> For the complete documentation index, see [llms.txt](https://developer.abacum.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.abacum.ai/essentials/concepts/access-and-permissions.md).

# Access and permissions

Which endpoints each user role can call.

Every call runs as the user who owns the credentials. The role of that user decides which endpoints the call can reach.

## Access levels

| Level     | Who can call                              | Endpoints                                                                    |
| --------- | ----------------------------------------- | ---------------------------------------------------------------------------- |
| No token  | Anyone                                    | The token endpoint and `GET /public-api/api-spec`                            |
| Any token | Any user with a valid token               | `GET /public-api/me`, `GET /public-api/search` and the five Spaces endpoints |
| Admin     | A user with the Admin or Super admin role | Every other endpoint                                                         |

A Member who calls an Admin endpoint gets `403`.

## Endpoints by level

| Method | Endpoint                                                    | Level     |
| ------ | ----------------------------------------------------------- | --------- |
| POST   | `/server-authentication/oauth2/token/`                      | No token  |
| GET    | `/public-api/api-spec`                                      | No token  |
| GET    | `/public-api/me`                                            | Any token |
| GET    | `/public-api/search`                                        | Any token |
| GET    | `/public-api/spaces`                                        | Any token |
| GET    | `/public-api/spaces/{space_id}`                             | Any token |
| GET    | `/public-api/spaces/{space_id}/tables`                      | Any token |
| GET    | `/public-api/spaces/{space_id}/tables/{table_id}`           | Any token |
| GET    | `/public-api/spaces/{space_id}/tables/{table_id}/data`      | Any token |
| GET    | `/public-api/models`                                        | Admin     |
| GET    | `/public-api/scenarios`                                     | Admin     |
| GET    | `/public-api/variables`                                     | Admin     |
| GET    | `/public-api/models/{model_id}/logic`                       | Admin     |
| GET    | `/public-api/models/{model_id}/actuals_data`                | Admin     |
| GET    | `/public-api/models/{model_id}/scenario_data/{scenario_id}` | Admin     |
| GET    | `/public-api/models/{model_id}/rolling_data/{scenario_id}`  | Admin     |
| GET    | `/public-api/data-sets`                                     | Admin     |
| GET    | `/public-api/data-sets/{dataset_id}/raw_data`               | Admin     |
| GET    | `/public-api/data-sets/{dataset_id}/processed_data`         | Admin     |
| POST   | `/public-api/load-data`                                     | Admin     |

## What the user can see

Endpoints at the Any token level return only what the user can see. For example, `GET /public-api/spaces` lists only the spaces that the user can view. A Member and an Admin can both call it, and each gets a different list.

Search follows the same rule. A Member can search `variables`, `spaces`, `tables` and `all`. A Member who searches `models`, `scenarios` or `datasets` gets `403`.

## Restricted models and datasets

An admin can restrict a model or a dataset to named users. The list endpoints return only the models and datasets that the user can access. The `restricted` field shows whether an item is restricted.

A call for a restricted model or dataset that the user cannot access returns `403` or `404`, depending on the endpoint. To get access, ask an admin to share the resource with the user.