Permissions
Understanding the permission model that governs access across ThreeU.
Permission Model
ThreeU uses a granular, resource-based permission model. Each permission follows the format resource:operation and controls access to specific API endpoints.
Permissions are declared in plugin manifests and theme/app configurations. During installation, merchants review and approve the requested permissions.
Available Permissions
| Permission | Description |
|---|---|
products:read | View products and variants |
products:create | Create new products |
products:update | Update existing products |
orders:read | View order data |
orders:update | Modify order status |
inventory:read | View stock levels |
inventory:update | Adjust stock quantities |
customers:read | View customer profiles |
pos:sell | Process POS transactions |
analytics:read | Access analytics data |
shipping:write | Create and manage shipments |
collections:read_public | View published collections |
products:read_public | View published products |
cart:write | Manage shopping cart |
checkout:create | Initialize checkout sessions |
Permission Enforcement
Permissions are enforced at three levels:
- Manifest declaration — The plugin/theme declares what it needs
- Installation approval — The merchant reviews and approves
- Runtime enforcement — The API validates every request against the approved scope
If a plugin attempts an operation outside its approved permissions, ThreeU returns a 403 permission_denied error.