# Roles & permissions

Control which school users can view, create, edit, export and manage records.

Category: Administration
Guide: https://avkul.in/docs/guides/module-access-control/
Guided sample demo: https://avkul.in/docs/demo/module-access-control/
Snapshot: 11 October 2026

## Features

- Role catalogue
- Permission catalogue
- Role grants
- User assignment

## Access and setup

Intended access: Assigned account with the required permissions
- An assigned school account with the required permissions.
- The academic, student or staff setup used by this workflow.

Permission keys: role:view, role:create, role:update, role:delete, role:manage

## Workflow

1. Open a role and inspect its existing permissions.
2. Choose only the required permission keys.
3. Save the role and assign eligible users.
4. Sign in as the affected role to review access.

## Fields and controls

- name (string, optional)
- key (string, declared required)
- description (string, optional)
- permissionKeys (string[], declared required)
- userId (string, declared required)

## Current limits

- A role name alone does not grant platform administration. School scope and explicit guards still apply.

## Actual application access

- https://avkul.in/en/school/settings/roles
- https://avkul.in/en/school/settings/roles — select the actual record from this list.

## API reference

- GET /api/v1/access-control/roles — List; role:view
- GET /api/v1/access-control/permissions — Permission Catalog; role:view
- GET /api/v1/access-control/roles/:id — Get; role:view
- POST /api/v1/access-control/roles — Create; role:create
- PATCH /api/v1/access-control/roles/:id — Update; role:update
- DELETE /api/v1/access-control/roles/:id — Remove; role:delete
- PUT /api/v1/access-control/roles/:id/permissions — Set Permissions; role:manage
- GET /api/v1/access-control/roles/:id/assignable-users — Assignable Users; role:manage
- POST /api/v1/access-control/roles/:id/users — Assign User; role:manage
- DELETE /api/v1/access-control/roles/:id/users/:userId — Unassign User; role:manage

## Demo access

No login is required for the guided sample demo. Its fictional records and actions stay in this browser tab; they do not modify ERP records or send messages/payments. An assigned account is required for the actual ERP links.

Source inventory checked on 11 October 2026. This source inventory is not a certification of every external provider or device flow.