---
title: Introduction
slug: api-documentation/rGz4-introduction
docTags: 
createdAt: 2026-09-25T14:18:13.226Z
---

REST API for the Profile Permissions Service.

This API provides:

- Permission checking for users
- User permission queries
- Role CRUD operations
- User-role assignments

**Authentication:** All endpoints require a valid JWT token via Bearer authentication.
Tenant context is extracted from the JWT token or X-Tenant-Id header.

**Note:** Service registration is handled via gRPC only (port 9090).
Health and metrics endpoints are internal monitoring and not part of this spec.

## Required Permissions

Each endpoint requires specific permissions. Users can access their own data without
special grants; accessing other users' data requires explicit permissions.

| Permission                              | Description                                      |
| --------------------------------------- | ------------------------------------------------ |
| `profile-permissions.users.check`       | Check permissions for other users                |
| `profile-permissions.users.read`        | View other users' permissions and roles          |
| `profile-permissions.users.roles.write` | Assign or revoke roles for users                 |
| `profile-permissions.roles.list`        | List all roles                                   |
| `profile-permissions.roles.read`        | View role definitions and their permissions      |
| `profile-permissions.roles.write`       | Create and update roles, manage role permissions |
| `profile-permissions.roles.delete`      | Delete roles                                     |
| `profile-permissions.services.read`     | View registered services and their permissions   |