Documentation › Nexus Hospitality › Securing

Securing Nexus Hospitality

Roles, module permissions, and the API paths each permission governs.

How access is decided

Every request passes three gates, in order. A failure at any gate is a refusal, and a later gate never widens what an earlier one denied.

Authentication — a valid session. See Identity and sign-in.
Entity scope — the request is bound to the company the user is signed in to. Someone with access to two entities still cannot read across both in one call.
Module permission — the role must grant the action on the module that owns the route, per the table below.

Granting Administration is not the same as granting every module. Administration governs users, roles and configuration; transactional modules are granted individually.

Module permission matrix

0 modules. The last column lists the API paths each module actually governs, taken from the enforcement map inside the application rather than from documentation.

Module	Key	Actions	Governs