> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squadvault.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

> Required API key permissions for each Public API endpoint.

Each organization API key carries a permission set. Endpoints require a matching permission. A valid key with the wrong permissions returns `403`.

Dashboard session routes (organization settings, Discord, billing, audit) are **not** on this map. They require an owner or admin membership and reject API keys. Organization data export, owner transfer, and organization delete are **owner session only**.

Paths below are relative to the Public API base URL `https://api.squadvault.xyz/v1`.

## Permission map

### Teams

| Endpoint                               | Permission    |
| -------------------------------------- | ------------- |
| `GET /teams/{organizationId}`          | `team:read`   |
| `GET /teams/{organizationId}/{teamId}` | `team:read`   |
| `POST /teams`                          | `team:create` |
| `PATCH /teams/{teamId}`                | `team:update` |
| `DELETE /teams/{teamId}`               | `team:delete` |

### Players

| Endpoint                                   | Permission      |
| ------------------------------------------ | --------------- |
| `GET /players/{organizationId}`            | `player:read`   |
| `GET /players/{organizationId}/{playerId}` | `player:read`   |
| `POST /players`                            | `player:create` |
| `PATCH /players/{playerId}`                | `player:update` |
| `DELETE /players/{playerId}`               | `player:delete` |

### Documents

| Endpoint                               | Permission        |
| -------------------------------------- | ----------------- |
| `GET /documents/{organizationId}`      | `document:read`   |
| `GET /documents/{documentId}/download` | `document:read`   |
| `POST /documents`                      | `document:create` |
| `PATCH /documents/{documentId}`        | `document:update` |
| `DELETE /documents/{documentId}`       | `document:delete` |

### Tryout applications

| Endpoint                                                      | Permission                          |
| ------------------------------------------------------------- | ----------------------------------- |
| `GET /tryout-applications`                                    | `tryout:read`                       |
| `GET /tryout-applications/{applicationId}`                    | `tryout:read`                       |
| `PATCH /tryout-applications/{applicationId}`                  | `tryout:update`                     |
| `POST /tryout-applications/{applicationId}/convert-to-player` | `tryout:update` and `player:create` |

Tryout list and get require `organizationId` as a query parameter. Tryout update and convert require `organizationId` in the JSON body. API keys need `tryout:update` to change status; converting also needs `player:create`.

### Uploads

| Endpoint                      | Permission        |
| ----------------------------- | ----------------- |
| `POST /uploads/document-file` | `document:create` |

<Note>
  Requesting a document upload URL checks `document:create` on the organization, because the upload exists to create a document afterward.
</Note>

## Least privilege

Grant only the permissions your integration needs. For a read-only bot, enable `team:read`, `player:read`, and `document:read`. Add `tryout:read` when the integration should list or inspect applications, and `tryout:update` to change status or notes. To add an applicant to the roster, also grant `player:create`. For document automation, add `document:create`, `document:update`, and `document:delete` as required.