Permissions

Your integration carries a set of boolean permission flags. Each endpoint checks the one it needs, and returns 403 if it is not granted:

{
  "detail": "Permission 'allow_order_creation' is required but not granted for this integration"
}

Inspecting your own permissions

Rather than discovering limits by trial and error, ask:

curl "$ALRIK_API_BASE/v1/integration" \
  -H "x-api-key: $ALRIK_API_KEY"

GET /v1/integration needs no permission beyond a valid key, and returns your flags alongside the locations you may act on. It is worth calling once at integration time and asserting on the flags your code depends on.

The flags

Flag	Grants
allow_order_creation	Create an order draft and update shipment details
allow_order_updating	Update an order
allow_order_cancellation	Cancel an order
allow_fetching_orders	Reading orders, order drafts, active and billable tours, and the engagement report
allow_fetching_company_orders	List company orders across every location in the company
allow_location_creation	Create a location
allow_progressing_orders	The carrier endpoints — status, proof of delivery and cost reporting
allow_fetching_billing_data	Widens billable tours from your locations to the whole company
allow_vehicle_management	The vehicle endpoints — list, create, update and delete vehicles

Worth noting:

• allow_order_creation also covers shipment updates, so an integration that can create an order can also amend its packing details.
• allow_fetching_orders covers every read endpoint except company orders and vehicles — order drafts, orders, active and billable tours and the engagement report.
• allow_vehicle_management covers reading vehicles as well as changing them.

Company-scoped endpoints

Some endpoints need the integration to be bound to a company, not just to locations. If it is not, they return:

{ "detail": "Forbidden" }

That applies to company orders and to all SCIM endpoints.

Permissions are not the only gate

A permission grants an operation. It does not grant access to a location — that is checked separately, and independently, on every request. An integration with allow_order_creation can still get 403 Invalid location id if it names a location it does not own. See Locations.