# How do the "Permissions" options work?

**URL:** <https://discourse.getcockpit.com/t/how-do-the-permissions-options-work/2030>\
**Category:** Support\
**Created:** [August 6, 2021, 11:45am UTC](https://discourse.getcockpit.com/t/how-do-the-permissions-options-work/2030 "2021-08-06T11:45:00Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![MarcTabaries](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/marctabaries/32/867_2.png) [@MarcTabaries](https://discourse.getcockpit.com/u/MarcTabaries)\
**Post date:** [August 6, 2021, 11:45am UTC](https://discourse.getcockpit.com/t/how-do-the-permissions-options-work/2030/1 "2021-08-06T11:45:00Z")

</div>

Who can explain to me what these options are for in Cockpit ? I can’t find anything in the documentation.

This (in Collections) :

 ![Capture d’écran 2021-08-05 à 20.21.29](https://canada1.discourse-cdn.com/flex030/uploads/getcockpit/original/1X/879acee5daab0124718ad41166a9901588bb226c.png)  
 ![Capture d’écran 2021-08-06 à 08.53.46](https://canada1.discourse-cdn.com/flex030/uploads/getcockpit/original/1X/076ad1d793b3701b06ed293cb53fdcfd1cfaef52.png)  
 ![Capture d’écran 2021-08-05 à 20.21.35](https://canada1.discourse-cdn.com/flex030/uploads/getcockpit/original/1X/547fbbe84046b62890bb78a209618403276f81c3.png)

And this (in Singletons) :

 ![Capture d’écran 2021-08-05 à 20.20.31](https://canada1.discourse-cdn.com/flex030/uploads/getcockpit/original/1X/f4d8a8dc691bded28d09a8ecbab5934fcdb57e58.png)

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![abernh](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/abernh/32/859_2.png) [@abernh](https://discourse.getcockpit.com/u/abernh)\
**Post date:** [August 6, 2021, 1:17pm UTC](https://discourse.getcockpit.com/t/how-do-the-permissions-options-work/2030/2 "2021-08-06T13:17:42Z")

</div>

The permissions are for access to the data via the API (and the admin interface) and they are split up into specific “actions”.

### Actions and their API endpoints

#### Collections

- Edit collection : `/api/collections/updateCollection/COLLECTION_NAME` + `{data: ...}`
- View entries : `/api/collections/entries/COLLECTION_NAME` / `/api/collections/entry/COLLECTION_NAME/ENTRY_ID`
- Edit entries : `/api/collections/save/COLLECTION_NAME` + `{data: {_id: ENTRY_ID, ...}}`
- Create entries : `/api/collections/save/COLLECTION_NAME` + `{data: {_id: undefined, ...}}`
- Delete entries : `/api/collections/remove/COLLECTION_NAME` + {filter: …}

#### Singletons

- Form : admin interface only; no api route - edit the singletons values
- Edit : admin interface only; no api route - edit the singletons fields
- Get data (like “view”) : `/api/singletons/get/SINGLETON_NAME[/FIELD_NAME]`

### Public (and other groups)

You can set those permissions on a group level.  
By default only the “public” group is shown; as soon as you have [other groups specified (in your `config.php`](https://discourse.getcockpit.com/t/where-to-create-user-groups/1182/7) ) you can set also permissions for those other groups; this also means if you have other groups than admin you are setting the permission for those group-users to access that data via the API as well as the admin interface (if the group has admin interface access).

_IMPORTANT_: If you enable any of the permissions to be public anyone can execute that action on your API without the need of a token or any authentication. E.g. “view entries” → this will make the whole contents of your collection available to anyone who wants to query it.

### Collection rule “scripts”

For “create”, “read”, “update”, “delete” you have the possibility to run the request through an additional script. Those are en/abled below the general permissions.

Those scripts are included when the request is processed and receive a `$context` of the query (data sent, filters set, etc) and allow you to edit that `$context` (filter, enhance, validate, …) before it is send to the user (on read) / the database (on write)

See

> <https://github.com/agentejo/cockpit/blob/568b0124352f6d27df359e8c19a70d2dd1961e87/modules/Collections/bootstrap.php#L659>

### Content preview

This can be found here [Missing documentation of Content Preview](https://discourse.getcockpit.com/t/missing-documentation-of-content-preview/1890)

---

<div class="post-metadata">

**Author:** ![MarcTabaries](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/marctabaries/32/867_2.png) [@MarcTabaries](https://discourse.getcockpit.com/u/MarcTabaries)\
**Post date:** [August 9, 2021, 10:36am UTC](https://discourse.getcockpit.com/t/how-do-the-permissions-options-work/2030/3 "2021-08-09T10:36:40Z")

</div>

Okay, thanks for the feedback.

I understand things better.

On the other hand, I have other questions:

1/ To retrieve the information from my Shop collection, I use this endpoint (this is what is indicated in the [documentation](https://getcockpit.com/documentation/modules/collections)) : /api/collections/get/shop?token=XXX (to get all the items in the shop) or /api/collections/get/shop?token=XXX&filter[slug]=XXX (to get a particular item), whereas you seem to be using this endpoint : /api/collections/entries/shop (to get all items in the shop) and /api/collections/entry/shop/XXX (to get a particular item). What I am doing is not right ?

2/ If I activate the “View entries” option in public mode. It is not possible to activate filters or sorting. For example: /api/collections/get/shop&filter[published]=true&sort[order]=1 ?

3/ Where can I find an example of code to put in the script section, in order to have an idea of what it is possible to do ?

---

<div class="post-metadata">

**Author:** ![abernh](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/abernh/32/859_2.png) [@abernh](https://discourse.getcockpit.com/u/abernh)\
**Post date:** [August 9, 2021, 11:26am UTC](https://discourse.getcockpit.com/t/how-do-the-permissions-options-work/2030/4 "2021-08-09T11:26:00Z")

</div>

1/  
`/get/` is working but labeled “deprecated”.  
`/entries/` is the “new” `/get/` and you can retrieve none or all or any amount inbetween of entries with the return format `{fields: [], entries: [], total: int}`

`/entry/` returns the first entry fitting the given filter params and returns that data object directly (no wrapper like `/entries/`)

2/  
There is a mistake in how you appended your parameters  
wrong with `&`: `/api/collections/get/shop&filter[published]=true&sort[order]=1`  
correct with `?` : `/api/collections/get/shop?filter[published]=true&sort[order]=1`

And filters and ordering are by default available.

3/  
For the “rules” scripts, you can find some in @raffaelj `s script collection

> **[cockpit-scripts/permissions at master · raffaelj/cockpit-scripts](https://github.com/raffaelj/cockpit-scripts/tree/master/permissions)**
>
> master/permissions

They all operate on the `$context` variable which is always different for the different rules.  
Just search the [/modules/Collections/bootstrap.php](https://github.com/agentejo/cockpit/blob/568b0124352f6d27df359e8c19a70d2dd1961e87/modules/Collections/bootstrap.php) for `_check_collection_rule` and you can see how that object is setup in the different cases of create, read, update, delete.

---

<div class="post-metadata">

**Author:** ![MarcTabaries](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/marctabaries/32/867_2.png) [@MarcTabaries](https://discourse.getcockpit.com/u/MarcTabaries)\
**Post date:** [August 9, 2021, 12:59pm UTC](https://discourse.getcockpit.com/t/how-do-the-permissions-options-work/2030/5 "2021-08-09T12:59:15Z")

</div>

> [@abernh](#):
>
> There is a mistake in how you appended your parameters

Yes, indeed ! I am stupid !

Thanks again for your feedback !

---

<div class="post-metadata">

**Author:** ![MarcTabaries](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/marctabaries/32/867_2.png) [@MarcTabaries](https://discourse.getcockpit.com/u/MarcTabaries)\
**Post date:** [August 10, 2021, 1:55pm UTC](https://discourse.getcockpit.com/t/how-do-the-permissions-options-work/2030/6 "2021-08-10T13:55:19Z")

</div>

Just one more thing.  
In the Singletons, Permissions section, the Form option is used to modify the Singleton structure (fields, etc…) directly via the API?

---

<div class="post-metadata">

**Author:** ![abernh](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/abernh/32/859_2.png) [@abernh](https://discourse.getcockpit.com/u/abernh)\
**Post date:** [August 10, 2021, 2:43pm UTC](https://discourse.getcockpit.com/t/how-do-the-permissions-options-work/2030/7 "2021-08-10T14:43:31Z")

</div>

The singletons can not be edited via the API but only retrieved.

The permission for `Form` is only for the admin interface route  
`/cockpit/singletons/form/SINGLETON_NAME`  
which shows the form to edit a singletons values.

---

<div class="post-metadata">

**Author:** ![MarcTabaries](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/marctabaries/32/867_2.png) [@MarcTabaries](https://discourse.getcockpit.com/u/MarcTabaries)\
**Post date:** [August 10, 2021, 3:59pm UTC](https://discourse.getcockpit.com/t/how-do-the-permissions-options-work/2030/8 "2021-08-10T15:59:12Z")

</div>

Ok, thanks for this feedback !