Groups and Permissions

Manage groups, individual permissions and RFID cards via the REST API.

Managing groups

Groups are stored as a synchronized list resource at labcontrol.groups. You need LAB_ADMIN, IS_ADMIN, or LAB_SEE_GROUPS permissions to read groups and LAB_MODIFY_GROUPS to modify them.

List all groups

curl http://your-server/api/lists/labcontrol.groups \
  -H "Authorization: Bearer $TOKEN"

[
  {
    "data": {
      "name": "Woodworking",
      "description": "Access to all woodworking machines",
      "systemGroup": false,
      "entities": [],
      "uuid": "a1b2c3d4e5f67890abcdef1234567890"
    },
    "uuid": "a1b2c3d4e5f67890abcdef1234567890"
  }
]

The system automatically creates three system groups for the built-in roles mem, empl, and ext. Groups with systemGroup: true should not be modified manually.

Create a new group

curl -X POST http://your-server/api/services/lab/addGroup \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Electronics Lab",
    "description": "Access to soldering stations and measurement equipment"
  }'

Requires LAB_ADMIN, LAB_SERVICE, or LAB_MODIFY_GROUPS.

Update group properties

curl -X PATCH http://your-server/api/lists/labcontrol.groups/a1b2c3d4e5f67890abcdef1234567890 \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "data": {
      "description": "Access to all woodworking and CNC machines"
    }
  }'

Delete a group

curl -X DELETE http://your-server/api/lists/labcontrol.groups/a1b2c3d4e5f67890abcdef1234567890 \
  -H "Authorization: Bearer $TOKEN"

Group entities (machines in a group)

Each group has a nested list of entities (the machines and resources it grants access to). This list is accessible at labcontrol.groups.entities.{groupUUID}:

curl http://your-server/api/lists/labcontrol.groups.entities.a1b2c3d4e5f67890abcdef1234567890 \
  -H "Authorization: Bearer $TOKEN"

[
  {
    "data": {
      "resourceID": "laser-cutter-01",
      "type": 0,
      "active": true,
      "expires": false,
      "expirationDate": "",
      "creationDate": "2024-01-10T14:00:00.000"
    },
    "uuid": "..."
  }
]

Add a machine to a group

curl -X POST http://your-server/api/lists/labcontrol.groups.entities.a1b2c3d4e5f67890abcdef1234567890 \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "data": {
      "resourceID": "reflow-oven-01",
      "active": true,
      "expires": false
    }
  }'

Remove a machine from a group

curl -X DELETE http://your-server/api/lists/labcontrol.groups.entities.a1b2c3d4e5f67890abcdef1234567890/ENTITY_UUID \
  -H "Authorization: Bearer $TOKEN"

User group assignments

Group assignments for a user are stored as a nested list at labcontrol.users.groups.{userUUID}. Each entry represents a group membership with optional expiration.

List group assignments

curl http://your-server/api/lists/labcontrol.users.groups.f47ac10b58cc4372a5670e02b2c3d479 \
  -H "Authorization: Bearer $TOKEN"

[
  {
    "data": {
      "groupID": "a1b2c3d4e5f67890abcdef1234567890",
      "active": true,
      "expires": false,
      "expirationDate": "",
      "creationDate": "2024-01-10T14:00:00.000",
      "type": 0
    },
    "uuid": "..."
  }
]

Assign a group to a user

curl -X POST http://your-server/api/lists/labcontrol.users.groups.f47ac10b58cc4372a5670e02b2c3d479 \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "data": {
      "groupID": "b2c3d4e5f67890abcdef1234567890a1",
      "active": true,
      "expires": false
    }
  }'

Assign with expiration date

curl -X POST http://your-server/api/lists/labcontrol.users.groups.f47ac10b58cc4372a5670e02b2c3d479 \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "data": {
      "groupID": "b2c3d4e5f67890abcdef1234567890a1",
      "active": true,
      "expires": true,
      "expirationDate": "2025-03-31T23:59:59.000"
    }
  }'

Deactivate a group assignment

curl -X PATCH http://your-server/api/lists/labcontrol.users.groups.f47ac10b58cc4372a5670e02b2c3d479/MEMBERSHIP_UUID \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "data": {
      "active": false
    }
  }'

Remove a group assignment

curl -X DELETE http://your-server/api/lists/labcontrol.users.groups.f47ac10b58cc4372a5670e02b2c3d479/MEMBERSHIP_UUID \
  -H "Authorization: Bearer $TOKEN"

Individual permissions

Permissions for a specific user are stored at labcontrol.users.permissions.{userUUID}. Each entry grants access to a specific resource (machine).

List user permissions

curl http://your-server/api/lists/labcontrol.users.permissions.f47ac10b58cc4372a5670e02b2c3d479 \
  -H "Authorization: Bearer $TOKEN"

[
  {
    "data": {
      "resourceID": "laser-cutter-01",
      "type": 0,
      "active": true,
      "expires": true,
      "expirationDate": "2025-06-30T23:59:59.000",
      "creationDate": "2024-01-10T14:00:00.000"
    },
    "uuid": "..."
  }
]

Grant a permission

curl -X POST http://your-server/api/lists/labcontrol.users.permissions.f47ac10b58cc4372a5670e02b2c3d479 \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "data": {
      "resourceID": "cnc-mill-02",
      "active": true,
      "expires": false
    }
  }'

Revoke a permission

curl -X DELETE http://your-server/api/lists/labcontrol.users.permissions.f47ac10b58cc4372a5670e02b2c3d479/PERMISSION_UUID \
  -H "Authorization: Bearer $TOKEN"

Note:

When checking access, 2log first checks the system groups (based on the user’s role), then custom group assignments, and finally individual user permissions. A user has access if any of these sources grants it.

User cards

RFID cards assigned to a user are stored at labcontrol.users.cards.{userUUID}:

curl http://your-server/api/lists/labcontrol.users.cards.f47ac10b58cc4372a5670e02b2c3d479 \
  -H "Authorization: Bearer $TOKEN"

Check if a user has permission

The hasPermission method checks if a user or card has access to a specific resource. It evaluates system groups, custom groups, and individual permissions in one call. Requires LAB_SERVICE permissions.

By user ID:

curl -X POST http://your-server/api/services/lab/hasPermission \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "userID": "f47ac10b58cc4372a5670e02b2c3d479",
    "resourceID": "laser-cutter-01"
  }'

By card ID:

curl -X POST http://your-server/api/services/lab/hasPermission \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "cardID": "04:A3:2B:1C:D4:E5:F6",
    "resourceID": "laser-cutter-01"
  }'