Edit in GitHubLog an issue
Adobe Commerce only. Learn more

Manage company roles

Within a company, customers may have different job roles, levels of responsibility, and access to information about their company. B2B for Adobe Commerce defines several types of system resources, and the Company Admin (or an integration that operates on the behalf of the Company Admin) grants or denies access to these resources using company roles. The Company Admin has access to all resources.

B2B for Adobe Commerce defines the following types of resources:

  • Sales
  • Purchase Orders
  • Negotiable quotes
  • Company profile
  • Company user management
  • Company credit

Each of these resources contains a hierarchy of other resources. When a Company Admin grants or blocks access to a resource from the store UI, the action applies to all sub-resources, unless explicitly overridden. However, if you grant or block access using web APIs, you must specify each resource individually.

The following table lists all the resources that are available to the customers defined with a company. To visualize the resource hierarchy, log in to a store as the Company Admin and select Roles and Permissions, then click the Edit action next to the Default User role.

Display nameResource name
  All
Magento_Company::index
    Sales
Magento_Sales::all
      Allow Checkout
Magento_Sales::place_order
        Use Pay On Account method
Magento_Sales::payment_account
      View orders
Magento_Sales::view_orders
      View orders of subordinate users
Magento_Sales::view_orders_sub
    Quotes
Magento_NegotiableQuote::all
      View
Magento_NegotiableQuote::view_quotes
        Request, Edit, Delete
Magento_NegotiableQuote::manage
        Checkout with Quote
Magento_NegotiableQuote::checkout
      View quotes of subordinate users
Magento_NegotiableQuote::view_quotes_sub
  Order Approvals
Magento_PurchaseOrder::all
    View My Purchase Orders
Magento_PurchaseOrder:view_purchase_orders
      View for subordinates
Magento_PurchaseOrder:view_purchase_orders_for_subordinates
      View for all company
Magento_PurchaseOrder:view_purchase_orders_for_company
    Auto-approve POs created within this role
Magento_PurchaseOrder:autoapprove_purchase_order
    Approve Purchase Orders without other approvals
Magento_PurchaseOrder:super_approve_purchase_order
    View Approval Rules
Magento_PurchaseOrder:view_approval_rules
      Create, Edit and Delete
Magento_PurchaseOrder:manage_approval_rules
    Company Profile
Magento_Company::view
      Account Information (View)
Magento_Company::view_account
        Edit
Magento_Company::edit_account
      Legal Address (View)
Magento_Company::view_address
        Edit
Magento_Company::edit_address
      Contacts (View)
Magento_Company::contacts
      Payment Information (View)
Magento_Company::payment_information
      Shipping Information (View)
Magento_Company::shipping_information
    Company User Management
Magento_Company::user_management
      View roles and permissions
Magento_Company::roles_view
        Manage roles and permissions
Magento_Company::roles_edit
      View users and teams
Magento_Company::users_view
        Manage users and teams
Magento_Company::users_edit
    Company credit
Magento_Company::credit
      view
Magento_Company::credit_history

Manage company roles

The Company Admin controls the possible actions for each customer within the company by creating common roles with embedded permissions and then assigning them to company users. In most cases, a few roles will be sufficient to cover all the different possible combinations of permissions needed for a company.

Service Name:

companyRoleRepositoryV1

REST Endpoints:

Copied to your clipboard
POST /V1/company/role/
PUT /V1/company/role/:id
GET /V1/company/role/:roleId
DELETE /V1/company/role/:roleId
GET /V1/company/role/

RoleInterface Parameters:

The following table lists the parameters defined in RoleInterface.

NameDescriptionFormatRequirements
id
The role ID
integer
Required for updates and deletes
role_name
The label assigned to the role
string
Required to create a role
permissions
A list of resources and permissions granted to the role. See the Permissions array table below for details.
Array[string]
Required to create a role
company_id
The company associated with this role
integer
Required to create a role

Permissions array:

NameDescriptionFormatRequirements
id
The permission ID generated by Magento.
integer
Required for updates and deletes
role_id
The role ID to which the permission applies.
integer
Required to create a role
resource_id
The internal name of a Magento resource, such as Magento_Sales::place_order.
string
Required
permission
Either allow or deny.
string
Required

Create a role

This example creates a role named "Junior Buyer". It allows the assignee to access to all Sales resources except "View orders of subordinate users".

All resources that are not explicitly allowed are denied. You must specify the Magento_Company::index resource in all calls.

Sample Usage:

POST <host>/rest/<store_code>/V1/company/role

Copied to your clipboard
{
  "role": {
    "role_name":"Junior Buyer",
    "permissions":[
      {"resource_id": "Magento_Company::index", "permission":"allow"},
      {"resource_id": "Magento_Sales::all", "permission":"allow"},
      {"resource_id": "Magento_Sales::place_order", "permission":"allow"},
      {"resource_id": "Magento_Sales::payment_account", "permission":"allow"},
      {"resource_id": "Magento_Sales::view_orders", "permission":"allow"},
      {"resource_id": "Magento_Sales::view_orders_sub", "permission":"deny"}
      ],
    "company_id": 2
  }
}

Update a role

Each update call must include all resources the assignee will have access to.

This example call adds access to all Negotiable Quote resources except "View quotes of subordinate users" to the Junior Buyer role.

Sample Usage:

PUT <host>/rest/<store_code>/V1/company/role/6

Copied to your clipboard
{
  "role": {
    "id": 6,
    "permissions":[
      {"resource_id": "Magento_Company::index", "permission":"allow"},
      {"resource_id": "Magento_Sales::all", "permission":"allow"},
      {"resource_id": "Magento_Sales::place_order", "permission":"allow"},
      {"resource_id": "Magento_Sales::payment_account", "permission":"allow"},
      {"resource_id": "Magento_Sales::view_orders", "permission":"allow"},
      {"resource_id": "Magento_Sales::view_orders_sub", "permission":"deny"},
      {"resource_id": "Magento_NegotiableQuote::all", "permission":"allow"},
      {"resource_id": "Magento_NegotiableQuote::view_quotes", "permission":"allow"},
      {"resource_id": "Magento_NegotiableQuote::manage", "permission":"allow"},
      {"resource_id": "Magento_NegotiableQuote::checkout", "permission":"allow"},
      {"resource_id": "Magento_NegotiableQuote::view_quotes_sub", "permission":"deny"}
      ],
    "company_id": 2
  }
}

Return all information about a role

This call returns the id, role name, and set of permissions defined within the specified role_id.

Sample Usage:

GET <host>/rest/<store_code>/V1/company/role/6

Copied to your clipboard
// none

Delete a role

You cannot delete a role if it is the only role defined within the company.

Sample Usage:

DELETE <host>/rest/<store_code>/V1/company/role/5

Copied to your clipboard
// none

Search for a role

The following call returns all roles that have been created for a company (company_id = 2).

See Search using REST APIs for information about constructing a search query.

Sample Usage:

GET <host>/rest/<store_code>/V1/company/role?searchCriteria[filter_groups][0][filters][0][field]=company_id&searchCriteria[filter_groups][0][filters][0][value]=2&searchCriteria[filter_groups][0][filters][0][condition_type]=eq

Copied to your clipboard
// none
Jared HooverJeff MatthewsKevin Harper
Last updated 11/25/2023
Was this helpful?

Community

Support

Adobe Developer

  • Privacy
  • Terms of Use
  • Do not sell or share my personal information
  • AdChoices
Copyright © 2024 Adobe. All rights reserved.