# Authentication

These endpoints provide authorization primitives for verifying user permissions and
bootstrapping new user access within the Content Intelligence Platform.

The platform uses a role-based access control (RBAC) model managed by the Authorization
service. Roles carry named permissions, and users are assigned one or more roles either
explicitly or via [User Groups](#tag/User-Groups).

- `has-permission` — check whether the calling user holds a specific named permission;
  use this as a guard in custom integrations before performing sensitive operations
- `assign-default-role` — assign the platform default role to a user, typically called
  during user provisioning or invite acceptance flows

For fine-grained, resource-level access decisions (e.g., "can this user access this
specific document?"), see [Access Control](#tag/Access-Control).
For managing the roles themselves, see [Roles](#tag/Roles).


## Check user permission

 - [POST /api/v1/authz/has-permission](https://api.tenovos.com/openapi/content-intelligence/authentication/tenovos.authz.authzservice.haspermission.md): Checks whether the authenticated user holds all of the specified permission IDs.

Request:
permissionIds   - List of permission IDs that the user must possess. Returns true if
the user has all specified permissions, or if the list is empty.

Response:
hasPermission   - True if the user holds every permission in the request; false otherwise.

## Assign default role

 - [POST /api/v1/authz/assign-default-role](https://api.tenovos.com/openapi/content-intelligence/authentication/tenovos.authz.authzservice.assigndefaultrole.md): Assigns the appropriate default role to a newly onboarded user within the organization.

Request:
userId   - The ID of the user to assign a default role to. The first user in an org
receives the default admin role; subsequent users receive the standard org user role.

Response:
(empty)