openapi: 3.2.0
info:
  title: Cal.com API v2 Orgs / Roles / Permissions API
  description: ''
  version: 1.0.0
  contact: {}
servers: []
tags:
- name: Orgs / Roles / Permissions
paths:
  /v2/organizations/{orgId}/roles/{roleId}/permissions:
    post:
      description: 'Required membership role: `org admin`. PBAC permission: `role.update`. Learn more about API access control at https://cal.com/docs/api-reference/v2/access-control'
      operationId: OrganizationsRolesPermissionsController_addPermissions
      parameters:
      - name: Authorization
        in: header
        description: For non-platform customers - value must be `Bearer <token>` where `<token>` is api key prefixed with cal_
        required: false
        schema:
          type: string
      - name: x-cal-secret-key
        in: header
        description: For platform customers - OAuth client secret key
        required: false
        schema:
          type: string
      - name: x-cal-client-id
        in: header
        description: For platform customers - OAuth client ID
        required: false
        schema:
          type: string
      - name: orgId
        required: true
        in: path
        schema:
          type: number
      - name: roleId
        required: true
        in: path
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOrgRolePermissionsInput'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOrgRolePermissionsOutput'
      summary: Add permissions to an organization role (single or batch)
      tags:
      - Orgs / Roles / Permissions
      x-platform-plan: SCALE
    get:
      description: 'Required membership role: `org admin`. PBAC permission: `role.readOrgRoles`. Learn more about API access control at https://cal.com/docs/api-reference/v2/access-control'
      operationId: OrganizationsRolesPermissionsController_listPermissions
      parameters:
      - name: Authorization
        in: header
        description: For non-platform customers - value must be `Bearer <token>` where `<token>` is api key prefixed with cal_
        required: false
        schema:
          type: string
      - name: x-cal-secret-key
        in: header
        description: For platform customers - OAuth client secret key
        required: false
        schema:
          type: string
      - name: x-cal-client-id
        in: header
        description: For platform customers - OAuth client ID
        required: false
        schema:
          type: string
      - name: orgId
        required: true
        in: path
        schema:
          type: number
      - name: roleId
        required: true
        in: path
        schema:
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOrgRolePermissionsOutput'
      summary: List permissions for an organization role
      tags:
      - Orgs / Roles / Permissions
      x-platform-plan: SCALE
    put:
      description: 'Required membership role: `org admin`. PBAC permission: `role.update`. Learn more about API access control at https://cal.com/docs/api-reference/v2/access-control'
      operationId: OrganizationsRolesPermissionsController_setPermissions
      parameters:
      - name: Authorization
        in: header
        description: For non-platform customers - value must be `Bearer <token>` where `<token>` is api key prefixed with cal_
        required: false
        schema:
          type: string
      - name: x-cal-secret-key
        in: header
        description: For platform customers - OAuth client secret key
        required: false
        schema:
          type: string
      - name: x-cal-client-id
        in: header
        description: For platform customers - OAuth client ID
        required: false
        schema:
          type: string
      - name: orgId
        required: true
        in: path
        schema:
          type: number
      - name: roleId
        required: true
        in: path
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOrgRolePermissionsInput'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOrgRolePermissionsOutput'
      summary: Replace all permissions for an organization role
      tags:
      - Orgs / Roles / Permissions
      x-platform-plan: SCALE
    delete:
      description: 'Required membership role: `org admin`. PBAC permission: `role.update`. Learn more about API access control at https://cal.com/docs/api-reference/v2/access-control'
      operationId: OrganizationsRolesPermissionsController_removePermissions
      parameters:
      - name: Authorization
        in: header
        description: For non-platform customers - value must be `Bearer <token>` where `<token>` is api key prefixed with cal_
        required: false
        schema:
          type: string
      - name: x-cal-secret-key
        in: header
        description: For platform customers - OAuth client secret key
        required: false
        schema:
          type: string
      - name: x-cal-client-id
        in: header
        description: For platform customers - OAuth client ID
        required: false
        schema:
          type: string
      - name: orgId
        required: true
        in: path
        schema:
          type: number
      - name: roleId
        required: true
        in: path
        schema:
          type: string
      - name: permissions
        required: false
        in: query
        description: 'Permissions to remove (format: resource.action). Supports comma-separated values as well as repeated query params.'
        schema:
          example: ?permissions=eventType.read,booking.read
          type: array
          items:
            type: string
            enum:
            - '*.*'
            - role.create
            - role.read
            - role.readTeamRoles
            - role.readOrgRoles
            - role.update
            - role.delete
            - eventType.create
            - eventType.read
            - eventType.readTeamEventTypes
            - eventType.readOrgEventTypes
            - eventType.update
            - eventType.delete
            - calEvent.create
            - calEvent.read
            - calEvent.update
            - calEvent.delete
            - team.create
            - team.read
            - team.readOrgTeams
            - team.readTeamSettings
            - team.readConferencing
            - team.readVerifiedResources
            - team.readMemberships
            - team.update
            - team.delete
            - team.invite
            - team.remove
            - team.listMembers
            - team.listMembersPrivate
            - team.changeMemberRole
            - team.impersonate
            - organization.create
            - organization.read
            - organization.readMemberships
            - organization.readManagedOrganizations
            - organization.readDelegationCredentials
            - organization.listMembers
            - organization.listMembersPrivate
            - organization.readMemberAuditLogs
            - organization.invite
            - organization.remove
            - organization.manageBilling
            - organization.changeMemberRole
            - organization.impersonate
            - organization.passwordReset
            - organization.editUsers
            - organization.update
            - organization.delete
            - booking.read
            - booking.readOrgBookings
            - booking.readRecordings
            - booking.update
            - booking.updateOrgBookings
            - booking.reassignOrgPastBookings
            - booking.readOrgAuditLogs
            - insights.read
            - workflow.create
            - workflow.read
            - workflow.readTeamWorkflows
            - workflow.update
            - workflow.delete
            - organization.attributes.read
            - organization.attributes.update
            - organization.attributes.delete
            - organization.attributes.create
            - organization.attributes.readSyncHistory
            - organization.attributes.editUsers
            - organization.attributes.readAuditLogs
            - routingForm.create
            - routingForm.read
            - routingForm.readTeamRoutingForms
            - routingForm.readOrgRoutingForms
            - routingForm.update
            - routingForm.delete
            - routingForm.readOrgAuditLogs
            - routingForm.readResponsePii
            - webhook.create
            - webhook.read
            - webhook.readOrgWebhooks
            - webhook.update
            - webhook.delete
            - availability.readTeamAvailability
            - availability.readOrgAvailability
            - availability.updateOrgAvailability
            - availability.readOrgAuditLogs
            - ooo.readOrgOoo
            - watchlist.create
            - watchlist.read
            - watchlist.update
            - watchlist.delete
            - featureOptIn.read
            - featureOptIn.update
            - organization.customDomain.create
            - organization.customDomain.read
            - organization.customDomain.update
            - organization.customDomain.delete
            - tag.create
            - tag.update
            - tag.delete
      responses:
        '204':
          description: ''
      summary: Remove multiple permissions from an organization role
      tags:
      - Orgs / Roles / Permissions
      x-platform-plan: SCALE
  /v2/organizations/{orgId}/roles/{roleId}/permissions/{permission}:
    delete:
      description: 'Required membership role: `org admin`. PBAC permission: `role.update`. Learn more about API access control at https://cal.com/docs/api-reference/v2/access-control'
      operationId: OrganizationsRolesPermissionsController_removePermission
      parameters:
      - name: Authorization
        in: header
        description: For non-platform customers - value must be `Bearer <token>` where `<token>` is api key prefixed with cal_
        required: false
        schema:
          type: string
      - name: x-cal-secret-key
        in: header
        description: For platform customers - OAuth client secret key
        required: false
        schema:
          type: string
      - name: x-cal-client-id
        in: header
        description: For platform customers - OAuth client ID
        required: false
        schema:
          type: string
      - name: orgId
        required: true
        in: path
        schema:
          type: number
      - name: roleId
        required: true
        in: path
        schema:
          type: string
      - name: permission
        required: true
        in: path
        schema:
          type: string
      responses:
        '204':
          description: ''
      summary: Remove a permission from an organization role
      tags:
      - Orgs / Roles / Permissions
      x-platform-plan: SCALE
components:
  schemas:
    GetOrgRolePermissionsOutput:
      type: object
      properties:
        status:
          type: string
          enum:
          - success
          example: success
        data:
          type: array
          items:
            type: string
      required:
      - status
      - data
    CreateOrgRolePermissionsInput:
      type: object
      properties:
        permissions:
          type: array
          items:
            type: string
            enum:
            - '*.*'
            - role.create
            - role.read
            - role.readTeamRoles
            - role.readOrgRoles
            - role.update
            - role.delete
            - eventType.create
            - eventType.read
            - eventType.readTeamEventTypes
            - eventType.readOrgEventTypes
            - eventType.update
            - eventType.delete
            - calEvent.create
            - calEvent.read
            - calEvent.update
            - calEvent.delete
            - team.create
            - team.read
            - team.readOrgTeams
            - team.readTeamSettings
            - team.readConferencing
            - team.readVerifiedResources
            - team.readMemberships
            - team.update
            - team.delete
            - team.invite
            - team.remove
            - team.listMembers
            - team.listMembersPrivate
            - team.changeMemberRole
            - team.impersonate
            - organization.create
            - organization.read
            - organization.readMemberships
            - organization.readManagedOrganizations
            - organization.readDelegationCredentials
            - organization.listMembers
            - organization.listMembersPrivate
            - organization.readMemberAuditLogs
            - organization.invite
            - organization.remove
            - organization.manageBilling
            - organization.changeMemberRole
            - organization.impersonate
            - organization.passwordReset
            - organization.editUsers
            - organization.update
            - organization.delete
            - booking.read
            - booking.readOrgBookings
            - booking.readRecordings
            - booking.update
            - booking.updateOrgBookings
            - booking.reassignOrgPastBookings
            - booking.readOrgAuditLogs
            - insights.read
            - workflow.create
            - workflow.read
            - workflow.readTeamWorkflows
            - workflow.update
            - workflow.delete
            - organization.attributes.read
            - organization.attributes.update
            - organization.attributes.delete
            - organization.attributes.create
            - organization.attributes.readSyncHistory
            - organization.attributes.editUsers
            - organization.attributes.readAuditLogs
            - routingForm.create
            - routingForm.read
            - routingForm.readTeamRoutingForms
            - routingForm.readOrgRoutingForms
            - routingForm.update
            - routingForm.delete
            - routingForm.readOrgAuditLogs
            - routingForm.readResponsePii
            - webhook.create
            - webhook.read
            - webhook.readOrgWebhooks
            - webhook.update
            - webhook.delete
            - availability.readTeamAvailability
            - availability.readOrgAvailability
            - availability.updateOrgAvailability
            - availability.readOrgAuditLogs
            - ooo.readOrgOoo
            - watchlist.create
            - watchlist.read
            - watchlist.update
            - watchlist.delete
            - featureOptIn.read
            - featureOptIn.update
            - organization.customDomain.create
            - organization.customDomain.read
            - organization.customDomain.update
            - organization.customDomain.delete
            - tag.create
            - tag.update
            - tag.delete
          description: 'Permissions to add (format: resource.action)'
          example:
          - eventType.read
          - booking.read
      required:
      - permissions
x-provenance:
  method: harvested
  publisher: Cal.com
  source: https://cal.com/docs/api-reference/v2/openapi.json
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)