Get the caller's privilege packages

Returns, for each data area, which scope privileges the calling user holds and the IDs those scopes are matched against.

Seven packages, one per area (customer, project, contract, invoice, time tracking, approval, employee). Each tells a client which records the caller may work with — e.g. "all projects" versus "projects where I am project manager" — so it can pre-filter pickers and hide actions the server would reject. It always describes the token's own user (for a client-credentials token: the system service user); no parameter selects another user.

Use it to:

Decide at client start-up whether to show 'register for other employees' or approval features
Pre-filter project / customer pickers to what the user may see

Not for:

Checking another user's privileges — not possible
Page access or feature flags — see GET /v1/user-setting

Behaviour:

Idempotent.
Safe to retry.

See also: GET /v1/user-setting, GET /v1/user/me

curl -X GET "https://app3.timelog.com/your-account/api/v1/privilege/user-privileges" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

import requests
import json

url = "https://app3.timelog.com/your-account/api/v1/privilege/user-privileges"
headers = {
  "Content-Type": "application/json",
  "Authorization": "Bearer YOUR_API_TOKEN"
}

response = requests.get(url, headers=headers)
print(response.json())

const response = await fetch("https://app3.timelog.com/your-account/api/v1/privilege/user-privileges", {
  method: "GET",
  headers: {
  "Content-Type": "application/json",
  "Authorization": "Bearer YOUR_API_TOKEN"
}
});

const data = await response.json();
console.log(data);

package main

import (
    "fmt"
    "net/http"
)

func main() {

    req, err := http.NewRequest("GET", "https://app3.timelog.com/your-account/api/v1/privilege/user-privileges", nil)
    if err != nil {
        panic(err)
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    fmt.Println("Response Status:", resp.Status)
}

require 'net/http'
require 'json'

uri = URI('https://app3.timelog.com/your-account/api/v1/privilege/user-privileges')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

request = Net::HTTP::Get.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'

response = http.request(request)
puts response.body

{
  "Entities": [
    {
      "Properties": {
        "Type": 42,
        "PrivilegePackage": {}
      },
      "Links": [
        {
          "Href": "example_string",
          "Rel": "example_string"
        }
      ],
      "Actions": [
        {}
      ]
    }
  ],
  "Links": [
    {
      "Href": "example_string",
      "Rel": "example_string"
    }
  ]
}

GET

/v1/privilege/user-privileges

GET

Base URLstring

Target server for requests. Edit to use your own host.

Bearer Token

OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp). The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user. > Not yet documented: how to obtain a token. > Not yet documented: token lifetime.

Request Preview

Response

Response will appear here after sending the request

Authentication

header

Authorizationstring

Required

Bearer token. OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).

The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.

Not yet documented: how to obtain a token.

Not yet documented: token lifetime.

Responses

Entitiesarray

Omitted (not []) when the list is empty.

Linksarray

Was this page helpful?