Endpoint permissions

A proxy’s allowlist pairs API paths with HTTP methods. Access requires both to match. Allowing GET /api/v3/movie does not allow POST /api/v3/movie, or a different path.

Edit permissions

Open a proxy’s Endpoints tab. Search for the API path, enable or disable the required methods, and choose Save configuration. Review the added and removed counts before saving. Draft changes do not take effect until saved.

The editor uses the upstream OpenAPI specification to describe endpoints. Access warnings can help identify a missing call, but a blocked request is evidence of an attempted operation, not a reason by itself to grant it.

Prefer the smallest set needed by the integration’s enabled features. An integration’s test button may use a different endpoint from its normal work.

Templates and local overrides

The effective allowlist starts with the app template’s block for this service type. Local overrides then replace the entire method list for a path.

For example, suppose a template grants:

{
  "/api/v3/movie": ["get", "post"]
}

These local overrides leave only GET on that path:

{
  "/api/v3/movie": ["get"]
}

An empty list denies every method on that path:

{
  "/api/v3/movie": []
}

Removing the override makes the path inherit its template again. It does not mean “deny.” Likewise, clearing all overrides on a templated app returns to the template’s grants.

Parameterized paths

A route such as /api/v3/movie/{id} matches different IDs. Granting it permits that method for every matching ID. Query parameters and request-body fields are not separate permission rules.

For example, allowing an upstream command endpoint can permit several actions selected by the JSON body. Review what the upstream endpoint can do before granting it; a narrow path name does not necessarily imply a narrow action.

Review changes and restore

The proxy’s History tab records configuration revisions, including manual edits, grants from access warnings, template-sync preservation, and restores.

Restoring a revision restores its local endpoint overrides and active state, using the current app template as the inherited baseline. It does not rewind the template repository, recover a deleted proxy, or restore an old key. A restore creates another revision.

For a broader review, use Tools → Recent changes. See Templates for the permission changes a sync can make automatically.