Permission actions
- Configure ACL & Options (
core.admin) — full administration of the component. - Access Administration Interface (
core.manage) — open the admin views (dashboard, services, posts, rules, templates, tags, logs, analytics). - Create / Edit / Delete — manage services, posts, rules, templates and tags.
- Edit State (
core.edit.state) — change item state: approve/reject/send a queued post, publish or unpublish a service or rule. - Setup (
mokonyxsocial.setup) — run, complete or reset the first-run Setup Wizard. This is a privileged, non-CRUD action kept separate from full administration.
What is protected
Both the admin screens and the REST API enforce these actions. In particular:
- Dispatching a post to a third-party platform (admin Send or the REST dispatch endpoint) requires Edit State.
- Completing the Setup Wizard — which can write configuration and create service credentials — requires Setup.
- Testing a service, the preview panel, the tag-lookup and analytics APIs, and the receive (relay) endpoint all require Manage.
A valid login or API token alone is never sufficient — the matching permission must be granted.
Recommended group setup
- Administrators / Super Users — inherit full access, including Setup.
- Team members who run social — grant Access, Create, Edit and Edit State; add Setup only if they should run the wizard.
- Read-only reviewers — grant Access (Manage) alone so they can view dashboards and analytics without changing anything.