Admin Overrides

Per-user grant and deny overrides that bypass role-based permissions.

Admin overrides let you grant or deny specific permissions for individual users, bypassing the normal role evaluation. Overrides are evaluated first in the permission check pipeline, before roles, ABAC, or ReBAC.

How overrides work

Effect	Behavior
GRANT	Allows a capability even if the user's role does not include it
DENY	Blocks a capability even if the user's role includes it

Overrides are useful for:

• Temporarily elevating a user's access for a specific task
• Blocking a compromised user from sensitive actions
• Exceptions that do not warrant creating a new role

Creating an override

Every override requires a reason (minimum 10 characters) to ensure accountability.

curl -X POST https://api.platformxe.com/api/v1/permissions/overrides \
  -H "Content-Type: application/json" \
  -H "x-api-key: pxk_live_your_api_key_here" \
  -d '{
    "adminId": "user_xyz789",
    "path": "invoices",
    "action": "delete",
    "effect": "DENY",
    "reason": "Pending audit investigation — block invoice deletion",
    "expiresAt": "2026-05-01T00:00:00.000Z"
  }'

await px.permissions.createOverride({
  adminId: 'user_xyz789',
  path: 'invoices',
  action: 'delete',
  effect: 'DENY',
  reason: 'Pending audit investigation — block invoice deletion',
  expiresAt: '2026-05-01T00:00:00.000Z',
});

Expiring overrides

The optional expiresAt field sets an automatic expiry in UTC. After the expiry time, the override is no longer evaluated — the user falls back to normal role-based evaluation.

Listing overrides for a user

curl https://api.platformxe.com/api/v1/permissions/overrides/user_xyz789 \
  -H "x-api-key: pxk_live_your_api_key_here"

const overrides = await px.permissions.listOverrides('user_xyz789');

Removing an override

curl -X DELETE https://api.platformxe.com/api/v1/permissions/overrides/remove/ovr_abc123 \
  -H "x-api-key: pxk_live_your_api_key_here"