Skip to content

Authorization Matrix

Roles in clubs are member and admin.

  • admin can perform all member actions.
  • Some actions are owner/author-scoped in addition to membership.
CapabilityAuthenticated (not member)Club MemberClub Admin
List clubs (GET /v1/clubs)YesYesYes
Join club (POST /v1/clubs/:clubId/join)YesYesYes
View club settings and member list (GET /v1/clubs/:clubId/settings)NoYesYes
Edit club settings (PATCH /v1/clubs/:clubId)NoNoYes
Manage members (POST/PATCH/DELETE /v1/clubs/:clubId/members...)NoNoYes
CapabilityClub MemberClub Admin
View books (GET /v1/clubs/:clubId/books)YesYes
Create book (POST /v1/clubs/:clubId/books)YesYes
Edit/delete books (PATCH/DELETE /v1/books/:bookId)NoYes
Set current/finished book state (PATCH /v1/books/:bookId/state)NoYes
Rate book (PATCH /v1/books/:bookId/rating)YesYes
View meetings (GET /v1/clubs/:clubId/meetings)YesYes
RSVP (POST /v1/meetings/:meetingId/rsvp)YesYes
Create/edit/cancel/delete meetingsNoYes
CapabilityClub MemberClub Admin
View notes/commentsYesYes
Create note sections and notesYesYes
Edit own note/commentYes (author only)Yes (author only)
Delete notes/comments/assetsNoYes
Create reactions and note asset metadataYesYes
  • Meeting comment edit requires both club membership and comment ownership.
  • Note/comment edit requires both club membership and author ownership.
  • Role downgrade/removal of last admin is blocked (409).
  • Websocket stream requires club membership and websocket upgrade headers.