Collections

The /collections endpoint allows you to manage collections and their security permissions.

Create Collection

Endpoint: /collections

Method: POST

Headers

Input Parameters

Example Request

{
    "name": "Project Documents",
    "description": "All project-related documents",
    "type": "document-type-id"
}

Update Collection Permissions

Endpoint: /collections/:collectionId/permissions

Method: PUT

Headers

Requirements: User must have content:admin permission

Input Parameters

Principal Format:

• user:<userId> - Individual user access
• group:<groupId> - Group access
• project:* - Project-wide access (all project members)

Example Request

{
    "content:read": ["user:123456", "group:789012", "project:*"],
    "content:write": ["user:123456", "project:*"],
    "content:delete": ["user:123456"]
}

Example Response

{
    "id": "collection-id",
    "security": {
        "content:read": ["user:123456", "group:789012", "project:*"],
        "content:write": ["user:123456", "project:*"],
        "content:delete": ["user:123456"]
    },
    "objectsUpdated": 42
}

Propagate Permissions

Endpoint: /collections/:collectionId/propagate-permissions

Method: POST

Headers

Requirements: User must have content:admin permission

Description: Manually triggers permission propagation from the collection to all its member objects. This is useful when permissions may be out of sync.

Example Response

{
    "id": "collection-id",
    "message": "Permissions propagated to 42 objects",
    "security": {
        "content:read": ["user:123456", "project:*"],
        "content:write": ["user:123456"],
        "content:delete": ["user:123456"]
    },
    "objectsUpdated": 42
}

Add/Remove Collection Members

Endpoint: /collections/:collectionId/members

Method: POST

Headers

Requirements: User must have content:write permission on the collection

Input Parameters

Example Request

{
    "action": "add",
    "members": ["object-id-1", "object-id-2", "object-id-3"]
}

Example Response

{
    "id": "collection-id",
    "objectsUpdated": 3
}

Note:

• Objects can belong to a maximum of 5 "secured" collections (collections with specific user/group permissions)
• Collections with only project:* permissions don't count toward this limit
• When an object is added to multiple collections, it inherits permissions from ALL collections (additive model)

Search Collections

Endpoint: /collections/search

Method: POST

Headers

Input Parameters

Example Request

{
    "name": "project",
    "limit": 10,
    "offset": 0
}

Security Model

Additive Permission Model

When objects belong to multiple collections, they inherit permissions from ALL collections:

1. Permission Merging: Object permissions are the UNION of all collection permissions
2. Collection Limit: Maximum 5 secured collections per object
3. Project-wide Access: Collections with only project:* don't count toward the limit
4. Revision Inheritance: All revisions inherit security from the root object

Permission Types

• content:read - View collection and its contents
• content:write - Modify collection and manage members
• content:delete - Delete collection
• content:admin - Manage collection permissions

Access Control

• Users can only see collections they have at least content:read permission for
• Admins can see all collections for management purposes
• Permission changes propagate automatically to all member objects