First steps: give your team access

Complete Quick start first. Reuse its EDEN_ORIGIN and administrator EDEN_TOKEN. This guide creates a read-only human identity, then grants explicit data access to the cache endpoint.

Create a user

Control permissions govern Eden resources; data permissions govern operations against a connected backend. Grant them separately and start with the minimum required access. See the RBAC guide for the permission alphabet and scope hierarchy.

read -r -s -p 'New team member password: ' EDEN_MEMBER_PASSWORD
printf '\n'
jq -n --arg password "$EDEN_MEMBER_PASSWORD" \
  '{username:"developer@example.com",password:$password,perms:"R"}' \
  | curl --fail --silent --show-error \
      -H 'Content-Type: application/json' \
      -H "Authorization: Bearer $EDEN_TOKEN" \
      -H 'Idempotency-Key: quickstart-create-developer-001' \
      --data-binary @- "$EDEN_ORIGIN/api/v1/iam/humans"
unset EDEN_MEMBER_PASSWORD

The caller needs GRANT and the permissions being granted. Higher privilege creation has additional super-administrator checks. If HA returns an accepted control operation, wait for its applied/activated result before the next step.

Grant endpoint access

Resolve the member's subject identifier from the creation response or user inventory and use the documented IAM subject format. With the member username:

curl --fail --silent --show-error --request PUT \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $EDEN_TOKEN" \
  -H 'Idempotency-Key: quickstart-grant-cache-control-001' \
  --data '{"perms":"R"}' \
  "$EDEN_ORIGIN/api/v1/iam/control/endpoints/cache/subjects/developer@example.com"

This grants endpoint control read access. It does not grant backend data reads. Grant backend read access separately:

curl --fail --silent --show-error --request PUT \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $EDEN_TOKEN" \
  -H 'Idempotency-Key: quickstart-grant-cache-data-001' \
  --data '{"perms":"r"}' \
  "$EDEN_ORIGIN/api/v1/iam/data/endpoints/cache/subjects/developer@example.com"

The lowercase r is the data read bit. See the data-plane RBAC API and confirm access under the member's own token. Do not copy broad administrator permission strings into application setup.

Verify as the member

Log in with the member's credentials and organization header. List endpoints, inspect the intended endpoint, and attempt the permitted read. Confirm an unauthorized write is rejected. Successful administrator requests do not test the member's policy. Match the endpoint's backend credential tier to the granted data profile; a read-only database role should remain read-only at the backend.

Use database credentials for credential isolation and access boundaries for provider and policy constraints.

Build on the working endpoint

Use the endpoint field when creating endpoint resources, and wrap data operations in request with their typed discriminator. Reuse the working Redis/PostgreSQL payloads in Quick start. Inspect top-level resource responses rather than looking for an invented status/data wrapper.

Next, configure service agents for automation, monitoring, and reliable API client behavior.