Manage Authorized User Access

This endpoint allows the main business account owner to manage access rights and permissions for authorized users (subprofiles) associated with their account. By submitting a POST request, the owner can grant, modify, or revoke specific capabilities such as opening cards, making transfers, or viewing financial accounts. This helps maintain security and ensures authorized users have only the privileges appropriate to their role.

Endpoint

POST /api/usersManagement/{id}/accessRights

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when a business account owner needs to adjust the permissions of an authorized user — for example, when an employee's role changes, when temporary access must be revoked, or when a new subprofile needs a specific set of capabilities assigned. This endpoint is applicable only to business customers who have subprofiles (authorized users) linked to their account.

Path Parameters

Request Body

{
  "mainAccess": false,
  "openBankingCard": true,
  "openFinancialAccount": false,
  "makeTransfers": true,
  "viewAllCardsAndFinancialAccounts": true
}

Response

200 OK

{
  "mainAccess": false,
  "openBankingCard": true,
  "openFinancialAccount": false,
  "makeTransfers": true,
  "viewAllCardsAndFinancialAccounts": true
}

Error Codes

Common Mistakes

• Sending an id that belongs to a different business account — each authorized user ID is scoped to the business profile that created it.
• Omitting all fields from the request body — while no individual field is strictly required, sending an empty object will have no effect; include at least one field to make a meaningful update.
• Calling this endpoint as a personal customer — authorized users (subprofiles) exist only for business accounts; personal accounts do not support this feature.
• Using an expired Bearer token — tokens last 10 minutes; refresh before making requests if the token may have timed out.

Related Endpoints

• POST /api/usersManagement — Create a new authorized user (subprofile) for a business account.
• GET /api/usersManagement/{id} — Retrieve details and current access rights for a specific authorized user.
• DELETE /api/usersManagement/{id} — Remove an authorized user from a business account.
• POST /api/auth/v2 — Obtain a Bearer token for authentication.
• POST /api/auth/refresh — Refresh an existing Bearer token.

Example

curl -X POST https://api.banking.netevia.dev/api/usersManagement/4821/accessRights \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "mainAccess": false,
    "openBankingCard": true,
    "openFinancialAccount": false,
    "makeTransfers": true,
    "viewAllCardsAndFinancialAccounts": true
  }'