Access Management

Take Full Control of Your API Access

Managing who can access your APIs is one of the most important parts of building a secure and reliable backend. With API Maker’s Access Management system, you get complete control over user permissions, Including from high-level API access down to individual database fields.

This means you can decide exactly which groups, users, or teams can see, update, or use specific parts of your API, all without writing complex role logic or redeploying your project.

Benefits of implementing Access Management:

• Role and group-based access control across all API types.
• Fine-grained field-level access for sensitive data.
• Multiple group memberships per user for flexible permission sets.
• Instant updates indicates that changes apply on the next request.
• Manage everything from the API Maker dashboard.

Why Access Management Matters

APIs are often the backbone of modern applications, Powering everything from business logic to third-party integrations. But with great flexibility comes great responsibility: if access isn’t carefully managed, you risk exposing sensitive data or slowing down teams with unnecessary restrictions.

API Maker’s access management system is designed to strike the perfect balance, Giving you strong security without sacrificing speed or flexibility.

Here’s how it makes a difference:

• One place to manage everything
  Instead of juggling separate tools or configs, you can control access to all API types (custom, system, generated, and even third-party) directly from the dashboard.
• Control at any depth
  From deciding which groups can call an API to hiding specific fields like passwords or salaries, you can fine-tune permissions exactly where they matter.
• No downtime headaches
  Every permission change is live instantly. Update access rules, and they take effect on the very next request, Which means no redeploys, no delays.
• Flexible team setups
  Users can belong to multiple groups, so you can model real-world roles (e.g., an “Analyst” who’s also part of the “Sales” group) without creating messy workarounds.
• Built to scale with you
  Whether you’re a small team or a growing enterprise, the same structure works With add new groups, refine roles, and expand without rewriting permissions.

What You Can Control with Access Management

Unlike many tools that only offer basic API-level access, API Maker lets you control permissions at multiple layers:

• API-Level Permissions: Decide which groups can access Custom APIs, System APIs, Generated APIs, or Third-party APIs.
• Field-Level Permissions: Control which database fields are visible or editable in your generated APIs (perfect for sensitive information like salaries or personal details).
• Group-Based Permissions: Organize users into groups, assign them different roles, and even allow users to belong to multiple groups for flexible combinations.
• Immediate Updates: No need to restart servers, Permission changes are applied instantly on the very next request.

How It Works

In API Maker, every request goes through built-in access controls. Unauthorized users are blocked instantly, while teams with read permissions can securely view data. Those with write access can update records, and users with full permissions enjoy complete control. All of this happens seamlessly from a single dashboard, Giving you the flexibility to decide exactly who can do what, without adding extra code or complexity.

Setting up access management in API Maker is straightforward and requires no extra coding.

• Create groups in your API Maker dashboard (e.g., “Admins”, “Sales Team”, “Analysts”).
• Assign API access to these groups, covering all API types.
• (Optional) Add field-level restrictions for Generated APIs to hide or lock down sensitive columns.
• Link users to groups: A single user can belong to multiple groups for combined permissions.
• Update permissions anytime: Changes apply instantly, with no redeploys or downtime.

Key Features at a Glance

Role & Group-Based Access Control

Easily define roles and assign permissions at a group level.

• Control API access per type (System, Custom, Generated, Third-party).
• Assign multiple groups to users for flexible setups.
• Adjust permissions in real time.

Field-Level Security

Protect sensitive database fields with absolute or partial restrictions. This feature allows you to implement field level security which is very useful when we have to protect specific field data from outside exposure.

• Decide which groups can read or update specific fields.
• Prevent unintentional data leaks.

Unified Permission Management

One dashboard to manage access across all parts of your API ecosystem.

• Custom APIs
• System APIs
• Generated (Schema) APIs
• Third-Party APIs
• Schedulers & Events

Instant Policy Updates

Your access changes are enforced immediately on the next request. This feature saves you the hassle of having to re-deploy the server every time there are changes in access control policies, which can be particularly useful in large-scale environments.

Why Teams Choose API Maker Access Management

With API Maker’s access management system, you can:

• Secure your APIs by preventing unauthorized access to sensitive data.
• Move faster with instant permission changes (no downtime).
• Scale easily with a flexible group and role model.
• Simplify governance by centralizing all access rules in one dashboard.
• Give teams confidence that they’re only seeing and editing what they should.

Examples in Action

• Restrict the “Sales Team” group to only view price and stock fields in the Products API, while hiding cost data.
• Allow the “Analysts” group to run reporting APIs but block delete operations.
• Lock down scheduler APIs so they’re only accessible to Admins.
• Roll out access changes instantly across teams without redeploying.

FAQs

Can users belong to multiple groups?

Yes. Users can be members of multiple groups, and their access is combined automatically.

Is field-level access available for generated APIs?

Yes. You can set read and write permissions at the individual field level in your generated APIs. There are 2 types of APIs in case of generated APIs, schema APIs & schema less APIs. So, it will work for schema APIs and will not work for schema less APIs.

Do I need to restart after changing permissions?

No. Changes take effect immediately on the very next request, Meaning no restarts or redeployments required.

Can I manage access to Third-party APIs?

Yes. API Maker lets you control who can call external APIs, down to the version level.

Does API Maker support role-based access control (RBAC)?

Yes. The access management system is built on RBAC principles, letting you assign permissions through groups and roles.

Is this suitable for compliance (GDPR, HIPAA, SOC 2)?

Yes. Fine-grained access control helps you enforce compliance with GDPR, HIPAA, and SOC 2 by restricting sensitive fields like personal data, salaries, or health records.

With Access Management in API Maker, you get enterprise-grade control without the complexity. Whether you’re protecting sensitive customer data, restricting integrations, or defining roles for large teams, you can manage everything in one place quickly, visually, and securely.