@greensecurity/javascript-sdk 0.45.0-beta.22 → 0.45.0-beta.24

package/src/funcs/medicalProductsGetManufacturer.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Returns a single manufacturer. Retired records are not returned.
  *
  * Requires the `manufacturers` / `view` permission.
+ *
+ * **Permissions.** Requires the `manufacturers.view` permission.
  */
 export function medicalProductsGetManufacturer(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsGetMedicalProduct.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Returns a single medical product. Retired records are not returned.
  *
  * Requires the `medical_products` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_products.view` permission.
  */
 export function medicalProductsGetMedicalProduct(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsGetMedicalProductCategory.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Returns a single product category. Retired records are not returned.
  *
  * Requires the `medical_product_categories` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_product_categories.view` permission.
  */
 export function medicalProductsGetMedicalProductCategory(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsGetMedicalProductFamily.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Returns a single product family. Retired records are not returned.
  *
  * Requires the `medical_products` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_products.view` permission.
  */
 export function medicalProductsGetMedicalProductFamily(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsListAllDistributors.ts

@@ -45,6 +45,8 @@ import {
  * Sortable by id, name, country, status, created_at and updated_at.
  *
  * Requires the `distributors` / `view` permission.
+ *
+ * **Permissions.** Requires the `distributors.view` permission.
  */
 export function medicalProductsListAllDistributors(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsListAllManufacturers.ts

@@ -45,6 +45,8 @@ import {
  * Sortable by id, name, country, status, created_at and updated_at.
  *
  * Requires the `manufacturers` / `view` permission.
+ *
+ * **Permissions.** Requires the `manufacturers.view` permission.
  */
 export function medicalProductsListAllManufacturers(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsListAllMedicalProductCategories.ts

@@ -45,6 +45,8 @@ import {
  * Sortable by id, name, sort_order, created_at and updated_at.
  *
  * Requires the `medical_product_categories` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_product_categories.view` permission.
  */
 export function medicalProductsListAllMedicalProductCategories(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsListAllMedicalProductFamilies.ts

@@ -48,6 +48,8 @@ import {
  * Sortable by id, name, brand_name, status, created_at and updated_at.
  *
  * Requires the `medical_products` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_products.view` permission.
  */
 export function medicalProductsListAllMedicalProductFamilies(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsListAllMedicalProducts.ts

@@ -49,6 +49,8 @@ import {
  * Sortable by id, product_name, brand_name, primary_di, status, created_at and updated_at.
  *
  * Requires the `medical_products` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_products.view` permission.
  */
 export function medicalProductsListAllMedicalProducts(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsPatchDistributor.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Identical to `PUT`: both leave omitted keys as they are.
  *
  * Requires the `distributors` / `edit` permission.
+ *
+ * **Permissions.** Requires the `distributors.edit` permission.
  */
 export function medicalProductsPatchDistributor(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsPatchManufacturer.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Identical to `PUT`: both leave omitted keys as they are.
  *
  * Requires the `manufacturers` / `edit` permission.
+ *
+ * **Permissions.** Requires the `manufacturers.edit` permission.
  */
 export function medicalProductsPatchManufacturer(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsPatchMedicalProduct.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Identical to `PUT`: both leave omitted keys as they are.
  *
  * Requires the `medical_products` / `edit` permission.
+ *
+ * **Permissions.** Requires the `medical_products.edit` permission.
  */
 export function medicalProductsPatchMedicalProduct(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsPatchMedicalProductCategory.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Identical to `PUT`: both leave omitted keys as they are.
  *
  * Requires the `medical_product_categories` / `edit` permission.
+ *
+ * **Permissions.** Requires the `medical_product_categories.edit` permission.
  */
 export function medicalProductsPatchMedicalProductCategory(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsPatchMedicalProductFamily.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Identical to `PUT`: both leave omitted keys as they are.
  *
  * Requires the `medical_products` / `edit` permission.
+ *
+ * **Permissions.** Requires the `medical_products.edit` permission.
  */
 export function medicalProductsPatchMedicalProductFamily(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsUpdateDistributor.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Updates a distributor. Keys the request omits are left as they are.
  *
  * Requires the `distributors` / `edit` permission.
+ *
+ * **Permissions.** Requires the `distributors.edit` permission.
  */
 export function medicalProductsUpdateDistributor(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsUpdateManufacturer.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Updates a manufacturer. Keys the request omits are left as they are.
  *
  * Requires the `manufacturers` / `edit` permission.
+ *
+ * **Permissions.** Requires the `manufacturers.edit` permission.
  */
 export function medicalProductsUpdateManufacturer(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsUpdateMedicalProduct.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Updates a medical product. Keys the request omits are left as they are.
  *
  * Requires the `medical_products` / `edit` permission.
+ *
+ * **Permissions.** Requires the `medical_products.edit` permission.
  */
 export function medicalProductsUpdateMedicalProduct(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsUpdateMedicalProductCategory.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Updates a product category. Keys the request omits are left as they are.
  *
  * Requires the `medical_product_categories` / `edit` permission.
+ *
+ * **Permissions.** Requires the `medical_product_categories.edit` permission.
  */
 export function medicalProductsUpdateMedicalProductCategory(
   client: GreenSecurityCore,

package/src/funcs/medicalProductsUpdateMedicalProductFamily.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Updates a product family. Keys the request omits are left as they are.
  *
  * Requires the `medical_products` / `edit` permission.
+ *
+ * **Permissions.** Requires the `medical_products.edit` permission.
  */
 export function medicalProductsUpdateMedicalProductFamily(
   client: GreenSecurityCore,

package/src/funcs/mobileDevicesAddMobileDevice.ts

@@ -32,6 +32,8 @@ import { Result } from "../types/fp.js";
  * @remarks
  * Add mobile device
  *
+ * **Permissions.** Requires the `mobile_devices.add` permission.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function mobileDevicesAddMobileDevice(

package/src/funcs/organizationsCreateCompanyTargetFacility.ts

@@ -36,15 +36,25 @@ import { Result } from "../types/fp.js";
  *
  * Access control: the URL's `company_id` must be in the caller's update
  * scope for Company, AND the `facility_id` must be in the caller's create
- * scope for Facility (a facility on the company's site, or a facility
- * reachable via the API user's site/system/facility-scoped activation).
- * Either being out of scope returns `404 Company not found` /
- * `404 Facility not found` respectively. Deleted facilities also return
- * `404 Facility not found`.
+ * scope for Facility. For a facility/system/vendor/company-manager caller,
+ * that create scope is widened the same way listing's potential-target
+ * scope is: it includes the public, non-deleted, listed facility directory
+ * in addition to the caller's own create scope, so a non-deleted publicly
+ * listed facility can be targeted even when it isn't otherwise in the
+ * caller's Facility relation. An API-user caller is the exception —
+ * restricted to its own create scope (a facility on the company's site, or
+ * a facility reachable via the API user's site/system/facility-scoped
+ * activation), with no directory added. Either being out of scope returns
+ * `404 Company not found` / `404 Facility not found` respectively. Deleted
+ * facilities also return `404 Facility not found`.
+ *
+ * **Permissions.** Requires the `target_facilities.add` permission.
  *
  * Available `expand` scopes are:
  *
- * - company_target_facility.facility
+ * - `company_target_facility.facility`
+ *
+ * Any other value is rejected with `422 Unprocessable Entity`.
  *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */

package/src/funcs/organizationsDeleteCompanyTargetFacility.ts

@@ -41,6 +41,8 @@ import * as types$ from "../types/primitives.js";
  * company whose app is activated for the API user). Callers outside that
  * scope receive `404 Company not found`.
  *
+ * **Permissions.** Requires the `target_facilities.delete` permission.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function organizationsDeleteCompanyTargetFacility(

package/src/funcs/organizationsDownloadCompanyTargetFacilitiesExport.ts

@@ -34,6 +34,8 @@ import * as types$ from "../types/primitives.js";
  * Returns the exported company target facilities CSV via a 302 redirect to a short-lived presigned S3 URL.
  * If the export is still being generated, returns 202 with a JSON `{ ready: false }` payload.
  *
+ * **Permissions.** Requires the `target_facilities.view` permission.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function organizationsDownloadCompanyTargetFacilitiesExport(

package/src/funcs/organizationsDownloadFacilityVendorsExport.ts

@@ -35,6 +35,8 @@ import * as types$ from "../types/primitives.js";
  * presigned S3 URL. If the export is still being generated, returns 202 with a JSON
  * `{ ready: false }` payload.
  *
+ * **Permissions.** Requires the `vendors.view` permission.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function organizationsDownloadFacilityVendorsExport(

package/src/funcs/organizationsExportCompanyTargetFacilities.ts

@@ -39,6 +39,8 @@ import { Result } from "../types/fp.js";
  * Access control: the URL's `company_id` must be in the caller's read scope for Company. Callers
  * outside that scope receive `404 Company not found`.
  *
+ * **Permissions.** Requires the `target_facilities.view` permission.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function organizationsExportCompanyTargetFacilities(

package/src/funcs/organizationsExportFacilityVendors.ts

@@ -46,6 +46,8 @@ import { Result } from "../types/fp.js";
  *     activated for the caller's marketplace app via the join-scoped
  *     `MarketplaceAppActivation` check.
  *
+ * **Permissions.** Requires the `vendors.view` permission.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function organizationsExportFacilityVendors(

package/src/funcs/organizationsGetCompanyTargetFacilitiesExportStatus.ts

@@ -33,6 +33,8 @@ import { Result } from "../types/fp.js";
  * Poll the state of an asynchronous company target facilities export job. When `ready` is true,
  * the export is complete and can be downloaded via the download endpoint.
  *
+ * **Permissions.** Requires the `target_facilities.view` permission.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function organizationsGetCompanyTargetFacilitiesExportStatus(

package/src/funcs/organizationsGetFacility.ts

@@ -33,6 +33,26 @@ import { Result } from "../types/fp.js";
  * @remarks
  * Retrieve an individual facility.
  *
+ * **Permissions.** Requires `facilities.view`, `facility_profile.view`, or `targeted_facilities.view`. `facility.search` does not grant access on its own — it only extends the reach of a `targeted_facilities.view` caller to a facility they are not targeted at, returning the public summary for it instead of a 403.
+ *
+ * - Callers with `facilities.view` or `facility_profile.view` can look up any facility, but only receive full expansion for their own facility; for any other facility, expansion is dropped and only the public summary is returned.
+ * - Callers with `targeted_facilities.view` receive the full record and full expansion for a facility they are targeted at (a vendor's target facilities, or a facility/system user's own facility). For a facility they are not targeted at, they receive the public summary (no expansion) if they also hold `facility.search`, or a 401 otherwise.
+ *
+ * Available `expand` scopes are:
+ *
+ * - `facility.system`
+ * - `facility.contacts`
+ * - `facility.vendor_counts`
+ * - `facility.appointment_policy`
+ * - `facility.vendor_policy`
+ * - `facility.vendor_guest_policy`
+ * - `facility.visitor_policy`
+ * - `facility.workflow_policy`
+ * - `facility.scrubs_policy`
+ * - `facility.flu_credential`
+ *
+ * Unrecognised values are ignored. Expansion is dropped entirely for callers who can only see the facility's public summary.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function organizationsGetFacility(

package/src/funcs/organizationsGetFacilityVendorsExportStatus.ts

@@ -34,6 +34,8 @@ import { Result } from "../types/fp.js";
  * Poll the state of an asynchronous facility vendors export job. When `ready` is true,
  * the export is complete and can be downloaded via the download endpoint.
  *
+ * **Permissions.** Requires the `vendors.view` permission.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function organizationsGetFacilityVendorsExportStatus(

package/src/funcs/organizationsListCompanyTargetFacilities.ts

@@ -41,9 +41,15 @@ import {
  * and parent system), the link status, and per-facility counts of the
  * company's individuals targeting it.
  *
- * When `include_potential_targets=true`, returns ALL non-deleted facilities
- * via a LEFT JOIN. Targeted rows carry their CTF `id` and `status`; non-targeted
- * rows have `id: null` and `status: "Not Targeted"`.
+ * When `include_potential_targets=true`, returns every non-deleted facility
+ * reachable via a LEFT JOIN against the caller's *potential-target* scope:
+ * for a facility/system/vendor/company-manager caller, that's the public,
+ * non-deleted, listed facility directory plus the caller's own read scope
+ * for Facility — not the read scope alone, so the roster includes
+ * facilities the caller has no existing relationship with. An API-user
+ * caller is the exception: it sees only its own read scope, with no
+ * directory added. Targeted rows carry their CTF `id` and `status`;
+ * non-targeted rows have `id: null` and `status: "Not Targeted"`.
  *
  * Access control: the URL's `company_id` must be in the caller's read scope
  * for Company (a company manager's or vendor's own company, or a company
@@ -53,9 +59,13 @@ import {
  * Filter with `has_individual` / `has_active_individual` to drive the
  * facility roster views.
  *
+ * **Permissions.** Requires the `target_facilities.view` permission.
+ *
  * Available `expand` scopes are:
  *
- * - company_target_facility.facility
+ * - `company_target_facility.facility`
+ *
+ * Any other value is rejected with `422 Unprocessable Entity`.
  *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */

package/src/funcs/organizationsListFacilityVendors.ts

@@ -57,6 +57,8 @@ import {
  *     must be activated for the caller's marketplace app
  *     (`MarketplaceAppActivation`).
  *
+ * **Permissions.** Requires the `vendors.view` permission.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function organizationsListFacilityVendors(

package/src/funcs/organizationsListOrSearchDepartmentContacts.ts

@@ -38,10 +38,14 @@ import {
  * @remarks
  * List or search department contacts.
  *
+ * **Permissions.** Requires the `departments.view` permission.
+ *
  * Available `expand` scopes are:
  *
- * - department_membership.contact
- * - department_membership.department
+ * - `department_membership.contact`
+ * - `department_membership.department`
+ *
+ * Unrecognised values are ignored.
  *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */

package/src/funcs/organizationsListOrSearchDepartments.ts

@@ -38,6 +38,8 @@ import {
  * @remarks
  * List or search departments.
  *
+ * **Permissions.** Requires the `departments.view` permission.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function organizationsListOrSearchDepartments(

package/src/funcs/organizationsListOrSearchFacilities.ts

@@ -38,18 +38,22 @@ import {
  * @remarks
  * List or search facilities.
  *
+ * **Permissions.** Requires any of `facilities.view`, `facility.search` or `targeted_facilities.view`. Callers holding only `targeted_facilities.view` or `facility.search` see a reduced record, and expansion scopes are applied only to facilities within their read scope.
+ *
  * Available `expand` scopes are:
  *
- * - facility.appointment_policy
- * - facility.contacts
- * - facility.vendor_counts
- * - facility.flu_credential
- * - facility.scrubs_policy
- * - facility.system
- * - facility.vendor_guest_policy
- * - facility.vendor_policy
- * - facility.visitor_policy
- * - facility.workflow
+ * - `facility.system`
+ * - `facility.contacts`
+ * - `facility.vendor_counts`
+ * - `facility.appointment_policy`
+ * - `facility.vendor_policy`
+ * - `facility.vendor_guest_policy`
+ * - `facility.visitor_policy`
+ * - `facility.workflow_policy`
+ * - `facility.scrubs_policy`
+ * - `facility.flu_credential`
+ *
+ * Unrecognised values are ignored. Expansion is applied only to facilities the caller can read; rows outside that scope are returned unexpanded.
  *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */

package/src/funcs/paymentProfileDeletePaymentProfile.ts

@@ -32,6 +32,8 @@ import { Result } from "../types/fp.js";
  *
  * Only vendors and company managers can access this endpoint.
  *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function paymentProfileDeletePaymentProfile(

package/src/funcs/paymentProfileGetPaymentProfile.ts

@@ -33,6 +33,8 @@ import { Result } from "../types/fp.js";
  *
  * Only vendors and company managers can access this endpoint.
  *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function paymentProfileGetPaymentProfile(

package/src/funcs/reportsGetFullReport.ts

@@ -55,6 +55,8 @@ import { Result } from "../types/fp.js";
  * produced it, or a report whose app is activated for the API user. Callers outside that
  * scope receive `404 Full report not found`.
  *
+ * **Permissions.** Requires the `scheduled_reports.view` permission.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function reportsGetFullReport(

package/src/funcs/reportsInitiateScheduledReport.ts

@@ -49,6 +49,8 @@ import { Result } from "../types/fp.js";
  * caller is an explicit recipient of, or a scheduled report whose app is activated for
  * the API user. Callers outside that scope receive `404 Scheduled report not found`.
  *
+ * **Permissions.** Requires the `scheduled_reports.view` permission.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function reportsInitiateScheduledReport(

package/src/funcs/supportArticlesGetSupportArticle.ts

@@ -33,12 +33,16 @@ import { Result } from "../types/fp.js";
  * @remarks
  * Retrieve an individual support article.
  *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
+ *
  * Available `expand` scopes are:
  *
- * - support_article.description
- * - support_article.published
- * - support_article.notes
- * - support_article.support_category
+ * - `support_article.description`
+ * - `support_article.notes`
+ * - `support_article.published`
+ * - `support_article.support_category`
+ *
+ * Unrecognised values are ignored.
  *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */

package/src/funcs/supportArticlesListOrSearchSupportArticles.ts

@@ -38,6 +38,8 @@ import {
  * @remarks
  * List or search support articles for FAQ.
  *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function supportArticlesListOrSearchSupportArticles(

package/src/funcs/systemsListSystems.ts

@@ -38,9 +38,24 @@ import {
  * @remarks
  * List or search systems.
  *
+ * **Permissions.** Requires the `systems.view` permission. `facilities.view` is additionally needed for the `system.facilities` expansion scope to be applied.
+ *
  * Available `expand` scopes are:
  *
- * - system.facilities
+ * - `system.facilities`
+ * - `system.location`
+ * - `system.green_contacts`
+ * - `system.vendor_counts`
+ * - `system.calendar_policy`
+ * - `system.sales_info`
+ * - `system.auto_approve_policy`
+ * - `system.vendor_guest_policy`
+ * - `system.gpo`
+ * - `system.aggregate`
+ * - `system.pricing_model`
+ * - `system.initiate_visit_request_requirements`
+ *
+ * Unrecognised values are ignored. Each scope is also accepted without the `system.` prefix (`location`, `gpo`, and so on) for backwards compatibility. Expansion is dropped for callers without facilities-view permission.
  *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */

package/src/funcs/usersChangePassword.ts

@@ -32,6 +32,8 @@ import { Result } from "../types/fp.js";
  * @remarks
  * Change the user's password to the new passed as parameter
  *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function usersChangePassword(

package/src/funcs/usersGetCurrentUser.ts

@@ -36,6 +36,8 @@ import { Result } from "../types/fp.js";
  * By default the response returns a compact profile (id, name, email,
  * phone, timezone, user type, and a handful of confirmation flags).
  *
+ * **Permissions.** Requires a valid token only - a caller may always read their own record.
+ *
  * Supported `expand` values:
  * - `user` — return the full user record, including all profile fields stored against the user (sensitive columns such as passwords, MFA codes, and payment-provider IDs are always omitted)
  * - `user.email_preferences` — include the user's `email_preferences` block (notification recipients, weekly email flags, and — for company managers — `receive_vendor_emails`)

package/src/funcs/usersGetLinkedUsers.ts

@@ -39,6 +39,8 @@ import { Result } from "../types/fp.js";
  * linked users, provided they have an active app activation for that user.
  * Non-API users may only pass `me`.
  *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
+ *
  * If set, this operation will use {@link Security.bearerJwt} from the global security.
  */
 export function usersGetLinkedUsers(

package/src/funcs/usersGetUserById.ts

@@ -37,6 +37,8 @@ import { Result } from "../types/fp.js";
  * By default the response returns a compact profile (id, name, email,
  * phone, timezone, user type, and a handful of confirmation flags).
  *
+ * **Permissions.** Requires any of `users.view`, `vendors.view`, `contacts.view`, `inventory_managers.view` or `company_managers.view`. Which one applies depends on the target user's type; callers may always read their own record.
+ *
  * Supported `expand` values:
  * - `user` — return the full user record (sensitive columns such as passwords and payment-provider IDs are always omitted)
  * - `user.email_preferences` — include the user's `email_preferences` block (notification recipients, weekly email flags, and — for company managers — `receive_vendor_emails`)

package/src/funcs/usersMagiclink.ts

@@ -31,6 +31,8 @@ import { Result } from "../types/fp.js";
  *
  * @remarks
  * It sends an email with a magic link to allow the user to log in.
+ *
+ * **Permissions.** No authentication required.
  */
 export function usersMagiclink(
   client: GreenSecurityCore,

package/src/funcs/usersPassword.ts

@@ -32,6 +32,8 @@ import { Result } from "../types/fp.js";
  * @remarks
  * Resets the a user's password using a password_reset_id that was sent to them via email.
  * See /users/passwordresetrequest to initiate a password reset flow.
+ *
+ * **Permissions.** No authentication required.
  */
 export function usersPassword(
   client: GreenSecurityCore,

package/src/funcs/usersPasswordResetRequest.ts

@@ -31,6 +31,8 @@ import { Result } from "../types/fp.js";
  *
  * @remarks
  * It sends an email with a link for resetting a user's password.
+ *
+ * **Permissions.** No authentication required.
  */
 export function usersPasswordResetRequest(
   client: GreenSecurityCore,

package/src/funcs/usersPostAuthenticate.ts

@@ -97,6 +97,8 @@ import { Result } from "../types/fp.js";
  * same blob; the user has to start again from the service provider. See the
  * [Login with Green Security](https://greensecurity.apidocumentation.com/guides/sso-login-with-green-security)
  * guide for the service provider half of this flow.
+ *
+ * **Permissions.** No authentication required.
  */
 export function usersPostAuthenticate(
   client: GreenSecurityCore,

package/src/funcs/usersRotateApiKey.ts

@@ -29,6 +29,8 @@ import { Result } from "../types/fp.js";
  *
  * @remarks
  * Allows an API user to rotate their own API key. Note, the key rotation happens immediately so the user should be prepared to update their API key in their application for all subsequent requests.
+ *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
  */
 export function usersRotateApiKey(
   client: GreenSecurityCore,