Permissions & Subscriptions

​

Permissions (What You CAN Access)

• Publish Permission: Can this app publish this event type?
• Receive Permission: Can this app subscribe to this event type?

​

Subscriptions (What You WANT to Receive)

// Subscribe to an event type
await client.subscribe('order.created', async (event) => {
  console.log('Received order:', event.data);
});

​

How Validation Works

​

When Publishing

1. EnSync validates the publisher has permission to publish that event
2. If valid, event is sent to specified Client IDs
3. If invalid, publish is rejected

// You must have permission to publish 'order.created'
await client.publish('order.created', orderData, ['partner_client_id']);

​

When Subscribing

1. EnSync validates the subscriber has permission to receive that event
2. If valid, subscription succeeds
3. If invalid, subscription fails immediately

// Subscription only succeeds if you have receive permission
await client.subscribe('order.created', handler);
// ✅ Success: You have permission
// ❌ Error: Permission denied

​

When Delivering

1. Permission (platform sets): You have receive permission for that event type
2. Subscription (you set): You have an active subscription to that event type
3. Event name matching (automatic): Published event type matches your subscription pattern
4. Recipient targeting (platform sets per-event): Event is explicitly addressed to your Client ID

​

Targeted Delivery Example

// Partner A has permission + subscription to 'order.created'
await partnerA.subscribe('order.created', handler);

// You publish to Partner A's Client ID
await client.publish('order.created', data, ['partner_a_client_id']);
// ✅ Partner A receives it

// You publish to Partner B's Client ID
await client.publish('order.created', data, ['partner_b_client_id']);
// ❌ Partner A does NOT receive it (not addressed to them)

​

The Four Layers Explained

​

Permission vs Subscription

​

Managing Permissions

​

Via Integration Page

1. View available events (based on your permission grants)
2. Subscribe to events they want to receive
3. Unsubscribe from events they no longer need
4. View event metrics and analytics

​

Via Config Manager API

• Get Access Key Permissions
• Update Access Key Permissions

​

Best Practices

1. Grant minimum permissions - Only give access to events partners need
2. Let partners manage subscriptions - They know which events they want
3. Review permissions regularly - Remove access when partnerships end
4. Use integration pages - Enable partners to self-manage their subscriptions