User Guide

18 Chapter 1: Using the Breeze XML APIs
There are a few other kinds of IDs that aren’t associated with a principal or a SCO, such as
account-id, answer-id, permission-id, and question-id. But in most cases, a parameter
name that ends in
-id indicates that the value of the parameter is the ID of either a principal or
a SCO.
About security
The security model in Breeze ensures that any code calling a given API is authorized to do so.
Almost every API call must include a cookie that represents a specific logged-in user. For more
information, see “Logging in to Breeze first” on page 16.
For information about the possible status codes that the server can return, see the
status tag.
About permissions
Permissions define the ways in which a particular principal can interact with a given SCO.
A permission mapping, indicating what permissions a particular principal has for a particular
SCO, is called an access control list or ACL. An ACL is an object that is capable of having
permission mappings between the object and a principal, but it may not have any mappings at all.
An ACL consists of three pieces of information: the ID of a SCO, principal, or account (usually
referred to in this context as an ACL ID); the ID of a principal; and a keyword that indicates what
the permissions are (usually referred to as a permission ID).
There are two kinds of permissions in Breeze: permissions associated with specific SCOs, and
permissions that belong to all users who are members of special groups that are called Built-in
groups. Permissions for Built-in groups take precedence over the permissions set on a SCO.
To find out what permissions a logged-in user has for a particular item, call the
permissions-info API. To change a principal’s permissions, call the principal-update API.
If a particular principal has no explicitly specified permissions on a particular SCO, that
principal’s permissions on the parent of the SCO apply.