> ## Documentation Index > Fetch the complete documentation index at: https://docs.connectadesk.com/llms.txt > Use this file to discover all available pages before exploring further. # List permission profiles > Lists the company's permission profiles and what each one allows. Use the `id` as `profileId` when inviting (`POST /users/invites`) or editing (`PUT /users/{id}`) a user. The `profiles` module is read only: the token accepts only `profiles: GET`. Profiles are created and edited on the profiles screen in Connecta DESK. The default profiles (Admin and Agent, with `systemKey`) come first, followed by the others in alphabetical order. ## OpenAPI ````yaml /api-reference/openapi.en.yaml get /profiles openapi: 3.0.3 info: title: Connecta DESK Public API version: 1.0.0 description: >- Public API of Connecta DESK, available at `/api/v1`. Access uses a token generated in the tokens module. Each token has permissions per **module × method**, and every list read is paginated. ## Authentication ``` Authorization: Bearer sk_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6 ``` The token belongs to a **company**, not to a user. The company used is always the token's company, so sending `companyId` in the body has no effect. A missing, invalid, revoked or expired token gets the same `401` response. ## Order of checks 1. **token** → `401` 2. **active company** → `403` 3. **API enabled on the plan** → `403 ERR_API_NOT_ENABLED` (does not apply to on-premise) 4. **company rate limit** → `429` 5. **token permission** → `403 ERR_API_FORBIDDEN_SCOPE` ## User ids Every user id in the API is the user's id **in this company**, the same one `GET /users` returns. This applies to what the API returns (`user.id`, `assignedTo.id`, `userCreated.id`) and to what it accepts (`userId`, `userIds`, `assignedToUserId` and the `{id}` in user routes). The same person can work in several companies, with a different name and profile in each one, and has a different id in each company. An id that does not belong to this company returns `404`, with the same message as an id that does not exist. ## Pagination Every list `GET` is paginated. The `meta` contains only `page`, `perPage` and `hasMore`, without the total number of records. To go through everything, keep advancing `page` while `hasMore` is `true`. ## Idempotency Optional on `POST`/`PUT`, through the `Idempotency-Key` header. If you repeat the call with the same key and the same body, you get the stored response (with `Idempotent-Replay: true`). With the same key and a different body, the response is `409`. servers: - url: https://api.connectadesk.com/api/v1 description: Production security: - apiToken: [] tags: - name: contacts description: Contact records, extra fields and marketing source. - name: tickets x-displayName: Tickets description: Opening, transferring, closing and wrap-up of tickets. - name: messages description: Asynchronous sending and reading of messages. - name: tags description: Tags and their link to tickets. - name: queues description: Service queues and their agents. - name: wrapups description: Wrap-up types. - name: users description: Agents and administrators. - name: schedules description: Scheduled messages. - name: quick-messages description: Quick replies. - name: campaigns description: Bulk sending. - name: crm description: Boards, stages, cards and metrics. - name: channels description: Channels (read only). - name: reports description: Reports and dashboards. - name: products description: Product catalog, categories and sales performance. - name: custom-fields description: Custom fields for contacts and cards, plus company-wide global variables. - name: profiles description: Company permission profiles (read only). - name: webchat description: >- Native webchat from your own system: open a visitor session, send and read messages. The token needs the `webchat` scope (GET and POST). paths: /profiles: get: tags: - profiles summary: List permission profiles description: >- Lists the company's permission profiles and what each one allows. Use the `id` as `profileId` when inviting (`POST /users/invites`) or editing (`PUT /users/{id}`) a user. The `profiles` module is read only: the token accepts only `profiles: GET`. Profiles are created and edited on the profiles screen in Connecta DESK. The default profiles (Admin and Agent, with `systemKey`) come first, followed by the others in alphabetical order. parameters: - $ref: '#/components/parameters/page' - $ref: '#/components/parameters/perPage' - name: search in: query description: Search by name or description. schema: type: string example: supervisor responses: '200': description: OK content: application/json: schema: type: object properties: data: type: array items: $ref: '#/components/schemas/Profile' meta: $ref: '#/components/schemas/PageMeta' '403': $ref: '#/components/responses/Forbidden' components: parameters: page: name: page in: query description: Page number, starting at 1. An invalid value is treated as 1. schema: type: integer minimum: 1 default: 1 example: 1 perPage: name: perPage in: query description: >- Number of items per page. The maximum depends on the environment (default 100). schema: type: integer minimum: 1 maximum: 100 default: 20 example: 50 schemas: Profile: type: object description: >- Permission profile. Every user in the company, except the owner, has a profile, and it defines what the person can see and do. properties: id: type: integer description: >- Use it as `profileId` in `POST /users/invites` and `PUT /users/{id}`. example: 21 name: type: string example: Atendente description: type: string nullable: true systemKey: type: string nullable: true enum: - admin - agent - null description: >- Marks the default profiles, which every company has and which cannot be deleted. `null` for profiles created by the company. | value | meaning | | --- | --- | | `admin` | Default **Admin** profile. | | `agent` | Default **Agent** profile. | usersCount: type: integer description: Company users with this profile. example: 8 permissions: type: object description: >- What the profile allows, per resource. Includes every resource on the platform, including the ones the profile cannot access (with `value: "none"`). The key is the module (`contacts`, `conversations`, `crm_boards`...) or an action inside it (`contacts.export`, `contacts.delete`...). The value is already the **effective** one: an action is never worth more than the module allows. For example, with `contacts` at `view`, `contacts.delete` comes back as `none` even if it is checked in the profile. | `value` | meaning | | --- | --- | | `none` | No access. | | `view` | Read. | | `edit` | Read and edit existing records. | | `admin` | Also create, delete, activate and deactivate. | | `yes` | Action allowed (on/off resources). | | `scope` | meaning | | --- | --- | | `all` | Every record in the company. | | `own` | Only the person's own records. | | `null` | The resource has no scope. | additionalProperties: type: object properties: value: type: string enum: - none - view - edit - admin - 'yes' scope: type: string nullable: true enum: - all - own - null example: contacts: value: edit scope: all contacts.export: value: none scope: null conversations: value: edit scope: own notifications: type: object description: >- From which priority the profile receives each type of platform notice. The company owner receives all of them. | type | notices | | --- | --- | | `announcement` | Announcements published by Connecta, such as releases and maintenance. | | `system_event` | Automatic events, such as a disconnected channel, plan limits, credits and pending payment. | | value | receives | | --- | --- | | `none` | Nothing. | | `urgent` | Urgent only. | | `high` | High or above. | | `medium` | Medium or above. | | `low` | All. | properties: announcement: type: string enum: - none - urgent - high - medium - low example: medium system_event: type: string enum: - none - urgent - high - medium - low example: high createdAt: type: string format: date-time updatedAt: type: string format: date-time PageMeta: type: object required: - page - perPage - hasMore properties: page: type: integer example: 1 perPage: type: integer example: 20 hasMore: type: boolean description: Whether there are more records beyond this page. example: true example: page: 1 perPage: 20 hasMore: true Error: type: object required: - error properties: error: type: object required: - code - message properties: code: type: string description: Fixed error code, so your system can handle each case. example: ERR_API_FORBIDDEN_SCOPE message: type: string details: {} responses: Forbidden: description: >- Inactive company, API not enabled on the plan, or insufficient permission. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: ERR_API_FORBIDDEN_SCOPE message: >- O token não tem permissão para este método neste módulo. A mensagem real nomeia os dois. securitySchemes: apiToken: type: http scheme: bearer description: API token in the `sk_live_…` format. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.