iblai-api-rbaclisted

# iblai-api-rbac Drive the organization's **role-based access control** from the API: define roles and policies, attach them to groups and users, check permissions, discover assignable resources and actions, share agents and teams, and toggle what students may do — the org-wide "who can do what" surface under `…/dm/api/core/rbac/…` (bulk user policies live under `…/dm/api/core/platform/…`). ## Auth & conventions - **Base URL:** `https://api.iblai.app` - **Header:** `Authorization: Api-Token $IBLAI_API_KEY` on every request. - **Path vars:** `{org}` = `$IBLAI_ORG` (a.k.a. `platform_key`), `{username}` = `$IBLAI_USERNAME`, `{mentor_id}` = the agent's numeric id. - Not connected yet? Run **`/iblai-api-login`** first to populate `IBLAI_ORG`, `IBLAI_USERNAME`, and `IBLAI_API_KEY`. - The RBAC developer docs phrase auth as `Authorization: Token <key>` — that is the same platform key; use `Api-Token`. - **`mentor`/`agent` route alias.** The `mentor-*` routes are canonical; the platform also serves an identical `agent-*` twin (same view, auth, and data) for `rbac/mentor-access/` and `rbac/student-mentor-creation/…`. Both spellings resolve. This skill uses `agent-*`; the canonical `mentor-*` path is noted inline. ## Concepts Every permission check resolves to one question — *can this identity perform this action on this resource?* — evaluated at two levels: **action** (the operation gate: `list`/`read`/`write`/`delete`/`action`) and **data** (field-level read / write