webflow-enterprise-rbac

# Webflow Enterprise RBAC ## Overview Enterprise-grade access control for Webflow Data API v2 integrations. Uses Webflow's OAuth 2.0 scope system, per-site token isolation, and application-level RBAC to enforce least privilege across teams and environments. ## Prerequisites - Webflow workspace (Core plan or higher for multiple members) - OAuth 2.0 Data Client App (for user-authorized access) - Understanding of Webflow scopes ## Webflow's Native Access Model Webflow provides three levels of access control: | Level | Mechanism | Granularity | |-------|-----------|-------------| | **Workspace tokens** | API token | All sites in workspace | | **Site tokens** | API token | Single site | | **OAuth tokens** | OAuth 2.0 authorization | User-authorized scopes per site | ## Scope-Based Permission Model Webflow scopes map directly to API access: | Scope | Read Access | Write Access | |-------|-------------|--------------| | `sites:read` | List/get sites | — | | `sites:write` | — | Publish sites | | `cms:read` | List collections, read items | — | | `cms:write` | — | Create/update/delete CMS items | | `pages:read` | List/get pages | — | | `pages:write` | — | Update page settings | | `forms:read` | List forms, read submissions | — | | `ecommerce:read` | List products, orders, inventory | — | | `ecommerce:write` | — | Create products, fulfill orders | | `custom_code:read` | List registered scripts | — | | `custom_code:write` | — | Register/apply custom code | ## Instructions ###...