--- title: "Security & Permissions: API User Permissions Tab" slug: "api-user-permissions-tab" description: "The API User Permissions tab controls whether API-managed users can be edited in R365. Covers the toggle and brand-managed API user behavior." updated: 2026-01-08T01:52:35Z published: 2026-01-08T01:52:35Z canonical: "docs.restaurant365.com/api-user-permissions-tab" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.restaurant365.com/llms.txt > Use this file to discover all available pages before exploring further. # Security & Permissions: API User Permissions Tab In Beta This feature is in beta for select customers. Contact your CSM for more information. The API User permissions tab is part of the [Security and Permissions page](/doc/docs/security-permissions-overview-security) and contains the setting that controls how [API managed users](/doc/docs/api-managed-users) (users that were created via API) are managed in R365. This tab is only displayed if at least 1 user has been created via API. By default, the **API Users** toggle is enabled, allowing users created via API to be edited and managed in R365. From this page, users can: - Enable API managed users to be edited in R365 - Disable API managed users from being edited in R365 --- ## Security Users must have the following permission to enable or disable API users from being managed in R365: - Administration → Users → User Roles → Create/Edit/Delete User Roles & Permissions These permissions can be added to [custom user roles](https://restaurant365.us.document360.io/doc/docs/custom-user-roles) or [individual users](https://restaurant365.us.document360.io/doc/docs/users-overview-and-security). The [Permission Access report](https://restaurant365.us.document360.io/doc/docs/generating-a-permissions-access-report) can be used to determine which user roles or users already have these permissions assigned. For more information, see [User Setup and Security](/doc/docs/user-setup-security-and-location-access). --- ## Navigation ****Navigation Menu**** 1. Click the **Admin** app. ![](https://cdn.us.document360.io/5c9d1111-0c69-4e96-8910-d7f2750fdc9d/Images/Documentation/image-5DRMTH65.png?sv=2026-02-06&spr=https&st=2026-11-13T23%3A07%3A15Z&se=2026-11-14T00%3A07%3A15Z&sr=c&sp=r&sig=p2Ghft48qv%2FTwfmNVdZm84kUm4WQn5limtbVjUEZMT0%3D) 2. Click **users & security.** ![](https://cdn.us.document360.io/5c9d1111-0c69-4e96-8910-d7f2750fdc9d/Images/Documentation/image-V392045C.png?sv=2026-02-06&spr=https&st=2026-11-13T23%3A07%3A15Z&se=2026-11-14T00%3A07%3A15Z&sr=c&sp=r&sig=p2Ghft48qv%2FTwfmNVdZm84kUm4WQn5limtbVjUEZMT0%3D) 3. Click **security & permissions.** ![](https://cdn.us.document360.io/5c9d1111-0c69-4e96-8910-d7f2750fdc9d/Images/Documentation/image-AYB7LCSF.png?sv=2026-02-06&spr=https&st=2026-11-13T23%3A07%3A15Z&se=2026-11-14T00%3A07%3A15Z&sr=c&sp=r&sig=p2Ghft48qv%2FTwfmNVdZm84kUm4WQn5limtbVjUEZMT0%3D) 4. Click the **API User Permissions** tab. ![](https://cdn.us.document360.io/5c9d1111-0c69-4e96-8910-d7f2750fdc9d/Images/Documentation/image-3PRVCTIY.png?sv=2026-02-06&spr=https&st=2026-11-13T23%3A07%3A15Z&se=2026-11-14T00%3A07%3A15Z&sr=c&sp=r&sig=p2Ghft48qv%2FTwfmNVdZm84kUm4WQn5limtbVjUEZMT0%3D) ****Search**** Navigate to pages with the [R365 global search bar](/doc/docs/r365-search): 1. Enter all or part of the **page name** in the R365 global search bar. 2. Select the page from the results list. > Only enabled pages can be searched for. If the desired page is not enabled, contact your CSM for assistance. ![](https://cdn.us.document360.io/5c9d1111-0c69-4e96-8910-d7f2750fdc9d/Images/Documentation/image-1745007955784.png?sv=2026-02-06&spr=https&st=2026-11-13T23%3A07%3A15Z&se=2026-11-14T00%3A07%3A15Z&sr=c&sp=r&sig=p2Ghft48qv%2FTwfmNVdZm84kUm4WQn5limtbVjUEZMT0%3D) --- ## API User Permissions Tab ![](https://cdn.us.document360.io/5c9d1111-0c69-4e96-8910-d7f2750fdc9d/Images/Documentation/image-HY658EHX.png?sv=2026-02-06&spr=https&st=2026-11-13T23%3A07%3A15Z&se=2026-11-14T00%3A07%3A15Z&sr=c&sp=r&sig=p2Ghft48qv%2FTwfmNVdZm84kUm4WQn5limtbVjUEZMT0%3D) | | Button/Field | Description | | --- | --- | --- | | **1** | Brand-managed API Users Setting | When an instance is connected to a brand, an additional setting appears for each enforcing brand. - Each setting displays the brand name in the setting name. - Brand settings are read-only and reflect the value set at the corporate level. Learn more about [brand-managed instances](/doc/docs/brand-managed-instances-overview#apimanaged-users). | | **2** | API Users | - **On:** Enables [API managed users](/doc/docs/api-managed-users) to be edited in R365. - This is the default selection. - **Off:** Disables [API managed users](/doc/docs/api-managed-users) from being edited in R365. | --- ## Editing Restrictions for API Managed Users When the **API Users** toggle is off, edits to [API-managed users](/doc/docs/api-managed-users) are restricted. All fields and checkboxes on the User Role and Report Roles tabs become read-only. ### User Records When the 'API Users' setting is disabled, API-managed [user records](/doc/docs/user-record-folder) display a message indicating that edits are restricted within R365 and all fields are read-only. The message is **only** displayed for users that contain the following permission: - Administration → Users → Edit Users > This restriction also applies to users attempting to update their own user record. ![](https://cdn.us.document360.io/5c9d1111-0c69-4e96-8910-d7f2750fdc9d/Images/Documentation/image-9W7XG26D.png?sv=2026-02-06&spr=https&st=2026-11-13T23%3A07%3A15Z&se=2026-11-14T00%3A07%3A15Z&sr=c&sp=r&sig=p2Ghft48qv%2FTwfmNVdZm84kUm4WQn5limtbVjUEZMT0%3D) ### Users Page When the 'API Users' setting is disabled, API managed users are not editable in the table of the [Users page](/doc/docs/users-page), all fields are read-only, and a message is displayed when hovering over users to indicate that the user is managed outside of R365. > Organizations using the [brand connector](/doc/docs/brand-connector) will see: ‘User managed by [Brand Name]’. This label indicates the user is managed at the brand level and cannot be edited within the instance. ![](https://cdn.us.document360.io/5c9d1111-0c69-4e96-8910-d7f2750fdc9d/Images/Documentation/image-B9VIXNDJ.png?sv=2026-02-06&spr=https&st=2026-11-13T23%3A07%3A15Z&se=2026-11-14T00%3A07%3A15Z&sr=c&sp=r&sig=p2Ghft48qv%2FTwfmNVdZm84kUm4WQn5limtbVjUEZMT0%3D) ### Security and Permissions Page When the ‘API Users’ setting is disabled, checkboxes in the User subtabs of the User Role and Report Roles tabs are read-only, and a message is displayed when hovering over users to indicate that the user is managed outside of R365. > Organizations using the [brand connector](/doc/docs/brand-connector) will see: ‘User managed by [Brand Name]’. This label indicates the user is managed at the brand level and cannot be edited within the instance. #### User Roles - Users Subtab ![](https://cdn.us.document360.io/5c9d1111-0c69-4e96-8910-d7f2750fdc9d/Images/Documentation/image-S4FIUB0O.png?sv=2026-02-06&spr=https&st=2026-11-13T23%3A07%3A15Z&se=2026-11-14T00%3A07%3A15Z&sr=c&sp=r&sig=p2Ghft48qv%2FTwfmNVdZm84kUm4WQn5limtbVjUEZMT0%3D) #### Report Roles - Users Subtab ![](https://cdn.us.document360.io/5c9d1111-0c69-4e96-8910-d7f2750fdc9d/Images/Documentation/image-NIXRN341.png?sv=2026-02-06&spr=https&st=2026-11-13T23%3A07%3A15Z&se=2026-11-14T00%3A07%3A15Z&sr=c&sp=r&sig=p2Ghft48qv%2FTwfmNVdZm84kUm4WQn5limtbVjUEZMT0%3D) ### Mass Role Update When the 'API Users' setting is disabled, API managed users are not editable in the Mass Role update tool and all fields for the API managed users are read-only, and a message is displayed when hovering over users to indicate that the user is managed outside of R365. > Organizations using the [brand connector](/doc/docs/brand-connector) will see: ‘User managed by [Brand Name]’. This label indicates the user is managed at the brand level and cannot be edited within the instance. ![](https://cdn.us.document360.io/5c9d1111-0c69-4e96-8910-d7f2750fdc9d/Images/Documentation/image-EMYZ9VFP.png?sv=2026-02-06&spr=https&st=2026-11-13T23%3A07%3A15Z&se=2026-11-14T00%3A07%3A15Z&sr=c&sp=r&sig=p2Ghft48qv%2FTwfmNVdZm84kUm4WQn5limtbVjUEZMT0%3D) ### Setup Assistant When the 'API Users' setting is disabled, API managed users are not editable in the Setup Assistant and all fields for the API managed users are read-only except for **reset password.** ![](https://cdn.us.document360.io/5c9d1111-0c69-4e96-8910-d7f2750fdc9d/Images/Documentation/image-68JCEL9B.png?sv=2026-02-06&spr=https&st=2026-11-13T23%3A07%3A15Z&se=2026-11-14T00%3A07%3A15Z&sr=c&sp=r&sig=p2Ghft48qv%2FTwfmNVdZm84kUm4WQn5limtbVjUEZMT0%3D) Access rights granted to users or user roles that dictate what actions they can perform within the system. Restaurant365