Permissions and Access Management

Permissions and Access Management allows you to define what actions each user can perform in the Stripo Plugin editor.

This ensures that only authorized users can view or modify emails, modules, or related resources.

All permissions are managed on your backend — the Stripo Plugin enforces them automatically.

How it works

1. Enable the User Permissions API in your Stripo Plugin account: Plugin → Server Settings → User Permissions API.

2. Provide your backend endpoint URL and Basic Authentication credentials.

   

3. When the editor is initialized, Stripo will call your endpoint with the ES‑PLUGIN‑UI‑DATA header, which contains the metadata you passed in the plugin initialization script.

4. Your backend must respond with a JSON object that specifies which actions are allowed for this user.

5. Based on the response, the Stripo editor will enable or disable features accordingly.

Response format

{
  "codeEditor": {
    "read": true,
    "write": false
  },
  "appearance": {
    "read": true,
    "write": false
  },
  "content": {
    "read": true,
    "write": false,
    "textOnly": false
  },
  "modules": {
    "read": true,
    "write": false
  },
  "versionHistory": {
    "read": true,
    "write": false
  },
  "manageOwnComments": {
    "read": true,
    "write": false
  },
  "manageAllComments": {
    "read": true,
    "write": false
  },
  "accessibilityTesting": {
    "read": true,
    "write": true
  }
}

Permissions reference

The response object supports the following permission groups and actions:

Permission	Action	Description
codeEditor	read	Allows the user to open and view the HTML code editor.
	write	Allows the user to edit and save changes in the HTML code editor.
appearance	read	Allows viewing appearance settings (fonts, colors, styles).
	write	Allows modifying and saving appearance settings.
content	read	Allows opening and viewing template content.
	write	Allows modifying content (adding/removing blocks, changing layout, etc.).
	textOnly	Allows editing only text values without changing layout or design.
modules	read	Allows browsing and inserting custom/saved modules.
	write	Allows creating, updating, or deleting modules.
versionHistory	read	Allows viewing the template version history.
	write	Allows restoring the versions.
manageOwnComments	read	Allows the user to view the Comments tab and see comment threads created by them. This permission controls the visibility of the tab: it is shown if either manageOwnComments.read or manageAllComments.read is enabled, and hidden only when both are disabled.
	write	Allows the user to create new comments. Authors can edit, delete, resolve, reopen, and move their own comments when they have read access.
manageAllComments	read	Allows the user to view the Comments tab and see comments created by all users. When this permission is disabled but manageOwnComments.read is enabled, the user sees only their own comment threads.
	write	Allows the user to edit, delete, resolve, reopen, and move comments created by other users, providing moderation capabilities.
accessibilityTesting	read	Allows the user to enter the Accessibility Testing Mode.
	write	Allows the user to edit the email while Accessibility Testing Mode is active. If disabled, the email will be available in view-only mode during accessibility testing.

Example scenarios

• Full editing
  Grant read: true and write: true in all permissions.
• Read-only access
  Grant read: true and set all write: false.
• Text-only editing
  Grant content.read: true and content.textOnly: true, with content.write: false.

API Reference

For details on the request/response format, see User Permissions API → GET method.