Permissions

​

Get App Permissions

​

Endpoint

GET https://api.mentra.glass/api/permissions/:packageName

GET https://devapi.mentra.glass/api/permissions/:packageName

GET http://localhost:8002/api/permissions/:packageName

​

Headers

Authorization: Bearer <coreToken>
X-Org-Id: <organizationId> (optional)

​

Parameters

​

Response

{
  "permissions": [
    {
      "type": "CAMERA",
      "description": "Take photos to analyze visual content"
    },
    {
      "type": "MICROPHONE",
      "description": "Listen to conversations for transcription"
    }
  ]
}

{
  "error": "Unauthorized",
  "message": "You do not have permission to view this app's permissions"
}

{
  "error": "App not found"
}

{
  "error": "Internal server error"
}

​

Implementation

• File: packages/cloud/src/routes/permissions.routes.ts:24-76
• Middleware: validateCoreToken
• Authorization: Checks app ownership or published status

​

Access Control

• App is published in the app store (appStoreStatus === 'PUBLISHED')
• User’s organization owns the app (via X-Org-Id header)
• User is the app developer (email matches developerId)
• User is member of the app’s organization

​

Update App Permissions

​

Endpoint

PATCH https://api.mentra.glass/api/permissions/:packageName

PATCH https://devapi.mentra.glass/api/permissions/:packageName

PATCH http://localhost:8002/api/permissions/:packageName

​

Headers

Authorization: Bearer <coreToken>
X-Org-Id: <organizationId> (optional)
Content-Type: application/json

​

Parameters

​

Request Body

{
  "permissions": [
    {
      "type": "CAMERA",
      "description": "Take photos to analyze visual content"
    },
    {
      "type": "MICROPHONE",
      "description": "Listen to conversations for transcription"
    },
    {
      "type": "DISPLAY",
      "description": "Show information on glasses display"
    }
  ]
}

​

Response

{
  "error": "Permissions must be an array" // or "Invalid permission type: INVALID_TYPE"
}

{
  "error": "Unauthorized",
  "message": "You do not have permission to modify this app"
}

{
  "error": "App not found"
}

{
  "error": "Internal server error"
}

​

Implementation

• File: packages/cloud/src/routes/permissions.routes.ts:83-155
• Validation: Validates permission types against PermissionType enum from SDK
• Authorization: Requires app ownership

​

Permission Types

• MICROPHONE - Access to device microphone
• LOCATION - Access to device location
• BACKGROUND_LOCATION - Access to location in background
• CALENDAR - Access to device calendar
• CAMERA - Access to device camera
• NOTIFICATIONS - Legacy notification permission (backward compatibility)
• READ_NOTIFICATIONS - Access to read notifications
• POST_NOTIFICATIONS - Access to post notifications
• ALL - All available permissions

​

Permission Object Structure

• type: One of the valid PermissionType enum values
• description: String explaining why the app needs this permission (optional but recommended)

​

Error Codes

​

Notes

• Each permission should include a description explaining its use to users
• Permissions are validated against the SDK’s PermissionType enum
• Organization context can be provided via X-Org-Id header
• Only app owners can modify permissions
• All users can view permissions for published apps
• The endpoint uses MongoDB’s findOneAndUpdate to ensure atomic updates
• Console logs are present in the code for debugging (lines 44-45, 51)