Data-Scoped Feature Permissions

Understand Feature Permissions that are enabled for a team but granted through Collection data permissions.

Overview

Most Feature Permissions apply directly to a User Role: if the role grants the feature, the user can access that feature area across the team. Data-scoped Feature Permissions work differently. They are enabled for the team, but assigned to users through Collection data permissions.

This lets Simply360 expose feature access at the same boundary as record access. A user can have a feature for one Collection, inherit it from a parent Collection, and have no access for another Collection.

Current Data-Scoped Feature Permissions

Permission	Scope	View level	Edit level
`DOCUMENT_TEMPLATES_TEAM`	Team-owned document templates assigned to a Collection.	View and generate documents from Team templates for the assigned Collection or a child Collection.	Create, update, archive, reassign, and copy Team templates for that Collection.
`DOCUMENT_TEMPLATES_PERSONAL`	User-owned personal document templates assigned to a Collection.	View and generate documents from the actor's personal templates. Team Admins can inspect all owners.	Create, update, archive, reassign, and copy personal templates. Team Users can mutate only their own personal templates.

How Access Is Calculated

A data-scoped Feature Permission requires both team availability and Collection data access:

The team must have the underlying Feature Permission enabled.
The user's role must have a Collection permission grant for the target Collection, or a parent grant with applyToChildCollections.
That Collection grant must include the data-scoped Feature Permission.
The requested action must match the access level: View Only for reads/use, View & Edit for writes.

Record and field permissions still apply. A user who can use a document template cannot merge fields or records they are not otherwise allowed to read.

Permission Snapshot

Use GET /v1/users/me?expand=permissionSnapshot to inspect a signed-in user's effective permissions. Data-scoped feature access appears under dataFeatureCapabilitiesByCollection, keyed by Collection Simply ID and Feature Permission ID.

{
  "permissionSnapshot": {
    "dataFeatureCapabilitiesByCollection": {
      "COLL-1234-ABCD": {
        "DOCUMENT_TEMPLATES_TEAM": {
          "canView": true,
          "canEdit": false
        },
        "DOCUMENT_TEMPLATES_PERSONAL": {
          "canView": true,
          "canEdit": true
        }
      }
    }
  }
}

Do not expect data-scoped features to appear as ordinary role-level Feature Permissions. They are intentionally absent from role-level feature grants.

API Behavior

APIs that manage a data-scoped feature enforce Collection access on every relevant operation. For document templates, the Content Templates API checks the template's assigned Collection and scope.

# List document templates available for a Collection
curl -s "https://api.simply360.app/v1/content-templates/collection/COLL-1234-ABCD" \
  -H "Authorization: Bearer $S360_API_KEY"

# Create a Team document template for that Collection
curl -s -X POST "https://api.simply360.app/v1/content-templates" \
  -H "Authorization: Bearer $S360_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Donation receipt",
    "textContent": "Thank you, {{First Name}}.",
    "documentSettings": { "pageSize": "letter", "orientation": "portrait" },
    "dataCollectionSimplyId": "COLL-1234-ABCD",
    "templateScope": "TEAM"
  }'

View-level access allows listing, reading, previewing, and using a template for document generation. Edit-level access is required to create, update, archive, copy, or reassign templates.

Integration Notes

API keys inherit data-scoped feature access from their assigned Team Role's Collection data permissions.
OAuth scopes narrow the authorizing user's already-granted permissions; they do not create Collection access by themselves.
MCP tools, Ask Simply, the TypeScript SDK, and the webapp all use the same server-side permission evaluator.
Team Admins bypass Team User data-permission checks after ownership is resolved, but the team must still have the feature enabled.