# Identity, Tenant & Authorization

> Sites, team roles, API tokens, OAuth for assistants, service accounts and the activity log.

> Markdown version of https://kanorio.com/en/developers/products/identity. Append `.md` to any developer docs URL for this format. Index: https://kanorio.com/llms.txt · MCP: https://app.kanorio.com/api/mcp

Status: **Available**

Identity answers who is calling and what they may do. Every request is scoped to one site, and every token's permissions are limited by the role of the person or service account behind it.

## Core objects

- **Sites.** The tenant boundary. Data never crosses between sites.
- **Team members and roles.** Owners, admins, editors and custom roles, with access requests.
- **Tokens.** Personal access tokens, OAuth access for assistants and service account tokens. See [Authentication](https://kanorio.com/en/developers/authentication).
- **Activity log.** Every change made in the dashboard or through the APIs, with who made it.

## How the APIs fit

- `GET /whoami` shows what the current token can do.
- List and create sites, read usage and the activity log with the Management API.
- What a customer may access belongs to [Customers, Membership & Entitlements](https://kanorio.com/en/developers/products/customers), not to identity.

## What the APIs expose

| Capability | Status | API | Elements | Hosted site | Webhooks |
| --- | --- | --- | --- | --- | --- |
| Site team RBAC (custom roles, access requests), personal access tokens, service accounts and OAuth 2.1 for the Management API, customer session tokens | Available | PAT (`knr_pat_`), OAuth 2.1 (`knr_at_`) with site scope; `auth.whoami?websiteId=` reports role vs. token scope; Customer Bearer (`knr_cat_`) bound to `(websiteId, contactId)` | `<kanorio-login>` | `/settings/team`, `/settings/team/roles`, `/account/api-access` | `team.accessRequest.created` |
| Custom end-user application roles (e.g. teacher / TA / branch manager in your own app) | Not offered | — | — | — | — |
| Enterprise SSO (SAML / OIDC / SCIM) & custom contractual uptime SLA | Not offered | — | — | — | — |

## API reference

- Management API: [Sites](https://kanorio.com/en/developers/management-api/sites) (6 operations)
- Management API: [Auth](https://kanorio.com/en/developers/management-api/auth) (1 operations)

## Webhook events

- `site.subscription.upcomingRenewal`: Fired before an annual plan renews when annual add-ons or pending add-on / platform fees will be charged on the same invoice.
- `site.subscription.addOnPriceChange`: Fired at least 30 days before add-on prices change for the site, with the per-level price changes and effective date.
- `team.accessRequest.created`: Fired when a team member requests permissions they are missing, so people who manage the team can review it.

Payloads: https://kanorio.com/en/developers/webhooks/events

## Recent changes

- 2026-10-28: Service account tokens (knr_sa_)
- 2026-10-24: Fine-grained scopes for publishing, domains, developer settings, media, orders and collection schemas
- 2026-10-23: Activity log redacts internal fields of platform actions
- 2026-10-14: OAuth client authentication, scope defaults and stability labels

Full changelog: https://kanorio.com/en/developers/changelog

## For site owners

Dashboard help: https://kanorio.com/en/help/team-permissions