クラウド基盤

ID、テナント、および認可

サイト、チームロール、APIトークン、アシスタント用OAuth、サービスアカウント、およびアクティビティログについて解説します。

提供中

IDは、誰が呼び出しを行っており、何ができるかを定義します。すべてのリクエストは1つのサイトにスコープされ、すべてのトークンの権限は、その背後にいるユーザーまたはサービスアカウントのロールによって制限されます。

コアオブジェクト

Site team RBAC (custom roles, access requests), personal access tokens, service accounts and OAuth 2.1 for the Management API, customer session tokens提供中
API
PAT (knr_pat_), OAuth 2.1 (knr_at_) with site scope; auth.whoami?websiteId= reports role vs. token scope; Customer Bearer (knr_cat_) bound to (websiteId, contactId)
Elements
<kanorio-login>
ホスト型サイト
/settings/team, /settings/team/roles, /account/api-access
Webhooks
team.accessRequest.created
Custom end-user application roles (e.g. teacher / TA / branch manager in your own app)提供なし
代替手段
Kanorio separates operational RBAC (site team), customer commercial entitlements (Entitlement), and plan entitlements. Fine-grained custom app roles (e.g. "teacher can only view students in class B") are not offered as a platform primitive; enforce them in your own application backend or an authorization service such as OpenFGA.
Enterprise SSO (SAML / OIDC / SCIM) & custom contractual uptime SLA提供なし
代替手段
Kanorio provides Google OAuth, Passkeys (WebAuthn), TOTP 2FA, free team RBAC with system roles (OWNER, ADMIN) plus up to 20 custom roles per site, and live platform status at status.kanorio.com. SAML/SCIM directory sync and custom SLA contracts are not offered.

site.subscription.upcomingRenewal · Fired before an annual plan renews when annual add-ons or pending add-on / platform fees will be charged on the same invoice.
site.subscription.addOnPriceChange · Fired at least 30 days before add-on prices change for the site, with the per-level price changes and effective date.
team.accessRequest.created · Fired when a team member requests permissions they are missing, so people who manage the team can review it.

管理画面での使い方はヘルプセンターで説明しています。