# 身份、租户与授权

> Sites, team roles, API tokens, OAuth for assistants, service accounts and the activity log.

> Markdown version of https://kanorio.com/zh-CN/developers/products/identity. Append `.md` to any developer docs URL for this format. Index: https://kanorio.com/llms.txt · MCP: https://app.kanorio.com/api/mcp
>
> Translated from the English original: https://kanorio.com/en/developers/products/identity.md

Status: **Available**

身份决定了谁在发出请求以及他们可以执行什么操作。每个请求都限定于单个网站，且每个令牌的权限皆受限于其背后人员或服务账号的角色。

## 核心对象

- **网站 (Sites)。** 租户边界。数据绝不会在网站之间流动。
- **团队成员与角色。** 拥有者、管理员、编辑者与自定义角色，以及访问请求。
- **令牌 (Tokens)。** 个人访问令牌、用于助手的 OAuth 访问权限，以及服务账号令牌。请参阅 [身份验证](https://kanorio.com/zh-CN/developers/authentication)。
- **活动日志 (Activity log)。** 在后台或通过 API 进行的每一项变更，以及执行变更的人员。

## API 的运作方式

- `GET /whoami` 显示当前令牌可以执行的操作。
- 使用 Management API 列出与创建网站、读取使用量与活动日志。
- 客户可以访问的内容属于 [客户、会员资格与权益](https://kanorio.com/zh-CN/developers/products/customers)，而非身份系统。

## What the APIs expose

| Capability | Status | API | Elements | Hosted site | Webhooks |
| --- | --- | --- | --- | --- | --- |
| Site team RBAC (custom roles, access requests), personal access tokens, service accounts and OAuth 2.1 for the Management API, customer session tokens | Available | PAT (`knr_pat_`), OAuth 2.1 (`knr_at_`) with site scope; `auth.whoami?websiteId=` reports role vs. token scope; Customer Bearer (`knr_cat_`) bound to `(websiteId, contactId)` | `<kanorio-login>` | `/settings/team`, `/settings/team/roles`, `/account/api-access` | `team.accessRequest.created` |
| Custom end-user application roles (e.g. teacher / TA / branch manager in your own app) | Not offered | — | — | — | — |
| Enterprise SSO (SAML / OIDC / SCIM) & custom contractual uptime SLA | Not offered | — | — | — | — |

## API reference

- Management API: [Sites](https://kanorio.com/en/developers/management-api/sites) (6 operations)
- Management API: [Auth](https://kanorio.com/en/developers/management-api/auth) (1 operations)

## Webhook events

- `site.subscription.upcomingRenewal`: Fired before an annual plan renews when annual add-ons or pending add-on / platform fees will be charged on the same invoice.
- `site.subscription.addOnPriceChange`: Fired at least 30 days before add-on prices change for the site, with the per-level price changes and effective date.
- `team.accessRequest.created`: Fired when a team member requests permissions they are missing, so people who manage the team can review it.

Payloads: https://kanorio.com/en/developers/webhooks/events

## Recent changes

- 2026-10-28: Service account tokens (knr_sa_)
- 2026-10-24: Fine-grained scopes for publishing, domains, developer settings, media, orders and collection schemas
- 2026-10-23: Activity log redacts internal fields of platform actions
- 2026-10-14: OAuth client authentication, scope defaults and stability labels

Full changelog: https://kanorio.com/en/developers/changelog

## For site owners

Dashboard help: https://kanorio.com/zh-CN/help/team-permissions