> For the complete documentation index, see [llms.txt](https://tech.x2bee.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tech.x2bee.com/dev-guide/developer-guide-en/dev-start/markdown/api-controller-authorization.md).

# API (Controller) Authorization

Configure authorization through Spring Security configuration, Controller annotations, and role-specific API clients.

* `x2bee-bo`: guest URIs use `permitAll()`; other requests require authentication and administrator login provides `ROLE_ADMIN`.
* `x2bee-api-bo`: requests require `ROLE_SERVICE` or `ROLE_ADMIN`.
* Other API projects use `@EnableMethodSecurity` and Controller-level security; signed-in FO/MO users receive `ROLE_MEMBER`.

Use `@Secured("ROLE_SERVICE")`, `@Secured("ROLE_MEMBER")`, or `@PreAuthorize(...)` as appropriate. Use `RestApiUtil` for service authorization and `RestApiUtil.getSecured` or related methods for member authorization. Secured calls require a signed-in user because they use `mbrNo`.