GET /lucca-api/events, the results are filtered based on the caller’s
permissions. Not all events are visible to all consumers.
OAuth scope-based topic filtering
When an OAuth client calls the events endpoint, it will only receive events whose topic matches one of its granted OAuth scopes. Each resource scope grants access to all event topics for that resource. For example, a client with theemployees.readonly scope will see:
employee.createdemployee.updatedemployee.deleted
.readonly and .readwrite variants of a resource scope grant the same read access to events.
In other words, holding employees.readwrite gives access to the same event topics as employees.readonly.
The
events.readonly scope is required to call the events endpoint, but it does not by itself determine
which topics are visible. The visible topics are determined by the resource scopes granted to your OAuth client.Establishment-level filtering
Like most resources, Events are also filtered by the caller’s permitted business establishments. You will only see events that occurred within establishments your credentials have access to.Some resources are not linked to a particular business establishment, like Departments. If you have
events.readonly
and departments.* scopes, you’ll see events for all departments.Section-level filtering (employee-attribute events)
Events withemployee-attribute.* topics are additionally filtered by the HR file sections granted to
your OAuth client. You will only see employee-attribute events for attributes that belong to a section your
client has been explicitly given access to.
This is the same section-based access control that applies when reading employee attributes directly.
See the employee-attributes guide for
how to configure section access on your OAuth client.