Roles, audit log, API keys and webhooks
Three system roles come ready, owner, supervisor and storekeeper, and you can add your own. Every change a person or an integration makes lands in the audit log with who, when and what. API keys are scoped to permissions and shown once; webhooks are signed and metered.
- 16 seeded permissions in a matrix per role
- Field-level access on custom forms
- Audit log of changes, sign-ins, keys and webhooks
- REST API, scoped keys, HMAC-signed webhooks
The default matrix
Owners hold everything. Supervisors run production and sales. Storekeepers post stock and issue material. Change any of it, or add roles, in Settings.
| Permission | Owner | Supervisor | Storekeeper |
|---|---|---|---|
| Settings, users, API keys, webhooks, audit log | yes | no | no |
| Items, units, warehouses: write | yes | yes | no |
| Stock: post movements, receive POs | yes | no | yes |
| Bills of materials: write | yes | yes | no |
| Work orders: lifecycle | yes | yes | no |
| Work orders: issue and return material | yes | no | yes |
| Sales and purchasing: write | yes | yes | no |
| Custom forms: design | yes | no | no |
| Workflow rules | yes | no | no |
| Zudo AI | yes | yes | no |
From the ZMOS user guide, section 17. The owner role is locked; other roles are edited in a matrix with one column per role.
The audit log
- What it records
Work orders, users, items, stock postings, BOM releases, settings, API keys and webhooks, record edits and every Zudo AI proposal that was applied, with the approval answers.
- Who, when, what
Each entry names the person or key, the time and the change. A cost changed by a receipt reads, for example, Standard cost of BOLT-M8 changed from 0.25 to 0.30 by stock movement RCV-000123.
- Retention
7 days on the trial, 30 on Standard, 90 on Business, a year on Enterprise.
- Sessions
Any role, status or password change signs that person out everywhere. People can sign out one device or all others from their profile.
API keys and webhooks
- Scoped keys
A key carries the permissions you choose, never more than its creator holds, and an optional expiry. It is shown once, prefixed zk_, and revoked immediately when deleted. Calls are metered: 10,000 a month on the trial, 50,000 on Standard, 250,000 on Business.
- Fifteen events
ping, job created, released, started, completed, closed and cancelled, sales order confirmed, purchase order received, shipment shipped, invoice issued and paid, vendor bill approved, NCR opened and closed.
- Signed deliveries
Each delivery carries the event, a delivery id and an HMAC-SHA256 signature of the raw body keyed with the endpoint secret. Verify it before trusting the body. Targets must be public HTTPS URLs.
- Testing and pausing
Send a ping from the settings page, pause an endpoint without deleting it, and read the delivery count on the usage page.
- The REST API
Masters, stock, BOMs and work orders, sales and purchasing, users and roles, custom forms and records, attachments, dashboards. The user guide has curl and JavaScript examples.
In numbers
- seeded permissions
- 16
- system roles, plus your own
- 3
- webhook events
- 15
- API calls a month on the free trial
- 10,000
- a key or a secret is shown
- Once
- audit retention on Business
- 90 days
Watch it work
See this part of ZMOS on video
Recorded in the product itself, narrated in English, start to finish.
56:3015. The team: roles, invitations and integrations
Roles, inviting the team, and connecting other systems with keys and webhooks. The clip starts at this chapter of the full two-hour build; every step is on sample data and the current version.
Can I control what a storekeeper sees?
Yes. Roles set permissions by module, and custom forms go down to single fields: editable, read-only or hidden per role. A hidden field never leaves the server for that role.
Is there an audit trail?
Every change is in the audit log with who, when and what, including stock postings, settings, keys, webhooks and applied Zudo AI proposals. Retention depends on the plan, from 7 days on the trial to a year on Enterprise.
Does ZMOS have an API?
Yes, a REST API with keys scoped to permissions. The free trial includes 10,000 calls a month; Standard 50,000; Business 250,000. The user guide documents the endpoints with examples.
How do webhooks work?
You register an HTTPS URL and pick events. Each delivery is signed with HMAC-SHA256 using the endpoint secret, carries a delivery id and is metered. There are no retries, so answer quickly with a 2xx.
Can Zudo Works build the integration for me?
Yes. The same engineers build Zoho and custom integrations as a service, fixed price for defined work.
Invite your storekeeper and see the difference
Six months free for three users, no card. Set the roles in Settings and connect your first webhook the same day.