Title: Roles, Audit Log, API Keys and Webhooks | ZMOS URL: https://zudoworks.com/zmos/roles-audit-api/ Description: ZMOS roles set what each person may see and do, down to fields. Every change lands in the audit log. Scoped API keys and signed webhooks connect tools. Updated: 2026-11-03 ZMOSControl and connect # Roles, audit log, API keys and webhooks Three system roles come ready, owner, supervisor and storekeeper, and you can add your own. Every change a person or an integration makes lands in the audit log with who, when and what. API keys are scoped to permissions and shown once; webhooks are signed and metered. [Try ZMOS free](https://app.zudoworks.com/signup) [Book a 20-minute demo](https://zudoworks.com/contact/) - 16 seeded permissions in a matrix per role - Field-level access on custom forms - Audit log of changes, sign-ins, keys and webhooks - REST API, scoped keys, HMAC-signed webhooks ![The ZMOS user menu open on the Customers page, showing the role badge, theme and density settings, the user guide and sign out](https://zudoworks.com/Asset/img/zmos/user-menu.webp) The user menu: role badge, theme, density, the complete user guide. Sample data. ## The default matrix Owners hold everything. Supervisors run production and sales. Storekeepers post stock and issue material. Change any of it, or add roles, in Settings. | Permission | Owner | Supervisor | Storekeeper | | --- | --- | --- | --- | | Settings, users, API keys, webhooks, audit log | yes | no | no | | Items, units, warehouses: write | yes | yes | no | | Stock: post movements, receive POs | yes | no | yes | | Bills of materials: write | yes | yes | no | | Work orders: lifecycle | yes | yes | no | | Work orders: issue and return material | yes | no | yes | | Sales and purchasing: write | yes | yes | no | | Custom forms: design | yes | no | no | | Workflow rules | yes | no | no | | Zudo AI | yes | yes | no | From the ZMOS user guide, section 17. The owner role is locked; other roles are edited in a matrix with one column per role. ## The audit log 1. **What it records** Work orders, users, items, stock postings, BOM releases, settings, API keys and webhooks, record edits and every Zudo AI proposal that was applied, with the approval answers. 2. **Who, when, what** Each entry names the person or key, the time and the change. A cost changed by a receipt reads, for example, Standard cost of BOLT-M8 changed from 0.25 to 0.30 by stock movement RCV-000123. 3. **Retention** 7 days on the trial, 30 on Standard, 90 on Business, a year on Enterprise. 4. **Sessions** Any role, status or password change signs that person out everywhere. People can sign out one device or all others from their profile. ## API keys and webhooks 1. **Scoped keys** A key carries the permissions you choose, never more than its creator holds, and an optional expiry. It is shown once, prefixed zk\_, and revoked immediately when deleted. Calls are metered: 10,000 a month on the trial, 50,000 on Standard, 250,000 on Business. 2. **Fifteen events** ping, job created, released, started, completed, closed and cancelled, sales order confirmed, purchase order received, shipment shipped, invoice issued and paid, vendor bill approved, NCR opened and closed. 3. **Signed deliveries** Each delivery carries the event, a delivery id and an HMAC-SHA256 signature of the raw body keyed with the endpoint secret. Verify it before trusting the body. Targets must be public HTTPS URLs. 4. **Testing and pausing** Send a ping from the settings page, pause an endpoint without deleting it, and read the delivery count on the usage page. 5. **The REST API** Masters, stock, BOMs and work orders, sales and purchasing, users and roles, custom forms and records, attachments, dashboards. The user guide has curl and JavaScript examples. ## In numbers seeded permissions : 16 system roles, plus your own : 3 webhook events : 15 API calls a month on the free trial : 10,000 a key or a secret is shown : Once audit retention on Business : 90 days Watch it work ## See this part of ZMOS on video Recorded in the product itself, narrated in English, start to finish. [![Video thumbnail: Chapter 15. The team: roles, invitations and integrations](https://zudoworks.com/Asset/img/zmos/user-menu.webp)Chapter 15. The team: roles, invitations and integrations](https://www.youtube.com/watch?v=X_AptIFS1Jo&t=3390s) 56:3015. The team: roles, invitations and integrations Roles, inviting the team, and connecting other systems with keys and webhooks. The clip starts at this chapter of the full two-hour build; every step is on sample data and the current version. [All 38 chapters and the 20-minute tour](https://zudoworks.com/zmos/videos/) ## Questions buyers ask Short answers. The [pricing page](https://zudoworks.com/zmos/pricing/) covers plans and the trial. ### Related - [Security in ZMOS](https://zudoworks.com/zmos/security/) - [Low-code forms and rules](https://zudoworks.com/zmos/low-code/) - [Integration services](https://zudoworks.com/zoho-integrations/) - [Zudo AI capabilities per role](https://zudoworks.com/zudo-ai/) - [The complete ZMOS user guide](https://zudoworks.com/guide/) Can I control what a storekeeper sees? Yes. Roles set permissions by module, and custom forms go down to single fields: editable, read-only or hidden per role. A hidden field never leaves the server for that role. Is there an audit trail? Every change is in the audit log with who, when and what, including stock postings, settings, keys, webhooks and applied Zudo AI proposals. Retention depends on the plan, from 7 days on the trial to a year on Enterprise. Does ZMOS have an API? Yes, a REST API with keys scoped to permissions. The free trial includes 10,000 calls a month; Standard 50,000; Business 250,000. The user guide documents the endpoints with examples. How do webhooks work? You register an HTTPS URL and pick events. Each delivery is signed with HMAC-SHA256 using the endpoint secret, carries a delivery id and is metered. There are no retries, so answer quickly with a 2xx. Can Zudo Works build the integration for me? Yes. The same engineers build Zoho and custom integrations as a service, fixed price for defined work.