As a vendor, I am preparing to potentially link my store to offer dropship to another website (they take orders, I do fulfilment and processing on Magento 2), and create an API for this via Magento 2 (System > Extension > Integrations). The dropship site is using jetti.io for API purposes. I will be creating an admin user on Magento's back end, followed by an API key set but I want to set it with the bare minimum permissions required for dropship, so, I need to give the drop ship API permissions to:
- Read (but not edit) any product data including stock availability or sellable stock, image paths, attribute values etc.
- Create orders and mark as paid or create the invoice (they receive the payment)
- Read/check status of orders it has created so Magento side we handle the shipment including related shipments and credits for returns, or cancelled orders (we, the vendor should have the cancellation right)
I want to ensure everything else permission-side is excluded (such as customer data, orders that have not been placed/created via the API are not accessible, and every other area of Magento). Obviously this is security best practice.
Can anyone explain this or point me in the direction of resources which will explain this setup permission-wise? I have of course reached out to jetti.io and the dropship channel but as a vendor and store owner/manager, I'd prefer to understand from a Magento 2 perspective of what data is being shared by API permission on the back end (screenshot below) and what minimum rights would be required, plus any information which may have to be exchanged which is not required.