> Portal Navigation: > > - Append `.md` to any URL under `https://dev.wix.com/docs/` to get its markdown version. > - Pages are either content pages (article or reference text) or menu pages (a list of links to child pages). > - To get a menu page, truncate any URL to a parent path and append `.md` (e.g. `https://dev.wix.com/docs/sdk.md`, `https://dev.wix.com/docs/sdk/core-modules.md`). > - Top-level index of all portals: https://dev.wix.com/docs/llms.txt > - Full concatenated docs: https://dev.wix.com/docs/llms-full.txt ## Resource: About Elevated Permissions ## Article: About Elevated Permissions ## Article Link: https://dev.wix.com/docs/api-reference/articles/authentication/about-elevated-permissions.md ## Article Content: # About Elevated Permissions Wix's permission system is designed to keep site data secure by ensuring that only authorized users can perform sensitive operations. This means that certain API methods are restricted based on user [identity](https://dev.wix.com/docs/api-reference/articles/authentication/about-identities.md) and [roles and permissions](https://support.wix.com/en/article/roles-permissions-overview). For example, [Confirm Booking](https://dev.wix.com/docs/api-reference/business-solutions/bookings/bookings/bookings-writer-v2/confirm-booking.md) can't be called by site visitors or site members, or by Wix users without an administrative bookings role. However, there are legitimate scenarios where it's necessary to call a method that requires higher-level permissions than the current user has. In Wix sites, Wix apps, and Wix-managed headless projects, you can use elevation to ensure the method is always called with the required level of authorization. > **Note:** > - In self-managed headless projects, use [API key authentication](https://dev.wix.com/docs/api-reference/articles/authentication/api-keys/about-api-keys.md) to make calls with the required level of authorization. ## Security considerations Elevation permits [identities](https://dev.wix.com/docs/api-reference/articles/authentication/about-identities.md) to call methods they typically can't access. Therefore, only use elevation intentionally and securely. Due to potential security risks, methods can only be elevated in backend code. ## Implementation approaches ::::tabs :::REST_TAB Different development contexts require different approaches for implementing elevation. For more details, see the article corresponding to your context: - [Elevation in Wix apps not made in Blocks](https://dev.wix.com/docs/build-apps/develop-your-app/access/authorization/about-elevation.md) - [Elevation in Wix sites or Blocks apps](https://dev.wix.com/docs/develop-websites/articles/coding-with-velo/authorization/elevation.md) - [Elevation in Wix-managed headless projects](https://dev.wix.com/docs/go-headless/develop-your-project/wix-managed-headless/authentication/authentication-and-api-integration.md) ::: :::SDK_TAB The use cases for elevating permissions are different depending on the type of project you are building. ### Elevation when building apps When building apps, calls to Wix APIs can be restricted based on user [identity](https://dev.wix.com/docs/api-reference/articles/authentication/about-identities.md). For example, if an app includes a [site widget](https://dev.wix.com/docs/build-apps/develop-your-app/extensions/site-extensions/site-widgets/about-site-widget-extensions.md) that manages bookings, most calls from the extension can be made with site visitor or member authentication. However, the app may also need to call APIs that can't be called when authenticated as a visitor or member, such as [Confirm Booking](https://dev.wix.com/docs/api-reference/business-solutions/bookings/bookings/bookings-writer-v2/confirm-booking.md). Calls to these APIs require elevation. Learn more about [elevation when building apps](https://dev.wix.com/docs/build-apps/develop-your-app/access/authorization/about-elevation.md). ### Elevation when building Wix-managed headless projects When building a Wix-managed headless project, use elevation to call methods that require higher-level permissions than the current identity has. For example, calling [Get Site Properties](https://dev.wix.com/docs/api-reference/business-management/site-properties/properties/get-site-properties.md) requires elevation. To call backend APIs from a headless client, [set up an HTTP endpoint](https://dev.wix.com/docs/wix-cli/guides/development/http-endpoints/about-http-endpoints.md) and [elevate API call permissions](https://dev.wix.com/docs/wix-cli/guides/about-the-wix-cli.md). Learn more about [elevation when building Wix-managed headless projects](https://dev.wix.com/docs/go-headless/develop-your-project/wix-managed-headless/authentication/authentication-and-api-integration.md). > **Note:** For self-managed headless projects, use [API key authentication](https://dev.wix.com/docs/go-headless/develop-your-project/self-managed-headless/authentication/about-admin-operations.md). ### Elevation when developing websites When developing websites, calls to Wix APIs can be restricted based on user [identity](https://dev.wix.com/docs/api-reference/articles/authentication/about-identities.md) or [roles and permissions](https://support.wix.com/en/article/roles-permissions-overview). For example, if a page on a site manages bookings, it may need to call Confirm Booking. Only a Wix user with an administrative bookings role can call this method. Therefore, calls to this method from a page's code require elevation. Learn more about elevation when [developing websites](https://dev.wix.com/docs/develop-websites/articles/coding-with-velo/authorization/elevation.md). ::: ::::