Method & PathPermissionPurpose
GET audit-logsaudit.viewPaginated tenant audit log, filterable by event
GET searchEnforced per-module inside the APIGlobal or module-scoped search
GET notifications—User's own notifications, paginated/filterable
POST notifications/read-all—Mark all own notifications read
POST notifications/{notification}/read—Mark one notification read
GET notifications/preferences / PUT notifications/preferences—Notification channel preferences
GET dashboard— (financials gated by report.view, audit feed by audit.view inside the method)Role-aware summary: permissions, team count, financials (nulled if unauthorized), per-module review/approval/rejected queue counts, recent audit activity