---
title: "Get entitlements template by ID"
method: GET
path: "/api-regulated/v1/entitlements-templates/{id}"
tags: ["EntitlementsTemplate"]
---

# Get entitlements template by ID

`GET /api-regulated/v1/entitlements-templates/{id}`

## Request

- Base URL: `https://api.currencyguard.com`
- URL: `https://api.currencyguard.com/api-regulated/v1/entitlements-templates/{id}`
- Auth: HTTP bearer

Retrieves a specific entitlements template by its UUID. Regulated users can only access regulated and customer templates.

## Path parameters

- `id` string, uuid, required

## Response `200`

Template retrieved successfully

- EntitlementsTemplateDTO: Schema for representing a EntitlementsTemplate
  - `id` string, uuid: The unique identifier for the entitlements template.
  - `templateName` string: The unique name of the entitlements template.
  - `description` string: Description of what this template provides.
  - `userType` 'INTERNAL' | 'REGULATED' | 'CUSTOMER' | 'SALES': The user type this template applies to.
  - `entitlements` EntitlementsDTO: User permissions organized by scope (internal/regulated/customer) and functional area (risk-management, administration, onboarding). Each permission is an optional boolean flag that controls specific actions the user can perform.
    - `internal` object: Permissions for internal users
      - `ledger` object: Ledger permissions
        - `canModifyScheduler` boolean: Entitles the internal user to schedule, pause, resume, and trigger scheduled jobs in the ledger domain
        - `canModifyChartOfAccounts` boolean: Entitles the internal user to create, update, and deactivate chart of accounts entries
        - `canModifyAccountPeriods` boolean: Entitles the internal user to create, update, and manage account periods and month-end close workflows
        - `canEnterJournals` boolean: Entitles the internal user to create, batch-create, and reverse journal entry pairs
      - `market-data` object: Market data permissions
        - `canModifySpotFX` boolean: Entitles the internal user to configure spot FX price sources, set manual prices, and manage spot quote data
        - `canModifyForwardCurves` boolean: Entitles the internal user to configure forward curve price sources and manage forward curve quote data
        - `canModifyIRCurves` boolean: Entitles the internal user to configure interest rate curve price sources and manage IR curve quote data
        - `canModifyVolSurfaces` boolean: Entitles the internal user to configure vol surface price sources and manage vol surface quote data
        - `canModifyHistoricFXPrices` boolean: Entitles the internal user to sync, upload, and delete historic FX price data
        - `canAuthenticateSaxo` boolean: Entitles the internal user to manage Saxo authentication sessions (login, logout, refresh)
      - `sales-users` object: Sales users permissions
        - `canDisableSalesUser` boolean: Entitles the internal user to disable (suspend) sales users
        - `canEnableSalesUser` boolean: Entitles the internal user to re-enable a disabled sales user
        - `canDeleteSalesUserPii` boolean: Entitles the internal user to permanently delete a sales user's PII data
      - `templates` object: Templates permissions
        - `canEditEntitlementTemplate` boolean: Entitles the internal user to create, update, and manage entitlements templates
        - `canEditEmailTemplate` boolean: Entitles the internal user to create, update, and manage invitation email templates
      - `payments` object: Payments permissions
        - `canRaisePayments` boolean: Entitles the internal user to raise payments and allocate them against debts — the MAKER half of maker-checker
        - `canApprovePayments` boolean: Entitles the internal user to APPROVE a payment. Deliberately separate from raising one: granting both to the same person defeats maker-checker at the entitlement level, before the checker <> maker rule ever gets a chance to bite
        - `canRaiseManualObligations` boolean: Entitles the internal user to raise a debt by hand against a counterparty — one no trade event raises, booked to the ledger on creation
        - `canWriteOffObligations` boolean: Entitles the internal user to write off part or all of a debt owed to CurrencyGuard, or to reverse an earlier write-off. Separate from raising payments: giving up money owed is a decision, not cash application
        - `canReprocessObligations` boolean: Entitles the internal user to reprocess one Guard's payment obligations — re-run the current rules and reconcile against what exists. Read-only preview; it never rewrites a debt money has moved against
      - `my-profile` object: My profile permissions
        - `canModifyMyAvatar` boolean: Entitles the internal user to upload and delete their own avatar
        - `canModifyMyUserDetails` boolean: Entitles the internal user to update their own profile details
        - `canEditOwnEntitlement` boolean: Entitles the internal user to modify their own entitlements
      - `api-clients` object: Api clients permissions
        - `canManageApiClients` boolean: Entitles the internal user to create, view, rotate, and delete system-level API clients
        - `canManageWebhooks` boolean: Entitles the internal user to register, renew, suspend, and delete webhook subscriptions against the internal trade and onboarding event streams. The internal counterpart of regulated.api-clients.canManageWebhooks. Also held by the system account, which registers and renews the cross-domain sync subscriptions on startup
        - `canReplayWebhooks` boolean: Entitles the internal user to restate a webhook subscription's cursor and replay historic events. Separated from canManageWebhooks because replay re-delivers events that have already been consumed, which double-processes on any non-idempotent consumer
      - `users` object: Users permissions
        - `canModifyUser` boolean: Entitles the internal user to create, update, and manage user accounts
        - `canDisableInternalUser` boolean: Entitles the internal user to disable (suspend) other internal users
        - `canEnableInternalUser` boolean: Entitles the internal user to re-enable a disabled internal user
        - `canDeleteInternalUserPii` boolean: Entitles the internal user to permanently delete an internal user's PII data
        - `canDisableRegulatedUser` boolean: Entitles the internal user to disable (suspend) regulated users
        - `canEnableRegulatedUser` boolean: Entitles the internal user to re-enable a disabled regulated user
        - `canDeleteRegulatedUserPii` boolean: Entitles the internal user to permanently delete a regulated user's PII data
        - `canInviteInternalUser` boolean: Entitles the internal user to invite and onboard other internal CurrencyGuard users
        - `canInviteRegulatedUser` boolean: Entitles the internal user to invite and onboard regulated users
        - `canResetUserMfa` boolean: Entitles the internal user to reset MFA (TOTP) for any user, forcing re-enrollment on next login
      - `system` object: System permissions
        - `canModifyTradingConfigs` boolean: Entitles the internal user to modify trading domain configuration settings
        - `canModifyOnboardingConfig` boolean: Entitles the internal user to update onboarding configuration settings
        - `canModifyTenantPerimeters` boolean: Entitles the internal user to ringfence and merge tenants, replace a perimeter's encryption key, and set ringfencing policy. Every one of these re-encrypts a tenant's data and provisions or retires AWS resources, but none destroys anything
        - `canShredTenantPerimeterKey` boolean: Entitles the internal user to destroy a perimeter's encryption key, making every row, document and backup belonging to that tenant permanently unreadable, and to cancel a destruction within its window. This is the tenant-wide counterpart of the canDelete*Pii entitlements: those erase one person's data from the tables that hold it, whereas this erases everyone in the perimeter at once and reaches copies no delete statement can — backups, replicas, exports. Held apart from the other perimeter operations because it is the only one with no way back
        - `canImportTrades` boolean: Entitles the internal user to bulk-import trades from a JSON export, writing directly into the trade book and bypassing the normal booking and pricing path. The counterpart of canDeleteAllTrades, with the same blast radius in the opposite direction
        - `canAcceptEventDeliveries` boolean: Entitles the caller to submit batches of domain events into a consuming domain. Held by the system account rather than by people: it is what lets the trading and ledger hexagons receive pushed trade, trade-reference, and onboarding events. Revoking it halts cross-domain sync
        - `canModifyScheduler` boolean: Entitles the internal user to schedule, pause, resume, and trigger scheduled jobs in the trading domain
        - `canModifySystemClock` boolean: Entitles the internal user to start, stop, rewind, and otherwise manipulate the system clock
        - `canModifyTradeEventProcessingRules` boolean: Entitles the internal user to create, update, and delete trade event processing rules and rule versions
        - `canModifyObligationRules` boolean: Entitles the internal user to create, update, and deactivate settlement obligation rules — which decide what debt a trade event raises, and for how much
        - `canResubmitTradeEventProcessing` boolean: Entitles the internal user to rewind event sequences, discharge and retry failed trade event processing
        - `canDeleteAllTrades` boolean: Entitles the internal user to permanently delete all trading data (destructive, dev/test only)
        - `canModifyMfaSettings` boolean: Entitles the internal user to enable or disable MFA (TOTP) on Cognito user pools
      - `risk-management` object: Risk management permissions
        - `canEnterFxOptionTrade` boolean: Entitles the internal user to enter FX option trades on behalf of customers
        - `canPriceOptions` boolean: Entitles the internal user to reprice options and run what-if option valuation scenarios
        - `canEnterFxCashTrade` boolean: Entitles the internal user to enter FX cash trades on behalf of customers
        - `canBuyGuard` boolean: Entitles the internal user to enter guard trades on behalf of customers
        - `canSettleGuard` boolean: Entitles the internal user to settle existing guard positions
        - `canExtendGuard` boolean: Entitles the internal user to extend guard position expiration dates
        - `canVoidGuard` boolean: Entitles the internal user to void a guard whose fee was never received, unwinding its hedge
      - `reference-data` object: Reference data permissions
        - `canModifyCurrency` boolean: Entitles the internal user to create, update, and manage currency configurations
        - `canModifyCalendar` boolean: Entitles the internal user to create, update, and manage trading calendars
        - `canModifyCurrencyPair` boolean: Entitles the internal user to create and update tradeable currency pairs
        - `canModifyTradingHours` boolean: Entitles the internal user to set the trading enabled and outside-hours trading flags
        - `canModifyGuardMarginSchedule` boolean: Entitles the internal user to create and update guard margin schedules
        - `canModifyCounterparties` boolean: Entitles the internal user to create and update counterparty records
      - `invitations` object: Invitations permissions
        - `canViewAllInvitation` boolean: Entitles the internal user to view all invitations across the entire system
        - `canManageAllInvitation` boolean: Entitles the internal user to manage and modify all invitations across the entire system
      - `parties` object: Parties permissions
        - `canModifyIntroducingBroker` boolean: Entitles the internal user to create and update introducing broker records
        - `canModifyRegulatedEntity` boolean: Entitles the internal user to create, update, and manage regulated entities
        - `canModifyRegulatedEntityLogo` boolean: Entitles the internal user to upload and delete logos for regulated entities
        - `canModifyCompany` boolean: Entitles the internal user to create, update, and manage company information
        - `canModifyCurrencyGuardCompany` boolean: Entitles the internal user to update CurrencyGuard company configuration
      - `customers` object: Customers permissions
        - `canDisableCustomer` boolean: Entitles the internal user to disable (suspend) customer users
        - `canEnableCustomer` boolean: Entitles the internal user to re-enable a disabled customer user
        - `canDeleteCustomerPii` boolean: Entitles the internal user to permanently delete a customer user's PII data
    - `regulated` object: Permissions for regulated users
      - `companies` object: Companies permissions
        - `canDisableCompany` boolean: Entitles the regulated user to disable (suspend) a company within their regulated entity
        - `canEnableCompany` boolean: Entitles the regulated user to re-enable a disabled company within their regulated entity
        - `canDeleteCompanyPii` boolean: Entitles the regulated user to permanently delete a company's PII data within their regulated entity
      - `system` object: System permissions
        - `canModifyMfaSettings` boolean: Entitles the regulated user to enable or disable MFA (TOTP) on their regulated entity's Cognito user pool
      - `risk-management` object: Risk management permissions
        - `canBuyGuard` boolean: Entitles the regulated user to enter guard trades for their customers
        - `canSettleGuard` boolean: Entitles the regulated user to settle existing guard positions for their customers
        - `canExtendGuard` boolean: Entitles the regulated user to extend guard position expiration dates for their customers
      - `invitations` object: Invitations permissions
        - `canViewInvitation` boolean: Entitles the regulated user to view invitations within their scope of responsibility
        - `canManageInvitation` boolean: Entitles the regulated user to manage and modify invitations within their scope of responsibility
      - `sales-users` object: Sales users permissions
        - `canModifySalesUser` boolean: Regulated user can create/update sales users (CRM-style, no invitation)
        - `canDisableSalesUser` boolean: Entitles the regulated user to disable (suspend) sales users within their regulated entity
        - `canEnableSalesUser` boolean: Entitles the regulated user to re-enable a disabled sales user within their regulated entity
        - `canDeleteSalesUserPii` boolean: Entitles the regulated user to permanently delete a sales user's PII data within their regulated entity
        - `canInviteSalesUser` boolean: Entitles the regulated user to invite and onboard sales users within their regulated entity
      - `templates` object: Templates permissions
        - `canEditEntitlementTemplate` boolean: Entitles the regulated user to create, update, and manage entitlements templates for their regulated entity
        - `canEditEmailTemplate` boolean: Entitles the regulated user to manage invitation email templates for their regulated entity
      - `parties` object: Parties permissions
        - `canModifyRegulatedEntity` boolean: Entitles the regulated user to update their own regulated entity profile
        - `canModifyRegulatedEntityLogo` boolean: Entitles the regulated user to upload and delete their own regulated entity logo
        - `canModifyIntroducingBroker` boolean: Entitles the regulated user to create and update introducing broker records within their regulated entity
        - `canModifyCompany` boolean: Entitles the regulated user to modify company information for their customer accounts
        - `canModifyCompanyLogo` boolean: Entitles the regulated user to upload and delete company logos for their customer accounts
      - `my-profile` object: My profile permissions
        - `canModifySelf` boolean: Entitles the regulated user to update their own profile details and avatar
        - `canModifyMyAvatar` boolean: Entitles the regulated user to upload and delete their own avatar
        - `canModifyMyUserDetails` boolean: Entitles the regulated user to update their own profile details
        - `canEditOwnEntitlement` boolean: Entitles the regulated user to update their own entitlements
      - `customers` object: Customers permissions
        - `canModifyCustomer` boolean: Entitles the regulated user to create and update customer accounts within their customer companies
        - `canDisableCustomer` boolean: Entitles the regulated user to disable (suspend) customer users within their regulated entity
        - `canEnableCustomer` boolean: Entitles the regulated user to re-enable a disabled customer user within their regulated entity
        - `canDeleteCustomerPii` boolean: Entitles the regulated user to permanently delete a customer user's PII data within their regulated entity
        - `canInviteCustomer` boolean: Entitles the regulated user to invite and onboard customer users
      - `api-clients` object: Api clients permissions
        - `canManageApiClients` boolean: Entitles the regulated user to create, view, rotate, and delete API clients for server-to-server integration
        - `canManageWebhooks` boolean: Entitles the regulated user to create, view, update, rotate, delete, and replay webhook subscriptions for B2B event delivery
      - `users` object: Users permissions
        - `canModifyUser` boolean: Entitles the regulated user to modify user accounts within their customer companies
        - `canDisableRegulatedUser` boolean: Entitles the regulated user to disable (suspend) other regulated users within their regulated entity
        - `canEnableRegulatedUser` boolean: Entitles the regulated user to re-enable a disabled regulated user within their regulated entity
        - `canDeleteRegulatedUserPii` boolean: Entitles the regulated user to permanently delete a regulated user's PII data within their regulated entity
        - `canInviteRegulatedUser` boolean: Entitles the regulated user to invite and onboard other regulated users within their organization
        - `canResetUserMfa` boolean: Entitles the regulated user to reset MFA (TOTP) for users within their regulated entity
    - `sales` object: Permissions for sales users
      - `companies` object: Companies permissions
        - `canDisableCompany` boolean: Entitles the sales user to disable (suspend) a company within their introducing broker
        - `canEnableCompany` boolean: Entitles the sales user to re-enable a disabled company within their introducing broker
        - `canDeleteCompanyPii` boolean: Entitles the sales user to permanently delete a company's PII data within their introducing broker
      - `risk-management` object: Risk management permissions
        - `canBuyGuard` boolean: Entitles the sales user to enter guard trades for their introducing broker's customers
        - `canSettleGuard` boolean: Entitles the sales user to settle existing guard positions for their introducing broker's customers
        - `canExtendGuard` boolean: Entitles the sales user to extend guard position expiration dates for their introducing broker's customers
      - `invitations` object: Invitations permissions
        - `canViewInvitation` boolean: Entitles the sales user to view invitations within their introducing broker
        - `canManageInvitation` boolean: Entitles the sales user to manage and modify invitations within their introducing broker
      - `sales-users` object: Sales users permissions
        - `canInviteSalesUser` boolean: Entitles the sales user to invite and onboard other sales users within their introducing broker
        - `canDisableSalesUser` boolean: Sales user can disable other sales users within their introducing broker
        - `canEnableSalesUser` boolean: Sales user can re-enable disabled sales users within their introducing broker
        - `canDeleteSalesUserPii` boolean: Sales user can permanently delete another sales user's PII data within their introducing broker
      - `templates` object: Templates permissions
        - `canEditEmailTemplate` boolean: Entitles the sales user to manage invitation email templates
      - `parties` object: Parties permissions
        - `canModifyIntroducingBroker` boolean: Entitles the sales user to modify their introducing broker, including uploading and deleting the IB logo
        - `canModifyCompany` boolean: Entitles the sales user to modify company information within their introducing broker
        - `canModifyCompanyLogo` boolean: Entitles the sales user to upload and delete company logos within their introducing broker
      - `my-profile` object: My profile permissions
        - `canModifySelf` boolean: Entitles the sales user to update their own profile details and avatar
        - `canModifyMyAvatar` boolean: Entitles the sales user to upload and delete their own avatar
        - `canModifyMyUserDetails` boolean: Entitles the sales user to update their own profile details
        - `canEditOwnEntitlement` boolean: Entitles the sales user to update their own entitlements
      - `customers` object: Customers permissions
        - `canModifyCustomer` boolean: Entitles the sales user to create and update customer accounts within their introducing broker's companies
        - `canDisableCustomer` boolean: Sales user can disable customer users within their introducing broker's companies
        - `canEnableCustomer` boolean: Sales user can re-enable disabled customer users within their introducing broker's companies
        - `canDeleteCustomerPii` boolean: Sales user can permanently delete a customer user's PII data within their introducing broker
        - `canInviteCustomer` boolean: Entitles the sales user to invite and onboard customer users within their introducing broker
      - `users` object: Users permissions
        - `canModifyUser` boolean: Entitles the sales user to modify user accounts within their introducing broker's companies
    - `customer` object: Permissions for customer users
      - `risk-management` object: Risk management permissions
        - `canBuyGuard` boolean: Entitles the customer to enter guard trades for their own company's positions
        - `canSettleGuard` boolean: Entitles the customer to settle their own company's existing guard positions
        - `canExtendGuard` boolean: Entitles the customer to extend expiration dates for their own company's guard positions
      - `invitations` object: Invitations permissions
        - `canViewInvitations` boolean: Entitles the customer to view invitations for their company
      - `my-profile` object: My profile permissions
        - `canModifyMyAvatar` boolean: Entitles the customer to upload, replace, or delete their own avatar image
      - `users` object: Users permissions
        - `canInviteUsers` boolean: Entitles the customer to invite other users within their company
  - `isActive` boolean: Whether this template is active and can be assigned to users.
  - `versionNumber` integer: The strictly monotonically increasing version number for this record.
  - `updatedBy` string: The username of the person or entity that updated this record.
  - `updatedAt` string: The timestamp of the last update in UTC.
  - `createdAt` string: The timestamp of creation in UTC.

## Other responses

- `400`: Invalid UUID format — [`http/malformed-request`](/problems/http/malformed-request/)
- `401`: Not authenticated — [`security/authentication-failed`](/problems/security/authentication-failed/)
- `403`: Not authorized - cannot access internal templates — [`security/insufficient-permissions`](/problems/security/insufficient-permissions/)
- `404`: Template not found — [`http/resource-not-found`](/problems/http/resource-not-found/)
- `500`: Server error — [`server/internal-error`](/problems/server/internal-error/)

---

[API](https://skmtc.dev/currencyguard/apis/currencyguard-trading-system-api-external.md) · [All operations](https://skmtc.dev/currencyguard/apis/currencyguard-trading-system-api-external/llms.txt) · [OpenAPI document](https://skmtc.dev/currencyguard/apis/currencyguard-trading-system-api-external/revisions/a1f3f854190d?raw)