> ## Documentation Index > Fetch the complete documentation index at: https://docs.flowpayroll.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get your access settings > Needs permission role:read. `defaultRole` is the role new access gets when no role is named: inviting a person, issuing an API token, giving an organisation or the whole account, and people a SCIM client adds. It is Viewer until you choose one (`defaultRoleChosen`). While only Administrator can be given out, new access without a role is Administrator whatever this says. ## OpenAPI ````yaml /api-reference/specs/administration.json get /customer/access-settings openapi: 3.0.4 info: title: Administration API description: >- Manage your Flow Payroll account: the organisations it owns, the people who can sign in to it, the API tokens it holds, its brand, and a feed of recent administration activity. Every resource is scoped to the account your credentials belong to, so no request ever names a customer and the `X-Org-Id` header is not used. version: v1 servers: - url: https://api.sandbox.flowpayroll.ai/v1/administration security: - X-Auth-Token: [] tags: - name: Customer description: >- Your account: the customer every other resource on this API belongs to. Read it and rename it. - name: Organisations description: >- The organisations your account owns or manages: list them with headcounts and your access to each, get one in full, add one or several at a time, see everybody who can reach one, and read which of its data an outside system manages. - name: Organisation groups description: >- Named sets of your organisations, such as the clients one team looks after. Give a person or API token a group, and they reach every organisation in it, including ones added later. - name: Users description: >- The people who can sign in to your account: list, invite (one or many), resend invitations, and manage each person's direct grants and account-wide access. - name: Roles description: >- What people and API tokens can do where they have access: the built-in roles, roles of your own, and the default role. Only Administrator can be given today. - name: API tokens description: >- The client credentials your integrations authenticate with: create (the secret is shown once), rename, rotate, revoke, and manage which organisations each token reaches. - name: Branding description: >- Your white-label brand: edit a draft, publish it, upload its files, and set a company logo for each organisation. - name: Activity description: >- Recent administration actions in your account, and every change to who has access, newest first. - name: SCIM description: >- SCIM 2.0 provisioning: your identity provider adds, updates, suspends and removes your account's people, and gives them account-wide roles. paths: /customer/access-settings: get: tags: - Roles summary: Get your access settings description: >- Needs permission role:read. `defaultRole` is the role new access gets when no role is named: inviting a person, issuing an API token, giving an organisation or the whole account, and people a SCIM client adds. It is Viewer until you choose one (`defaultRoleChosen`). While only Administrator can be given out, new access without a role is Administrator whatever this says. operationId: GetAccessSettings responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/AccessSettingsResponseResponseBody' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' components: schemas: AccessSettingsResponseResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/AccessSettingsResponseContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false ObjectResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/ObjectContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false MessageWithTokenResponse: type: object properties: text: type: string token: type: string tokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false AccessSettingsResponseContentResponse: type: object properties: data: $ref: '#/components/schemas/AccessSettingsResponse' metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssue: type: object properties: field: type: string reason: type: string reasonToken: type: string reasonTokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false ObjectContentResponse: type: object properties: data: {} metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssueArgument: type: object properties: name: type: string value: {} additionalProperties: false AccessSettingsResponse: type: object properties: defaultRoleId: type: string defaultRole: $ref: '#/components/schemas/RoleResponse' defaultRoleChosen: type: boolean description: False while your account uses the standard default, Viewer. additionalProperties: false description: Your account's access settings. ContentMetadataResponse: type: object properties: dateFormat: type: string dateTimeFormat: type: string paginationToken: type: string nullable: true additionalProperties: false RoleResponse: type: object properties: roleId: type: string description: >- How grants name it: `payroll-manager`, or `custom.hr-team` for one of your own. name: type: string description: type: string nullable: true permissions: type: array items: type: string description: >- Exactly what it lets people do, as catalogue selectors: `resource:verb`, `resource:*`, or `*`. assignableTo: type: array items: type: string description: '`person`, `api-token` or both: who the role can be given to.' builtIn: type: boolean description: >- True for the roles every account has. They cannot be changed or deleted. available: type: boolean description: >- False while only administrator can be given out. The other roles are listed so a screen can show them, and become available without any change on your side. isDefault: type: boolean description: Whether it is the role people get when none is chosen for them. revision: type: integer description: 'Your own roles only: 1 when made, one more on every change.' format: int64 nullable: true createdDate: type: string nullable: true updatedDate: type: string nullable: true holders: $ref: '#/components/schemas/RoleHoldersResponse' additionalProperties: false description: 'A role: one of the built-in ones, or one your account made.' RoleHoldersResponse: type: object properties: people: type: integer description: >- People with the role: on every organisation, on an organisation group, or on single organisations. format: int64 apiTokens: type: integer description: API tokens with the role, counted the same way. format: int64 wholeAccountOnly: type: boolean description: >- True for `administrator` only: the counts cover people and API tokens who are administrators on every organisation, not those who are administrators of single organisations or organisation groups. additionalProperties: false description: >- How many people and API tokens have a role in your account. Each is counted once, wherever they have it. securitySchemes: X-Auth-Token: type: apiKey description: FlowPayroll JWT (raw token, no Bearer prefix) name: X-Auth-Token in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.