# How to modify an inventory management object with the user reader role

**URL:** <https://community.cumulocity.com/t/how-to-modify-an-inventory-management-object-with-the-user-reader-role/737>\
**Category:** Forum\
**Tags:** cumulocity\
**Created:** [August 24, 2023, 8:18am UTC](https://community.cumulocity.com/t/how-to-modify-an-inventory-management-object-with-the-user-reader-role/737 "2023-08-24T08:18:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ranjithkumar\_m](https://avatars.discourse-cdn.com/v4/letter/r/9f8e36/32.png) [@ranjithkumar\_m](https://community.cumulocity.com/u/ranjithkumar_m)\
**Post date:** [August 24, 2023, 8:18am UTC](https://community.cumulocity.com/t/how-to-modify-an-inventory-management-object-with-the-user-reader-role/737/1 "2023-08-24T08:18:01Z")

</div>

We have a list device widget where I want to give access to the end user to update the device information without providing him with admin access.

Basically, he can update device information from the widget, but he cannot add widgets or other functionalities specific to admins.

Right now, we tried it by providing an inventory role where he can see the device assigned to him only and can update the device.  
information as well, but with this, he can also add widgets and do other actions required by the admin only.

Please give me the solution.?

---

<div class="post-metadata">

**Author:** ![Korbinian\_Butz](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/korbinian_butz/32/10473_2.png) [@Korbinian\_Butz](https://community.cumulocity.com/u/Korbinian_Butz)\
**Post date:** [August 24, 2023, 5:22pm UTC](https://community.cumulocity.com/t/how-to-modify-an-inventory-management-object-with-the-user-reader-role/737/2 "2023-08-24T17:22:10Z")

</div>

Hey,

I see two different approaches you could take on this one - one using Inventory Roles, the other using a Service as Proxy.

**Option 1: Inventory Roles**  
A user having below Inventory Roles set will be able to:

- Read all Devices and all their properties within the Device Groups the User has access to
- Additionally, he will be able to change `fragmentA` and `fragmentB` properties for these Devices. Once a PUT request contains any other fragment, API will reject it with a `403 Forbidden` response.

 ![image](https://europe1.discourse-cdn.com/flex005/uploads/cumulocity/original/3X/6/0/60de99d94890863fb9be89c87aee729ad750d77a.png)

Keep in mind that you can’t use the Inventory Read/Write Permissions provided by Global Roles for such users - they would overrule these Inventory Roles. Thus, this needs to be maintained on Device Group Level.

**Option 2: Device Detail Service**

Alternatively, you can write a Microservice that exposes an endpoint to change device details. Grant this Service Inventory-Admin permissions.  
Once you have this service, give your Users:

- Inventory Read permissions either via global- or inventory role (preferably global as it’s easier to maintain)
- Access to this Microservice (can be controlled via global roles)

…and then let your widget call this Microservice to change your Device Details. A benefit of this is that you’re also able to do additional authentication-/validation checks, custom logics or caching in such a Service if needed.

 ![image](https://europe1.discourse-cdn.com/flex005/uploads/cumulocity/original/3X/5/8/5812002a62929508354be2eb7206e59a5e3fff3b.png)

---

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/system/32/31990_2.png) [@system](https://community.cumulocity.com/u/system)\
**Post date:** [February 20, 2024, 5:22pm UTC](https://community.cumulocity.com/t/how-to-modify-an-inventory-management-object-with-the-user-reader-role/737/3 "2024-02-20T17:22:44Z")

</div>

Closed on February 20, 2024, 5:22pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.