Skip to main content
The RideShare API uses role-based access control. Every authenticated request is scoped to the role you present at login. There are four roles: USER, RIDER, DRIVER, and ADMIN.

​
Role overview

RoleWho it’s forAccess level
USERGeneral authenticated usersView rides and public data
RIDERPassengers booking ridesBook rides, view history, submit feedback
DRIVERDrivers accepting and completing ridesAccept rides, update location and status
ADMINPlatform administratorsFull access to all /api/admin/* endpoints

​
What each role can do

​
USER

The USER role provides general read access. You can view ride status and public ride data, but you cannot book rides or perform driver actions.

​
RIDER

The RIDER role is for passengers. With this role you can:
  • Book a new ride: POST /rides/book
  • Get a fare estimate: GET /rides/estimate
  • View your ride history: GET /rides/history
  • Check the status of a specific ride: GET /rides/status/{rideId}
  • Cancel a ride: POST /rides/cancel/{rideId}
  • Submit post-ride feedback and a rating: POST /rides/feedback/{rideId}
  • Browse nearby available drivers: GET /rides/drivers/nearby

​
DRIVER

The DRIVER role is for drivers. With this role you can:
  • View open ride requests: GET /rides/requested
  • Accept a ride or update its status: POST /rides/status/{rideId}
  • Update your live location during a ride: POST /rides/location/{rideId}
  • Submit feedback on a rider: POST /rides/feedback/{rideId}

​
ADMIN

The ADMIN role grants full access to all platform management endpoints under /api/admin/*, including user management, ride oversight, and reporting.

​
Logging in with a role

You specify your role in the role field of your login request body. The token returned is scoped to that role for the duration of the session. 
{
  "email": "alice@example.com",
  "password": "secret",
  "role": "RIDER"
}
The response returns a bearer token. Include it in the Authorization header of every subsequent request: 
Authorization: Bearer <token>
Your account has a default role stored on your profile, but you can request any valid role at login by setting the role field explicitly. The role you specify at login determines what you can do for that session.