How to organize API for different roles?

Question

API

There are two roles
- Admin -
Manager, reports
to the admin Only the admin has access to the Admin page.
Admin and Manager have access to the Manager page.
If the manager requests data via api, then I look at the token and return it, but what if the admin requests data on the manager's page?
How to organize on the server side?

Answer 1

The API should not know anything about your mythical roles in the system. A role is simply a way to group permissions in a system and bind them to a user. The token should contain information about them, and not about the roles. All. Mystery solved