# Ability to monitor and edit team permissions by API (workaround to prevent Refund permission abuse)

**URL:** <https://developer.squareup.com/forums/t/ability-to-monitor-and-edit-team-permissions-by-api-workaround-to-prevent-refund-permission-abuse/15742>\
**Category:** Questions\
**Created:** [May 12, 2024, 7:29pm UTC](https://developer.squareup.com/forums/t/ability-to-monitor-and-edit-team-permissions-by-api-workaround-to-prevent-refund-permission-abuse/15742 "2024-05-12T19:29:25Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![DevelopingForFun](https://avatars.discourse-cdn.com/v4/letter/d/4bbf92/32.png) [@DevelopingForFun](https://developer.squareup.com/forums/u/DevelopingForFun)\
**Post date:** [May 14, 2024, 6:35pm UTC](https://developer.squareup.com/forums/t/ability-to-monitor-and-edit-team-permissions-by-api-workaround-to-prevent-refund-permission-abuse/15742/3 "2024-05-14T18:35:05Z")

</div>

Thanks, thinking more:

**Technically I think we could implement this crudely with the api disabling someone entirely:**

1. Listen to refunds and velocity per team member
2. If we see it exceeds what we allow then call UpdateTeamMember endpoint to set status = `INACTIVE` [PUT /v2/team-members/{team\_member\_id} - Square API Explorer](https://developer.squareup.com/explorer/square/team-api/update-team-member)

Q: does that immediately lock out the team member? Would it be within 10 min? (Probably ok). And then after we resolve it can we mark them active again?

Here’s a related discussion in seller community [Solved: Re: Limiting Refund Abuse by employees with refund... - The Seller Community](https://www.sellercommunity.com/t5/Square-Staff-and-Payroll/Limiting-Refund-Abuse-by-employees-with-refund-permission-max/m-p/727984#M1565)

And 3 proposed workarounds (all requiring Square features)

> > The complexity lies in how our team would handle the setup of a rule-based permission like this.  
> > I think it could be very simple.
> 
> 1. Setting of how many # or $ volume refunds to allow in a day or N hour period before. Could be a settable value based on the merchant, for some $1000 may be a very safe limit that shouldn’t ever be hit, and if it was, it’s probably a problem.
> 2. Needing someone else to do the refund.
> 
> This would be a new permission, “Limited Refund” and if it can’t do it due to hitting a limit anyone with the existing “Refund” permission can do it.
> 
> - OR - likely simpler even:
> 
> 1. new “Limited Refund” permission, same as above
> 2. This permission only allows refunding over the past N days / hours. That could be hard coded e.g. 7 days or 30 days or it could be a setting. This could have more customer service issues so the above to monitor suspicious / excessive volume behavior would be a safer customer experience probably. (Avoid blocking a valid refund).
> 
> - OR - expose existing permissions on the API, and enterprises that need this can implement revoking a permission from a team member if they see _any_ suspicious things on their side.

---

_[View the full topic](https://developer.squareup.com/forums/t/ability-to-monitor-and-edit-team-permissions-by-api-workaround-to-prevent-refund-permission-abuse/15742)._