Skip to main content
Config.PermissionMode supports ace (default) or custom. There is no built-in QBCore/ESX job mode.

​
Logical actions

Viewing displays does not require an ACE. Full sync, live cache updates, page scrolling, map panning, and eligible bodycam subscriptions are public and remain subject to server-side validity, distance, routing bucket, interior, cooldown, and rate-limit checks. The server supplies a permission snapshot to build the menu, then revalidates every player action. A No permission entry or locally altered client grants no authority.

​
Administrator

This group can open the administrative menu and inspect nearby displays, but it cannot place, configure, refresh, diagnose, or delete them. No group grant is needed merely to view an in-world display.

​
Dispatcher management

This group can open the menu, configure, move, refresh, and diagnose displays but cannot place or delete them.

​
ACE inheritance

FiveM evaluates allow/deny rules and principal inheritance. Inspect inherited deny rules when an expected grant fails.

​
Custom mode

The callback receives backend actions:
The forceRefresh logical action resolves to the refresh backend action. The callback runs inside pcall. Only boolean true allows; errors and other return values deny.

​
Server validation

Depending on the request, the server checks:
  • The current permission
  • Display existence and maximum count
  • Model allowlist
  • Name, enum, page, and numeric ranges
  • At least one enabled page
  • Player proximity
  • Routing bucket and interior context
  • Page/action validity and cooldown
  • Per-player event rate limits
Save/delete/move operations also validate the player against the saved/final position. A client cannot authorize itself by changing local state.

​
Data access

Every player receives sanitized display definitions and live board data. There is no viewing ACE. Bodycam image delivery additionally requires an eligible subscription and passes distance, routing bucket, interior, feed, payload, and rate-limit validation. Caller normalization is disabled by default and caller text is not rendered. That does not make every call field suitable for a public-facing screen; review address and description settings.