anchor.diff:  The full list of available permissions can be found https://github.com/killbill/killbill-api/blob/master/src/main/java/org/killbill/billing/security/Permission.java[here].
   
   
  -= User Management APIs
  -
  -== Configuration of the User/Role/Permissions
  -
  +== User Management APIs
  +
  +=== Configuration of the User/Role/Permissions
   
   Shiro supports multiple backend implementations, and we integrated a few of them including:
   
  
positive.code: [source,bash]
  ----
  curl -v \
  -u cs:cs123 \
  -H "X-Killbill-ApiKey: bob" \
  -H "X-Killbill-ApiSecret: lazar" \
  -H "Content-Type: application/json" \
  -H "X-Killbill-CreatedBy: demo" \
  -X POST \
  --data-binary '{"name":"John Doe","email":"john@example.com","externalKey":"john-doe-1234","currency":"USD"}' \
  "http://127.0.0.1:8080/1.0/kb/accounts"
  ----
  
  But the following curl to refund a payment would fail because his role `customer_support` does not include the permission `payment:refund`:
  
negative.code: 
  As far as tenant configuration goes, it is possible to create tenants directly from Kaui. If you already have created a tenant in Kill Bill using APIs, you can safely re-create it from Kaui, which will discover it on the server side and simply sync it locally.
  
  === Super user
  
  Kaui has the concept of a super user (*root*) for critical, cross-tenants, operations. By default, it assumes that the `admin` user is the super user, but you can change this by setting the system property `kaui.root_username` (`KAUI_ROOT_USERNAME` Docker environment variable). The password doesn't need to be specified as it is stored on the server side (`shiro.ini`, etc.).
  
  == Summary
  
  1. User, roles, permissions need to be configured on the server side (`shiro.ini`, database, LDAP, Okta, ...)
  2. Tenants can then be created (using a user whole role's permissions allow such operation)
  