rules:
  # Catalog: GET and POST salessheet. No put endpoint.
  - path: /salessheets/single/<int>
    methods: [GET, POST]
    groups:
      alw: [1]
      oa: ['*']
  # Admin: Allow all.
  - path: <*>
    methods: ['*']
    groups:
      alw: [4]
      oa: ['*']