# What I may do GET /v1/identity/me/permissions ```sh curl --request GET \ --url https://example.com/v1/identity/me/permissions \ --header 'Authorization: Bearer ' ``` What the caller may do, so a client can hide what it can’t: tenant admin, its reviewer role and the roles it decides, its API key’s limits and capabilities, the projects it may read with its role in each and every way it holds it (directly, a team, an org it administers, tenant admin), its orgs and teams, and what each project role allows (from the runtime’s authorization model). The key’s limits are applied: a `member` key is never tenant admin, and a key limited to a project sees that project alone. Only what the caller may see. The server still checks every call. `501 permissions-unsupported` on a runtime without an authorization store: read whoami’s `tenantAdmin` and `reviewerRole` instead. ## Authorizations - **[bearerAuth](https://docs.kindgi.com/v0.1.10/reference/api.md#bearerauth)** ## Responses ### 200 What the caller may do. application/json What the caller may do, with its API key’s limits applied: tenant admin and member, its reviewer role, its key’s limits and capabilities, the projects it may read with its role in each and how it holds it, its orgs and teams, and what each project role allows. Only what the caller may see: nothing names a project it can’t read, or anyone else’s role. object **tenantId** required string format: uuid **tenant** required object **admin** required Tenant admin, decided as the admin routes decide it (a `member` key’s never is). boolean **member** Tenant member: reads the tenant’s settings. Absent when the runtime doesn’t report it. boolean **reviewer** Present when the caller is a reviewer. object **role** required Reviewer role class. Hierarchy: standard < senior < admin. string Allowed values: standard senior admin **id** The caller’s reviewer id, its row on the roster: an approval assigned to the caller names it in `assignedTo`. Absent without a roster row (then `canDecide` is false), and from a runtime before 0.1.6. string **decides** required The approvals’ required roles the caller may decide: its own rank and below, lowest first. Array\ Allowed values: standard senior admin **canDecide** required Whether the caller can decide at all: deciding also needs its user and its row on the reviewer roster. False for a token that carries a reviewer role without them. boolean **key** The caller’s API key, when it is one, and what it limits. object **tokenId** required string **role** The most the key may do, under its principal’s grants: an `admin` key may administer the tenant when its principal is a tenant admin; a `member` key takes no admin action on the tenant, whoever it’s for; below it, its principal’s roles hold (a project admin’s member key administers that project). string Allowed values: admin member **projectId** The project the key is limited to: `projects` holds it alone, and no org or team is administered through it. string **tokenCapabilities** required The framework capabilities the caller’s token carries (`env:write`, `secrets:write`, `secrets:rotate`, …), which secret, env and signing-key writes require on top of admin at their scope. A sign-in session carries those its person holds: none unless the runtime gives them some, as it does a tenant’s first admin. An API key carries those it was minted with (`POST /v1/tokens`, none by default). Array\ **projects** required The projects the caller may read, by name. Array\ object **projectId** required string **name** required string **role** required The highest role the caller holds on the project, whichever way. string Allowed values: owner admin editor viewer **via** required Every way the caller holds a role on it (for “My access”). Array One of: discriminator: kind - **object** object **kind** required string Allowed values: direct **role** required A project role, as the authorization model holds it: `owner` > `admin` > `editor` > `viewer` (a membership stored as `member` is `viewer`). string Allowed values: owner admin editor viewer **since** When the membership was added, when the runtime keeps it. string format: date-time - **object** object **kind** required string Allowed values: team **teamId** required string **teamName** required string **role** required The role the team holds on the project. string Allowed values: owner admin editor viewer **since** When the caller joined the team, when the runtime keeps it. string format: date-time - **object** An admin of the org the project sits in: admin on the project. object **kind** required string Allowed values: org-admin **orgId** required string **orgName** required string - **object** A tenant admin: admin on every project. object **kind** required string Allowed values: tenant-admin **orgs** required The orgs the caller is a member or admin of, by name. Array\ object **orgId** required string **name** required string **role** required string Allowed values: admin member **teams** required The teams the caller is a member or admin of, by name. Array\ object **teamId** required string **name** required string **role** required Role on a team membership. string Allowed values: member admin **capabilities** required What each project role allows, worked out by the runtime from its authorization model. A client decides an action as `capabilities[project.role][type]` holding it; the server still checks every call. An object can grant more on itself (an agent’s own editor), never less, so this is what the caller may do at the least. object **owner** required What a project role allows on the project and on every object of each type in it, by object type. object **project** required Array\ Allowed values: read write admin delete **agent** required Array\ Allowed values: read write delete admin execute publish promote **flow** required Array\ Allowed values: read write delete admin execute publish **tool** required Array\ Allowed values: read write delete admin invoke **guardrail** required Array\ Allowed values: read write delete admin **eval_suite** required Array\ Allowed values: read write delete admin execute publish **trigger** required Array\ Allowed values: read write delete admin fire **conversation** required Array\ Allowed values: read write delete admin **secret** required Array\ Allowed values: read write delete admin rotate **env** required Array\ Allowed values: read write delete admin **mcp_endpoint** required Array\ Allowed values: read write delete admin **run** required Array\ Allowed values: read cancel delete **admin** required What a project role allows on the project and on every object of each type in it, by object type. object **project** required Array\ Allowed values: read write admin delete **agent** required Array\ Allowed values: read write delete admin execute publish promote **flow** required Array\ Allowed values: read write delete admin execute publish **tool** required Array\ Allowed values: read write delete admin invoke **guardrail** required Array\ Allowed values: read write delete admin **eval_suite** required Array\ Allowed values: read write delete admin execute publish **trigger** required Array\ Allowed values: read write delete admin fire **conversation** required Array\ Allowed values: read write delete admin **secret** required Array\ Allowed values: read write delete admin rotate **env** required Array\ Allowed values: read write delete admin **mcp_endpoint** required Array\ Allowed values: read write delete admin **run** required Array\ Allowed values: read cancel delete **editor** required What a project role allows on the project and on every object of each type in it, by object type. object **project** required Array\ Allowed values: read write admin delete **agent** required Array\ Allowed values: read write delete admin execute publish promote **flow** required Array\ Allowed values: read write delete admin execute publish **tool** required Array\ Allowed values: read write delete admin invoke **guardrail** required Array\ Allowed values: read write delete admin **eval_suite** required Array\ Allowed values: read write delete admin execute publish **trigger** required Array\ Allowed values: read write delete admin fire **conversation** required Array\ Allowed values: read write delete admin **secret** required Array\ Allowed values: read write delete admin rotate **env** required Array\ Allowed values: read write delete admin **mcp_endpoint** required Array\ Allowed values: read write delete admin **run** required Array\ Allowed values: read cancel delete **viewer** required What a project role allows on the project and on every object of each type in it, by object type. object **project** required Array\ Allowed values: read write admin delete **agent** required Array\ Allowed values: read write delete admin execute publish promote **flow** required Array\ Allowed values: read write delete admin execute publish **tool** required Array\ Allowed values: read write delete admin invoke **guardrail** required Array\ Allowed values: read write delete admin **eval_suite** required Array\ Allowed values: read write delete admin execute publish **trigger** required Array\ Allowed values: read write delete admin fire **conversation** required Array\ Allowed values: read write delete admin **secret** required Array\ Allowed values: read write delete admin rotate **env** required Array\ Allowed values: read write delete admin **mcp_endpoint** required Array\ Allowed values: read write delete admin **run** required Array\ Allowed values: read cancel delete **readOnlyNotice** The line a console shows a caller who may only view a project, as a tenant admin set it in the tenant config (`kind: 'config'`, key `console.readOnlyNotice`). Plain text on one line, at most 280 characters. Absent when none is set: the console shows its own. string <= 280 characters ##### Example ```json { "reviewer": { "role": "standard", "decides": [ "standard" ] }, "key": { "role": "admin" }, "projects": [ { "role": "owner", "via": [ { "kind": "direct", "role": "owner" } ] } ], "orgs": [ { "role": "admin" } ], "teams": [ { "role": "member" } ], "capabilities": { "owner": { "project": [ "read" ], "agent": [ "read" ], "flow": [ "read" ], "tool": [ "read" ], "guardrail": [ "read" ], "eval_suite": [ "read" ], "trigger": [ "read" ], "conversation": [ "read" ], "secret": [ "read" ], "env": [ "read" ], "mcp_endpoint": [ "read" ], "run": [ "read" ] }, "admin": { "project": [ "read" ], "agent": [ "read" ], "flow": [ "read" ], "tool": [ "read" ], "guardrail": [ "read" ], "eval_suite": [ "read" ], "trigger": [ "read" ], "conversation": [ "read" ], "secret": [ "read" ], "env": [ "read" ], "mcp_endpoint": [ "read" ], "run": [ "read" ] }, "editor": { "project": [ "read" ], "agent": [ "read" ], "flow": [ "read" ], "tool": [ "read" ], "guardrail": [ "read" ], "eval_suite": [ "read" ], "trigger": [ "read" ], "conversation": [ "read" ], "secret": [ "read" ], "env": [ "read" ], "mcp_endpoint": [ "read" ], "run": [ "read" ] }, "viewer": { "project": [ "read" ], "agent": [ "read" ], "flow": [ "read" ], "tool": [ "read" ], "guardrail": [ "read" ], "eval_suite": [ "read" ], "trigger": [ "read" ], "conversation": [ "read" ], "secret": [ "read" ], "env": [ "read" ], "mcp_endpoint": [ "read" ], "run": [ "read" ] } } } ``` ### 401 Missing / malformed / expired / revoked bearer token. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 501 The runtime has no authorization store (`permissions-unsupported`): read whoami instead. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 503 The authorization store couldn’t be read (`authz-backend-unavailable`): try again. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ## See also - [`GET /v1/identity/me/second-factor`: My second factor](https://docs.kindgi.com/v0.1.10/reference/api/operations/identitymesecondfactor.md) - [`POST /v1/identity/me/second-factor`: Start setting up a second factor](https://docs.kindgi.com/v0.1.10/reference/api/operations/identitymestartsecondfactor.md) - [`POST /v1/identity/me/second-factor/confirm`: Confirm a new second factor](https://docs.kindgi.com/v0.1.10/reference/api/operations/identitymeconfirmsecondfactor.md) - [`POST /v1/identity/me/second-factor/recovery-codes`: New recovery codes](https://docs.kindgi.com/v0.1.10/reference/api/operations/identitymenewrecoverycodes.md) - [Run with authorization](https://docs.kindgi.com/v0.1.10/deploy/authorization.md) - [People, API keys and service accounts](https://docs.kindgi.com/v0.1.10/deploy/people-and-keys.md) - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/operate.md) - [Error code `authz-backend-unavailable`](https://docs.kindgi.com/v0.1.10/reference/errors.md#authz-backend-unavailable) - [Error code `permissions-unsupported`](https://docs.kindgi.com/v0.1.10/reference/errors.md#permissions-unsupported) - [Every error code](https://docs.kindgi.com/v0.1.10/reference/errors.md)