View effective permissions

Use the Can I? tab under Access Management to test permissions.

Table 1. Can I? sub-tabs
Sub-tab Description
Check Access Test whether you can perform a specific action on a resource. The resource-actions registry dynamically populates the action dropdowns.
Who Can List all users who can perform a specific action (requiresauthz:query permission)
My Permissions View all permissions for the current user

Check if you can perform an action
Copy link

POST /api/v1/authz/can_i
 
curl -X POST https://orchestrator.example.com/api/v1/authz/can_i \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "read",
    "resource_type": "workflow",
    "resource_id": "workflow-id"
  }'

Example response (allowed):

{
  "allowed": true,
  "denied": false,
  "matched_policy": "workflow:read:any",
  "denial_reason": "",
  "denied_by": ""
}

Example response (denied):

{
  "allowed": false,
  "denied": true,
  "matched_policy": "",
  "denial_reason": "No matching allow policy for workflow:delete",
  "denied_by": ""
}

List all your permissions
Copy link

POST /api/v1/authz/what_can_i
 
curl -X POST https://orchestrator.example.com/api/v1/authz/what_can_i \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Example response:

{
  "permissions": [
    {
      "policy_name": "workflow:read:any",
      "effect": "allow",
      "actions": ["workflow:read"],
      "scope": "any",
      "project": ""
    }
  ]
}

List users who can perform an action
Copy link

POST /api/v1/authz/who_can

Requires the authz:query permission, which the admin role grants by default. This endpoint iterates all active users and checks each against the authorization system.

curl -X POST https://orchestrator.example.com/api/v1/authz/who_can \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "delete",
    "resource_type": "workflow",
    "resource_id": "workflow-id",
    "limit": 20
  }'

Example response:

{
  "resources": [
    {"id": "a1b2c3d4-e5f6-7890-g1h2-i3j4k5l6m7n8", "username": "alice"},
    {"id": "b2c3d4e5-f6g7-8901-h2i3-j4k5l6m7n8o9", "username": "bob"}
  ],
  "next": null,
  "prev": null,
  "total": null
}

Authorization response fields
Copy link

can_i response fields:

  • allowed: Boolean. You can perform the action
  • denied: Boolean. Action is explicitly denied
  • matched_policy: Name of the policy that matched (empty if denied by default)
  • denial_reason: Human-readable reason for denial (empty if allowed)
  • denied_by: Reserved field (always empty; no deny-effect policies exist)

List available resource types and actions
Copy link

GET /api/v1/authz/resource_actions

Returns the catalog of all resource types and their valid actions. This endpoint requires authentication but no specific permission. Automation orchestrator builds the data at startup and does not query the database.

curl -X GET https://orchestrator.example.com/api/v1/authz/resource_actions \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Example response:

{
  "resource_actions": {
    "workflow": ["create", "read", "update", "delete"],
    "execution": ["read", "run"],
    "credential": ["create", "read", "update", "delete"],
    "project": ["create", "read", "update", "delete"],
    "group": ["create", "read", "update", "delete", "manage-members"],
    "role-assignment": ["read", "assign", "revoke"],
    "policy": ["read"],
    "role": ["create", "read", "update", "delete"],
    "user": ["create", "read", "update", "delete"],
    "identity-provider": ["create", "read", "update", "delete", "test"],
    "approval": ["create", "read", "decide"],
    "authz": ["query"],
    "user_identity": ["read", "attach", "detach"],
    "invocation": ["create", "read", "cancel"],
    "files": ["upload", "download"],
    "setting": ["read", "write"],
    "integration": ["create", "read", "update", "delete", "discover", "validate", "refresh"],
    "tool": ["read", "update"],
    "llm_model": ["read", "update"],
    "service_account": ["create", "read", "update", "delete", "rotate_secret", "disable", "enable"],
    "user-directory": ["read"],
    "group-directory": ["read"],
    "admin:revocation": ["read", "execute"]
  }
}

Use this endpoint to discover valid resource types and actions for authorization checks such as can_i.

Authorization response fields
Copy link

Field definitions for the authorization query endpoint responses.

Response fields for the can_i endpoint
Copy link

  • allowed — Boolean: you can perform the action
  • denied — Boolean: action is explicitly denied
  • matched_policy — Name of the policy that matched (empty if denied by default)
  • denial_reason — Human-readable reason for denial (empty if allowed)
  • denied_by — Reserved field (always empty; no deny-effect policies exist)

Resource types and actions reference
Copy link

The catalog of all resource types and their valid actions. Use this reference to discover valid action strings when creating policies.

Retrieve the resource-actions catalog
Copy link

GET /api/v1/authz/resource_actions

This endpoint requires authentication but no specific permission. Automation orchestrator builds the data at startup and does not query the database.

curl -X GET https://orchestrator.example.com/api/v1/authz/resource_actions \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Example response:

{
  "resource_actions": {
    "workflow": ["create", "read", "update", "delete"],
    "execution": ["read", "run"],
    "credential": ["create", "read", "update", "delete"],
    "project": ["create", "read", "update", "delete"],
    "group": ["create", "read", "update", "delete", "manage-members"],
    "role-assignment": ["read", "assign", "revoke"],
    "policy": ["read"],
    "role": ["create", "read", "update", "delete"],
    "user": ["create", "read", "update", "delete"],
    "identity-provider": ["create", "read", "update", "delete", "test"],
    "approval": ["create", "read", "decide"],
    "authz": ["query"],
    "user_identity": ["read", "attach", "detach"],
    "invocation": ["create", "read", "cancel"],
    "files": ["upload", "download"],
    "setting": ["read", "write"],
    "integration": ["create", "read", "update", "delete", "discover", "validate", "refresh"],
    "tool": ["read", "update"],
    "llm_model": ["read", "update"],
    "service_account": ["create", "read", "update", "delete", "rotate_secret", "disable", "enable"],
    "user-directory": ["read"],
    "group-directory": ["read"],
    "admin:revocation": ["read", "execute"]
  }
}

The system validates policy statement actions against this catalog and rejects unrecognized resource_type:action pairs.