Check Authorization

Find out whether someone can do something before they try, and which role, grant, or rule is behind the answer.

POST

Headers

Optional headers

string

Optional. The id of the organization to act in. Leave it out to act in the API key's own organization. A key can also act in its child organizations, and, with "Use this key across all of your organizations" on, in every organization its creator can open in the app. List them with GET /v2/companies. Every response's X-Company-Id header names the organization it acted in. See Organizations.

Body

Arguments

stringrequired

The member's userId, from List Members.

string

A permission key, from List Permissions.

string

A Cirra capability key, from Get Capability Catalog or List Universal Actions.

Response fields

userIdstring

The member's userId.

permissionobject

The permission answer, or null when no permission was asked about.

keystring
The permission asked about.
allowedboolean
True when the member holds it.
sourcesarray
Where they hold it from: role, directGrant, staff, companySetting, or membership (every member holds it). Empty when they do not.

capabilityobject

The Cirra capability answer, or null when no capability was asked about.

keystring
The capability key asked about.
allowedboolean
False when Cirra refuses it.
decisionstring
allow (Cirra asks the member first unless the thread runs with full access), never_ask, or deny.
- allow
- never_ask
- deny
layerstring
Which layer decided: role, user (their own rules), or default.
- role
- user
- default
ruleKeystring
The key of the rule that decided: the key asked about, or the broader key it fell back to.