# Check Authorization

Find out whether someone can do something before they try, and which role, grant, or rule is behind the answer.

`POST https://connect.mindcloud.co/v2/authorization/check`

Permissions: `member:view`.

## Parameters

### Headers

- `X-Company-Id` (string): Optional. The id of the organization to act in. Leave it out to act in the API key's own organization. A key can also act in its child organizations, and, with "Use this key across all of your organizations" on, in every organization its creator can open in the app. List them with GET /v2/companies. Every response's X-Company-Id header names the organization it acted in. See [Organizations](https://mindcloud.co/docs/api/rest/introduction/organizations).

### Body

- `userId` (string, required): The member's userId, from List Members.
- `permission` (string): A permission key, from List Permissions.
- `capability` (string): A Cirra capability key, from Get Capability Catalog or List Universal Actions.

## Example request

```bash
curl --request POST \
  --url 'https://connect.mindcloud.co/v2/authorization/check' \
  --header 'Authorization: Bearer $MINDCLOUD_API_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "userId": "user_2wXk9Lm4Pq7Rz3Ts8Vb1Nc6Hd",
  "permission": "workflow:run",
  "capability": "apps.salesforce.actions.delete-contact"
}'
```

## Response fields

- `userId` (string): The member's userId.
- `permission` (object): The permission answer, or null when no permission was asked about.
  - `key` (string): The permission asked about.
  - `allowed` (boolean): True when the member holds it.
  - `sources` (array): Where they hold it from: role, directGrant, staff, companySetting, or membership (every member holds it). Empty when they do not.
- `capability` (object): The Cirra capability answer, or null when no capability was asked about.
  - `key` (string): The capability key asked about.
  - `allowed` (boolean): False when Cirra refuses it.
  - `decision` (string): allow (Cirra asks the member first unless the thread runs with full access), never_ask, or deny.
    Allowed values:
      - `allow`
      - `never_ask`
      - `deny`
  - `layer` (string): Which layer decided: role, user (their own rules), or default.
    Allowed values:
      - `role`
      - `user`
      - `default`
  - `ruleKey` (string): The key of the rule that decided: the key asked about, or the broader key it fell back to.