# Get Capability Catalog

See every Cirra capability key a role can allow or deny, its default, and how the keys fall back to each other. Find app, model, operation, and action values with List Universal Actions.

`GET https://connect.mindcloud.co/v2/capabilities`

Permissions: any API key can call this endpoint.

## Parameters

### Headers

- `X-Company-Id` (string): Optional. The id of the organization to act in. Leave it out to act in the API key's own organization. A key can also act in its child organizations, and, with "Use this key across all of your organizations" on, in every organization its creator can open in the app. List them with GET /v2/companies. Every response's X-Company-Id header names the organization it acted in. See [Organizations](https://mindcloud.co/docs/api/rest/introduction/organizations).

## Example request

```bash
curl --request GET \
  --url 'https://connect.mindcloud.co/v2/capabilities' \
  --header 'Authorization: Bearer $MINDCLOUD_API_TOKEN'
```

## Response fields

- `keys` (array of objects): Every capability key or key pattern, from the broadest to the most specific. Patterns name their parts in angle brackets.
  - `key` (string): The key, such as files.write, or a pattern, such as apps.<app>.<model>.<operation>.
  - `description` (string): What the key governs.
  - `default` (string): Its value when no role or person sets it: allow, never_ask (allow without asking) or deny. Null for a pattern: its default is its fallback.
    Allowed values:
      - `allow`
      - `never_ask`
      - `deny`
  - `fallback` (string): The key that decides when this one is not set. Null for a top-level key.
- `operations` (array of string): The operations an app action declares, as used in apps keys. An action declares one; GET /v2/universal/apps/{app}/actions lists each action with its model and operation.
- `values` (object): The values each layer may set.
  - `role` (array): Values a role may set: allow or deny. A role deny is a ceiling no person can lift.
  - `user` (array): Values a person's own rules may set: allow, never_ask (allow without asking), or deny.
- `reservedShellCommands` (array of string): Shell commands that cannot be given a rule of their own, such as ls and cat. They follow shell.default.