1. Docs
  2. API Reference
  3. Get every permission an identity holds at a node, and what grants it

Get every permission an identity holds at a node, and what grants it

GET/api/v1/identities/{id}/access

Every permission the identity holds at node_id, each with granted_by: the roles that grant it, the lineage node each is held at and access_type (direct at the node itself), nearest the node first. The same assignments and enabled roles evaluate reads, so every key listed is one evaluate allows at the node; an inactive identity holds nothing. Unpaginated, sorted by key. Requires the identity.view permission. Returns 404 when the identity has no membership in this Environment, or when node_id names no node in it.

Authentication

Bearer TokenAuthorization Option A

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

API KeyX-API-Key Option B

API key for management-tier access. Never send alongside an Authorization header: a request carrying both is refused.

Production Environments require production_identities.accessDeveloper Console

Access identities in production Environments. Applies to users only, and only in an Environment marked production: its identities are real end users. API keys and identity principals are exempt.

Path Parameters

idstring Required

Query Parameters

node_idstring · uuid Required

The node to answer for.

Responses

application/json

  • itemsIdentityAccessItemDto[]*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Errors

When the request can't be completed, the response body includes a stable error code you can branch on, and a correlation_id (also sent as the X-Correlation-Id header). Quote the correlation id when you contact support: it identifies the exact request in Canopy's logs. A request refused by an authorization check answers 403 with the code authorization.denied, and its data names the denial_reason and the permission checked.

403environment.production_identities_forbiddenForbidden
When it happens

The Environment is marked production and the caller is a user without production identity access.

Remediation

Manage these people in the Admin Workspace, or ask an administrator to grant the Production Support role, then retry.

Returned object

IdentityAccessItemDtoView all properties on this resource
Request
curl -X GET "https://auth.canopy-io.com/api/v1/identities/value/access?node_id=value" \
  -H "X-API-Key: $CANOPY_API_KEY"
Response
{
  "items": [
    {
      "permission": "string",
      "granted_by": [
        {
          "role_id": "string",
          "role_name": "string",
          "node_id": "string",
          "node_name": "string",
          "access_type": "direct"
        }
      ]
    }
  ]
}
 Related endpoints
GETList identities in Application
POSTCreate an identity
GETList identities with their role assignments
GETGet Application identities summary
POSTBulk-create identities
GETGet an identity
PATCHUpdate an identity
DELETERemove an identity
GETGet identity detail with role assignments
POSTSet an identity's password (admin)
POSTForce a password reset for an identity (admin)
GETList an identity's active sessions (admin)
DELETERevoke one of an identity's sessions (admin)
POSTRevoke all of an identity's sessions (admin)
GETGet MFA enrollment summary for an identity
POSTForce-reset an identity's MFA — admin recovery action
GETRead an identity's auth state for backend decisioning
POSTMark an identity's email verified (admin)
GETGet identity's role assignments
GETGet identity's effective permissions
GETGet where an identity may act with one permission
GETGet where an identity holds each permission
 Was this page helpful?

Tell us how we can improve this guide.

Canopy