1. Docs
  2. API Reference
  3. Bulk evaluate authorization

Bulk evaluate authorization

POST/api/v1/permissions/evaluate/bulk

Evaluates many permission checks in a single request, returning a { items } array of decisions in the same order as the input checks, each with the same shape as the single evaluate endpoint. Every check is resolved independently against its own identity_id, permission, and scope (node lineage walk or app_wide). Scoped API keys must carry the evaluate scope (403 otherwise). Rate-limited to 500 requests/minute.

Authentication

Bearer TokenAuthorization Option A

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

API KeyX-API-Key Option B

API key for management-tier access. Never send alongside an Authorization header: a request carrying both is refused.

Request body

application/json

checksEvaluateCheckDto[] Required

Responses

application/json

  • itemsEvaluateResponseDto[]*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Returned object

EvaluateResponseDtoView all properties on this resource
Request
curl -X POST "https://auth.canopy-io.com/api/v1/permissions/evaluate/bulk" \
  -H "X-API-Key: $CANOPY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "checks": [
      {
        "identity_id": "string",
        "permission": "string",
        "scope": "node",
        "node_id": "string"
      }
    ]
  }'
Response
{
  "items": [
    {
      "allowed": false,
      "permission": "string",
      "scope_evaluated": "node",
      "effective_node_id": "string",
      "granting_roles": [
        "string"
      ],
      "denial_reason": "string"
    }
  ]
}
 Related endpoints
GETList permission catalog
POSTRegister new permission(s)
GETGet a permission
PATCHUpdate permission metadata
DELETERemove a permission
GETGet where a permission is used
POSTEvaluate authorization
POSTExplain a node-scoped authorization decision
 Was this page helpful?

Tell us how we can improve this guide.

Canopy