Skip to main content

ResolveMyPermissions

GET 
/v1/me/permissions

ResolveMyPermissions returns every RBAC permission the calling identity holds at one target: the customer's org level when project_id is empty, or that project otherwise.

This is the read the console renders from -- it decides which controls exist, not whether a call is allowed. Enforcement stays at the interceptor.

This read and the interceptor's RBAC leg resolve through the SAME bindings, so they cannot disagree about a binding-derived grant. They can still disagree in one direction, and it is worth stating plainly: authorization is an additive OR of the RBAC leg and the static coarse-scope leg, so a caller the interceptor admits on a coarse scope alone -- holding no binding -- resolves an empty set here. The admin scope is carved out below and unioned in; the other scope tokens are not, and neither is a management key riding delegated scopes. Such a caller sees fewer controls than it may in fact use. That is the safe direction (it hides, it never offers a control that 403s), but it is not "identical".

resolved reports whether the frontier was actually computed. It is never a silent empty: a resolve failure answers an error rather than an empty permission list, because "no permissions" and "could not tell" render the same way and only one of them is safe to act on.

Request​

Responses​

Success