Skip to content
OpenRelay is in early access, and the /v1 API is stable. New capabilities ship in the changelog.
PricingDashboard
GuidesAPI ReferenceCLI
API ReferenceAccount and accessAccess

Show what a principal can do right now

Returns the permission ids and actions a member, service account or API key holds right now, and the models it may call, after its restrictions apply. Without parameters, answers for the caller. Naming a member, service account or key of the organization needs policy.read. The answer is the principal's role intersected with its key restrictions, role conditions and the organization's guardrails. Network rules are checked against the address of the request you send, not one the named principal would call from.

Required permission

Checked against the self.read permission for the resource it acts on. See Permissions for the roles and API key permissions that include it.

Command line

The orl CLI wraps this endpoint:

orl authz effective get
GET
/v1/authz/effective

Authorization

apiKey
headerAuthorizationBearer <token>

OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).

Query Parameters

principalType?string
Value in"member""service_account""api_key"
principalId?string

Response Body

Effective access

application/json
  1. response
principalType*string
Value in"member""service_account""api_key"
principalId*string
roleId?string
roleName?string
keyKind?string
Value in"personal""service""org""legacy"
active?boolean

False for a key whose owner left the organization or whose service account is disabled.

permissions*array<string>

Permission ids fully held, for display.

actions*array<string>

Every allowed action.

models?array<string>

Models the principal may call, when not all.

allModels*boolean
restrictions?
Example Request
curl -X GET 'https://api.openrelay.inc/v1/authz/effective'
Example Response
{  "principalType": "member",  "principalId": "string",  "roleId": "string",  "roleName": "string",  "keyKind": "personal",  "active": true,  "permissions": [    "string"  ],  "actions": [    "string"  ],  "models": [    "string"  ],  "allModels": true,  "restrictions": {    "permissions": [      "string"    ],    "models": [      "string"    ],    "endpoints": [      "string"    ],    "ipRanges": [      "string"    ]  }}

Get the permission catalog GET

Returns the permission areas and levels with the actions each allows, the built-in roles, the key templates, and the actions API key ceilings cannot grant.

Check whether a principal may perform an action POST

Evaluates one action for a member, service account or key of the organization and returns the decision, the layer that decided it and the deciding policies.