Skip to content
OpenRelay is in early access, and the /v1 API is stable. New capabilities ship in the changelog.
PricingDashboard
GuidesAPI ReferenceCLI
API ReferenceAccount and accessAccess

Get the permission catalog

Returns the permission areas and levels with the actions each allows, the built-in roles, the key templates, and the actions API key ceilings cannot grant.

Required permission

Requires the catalog.read permission. See Permissions for the roles and API key permissions that include it.

Command line

The orl CLI wraps this endpoint:

orl authz permission-catalog get
GET
/v1/authz/catalog

Authorization

apiKey
headerAuthorizationBearer <token>

OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).

Response Body

The permission catalog

application/json
  1. response
areas*array<>
roles*array<>
templates*array<>
sessionOnlyActions*array<string>

Actions that cannot be granted to API keys through permission ceilings. Platform policies may allow scoped uses, such as revoking the key itself.

Example Request
curl -X GET 'https://api.openrelay.inc/v1/authz/catalog'
Example Response
{  "areas": [    {      "id": "string",      "label": "string",      "levels": [        {          "id": "string",          "label": "string",          "description": "string",          "actions": [            "string"          ],          "sessionOnly": true        }      ]    }  ],  "roles": [    {      "id": "string",      "name": "string",      "description": "string",      "grants": [        "string"      ],      "all": true    }  ],  "templates": [    {      "id": "string",      "name": "string",      "description": "string",      "permissions": [        "string"      ],      "providerOnly": true    }  ],  "sessionOnlyActions": [    "string"  ]}

Overview

The permission catalog, effective access, the access checker, guardrails, Cedar policies and key settings such as the maximum key lifetime. Available to organizations with permissions enabled; otherwise these endpoints return 404.

Show what a principal can do right now GET

Returns the permission ids and actions a member, service account or API key holds right now, and the models it may call, after its restrictions apply. Without parameters, answers for the caller. Naming a member, service account or key of the organization needs policy.read. The answer is the principal's role intersected with its key restrictions, role conditions and the organization's guardrails. Network rules are checked against the address of the request you send, not one the named principal would call from.