Permissions

Grants, reads, checks, and revokes resource permissions.

📄️ Grant Permission

Grant a role on a resource to a user, group, or the public.

📄️ List Permissions

List permission grants for a resource.

📄️ Update Permission

Change a user or group role on a resource. The read/write/owner hierarchy and the `use` role are independent, so changing one does not remove the other. Collection role changes also apply to child resources within the collection permission ceiling.

📄️ Revoke Permission

Revoke a role on a resource from a user or group.

📄️ Check Permission

Check whether the current user has a permission on a resource. Classification-label clearance is required in addition to the discretionary role, including for owners and administrators; the response is `{"allowed": false}` when required clearance is missing.

📄️ Get Resource Owner

Return the run-as owner principal for a resource, or null when no owner is recorded. Only administrator or manager callers may use this endpoint.

📄️ Check Connector Use

Check whether the subject specified by `principal` has `use` permission on a connector or secret. The authenticated caller must be an administrator or manager; the caller's own resource permission is not evaluated.