List Principal Effective Permissions
const url = 'https://example.com/iam/v1/scopes/example/example/access/example/permissions';const options = {method: 'GET'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://example.com/iam/v1/scopes/example/example/access/example/permissionsReturns every permission the named principal effectively holds at the requested scope, flattened across the scope’s ancestor chain, with full provenance lineage.
Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ”The scope type: PLATFORM, ORGANISATION, WORKSPACE, or GROUP.
This MUST remain a string and MUST NOT become a proto enum. The scope
resolution that authorizes and answers scoped requests reads this field
reflectively as a string; an enum getter yields no string, the explicit
scope resolves to nothing, and every scoped ask silently collapses to a
platform-only chain - a wrong answer with no error.
The unique identifier of the scope. For the PLATFORM scope this is the zero-UUID sentinel 00000000-0000-0000-0000-000000000000.
The unique identifier of the principal being inspected.
This path parameter is deliberately named principal, not id. The scope
resolution that builds a request’s authorization chain treats an id field
as the target resource and derives a resource identifier from it; that is
the wrong shape here, because the resource being authorized is the SCOPE,
not the inspected principal. A later path-parameter cleanup must not
“correct” this name.
Query Parameters
Section titled “Query Parameters ”The maximum number of entries to return. The service may return fewer than this value. If unspecified, at most 20 entries will be returned. The maximum value is 100; values above 100 will be coerced to 100.
This rolled-up listing pages by offset (skip) only and never issues page tokens;
a request supplying a page token is rejected as invalid.
AIP-160 filter expression. Filterable fields: action, condition_kinds, lineage.conditional, lineage.origin, lineage.origin_scope_id, lineage.origin_scope_type, lineage.role_id, lineage.role_name, permission, resource, service.
AIP-132 order_by expression. Sortable fields: permission.
AIP-158 offset mode: number of entries to skip from the start of the rolled-up set.
This listing pages by offset only - page_token is not supported, and a request
supplying both is an invalid request. Default 0 (no skip).
Responses
Section titled “ Responses ”OK
ListPrincipalEffectivePermissionsResponse
Response message for ListPrincipalEffectivePermissions.
object
One entry per permission key the inspected principal effectively holds.
One permission the principal effectively holds at the requested scope.
Advisory display data: use it to decide what to show, never as an
authorization decision - every action is enforced by the platform when it is
attempted. Policy conditions are reported via condition_kinds, never
evaluated by this read.
object
The permission key, <service>.<resource>.<action>.
The service facet of the key (e.g. “compute”).
The resource facet of the key (e.g. “vm”).
The action facet of the key (e.g. “create”).
The kinds of condition guarding this permission.
Empty means the permission is held outright - at least one granting binding carries no condition at all. Non-empty means every granting binding is conditional, and these are the kinds involved; CONDITION_KIND_UNKNOWN appears when a condition exists but its definition could not be read.
Reported, never evaluated: the same question asked at any time, from any network, returns the same kinds.
Every granting role, most-local first (direct grants before inherited, then by proximity of the origin scope).
One granting role behind an effective permission - the provenance of a grant.
object
The unique identifier of the granting role.
The human-readable name of the granting role.
Whether the grant was made at the requested scope or inherited from an ancestor.
The scope type the grant was inherited from; unset when origin is DIRECT.
The scope id the grant was inherited from; empty when origin is DIRECT.
Whether this particular grant only holds under a policy condition.
Always empty - this rolled-up listing pages by offset only; continue with skip.
Exact count of entries matching the request’s filter and scope, independent of paging.
Example
{ "permissions": [ { "condition_kinds": [ "CONDITION_KIND_UNSPECIFIED" ], "lineage": [ { "origin": "ROLE_ORIGIN_UNSPECIFIED", "origin_scope_type": "SCOPE_TYPE_UNSPECIFIED" } ] } ]}default
Section titled “default ”Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
object
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
A list of messages that carry the error details. There is a common set of message types for APIs to use.
Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.
object
The type of the serialized message.
Example generated
{ "code": 1, "message": "example", "details": [ { "@type": "example" } ]}