List My Effective Permissions
const url = 'https://example.com/iam/v1/scopes/example/example/access/me/permissions';const options = {method: 'GET'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://example.com/iam/v1/scopes/example/example/access/me/permissionsReturns every permission the calling principal effectively holds at the requested scope, flattened across the scope’s ancestor chain, with full provenance lineage. Advisory display data - never an authorization decision; every action is enforced by the platform when attempted, and policy conditions are reported but never evaluated by this read.
Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ”The scope type: PLATFORM, ORGANISATION, WORKSPACE, or GROUP.
This MUST remain a string and MUST NOT become a proto enum. The scope
resolution that authorizes and answers scoped requests reads this field
reflectively as a string; an enum getter yields no string, the explicit
scope resolves to nothing, and every scoped ask silently collapses to a
platform-only chain - a wrong answer with no error.
The unique identifier of the scope. For the PLATFORM scope this is the zero-UUID sentinel 00000000-0000-0000-0000-000000000000.
Query Parameters
Section titled “Query Parameters ”The maximum number of entries to return. The service may return fewer than this value. If unspecified, at most 20 entries will be returned. The maximum value is 100; values above 100 will be coerced to 100.
This rolled-up listing pages by offset (skip) only and never issues page tokens;
a request supplying a page token is rejected as invalid.
AIP-160 filter expression. Filterable fields: action, condition_kinds, lineage.conditional, lineage.origin, lineage.origin_scope_id, lineage.origin_scope_type, lineage.role_id, lineage.role_name, permission, resource, service.
AIP-132 order_by expression. Sortable fields: permission.
AIP-158 offset mode: number of entries to skip from the start of the rolled-up set.
This listing pages by offset only - page_token is not supported, and a request
supplying both is an invalid request. Default 0 (no skip).
Responses
Section titled “ Responses ”OK
ListMyEffectivePermissionsResponse
Response message for ListMyEffectivePermissions.
object
One entry per permission key the caller effectively holds at the scope.
One permission the principal effectively holds at the requested scope.
Advisory display data: use it to decide what to show, never as an
authorization decision - every action is enforced by the platform when it is
attempted. Policy conditions are reported via condition_kinds, never
evaluated by this read.
object
The permission key, <service>.<resource>.<action>.
The service facet of the key (e.g. “compute”).
The resource facet of the key (e.g. “vm”).
The action facet of the key (e.g. “create”).
The kinds of condition guarding this permission.
Empty means the permission is held outright - at least one granting binding carries no condition at all. Non-empty means every granting binding is conditional, and these are the kinds involved; CONDITION_KIND_UNKNOWN appears when a condition exists but its definition could not be read.
Reported, never evaluated: the same question asked at any time, from any network, returns the same kinds.
Every granting role, most-local first (direct grants before inherited, then by proximity of the origin scope).
One granting role behind an effective permission - the provenance of a grant.
object
The unique identifier of the granting role.
The human-readable name of the granting role.
Whether the grant was made at the requested scope or inherited from an ancestor.
The scope type the grant was inherited from; unset when origin is DIRECT.
The scope id the grant was inherited from; empty when origin is DIRECT.
Whether this particular grant only holds under a policy condition.
Always empty - this rolled-up listing pages by offset only; continue with skip.
Exact count of entries matching the request’s filter and scope, independent of paging.
Example
{ "permissions": [ { "condition_kinds": [ "CONDITION_KIND_UNSPECIFIED" ], "lineage": [ { "origin": "ROLE_ORIGIN_UNSPECIFIED", "origin_scope_type": "SCOPE_TYPE_UNSPECIFIED" } ] } ]}default
Section titled “default ”Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
object
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
A list of messages that carry the error details. There is a common set of message types for APIs to use.
Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.
object
The type of the serialized message.
Example generated
{ "code": 1, "message": "example", "details": [ { "@type": "example" } ]}