# View permission schema

```{raw} html
<div class="mo-api-page-show-toc" aria-hidden="true"></div>
```

View the permission resources, actions, and grant scopes supported by the current workspace. Use them when configuring permission policies or object grants.

```text
GET https://moi.matrixorigin.cn/newmoi/workspaces/{workspace_id}/iam/permissions/schema
```

## Preparation before calling

Prepare a [personal access token](../../../../../guides/genesis/api-keys.md) that can access the target workspace and the [target workspace ID](../../../../../guides/ai-studio/resource-center/workspace.md#copy-a-workspace-id).

## Request parameters

:::::::{div} mo-api-tabs
::::::{tab-set}
:::::{tab-item} Input example

```bash
curl -X GET "https://moi.matrixorigin.cn/newmoi/workspaces/$WORKSPACE_ID/iam/permissions/schema" \
  -H "X-API-Key: $AI_STUDIO_API_KEY" \
  -H "X-Workspace-ID: $WORKSPACE_ID"
```

:::::
:::::{tab-item} Parameter description

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `workspace_id` | string | Yes | Target workspace ID. |

:::::
::::::
:::::::

## Successful response

On success, returns the permission schema available to the current workspace. When creating or updating a policy, use the returned schema version, action IDs, resource types, and scope options.

:::::::{div} mo-api-tabs mo-api-response-tabs
::::::{tab-set}
:::::{tab-item} Response example

```json
{
  "code": "OK",
  "msg": "OK",
  "data": {
    "schema_version": "schema-v1",
    "capabilities": {
      "application_policy_actions_included": true,
      "matrixone_actions_included": true
    },
    "resources": [],
    "actions": [],
    "operations": [],
    "request_id": "req-001",
    "trace_id": "trace-001"
  }
}
```

:::::
:::::{tab-item} Field details

| Field | Type | Description |
| --- | --- | --- |
| `code` | string | `OK` on success. |
| `msg` | string | `OK` on success. |
| `data.schema_version` | string | Current permission schema version. |
| `data.capabilities` | object | Flags for the permission capabilities included in the current schema. |
| `data.resources` | object array | Resource types and their supported scopes. |
| `data.actions` | object array | Action definitions available to policies. |
| `data.operations` | object array | Product operations and their permission requirements. |
| `data.request_id` | string | Request correlation ID. |
| `data.trace_id` | string | Trace ID. |

:::::
::::::
:::::::

## Error response

:::::::{div} mo-api-tabs mo-api-response-tabs
::::::{tab-set}
:::::{tab-item} Response example

```json
{
  "code": "ErrIAMSchemaInvalid",
  "msg": "Service temporarily unavailable",
  "data": null
}
```

:::::
:::::{tab-item} Field details

| Field | Type | Description |
| --- | --- | --- |
| `code` | string | Error code. |
| `msg` | string | Error message. |
| `data` | null | — |

:::::
::::::
:::::::

## Next steps

### Select policy inputs

Before validating or applying an application permission policy or an object grant, select matching actions, resource types, and grant scopes from the current schema.