View role permission view

View a role’s application-permission policy, grant sources, and editability before changing application permissions.

GET https://moi.matrixorigin.cn/newmoi/workspaces/{workspace_id}/iam/roles/{role_id}/permission-view

Preparation before calling

First select the role. Prepare a personal access token with access to the target workspace and the target workspace ID.

Request parameters

curl -X GET "https://moi.matrixorigin.cn/newmoi/workspaces/$WORKSPACE_ID/iam/roles/$ROLE_ID/permission-view" \
  -H "X-API-Key: $AI_STUDIO_API_KEY" \
  -H "X-Workspace-ID: $WORKSPACE_ID"

Parameter

Type

Required

Description

workspace_id

string

Yes

Target workspace ID.

role_id

string

Yes

Target role ID.

Successful response

On success, returns the role’s direct application-permission policy view, current policy and lifecycle versions, and permission sources included in the view. A false capability flag does not mean that a missing source has no permissions.

{"code":"OK","msg":"OK","data":{"role_id":"role-001","schema_version":"schema-v1","policy_version":2,"policy_hash":"sha256:example","role_kind":"ordinary","role_graph_version":"graph-v1","lifecycle_version":"3","expected_role_lifecycle_version":3,"system_role":false,"protected_role":false,"policy_mutation_allowed":true,"capabilities":{"direct_policy_included":true,"inherited_policy_included":false},"direct_grants":[],"request_id":"req-001","trace_id":"trace-001"}}

Field

Type

Description

code

string

OK on success.

msg

string

OK on success.

data.role_id

string

Assessed role ID.

data.schema_version

string

Permission schema version used by the policy.

data.policy_version

integer

Current policy version.

data.policy_hash

string

Current policy hash.

data.role_graph_version

string

Current role graph version.

data.expected_role_lifecycle_version

integer

Role lifecycle version to submit when updating the policy.

data.system_role

boolean

Whether this is a system role.

data.protected_role

boolean

Whether this is a protected role.

data.policy_mutation_allowed

boolean

Whether the policy can currently be changed.

data.capabilities

object

Data-source flags included in the current view.

data.direct_grants

object[]

Direct grants for the role; may be omitted for a newly created empty role.

data.request_id

string

Request correlation ID.

data.trace_id

string

Trace ID.

Error response

{"code":"ErrIAMCoreUnavailable","msg":"服务暂时不可用","data":null}

Field

Type

Description

code

string

Error code.

msg

string

Error message.

data

null

—

Next steps

Confirm current policy state

Before validating or applying an application-permission policy, confirm that the role’s policy can currently be changed and prepare the change from the policy state read on this page.

Last updated on