# View role permission view

```{raw} html
<div class="mo-api-page-show-toc" aria-hidden="true"></div>
```

View a role's application-permission policy, grant sources, and editability before changing application permissions.

```text
GET https://moi.matrixorigin.cn/newmoi/workspaces/{workspace_id}/iam/roles/{role_id}/permission-view
```

## Preparation before calling

First [select the role](list-roles.md#select-a-role). Prepare a personal access token with access to the target workspace and the [target workspace ID](../../../../../guides/ai-studio/resource-center/workspace.md#copy-a-workspace-id).

## Request parameters

:::::::{div} mo-api-tabs
::::::{tab-set}
:::::{tab-item} Input example

```bash
curl -X GET "https://moi.matrixorigin.cn/newmoi/workspaces/$WORKSPACE_ID/iam/roles/$ROLE_ID/permission-view" \
  -H "X-API-Key: $AI_STUDIO_API_KEY" \
  -H "X-Workspace-ID: $WORKSPACE_ID"
```

:::::
:::::{tab-item} Parameter description

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| workspace_id | string | Yes | Target workspace ID. |
| role_id | string | Yes | Target role ID. |

:::::
::::::
:::::::

## Successful response

On success, returns the role's direct application-permission policy view, current policy and lifecycle versions, and permission sources included in the view. A `false` capability flag does not mean that a missing source has no permissions.

:::::::{div} mo-api-tabs mo-api-response-tabs
::::::{tab-set}
:::::{tab-item} Response example

```json
{"code":"OK","msg":"OK","data":{"role_id":"role-001","schema_version":"schema-v1","policy_version":2,"policy_hash":"sha256:example","role_kind":"ordinary","role_graph_version":"graph-v1","lifecycle_version":"3","expected_role_lifecycle_version":3,"system_role":false,"protected_role":false,"policy_mutation_allowed":true,"capabilities":{"direct_policy_included":true,"inherited_policy_included":false},"direct_grants":[],"request_id":"req-001","trace_id":"trace-001"}}
```

:::::
:::::{tab-item} Field details

| Field | Type | Description |
| --- | --- | --- |
| code | string | `OK` on success. |
| msg | string | `OK` on success. |
| data.role_id | string | Assessed role ID. |
| data.schema_version | string | Permission schema version used by the policy. |
| data.policy_version | integer | Current policy version. |
| data.policy_hash | string | Current policy hash. |
| data.role_graph_version | string | Current role graph version. |
| data.expected_role_lifecycle_version | integer | Role lifecycle version to submit when updating the policy. |
| data.system_role | boolean | Whether this is a system role. |
| data.protected_role | boolean | Whether this is a protected role. |
| data.policy_mutation_allowed | boolean | Whether the policy can currently be changed. |
| data.capabilities | object | Data-source flags included in the current view. |
| data.direct_grants | object[] | Direct grants for the role; may be omitted for a newly created empty role. |
| data.request_id | string | Request correlation ID. |
| data.trace_id | string | Trace ID. |

:::::
::::::
:::::::

## Error response

:::::::{div} mo-api-tabs mo-api-response-tabs
::::::{tab-set}
:::::{tab-item} Response example

```json
{"code":"ErrIAMCoreUnavailable","msg":"服务暂时不可用","data":null}
```

:::::
:::::{tab-item} Field details

| Field | Type | Description |
| --- | --- | --- |
| code | string | Error code. |
| msg | string | Error message. |
| data | null | — |

:::::
::::::
:::::::

## Next steps

### Confirm current policy state

Before validating or applying an application-permission policy, confirm that the role's policy can currently be changed and prepare the change from the policy state read on this page.