AGagentarea
v1
protected
access-control

Resolve Access

Changed on

Resolve why (and how) a subject can access a resource.

allowed is computed via the graph backend; paths are derived from the direct resource grants matching the subject so the UI can render the derivation. Grants inherited through project/role still affect allowed but are not expanded into hops here.

post/v1/workspaces/{workspace}/access-control/resolve

Request

Path parameters

workspacestring required

Slug of the workspace the request acts in

Request body

resource_idstring required
resource_kind'skill' | 'collection' | 'mcp' | 'agent' required
subject_idstring required

Response

Successful Response

allowedboolean required
effective_relationstring nullable required
verbstring required

Changes