---
title: "Resolve Access"
method: POST
path: "/v1/access-control/resolve"
tags: ["v1", "protected", "access-control"]
---

# Resolve Access

`POST /v1/access-control/resolve`

Resolve why (and how) a subject can access a resource.

``allowed`` is computed via the graph backend; ``paths`` are derived from the
direct ``resource`` grants matching the subject so the UI can render the
derivation. Grants inherited through ``project``/``role`` still affect
``allowed`` but are not expanded into hops here.

## Request body

- ResolveRequest
  - `resource_id` string, required
  - `resource_kind` 'skill' | 'collection' | 'mcp' | 'agent', required
  - `subject_id` string, required

## Response `200`

Successful Response

- ResolveResponse
  - `allowed` boolean, required
  - `effective_relation` string, nullable, required
  - `paths` ResolvePath[], required
    - `hops` ResolveHop[], required
      - `color` string, required
      - `id` string, required
      - `kind` string, required
      - `name` string, required
    - `relation` string, required
    - `rels` string[], required
  - `verb` string, required

## Other responses

- `422` — Validation Error

## Changes

- **2026-06-18** `dad98bb65260` — 1 info
  - endpoint added
- **2026-03-30** `e9c153221160` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/agentarea/apis/agentarea-api/changes/v1/access-control/resolve/post.md)

---

[API](https://skmtc.dev/agentarea/apis/agentarea-api.md) · [All operations](https://skmtc.dev/agentarea/apis/agentarea-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/agentarea/agentarea-api/revisions/ce40e8663ec3/schema)