---
title: "Check Tool Access"
method: POST
path: "/v1/tool-access/checks"
tags: ["v1", "protected", "tool-access"]
---

# Check Tool Access

`POST /v1/tool-access/checks`

Check whether a user can call a tool.

Omitting ``arguments`` checks a whole-tool grant. Passing ``arguments``
checks the concrete invocation path used by runtime tool execution.

## Request body

- ToolAccessCheckRequest
  - `arguments` object, nullable — Optional exact argument set. Omit to check the whole-tool grant.
  - `tool_name` string, required
  - `user_id` string, required — User UUID or User:<uuid> subject.

## Response `200`

Successful Response

- ToolAccessCheckResponse
  - `allowed` boolean, required
  - `grant` ToolAccessGrant, required
    - `arguments_hash` string, nullable
    - `object_id` string, required
    - `scope` 'tool' | 'arguments', required
    - `tool_name` string, required
    - `user_id` string, required
    - `workspace_id` string, required

## Other responses

- `422` — Validation Error

## Changes

- **2026-06-18** `dad98bb65260` — 1 info
  - endpoint added
- **2026-03-30** `e9c153221160` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/agentarea/apis/agentarea-api/changes/v1/tool-access/checks/post.md)

---

[API](https://skmtc.dev/agentarea/apis/agentarea-api.md) · [All operations](https://skmtc.dev/agentarea/apis/agentarea-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/agentarea/agentarea-api/revisions/dad98bb65260/schema)