---
title: "Check if a role may read/write a field path"
method: POST
path: "/api/data-access/check"
tags: ["DataAccess"]
---

# Check if a role may read/write a field path

`POST /api/data-access/check`

## Request

- Base URL: `https://api.agentstack.tech` (the document declares no server; this is the origin it was published from)
- URL: `https://api.agentstack.tech/api/data-access/check`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

**Auth:** **read** on `project_id`. Evaluates FAP for hypothetical role/bitmap.

## Query parameters

- `project_id` integer, required: Project ID

## Headers

- `Idempotency-Key` string

## Request body

- CheckFieldBody: Body for POST /check
  - `field_path` string, required: Dot path: 'resource.field' (e.g., 'orders.profit_margin')
  - `user_role` string, required: Role to test
  - `permission` string: 'read' or 'write'
  - `permissions_bitmap` integer: Bitmap from session/JWT
  - `user_id` integer: User ID (0 = anonymous)
  - `resource_owner_id` integer, nullable: Owner ID for 'owner' descriptor evaluation

## Response `200`

{ allowed, field_path, ... }

- unknown

## Other responses

- `400`: Bad Request
- `401`: Not authenticated
- `403`: Insufficient project access (read / admin / owner)
- `404`: Not Found
- `409`: Conflict
- `422`: Validation Error
- `429`: Too Many Requests
- `500`: Internal Server Error

---

[API](https://skmtc.dev/agentstack/apis/agentstack-core-api.md) · [All operations](https://skmtc.dev/agentstack/apis/agentstack-core-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentstack/apis/agentstack-core-api/revisions/8ecf3406e74a?raw)