---
title: "Explain Fga Check"
method: POST
path: "/api/platform/users/{user_id}/fga-check/explain"
tags: ["platform"]
---

# Explain Fga Check

`POST /api/platform/users/{user_id}/fga-check/explain`

Explain how a user obtained an FGA relation on an object when allowed.

By default checks the bare ``user:<anchor>`` subject so the proof graph
matches grants that follow the person across Auth0 logins; with
``linkedSub`` the proof is computed for that single login's bare
``user:<sub>`` subject.

## Path parameters

- `user_id` string, required — Auth0 user id whose principal is checked

## Request body

- UserFgaCheckRequest — FGA check request for a user, optionally pinned to one linked login. When ``linked_sub`` is omitted the check runs person-level: the person's anchor sub is resolved and the subject is the bare ``user:<anchor>``, so the result reflects access through any of their Auth0 logins (via ``equivalent`` and the self-link). Checking the ``#linked`` userset as the subject would miss bare ``*_user`` grants. When the operator picks one of the person's linked logins, ``linked_sub`` carries that Auth0 sub and the check runs against the bare ``user:<linked_sub>`` subject — exactly what runtime authorization evaluates when that credential authenticates.
  - `objectType` string, required
  - `objectId` string, required
  - `relation` string, required
  - `linkedSub` string, nullable

## Response `200`

Successful Response

- FgaCheckExplanationResponse — Proof graph for how a principal obtained an FGA relation on an object.
  - `allowed` boolean, required
  - `user` string, required
  - `relation` string, required
  - `object` string, required
  - `summary` string, nullable
  - `nodes` FgaExplainNode[]
    - `id` string, required
    - `label` string, required
    - `kind` string, required
    - `displayName` string, nullable
  - `edges` FgaExplainEdge[]
    - `fromId` string, required
    - `toId` string, required
    - `label` string, required
  - `truncated` boolean
  - `warnings` string[]

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/gocrisp/apis/crisp-app-dock.md) · [All operations](https://skmtc.dev/gocrisp/apis/crisp-app-dock/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/gocrisp/crisp-app-dock/revisions/e56bd3c1a9db/schema)