---
title: "Run Fga Check"
method: POST
path: "/api/platform/users/{user_id}/fga-check"
tags: ["platform"]
---

# Run Fga Check

`POST /api/platform/users/{user_id}/fga-check`

Run an ad-hoc FGA ``check`` for a user against an arbitrary object.

By default resolves the person's anchor sub and checks the bare
``user:<anchor>`` subject so effective access matches any of their Auth0
logins (via ``equivalent`` and the self-link). When ``linkedSub`` selects
one of the person's linked logins, the check runs against that bare
``user:<sub>`` subject instead.

## Path parameters

- `user_id` string, required — Auth0 user id whose principal is checked

## Request body

- UserFgaCheckRequest — FGA check request for a user, optionally pinned to one linked login. When ``linked_sub`` is omitted the check runs person-level: the person's anchor sub is resolved and the subject is the bare ``user:<anchor>``, so the result reflects access through any of their Auth0 logins (via ``equivalent`` and the self-link). Checking the ``#linked`` userset as the subject would miss bare ``*_user`` grants. When the operator picks one of the person's linked logins, ``linked_sub`` carries that Auth0 sub and the check runs against the bare ``user:<linked_sub>`` subject — exactly what runtime authorization evaluates when that credential authenticates.
  - `objectType` string, required
  - `objectId` string, required
  - `relation` string, required
  - `linkedSub` string, nullable

## Response `200`

Successful Response

- FgaCheckResponse — Result of an FGA ``check`` for a principal.
  - `allowed` boolean, required
  - `user` string, required
  - `relation` string, required
  - `object` string, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/gocrisp/apis/crisp-app-dock.md) · [All operations](https://skmtc.dev/gocrisp/apis/crisp-app-dock/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/gocrisp/crisp-app-dock/revisions/e56bd3c1a9db/schema)