---
title: "GET /api/admin/capabilities"
method: GET
path: "/api/admin/capabilities"
tags: ["Admin: Audit"]
---

# GET /api/admin/capabilities

`GET /api/admin/capabilities`

## Request

- The document declares no server URL.
- Auth: API key in cookie `session`

The capabilities the caller holds; open to any staff member.

## Response `200`

The request has succeeded.

- MyCapabilities: The capability Permissions (`audit.read`, `mcp.read`, ...) the signed-in staff member holds through their Staff Role. The administrator flag adds none, so the admin menu shows an entry behind a capability only to someone who holds it.
  - `held` string[], required

## Other responses

- `default`: Default error response shared by every operation. `@error` emits an OpenAPI `default` response, keeping central transport failures typed without enumerating every status on every operation.

## Changes

- **2026-10-18** `9380d4c85a04`: 3 info
  - removed the non-success response with the status `401`
  - removed the non-success response with the status `403`
  - added the optional property `errors` to the response with the `default` status
- **2026-10-17** `023e7c2cd140`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/changes/api/admin/capabilities/get.md)

---

[API](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api.md) · [All operations](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/revisions/51c7f596b47c?raw)