---
title: "GET /api/admin/management/permissions"
method: GET
path: "/api/admin/management/permissions"
tags: ["Admin: Roles"]
---

# GET /api/admin/management/permissions

`GET /api/admin/management/permissions`

## Request

- The document declares no server URL.
- Auth: API key in cookie `session`

The catalog of Permissions, generated from the operations' declarations.

## Response `200`

The request has succeeded.

- PermissionCatalog: Every Permission an admin operation can require.
  - `permissions` Permission[], required
    - `name` string, required
    - `kind` 'read' | 'write', required: Whether an operation only reads or can change data (ADR-0020).
    - `capability` boolean, required: True for a capability Permission (MCP, audit): the administrator flag does not imply it, so a role must be given it explicitly.

## Other responses

- `default`: Default error response shared by every operation. `@error` emits an OpenAPI `default` response, keeping central transport failures typed without enumerating every status on every operation.

## Changes

- **2026-10-18** `9380d4c85a04`: 3 info
  - removed the non-success response with the status `401`
  - removed the non-success response with the status `403`
  - added the optional property `errors` to the response with the `default` status
- **2026-10-17** `023e7c2cd140`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/changes/api/admin/management/permissions/get.md)

---

[API](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api.md) · [All operations](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/revisions/51c7f596b47c?raw)