---
title: "List Available User Permissions"
method: GET
path: "/v1/user-permissions"
tags: ["Users", "v1"]
---

# List Available User Permissions

`GET /v1/user-permissions`

Returns the complete catalogue of permissions that can be granted to users. This is a universal list independent of any specific account — use it to populate permission selection UIs or to discover valid permission identifiers before calling the invite or update endpoints.

## Response `200`

List of available user permissions

- object
  - `data` UserPermissionV1[], required
    - `type` 'user_permission', required — The type of the object.
    - `id` string, required — Unique identifier for the permission in the format `{product}.{key}`. Use these identifiers when setting permissions on a user.
    - `attributes` object, required
      - `product` string, required — The product this permission belongs to.
      - `key` string, required — The permission key within the product.
      - `description` string, required — Human-readable description of what this permission grants.
  - `meta` object, required
    - `request_id` string, required — A unique identifier assigned to each API request for end-to-end traceability.

## Other responses

- `401` — Unauthorized. The request was rejected because the credentials are missing, invalid, expired, or have been revoked. The client must re-authenticate before retrying. Clients can differentiate via the `code` value of the first item in `errors`.
- `403` — Forbidden. The credentials are valid but the caller is not authorized to perform the request — typically because the user lacks the required permission, the OAuth scope is insufficient, the subscription plan does not include the required entitlement, the `account_id` does not belong to the authenticated user, or the target list is read-only and its members cannot be modified. Clients can differentiate via the `code` value of the first item in `errors`.
- `429` — Too many requests. Either the per-second rate limit or the monthly quota configured for the API key / OAuth application has been exceeded. Clients can differentiate via the `code` value of the first item in `errors`.
- `500` — Internal server error
- `504` — Server timeout

## Changes

> 17 revisions in range; 1 not diffed.

- **2026-09-01** `885dcce2a6c2` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/leadfeeder/apis/leadfeeder-public-api/changes/v1/user-permissions/get.md)

---

[API](https://skmtc.dev/leadfeeder/apis/leadfeeder-public-api.md) · [All operations](https://skmtc.dev/leadfeeder/apis/leadfeeder-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/leadfeeder/leadfeeder-public-api/revisions/885dcce2a6c2/schema)