---
title: "macOS permission snapshot"
method: GET
path: "/v1/permissions"
tags: ["System"]
---

# macOS permission snapshot

`GET /v1/permissions`

## Request

- Base URL: `http://localhost:9998`
- URL: `http://localhost:9998/v1/permissions`
- Auth: HTTP bearer

Live macOS privacy-permission state for ToolPiper: per-permission TCC
state, per-target Automation consent (consent is per app/target pair),
the Gatekeeper app-translocation flag, and the bundle path. Read by
`piper diagnose permissions`. Loopback callers skip auth; LAN/remote
bearers need the tools:read scope.

## Response `200`

Permission snapshot

- object
  - `permissions` object[], required
    - `id` string, required
    - `display_name` string, required
    - `state` 'granted' | 'denied' | 'not_determined', required
    - `relevant` boolean, required
  - `automation_targets` object[], required
    - `bundle_id` string, required
    - `app_name` string, required
    - `state` 'granted' | 'denied' | 'not_determined', required
    - `denied_hint` string, required
  - `translocated` boolean, required
  - `bundle_path` string, required

## Other responses

- `503`: Permission service not wired yet (launch race)

---

[API](https://skmtc.dev/modelpiper/apis/toolpiper-api.md) · [All operations](https://skmtc.dev/modelpiper/apis/toolpiper-api/llms.txt) · [OpenAPI document](https://skmtc.dev/modelpiper/apis/toolpiper-api/revisions/6722bf56385c?raw)