---
title: "Get Permission"
method: GET
path: "/x402/permissions/{permissionHash}"
tags: ["X402 - Permissions"]
---

# Get Permission

`GET /x402/permissions/{permissionHash}`

## Request

- Base URL: `https://api.sandbox.nevermined.app/api/v1`
- URL: `https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash}`
- Auth: HTTP bearer

Retrieves complete information about a specific permission.

## Path parameters

- `permissionHash` string, required

## Response `200`

Permission details

- Permission: Full details of one permission, as returned by `GET /x402/permissions/{permissionHash}`. The four delegation budget fields are present whenever the permission is linked to a delegation — on BOTH schemes, not `nvm:card-delegation` only: `PermissionEntity.createErc4337Delegation` sets `delegationId`, `spendingLimitCents` and `currency` alongside the `nvm:erc4337` scheme, and the builder gates them on `delegationId`, never on `scheme`.
  - `permissionHash` string, required: Unique identifier of the permission (hash)
  - `scheme` 'nvm:erc4337' | 'nvm:card-delegation', required: Payment scheme identifier
  - `planId` string: No permission the API creates today carries one: the single write path (delegation.service.ts — permissionRepository.save) hardcodes `planId = null` as plan-agnostic, and the response builder maps `planId ?? undefined`, which `JSON.stringify` drops — so the key is ALWAYS absent, on both schemes. Retained because the column exists and older rows may carry a value.
  - `planName` string, required: Name of the payment plan. Always the empty string on permissions the API creates today — the write path hardcodes `planName` to it. The key is always emitted, which is why it stays in `required`.
  - `status` 'Active' | 'Revoked' | 'Expired' | 'Exhausted', required: Current status of the permission
  - `createdAt` string, date-time, required: Date when the permission was created
  - `lastUsedAt` string, date-time, nullable, required: Date when the permission was last used, or `null` if never used
  - `expiresAt` string, date-time, nullable, required: Date when the permission expires, or `null` if it does not expire
  - `redemptionLimit` integer, nullable, required: Maximum number of redemptions allowed, or `null` for unlimited
  - `delegationId` string, nullable: Linked delegation id. Present on any delegation-linked permission, on both schemes
  - `spendingLimitCents` string, nullable: Spending limit in cents. Present on any delegation-linked permission, on both schemes
  - `currency` string, nullable: Currency code. Present on any delegation-linked permission, on both schemes
  - `remainingBudgetCents` string, nullable: Remaining budget in cents. Present on any delegation-linked permission, on both schemes

## Other responses

- `401`: Unauthorized
- `404`: Permission not found

---

[API](https://skmtc.dev/nevermined/apis/nevermined-api.md) · [All operations](https://skmtc.dev/nevermined/apis/nevermined-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nevermined/apis/nevermined-api/revisions/cabbe618c80b?raw)