---
title: "Get the permission catalog"
method: GET
path: "/v1/authz/catalog"
tags: ["Access"]
---

# Get the permission catalog

`GET /v1/authz/catalog`

## Request

- Base URL: `https://api.openrelay.inc`
- URL: `https://api.openrelay.inc/v1/authz/catalog`
- Auth: HTTP bearer

Returns the permission areas and levels with the actions each allows, the built-in roles, the key templates, and the actions API key ceilings cannot grant.

Requires the `catalog.read` permission. See [Permissions](https://docs.openrelay.inc/docs/permissions) for the roles and API key permissions that include it.

## Response `200`

The permission catalog

- AuthzCatalog
  - `areas` PermissionArea[], required
    - `id` string, required
    - `label` string, required
    - `levels` PermissionLevel[], required: Lowest first; each level includes the ones before it.
      - `actions` string[], required: Every action the level allows, including the levels below it.
      - `description` string, required
      - `id` string, required: Permission id, area and level, e.g. compute.write.
      - `label` string, required: Display name, e.g. "Compute: Write".
      - `sessionOnly` boolean, required: True when every action this level adds over the one below it needs a signed-in session. In an API key's permissions it grants nothing more than the level below.
  - `roles` BuiltinRole[], required
    - `all` boolean: True for a role that holds every permission (Owner, Admin).
    - `description` string, required
    - `grants` string[], required: Permission ids the role holds.
    - `id` string, required
    - `name` string, required
  - `sessionOnlyActions` string[], required: Actions that cannot be granted to API keys through permission ceilings. Platform policies may allow scoped uses, such as revoking the key itself.
  - `templates` KeyTemplate[], required
    - `description` string, required
    - `id` string, required
    - `name` string, required
    - `permissions` string[], required
    - `providerOnly` boolean, required: True for a preset that only an organization running provider nodes needs.

## Other responses

- `401`: Missing or invalid API key
- `404`: Resource not found

## Changes

- **2026-10-26** `7fe59d94a9f5`: 2 info
  - added the optional property `requestId` to the response with the `401` status
  - added the optional property `requestId` to the response with the `404` status
- **2026-10-11** `42ca064781bf`: 1 info
  - added the required property `sessionOnlyActions` to the response with the `200` status
- **2026-10-10** `12b2fcbcc298`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/openrelay/apis/openrelay-api/changes/v1/authz/catalog/get.md)

---

[API](https://skmtc.dev/openrelay/apis/openrelay-api.md) - [All operations](https://skmtc.dev/openrelay/apis/openrelay-api/llms.txt) - [OpenAPI document](https://skmtc.dev/openrelay/apis/openrelay-api/revisions/7fe59d94a9f5?raw)