---
title: "Get permissions for a file"
method: GET
path: "/files/{fileId}/permissions"
tags: ["Files"]
---

# Get permissions for a file

`GET /files/{fileId}/permissions`

## Request

- Base URL: `https://public-api.process.st/api/v1.1`
- URL: `https://public-api.process.st/api/v1.1/files/{fileId}/permissions`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Shows which users and groups have access to a file and their permission levels. `Custom` means their permissions do not match a single named access level. Groups are identified by `group-<id>@process.st` addresses. Returns up to 1000 entries; larger lists return an error.

## Path parameters

- `fileId` string, required

## Response `200`

- PublicApiFilePermissionListResponse
  - `data` object[]: The list of resources returned by this request.
    - `email` string, required: Email address.
    - `accessLevel` 'Edit' | 'View' | 'Custom', required: Access level a user or group has on this file. `Edit` — view, edit, and delete the file. `View` — view the file (read-only). `Custom` — the user's underlying permission atoms don't match any predefined level; inspect the `permissions` object on the same entry for the actual atoms.
    - `permissions` object, required: Granular permission flags this user or group has on the file.
      - `fileRead` boolean, required: Can view the file.
      - `fileUpdate` boolean, required: Can edit the file.
      - `fileDelete` boolean, required: Can delete the file.
  - `links` object[]: Pagination links. When the result has more pages, look for an entry with `name: "next"` — its `href` is the URL to fetch the next page. Absence of `next` means there are no more pages. For single-resource responses this array is typically empty.
    - `name` string, required: Standard link relation name (RFC 5988) indicating this link's role. Common values include `self`, `edit`, `related`, `previous`, `next`.
    - `href` string, required: URL of the linked resource.
    - `rel` 'Approval Task' | 'Approvals' | 'Assignees' | 'Comment' | 'Data Set Records' | 'Data Sets' | 'Form Field Values' | 'Subject Task' | 'Task' | 'Tasks' | 'Users' | 'Webhook' | 'Workflow' | 'Workflow Run': Optional. The kind of resource this link points to (e.g. `Workflow`, `Task`, `Comment`).
    - `type` 'Api' | 'App', required: Whether this link targets an API endpoint or a Process Street app URL. `Api` — a callable API endpoint you can fetch directly. `App` — a browser-facing URL in the Process Street UI.

## Other responses

- `default`

## Changes

- **2026-10-30** `292a565ad8bc`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/process/apis/process-street-public-api/changes/files/:fileId/permissions/get.md)

---

[API](https://skmtc.dev/process/apis/process-street-public-api.md) - [All operations](https://skmtc.dev/process/apis/process-street-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/process/apis/process-street-public-api/revisions/78ea0b3f3b40?raw)