Identity

Changed on

Requires an application machine-client bearer token with actor_type=client and the resource_access:check permission in the target application. The body token is the resource-access credential being checked, not the caller's authentication credential. User credentials and resource-access tokens cannot authenticate this endpoint.

post/v1/applications/{application_id}/service/resource-access/check

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /v1/applications/{application_id}/service/resource-access/check
  • Auth: HTTP bearer

Request body

tokenstring required
resourcestring uri required
capabilitystring required

Relative capability key.

workspace_idstring uuid

Response

Resource authorization decision; a denied check returns allowed=false and a reason.

allowedboolean required
reasonstring required
user_idstring uuid
connection_idstring uuid
workspace_idstring uuid

Changes