---
title: "POST /v1/applications/{application_id}/service/resource-access/check"
method: POST
path: "/v1/applications/{application_id}/service/resource-access/check"
tags: ["Identity"]
---

# POST /v1/applications/{application_id}/service/resource-access/check

`POST /v1/applications/{application_id}/service/resource-access/check`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/v1/applications/{application_id}/service/resource-access/check`
- Auth: HTTP bearer

Requires an application machine-client bearer token with actor_type=client and the resource_access:check permission in the target application. The body token is the resource-access credential being checked, not the caller's authentication credential. User credentials and resource-access tokens cannot authenticate this endpoint.

## Request body

- ResourceAccessCheck
  - `token` string, required
  - `resource` string, uri, required
  - `capability` string, required: Relative capability key.
  - `workspace_id` string, uuid

## Response `200`

Resource authorization decision; a denied check returns allowed=false and a reason.

- ResourceAccessDecision
  - `allowed` boolean, required
  - `reason` string, required
  - `user_id` string, uuid
  - `connection_id` string, uuid
  - `workspace_id` string, uuid

## Other responses

- `401`: RFC 9457 problem
- `403`: RFC 9457 problem
- `422`: RFC 9457 problem

## Changes

- **2026-10-18** `7c63ef49acf0`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/supaapps/apis/platform93-api/changes/v1/applications/:application_id/service/resource-access/check/post.md)

---

[API](https://skmtc.dev/supaapps/apis/platform93-api.md) · [All operations](https://skmtc.dev/supaapps/apis/platform93-api/llms.txt) · [OpenAPI document](https://skmtc.dev/supaapps/apis/platform93-api/revisions/7c63ef49acf0?raw)