---
title: "Get Action Access"
method: GET
path: "/api/workflows/{team_key}/actions/{action_key}/access"
tags: ["workflows"]
---

# Get Action Access

`GET /api/workflows/{team_key}/actions/{action_key}/access`

## Request

- Base URL: `https://api.superit.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.superit.ai/api/workflows/{team_key}/actions/{action_key}/access`
- Auth: HTTP bearer

## Path parameters

- `action_key` string, required
- `team_key` string, required

## Response `200`

Successful Response

- ActionAccessView
  - `requesters` ActionAccessContactList, required
    - `contacts` ActionAccessContact[], required
      - `userKey` string, required
      - `name` string, required: Preferred conversational name, then full name, then login email.
      - `email` string, required
      - `fullName` string, nullable: Person's full name; empty if unknown, null for legacy contacts without name fields.
      - `nickname` string, nullable: Preferred conversational name, independent of full name.
    - `truncated` boolean, required
    - `fallbackReason` 'matched' | 'no_matching_users' | 'no_matching_rules', required
  - `approversByRule` RuleApproverGroup[], required
    - `ruleIndex` integer, required
    - `rule` AuthorizationRule, required: Single authorization rule: requester + approver + optional target.
      - `requester` union, required
        - GroupTagMatcher: Match users by membership in one or more superit tags.
          - `tag` 'group', required
          - `tags` string[], required
        - SelfTagMatcher: Match the requesting user.
          - `tag` 'self', required
        - NoneTagMatcher: Match unconditionally — no tag required. Evaluated by ``_matches`` (services/authorization.py) as an unconditional ``True``, so it means opposite things depending on which field it's used in: as a requester/target matcher it means "anyone" (no restriction); as an approver it means "no approval needed" (self-service). The UI labels it accordingly per field (``TagMatcherEditor.tsx``'s ``REQUESTER_MODES`` vs ``APPROVER_MODES``) rather than showing one generic label.
          - `tag` 'none', required
      - `approver` union, required
        - GroupTagMatcher: Match users by membership in one or more superit tags.
          - `tag` 'group', required
          - `tags` string[], required
        - SelfTagMatcher: Match the requesting user.
          - `tag` 'self', required
        - NoneTagMatcher: Match unconditionally — no tag required. Evaluated by ``_matches`` (services/authorization.py) as an unconditional ``True``, so it means opposite things depending on which field it's used in: as a requester/target matcher it means "anyone" (no restriction); as an approver it means "no approval needed" (self-service). The UI labels it accordingly per field (``TagMatcherEditor.tsx``'s ``REQUESTER_MODES`` vs ``APPROVER_MODES``) rather than showing one generic label.
          - `tag` 'none', required
      - `target` union
        - GroupTagMatcher: Match users by membership in one or more superit tags.
          - `tag` 'group', required
          - `tags` string[], required
        - SelfTagMatcher: Match the requesting user.
          - `tag` 'self', required
        - NoneTagMatcher: Match unconditionally — no tag required. Evaluated by ``_matches`` (services/authorization.py) as an unconditional ``True``, so it means opposite things depending on which field it's used in: as a requester/target matcher it means "anyone" (no restriction); as an approver it means "no approval needed" (self-service). The UI labels it accordingly per field (``TagMatcherEditor.tsx``'s ``REQUESTER_MODES`` vs ``APPROVER_MODES``) rather than showing one generic label.
          - `tag` 'none', required
    - `contacts` ActionAccessContactList, required
      - `contacts` ActionAccessContact[], required
        - `userKey` string, required
        - `name` string, required: Preferred conversational name, then full name, then login email.
        - `email` string, required
        - `fullName` string, nullable: Person's full name; empty if unknown, null for legacy contacts without name fields.
        - `nickname` string, nullable: Preferred conversational name, independent of full name.
      - `truncated` boolean, required
      - `fallbackReason` 'matched' | 'no_matching_users' | 'no_matching_rules', required
  - `rules` AuthorizationMatrix, required: Ordered list of rules, evaluated top-down, first match wins.
    - `rules` AuthorizationRule[], required
      - `requester` union, required
        - GroupTagMatcher: Match users by membership in one or more superit tags.
          - `tag` 'group', required
          - `tags` string[], required
        - SelfTagMatcher: Match the requesting user.
          - `tag` 'self', required
        - NoneTagMatcher: Match unconditionally — no tag required. Evaluated by ``_matches`` (services/authorization.py) as an unconditional ``True``, so it means opposite things depending on which field it's used in: as a requester/target matcher it means "anyone" (no restriction); as an approver it means "no approval needed" (self-service). The UI labels it accordingly per field (``TagMatcherEditor.tsx``'s ``REQUESTER_MODES`` vs ``APPROVER_MODES``) rather than showing one generic label.
          - `tag` 'none', required
      - `approver` union, required
        - GroupTagMatcher: Match users by membership in one or more superit tags.
          - `tag` 'group', required
          - `tags` string[], required
        - SelfTagMatcher: Match the requesting user.
          - `tag` 'self', required
        - NoneTagMatcher: Match unconditionally — no tag required. Evaluated by ``_matches`` (services/authorization.py) as an unconditional ``True``, so it means opposite things depending on which field it's used in: as a requester/target matcher it means "anyone" (no restriction); as an approver it means "no approval needed" (self-service). The UI labels it accordingly per field (``TagMatcherEditor.tsx``'s ``REQUESTER_MODES`` vs ``APPROVER_MODES``) rather than showing one generic label.
          - `tag` 'none', required
      - `target` union
        - GroupTagMatcher: Match users by membership in one or more superit tags.
          - `tag` 'group', required
          - `tags` string[], required
        - SelfTagMatcher: Match the requesting user.
          - `tag` 'self', required
        - NoneTagMatcher: Match unconditionally — no tag required. Evaluated by ``_matches`` (services/authorization.py) as an unconditional ``True``, so it means opposite things depending on which field it's used in: as a requester/target matcher it means "anyone" (no restriction); as an approver it means "no approval needed" (self-service). The UI labels it accordingly per field (``TagMatcherEditor.tsx``'s ``REQUESTER_MODES`` vs ``APPROVER_MODES``) rather than showing one generic label.
          - `tag` 'none', required
    - `target_input` string, nullable

## Other responses

- `400`: Invalid input
- `401`: Not authenticated
- `403`: Forbidden
- `404`: Not found
- `405`: Method not allowed
- `409`: Conflict
- `422`: Validation Error

---

[API](https://skmtc.dev/superit/apis/super-it-api.md) - [All operations](https://skmtc.dev/superit/apis/super-it-api/llms.txt) - [OpenAPI document](https://skmtc.dev/superit/apis/super-it-api/revisions/4944d556c2bb?raw)