---
title: "QueryResourcePermission looks up permissions that are allowed for the current principal. Multiple records can be queried with a single request. Query limit is 100, multiple requests are required to lookup more than the limit."
method: PUT
path: "/v2/permissions/query"
tags: ["Permissions"]
---

# QueryResourcePermission looks up permissions that are allowed for the current principal. Multiple records can be queried with a single request. Query limit is 100, multiple requests are required to lookup more than the limit.

`PUT /v2/permissions/query`

## Request

- Base URL: `https://docs.tetrate.io` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.tetrate.io/v2/permissions/query`
- Auth: none declared
- TypeScript: <https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/docs/v2/permissions/query/put.ts> (a function with typed inputs; its response is checked against the schema)

## Request body

- V2QueryResourcePermissionsRequest: Request to query permissions on multiple records. Example: QueryResourcePermissionsRequest { Queries: []Query{ Query{ QueryID: "1234", Kind: Query_Fqn{ Fqn: "tetrate/tenants/default/workspaces/example" } } } }
  - `queries` V2Query[]: One or more resources to query permissions on, limited to 100 per request.
    - `queryId` string: Optional ID that is an open string the caller can use for correlation purposes.
    - `fqn` string: Fully-qualified name of the resource.

## Response `200`

A successful response.

- V2QueryResourcePermissionsResponse: Response with permissions for the requested queries. Example: QueryResourcePermissionsResponse { Results: []Result{ Result{ Request: Query{ QueryID: "1234", Kind: Query_Fqn{ Fqn: "tetrate/tenants/default/workspaces/example" } }, Rules: []*Role_Rule{ { Types: []*Role_ResourceType{ { ApiGroup: "api.tsb.tetrate.io/v2", Kinds: []string{"Workspace"} } }, Permissions: []Permission{"READ"} } } } } }
  - `results` QueryResourcePermissionsResponseResult[]
    - `request` V2Query, required
      - `queryId` string: Optional ID that is an open string the caller can use for correlation purposes.
      - `fqn` string: Fully-qualified name of the resource.
    - `rules` RoleRule[]: set of allowed RBAC rules that the current principal has on the matching resource. If the query produced no results, the rules set will be empty.
      - `types` RoleResourceType[]: The set of API groups and the api Kinds within the group on which this rule is applicable. If omitted, the permissions will globally apply to all resource types.
        - `apiGroup` string, required: A specific API group such as traffic.tsb.tetrate.io/v2.
        - `kinds` string[]: Specific kinds of APIs under the API group. If omitted, the role will apply to all kinds under the group.
      - `permissions` V2Permission[], required: The set of actions allowed for these APIs. The current version supports requires the kind, but this constraint will be relaxed in upcoming releases so that rules can apply globally to an entire API group.

## Other responses

- `default`: An unexpected error response.

---

[API](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api.md) - [All operations](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tetrate/apis/tetrate-service-bridge-api/revisions/2f19c3a1ae57?raw)