GET /openapi/memorylake/admin/v1/members/{principal_id}/effective-permissions
Permission required:
access_group:viewPath Parameters
string
required
Identifier of the member (
principal_id)curl -X GET 'https://app.memorylake.ai/openapi/memorylake/admin/v1/members/dbcf9a3aabee5042775269c9d137a2f8/effective-permissions' \
-H 'Authorization: Bearer sk_xxxxxx'
Response
object
Show Effective Permissions object
Show Effective Permissions object
string
The member’s display name
array
Effective actions with their sources
Show Effective Permission object
Show Effective Permission object
string
The member
string
The member’s primary role
array
Effective instance limits; types not listed are unrestricted
Show Effective Scope object
Show Effective Scope object
string
Resource type
boolean
false = every instance
array
Reachable instances, when restricted
Show Effective Scope Instance object
Show Effective Scope Instance object
array
Per-source breakdown
Show Effective Permission Source object
Show Effective Permission Source object
string
Role key or access group id
string
Display name
array
Actions this source grants
string
Where these permissions come from. One of:
role, access_group.array
Actions this source grants that a deny elsewhere removes from the effective set
array
Instance limits this source carries
Show Access Scope Entry object
Show Access Scope Entry object
string
all = every instance; instances = only the listed ones
string
Resource type, e.g. memorylake:project (see GET /permission-catalog)
array
Read-only. Instance-level actions the member’s role grants for this type — the most a scope entry can allow.
array
The instances, when mode is instances
Show Access Scope Instance object
Show Access Scope Instance object
string
Instance id, as returned by the data API
array
Actions allowed on this instance. Omit for every action the member’s role allows.
array
Read-only. The subset of actions the member’s CURRENT role still grants.
string
Read-only. The permission level, when via_permission_level is true. One of:
read, write, manage.array
Read-only. Actions stored here that the member’s current role no longer grants.
boolean
Read-only. The member reaches this instance through a permission level granted on it, not through this scope. May be echoed back on write; such instances are skipped.
string
Parent workspace of a project instance. Required when writing a project instance.
{
"success": true,
"message": "Operation completed successfully",
"data": {
"display_name": "Alice",
"permissions": [
{
"permission": "example",
"sources": [
{
"type": "role",
"id": "7ea9bf65e6937c3c168bc7a2a0f6fbf2",
"name": "Example name"
}
]
}
],
"principal_id": "a4f0086eca294846b3bb8b9086c30e2a",
"role": "tenant_member",
"scopes": [
{
"resource_type": "example",
"restricted": false,
"instances": [
{
"id": "66a8e03ad707a50641b92fac99929037",
"sources": []
}
]
}
],
"sources": [
{
"id": "eb619252391dd05caf4e338bf6fc7872",
"name": "Example name",
"permissions": [
"example"
],
"type": "role",
"overridden_permissions": [
"example"
],
"scopes": [
{
"mode": "all",
"resource_type": "example",
"available_actions": [],
"instances": []
}
]
}
]
}
}
Errors
Errors answer withsuccess: false, a message and an error_code. See Error Codes for every code.
| Status | Meaning |
|---|---|
401 | The API key is missing, invalid, disabled or expired |
403 | The key is not allowed to do this |
404 | The resource does not exist |
422 | The body or a parameter failed validation |
429 | Too many requests. Wait for the time in Retry-After |
500 | Server-side error |