View permission schema¶

View the permission resources, actions, and grant scopes supported by the current workspace. Use them when configuring permission policies or object grants.

HTTP
GET $CLOUDSIGMA_API_BASE/workspaces/{workspace_id}/iam/permissions/schema

Before you call this API¶

Configure the regional API endpoint and authentication, and select the target workspace.

Request parameters¶

Input examples

Shell
curl -X GET "$CLOUDSIGMA_API_BASE/workspaces/$WORKSPACE_ID/iam/permissions/schema" \
  -H "X-API-Key: $CLOUDSIGMA_API_KEY" \
  -H "X-Workspace-ID: $WORKSPACE_ID"

Parameter description

Parameter	Type	Required	Description
`workspace_id`	string	Yes	Target workspace ID.

Successful response¶

On success, returns the permission schema available to the current workspace. When creating or updating a policy, use the returned schema version, action IDs, resource types, and scope options.

Response example

JSON
{
  "code": "OK",
  "msg": "OK",
  "data": {
    "schema_version": "schema-v1",
    "capabilities": {
      "application_policy_actions_included": true,
      "matrixone_actions_included": true
    },
    "resources": [],
    "actions": [],
    "operations": [],
    "request_id": "req-001",
    "trace_id": "trace-001"
  }
}

Field details

Field	Type	Description
`code`	string	`OK` on success.
`msg`	string	`OK` on success.
`data.schema_version`	string	Current permission schema version.
`data.capabilities`	object	Flags for the permission capabilities included in the current schema.
`data.resources`	object array	Resource types and their supported scopes.
`data.actions`	object array	Action definitions available to policies.
`data.operations`	object array	Product operations and their permission requirements.
`data.request_id`	string	Request correlation ID.
`data.trace_id`	string	Trace ID.

Error response¶

Response example

JSON
{
  "code": "ErrIAMSchemaInvalid",
  "msg": "Service temporarily unavailable",
  "data": null
}

Field details

Field	Type	Description
`code`	string	Error code.
`msg`	string	Error message.
`data`	null	—

Next steps¶

Select policy inputs¶

Before validating or applying an application permission policy or an object grant, select matching actions, resource types, and grant scopes from the current schema.

Last updated on Sep 15, 2026