Herald
OpenapiExt

Check a user's capabilities in an organization

Boolean judgment for the per-request pattern: every rule must hit for `allowed = true`. Non-members get an explicit `member = false`; a disabled member keeps `member = true` with `allowed = false`. Rejections are structured 200 results, matching the ext permission-check contract.

POST
/api/ext/realms/{realmId}/orgs/{orgId}/permission-check

Boolean judgment for the per-request pattern: every rule must hit for allowed = true. Non-members get an explicit member = false; a disabled member keeps member = true with allowed = false. Rejections are structured 200 results, matching the ext permission-check contract.

Authorization

api_key
X-API-Key<token>

Client-app API key (third-party external API).

In: header

Path Parameters

realmId*string

Realm ID

orgId*string

Organization ID

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

rules?array<>|

All rules must hit for allowed = true. Deserialized as Option so a missing or empty array yields a structured 400 rules_required instead of a vacuous allowed=true.

userId*string

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/api/ext/realms/string/orgs/string/permission-check" \  -H "Content-Type: application/json" \  -d '{    "userId": "string"  }'
{  "allowed": true,  "member": true,  "role": null}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}