Herald
OpenapiExt

Check user permissions

This endpoint allows third-party applications to check if a user has specific permissions using their browser access token. # Authentication Requires valid API Key via X-API-Key header # Example ```json { "accessToken": "user-access-token", "rules": [ {"resource": "article", "action": "read"}, {"resource": "article", "action": "write"} ] } ```

POST
/api/ext/permission/check

This endpoint allows third-party applications to check if a user has specific permissions using their browser access token.

Authentication

Requires valid API Key via X-API-Key header

Example

{  "accessToken": "user-access-token",  "rules": [    {"resource": "article", "action": "read"},    {"resource": "article", "action": "write"}  ]}

Authorization

api_key
X-API-Key<token>

Client-app API key (third-party external API).

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

clientId*string
rules?array<>|null
token*string

Response Body

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/api/ext/permission/check" \  -H "Content-Type: application/json" \  -d '{    "clientId": "string",    "token": "string"  }'
{  "allowed": true,  "userId": "2c4a230c-5085-4924-a3e1-25fb4fc5965b"}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}