Permissions
Botyard REST API endpoints for permissions.
8 endpoints in this group. Every request authenticates with an API key; see the API reference for the other groups.
- List Effective Permissions:
GET /v1/orgs/{org_id}/permissions - Get My Permissions:
GET /v1/orgs/{org_id}/permissions/mine - Get Permission Catalogue:
GET /v1/orgs/{org_id}/permission-catalogue - List Permission Holders:
GET /v1/orgs/{org_id}/permission-holders - Get Grant Impact:
GET /v1/orgs/{org_id}/permission-grants/{grant_id}/impact - Get Role Permission Impact:
GET /v1/orgs/{org_id}/role-permissions/{role_permission_id}/impact - Create Permission Grant:
POST /v1/orgs/{org_id}/permission-grants - Revoke Permission Grant:
DELETE /v1/orgs/{org_id}/permission-grants/{grant_id}
List Per User Claude Models
The models offered when putting a bot on each person's own Claude. The Claude subscription catalogue filtered through the Claude Code model mapping, in catalogue order; the same for every org. Gated like reading a bot, because it is what the bot model picker shows.
List Effective Permissions
Everything an actor effectively holds, attributed to its source. One entry per *(authority, pattern)* pair rather than a deduplicated set: an actor commonly holds the same pattern through a role bundle **and** a direct grant, and collapsing them would destroy the answer to "what actually changes if I revoke this?". ``revocable_by_caller`` is resolved here because it depends on the caller, not on the entry. It is computed with the same ``covers_any`` the service's no-escalation check uses, so the control a UI offers and the refusal the service would issue cannot disagree — but it is **advisory**: revocation still goes through ``AuthzGrantService``, which re-runs the check.