Get permissions

/v1/workflows/{id}/permissions

The policy the engine applies to every run of the bot, from every door. Owner only.

Authorizations

Authorizationstringheaderrequired

Bearer token: Authorization: Bearer ozk_…. ozk_ platform API key (Authorization: Bearer ozk_…)

Path parameters

idstringrequired

Saved workflow id (a bot you own)

Response

Stored policy and its effective classes Response format negotiates via the format field, an Accept header (application/json, text/yaml, text/markdown, text/plain), or the request Content-Type mirror; default JSON.

application/json
text/yaml
text/markdown
text/plain

classesobject

Stored preset per permission class; a class absent here falls back to the bot YAML / default

locksenum<string>[]

Admin locks: a locked class forces the bot’s own allow up to ask

budget_usd_runnumber | null

Per-run spend cap in USD; null = none

Required range: x >= 0

budget_usd_monthnumber | null

Monthly spend cap in USD; null = none

Required range: x >= 0

effectiveobject

The preset each class runs under: the stored one (the engine applies it on every run, from every door), else allow — a class no preset names is let through. A locked class still lifts allow to ask, and the money floor always asks. hand_off is a One Agent verdict; other agent runtimes treat it as deny.

Show child attributes

sendenum<string>

Available options: allow, ask, deny, hand_off

writeenum<string>

Available options: allow, ask, deny, hand_off

payenum<string>

Available options: allow, ask, deny, hand_off

deleteenum<string>

Available options: allow, ask, deny, hand_off

invalid_format — format must be one of json, yaml, markdown, text

application/json

errorobjectrequired

Show child attributes

codestringrequired

messagestringrequired

connectobject

On a 424 connection_required / credential_required: where the missing connection is made.

Show child attributes

providerstring

methodenum<string>

Available options: oauth, api_key, wallet

linkstring

Example: "POST /v1/connections/stripe/link"

unauthorized — missing, invalid or revoked ozk_ key

application/json

errorobjectrequired

Show child attributes

codestringrequired

messagestringrequired

connectobject

On a 424 connection_required / credential_required: where the missing connection is made.

Show child attributes

providerstring

methodenum<string>

Available options: oauth, api_key, wallet

linkstring

Example: "POST /v1/connections/stripe/link"

workflow_not_found — no saved workflow with that id for this account (foreign and missing ids answer alike); not_found — no route for this method on this path: every other method answers it

application/json

errorobjectrequired

Show child attributes

codestringrequired

messagestringrequired

connectobject

On a 424 connection_required / credential_required: where the missing connection is made.

Show child attributes

providerstring

methodenum<string>

Available options: oauth, api_key, wallet

linkstring

Example: "POST /v1/connections/stripe/link"

import os import requests response = requests.get( "https://api.plungeai.com/v1/workflows/{id}/permissions", headers={"Authorization": f"Bearer {os.environ['PLUNGE_API_KEY']}"}, ) if not response.ok: raise SystemExit(f"{response.status_code} {response.headers.get('X-Error-Code')}") print(response.json())

const response = await fetch('https://api.plungeai.com/v1/workflows/{id}/permissions', { method: 'GET', headers: { Authorization: `Bearer ${process.env.PLUNGE_API_KEY}`, }, }) if (!response.ok) throw new Error(`${response.status} ${response.headers.get('X-Error-Code')}`) console.log(await response.json())

import java.net.URI; import java.net.http.HttpClient; import java.net.http.HttpRequest; import java.net.http.HttpResponse; public class Main { public static void main(String[] args) throws Exception { HttpClient client = HttpClient.newHttpClient(); HttpRequest request = HttpRequest.newBuilder() .uri(URI.create("https://api.plungeai.com/v1/workflows/{id}/permissions")) .header("Authorization", "Bearer " + System.getenv("PLUNGE_API_KEY")) .GET() .build(); HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString()); if (response.statusCode() >= 400) { System.out.println(response.statusCode() + " " + response.headers().firstValue("X-Error-Code").orElse("")); return; } System.out.println(response.body()); } }

{ "classes": {}, "locks": [ "send" ], "budget_usd_run": 0, "budget_usd_month": 0, "effective": { "send": "allow", "write": "allow", "pay": "allow", "delete": "allow" } }

Authorizations

Path parameters

Response

Planned: TI-33

Planned: TI-34