---
title: "Resolve Access"
method: POST
path: "/v1/access-control/resolve"
tags: ["v1", "protected", "access-control"]
---

# Resolve Access

`POST /v1/access-control/resolve`

Resolve why (and how) a subject can access a resource.

``allowed`` is computed via the graph backend; ``paths`` are derived from the
direct ``resource`` grants matching the subject so the UI can render the
derivation. Grants inherited through ``project``/``role`` still affect
``allowed`` but are not expanded into hops here.

## Request body

- ResolveRequest
  - `resource_id` string, required
  - `resource_kind` 'skill' | 'collection' | 'mcp' | 'agent', required
  - `subject_id` string, required

## Response `200`

Successful Response

- ResolveResponse
  - `allowed` boolean, required
  - `effective_relation` string, nullable, required
  - `paths` ResolvePath[], required
    - `hops` ResolveHop[], required
      - `color` string, required
      - `id` string, required
      - `kind` string, required
      - `name` string, required
    - `relation` string, required
    - `rels` string[], required
  - `verb` string, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/agentarea/apis/agentarea-api.md) · [All operations](https://skmtc.net/agentarea/apis/agentarea-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/agentarea/agentarea-api/versions/e3650e48373b/schema)