---
title: "List all permissions for a tenant"
method: GET
path: "/permissions"
tags: ["Permission"]
---

# List all permissions for a tenant

`GET /permissions`

Returns a paginated list of all permission records scoped to the tenant identified by the tenant-id header. Use this endpoint to inspect the full permission catalog before assigning permissions to roles; for a single known permission, use GET /permissions/{id} instead.

Preconditions: the caller must be authenticated and hold the READ_PERMISSION permission for the tenant.

Pagination is offset-based: supply page (0-based, defaults to 0) and size (defaults to 100). The response contains data (the permission objects for this page), totalCount, hasNext, and hasPrevious. Note: the createdAt and updatedAt fields on each permission are always null in the current implementation, and the envelope's page/size fields are not populated by this endpoint.

## Query parameters

- `page` integer
- `size` integer

## Headers

- `tenant-id` string, required

## Response `200`

The requested page of permission records for this tenant, wrapped in a pagination envelope (data, totalCount, hasNext, hasPrevious). The createdAt and updatedAt fields on each permission are always null in the current implementation.

- PermissionListResponseDto — Paginated list of permissions
  - `data` PermissionResponseDto[] — Permission records included on this page. May be null (rather than an empty array) when the underlying data service returns no records — e.g. a page beyond the last available record — so consumers should treat null and [] equivalently.
    - `id` string — Server-assigned unique identifier for the permission.
    - `resource` string — Name of the resource this permission governs (e.g. 'user', 'roster'). Mirrors the resource value supplied when the permission was created or last replaced.
    - `action` string — Name of the action this permission grants on the resource (e.g. 'read', 'create'). Mirrors the action value supplied when the permission was created or last replaced.
    - `description` string — Human-readable explanation of what the permission allows. Optional; may be null if it was not supplied at creation.
    - `createdAt` string, date-time
    - `updatedAt` string, date-time
  - `totalCount` integer — Total number of permission records across all pages for this tenant, not just the current page.
  - `page` integer — Currently always null — this endpoint does not populate a page number in the envelope.
  - `size` integer — Currently always null — this endpoint does not populate a page size in the envelope.
  - `hasNext` boolean — Whether a subsequent page of results is available, based on the presence of a next-page link from the underlying data service.
  - `hasPrevious` boolean — Whether a preceding page of results is available, based on the presence of a previous-page link from the underlying data service.

## Other responses

- `401` — The request lacks a valid, non-expired JSON Web Token. Obtain a new token via the authentication endpoint and retry with it in the Authorization header.
- `500` — An unexpected error occurred while retrieving permissions, typically a downstream data-service failure. The response body is empty; retry the request or contact support if the error persists.

---

[API](https://skmtc.net/certifyos/apis/certify-api-layer.md) · [All operations](https://skmtc.net/certifyos/apis/certify-api-layer/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/certifyos/certify-api-layer/revisions/563848e0ecc0/schema)