---
title: "Dry-run permission evaluation"
method: POST
path: "/toolkits/{toolkit_id}/credentials/{credential_id}/permissions:test"
tags: ["Toolkit Permissions"]
---

# Dry-run permission evaluation

`POST /toolkits/{toolkit_id}/credentials/{credential_id}/permissions:test`

Answer "what would the broker do for this request?" without calling upstream.

Evaluates the same **vendor-pooled** rule set the broker sees at request
time — rules from all same-vendor bindings on this toolkit compete in one
ordered list. The response names which binding contributed the matching
rule, which is not obvious from the toolkit id alone under pooling.

## Path parameters

- `toolkit_id` string, required
- `credential_id` string, required

## Request body

- PermissionTestRequest — Request body for :test — dry-run a request shape against pooled rules.
  - `method` string, required — HTTP method of the hypothetical request (case-insensitive).
  - `operation_id` string, nullable — Optional OpenAPI operation id resolved from the request URL.
  - `path` string, required — Path of the hypothetical request as the broker would see it.

## Response `200`

Successful Response

- PermissionTestResponse — Dry-run result matching :class:`PermissionTestResult`.
  - `allowed` boolean, required — Whether the broker would allow this request under the pooled rules.
  - `credential_id` string, nullable — Which binding contributed the matching rule — vendor pooling means this may not equal the credential in the request URL.
  - `effect` string, nullable — Effect of the matching rule (`allow`/`deny`); null when no match.
  - `is_system` boolean, nullable — True when the matching rule was written by the system; null when no match.
  - `matched` boolean, required — Whether any rule matched; when false, the outcome is default-deny.
  - `rule_index` integer, nullable — Zero-based index in the vendor-pooled rule list; null when no match.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `422` — Unprocessable Entity
- `500` — Internal Server Error
- `503` — Service Unavailable

---

[API](https://skmtc.net/jentic/apis/jentic-control-plane-api.md) · [All operations](https://skmtc.net/jentic/apis/jentic-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/jentic/jentic-control-plane-api/revisions/ff371f19960a/schema)