---
title: "GET /api/ee/permission_debug"
method: GET
path: "/api/ee/permission_debug"
tags: ["/api/ee/permission_debug"]
---

# GET /api/ee/permission_debug

`GET /api/ee/permission_debug`

This endpoint expects a `user_id`, a `model_id` to debug permissions against, and `action_type`.
  The type of model we are debugging against is inferred by the `action_type`.

  It will return:
  - `decision`: The overall permission decision ("allow", "denied", or "limited")
  - `model-type`: The type of model being checked (e.g., "question")
  - `model-id`: The ID of the model being checked
  - `segment`: A set of segmentation types applied (e.g., "sandboxed", "impersonated", "routed")
  - `message`: A sequence of strings explaining the decision
  - `data`: A map containing details about permissions (table or collection names to group names)
  - `suggestions`: A map of group IDs to group names that could provide access

  Example requests:
  - Check if user can read a card: `GET /api/ee/permission_debug?user_id=123&model_id=456&action_type=card/read`
  - Check if user can query a card: `GET /api/ee/permission_debug?user_id=123&model_id=456&action_type=card/query`
  - Check if user can download data: `GET /api/ee/permission_debug?user_id=123&model_id=456&action_type=card/download-data`

  Example responses:
  - Allowed access:
    ```json
    {
      "decision": "allow",
      "model-type": "question",
      "model-id": "456",
      "segment": [],
      "message": ["User has permission to read this card"],
      "data": {},
      "suggestions": {}
    }
    ```
  - Denied access with blocked table:
    ```json
    {
      "decision": "denied",
      "model-type": "question",
      "model-id": "456",
      "segment": [],
      "message": ["User does not have permission to query this card"],
      "data": {"sample-db.PUBLIC.ORDERS": ["All Users"]},
      "suggestions": {}
    }
    ```
  - Limited access:
    ```json
    {
      "decision": "limited",
      "model-type": "question",
      "model-id": "456",
      "segment": [],
      "message": ["User has permission to download some data from this card"],
      "data": {},
      "suggestions": {}
    }
    ```

## Query parameters

- `user_id` integer, required
- `model_id` string, required
- `action_type` 'card/read' | 'card/query' | 'card/download-data', required

## Response `2XX`

Successful response

- MetabaseEnterprisePermissionDebugImplPermDebugInfo
  - `data` object, required
  - `decision` 'allow' | 'denied' | 'limited', required
  - `message` string[], required
  - `model-id` string, required
  - `model-type` 'card' | 'invalid', required
  - `segment` string[], required
  - `suggestions` object, required

## Other responses

- `4XX` — Client error response
- `5XX` — Server error response

---

[API](https://skmtc.net/metabase/apis/metabase-api.md) · [All operations](https://skmtc.net/metabase/apis/metabase-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/metabase/metabase-api/revisions/08b5a2bafb4f/schema)