> ## Documentation Index > Fetch the complete documentation index at: https://team.k0labs.com/llms.txt > Use this file to discover all available pages before exploring further. # Check permissions > **Visibility:** `public` · `internal` ( OpenAPI Custom Extension: x-visibility ) Evaluate whether the authenticated principal (or a specified subject) is allowed to perform one or more actions on target resources. Supports both single and bulk checks in a single request. **Self-check** — When no subject is specified, the caller's own permissions are evaluated. Useful for frontends that need to show/hide UI elements based on the current user's access. **Subject check** — Tenant administrators can evaluate permissions for another principal by specifying a subject. Non-admin callers specifying a subject other than themselves receive 403. Results are returned positionally — results[i] corresponds to checks[i]. ## OpenAPI ````yaml api-docs/k0rdent-api.json post /v1/regions/global/auth/check openapi: 3.1.0 info: title: K0rdent AI API version: 0.2.0-draft description: > OpenAPI specification for the K0rdent AI GPU-as-a-Service platform. **Custom Extensions:** - `x-visibility`: Endpoint visibility — `internal` (Atlas only), `public` (Arc only), `[internal, public]` (common) - `x-status`: Implementation status — `mvp`, `tbd`, `blocked`, `stretch` - `x-source`: Source document reference or `TBD` for fields pending confirmation **Error Model:** Standard `{ error: { code, message, details[] } }` envelope. **Pagination:** All list endpoints support two modes: - **Cursor** (`pageToken` + `pageSize`): Use for frequently updated resources. Prevents skipped or duplicated items across pages. `nextPageToken` is returned; `total` is not. - **Offset** (`offset` + `pageSize`): Use for stable resources. Returns `total` for page-count UIs. `nextPageToken` is not returned. `pageToken` and `offset` are mutually exclusive. Default `pageSize` is 50, maximum is 500. servers: - url: https://api.k0rdent.ai description: K0rdent AI API Gateway security: - bearerAuth: [] tags: - name: clusters description: Kubernetes cluster management - name: kubeconfigs description: Kubeconfig issuance and management - name: instances description: VM and baremetal instance lifecycle - name: networks description: Network configuration and topology - name: addresses description: IP address management - name: servers description: Bare metal server lifecycle management - name: organizations description: Organization (tenant) management - name: projects description: Project resource grouping - name: authentication description: Authentication and session management - name: users description: User management - name: groups description: User group management - name: roles description: RBAC role definitions - name: policies description: IAM policy bindings - name: providers description: Identity provider configuration - name: token description: > Generate access token via multiple grant types (authorization_code, api_key, client_credentials). - name: check description: > Evaluate permissions for a principal against actions and resources. Supports single and bulk checks (up to 100). - name: introspect description: > Token introspection per RFC 7662. Validate token activity and retrieve full decoded claims. - name: revoke description: > Token revocation per RFC 7009. Explicitly invalidate access tokens before natural expiration. - name: sessions description: > Manage user browser sessions. Supports listing active sessions, creating a new session (login), and ending the current session (logout). - name: apikeys description: > Manage API keys for programmatic access. API keys are bound to a user and inherit a dynamic subset of the user's privileges, evaluated at token-mint time. Keys are scoped to a level in the resource hierarchy (organization, or project). - name: serviceaccounts description: | Manage service accounts for machine-to-machine and infrastructure access. Service accounts are independent principals with their own identity, role bindings, and credentials. They survive user off-boarding and are managed exclusively by tenant administrators. paths: /v1/regions/global/auth/check: post: tags: - check summary: Check permissions description: > **Visibility:** `public` · `internal` ( OpenAPI Custom Extension: x-visibility ) Evaluate whether the authenticated principal (or a specified subject) is allowed to perform one or more actions on target resources. Supports both single and bulk checks in a single request. **Self-check** — When no subject is specified, the caller's own permissions are evaluated. Useful for frontends that need to show/hide UI elements based on the current user's access. **Subject check** — Tenant administrators can evaluate permissions for another principal by specifying a subject. Non-admin callers specifying a subject other than themselves receive 403. Results are returned positionally — results[i] corresponds to checks[i]. operationId: checkPermissions requestBody: required: true content: application/json: schema: type: object required: - checks properties: subject: type: string description: | Principal to evaluate. Can be a user ID, API key ID, or service account clientId. If omitted, defaults to the authenticated caller. Only tenant administrators can specify a subject other than themselves. example: user-xyz789 checks: type: array description: | List of permission checks to evaluate. Each check specifies an action and a target resource. Maximum 100 checks per request. minItems: 1 maxItems: 100 items: type: object required: - action - resource properties: action: type: string description: > The action to evaluate. Must be a recognized action string in the format {service}.{resource}.{verb} (e.g., compute.instances.create). example: compute.instances.create resource: type: string description: | The target resource identifier to evaluate the action against. Can be a project ID ID, or organization ID depending on the action's scope. example: proj-abc123 responses: '200': description: Permission check results. content: application/json: schema: type: object required: - results properties: results: type: array description: | Positional results — results[i] corresponds to checks[i] in the request. items: type: object required: - allowed properties: allowed: type: boolean description: | Whether the action is permitted on the specified resource for the evaluated principal. '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '500': $ref: '#/components/responses/InternalServerError' components: responses: BadRequest: description: Bad request content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/Error' InternalServerError: description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' schemas: Error: type: object description: Standard error response properties: error: type: object properties: code: type: integer description: HTTP status code message: type: string description: Error message details: type: array items: type: object description: Additional error details securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: Bearer token authentication using OAuth2/OIDC tokens ````