> ## Documentation Index
> Fetch the complete documentation index at: https://doc.gapstack.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Current user permissions in tenant



## OpenAPI

````yaml /api-reference/openapi.yaml get /tenant/{tenantId}/permissions
openapi: 3.0.3
info:
  title: Gapstack API
  version: '1.0'
  description: >-
    REST API for Gapstack tenants, projects, environments, resources, and
    integrations.
servers:
  - url: https://9nr7sbhimh.execute-api.us-west-1.amazonaws.com/prod
    description: Production
security:
  - BearerAuth: []
tags:
  - name: healthcheck
    description: Service health
  - name: tenants
    description: Tenants, members, infrastructure, and API keys
  - name: invitations
    description: Tenant invitations
  - name: projects
    description: Projects, variables, webhooks, and integrations
  - name: environments
    description: Environments, deploys, artifacts, and variables
  - name: resources
    description: Cloud resources
  - name: workflows
    description: Deployment and infrastructure workflows
  - name: aws-accounts
    description: Linked AWS accounts
  - name: integrations
    description: Marketplace integrations
  - name: github
    description: GitHub App install and webhooks
  - name: costs
    description: Aggregated cloud costs
  - name: summary
    description: Tenant dashboard summary
  - name: subscription
    description: Plans, usage, and billing webhooks
  - name: settings
    description: System settings, permissions, and superadmins
paths:
  /tenant/{tenantId}/permissions:
    get:
      tags:
        - tenants
      summary: Current user permissions in tenant
      operationId: getTenantUserPermissions
      parameters:
        - $ref: '#/components/parameters/TenantPathId'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantUserPermissions'
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  parameters:
    TenantPathId:
      name: tenantId
      in: path
      required: true
      schema:
        type: string
      description: Tenant identifier.
  schemas:
    TenantUserPermissions:
      type: object
      properties:
        permissions:
          type: array
          items:
            $ref: '#/components/schemas/Permission'
        is_super_admin:
          type: boolean
    ErrorResponse:
      type: object
      description: >
        JSON body returned by WriteJsonError (internal/app/util.go
        errorResponse).

        Field `error` carries the human-readable message; `code` is set for
        Gapstack errors.
      properties:
        code:
          description: >
            Machine-readable code from paas-lib when the error is a
            GapstackError; omitted when not.
          nullable: true
          allOf:
            - $ref: '#/components/schemas/PaasLibErrorCode'
        error:
          type: string
          description: Human-readable error message (JSON key `error`, not `message`).
        meta:
          type: object
          additionalProperties:
            type: string
          description: Optional metadata (e.g. validation field names).
    Permission:
      type: string
      description: >-
        Fine-grained capability string (matches paas-lib permission
        identifiers).
      enum:
        - create_tenant
        - read_tenant
        - update_tenant
        - delete_tenant
        - manage_tenant_members
        - manage_tenant_settings
        - manage_tenant_api_keys
        - create_integration
        - read_integration
        - update_integration
        - delete_integration
        - create_project
        - read_project
        - update_project
        - delete_project
        - bulk_deploy_project
        - clone_project
        - create_environment
        - read_environment
        - update_environment
        - delete_environment
        - clone_environment
        - deploy_environment
        - read_workflow
        - read_tenant_workflows
        - create_resource
        - read_resource
        - update_resource
        - delete_resource
        - list_tenants
        - manage_super_admins
        - read_system
        - update_system
        - read_github_repos
        - read_github_app
        - read_my_invitations
        - read_tenant_invitations
        - create_invitation
        - delete_invitation
      x-enum-varnames:
        - PermissionCreateTenant
        - PermissionReadTenant
        - PermissionUpdateTenant
        - PermissionDeleteTenant
        - PermissionManageTenantMembers
        - PermissionManageTenantSettings
        - PermissionManageTenantApiKeys
        - PermissionCreateIntegration
        - PermissionReadIntegration
        - PermissionUpdateIntegration
        - PermissionDeleteIntegration
        - PermissionCreateProject
        - PermissionReadProject
        - PermissionUpdateProject
        - PermissionDeleteProject
        - PermissionBulkDeployProject
        - PermissionCloneProject
        - PermissionCreateEnvironment
        - PermissionReadEnvironment
        - PermissionUpdateEnvironment
        - PermissionDeleteEnvironment
        - PermissionCloneEnvironment
        - PermissionDeployEnvironment
        - PermissionReadWorkflow
        - PermissionReadTenantWorkflows
        - PermissionCreateResource
        - PermissionReadResource
        - PermissionUpdateResource
        - PermissionDeleteResource
        - PermissionListTenants
        - PermissionManageSuperAdmins
        - PermissionReadSystem
        - PermissionUpdateSystem
        - PermissionReadGitHubRepos
        - PermissionReadGitHubApp
        - PermissionReadMyInvitations
        - PermissionReadTenantInvitations
        - PermissionCreateInvitation
        - PermissionDeleteInvitation
    PaasLibErrorCode:
      type: string
      description: >
        Machine-readable code from paas-lib (errors.Code). Matches
        github.com/gapai-io/paas-lib/pkg/errors.Code.
      enum:
        - common.internal_error
        - common.unavailable
        - common.timeout
        - common.conflict
        - common.not_implemented
        - validation.invalid
        - validation.required
        - auth.unauthorized
        - auth.forbidden
        - storage.not_found
        - storage.already_exists
        - storage.db_error
        - storage.constraint_violation
        - service.invalid_state
        - service.rule_violation
        - service.aborted
        - external.error
        - external.timeout
        - external.bad_response
        - stack.manual_deletion
        - subscription.invalid_state
        - subscription.rule_violation
        - subscription.canceled
        - subscription.not_found
        - subscription.limit_reached
      x-enum-varnames:
        - ErrInternalErrorCode
        - ErrUnavailableErrorCode
        - ErrTimeoutErrorCode
        - ErrConflictErrorCode
        - ErrNotImplementedErrorCode
        - ErrValidationInvalidCode
        - ErrValidationRequiredCode
        - ErrUnauthorizedCode
        - ErrForbiddenCode
        - ErrRepoNotFoundErrorCode
        - ErrRepoAlreadyExistsErrorCode
        - ErrRepoDBErrorCode
        - ErrRepoConstraintViolationErrorCode
        - ErrInvalidStateCode
        - ErrBusinessRuleCode
        - ErrOperationAbortCode
        - ErrExternalErrorCode
        - ErrExternalTimeoutCode
        - ErrExternalBadRespCode
        - ErrStackManualDeletionCode
        - ErrSubscriptionInvalidStateCode
        - ErrSubscriptionBusinessRuleCode
        - ErrSubscriptionCanceledCode
        - ErrSubscriptionNotFoundCode
        - ErrSubscriptionLimitReachedCode
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Bearer token in the Authorization header (e.g. JWT / Cognito access
        token).

````