Read Authority
Workspace Endpoints
Read Authority
The resolved standing of a user on a workspace — permissions as a service
Read Authority
Returns the caller’s resolved standing on a workspace:
{ reasons, capabilities, permissions, rank }, computed via the authority resolver (fast-path + bounded ancestor climb). This is the endpoint your authorization server reads (via the node SDK) to make its own app-level decisions.
reasons is an array of structured entries — { type, viaWorkspaceId? } — distinguishing owner / ancestor-owner / member / reach-holder, so you always know why a user has what they have and which workspace grants it. It is the same object shape a roster entry’s reasons carries. viaWorkspaceId names the granting ancestor and is present on ancestor-owner / reach-holder only (owner / member are grants on the workspace itself). A user reaching in from several ancestors carries one entry per granting ancestor.
This read is inherently a self read (or a privileged-key read of a named user), so capabilities / permissions / rank are always returned in full here — unlike the member-standing read, which fences them.
There is no convenience
?permission= check and no can() middleware. Sublay never consumes your opaque permissions, so a permission check is a one-line .includes() on the returned record:Path Parameters
string
required
The workspace UUID.
Query Parameters
string
Service/master keys only — the target user whose standing to resolve (the service-key variant). With a client token the actor is derived from the token and this is ignored.
Response
reasons— structured standings;viaWorkspaceIdis present onancestor-owner/reach-holderonly.capabilities— the fully-resolved set (direct + reach + ownership).viewis implied by every other capability — any user with standing on the workspace resolves withview, including a member whose storedcapabilitiesarray is empty. A user with no relation at all resolves to an empty set.permissions— per-node (the direct membership on this workspace only; may be empty). Does not cascade.rank— the direct-membership rank, ornullfor owners / ancestor-owners / reach-only holders.

