List a user's explicit grants + revokes (admin)

GET

/admin/users/{ref}/capabilities

• Local development behind nginx (port 8088 by default)

Returns the per-user GRANT and REVOKE override lists. Role-derived capabilities are not included (they’re already returned by GET /auth/me/capabilities and the role editor surface). This list is the additive/subtractive delta admins manage by hand.

Authorizations

• cookieAuth
• bearerAuth

Parameters

Path Parameters

ref

required

integer format: int64

Responses

200

Per-user grant + revoke override lists.

Per-user explicit GRANT + REVOKE override lists. Role-derived capabilities are NOT included — admins manage those through the role editor; this surface only exposes the additive / subtractive deltas attached directly to the user.

object

grants

required

Array<object>

One row from either user_capability_grants or user_capability_revokes. team_id is null for global overrides, set for team-scoped ones. note is the admin-supplied justification recorded at grant/revoke time.

expires_at is the optional time-bound expiry. NULL means permanent (the existing default behavior); non-null rows get reaped by the background capability sweeper once NOW() passes the expiry.

object

capability

required

string

team_id

string format: uuid

nullable

note

Free-text justification — empty when none was supplied.

string

granted_by

Acting admin’s user_ref at time of grant/revoke. Null when the row predates actor recording or was inserted by seed migration.

integer format: int64

nullable

granted_at

required

string format: date-time

expires_at

Optional auto-expiry timestamp. Null means permanent. Reaped by the background sweeper.

string format: date-time

nullable

revokes

required

Array<object>

One row from either user_capability_grants or user_capability_revokes. team_id is null for global overrides, set for team-scoped ones. note is the admin-supplied justification recorded at grant/revoke time.

expires_at is the optional time-bound expiry. NULL means permanent (the existing default behavior); non-null rows get reaped by the background capability sweeper once NOW() passes the expiry.

object

capability

required

string

team_id

string format: uuid

nullable

note

Free-text justification — empty when none was supplied.

string

granted_by

Acting admin’s user_ref at time of grant/revoke. Null when the row predates actor recording or was inserted by seed migration.

integer format: int64

nullable

granted_at

required

string format: date-time

expires_at

Optional auto-expiry timestamp. Null means permanent. Reaped by the background sweeper.

string format: date-time

nullable

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

403

Authenticated but missing required capabilities

object

error

required

Human-readable error summary

string

Example

the request could not be completed

404

Resource not found

object

error

required

Human-readable error summary

string

Example

the request could not be completed