> ## Documentation Index > Fetch the complete documentation index at: https://docs.getcliq.io/llms.txt > Use this file to discover all available pages before exploring further. # Get the realm access list > A daemon refreshes its realm's access list (who may call it from another host) and the public key it checks CliqHub's dispatch tokens with, for example after a key rotation. A token that does not grant the requested `realm_id` is refused with `403 forbidden`. Daemon only: requires the daemon's realm token (`Authorization: Bearer cliq_dt_…`). User tokens are refused. ## OpenAPI ````yaml /openapi/hub-by-tag/hub-daemons.yaml post /v1/auth/acl openapi: 3.0.3 info: title: 'CliqHub API: Daemons' version: 1.0.0 description: >- Daemons (`cliqd`) connected to CliqHub. A daemon joins a realm with a realm token (`cliq_dt_…`, from Generate a token with `type: realm`, or `cliq login` on the daemon). With that token it registers, sends a heartbeat, reports its installed teams, refreshes the realm's access list and acknowledges each command CliqHub sends it. People list, inspect and remove daemons. A daemon is `online` while it sends heartbeats, then `stale`, then `offline`; `removed` once deregistered or removed. servers: - url: https://{host} variables: host: default: cliqhub.io description: CliqHub host security: [] tags: - name: Daemons description: >- Daemons (`cliqd`) connected to CliqHub. A daemon joins a realm with a realm token (`cliq_dt_…`, from Generate a token with `type: realm`, or `cliq login` on the daemon). With that token it registers, sends a heartbeat, reports its installed teams, refreshes the realm's access list and acknowledges each command CliqHub sends it. People list, inspect and remove daemons. A daemon is `online` while it sends heartbeats, then `stale`, then `offline`; `removed` once deregistered or removed. paths: /v1/auth/acl: post: tags: - Daemons summary: Get the realm access list description: >- A daemon refreshes its realm's access list (who may call it from another host) and the public key it checks CliqHub's dispatch tokens with, for example after a key rotation. A token that does not grant the requested `realm_id` is refused with `403 forbidden`. Daemon only: requires the daemon's realm token (`Authorization: Bearer cliq_dt_…`). User tokens are refused. operationId: POST_v1_auth_acl requestBody: required: true content: application/json: schema: type: object properties: realm_id: type: string minLength: 1 description: Realm to read; defaults to the token's realm. daemon_id: type: string minLength: 1 description: The daemon asking, echoed back. examples: default: value: daemon_id: 7d1c2b3a-4e5f-4a6b-8c7d-9e0f1a2b3c4d responses: '200': description: Success. content: application/json: schema: type: object required: - ok - data properties: ok: type: boolean enum: - true description: Always `true` on success. data: allOf: - $ref: '#/components/schemas/DaemonAcl' - type: object properties: daemon_id: type: string example: ok: true data: realm_id: 5b0c3a7e-2f4d-4b8e-9a51-7c1d2e3f4a5b allowed: - sshah - jdoe dispatch_public_key: |- -----BEGIN PUBLIC KEY----- … daemon_id: 7d1c2b3a-4e5f-4a6b-8c7d-9e0f1a2b3c4d '401': description: >- `unauthorized`: No `Authorization` header, or the token is malformed, expired or revoked. content: application/json: schema: $ref: '#/components/schemas/HubErr' examples: unauthorized: summary: unauthorized value: ok: false error: code: unauthorized message: Authentication required '403': description: >- `forbidden`: A user token was used, or the daemon's token belongs to another realm. `forbidden`: The realm token does not grant the requested `realm_id`. content: application/json: schema: $ref: '#/components/schemas/HubErr' examples: forbidden: summary: forbidden value: ok: false error: code: forbidden message: You do not have access to do this forbidden (endpoint): summary: forbidden (endpoint) value: ok: false error: Realm grant denied code: forbidden '422': description: >- `invalid_params`: The body fails the request schema: a field is missing or has the wrong type. `details.issues` lists each problem. content: application/json: schema: $ref: '#/components/schemas/HubErr' examples: invalid_params: summary: invalid_params value: ok: false error: Required code: invalid_params details: issues: - field: realm_id message: Required '500': description: >- `internal_error`: An unexpected server fault. Retry later; if it persists, report it with the time of the request. content: application/json: schema: $ref: '#/components/schemas/HubErr' examples: internal_error: summary: internal_error value: ok: false error: Internal server error code: internal_error security: - BearerAuth: [] components: schemas: DaemonAcl: type: object required: - realm_id - allowed - dispatch_public_key properties: realm_id: type: string allowed: type: array items: type: string description: Who may call the daemon from another host (the realm's members). dispatch_public_key: type: string description: PEM public key the daemon checks CliqHub's dispatch tokens with. HubErr: type: object required: - ok - error description: >- Every failure. Route-policy denials (401/403/404, and 400 when neither realm_id nor org_id was sent) answer `error` as `{ code, message }`; errors raised by the endpoint answer `error` as the message with the code beside it in `code`. Every error has a code. See [Errors](/hub-api/errors). properties: ok: type: boolean description: Always false on error error: description: The message, or `{ code, message }` for an access denial. oneOf: - type: string - type: object required: - code - message properties: code: type: string message: type: string code: type: string description: Stable error code of an endpoint error. details: type: object additionalProperties: true description: Structured detail, when there is some. securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: cliq_tok_* | cliq_dt_* description: >- User PAT (`cliq_tok_…`, including session-scoped) or realm token (`cliq_dt_…`). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.