> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getcliq.io/llms.txt
> Use this file to discover all available pages before exploring further.

# List permissions

> Lists every permission a role can grant, and those reserved for owners. Use them with Create a role. Takes no body.

Requires a signed-in user token (`Authorization: Bearer cliq_tok_…`). Results are limited to what that user can see.



## OpenAPI

````yaml /openapi/hub-by-tag/hub-organizations.yaml post /v1/permissions/list
openapi: 3.0.3
info:
  title: 'CliqHub API: Organizations'
  version: 1.0.0
  description: >-
    An organization owns realms, teams (through its scopes) and people. Every
    organization

    has four built-in roles, **Owner**, **Admin**, **Operator** and **Member**,
    and can define

    its own: a role is a named set of permissions (List permissions shows them
    all). Owners can

    do everything; `org.delete` and `org.transfer` belong to owners only.


    **Scopes** are the organization's package namespaces (`@acme`,
    `@acme-labs`): teams are

    published under a scope, and only the scope's members may publish to it. The
    organization's

    **team library** lists the teams its realms may use. Organization-wide
    notification rules

    also live here.


    People join an organization through Send an invitation. Organizations are
    created by site

    administrators for their future owner.
servers:
  - url: https://{host}
    variables:
      host:
        default: cliqhub.io
        description: CliqHub host
security: []
tags:
  - name: Organizations
    description: >-
      An organization owns realms, teams (through its scopes) and people. Every
      organization

      has four built-in roles, **Owner**, **Admin**, **Operator** and
      **Member**, and can define

      its own: a role is a named set of permissions (List permissions shows them
      all). Owners can

      do everything; `org.delete` and `org.transfer` belong to owners only.


      **Scopes** are the organization's package namespaces (`@acme`,
      `@acme-labs`): teams are

      published under a scope, and only the scope's members may publish to it.
      The organization's

      **team library** lists the teams its realms may use. Organization-wide
      notification rules

      also live here.


      People join an organization through Send an invitation. Organizations are
      created by site

      administrators for their future owner.
paths:
  /v1/permissions/list:
    post:
      tags:
        - Organizations
      summary: List permissions
      description: >-
        Lists every permission a role can grant, and those reserved for owners.
        Use them with Create a role. Takes no body.


        Requires a signed-in user token (`Authorization: Bearer cliq_tok_…`).
        Results are limited to what that user can see.
      operationId: POST_v1_permissions_list
      responses:
        '200':
          description: Success.
          content:
            application/json:
              schema:
                type: object
                required:
                  - ok
                  - data
                properties:
                  ok:
                    type: boolean
                    enum:
                      - true
                    description: Always `true` on success.
                  data:
                    type: object
                    properties:
                      permissions:
                        type: array
                        items:
                          type: string
                      owner_only:
                        type: array
                        items:
                          type: string
              example:
                ok: true
                data:
                  permissions:
                    - org.settings
                    - org.members.manage
                    - realms.create
                    - teams.install
                    - teams.publish
                    - runs.view
                  owner_only:
                    - org.delete
                    - org.transfer
        '401':
          description: >-
            `unauthorized`: No `Authorization` header, or the token is
            malformed, expired or revoked.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HubErr'
              examples:
                unauthorized:
                  summary: unauthorized
                  value:
                    ok: false
                    error:
                      code: unauthorized
                      message: Authentication required
        '403':
          description: '`forbidden`: A daemon token was used; this route needs a user token.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HubErr'
              examples:
                forbidden:
                  summary: forbidden
                  value:
                    ok: false
                    error:
                      code: forbidden
                      message: You do not have access to do this
        '500':
          description: >-
            `internal_error`: An unexpected server fault. Retry later; if it
            persists, report it with the time of the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HubErr'
              examples:
                internal_error:
                  summary: internal_error
                  value:
                    ok: false
                    error: Internal server error
                    code: internal_error
      security:
        - BearerAuth: []
components:
  schemas:
    HubErr:
      type: object
      required:
        - ok
        - error
      description: >-
        Every failure. Route-policy denials (401/403/404, and 400 when neither
        realm_id nor org_id was sent) answer `error` as `{ code, message }`;
        errors raised by the endpoint answer `error` as the message with the
        code beside it in `code`. Every error has a code. See
        [Errors](/hub-api/errors).
      properties:
        ok:
          type: boolean
          description: Always false on error
        error:
          description: The message, or `{ code, message }` for an access denial.
          oneOf:
            - type: string
            - type: object
              required:
                - code
                - message
              properties:
                code:
                  type: string
                message:
                  type: string
        code:
          type: string
          description: Stable error code of an endpoint error.
        details:
          type: object
          additionalProperties: true
          description: Structured detail, when there is some.
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: cliq_tok_* | cliq_dt_*
      description: >-
        User PAT (`cliq_tok_…`, including session-scoped) or realm token
        (`cliq_dt_…`).

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.