Lire la liste complète des privilèges accordés au propriétaire d’un agent

GET/api/public/v1/agents/{agent_id}/ownership/privileges

Every group, admin role and application entitlement the agent's owner holds, with the scope it applies to, whether it was assigned directly or inherited through a group, and whether it is standing or merely PIM-eligible. Ordered admin roles first, then groups, then application entitlements, most-privileged first inside each. Served from stored state — no directory call is made on this path. An agent with no human owner returns an empty list and a null tier rather than a 404: there is no owner to describe, which is an answer.

cURL

curl --fail-with-body -X GET 'https://app.openlatch.ai/api/public/v1/agents/<agent_id>/ownership/privileges' \
  -H "Authorization: Bearer $OPENLATCH_API_KEY"

Python

import json
import os
import urllib.request

request = urllib.request.Request(
    'https://app.openlatch.ai/api/public/v1/agents/<agent_id>/ownership/privileges',
    method='GET',
    headers={
        'Authorization': 'Bearer ' + os.environ['OPENLATCH_API_KEY'],
    },
)
with urllib.request.urlopen(request) as response:
    text = response.read().decode()
    print(json.dumps(json.loads(text), indent=2) if text else response.status)

Bash

#!/usr/bin/env bash
set -euo pipefail

curl -sS --fail-with-body -X GET 'https://app.openlatch.ai/api/public/v1/agents/<agent_id>/ownership/privileges' \
  -H "Authorization: Bearer $OPENLATCH_API_KEY" | jq .

PowerShell

$headers = @{
  Authorization = "Bearer $env:OPENLATCH_API_KEY"
}
Invoke-RestMethod -Method GET -Uri 'https://app.openlatch.ai/api/public/v1/agents/<agent_id>/ownership/privileges' -Headers $headers | ConvertTo-Json -Depth 20

Autorisation

Rôle dans l’organisation	Ce point de terminaison
owner	Autorisé
admin	Autorisé
editor	Autorisé
viewer	Autorisé

Une clé porte le rôle que son propriétaire détient dans l’organisation. Voir Authentification.

Portée de clé d’API : agents:read

Paramètres de chemin

Paramètre	Type	Description
agent_id	string	Obligatoire.

Paramètres de requête

Paramètre	Type	Description
projection	string — one of full, reach	reach returns only the distinct-permission projection, with an empty grant list.

Réponse

• 200 OK — l’appel a réussi.
• 401 Unauthorized — UNAUTHORIZED
• 402 Payment Required — license_expired
• 403 Forbidden — FEATURE_DISABLED, FORBIDDEN, INSUFFICIENT_SCOPE
• 404 Not Found — NOT_FOUND
• 422 Unprocessable Content — INVALID_ID, VALIDATION_ERROR
• 429 Too Many Requests — TOO_MANY_REQUESTS
• 500 Internal Server Error — INTERNAL_SERVER_ERROR, tenant_isolation_violation
• 503 Service Unavailable — FEATURE_STATE_UNAVAILABLE, SERVICE_UNAVAILABLE

Champs de la réponse

Champ	Type	Description
capabilities	object
evaluated_at	string (date-time) or null
grants	array of object
grants[].display_name	string or null
grants[].external_id	string	Obligatoire.
grants[].kind	string	Obligatoire.
grants[].permissions	array of string
grants[].scope	string or null
grants[].source	string	Obligatoire.
grants[].tier	string	Obligatoire.
reach	array of object
reach[].permission	string	Obligatoire.
reach[].tier	string or null
tier	string or null

Exemple de réponse

{
  "capabilities": {},
  "evaluated_at": "2026-01-15T14:32:05Z",
  "grants": [
    {
      "display_name": "release-bot",
      "external_id": "3f6c1a2e-8b4d-4c1f-9a7e-0d5b2c8e4f10",
      "kind": "string",
      "permissions": [
        "string"
      ],
      "scope": "string",
      "source": "string",
      "tier": "string"
    }
  ],
  "reach": [
    {
      "permission": "string",
      "tier": "string"
    }
  ],
  "tier": "string"
}

Voir aussi

• GET Lister les agents connectés à l’organisation authentifiée
• DELETE Supprimer un agent, avec ses sessions, ses événements et ses statistiques.
• GET Obtenir un agent par son ID