Returns the full catalog of permission keys the system knows about -- everything you can grant or deny to a role, in either Set a Role's Fleet-Wide Permissions or Grant a Scoped Permission. Use this to build a picker in your own tooling rather than hardcoding the list, since it's stored data, not a fixed code enum.

Having trouble reaching the API, or logging in from another machine? See Network Access & Authentication Security -- by default the Api only answers localhost, and PowerShell needs an extra flag once it does answer elsewhere.

Order of Operations

  1. Authenticate to the API.
  2. Request the catalog.

The call

GET /api/security/permissions

No route parameters, no query parameters, no request body.

Permission needed: Security.Manage.

C# example

var jsonOptions = new JsonSerializerOptions(JsonSerializerDefaults.Web);

// Step 1: Authenticate to the API.
using var handler = new HttpClientHandler { UseDefaultCredentials = true };
using var client = new HttpClient(handler) { BaseAddress = new Uri("http://your-minion-agent-server:5443") };
client.DefaultRequestHeaders.Add("X-App-Name", "MyIntegration");

// Step 2: Request the catalog.
var permissions = await client.GetFromJsonAsync<PermissionSummary[]>("/api/security/permissions", jsonOptions);
foreach (var perm in permissions!)
{
    Console.WriteLine($"{perm.PermissionKey}: {perm.DisplayName}");
}

record PermissionSummary(string PermissionKey, string DisplayName, int DisplayOrder);

Not on a domain machine? Swap in the app-account login from Calling the API From Your Own Code.

PowerShell example

# Step 1: Authenticate to the API.
$headers = @{ "X-App-Name" = "MyIntegration" }

# Step 2: Request the catalog. (-AllowUnencryptedAuthentication: PowerShell requires this for Windows auth over plain http to anything but localhost -- see "Network Access & Authentication Security".)
$permissions = Invoke-RestMethod -Uri "http://your-minion-agent-server:5443/api/security/permissions" -UseDefaultCredentials -AllowUnencryptedAuthentication -Headers $headers
$permissions | ForEach-Object { "$($_.permissionKey): $($_.displayName)" }

What you get back

200 OK, an array, ordered by displayOrder:

[
    { "permissionKey": "Job.View", "displayName": "View Jobs", "displayOrder": 10 },
    { "permissionKey": "Job.Run", "displayName": "Run Jobs", "displayOrder": 20 },
    { "permissionKey": "Credential.Manage", "displayName": "Manage Credentials", "displayOrder": 90 }
]

Each key follows an Area.Action shape (e.g. Job.View, Credential.Manage, TargetServer.Manage) and is what you pass as PermissionKey in every grant/revoke call.

Codes this call can return

See API Response Codes for what each one means in general. For this specific call:

  • 200 -- the catalog, even if empty.
  • 403 -- you don't have Security.Manage.

See also: Set a Role's Fleet-Wide Permissions, Grant a Scoped Permission.