List Access Rule Mappings

GET/access-rule-mappings

Agency-scoped keys

This endpoint is not available for agency-scoped API keys.

Summary

Returns global default role-based access control (RBAC) grants. Requires a valid company-scoped key.

Each row grants the action in can to the role in a. The role identifiers are internal values such as projectApprover, rather than friendly display labels. These mappings are global defaults.

Defaults do not include user overrides, project membership, workflow restrictions, or record-level checks. To inspect a user's effective project permissions, use List User Permissions.

Query Parameters

Name	Type	Description
groupBy	string	role or rule; omit for individual mappings
role	string	Exact role identifier, matched against a
action	string	Exact action identifier, matched against can
query	string	Case-insensitive search across a, can, and configKey
page	integer	Page number (default 1)
limit	integer	Mappings per page (default 50, maximum 200)
sortBy	string	a, can, or configKey (default a)
sortOrder	string	asc or desc (default asc)
fields	string	Comma-separated response fields to return

All parameters are optional. Filters combine and apply before grouping. When grouped, page, limit, and meta.total count groups, with all matching mappings included in each returned group. Groups are ordered by role, or action then configuration key, using sortOrder. sortBy applies only to ungrouped results.

Request Example

curl 'https://api.requidex.com/api/open/v1/access-rule-mappings?role=projectApprover&page=1&limit=50' \
  -H 'Authorization: Bearer <API_KEY>'

Response Fields

Field	Type	Description
id	string	Mapping id
a	string	Role identifier
can	string	Action identifier granted by default
configKey	string	Configuration key, when present on the mapping
type	string	RBAC

The response contains success, a data array, and meta with page, limit, and total matching mappings. No matching mappings returns an empty data array and total: 0.

Grouped Response Fields

Use ?groupBy=role to collect each role's default rules, or ?groupBy=rule to see which roles share each action and configuration key. Omit groupBy to keep the response fields above.

Field	Type	Description
a	string	Role identifier; present with groupBy=role
can	string	Action identifier; present with groupBy=rule
configKey	string	Configuration key, when present; included with groupBy=rule
rules	array	Matching mappings in this group Show child attributes id string - Mapping id a string - Role identifier can string - Action identifier configKey string - Configuration key, when present type string - RBAC

Use fields with the grouped response shape, for example fields=a,rules when grouping by role.

Response Examples (200)

The identifiers, action, and configuration key below are illustrative.

Ungrouped

Omit groupBy to return individual mappings.

{
  "success": true,
  "data": [
    {
      "id": "67bc36db80a1616ec3f47003",
      "a": "projectApprover",
      "can": "exampleAction",
      "configKey": "exampleConfig",
      "type": "RBAC"
    }
  ],
  "meta": {
    "page": 1,
    "limit": 50,
    "total": 1
  }
}

By Role

Use groupBy=role to collect mappings for each role.

{
  "success": true,
  "data": [
    {
      "a": "projectApprover",
      "rules": [
        {
          "id": "67bc36db80a1616ec3f47003",
          "a": "projectApprover",
          "can": "exampleAction",
          "configKey": "exampleConfig",
          "type": "RBAC"
        }
      ]
    }
  ],
  "meta": {
    "page": 1,
    "limit": 50,
    "total": 1
  }
}

By Rule

Use groupBy=rule to collect mappings for each action and configuration key.

{
  "success": true,
  "data": [
    {
      "can": "exampleAction",
      "configKey": "exampleConfig",
      "rules": [
        {
          "id": "67bc36db80a1616ec3f47003",
          "a": "projectApprover",
          "can": "exampleAction",
          "configKey": "exampleConfig",
          "type": "RBAC"
        }
      ]
    }
  ],
  "meta": {
    "page": 1,
    "limit": 50,
    "total": 1
  }
}

MCP Tool

Use open_api_list_access_rule_mappings (operation ListAccessRuleMappings) with the query parameters above. The same authentication and company-only restrictions apply.

Errors

HTTP Status	Description
400	Invalid groupBy value
401	Missing or invalid authentication
403	Agency-scoped key or another access restriction
429	Rate limit exceeded
500	Unexpected internal error