api referenceGET
GET
POST
POST
Permissions & roles
The permission catalog, custom roles, and per-object access grants.
GET/api/permissions
The fixed permission catalog (every key the role editor can assign), each with a display label and category.
Response
[{ "key": "view_query", "label": "View queries", "category": "queries" }]GET/api/roles
List custom roles in the org, each with the count of groups it's attached to.
Response
[{ "id": 2, "name": "Analyst", "type": "custom", "permissions": ["view_query"], "group_count": 3, "created_at": "2026-01-01T00:00:00Z", "updated_at": "2026-01-01T00:00:00Z" }]POST/api/roles
Create a custom role. Requires manage_roles; every permission key is validated against the catalog.
Request
{ "name": "Analyst", "permissions": ["view_query", "create_query"] }POST/api/queries/{id}/acl
Grant a user or group Editor-or-View access on a specific query. Same shape for /api/dashboards/{id}/acl and /api/monitors/{id}/acl. access_type accepts "owner"/"editor"/"viewer" (or the legacy aliases "modify"/"view", normalized to "editor"/"viewer").
Request
{ "grantee_id": 12, "access_type": "editor" }Response
{ "id": 55, "object_type": "query", "object_id": 42, "access_type": "editor", "grantor_id": 3, "grantee_id": 12, "grantee_group_id": null, "created_at": "2026-07-17T12:00:00Z" }