Organisation Permissions

List permissions

GET/permissions
permissions:readlist_permissionsRead-only

Lists every permission that can be put on a role, by id, whatever its level, 25 per cursor page by default and up to 100 with limit; the old route returned them all unpaginated. Each carries its key, name, label, category, level and creation_default (in your organisation's default set for new users). Narrow with filter[category] and filter[creation_default], which replace the removed grouped and context=creation parameters.

Query parameters

  • limitinteger#

    Page size (1–100). Defaults to 25; values are clamped to the range.

    Default: 25
  • cursorstring#

    Opaque pagination cursor taken from a prior response's meta.next_cursor.

  • fieldsstring#

    Comma-separated top-level fields to return. id is always returned.

  • sortstring#

    Comma-separated fields to sort by: id, key, label or created_at. Prefix a field with - for descending. Defaults to id.

  • filter[category]string#

    Permissions in the category with this label, ignoring case. Takes [in] and [not_in] with a comma-separated list, and [contains].

  • filter[creation_default]boolean#

    true for the permissions in your organisation's default set for new users, false for the rest.

Responses

200

The permissions.

Permission[]
{
  "data": [
    {
      "id": 1,
      "key": "string",
      "name": "string",
      "label": "string",
      "description": "string",
      "category": "string",
      "level": 1,
      "creation_default": true,
      "created_at": "2026-06-12T10:00:00+00:00",
      "updated_at": "2026-06-12T10:00:00+00:00"
    }
  ],
  "meta": {
    "limit": 1,
    "next_cursor": "string",
    "prev_cursor": "string"
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error
422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error
429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl https://your-org-domain/kong/core/api/v2/permissions\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"