# Permissions - X-Radius API

> Base URL: https://x-radius.com/api/v1
> Auth: Authorization: Bearer xrt_...  (a manager API token)
> Envelope: {"data": ...}; lists add {"meta":{page,page_size,total,has_next}}
> Errors: {"error":{"code","message","request_id"}} - branch on code, never on message
> Timestamps: yyyy-MM-dd HH:mm:ss, UTC
> Money: a bare JSON number in major units, with an ISO-4217 currency code beside it
> Idempotency: redeem and activate endpoints take a client-supplied request_id (UUID)
>
> This page: https://x-radius.com/docs/api/permissions
> Every group: https://x-radius.com/llms.txt

1 endpoints in 1 resource groups. 1 carry a hand-written reference entry with examples; the remaining 0 are generated from the running router and carry method, path, authentication, permission and rate-limit bucket, but no request or response example.

### List the permission catalogue

`GET /api/v1/permissions`

Every permission code this build defines, with its group, label, help text, stated effect and risk class. This is the authoritative list a role editor or a token scope picker should render from.

- Authentication: manager session (JWT) or API token
- Permission: `prm_roles_manage` (Manage roles & permissions)
- Risk: danger

#### Response — 200 OK

```json
{
  "data": [
    {
      "code": "prm_users_index",
      "group": "Subscribers",
      "label": "View subscribers",
      "desc": "See the subscriber list and open a subscriber record.",
      "effect": "Read-only.",
      "risk": "read"
    }
  ]
}
```

#### Note

English only, and deliberately not translated — these are operator-facing catalogue strings baked into the build, not localized messages. risk is read, write or danger, and is the right signal for warning someone before they tick a box.