### List the permission catalogue

`GET /api/v1/permissions`

Every permission code this build defines, with its group, label, help text, stated effect and risk class. This is the authoritative list a role editor or a token scope picker should render from.

- Authentication: manager session (JWT) or API token
- Permission: `prm_roles_manage` (Manage roles & permissions)
- Risk: danger

#### Response — 200 OK

```json
{
  "data": [
    {
      "code": "prm_users_index",
      "group": "Subscribers",
      "label": "View subscribers",
      "desc": "See the subscriber list and open a subscriber record.",
      "effect": "Read-only.",
      "risk": "read"
    }
  ]
}
```

#### Note

English only, and deliberately not translated — these are operator-facing catalogue strings baked into the build, not localized messages. risk is read, write or danger, and is the right signal for warning someone before they tick a box.