> ## Documentation Index > Fetch the complete documentation index at: https://onecli.sh/docs/llms.txt > Use this file to discover all available pages before exploring further. # Effective app permissions (workspace) > What the enforced policy decides for every tool of one app, in this workspace: the agent's grant composed with organization rules. Without `agentId` the answer is the all-agents baseline; `variesByIdentity` counts the identity-scoped rules it cannot show. Add `connectionId` to reflect one specific account as the injected connection and to get the resource boundary (`orgResources`, `effectiveResources`). Organization rule names are visible to organization admins only; other viewers see `redacted: true` on the provenance. ## OpenAPI ````yaml /openapi.yaml get /policy/effective-app-permissions openapi: 3.1.0 info: title: OneCLI API version: '1.0' description: > The OneCLI API manages everything behind the gateway: workspaces, agents and what each agent may use (grants), secrets, app connections, organization policy, hosted-agent conversations, schedules, memory, skills, Slack channels, and the organization's directory. **Base URL:** `https://api.onecli.sh/v1` (OneCLI Cloud) or `http://localhost:10254/v1` (self-hosted). ## Authentication Every endpoint takes an `Authorization: Bearer ` header unless its description says otherwise. - **Workspace API key** (`oc_…`) — acts inside one workspace. Read it from the dashboard or `GET /user/api-key`. - **Organization API key** (`oc_org_…`) — acts for the whole organization. Workspace-scoped endpoints additionally need an `X-Workspace-Id` header naming the workspace; without it they answer `401`. - **Dashboard session** — the browser's own session (Cloud: a bearer JWT; self-hosted: the session cookie). `X-Workspace-Id` replaced `X-Project-Id`. The old header, the `?_project` query bridge, and the `/v1/projects` path alias still work for a deprecation window and answer with a `Deprecation: true` header; migrate to the new names. ## Editions Each endpoint states where it is available. Unless marked otherwise an endpoint exists on **OneCLI Cloud**, the **Community** self-hosted edition, and the **Enterprise** self-hosted edition. Endpoints tagged **Enterprise** answer `403` with `error.type: "enterprise_license_required"` on a self-hosted deployment that has not set `ENTERPRISE_ENABLED=true`; on Cloud they are always present, though some features are additionally gated by the organization's plan. Endpoints tagged **Cloud** do not exist on self-hosted deployments at all. ## Roles Organization-level endpoints (`/org/…`) require the **admin** or **owner** role wherever roles are enforced (Cloud and Enterprise). The Community edition runs a flat team: every active member passes the role check. servers: - url: https://api.onecli.sh/v1 description: OneCLI Cloud - url: http://localhost:10254/v1 description: Self-hosted security: - bearerAuth: [] tags: - name: Workspaces description: >- Workspaces partition an organization's agents, secrets, and connections. Every workspace-scoped endpoint resolves its workspace from the API key (or `X-Workspace-Id` with an organization key). - name: Agents description: >- Manage agents, their gateway access tokens, and hosted-agent configuration. - name: Grants description: >- Which credentials each agent may use — attach app connections (with optional per-tool allow/approval lists and resource scoping) and secrets. Writes take effect immediately. - name: Secrets description: >- Credentials the gateway injects into outbound requests that match a host pattern. - name: Apps description: >- The app catalog, OAuth and direct-credential connects, your own OAuth client configuration, permission catalogs, and blocklists. - name: Connections description: Connected app accounts as a top-level resource. - name: Effective policy description: >- Read-only reflections of what the enforced policy means for an agent, a connection, or an app — workspace grants composed with organization rules. - name: Conversations description: >- Talk to a hosted agent. A conversation owns its turns, transcript, and attachments. - name: Schedules description: Cron-style schedules on a hosted agent. - name: Memories description: A hosted agent's memory files and their revision history. - name: Skills description: >- Skills reachable from a workspace — the organization's, the workspace's own, and per-agent ones. - name: Channels description: >- Where a hosted agent is reachable (Slack), who may reach it, who it may message, and which other agents it may talk to. - name: Approvals description: Long-poll for the gateway's manual-approval requests and submit decisions. - name: User description: Your profile, API keys, SSH keys, and account deletion. - name: Instance description: Unauthenticated deployment facts and bootstrap endpoints. - name: Utility description: Counts, vaults, and agent bootstrap helpers. - name: Organization description: The current organization and its invitations. Free on every edition. - name: Organization secrets description: Secrets shared into every workspace of the organization. - name: Organization policy description: >- The organization's first-match rule set — blocks, allows, rate limits, approvals, and app permissions that bind every workspace. - name: Organization connections description: App connections shared into every workspace of the organization. - name: Organization apps description: >- Connect apps and configure your own OAuth clients at the organization level. - name: Organization skills description: Skills every workspace in the organization receives. - name: Organization channels description: The organization's Slack integration and identity links. - name: Organization approvals description: Long-poll for manual-approval requests across every workspace. - name: Members description: The organization directory — list, provision, suspend, and remove members. - name: Groups description: Directory groups and group-to-role mappings. - name: Workspace access description: Share a workspace with people and groups. - name: Domains description: Verified email domains, the anchor for SSO and home-realm discovery. - name: SSO description: SAML and OIDC sign-in connections and organization-wide enforcement. - name: SCIM tokens description: Bearer tokens for the organization's SCIM endpoint. - name: App availability description: Restrict which apps each workspace may connect. - name: Provisioning description: >- Pre-create members with a ready workspace and API key, then let them claim the account. - name: Resource browsing description: Browse a connected account's folders to pick resource scopes for a grant. - name: SCIM description: >- The SCIM 2.0 provisioning endpoint for identity providers (Okta, Entra ID, and others). paths: /policy/effective-app-permissions: get: tags: - Effective policy summary: Effective app permissions (workspace) description: > What the enforced policy decides for every tool of one app, in this workspace: the agent's grant composed with organization rules. Without `agentId` the answer is the all-agents baseline; `variesByIdentity` counts the identity-scoped rules it cannot show. Add `connectionId` to reflect one specific account as the injected connection and to get the resource boundary (`orgResources`, `effectiveResources`). Organization rule names are visible to organization admins only; other viewers see `redacted: true` on the provenance. operationId: getEffectiveAppPermissions parameters: - name: provider in: query required: true schema: type: string - name: agentId in: query required: false schema: type: string - name: connectionId in: query required: false schema: type: string responses: '200': description: The per-tool verdicts content: application/json: schema: $ref: '#/components/schemas/EffectiveAppPermissions' '422': description: Missing or invalid `provider` content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: EffectiveAppPermissions: type: object properties: provider: type: string basis: type: object properties: agentId: type: string nullable: true description: Null = the all-agents baseline. credentialAttached: type: boolean scope: type: string enum: - organization - workspace variesByIdentity: type: integer description: Identity-scoped rules the baseline view cannot show. orgResources: allOf: - $ref: '#/components/schemas/SessionPolicy' nullable: true description: >- The organization's resource boundary for this agent + connection. Null when the organization does not restrict, or when no `agentId` + `connectionId` basis was given. effectiveResources: allOf: - $ref: '#/components/schemas/SessionPolicy' nullable: true description: >- What the credential actually reaches — the organization boundary composed with the workspace grant's selection. An empty list means the two do not overlap. groups: type: array items: type: object properties: category: type: string enum: - read - write verdict: $ref: '#/components/schemas/EffectiveToolVerdict' tools: type: array items: type: object properties: toolId: type: string verdict: $ref: '#/components/schemas/EffectiveToolVerdict' rateLimit: type: integer nullable: true rateLimitWindow: type: string nullable: true decidedBy: allOf: - $ref: '#/components/schemas/EffectiveProvenance' nullable: true orgCeiling: type: string enum: - allow - approval - block nullable: true description: >- What the organization level alone decides for this tool — the ceiling a workspace grant cannot exceed. Null when no organization rule touches it. Error: description: > Error responses take one of two shapes depending on the failing layer: route-level validation returns the flat shape (`{ "error": "..." }`), while authentication failures and service errors return the envelope (`{ "error": { "message": "...", "type": "..." } }`). oneOf: - $ref: '#/components/schemas/ErrorFlat' - $ref: '#/components/schemas/ErrorEnvelope' SessionPolicy: description: > Resource scoping for a connection's credential ("Resources"): an object keyed by the provider's resource axis. Exactly one key: `repositories` (GitHub, `owner/repo`), `folders` (Dropbox, absolute paths), or `driveFolders` (Google Drive, folder-id chains). Lists must be non-empty. oneOf: - type: object title: GitHub repositories required: - repositories properties: repositories: type: array minItems: 1 maxItems: 1000 items: type: string additionalProperties: false - type: object title: Dropbox folders required: - folders properties: folders: type: array minItems: 1 maxItems: 100 items: type: string additionalProperties: false - type: object title: Google Drive folders required: - driveFolders properties: driveFolders: type: array minItems: 1 maxItems: 100 items: type: string additionalProperties: false EffectiveToolVerdict: type: string description: > `mixed` means the tool's variants — or a group's tools — disagree. `unmanaged` means no rule applies and the traffic passes through under the enforce-deny carve (no credential attached, or an LLM host). A rate limit is not a verdict: it rides `rateLimit`/`rateLimitWindow` on an `allow`. enum: - allow - approval - block - mixed - unmanaged EffectiveProvenance: type: object description: >- Which rule decided a verdict. An organization rule's name is visible only to organization admins; other viewers get `redacted` set instead, with the name withheld. properties: kind: type: string enum: - rule scope: type: string enum: - organization - workspace redacted: type: boolean rule: type: object properties: logicalId: type: string name: type: string ErrorFlat: type: object description: Flat error shape used by route-level validation. required: - error properties: error: type: string ErrorEnvelope: type: object description: >- Envelope error shape used for authentication failures and service errors. properties: error: type: object properties: message: type: string type: type: string description: >- Error category: `authentication_error`, `invalid_request_error`, `not_found_error`, `validation_error`, `rate_limit_error`, `enterprise_license_required`, or `api_error`. code: type: string description: >- Present on some `401`s (for example when the organization requires SSO). securitySchemes: bearerAuth: type: http scheme: bearer description: >- A workspace API key (`oc_…`) or organization API key (`oc_org_…`). Workspace-scoped endpoints called with an organization key also need `X-Workspace-Id`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.