Caller's effective per-resource access map. Returned in the same shape the dashboard's usePermissions hook consumes so mobile + web can share guard logic.
Get caller's effective permissions
Returns the caller's effective per-resource access map plus an OWNER bypass flag. Mobile clients call this once per app launch (and on cache-miss) and memoise the result locally so per-screen guards do not round-trip on every navigation.
The same shape powers the dashboard's usePermissions hook — names kept aligned so client code can share the same mental model across the two surfaces.
When to re-fetch:
- On app launch (post-login)
- After receiving any
403 access deniedresponse (the user's role may have just changed) - When the in-app cache TTL expires (typical: 5 minutes)
Get caller's effective permissions › Responses
Effective permission map.
successRBAC envelope returned to the caller. is_owner=true short-circuits all per-resource checks. rbac_enabled=false means the server is currently bypassing RBAC enforcement (kill-switch) — UI clients should ALSO bypass their restriction screens so the kill-switch is comprehensive across server + UI.