Skip to content
Origin Cloud Docs

IAM / Task

Check access

Updated · 3 min read

Look up who you are and which roles you hold, list the platform's permissions, and check whether a principal has a permission on a resource.

On this page8 sections

You can check access before you act instead of handling a permission error afterward. This is useful in automation that needs to know whether a call will succeed, and when you investigate why a request was refused.

Before you begin

Check who you are

Show the signed-in user. The userId is what others use in user:<user-id> to grant you a role.

terminal
origin iam current-user

Example output (illustrative):

JSON
{
  "iam": {
    "currentUser": {
      "userId": "3f6e1c2a-8b4d-4e5f-9a1b-2c3d4e5f6a7b",
      "firstName": "Jane",
      "lastName": "Doe",
      "enabled": true,
      "email": "jane@example.com",
      "emailVerified": true
    }
  }
}

List your own role assignments

List every role assignment you hold, across all organizations you belong to. A projectId of null means the assignment is org-wide.

terminal
origin iam current-user-grants

List another principal’s roles

List every member of the organization with its role URNs, and find the principal in the output.

terminal
origin iam list-members --org-id <org-id>

To see each assignment’s project scope, list the principal’s grants. Each grant shows its project scope:

terminal
origin iam principal-grants --org-id <org-id> --principal <principal>

In the API, the orgRoleAssignments query returns the same scopes for the whole organization. See Manage organization members.

Find a permission key

List every permission the platform defines, with its service, resource type and action.

terminal
origin iam permissions

For the permissions each role grants, see Built-in roles.

Check a permission on a resource

  1. Get the URN of the resource you want to check. Every resource returns its URN in its urn field.

  2. Check whether the principal holds the permission on that resource.

    terminal
    origin iam has-permission \
  --principal service_account:<service-account-id> \
  --permission-key compute.instance.launch \
  --on-resource-urn <resource-urn>

  3. Read the result: true means a request needing that permission on that resource is allowed; false means it would be refused.

The check applies the same rules as a real request, including project scope. See How a request is authorized.

Using the API

The queries are currentUser, currentUserGrants, orgMembers, orgRoleAssignments, permissions and hasPermission, all in the iam namespace.

GraphQL
query {
  iam {
    hasPermission(input: {
      principal: "user:<user-id>"
      permissionKey: "network.vpc.create"
      onResourceUrn: "<resource-urn>"
    })
  }
}