# Check access

Look up who you are and which roles you hold, list the platform's permissions, and check whether a principal has a permission on a resource.

You can check access before you act instead of handling a permission error afterward. This is useful in automation that needs to know whether a call will succeed, and when you investigate why a request was refused.

## Before you begin [#before-you-begin]

<BeforeYouBegin>

- To see your own identity, grants and the list of permissions: any signed-in user or service account.
- To list another principal’s roles: an org-wide `roles/owner` or `roles/viewer` assignment.
- To check a permission with `has-permission`: `roles/owner` that covers the resource you check.

</BeforeYouBegin>

## Check who you are [#check-who-you-are]

Show the signed-in user. The `userId` is what others use in `user:<user-id>` to grant you a role.

```sh
origin iam current-user
```

Example output (illustrative):

```json
{
  "iam": {
    "currentUser": {
      "userId": "3f6e1c2a-8b4d-4e5f-9a1b-2c3d4e5f6a7b",
      "firstName": "Jane",
      "lastName": "Doe",
      "enabled": true,
      "email": "jane@example.com",
      "emailVerified": true
    }
  }
}
```

## List your own role assignments [#list-your-own-role-assignments]

List every role assignment you hold, across all organizations you belong to. A `projectId` of `null` means the assignment is org-wide.

```sh
origin iam current-user-grants
```

## List another principal’s roles [#list-another-principals-roles]

List every member of the organization with its role URNs, and find the principal in the output.

```sh
origin iam list-members --org-id <org-id>
```

To see each assignment’s project scope, list the principal’s grants. Each grant shows its project scope:

```sh
origin iam principal-grants --org-id <org-id> --principal <principal>
```

In the API, the `orgRoleAssignments` query returns the same scopes for the whole organization. See [Manage organization members](/docs/iam/manage-members).

## Find a permission key [#find-a-permission-key]

List every permission the platform defines, with its service, resource type and action.

```sh
origin iam permissions
```

For the permissions each role grants, see [Built-in roles](/docs/iam/roles).

## Check a permission on a resource [#check-a-permission-on-a-resource]

1. Get the URN of the resource you want to check. Every resource returns its URN in its `urn` field.
1. Check whether the principal holds the permission on that resource.

   ```sh
   origin iam has-permission \
     --principal service_account:<service-account-id> \
     --permission-key compute.instance.launch \
     --on-resource-urn <resource-urn>
   ```

1. Read the result: `true` means a request needing that permission on that resource is allowed; `false` means it would be refused.

The check applies the same rules as a real request, including project scope. See [How a request is authorized](/docs/iam/access-model#how-a-request-is-authorized).

## Using the API [#using-the-api]

The queries are `currentUser`, `currentUserGrants`, `orgMembers`, `orgRoleAssignments`, `permissions` and `hasPermission`, all in the `iam` namespace.

```graphql
query {
  iam {
    hasPermission(input: {
      principal: "user:<user-id>"
      permissionKey: "network.vpc.create"
      onResourceUrn: "<resource-urn>"
    })
  }
}
```

## Related [#related]

- [Access model](/docs/iam/access-model)
- [Built-in roles](/docs/iam/roles)
- [`origin iam` commands](/docs/iam/reference/cli)