> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onyx.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Permission Registry

> [!NOTE]
>
> **Enterprise Edition Feature**
>
> This feature requires an Enterprise plan. [View plans](https://docs.onyx.app/admins/billing/overview.md)
> or [contact sales](https://onyx.app/contact-sales) to learn more.

> [!NOTE]
>
> **Required permission:** Admin (`admin`).


## OpenAPI

````yaml GET /manage/admin/permissions/registry
openapi: 3.1.0
info:
  title: Onyx API
  description: Onyx API for AI-powered enterprise search and chat
  version: Development
servers:
  - url: https://cloud.onyx.app/api
security: []
paths:
  /manage/admin/permissions/registry:
    get:
      tags:
        - public
      summary: Get Permission Registry
      operationId: get_permission_registry
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PermissionRegistryEntry'
                title: >-
                  Response Get Permission Registry Manage Admin Permissions
                  Registry Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - BearerAuth: []
components:
  schemas:
    PermissionRegistryEntry:
      properties:
        id:
          type: string
          title: Id
        display_name:
          type: string
          title: Display Name
        description:
          type: string
          title: Description
        permissions:
          items:
            $ref: '#/components/schemas/Permission'
          type: array
          title: Permissions
        group:
          type: integer
          title: Group
        default_group_toggleable:
          type: boolean
          title: Default Group Toggleable
          description: Whether the row is offered on the Basic group's page.
          readOnly: true
      type: object
      required:
        - id
        - display_name
        - description
        - permissions
        - group
        - default_group_toggleable
      title: PermissionRegistryEntry
      description: |-
        A UI-facing permission row served by GET /admin/permissions/registry.

        The field_validator ensures non-toggleable permissions (BASIC_ACCESS,
        FULL_ADMIN_PANEL_ACCESS, READ_*) can never appear in the registry.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    Permission:
      type: string
      enum:
        - basic
        - read:connectors
        - read:document_sets
        - read:agents
        - read:users
        - read:user_groups
        - read:search
        - read:chat
        - write:chat
        - read:admin
        - generate:image
        - use:llm_gateway
        - add:agents
        - manage:agents
        - manage:document_sets
        - manage:connectors
        - manage:llms
        - read:agent_analytics
        - manage:actions
        - manage:skills
        - read:query_history
        - manage:user_groups
        - create:user_api_keys
        - manage:service_account_api_keys
        - manage:bots
        - craft_sandbox
        - admin
      title: Permission
      description: >-
        Permission tokens for group-based authorization and PAT scoping.

        full_admin_panel_access is an override — if present, any permission

        check passes.


        The read:*/write:* "API-surface scopes" are coarser than the capability

        tokens: they name request surfaces (search, chat, admin-read) rather
        than

        admin capabilities. They are implied by basic / admin (so they're never

        granted directly to a group) and exist primarily to scope Personal
        Access

        Tokens.
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: Authorization header with Bearer token

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.