Access Check

The runtime authorization endpoint. Ask one question: can this subject perform this action on this resource? Get one answer.

How it works

Pass a subject, resource, action, and scope. The evaluator resolves every policy for that subject, walks all role hierarchies, checks permissions, and returns one boolean. Single-digit milliseconds.

Single check

cURL

curl -X POST https://api.wardenauthz.com/v1/access/has-access \
  -H "x-api-key: YOUR_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "subjectId": "subject-alice",
    "resource": "documents",
    "action": "write",
    "scopeId": "workspace-eng"
  }'

{
  "allowed": true,
  "subjectId": "subject-alice",
  "resource": "documents",
  "action": "write",
  "scopeId": "workspace-eng"
}

TypeScript

const result = await warden.hasAccess({
  subjectId: 'subject-alice',
  resource: 'documents',
  action: 'write',
  scopeId: 'workspace-eng',
})
if (result.allowed) {
  // proceed
}

Bulk check

Check multiple permissions in one call:

cURL

curl -X POST https://api.wardenauthz.com/v1/access/has-access-bulk \
  -H "x-api-key: YOUR_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "subjectId": "subject-alice",
    "scopeId": "workspace-eng",
    "checks": [
      { "resource": "documents", "action": "read" },
      { "resource": "documents", "action": "write" },
      { "resource": "billing", "action": "read" }
    ]
  }'

{
  "results": [
    { "resource": "documents", "action": "read", "allowed": true },
    { "resource": "documents", "action": "write", "allowed": true },
    { "resource": "billing", "action": "read", "allowed": false }
  ]
}

Edge cases

• No policies exist for the subject: Returns { allowed: false }. No error — the subject simply has no permissions.
• Subject has policies but no role grants the action: Returns { allowed: false }. The evaluator checks all roles, finds no match.
• Deny overrides allow: If a single deny permission matches, the result is { allowed: false } regardless of how many allow permissions match.

In the dashboard

[Screenshot: Access Check page with subject, resource, action fields and a result badge showing allowed/denied]

Navigate to Access Check. Enter a subject ID, resource, action, and scope. Use it to debug policies — verify that a user actually has the permissions you think they have.