> ## Documentation Index > Fetch the complete documentation index at: https://docs.plerion.com/llms.txt > Use this file to discover all available pages before exploring further. # Get the permission catalog > Returns every action and action group a role's permissions may name. An action's `level` says whether it belongs in a tenant-scoped or an organization-scoped role, and its `resourceType` says whether it can be narrowed to specific integrations (`integration`) or applies to the whole tenant or organization (`null`). An action group lists everything it grants, including the groups it implies. The catalog is the same for every organization. Requires an organization API key with read access. ## OpenAPI ````yaml /api-reference/organization-openapi.yaml get /v1/organization/permission-catalog openapi: 3.1.0 info: title: Plerion organization API version: v1 termsOfService: https://www.plerion.com/terms-and-conditions contact: name: Plerion Pty Ltd url: https://www.plerion.com/contact-us email: support@plerion.com license: name: Plerion Use License url: https://www.plerion.com/terms-and-conditions description: |- The Plerion organization API manages roles, role assignments and preferences for a whole organization: the roles that exist, the permissions each one grants, which users and user groups hold them, and the home dashboard and navigation each user or user group gets in a tenant. It covers the same lifecycle as the roles, user access and dashboard assignment pages of the Plerion app, so an automation can grant access and set defaults without a person signing in. Requests are authenticated with a Plerion organization API key sent as a bearer token. The organization is resolved from the key, so no request names an organization. List responses are `{ "data": [...], "meta": { "cursor": ... } }`. Pass `meta.cursor` back as the `cursor` query parameter to fetch the next page; it is `null` on the last page. Single objects are `{ "data": ... }`. Deletes answer 204 with no body. Errors are `{ "errors": [{ "code": ..., "message": ... }] }`. servers: - url: https://{region}.api.plerion.com description: Production API server - Select your preferred region variables: region: default: au enum: - au - sg1 - in1 - us1 security: - organizationApiKey: [] tags: - name: Roles x-displayName: Roles description: >- Built-in and custom roles. A built-in role's permissions are fixed and shown for reference; a custom role's permissions name actions or action groups from the permission catalog, optionally narrowed to specific integrations. - name: Role assignments x-displayName: Role assignments description: >- Which users and user groups hold which roles. A tenant-scoped role applies to one tenant; an organization-scoped role applies everywhere. - name: Permission catalog x-displayName: Permission catalog description: >- The actions and action groups a role's permissions may name, with the level and resource type of each action. Read this before writing a role. - name: Preferences x-displayName: Preferences description: >- The home dashboard and sidebar navigation a user or a user group gets in one tenant. A user's own setting wins, then the most recently updated of their user groups, then the tenant default (home dashboard only). Each setting is a sub-resource: PUT replaces it, DELETE clears it so the next level applies. paths: /v1/organization/permission-catalog: get: tags: - Permission catalog summary: Get the permission catalog description: > Returns every action and action group a role's permissions may name. An action's `level` says whether it belongs in a tenant-scoped or an organization-scoped role, and its `resourceType` says whether it can be narrowed to specific integrations (`integration`) or applies to the whole tenant or organization (`null`). An action group lists everything it grants, including the groups it implies. The catalog is the same for every organization. Requires an organization API key with read access. operationId: getOrganizationPermissionCatalog responses: '200': description: The catalog. content: application/json: schema: type: object properties: data: type: object properties: actions: type: array items: $ref: '#/components/schemas/CatalogAction' actionGroups: type: array items: $ref: '#/components/schemas/CatalogActionGroup' example: data: actions: - id: Finding:Read name: View findings description: >- View findings. Finding payloads include asset identifiers and configuration fragments. level: tenant resourceType: integration - id: Organization:Read name: View organization settings description: >- View subscription, usage, organization metrics and organization-wide audit logs. level: organization resourceType: null actionGroups: - id: read-only name: View everything description: All data and configuration, read only actions: - Finding:Read - Alert:Read - Asset:Read '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' components: schemas: CatalogAction: type: object properties: id: type: string description: The value to use in a permission's `actions`. name: type: string description: type: string level: type: string enum: - organization - tenant description: >- Organization-level actions may only appear in organization-scoped roles. resourceType: type: - string - 'null' enum: - integration - null description: >- `integration` when the action can be narrowed with `resources`; `null` when it applies to the whole tenant or organization. required: - id - name - description - level - resourceType CatalogActionGroup: type: object properties: id: type: string description: The value to use in a permission's `actionGroup`. name: type: string description: type: string actions: type: array items: type: string description: Everything the group grants, including the groups it implies. required: - id - name - description - actions Error: type: object properties: errors: type: array items: type: object properties: code: type: string message: type: string field: type: string description: Present on validation errors. required: - code - message required: - errors responses: Unauthorized: description: The organization API key is missing, malformed or revoked. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: >- The key has the read access level and the operation writes, or the key is a tenant API key. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: organizationApiKey: type: http scheme: bearer description: > Plerion organization API key (plerion_oak_…), created by an organization admin in the Plerion app. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.