> ## Documentation Index > Fetch the complete documentation index at: https://docs.plerion.com/llms.txt > Use this file to discover all available pages before exploring further. # Get the permission catalog > Returns every action and action group a role's permissions may name. An action's `level` says whether it belongs in a tenant-scoped or an organization-scoped role, and its `resourceType` says whether it can be narrowed to specific integrations (`integration`) or applies to the whole tenant or organization (`null`). An action group lists everything it grants, including the groups it implies. The catalog is the same for every organization. ## OpenAPI ````yaml /api-reference/organization-openapi.yaml get /v1/organization/permission-catalog openapi: 3.1.0 info: title: Plerion organization API version: v1 termsOfService: https://www.plerion.com/terms-and-conditions contact: name: Plerion Pty Ltd url: https://www.plerion.com/contact-us email: support@plerion.com license: name: Plerion Use License url: https://www.plerion.com/terms-and-conditions description: |- The Plerion organization API manages roles and role assignments for a whole organization: the roles that exist, the permissions each one grants, and which users and user groups hold them. It covers the same lifecycle as the roles and user access pages of the Plerion app, so an automation can grant and revoke access without a person signing in. Requests are authenticated with a Plerion organization API key sent as a bearer token. The organization is resolved from the key, so no request names an organization. Reads work with a key of either access level; writes need a key with the readWrite access level. List responses are `{ "data": [...], "meta": { "cursor": ... } }`. Pass `meta.cursor` back as the `cursor` query parameter to fetch the next page; it is `null` on the last page. Single objects are `{ "data": ... }`. Deletes answer 204 with no body. Errors are `{ "errors": [{ "code": ..., "message": ... }] }`. servers: - url: https://{region}.api.plerion.com description: Production API server - Select your preferred region variables: region: default: au enum: - au - sg1 - in1 - us1 security: - organizationApiKey: [] tags: - name: Roles x-displayName: Roles description: >- Built-in and custom roles. A built-in role's permissions are fixed and shown for reference; a custom role's permissions name actions or action groups from the permission catalog, optionally narrowed to specific integrations. Writes need an organization API key with the readWrite access level. - name: Role assignments x-displayName: Role assignments description: >- Which users and user groups hold which roles. A tenant-scoped role applies to one tenant; an organization-scoped role applies everywhere. Writes need an organization API key with the readWrite access level. - name: Permission catalog x-displayName: Permission catalog description: >- The actions and action groups a role's permissions may name, with the level and resource type of each action. Read this before writing a role. paths: /v1/organization/permission-catalog: get: tags: - Permission catalog summary: Get the permission catalog description: > Returns every action and action group a role's permissions may name. An action's `level` says whether it belongs in a tenant-scoped or an organization-scoped role, and its `resourceType` says whether it can be narrowed to specific integrations (`integration`) or applies to the whole tenant or organization (`null`). An action group lists everything it grants, including the groups it implies. The catalog is the same for every organization. operationId: getOrganizationPermissionCatalog responses: '200': description: The catalog. content: application/json: schema: type: object properties: data: type: object properties: actions: type: array items: $ref: '#/components/schemas/CatalogAction' actionGroups: type: array items: $ref: '#/components/schemas/CatalogActionGroup' example: data: actions: - id: Finding:Read name: View findings description: >- View findings. Finding payloads include asset identifiers and configuration fragments. level: tenant resourceType: integration - id: Organization:Read name: View organization settings description: >- View subscription, usage, organization metrics and organization-wide audit logs. level: organization resourceType: null actionGroups: - id: read-only name: View everything description: All data and configuration, read only actions: - Finding:Read - Alert:Read - Asset:Read '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' components: schemas: CatalogAction: type: object properties: id: type: string description: The value to use in a permission's `actions`. name: type: string description: type: string level: type: string enum: - organization - tenant description: >- Organization-level actions may only appear in organization-scoped roles. resourceType: type: - string - 'null' enum: - integration - null description: >- `integration` when the action can be narrowed with `resources`; `null` when it applies to the whole tenant or organization. required: - id - name - description - level - resourceType CatalogActionGroup: type: object properties: id: type: string description: The value to use in a permission's `actionGroup`. name: type: string description: type: string actions: type: array items: type: string description: Everything the group grants, including the groups it implies. required: - id - name - description - actions Error: type: object properties: errors: type: array items: type: object properties: code: type: string message: type: string field: type: string description: Present on validation errors. required: - code - message required: - errors responses: Unauthorized: description: The organization API key is missing, malformed or revoked. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: >- The key has the read access level and the operation writes, or the key is a tenant API key. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: organizationApiKey: type: http scheme: bearer description: > Plerion organization API key (plerion_oak_…), created by an organization admin in the Plerion app. GET operations work with a key of either access level; POST, PUT and DELETE require the readWrite access level. ````