Permission rules

Ask what someone would see

Answers 'what would this user see' without granting anything: the rows and fields a set of groups gets on a table, and the same answer per group so you can tell which group is doing the granting.

POST/v1/apps/{appId}/rules/simulate

Request

curl --request POST \
  --url 'https://studio.gtable.app/v1/apps/<appId>/rules/simulate' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "groups": [
    "<string>"
  ],
  "tableId": "<string>",
  "op": "read"
}'

import json
import requests

url = "https://studio.gtable.app/v1/apps/<appId>/rules/simulate"
headers = {
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
}
payload = json.loads("{\"groups\":[\"<string>\"],\"tableId\":\"<string>\",\"op\":\"read\"}")

response = requests.request("POST", url, headers=headers, json=payload)
print(response.json())

const response = await fetch("https://studio.gtable.app/v1/apps/<appId>/rules/simulate", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "groups": [
      "<string>"
    ],
    "tableId": "<string>",
    "op": "read"
  }),
});

const data = await response.json();
console.log(data);

<?php
$client = curl_init();

curl_setopt($client, CURLOPT_URL, "https://studio.gtable.app/v1/apps/<appId>/rules/simulate");
curl_setopt($client, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($client, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
]);
curl_setopt($client, CURLOPT_POSTFIELDS, "{\"groups\":[\"<string>\"],\"tableId\":\"<string>\",\"op\":\"read\"}");
curl_setopt($client, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($client);
curl_close($client);
echo $response;

package main

import (
  "bytes"
  "fmt"
  "io"
  "net/http"
)

func main() {
  req, _ := http.NewRequest("POST", "https://studio.gtable.app/v1/apps/<appId>/rules/simulate", bytes.NewBuffer([]byte("{\"groups\":[\"<string>\"],\"tableId\":\"<string>\",\"op\":\"read\"}")))
  req.Header.Set("Authorization", "Bearer <token>")
  req.Header.Set("Content-Type", "application/json")
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  data, _ := io.ReadAll(res.Body)
  fmt.Println(string(data))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

var request = HttpRequest.newBuilder(URI.create("https://studio.gtable.app/v1/apps/<appId>/rules/simulate"))
    .header("Authorization", "Bearer <token>")
    .header("Content-Type", "application/json")
    .method("POST", HttpRequest.BodyPublishers.ofString("{\"groups\":[\"<string>\"],\"tableId\":\"<string>\",\"op\":\"read\"}"))
    .build();

var response = HttpClient.newHttpClient().send(
    request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

require 'net/http'
require 'json'

uri = URI("https://studio.gtable.app/v1/apps/<appId>/rules/simulate")
request = Net::HTTP::Post.new(uri)
request["Authorization"] = "Bearer <token>"
request["Content-Type"] = "application/json"
request.body = "{\"groups\":[\"<string>\"],\"tableId\":\"<string>\",\"op\":\"read\"}"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end

puts response.body

application/json

{
  "data": {
    "allowed": true,
    "readableFields": [
      "<string>"
    ],
    "writableFields": [
      "<string>"
    ],
    "matchedRows": 123,
    "byGroup": [
      {
        "group": "<string>",
        "allowed": true,
        "readableFields": [
          "<string>"
        ]
      }
    ]
  }
}

{
  "error": {
    "code": "not_found",
    "message": "<string>",
    "details": {}
  }
}

Use this before changing rules, not after.

Requires the schema:read scope. Operation rules.simulate. MCP tool rules_simulate. CLI, once published: gtable rules simulate.

Path parameters

Name	Type	Required	Description
`appId`	string	yes

Headers

Name	Type	Required	Description
`Idempotency-Key`	string	no	Any unique string. Sending the same key with the same request again returns the first response (marked `Idempotency-Replayed: true`) instead of running it twice. Reusing it for a different request is refused with 409. Kept for 24 hours. Up to 255 characters.

Request body

Field	Type	Required
`groups`	string[]	yes
`tableId`	string	yes
`op`	“read” or “create” or “update” or “delete”	yes

Response

application/json

Success

dataobjectrequired

Show child attributes

allowedbooleanrequired

readableFieldsstring[]required

writableFieldsstring[]required

matchedRowsintegerrequired

byGroupobject[]required

curl --request POST \ --url 'https://studio.gtable.app/v1/apps/<appId>/rules/simulate' \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "groups": [ "<string>" ], "tableId": "<string>", "op": "read" }'

{ "data": { "allowed": true, "readableFields": [ "<string>" ], "writableFields": [ "<string>" ], "matchedRows": 123, "byGroup": [ { "group": "<string>", "allowed": true, "readableFields": [ "<string>" ] } ] } }

Ask what someone would see

Path parameters

Headers

Request body

Response

Use these docs with your AI tools

Query these docs via MCP

Query these docs over HTTP

Read these docs as Markdown