Permission groups

List permission groups

List permission groups in an organization with cursor pagination. Requires organization Admin or owner access and active Access Control. Workspace API keys return `403`; use a personal API key or scoped OAuth token. OAuth scope: `api:read`.

GET/api/v2/organizations/{organizationId}/permission-groups

List permission groups in an organization with cursor pagination. Requires organization Admin or owner access and active Access Control. Workspace API keys return 403; use a personal API key or scoped OAuth token.

OAuth scope: api:read.

Authentication

Send a personal or workspace API key in X-API-Key. See key types and access; operations that reject workspace keys say so in their description.

Send X-API-Key in the request header.

Alternatively

Send a Sim OAuth access token in Authorization: Bearer. See OAuth authentication and scopes.

Authorization: Bearer YOUR_ACCESS_TOKEN

Required scopes: api:read

OAuth flows

json

{
  "authorizationCode": {
    "authorizationUrl": "https://www.sim.ai/api/auth/oauth2/authorize",
    "tokenUrl": "https://www.sim.ai/api/auth/oauth2/token",
    "refreshUrl": "https://www.sim.ai/api/auth/oauth2/token",
    "scopes": {
      "api:read": "Read your workspaces, workflows, files, tables, and logs",
      "api:write": "Read, create, change, run, and delete resources in your workspaces",
      "offline_access": "Stay signed in without asking again"
    }
  }
}

OAuth scope: api:read.

Path parameters

organizationIdstringRequired

Organization that owns the permission groups.

minLength: 1

Query parameters

searchstring

Case-insensitive substring match against the group name.

minLength: 1
maxLength: 200

sortBystring

Field used to sort the result. Do not rely on case-insensitive ordering when sorting by name.

default: createdAt
enum: ["name","createdAt","updatedAt"]

sortOrderstring

Sort direction.

default: desc
enum: ["asc","desc"]

limitinteger

Maximum permission groups to return per page. Must be a whole number from 1 to 100. Defaults to 50.

default: 50
minimum: 1
maximum: 100

cursorstring

Opaque cursor from the previous page. Send it back with the same sort and filters; only limit may change. Change anything else and pagination must restart without a cursor.

minLength: 1

Responses

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

A page of permission groups with resolved settings.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

A page of permission groups with resolved settings.

2 fields

dataarrayRequired

Items in the current page.

Schema details

Array itemobject

An organization permission group and its resolved settings for human callers. Workspace API keys use their workspace role and operation policy without a user permission group.

11 fields

idstringRequired

Permission group identifier.

organizationIdstringRequired

Organization that owns the group.

namestringRequired

Group name, unique within the organization.

descriptionvalueRequired

Optional description of the group.

Schema details

Any of

Option 1string

Option 2null

configobjectRequired

Resolved group settings. True disables a boolean capability; null allowlists permit every value and empty allowlists permit none. defaultAgentModel selects the default for new Agent blocks without restricting model selection.

45 fields

allowedIntegrationsvalueRequired

Integrations and blocks are limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

Option 2null

allowedModelProvidersvalueRequired

Model providers are limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

Option 2null

deniedModelsarrayRequired

Models listed in this list are blocked.

default: []

Schema details

Array itemstring

deniedToolsarrayRequired

Integration tools listed in this list are blocked.

default: []

Schema details

Array itemstring

hideTraceSpansbooleanRequired

Withhold per-block trace spans from logs and from the API.

hideKnowledgeBaseTabbooleanRequired

Revoke the Knowledge Base module. Members cannot open, search, or query any knowledge base.

hideTablesTabbooleanRequired

Revoke the Tables module. Members cannot read or write any table.

hideCopilotbooleanRequired

Revoke Chat. Members cannot ask Sim to build or edit anything.

hideIntegrationsTabbooleanRequired

Revoke integration connections. Members cannot view, add, or remove an OAuth connection.

hideSecretsTabbooleanRequired

Revoke secrets. Members cannot read, add, or change a workspace environment variable.

hideApiKeysTabbooleanRequired

Revoke workspace API keys. Members cannot list, create, or revoke one.

hideInboxTabbooleanRequired

Revoke the Sim Mailer inbox. Members cannot read or send mail.

hideFilesTabbooleanRequired

Revoke the Files module. Members cannot list, upload, or download workspace files.

disableMcpToolsbooleanRequired

Block agents from calling MCP tools.

disableCustomToolsbooleanRequired

Block agents from calling user-defined custom tools.

disableSkillsbooleanRequired

Block agents from loading skills.

disableInvitationsbooleanRequired

Prevent inviting anyone to a workspace or to the organization.

disablePublicApibooleanRequired

Revoke public API access. Calls to a deployed workflow are refused.

disablePublicFileSharingbooleanRequired

Revoke public file sharing. Members cannot create a share link.

allowedFileShareAuthTypesvalueRequired

Public file-share authentication is limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

enum: ["public","password","email","sso"]

Option 2null

hideDeployApibooleanRequired

Prevent deploying a workflow as an API endpoint.

hideDeployMcpbooleanRequired

Prevent exposing a workflow as an MCP server.

hideDeployChatbotbooleanRequired

Prevent deploying a workflow as a chat.

allowedChatDeployAuthTypesvalueRequired

Chat deployment authentication is limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

enum: ["public","password","email","sso"]

Option 2null

disablePersonalApiKeysbooleanRequired

Prevent members from using a personal API key against this workspace.

disableLogExportbooleanRequired

Prevent downloading execution logs as a CSV.

hideCostInfobooleanRequired

Withhold execution cost. Logs and member exports omit cost and token spend; organization-level data drains, configurable by org admins only, are not projected.

disableKnowledgeBaseCreationbooleanRequired

Prevent creating knowledge bases, leaving existing ones queryable.

disableKnowledgeBaseFileUploadbooleanRequired

Prevent uploading local documents, leaving sanctioned connectors as the only source.

allowedKnowledgeConnectorsvalueRequired

Knowledge base connectors are limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

Option 2null

disableTableCreationbooleanRequired

Prevent creating tables, leaving existing ones usable.

disableTableExportbooleanRequired

Prevent downloading a whole table as CSV or JSON.

disableBulkFileDownloadbooleanRequired

Prevent downloading folders as an archive.

disablePersonalCredentialsbooleanRequired

Prevent connecting personal credentials, leaving only workspace-shared ones.

disableWorkspaceCreationbooleanRequired

Prevent creating new workspaces, which no existing group would govern. Read from the organization's default group, because creating a workspace names none.

hideOrgMemberDirectorybooleanRequired

Withhold the member directory. Members cannot see the names or email addresses of other members. Read from the organization's default group, because the directory belongs to the organization and names no workspace.

disableCliAccessbooleanRequired

Prevent approving a CLI login or using Sim CLI OAuth tokens for the public API. A login naming one of this group's workspaces is refused; an account-level login names none, so it is read from the organization's default group.

disableWebhookTriggersbooleanRequired

Prevent making a workflow reachable from an inbound webhook.

disableToolAutoApprovalbooleanRequired

Prevent silencing a tool confirmation, so every call is confirmed again.

hideSandboxesTabbooleanRequired

Revoke the Sandboxes module. Members cannot view, create, or change a workspace sandbox.

disableOAuthAppAccessbooleanRequired

Prevent OAuth apps from accessing this group's workspaces. The organization's default group also governs authorizing apps and refreshing their access.

disableKnowledgeBaseExportbooleanRequired

Prevent downloading a whole knowledge base as an archive.

deniedPartialAccessProjectIssuesarrayRequired

Issues in the listed Projects are unavailable to teammates without access to every active environment.

default: []

Schema details

Array itemstring

minLength: 1
maxLength: 255

defaultAgentModelvalueRequired

Default model for new Agent blocks. Null uses the platform default.

default: null

Schema details

Any of

Option 1string

minLength: 1

Option 2null

deniedAccessRequestsarrayRequired

Access requests are unavailable for the listed canonical target keys when access is restricted.

default: []

Schema details

Array itemstring

minLength: 1
maxLength: 1024

Additional properties are not allowed.

isDefaultbooleanRequired

Whether this is the organization fallback group. It governs a human caller with no applicable workspace-specific group; its own membership assignments do not limit its audience. Organization-level actions use the default group.

membershipModestringRequired

When no explicit assignments exist, an inherit group governs every member in its targeted workspaces. An empty explicit group, including a SCIM-managed group, governs nobody.

workspaceIdsarrayRequired

Workspaces governed by a non-default group. Empty for the default group.

Schema details

Array itemstring

createdBystringRequired

User who created the group.

createdAtstringRequired

When the group was created.

format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$

updatedAtstringRequired

When the group was last updated.

format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$

Additional properties are not allowed.

nextCursorvalueRequired

Opaque cursor for the next page. Send it back as cursor; null means there are no more pages. Do not construct a cursor yourself.

Schema details

Any of

Option 1string

Option 2null

Additional properties are not allowed.

Response example 1

json

{
  "data": [
    {
      "id": "group-123",
      "organizationId": "org-123",
      "name": "Restricted",
      "description": null,
      "config": {
        "allowedIntegrations": null,
        "allowedModelProviders": null,
        "deniedModels": [],
        "deniedTools": [],
        "hideTraceSpans": false,
        "hideKnowledgeBaseTab": false,
        "hideTablesTab": false,
        "hideCopilot": false,
        "hideIntegrationsTab": false,
        "hideSecretsTab": false,
        "hideApiKeysTab": false,
        "hideInboxTab": false,
        "hideFilesTab": false,
        "disableMcpTools": false,
        "disableCustomTools": false,
        "disableSkills": false,
        "disableInvitations": false,
        "disablePublicApi": false,
        "disablePublicFileSharing": false,
        "allowedFileShareAuthTypes": null,
        "hideDeployApi": false,
        "hideDeployMcp": false,
        "hideDeployChatbot": false,
        "allowedChatDeployAuthTypes": null,
        "disablePersonalApiKeys": false,
        "disableLogExport": false,
        "hideCostInfo": false,
        "disableKnowledgeBaseCreation": false,
        "disableKnowledgeBaseFileUpload": false,
        "allowedKnowledgeConnectors": null,
        "disableTableCreation": false,
        "disableTableExport": false,
        "disableBulkFileDownload": false,
        "disablePersonalCredentials": false,
        "disableWorkspaceCreation": false,
        "hideOrgMemberDirectory": false,
        "disableCliAccess": false,
        "disableWebhookTriggers": false,
        "disableToolAutoApproval": false,
        "hideSandboxesTab": false,
        "disableOAuthAppAccess": false,
        "disableKnowledgeBaseExport": false,
        "deniedPartialAccessProjectIssues": [],
        "defaultAgentModel": null,
        "deniedAccessRequests": []
      },
      "isDefault": false,
      "membershipMode": "inherit",
      "workspaceIds": [
        "workspace-123"
      ],
      "createdBy": "admin-123",
      "createdAt": "2026-06-01T09:00:00.000Z",
      "updatedAt": "2026-06-01T09:00:00.000Z"
    }
  ],
  "nextCursor": null
}

Response headers

X-RateLimit-Limitinteger

Maximum requests allowed in the current window.

minimum: 0
maximum: 9007199254740991

X-RateLimit-Remaininginteger

Requests remaining in the current window.

minimum: 0
maximum: 9007199254740991

X-RateLimit-Resetstring

ISO 8601 timestamp when the current rate-limit window resets.

format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$

The request is invalid. This includes a query parameter sent with no value (?limit=, ?search=), which is rejected rather than read as zero, empty, or the parameter default — omit the parameter instead.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "Invalid request"
  }
}

The API credential is missing or invalid.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication required"
  }
}

The caller lacks the rights this operation requires. When the cause is one a caller can act on, error.details.code names it. A resource in a workspace the caller cannot reach at all answers 404 instead, so absence and denial are indistinguishable.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "FORBIDDEN",
    "message": "Insufficient workspace permissions",
    "details": {
      "code": "INSUFFICIENT_WORKSPACE_ROLE"
    }
  }
}

The requested resource was not found.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "NOT_FOUND",
    "message": "Not found"
  }
}

The caller exceeded the request rate limit.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "RATE_LIMITED",
    "message": "API rate limit exceeded",
    "details": {
      "retryAfter": "2026-01-01T00:00:30.000Z"
    }
  }
}

Response headers

Retry-Afterinteger

Seconds to wait before retrying, sent on 429 and 503. Add jitter rather than retrying at exactly this offset.

minimum: 0
maximum: 9007199254740991

An unexpected server error occurred.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "INTERNAL_ERROR",
    "message": "Internal server error"
  }
}

A required service is temporarily unavailable. When present, Retry-After gives the minimum seconds to wait; add jitter before retrying. Check operation-specific guidance before repeating a change after an uncertain response.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "SERVICE_UNAVAILABLE",
    "message": "Service temporarily unavailable"
  }
}

Response headers

Retry-Afterinteger

Seconds to wait before retrying, sent on 429 and 503. Add jitter rather than retrying at exactly this offset.

minimum: 0
maximum: 9007199254740991

Suggest an edit

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

Request

curl --request GET 'https://www.sim.ai/api/v2/organizations/string/permission-groups' \
  --header 'X-API-Key: YOUR_API_KEY'

const response = await fetch("https://www.sim.ai/api/v2/organizations/string/permission-groups", {
  "method": "GET",
  "headers": {
    "X-API-Key": "YOUR_API_KEY"
  }
});
if (!response.ok) throw new Error(`HTTP ${response.status}`);
const result = await response.json();

import requests

response = requests.request(
    "GET",
    "https://www.sim.ai/api/v2/organizations/string/permission-groups",
    headers={
  "X-API-Key": "YOUR_API_KEY"
},
)
response.raise_for_status()
result = response.json()

package main

import (
  "io"
  "net/http"
  "os"
)

func check(err error) {
  if err != nil { panic(err) }
}

func must[T any](value T, err error) T {
  check(err)
  return value
}

func main() {

  request := must(http.NewRequest("GET", "https://www.sim.ai/api/v2/organizations/string/permission-groups", nil))
  request.Header.Set("X-API-Key", "YOUR_API_KEY")
  response := must(http.DefaultClient.Do(request))
  defer response.Body.Close()
  if response.StatusCode >= 400 { panic(response.Status) }
  must(io.Copy(os.Stdout, response.Body))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
  public static void main(String[] args) throws Exception {
    var builder = HttpRequest.newBuilder(URI.create("https://www.sim.ai/api/v2/organizations/string/permission-groups"));
    builder.header("X-API-Key", "YOUR_API_KEY");
    var request = builder.method("GET", HttpRequest.BodyPublishers.noBody()).build();
    var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofInputStream());
    try (var body = response.body()) {
      if (response.statusCode() >= 400) throw new IllegalStateException("HTTP " + response.statusCode());
      body.transferTo(System.out);
    }
  }
}

using System;
using System.IO;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();
using var request = new HttpRequestMessage(new HttpMethod("GET"), "https://www.sim.ai/api/v2/organizations/string/permission-groups");
request.Headers.TryAddWithoutValidation("X-API-Key", "YOUR_API_KEY");
using var response = await client.SendAsync(request, HttpCompletionOption.ResponseHeadersRead);
response.EnsureSuccessStatusCode();
await response.Content.CopyToAsync(Console.OpenStandardOutput());

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

Response

{
  "data": [
    {
      "id": "group-123",
      "organizationId": "org-123",
      "name": "Restricted",
      "description": null,
      "config": {
        "allowedIntegrations": null,
        "allowedModelProviders": null,
        "deniedModels": [],
        "deniedTools": [],
        "hideTraceSpans": false,
        "hideKnowledgeBaseTab": false,
        "hideTablesTab": false,
        "hideCopilot": false,
        "hideIntegrationsTab": false,
        "hideSecretsTab": false,
        "hideApiKeysTab": false,
        "hideInboxTab": false,
        "hideFilesTab": false,
        "disableMcpTools": false,
        "disableCustomTools": false,
        "disableSkills": false,
        "disableInvitations": false,
        "disablePublicApi": false,
        "disablePublicFileSharing": false,
        "allowedFileShareAuthTypes": null,
        "hideDeployApi": false,
        "hideDeployMcp": false,
        "hideDeployChatbot": false,
        "allowedChatDeployAuthTypes": null,
        "disablePersonalApiKeys": false,
        "disableLogExport": false,
        "hideCostInfo": false,
        "disableKnowledgeBaseCreation": false,
        "disableKnowledgeBaseFileUpload": false,
        "allowedKnowledgeConnectors": null,
        "disableTableCreation": false,
        "disableTableExport": false,
        "disableBulkFileDownload": false,
        "disablePersonalCredentials": false,
        "disableWorkspaceCreation": false,
        "hideOrgMemberDirectory": false,
        "disableCliAccess": false,
        "disableWebhookTriggers": false,
        "disableToolAutoApproval": false,
        "hideSandboxesTab": false,
        "disableOAuthAppAccess": false,
        "disableKnowledgeBaseExport": false,
        "deniedPartialAccessProjectIssues": [],
        "defaultAgentModel": null,
        "deniedAccessRequests": []
      },
      "isDefault": false,
      "membershipMode": "inherit",
      "workspaceIds": [
        "workspace-123"
      ],
      "createdBy": "admin-123",
      "createdAt": "2026-06-01T09:00:00.000Z",
      "updatedAt": "2026-06-01T09:00:00.000Z"
    }
  ],
  "nextCursor": null
}

{
  "error": {
    "code": "FORBIDDEN",
    "message": "Insufficient workspace permissions",
    "details": {
      "code": "INSUFFICIENT_WORKSPACE_ROLE"
    }
  }
}

{
  "error": {
    "code": "RATE_LIMITED",
    "message": "API rate limit exceeded",
    "details": {
      "retryAfter": "2026-01-01T00:00:30.000Z"
    }
  }
}

OpenAPI document ↗Download the specification

Authentication

Path parameters

Query parameters

Responses

200

Response example 1

Response headers

400

401

403

404

429

Response headers

500

503

Response headers