workos-openapi-agent/skills/authorization/SKILL.md

---
name: authorization-routes
description: Handle 45 OpenAPI operation(s) under /authorization for the authorization route group.
---

# authorization API Routes

Handle 45 OpenAPI operation(s) under /authorization for the authorization route group.

Use the generated operation tools to make real API calls. Do not invent API responses.
If a tool reports missing setup, return the exact setup field name to the caller.
For write, update, or delete operations, state the intended action before calling the tool.

## Operations

### authorization_group_role_assignments_controller_list

- Operation ID: `authorization_group_role_assignments_controller_list`
- Route: `GET /authorization/groups/{group_id}/role_assignments`
- Mode: READ
- Summary: List role assignments for a group
- Parameters:
  - `group_id` in `path` required
  - `before` in `query`
  - `after` in `query`
  - `limit` in `query`
  - `order` in `query`

### authorization_group_role_assignments_controller_create

- Operation ID: `authorization_group_role_assignments_controller_create`
- Route: `POST /authorization/groups/{group_id}/role_assignments`
- Mode: WRITE
- Summary: Assign a role to a group
- Parameters:
  - `group_id` in `path` required
- Body: JSON request body accepted.

### authorization_group_role_assignments_controller_replace_group_role_assignments

- Operation ID: `authorization_group_role_assignments_controller_replace_group_role_assignments`
- Route: `PUT /authorization/groups/{group_id}/role_assignments`
- Mode: WRITE
- Summary: Replace all role assignments for a group
- Parameters:
  - `group_id` in `path` required
- Body: JSON request body accepted.

### authorization_group_role_assignments_controller_remove_group_role_assignments

- Operation ID: `authorization_group_role_assignments_controller_remove_group_role_assignments`
- Route: `DELETE /authorization/groups/{group_id}/role_assignments`
- Mode: WRITE
- Summary: Remove group role assignments by criteria
- Parameters:
  - `group_id` in `path` required
- Body: JSON request body accepted.

### authorization_group_role_assignments_controller_get

- Operation ID: `authorization_group_role_assignments_controller_get`
- Route: `GET /authorization/groups/{group_id}/role_assignments/{role_assignment_id}`
- Mode: READ
- Summary: Get a group role assignment
- Parameters:
  - `group_id` in `path` required
  - `role_assignment_id` in `path` required

### authorization_group_role_assignments_controller_remove_group_role_assignment

- Operation ID: `authorization_group_role_assignments_controller_remove_group_role_assignment`
- Route: `DELETE /authorization/groups/{group_id}/role_assignments/{role_assignment_id}`
- Mode: WRITE
- Summary: Remove a group role assignment
- Parameters:
  - `group_id` in `path` required
  - `role_assignment_id` in `path` required

### authorization_controller_check

- Operation ID: `authorization_controller_check`
- Route: `POST /authorization/organization_memberships/{organization_membership_id}/check`
- Mode: WRITE
- Summary: Check authorization
- Parameters:
  - `organization_membership_id` in `path` required
- Body: JSON request body accepted.

### authorization_controller_list_resources_for_membership

- Operation ID: `authorization_controller_list_resources_for_membership`
- Route: `GET /authorization/organization_memberships/{organization_membership_id}/resources`
- Mode: READ
- Summary: List resources for organization membership
- Parameters:
  - `organization_membership_id` in `path` required
  - `before` in `query`
  - `after` in `query`
  - `limit` in `query`
  - `order` in `query`
  - `permission_slug` in `query` required
  - `parent_resource_id` in `query`
  - `parent_resource_type_slug` in `query`
  - `parent_resource_external_id` in `query`

### authorization_controller_list_effective_permissions

- Operation ID: `authorization_controller_list_effective_permissions`
- Route: `GET /authorization/organization_memberships/{organization_membership_id}/resources/{resource_id}/permissions`
- Mode: READ
- Summary: List effective permissions for an organization membership on a resource
- Parameters:
  - `organization_membership_id` in `path` required
  - `resource_id` in `path` required
  - `before` in `query`
  - `after` in `query`
  - `limit` in `query`
  - `order` in `query`

### authorization_controller_list_effective_permissions_by_external_id

- Operation ID: `authorization_controller_list_effective_permissions_by_external_id`
- Route: `GET /authorization/organization_memberships/{organization_membership_id}/resources/{resource_type_slug}/{external_id}/permissions`
- Mode: READ
- Summary: List effective permissions for an organization membership on a resource by external ID
- Parameters:
  - `organization_membership_id` in `path` required
  - `resource_type_slug` in `path` required
  - `external_id` in `path` required
  - `before` in `query`
  - `after` in `query`
  - `limit` in `query`
  - `order` in `query`

### authorization_role_assignments_controller_list_role_assignments

- Operation ID: `authorization_role_assignments_controller_list_role_assignments`
- Route: `GET /authorization/organization_memberships/{organization_membership_id}/role_assignments`
- Mode: READ
- Summary: List role assignments
- Parameters:
  - `organization_membership_id` in `path` required
  - `before` in `query`
  - `after` in `query`
  - `limit` in `query`
  - `order` in `query`
  - `resource_id` in `query`
  - `resource_external_id` in `query`
  - `resource_type_slug` in `query`

### authorization_role_assignments_controller_assign_role

- Operation ID: `authorization_role_assignments_controller_assign_role`
- Route: `POST /authorization/organization_memberships/{organization_membership_id}/role_assignments`
- Mode: WRITE
- Summary: Assign a role
- Parameters:
  - `organization_membership_id` in `path` required
- Body: JSON request body accepted.

### authorization_role_assignments_controller_remove_role_by_criteria

- Operation ID: `authorization_role_assignments_controller_remove_role_by_criteria`
- Route: `DELETE /authorization/organization_memberships/{organization_membership_id}/role_assignments`
- Mode: WRITE
- Summary: Remove a role assignment
- Parameters:
  - `organization_membership_id` in `path` required
- Body: JSON request body accepted.

### authorization_role_assignments_controller_remove_role_by_id

- Operation ID: `authorization_role_assignments_controller_remove_role_by_id`
- Route: `DELETE /authorization/organization_memberships/{organization_membership_id}/role_assignments/{role_assignment_id}`
- Mode: WRITE
- Summary: Remove a role assignment by ID
- Parameters:
  - `organization_membership_id` in `path` required
  - `role_assignment_id` in `path` required

### authorization_organization_roles_controller_create

- Operation ID: `authorization_organization_roles_controller_create`
- Route: `POST /authorization/organizations/{organizationId}/roles`
- Mode: WRITE
- Summary: Create a custom role
- Parameters:
  - `organizationId` in `path` required
- Body: JSON request body accepted.

### authorization_organization_roles_controller_list

- Operation ID: `authorization_organization_roles_controller_list`
- Route: `GET /authorization/organizations/{organizationId}/roles`
- Mode: READ
- Summary: List custom roles
- Parameters:
  - `organizationId` in `path` required

### authorization_organization_roles_controller_get

- Operation ID: `authorization_organization_roles_controller_get`
- Route: `GET /authorization/organizations/{organizationId}/roles/{slug}`
- Mode: READ
- Summary: Get a custom role
- Parameters:
  - `organizationId` in `path` required
  - `slug` in `path` required

### authorization_organization_roles_controller_update

- Operation ID: `authorization_organization_roles_controller_update`
- Route: `PATCH /authorization/organizations/{organizationId}/roles/{slug}`
- Mode: WRITE
- Summary: Update a custom role
- Parameters:
  - `organizationId` in `path` required
  - `slug` in `path` required
- Body: JSON request body accepted.

### authorization_organization_roles_controller_delete

- Operation ID: `authorization_organization_roles_controller_delete`
- Route: `DELETE /authorization/organizations/{organizationId}/roles/{slug}`
- Mode: WRITE
- Summary: Delete a custom role
- Parameters:
  - `organizationId` in `path` required
  - `slug` in `path` required

### authorization_organization_role_permissions_controller_set_permissions

- Operation ID: `authorization_organization_role_permissions_controller_set_permissions`
- Route: `PUT /authorization/organizations/{organizationId}/roles/{slug}/permissions`
- Mode: WRITE
- Summary: Set permissions for a custom role
- Parameters:
  - `organizationId` in `path` required
  - `slug` in `path` required
- Body: JSON request body accepted.

### authorization_organization_role_permissions_controller_add_permission

- Operation ID: `authorization_organization_role_permissions_controller_add_permission`
- Route: `POST /authorization/organizations/{organizationId}/roles/{slug}/permissions`
- Mode: WRITE
- Summary: Add a permission to a custom role
- Parameters:
  - `organizationId` in `path` required
  - `slug` in `path` required
- Body: JSON request body accepted.

### authorization_organization_role_permissions_controller_remove_permission

- Operation ID: `authorization_organization_role_permissions_controller_remove_permission`
- Route: `DELETE /authorization/organizations/{organizationId}/roles/{slug}/permissions/{permissionSlug}`
- Mode: WRITE
- Summary: Remove a permission from a custom role
- Parameters:
  - `organizationId` in `path` required
  - `slug` in `path` required
  - `permissionSlug` in `path` required

### authorization_resources_by_external_id_controller_get_by_external_id

- Operation ID: `authorization_resources_by_external_id_controller_get_by_external_id`
- Route: `GET /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}`
- Mode: READ
- Summary: Get a resource by external ID
- Parameters:
  - `organization_id` in `path` required
  - `resource_type_slug` in `path` required
  - `external_id` in `path` required

### authorization_resources_by_external_id_controller_update_by_external_id

- Operation ID: `authorization_resources_by_external_id_controller_update_by_external_id`
- Route: `PATCH /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}`
- Mode: WRITE
- Summary: Update a resource by external ID
- Parameters:
  - `organization_id` in `path` required
  - `resource_type_slug` in `path` required
  - `external_id` in `path` required
- Body: JSON request body accepted.

### authorization_resources_by_external_id_controller_delete_by_external_id

- Operation ID: `authorization_resources_by_external_id_controller_delete_by_external_id`
- Route: `DELETE /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}`
- Mode: WRITE
- Summary: Delete an authorization resource by external ID
- Parameters:
  - `organization_id` in `path` required
  - `resource_type_slug` in `path` required
  - `external_id` in `path` required
  - `cascade_delete` in `query`

### authorization_resources_by_external_id_controller_list_organization_memberships_

- Operation ID: `authorization_resources_by_external_id_controller_list_organization_memberships_`
- Route: `GET /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}/organization_memberships`
- Mode: READ
- Summary: List memberships for a resource by external ID
- Parameters:
  - `organization_id` in `path` required
  - `resource_type_slug` in `path` required
  - `external_id` in `path` required
  - `before` in `query`
  - `after` in `query`
  - `limit` in `query`
  - `order` in `query`
  - `permission_slug` in `query` required
  - `assignment` in `query`

### authorization_role_assignments_controller_list_role_assignments_for_resource_by_

- Operation ID: `authorization_role_assignments_controller_list_role_assignments_for_resource_by_`
- Route: `GET /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}/role_assignments`
- Mode: READ
- Summary: List role assignments for a resource by external ID
- Parameters:
  - `organization_id` in `path` required
  - `resource_type_slug` in `path` required
  - `external_id` in `path` required
  - `before` in `query`
  - `after` in `query`
  - `limit` in `query`
  - `order` in `query`
  - `role_slug` in `query`

### authorization_permissions_controller_list

- Operation ID: `authorization_permissions_controller_list`
- Route: `GET /authorization/permissions`
- Mode: READ
- Summary: List permissions
- Parameters:
  - `before` in `query`
  - `after` in `query`
  - `limit` in `query`
  - `order` in `query`

### authorization_permissions_controller_create

- Operation ID: `authorization_permissions_controller_create`
- Route: `POST /authorization/permissions`
- Mode: WRITE
- Summary: Create a permission
- Body: JSON request body accepted.

### authorization_permissions_controller_find

- Operation ID: `authorization_permissions_controller_find`
- Route: `GET /authorization/permissions/{slug}`
- Mode: READ
- Summary: Get a permission
- Parameters:
  - `slug` in `path` required

### authorization_permissions_controller_update

- Operation ID: `authorization_permissions_controller_update`
- Route: `PATCH /authorization/permissions/{slug}`
- Mode: WRITE
- Summary: Update a permission
- Parameters:
  - `slug` in `path` required
- Body: JSON request body accepted.

### authorization_permissions_controller_delete

- Operation ID: `authorization_permissions_controller_delete`
- Route: `DELETE /authorization/permissions/{slug}`
- Mode: WRITE
- Summary: Delete a permission
- Parameters:
  - `slug` in `path` required

### authorization_resources_controller_list

- Operation ID: `authorization_resources_controller_list`
- Route: `GET /authorization/resources`
- Mode: READ
- Summary: List resources
- Parameters:
  - `before` in `query`
  - `after` in `query`
  - `limit` in `query`
  - `order` in `query`
  - `organization_id` in `query`
  - `resource_type_slug` in `query`
  - `resource_external_id` in `query`
  - `parent_resource_id` in `query`
  - `parent_resource_type_slug` in `query`
  - `parent_external_id` in `query`

### authorization_resources_controller_create

- Operation ID: `authorization_resources_controller_create`
- Route: `POST /authorization/resources`
- Mode: WRITE
- Summary: Create an authorization resource
- Body: JSON request body accepted.

### authorization_resources_controller_find_by_id

- Operation ID: `authorization_resources_controller_find_by_id`
- Route: `GET /authorization/resources/{resource_id}`
- Mode: READ
- Summary: Get a resource
- Parameters:
  - `resource_id` in `path` required

### authorization_resources_controller_update

- Operation ID: `authorization_resources_controller_update`
- Route: `PATCH /authorization/resources/{resource_id}`
- Mode: WRITE
- Summary: Update a resource
- Parameters:
  - `resource_id` in `path` required
- Body: JSON request body accepted.

### authorization_resources_controller_delete

- Operation ID: `authorization_resources_controller_delete`
- Route: `DELETE /authorization/resources/{resource_id}`
- Mode: WRITE
- Summary: Delete an authorization resource
- Parameters:
  - `resource_id` in `path` required
  - `cascade_delete` in `query`

### authorization_resources_controller_list_organization_memberships_for_resource

- Operation ID: `authorization_resources_controller_list_organization_memberships_for_resource`
- Route: `GET /authorization/resources/{resource_id}/organization_memberships`
- Mode: READ
- Summary: List organization memberships for resource
- Parameters:
  - `resource_id` in `path` required
  - `before` in `query`
  - `after` in `query`
  - `limit` in `query`
  - `order` in `query`
  - `permission_slug` in `query` required
  - `assignment` in `query`

### authorization_role_assignments_controller_list_role_assignments_for_resource

- Operation ID: `authorization_role_assignments_controller_list_role_assignments_for_resource`
- Route: `GET /authorization/resources/{resource_id}/role_assignments`
- Mode: READ
- Summary: List role assignments for a resource
- Parameters:
  - `resource_id` in `path` required
  - `before` in `query`
  - `after` in `query`
  - `limit` in `query`
  - `order` in `query`
  - `role_slug` in `query`

### authorization_roles_controller_create

- Operation ID: `authorization_roles_controller_create`
- Route: `POST /authorization/roles`
- Mode: WRITE
- Summary: Create an environment role
- Body: JSON request body accepted.

### authorization_roles_controller_list

- Operation ID: `authorization_roles_controller_list`
- Route: `GET /authorization/roles`
- Mode: READ
- Summary: List environment roles

### authorization_roles_controller_get

- Operation ID: `authorization_roles_controller_get`
- Route: `GET /authorization/roles/{slug}`
- Mode: READ
- Summary: Get an environment role
- Parameters:
  - `slug` in `path` required

### authorization_roles_controller_update

- Operation ID: `authorization_roles_controller_update`
- Route: `PATCH /authorization/roles/{slug}`
- Mode: WRITE
- Summary: Update an environment role
- Parameters:
  - `slug` in `path` required
- Body: JSON request body accepted.

### authorization_role_permissions_controller_set_permissions

- Operation ID: `authorization_role_permissions_controller_set_permissions`
- Route: `PUT /authorization/roles/{slug}/permissions`
- Mode: WRITE
- Summary: Set permissions for an environment role
- Parameters:
  - `slug` in `path` required
- Body: JSON request body accepted.

### authorization_role_permissions_controller_add_permission

- Operation ID: `authorization_role_permissions_controller_add_permission`
- Route: `POST /authorization/roles/{slug}/permissions`
- Mode: WRITE
- Summary: Add a permission to an environment role
- Parameters:
  - `slug` in `path` required
- Body: JSON request body accepted.