Skip to main content
GET
Read the authoring capability that governs this API key

Authorizations

Authorization
string
header
required

MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).

X-MeshQu-Tenant-Id
string
header
required

Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.

Response

The authoring capability grant that currently governs the calling API key, without its grantor signature.

The authoring capability grant that currently governs the calling API key, without its grantor signature.

id
string<uuid>
required
tenant_id
string<uuid>
required
record_type
required
Available options:
grant
key_id
string<uuid>
required
revokes_capability_id
string<uuid> | null
required
granted_by
string
required
grant_authority
string
required
policy_id
string<uuid>
required
policy_version_id
string<uuid>
required
policy_version_number
integer
required
allowed_actions
enum<string>[]
required
Available options:
policy.read,
draft.edit,
draft.validate,
review.submit,
review.withdraw_request,
review.retrieve,
case.preview
source_item_ids
string[]
required
valid_from
string<date-time>
required
valid_until
string<date-time>
required
issued_at
string<date-time>
required
capability_digest
string
required
Pattern: ^[0-9a-f]{64}$
created_at
string<date-time>
required
root_capability_id
string<uuid>
required

Derived, not stored: the grant this chain starts at. Equal to id for a grant a human issued.

agent_declaration
object

What the agent DECLARES about itself, recorded on the capability at issuance. It is inside the capability digest preimage and therefore covered by the grantor signature, so it cannot be edited after issuance without breaking the record. That is the whole of the property: it does not establish that the named model exists, that it is the model that authenticated, or that it produced anything. Never read by any admission decision.

succeeds_capability_id
string<uuid>

Present only on a grant the server minted when a draft supersession carried an authoring capability to the successor draft: the grant this one continues. Inside the capability digest preimage.