Read the authoring capability that governs this API key
Returns the authoring capability grant that currently governs the calling API key — the grant to name in authoring_capability_id — without its grantor signature, plus root_capability_id: the grant its chain starts at (equal to id unless the capability was carried to a successor draft by a supersession). Reachable only by a credential holding the authoring:capability scope and no policies:read / policies:write, whose capability grants policy.read. A broad key and a human session receive 403 FORBIDDEN; a capability that is missing, revoked or exhausted (anywhere in its chain), expired, not yet valid or fails integrity receives the gate’s 403 AUTHORING_CAPABILITY_* code; a key holding policies:read or policies:write beside the carrier scope receives 403 AUTHORING_CAPABILITY_OBJECT_MISMATCH. Writes nothing.
Authorizations
MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).
Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.
Response
The authoring capability grant that currently governs the calling API key, without its grantor signature.
The authoring capability grant that currently governs the calling API key, without its grantor signature.
grant policy.read, draft.edit, draft.validate, review.submit, review.withdraw_request, review.retrieve, case.preview ^[0-9a-f]{64}$Derived, not stored: the grant this chain starts at. Equal to id for a grant a human issued.
What the agent DECLARES about itself, recorded on the capability at issuance. It is inside the capability digest preimage and therefore covered by the grantor signature, so it cannot be edited after issuance without breaking the record. That is the whole of the property: it does not establish that the named model exists, that it is the model that authenticated, or that it produced anything. Never read by any admission decision.
Present only on a grant the server minted when a draft supersession carried an authoring capability to the successor draft: the grant this one continues. Inside the capability digest preimage.