List permissions
Returns every permission a property manager can be granted, with a human-readable name, description, and category. Use it to build a permission picker or to look up the exact strings to send when creating an API key.
Authorization
AuthorizationstringrequiredQuery parameters
categorystringReturn only permissions whose category matches this exactly, spelling and capitalisation included. Take the value from a category in an unfiltered response.
searchstringReturn only permissions whose name or description contains this text, ignoring case. It does not search code.
Response
200 · Every matching permission. Not paged — the whole list comes back at once
codestringThe resource:action string to send in an API key's permissions list.
namestringA short label for a picker, for example Read Leases.
descriptionstringA sentence saying what holding this permission lets someone do.
categorystringThe resource this permission belongs to, for grouping a picker. Also the value the category filter matches.
portalstringWhich portal the permission belongs to. Always CompanyPortal here.
401 · The access token is missing, expired, or invalid
This is a fixed catalogue of names and descriptions with no company or user data in it, so it needs no permission of its own — any signed-in property manager can read it. It is also scoped by the route: only permissions a property manager can hold are reachable here, never a tenant's, an owner's, a vendor's, or MagicDoor's internal ones.
The list is the same for everyone. It is not narrowed to what the caller holds, so it will show permissions you cannot grant. Asking for one of those when creating an API key returns 403, naming the ones at fault.