<!-- llms.txt: https://workos.com/llms.txt -->

# Access checks

Access check endpoints help you answer authorization questions: "Can this user perform this action on this resource?" and "What resources can this user access?"

## Check authorization

Check if an organization membership has a specific permission on a resource. This endpoint considers all sources of access:

- Direct role assignments on the resource
- Inherited permissions from parent resources
- Organization-scoped roles

You must provide either `resource_id` or both `resource_external_id` and `resource_type_slug` to identify the resource.

> **Note:** For org-wide permissions, you can check the JWT directly without making an API
> call. Use this endpoint for resource-specific permission checks.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request POST \
  --url "https://api.workos.com/authorization/organization_memberships/om_01HXYZ123456789ABCDEFGHIJ/check" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "permission_slug": "posts:create",
        "resource_id": "resource_01HXYZ123456789ABCDEFGHIJ",
        "resource_type_slug": "document"
    }
BODY
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

// Option 1: by resource ID
const result = await workos.authorization.check({
  organizationMembershipId: 'om_01HXYZ123456789ABCDEFGHIJ',
  permissionSlug: 'project:edit',
  resourceId: 'authz_resource_01HXYZ123456789ABCDEFGH',
});

// Option 2: by external ID + type
const resultByExternal = await workos.authorization.check({
  organizationMembershipId: 'om_01HXYZ123456789ABCDEFGHIJ',
  permissionSlug: 'project:edit',
  resourceExternalId: 'proj-456',
  resourceTypeSlug: 'project',
});

console.log(result.authorized); // true or false
```

```rb language="ruby" title="Request" tab="1"
# workos:manual - do not regenerate; see scripts/generate-sdk-snippets.ts
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

# Option 1: by resource ID
WorkOS.client.authorization.check(
  organization_membership_id: "om_01HXYZ123456789ABCDEFGHIJ",
  permission_slug: "project:edit",
  resource_id: "authz_resource_01HXYZ123456789ABCDEFGH"
)

# Option 2: by external ID + type
WorkOS.client.authorization.check(
  organization_membership_id: "om_01HXYZ123456789ABCDEFGHIJ",
  permission_slug: "project:edit",
  resource_external_id: "proj-456",
  resource_type_slug: "project"
)
```

```py language="python" title="Request" tab="1"
# workos:manual - do not regenerate; see scripts/generate-sdk-snippets.ts
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

# Option 1: by resource ID
client.authorization.check(
    organization_membership_id="om_01HXYZ123456789ABCDEFGHIJ",
    permission_slug="project:edit",
    resource_id="authz_resource_01HXYZ123456789ABCDEFGH",
)

# Option 2: by external ID + type
client.authorization.check(
    organization_membership_id="om_01HXYZ123456789ABCDEFGHIJ",
    permission_slug="project:edit",
    resource_external_id="proj-456",
    resource_type_slug="project",
)
```

```go language="go" title="Request" tab="1"
// workos:manual - do not regenerate; see scripts/generate-sdk-snippets.ts
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	// Option 1: by resource ID
	_, err := client.Authorization().Check(context.Background(), "om_01HXYZ123456789ABCDEFGHIJ", &workos.AuthorizationCheckParams{
		PermissionSlug: "project:edit",
		ResourceID:     "authz_resource_01HXYZ123456789ABCDEFGH",
	})
	if err != nil {
		panic(err)
	}

	// Option 2: by external ID + type
	_, err = client.Authorization().Check(context.Background(), "om_01HXYZ123456789ABCDEFGHIJ", &workos.AuthorizationCheckParams{
		PermissionSlug:     "project:edit",
		ResourceExternalID: "proj-456",
		ResourceTypeSlug:   "project",
	})
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

// workos:manual - do not regenerate; see scripts/generate-sdk-snippets.ts

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

// Option 1: by resource ID
$workos
    ->authorization()
    ->check(
        organizationMembershipId: "om_01HXYZ123456789ABCDEFGHIJ",
        permissionSlug: "project:edit",
        resourceId: "authz_resource_01HXYZ123456789ABCDEFGH",
    );

// Option 2: by external ID + type
$workos
    ->authorization()
    ->check(
        organizationMembershipId: "om_01HXYZ123456789ABCDEFGHIJ",
        permissionSlug: "project:edit",
        resourceExternalId: "proj-456",
        resourceTypeSlug: "project",
    );
```

```java language="java" title="Request" tab="1"
// workos:manual - do not regenerate; see scripts/generate-sdk-snippets.ts
import com.workos.WorkOS;
import com.workos.authorization.AuthorizationApi.CheckOptions;

WorkOS workos = new WorkOS("sk_example_123456789");

// Option 1: by resource ID
CheckOptions optionsById = CheckOptions.builder()
                               .permissionSlug("project:edit")
                               .resourceId("authz_resource_01HXYZ123456789ABCDEFGH")
                               .build();

workos.authorization.check("om_01HXYZ123456789ABCDEFGHIJ", optionsById);

// Option 2: by external ID + type
CheckOptions optionsByExternalId = CheckOptions.builder()
                                       .permissionSlug("project:edit")
                                       .resourceExternalId("proj-456")
                                       .resourceTypeSlug("project")
                                       .build();

workos.authorization.check("om_01HXYZ123456789ABCDEFGHIJ", optionsByExternalId);
```

```cs language="dotnet" title="Request" tab="1"
// workos:manual - do not regenerate; see scripts/generate-sdk-snippets.ts
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

// Option 1: by resource ID
await client.Authorization.CheckAsync("om_01HXYZ123456789ABCDEFGHIJ", new AuthorizationCheckOptions {
    PermissionSlug = "project:edit",
    ResourceId = "authz_resource_01HXYZ123456789ABCDEFGH",
});

// Option 2: by external ID + type
await client.Authorization.CheckAsync("om_01HXYZ123456789ABCDEFGHIJ", new AuthorizationCheckOptions {
    PermissionSlug = "project:edit",
    ResourceExternalId = "proj-456",
    ResourceTypeSlug = "project",
});
```

```rust language="rust" title="Request" tab="1"
// workos:manual - do not regenerate; see scripts/generate-sdk-snippets.ts
use workos::Client;
use workos::authorization::CheckParams;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    // Option 1: by resource ID
    let _result = client
        .authorization()
        .check(
            "om_01HXYZ123456789ABCDEFGHIJ",
            CheckParams {
                permission_slug: "project:edit".into(),
                resource_id: Some("authz_resource_01HXYZ123456789ABCDEFGH".into()),
                ..Default::default()
            },
        )
        .await?;

    // Option 2: by external ID + type
    let _result_by_external_id = client
        .authorization()
        .check(
            "om_01HXYZ123456789ABCDEFGHIJ",
            CheckParams {
                permission_slug: "project:edit".into(),
                resource_external_id: Some("proj-456".into()),
                resource_type_slug: Some("project".into()),
                ..Default::default()
            },
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "authorized": true
}
```

:::

## List effective permissions for an organization membership on a resource by external ID

Returns all permissions the organization membership effectively has on a resource identified by its external ID, including permissions inherited through roles assigned to ancestor resources. Results are not filtered by the resource type: a permission is returned whenever a check for it on this resource would be authorized, and each permission is labeled with the resource type it is declared on.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/authorization/organization_memberships/om_01HXYZ123456789ABCDEFGHIJ/resources/document/doc-456/permissions" \
  --header "Authorization: Bearer sk_example_123456789"
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.authorization.list_effective_permissions_by_external_id(
  organization_membership_id: "om_01HXYZ123456789ABCDEFGHIJ",
  resource_type_slug: "document",
  external_id: "doc-456"
)
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.authorization.list_effective_permissions_by_external_id(
    organization_membership_id="om_01HXYZ123456789ABCDEFGHIJ",
    resource_type_slug="document",
    external_id="doc-456",
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Authorization().ListEffectivePermissionsByExternalID(context.Background(), "om_01HXYZ123456789ABCDEFGHIJ", "document", "doc-456")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->authorization()
    ->listEffectivePermissionsByExternalId(
        organizationMembershipId: "om_01HXYZ123456789ABCDEFGHIJ",
        resourceTypeSlug: "document",
        externalId: "doc-456",
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.authorization.listEffectivePermissionsByExternalId(
    "om_01HXYZ123456789ABCDEFGHIJ", "document", "doc-456");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Authorization.ListEffectivePermissionsByExternalIdAsync("om_01HXYZ123456789ABCDEFGHIJ", "document",
                                                                     "doc-456");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .authorization()
        .list_effective_permissions_by_external_id(
            "om_01HXYZ123456789ABCDEFGHIJ",
            "document",
            "doc-456"
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "list",
  "data": [
    {
      "object": "permission",
      "id": "perm_01HXYZ123456789ABCDEFGHIJ",
      "slug": "documents:read",
      "name": "View Documents",
      "description": "Allows viewing document contents",
      "system": false,
      "resource_type_slug": "workspace",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "list_metadata": {
    "before": "perm_01HXYZ123456789ABCDEFGHIJ",
    "after": "perm_01HXYZ987654321KJIHGFEDCBA"
  }
}
```

:::

## List effective permissions for an organization membership on a resource

Returns all permissions the organization membership effectively has on a resource, including permissions inherited through roles assigned to ancestor resources. Results are not filtered by the resource type: a permission is returned whenever a check for it on this resource would be authorized, and each permission is labeled with the resource type it is declared on.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/authorization/organization_memberships/om_01HXYZ123456789ABCDEFGHIJ/resources/authz_resource_01HXYZ123456789ABCDEFGHIJ/permissions" \
  --header "Authorization: Bearer sk_example_123456789"
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.authorization.list_effective_permissions(
  organization_membership_id: "om_01HXYZ123456789ABCDEFGHIJ",
  resource_id: "authz_resource_01HXYZ123456789ABCDEFGHIJ"
)
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.authorization.list_effective_permissions(
    organization_membership_id="om_01HXYZ123456789ABCDEFGHIJ",
    resource_id="authz_resource_01HXYZ123456789ABCDEFGHIJ",
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Authorization().ListEffectivePermissions(context.Background(), "om_01HXYZ123456789ABCDEFGHIJ", "authz_resource_01HXYZ123456789ABCDEFGHIJ")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->authorization()
    ->listEffectivePermissions(
        organizationMembershipId: "om_01HXYZ123456789ABCDEFGHIJ",
        resourceId: "authz_resource_01HXYZ123456789ABCDEFGHIJ",
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.authorization.listEffectivePermissions(
    "om_01HXYZ123456789ABCDEFGHIJ", "authz_resource_01HXYZ123456789ABCDEFGHIJ");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Authorization.ListEffectivePermissionsAsync("om_01HXYZ123456789ABCDEFGHIJ",
                                                         "authz_resource_01HXYZ123456789ABCDEFGHIJ");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .authorization()
        .list_effective_permissions(
            "om_01HXYZ123456789ABCDEFGHIJ",
            "authz_resource_01HXYZ123456789ABCDEFGHIJ"
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "list",
  "data": [
    {
      "object": "permission",
      "id": "perm_01HXYZ123456789ABCDEFGHIJ",
      "slug": "documents:read",
      "name": "View Documents",
      "description": "Allows viewing document contents",
      "system": false,
      "resource_type_slug": "workspace",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "list_metadata": {
    "before": "perm_01HXYZ123456789ABCDEFGHIJ",
    "after": "perm_01HXYZ987654321KJIHGFEDCBA"
  }
}
```

:::

## List memberships for a resource by external ID

Returns all organization memberships that have a specific permission on a resource, using the resource's external ID. This is useful for answering "Who can access this resource?" when you only have the external ID.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/authorization/organizations/org_01EHZNVPK3SFK441A1RGBFSHRT/resources/project/proj-456/organization_memberships" \
  --header "Authorization: Bearer sk_example_123456789" \
  -G \
  -d permission_slug=project:read
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

const memberships =
  await workos.authorization.listMembershipsForResourceByExternalId({
    organizationId: 'org_01ABC123',
    resourceTypeSlug: 'project',
    externalId: 'proj-456',
    permissionSlug: 'project:edit',
    assignment: 'direct',
    limit: 10,
  });
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.authorization.list_memberships_for_resource_by_external_id(
  organization_id: "org_01EHZNVPK3SFK441A1RGBFSHRT",
  resource_type_slug: "project",
  external_id: "proj-456",
  permission_slug: "project:read"
)
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.authorization.list_memberships_for_resource_by_external_id(
    organization_id="org_01EHZNVPK3SFK441A1RGBFSHRT",
    resource_type_slug="project",
    external_id="proj-456",
    permission_slug="project:read",
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Authorization().ListMembershipsForResourceByExternalID(context.Background(), "org_01EHZNVPK3SFK441A1RGBFSHRT", "project", "proj-456", &workos.AuthorizationListMembershipsForResourceByExternalIDParams{
		PermissionSlug: "project:read",
	})
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->authorization()
    ->listMembershipsForResourceByExternalId(
        organizationId: "org_01EHZNVPK3SFK441A1RGBFSHRT",
        resourceTypeSlug: "project",
        externalId: "proj-456",
        permissionSlug: "project:read",
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;
import com.workos.authorization.AuthorizationApi.ListMembershipsForResourceByExternalIdOptions;

WorkOS workos = new WorkOS("sk_example_123456789");

ListMembershipsForResourceByExternalIdOptions options =
    ListMembershipsForResourceByExternalIdOptions.builder()
        .permissionSlug("project:read")
        .build();

workos.authorization.listMembershipsForResourceByExternalId(
    "org_01EHZNVPK3SFK441A1RGBFSHRT", "project", "proj-456", options);
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Authorization.ListMembershipsForResourceByExternalIdAsync(
    "org_01EHZNVPK3SFK441A1RGBFSHRT", "project", "proj-456",
    new AuthorizationListMembershipsForResourceByExternalIdOptions {
        PermissionSlug = "project:read",
    });
```

```rust language="rust" title="Request" tab="1"
use workos::Client;
use workos::authorization::ListMembershipsForResourceByExternalIdParams;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .authorization()
        .list_memberships_for_resource_by_external_id(
            "org_01EHZNVPK3SFK441A1RGBFSHRT",
            "project",
            "proj-456",
            ListMembershipsForResourceByExternalIdParams {
                permission_slug: "project:read".into(),
                ..Default::default()
            }
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "id": "om_01HXYZ123456789ABCDEFGHIJ",
      "user_id": "user_01E4ZCR3C56J083X43JQXF3JK5",
      "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT",
      "status": "active",
      "directory_managed": false,
      "organization_name": "Acme Corp",
      "custom_attributes": {
        "department": "Engineering",
        "title": "Developer Experience Engineer",
        "location": "Brooklyn"
      },
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z",
      "user": {
        "object": "user",
        "id": "user_01E4ZCR3C56J083X43JQXF3JK5",
        "first_name": "Marcelina",
        "last_name": "Davis",
        "name": "Marcelina Davis",
        "profile_picture_url": "https://workoscdn.com/images/v1/123abc",
        "email": "marcelina.davis@example.com",
        "email_verified": true,
        "external_id": "f1ffa2b2-c20b-4d39-be5c-212726e11222",
        "metadata": {
          "timezone": "America/New_York"
        },
        "last_sign_in_at": "2025-06-25T19:07:33.155Z",
        "locale": "en-US",
        "created_at": "2026-01-15T12:00:00.000Z",
        "updated_at": "2026-01-15T12:00:00.000Z"
      }
    }
  ],
  "list_metadata": {
    "before": "om_01HXYZ123456789ABCDEFGHIJ",
    "after": "om_01HXYZ987654321KJIHGFEDCBA"
  }
}
```

:::

## List memberships for a resource

Returns all organization memberships that have a specific permission on a resource. This is useful for answering "Who can access this resource?"

You can filter by assignment type to distinguish between direct assignments (role assigned directly on the resource) and indirect assignments (permission inherited from a parent resource).

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/authorization/resources/authz_resource_01HXYZ123456789ABCDEFGHIJ/organization_memberships" \
  --header "Authorization: Bearer sk_example_123456789" \
  -G \
  -d permission_slug=document:edit
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

const memberships = await workos.authorization.listMembershipsForResource({
  resourceId: 'authz_resource_01HXYZ123456789ABCDEFGH',
  permissionSlug: 'project:edit',
  assignment: 'direct',
  limit: 10,
  order: 'desc',
});
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.authorization.list_memberships_for_resource(
  resource_id: "authz_resource_01HXYZ123456789ABCDEFGHIJ",
  permission_slug: "document:edit"
)
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.authorization.list_memberships_for_resource(
    resource_id="authz_resource_01HXYZ123456789ABCDEFGHIJ",
    permission_slug="document:edit",
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Authorization().ListMembershipsForResource(context.Background(), "authz_resource_01HXYZ123456789ABCDEFGHIJ", &workos.AuthorizationListMembershipsForResourceParams{
		PermissionSlug: "document:edit",
	})
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->authorization()
    ->listMembershipsForResource(
        resourceId: "authz_resource_01HXYZ123456789ABCDEFGHIJ",
        permissionSlug: "document:edit",
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;
import com.workos.authorization.AuthorizationApi.ListMembershipsForResourceOptions;

WorkOS workos = new WorkOS("sk_example_123456789");

ListMembershipsForResourceOptions options =
    ListMembershipsForResourceOptions.builder().permissionSlug("document:edit").build();

workos.authorization.listMembershipsForResource(
    "authz_resource_01HXYZ123456789ABCDEFGHIJ", options);
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Authorization.ListMembershipsForResourceAsync("authz_resource_01HXYZ123456789ABCDEFGHIJ",
                                                           new AuthorizationListMembershipsForResourceOptions {
                                                               PermissionSlug = "document:edit",
                                                           });
```

```rust language="rust" title="Request" tab="1"
use workos::Client;
use workos::authorization::ListMembershipsForResourceParams;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .authorization()
        .list_memberships_for_resource(
            "authz_resource_01HXYZ123456789ABCDEFGHIJ",
            ListMembershipsForResourceParams {
                permission_slug: "document:edit".into(),
                ..Default::default()
            }
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "id": "om_01HXYZ123456789ABCDEFGHIJ",
      "user_id": "user_01E4ZCR3C56J083X43JQXF3JK5",
      "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT",
      "status": "active",
      "directory_managed": false,
      "organization_name": "Acme Corp",
      "custom_attributes": {
        "department": "Engineering",
        "title": "Developer Experience Engineer",
        "location": "Brooklyn"
      },
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z",
      "user": {
        "object": "user",
        "id": "user_01E4ZCR3C56J083X43JQXF3JK5",
        "first_name": "Marcelina",
        "last_name": "Davis",
        "name": "Marcelina Davis",
        "profile_picture_url": "https://workoscdn.com/images/v1/123abc",
        "email": "marcelina.davis@example.com",
        "email_verified": true,
        "external_id": "f1ffa2b2-c20b-4d39-be5c-212726e11222",
        "metadata": {
          "timezone": "America/New_York"
        },
        "last_sign_in_at": "2025-06-25T19:07:33.155Z",
        "locale": "en-US",
        "created_at": "2026-01-15T12:00:00.000Z",
        "updated_at": "2026-01-15T12:00:00.000Z"
      }
    }
  ],
  "list_metadata": {
    "before": "om_01HXYZ123456789ABCDEFGHIJ",
    "after": "om_01HXYZ987654321KJIHGFEDCBA"
  }
}
```

:::

## List resources for an organization membership

Returns all child resources of a parent resource where the organization membership has a specific permission. This is useful for resource discovery—answering "What projects can this user access in this workspace?"

You must provide either `parent_resource_id` or both `parent_resource_external_id` and `parent_resource_type_slug` to identify the parent resource.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/authorization/organization_memberships/om_01HXYZ123456789ABCDEFGHIJ/resources" \
  --header "Authorization: Bearer sk_example_123456789" \
  -G \
  -d permission_slug=project:read
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

// Option 1: by parent resource ID
const resources = await workos.authorization.listResourcesForMembership({
  organizationMembershipId: 'om_01HXYZ123456789ABCDEFGHIJ',
  permissionSlug: 'project:read',
  parentResourceId: 'authz_resource_01XYZ789',
  limit: 10,
  order: 'desc',
});

// Option 2: by parent external ID + type
const resourcesByExternal =
  await workos.authorization.listResourcesForMembership({
    organizationMembershipId: 'om_01HXYZ123456789ABCDEFGHIJ',
    permissionSlug: 'project:read',
    parentResourceTypeSlug: 'workspace',
    parentResourceExternalId: 'ws-123',
  });
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.authorization.list_resources_for_membership(
  organization_membership_id: "om_01HXYZ123456789ABCDEFGHIJ",
  permission_slug: "project:read"
)
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.authorization.list_resources_for_membership(
    organization_membership_id="om_01HXYZ123456789ABCDEFGHIJ",
    permission_slug="project:read",
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Authorization().ListResourcesForMembership(context.Background(), "om_01HXYZ123456789ABCDEFGHIJ", &workos.AuthorizationListResourcesForMembershipParams{
		PermissionSlug: "project:read",
	})
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->authorization()
    ->listResourcesForMembership(
        organizationMembershipId: "om_01HXYZ123456789ABCDEFGHIJ",
        permissionSlug: "project:read",
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;
import com.workos.authorization.AuthorizationApi.ListResourcesForMembershipOptions;

WorkOS workos = new WorkOS("sk_example_123456789");

ListResourcesForMembershipOptions options =
    ListResourcesForMembershipOptions.builder().permissionSlug("project:read").build();

workos.authorization.listResourcesForMembership("om_01HXYZ123456789ABCDEFGHIJ", options);
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Authorization.ListResourcesForMembershipAsync("om_01HXYZ123456789ABCDEFGHIJ",
                                                           new AuthorizationListResourcesForMembershipOptions {
                                                               PermissionSlug = "project:read",
                                                           });
```

```rust language="rust" title="Request" tab="1"
use workos::Client;
use workos::authorization::ListResourcesForMembershipParams;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .authorization()
        .list_resources_for_membership(
            "om_01HXYZ123456789ABCDEFGHIJ",
            ListResourcesForMembershipParams {
                permission_slug: "project:read".into(),
                ..Default::default()
            }
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "list",
  "data": [
    {
      "object": "authorization_resource",
      "name": "Website Redesign",
      "description": "Company website redesign project",
      "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT",
      "parent_resource_id": "authz_resource_01HXYZ123456789ABCDEFGHIJ",
      "id": "authz_resource_01HXYZ123456789ABCDEFGH",
      "external_id": "proj-456",
      "resource_type_slug": "project",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "list_metadata": {
    "before": "authz_resource_01HXYZ123456789ABCDEFGHIJ",
    "after": "authz_resource_01HXYZ987654321KJIHGFEDCBA"
  }
}
```

:::

### POST /authorization/organization_memberships/{organization_membership_id}/check

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `permission_slug` | string | Yes | The slug of the permission to check. |
| `resource_id` | string | No | The ID of the resource to check. Use either this or resource_external_id + resource_type_slug. |
| `resource_external_id` | string | No | The external ID of the resource. Requires resource_type_slug. |
| `resource_type_slug` | string | No | The resource type slug. Required with resource_external_id. |

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `organization_membership_id` | string | Yes | The ID of the organization membership to check. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `authorized` | boolean | Whether the organization membership has the permission on the resource. |

### GET /authorization/organization_memberships/{organization_membership_id}/resources/{resource_type_slug}/{external_id}/permissions

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `organization_membership_id` | string | Yes | The ID of the organization membership. |
| `resource_type_slug` | string | Yes | The slug of the resource type. |
| `external_id` | string | Yes | An identifier you provide to reference the resource in your system. |
| `before` | string | No | An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. |
| `after` | string | No | An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. |
| `limit` | integer | No | Upper limit on the number of objects to return, between `1` and `100`. Defaults to `10`. |
| `order` | "normal" \| "desc" \| "asc" | No | Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. |

### GET /authorization/organization_memberships/{organization_membership_id}/resources/{resource_id}/permissions

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `organization_membership_id` | string | Yes | The ID of the organization membership. |
| `resource_id` | string | Yes | The ID of the authorization resource. |
| `before` | string | No | An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. |
| `after` | string | No | An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. |
| `limit` | integer | No | Upper limit on the number of objects to return, between `1` and `100`. Defaults to `10`. |
| `order` | "normal" \| "desc" \| "asc" | No | Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. |

### GET /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}/organization_memberships

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `organization_id` | string | Yes | The ID of the organization. |
| `resource_type_slug` | string | Yes | The slug of the resource type. |
| `external_id` | string | Yes | The external ID of the resource. |
| `before` | string | No | Cursor for pagination (before). |
| `after` | string | No | Cursor for pagination (after). |
| `limit` | integer | No | Maximum number of records to return (default 10, max 100). |
| `order` | "normal" \| "desc" \| "asc" | No | Sort order (asc or desc). |
| `permission_slug` | string | Yes | The permission slug to filter by. Only users with this permission on the resource are returned. |
| `assignment` | "direct" \| "indirect" | No | Filter by assignment type. Use "direct" for direct assignments only, or "indirect" to include inherited assignments. |

### GET /authorization/resources/{resource_id}/organization_memberships

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `resource_id` | string | Yes | The ID of the resource. |
| `before` | string | No | Cursor for pagination (before). |
| `after` | string | No | Cursor for pagination (after). |
| `limit` | integer | No | Maximum number of records to return (default 10, max 100). |
| `order` | "normal" \| "desc" \| "asc" | No | Sort order (asc or desc). |
| `permission_slug` | string | Yes | The permission slug to filter by. Only users with this permission on the resource are returned. |
| `assignment` | "direct" \| "indirect" | No | Filter by assignment type. Use "direct" for direct assignments only, or "indirect" to include inherited assignments. |

### GET /authorization/organization_memberships/{organization_membership_id}/resources

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `organization_membership_id` | string | Yes | The ID of the organization membership. |
| `before` | string | No | Cursor for pagination (before). |
| `after` | string | No | Cursor for pagination (after). |
| `limit` | integer | No | Maximum number of records to return (default 10, max 100). |
| `order` | "normal" \| "desc" \| "asc" | No | Sort order (asc or desc). |
| `permission_slug` | string | Yes | The permission slug to filter by. Only resources where the user has this permission are returned. |
| `parent_resource_id` | string | No | The ID of the parent resource. Use either this or parent_resource_external_id + parent_resource_type_slug. |
| `parent_resource_type_slug` | string | No | The resource type slug of the parent. Required with parent_resource_external_id. |
| `parent_resource_external_id` | string | No | The external ID of the parent resource. Requires parent_resource_type_slug. |