## My site permissions

`GET /v1/sites/:id/my-permissions`

Returns the operations the API key's user can perform on the site. Use it to check permissions before changing, publishing or deleting a site.

## Parameters

| Parameter | Type | Required | Description |
|----------|-----|:-----:|---------|
| `id` (path) | number | yes | Site identifier — a positive integer. List: [`GET /v1/sites`](/docs/entities/sites/list) |
| `scope` (query) | string | no | Internal landing scope: `KNOWLEDGE` / `GROUP` / `MAINPAGE`. Specify it if the site belongs to the corresponding scope. Otherwise `404 ENTITY_NOT_FOUND` is returned. An ordinary site requested with `scope` also returns `404` |

## Examples

### curl — personal key

```bash
curl "https://vibecode.bitrix24.com/v1/sites/3/my-permissions" \
  -H "X-Api-Key: YOUR_API_KEY"
```

### curl — OAuth application

```bash
curl "https://vibecode.bitrix24.com/v1/sites/3/my-permissions" \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN"
```

### JavaScript — personal key

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/sites/3/my-permissions', {
  headers: {
    'X-Api-Key': 'YOUR_API_KEY',
  },
})

const { success, data } = await res.json()
console.log('Can publish:', data.operations.includes('public'))
```

### JavaScript — OAuth application

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/sites/3/my-permissions', {
  headers: {
    'X-Api-Key': 'YOUR_APP_KEY',
    'Authorization': 'Bearer USER_SESSION_TOKEN',
  },
})

const { success, data } = await res.json()
```

## Response fields

| Field | Type | Description |
|------|-----|---------|
| `success` | boolean | `true` on success |
| `data.operations` | string[] | Operations of the key's user: `read` — view, `edit` — edit, `sett` — change settings, `public` — publish, `delete` — delete, `denied` — access denied. Can be an empty array |

## Response example

Permissions of a Bitrix24 account administrator:

```json
{
  "success": true,
  "data": {
    "operations": [
      "denied",
      "read",
      "edit",
      "sett",
      "public",
      "delete"
    ]
  }
}
```

## Error response example

404 — site not found:

```json
{
  "success": false,
  "error": {
    "code": "ENTITY_NOT_FOUND",
    "message": "Site not found or not visible"
  }
}
```

## Errors

| HTTP | Code | Description |
|------|-----|---------|
| 400 | `INVALID_PARAMS` | `id` is not a positive integer |
| 400 | `INVALID_SCOPE` | `scope` is not `KNOWLEDGE`, `GROUP` or `MAINPAGE` |
| 404 | `ENTITY_NOT_FOUND` | No site with this `id`, the site is not accessible to the key's user, or it belongs to a different `scope` |
| 409 | `LANDING_MODULE_NOT_ENABLED` | The Sites module is unavailable on this Bitrix24 account. Ask a Bitrix24 account administrator to enable it — until then a retry returns the same refusal |
| 422 | `BITRIX_ERROR` | Bitrix24 returned the permissions in a form other than a list of strings, or rejected the request. The reason is in `message` |
| 403 | `BITRIX_ACCESS_DENIED` | Bitrix24 denied access: the key's user is not an administrator, or the feature is unavailable on the Bitrix24 account |
| 403 | `SCOPE_DENIED` | The API key does not have the `landing` scope |
| 401 | `TOKEN_MISSING` | The API key has no configured tokens |
| 401 | `MISSING_API_KEY` | The `X-Api-Key` header is missing |

The full list of common API errors — [Errors](/docs/errors).

## Known specifics

- **The method covers only the key's user.** Permissions of other employees and groups assigned via [`PUT /v1/sites/:id/permissions`](/docs/entities/sites/permissions) cannot be read with this method.
- **`denied` in the list does not mean this user is blocked.** A Bitrix24 account administrator gets all six operations together with `denied`. Check for the operation you need — `edit`, `public`, `delete` — rather than for the absence of `denied`.

## See also

- [Site permissions](/docs/entities/sites/permissions)
- [Reset site permissions](/docs/entities/sites/permissions-delete)
- [Get a site](/docs/entities/sites/get)
- [Sites](/docs/entities/sites)