getMyCapabilities
The key owner's own permissions.
The key owner's own permissions: CHECK THIS BEFORE OFFERING OR ATTEMPTING A GATED ACTION, or saying why one is unavailable. Returns the capabilities they HOLD; one missing from the list is one they do NOT have. Seven are opt-IN, off unless a team admin granted them: VIEW_ALL_CONTACTS (without it the user sees only contacts assigned to them or their teams, the usual real answer to "why can't I see this contact"), VIEW_ALL_DEALS, VIEW_ALL_PHONES (call and text FROM any team number), CONTRACTS_VIEW and CONTRACTS_MANAGE (where a contract surface enforces them), VIEW_ORGANIZATION_SETTINGS (the organization's settings pages) and CAN_MANAGE_SPENDING (seats, numbers, the plan, invites). Eleven are opt-OUT, on unless a team admin revoked them: CAN_SKIPTRACE, CAN_EXPORT, CAN_WORKFLOW, and VIEW_TEAM_DIRECTORY (knowing anyone else is in the organization: without it no teammate names are shown, the real answer to "why is this note signed Team member"), and the app sections CAN_USE_AUTOMATIONS (workflow operations too), CAN_USE_FILES, CAN_USE_MARKETPLACE, CAN_USE_API_KEYS, CAN_USE_COMPUTER (where computer use is on), VIEW_TEAM_CALENDARS (teammates' calendars), and VIEW_TEAM_CALLS_TEXTS (reading teammates' calls and texts; email only from mailboxes their owner shares). Roles are only Admin (holds them all) and Member (their own set). An EMPTY list means none held; a NULL/absent list means the lookup failed and you know nothing: never read either as the other, nor tell a user they lack a permission on a failed read. When one is missing, say so plainly and name the remedy (a team admin can turn it on) rather than attempting it and relaying the refusal, or guessing the record does not exist. Never promise the app will refuse an act their role does not allow: say what it does and let the approval card or the operation's own answer speak to permission.
curl https://server.goliathdata.com/api/v1/call \
-H "Authorization: Bearer $GOLIATH_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"operationId": "getMyCapabilities",
"variables": {}
}'import { GoliathClient } from '@goliath-data/sdk'
const goliath = new GoliathClient({
apiKey: process.env.GOLIATH_API_KEY!,
baseUrl: 'https://server.goliathdata.com',
})
const result = await goliath.account.getMyCapabilities()const res = await fetch('https://server.goliathdata.com/api/v1/call', {
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.GOLIATH_API_KEY}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
operationId: 'getMyCapabilities',
variables: {}
}),
})
const { data, errors } = await res.json()Variables
None. Send "variables": {}.
Response
What comes back under data: a list shows as one entry, and a value as its type.
{
"data": {
"teamQuery": {
"myCapabilities": [
"VIEW_ALL_CONTACTS"
]
}
}
}Errors
unknown_variableA variable the operation does not declare. A typo is refused rather than silently dropped.
unauthorizedNo bearer header, or the key is invalid or revoked.
insufficient_scopeThe key lacks the scope the operation requires.
forbiddenA referenced record does not exist, was deleted, or is outside your organization. The gateway cannot tell those apart.
Behaviour
A read. It rejects an Idempotency-Key header with 400 bad_request.