# list all permissions

> 🔒 **Private label — [contact sales](mailto:sales@boyahq.com).** Requires a private-label entitlement on your API client.

list all permissions

Endpoint: GET /permissions
Version: 2.0.0
Security: oauth2ClientCredentials

## Header parameters:

  - `business_id` (string, required)
    Business identifier for the request

## Response 200 fields (application/json):

  - `status` (number, required)
    HTTP status code
    Example: 200

  - `data` (array)
    Array of permission role objects

  - `data._id` (string, required)
    Permission MongoDB ID

  - `data.name` (string, required)
    Permission display name
    Example: View Balance

  - `data.slug` (string, required)
    Permission slug
    Example: view-balance

  - `data.description` (string, required)
    Permission description
    Example: See current and available balance

  - `data.category` (string, required)
    Permission category
    Enum: "READ", "TRANSACT", "ADMIN"

  - `data.requires_ownership` (boolean, required)
    Whether this is an owner-only permission

  - `data.createdAt` (string)
    Creation timestamp

  - `data.updatedAt` (string)
    Last update timestamp

  - `timestamp` (string, required)
    Response timestamp in ISO format
    Example: 2026-01-08T12:07:27.605Z