> ## Documentation Index > Fetch the complete documentation index at: https://klef.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # List connection entitlements ## OpenAPI ````yaml /openapi-public.json get /connections/{id}/entitlements openapi: 3.1.1 info: title: Klef API description: Klef's multi-tenant HRIS sync platform API. version: v1 servers: - url: https://{workspace}.klef.ai/api variables: workspace: default: acme description: Your workspace's subdomain. security: [] tags: - name: Auth - name: Users - name: Connections - name: Adoption - name: Policy resources - name: Audit - name: Catalog - name: Workers - name: Sync - name: Search - name: SyncPlans - name: Agent - name: Workspaces - name: Invitations - name: FirstSignIns - name: Connection accounts - name: Connection principals - name: Connection access - name: Licenses - name: Policies - name: Secrets - name: Lookup tables - name: Workspace connectors - name: Scripts - name: Segments - name: Members - name: Inbox - name: Notifications paths: /connections/{id}/entitlements: get: tags: - Connection access summary: List connection entitlements operationId: ListConnectionEntitlements parameters: - name: id in: path required: true schema: type: string format: uuid responses: '200': description: OK content: application/json: schema: $ref: >- #/components/schemas/ApiResponseOfConnectionEntitlementsResponse '401': description: Authentication required. content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponse' '403': description: Permission denied. content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponse' '404': description: Not Found '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponse' security: - cookieAuth: [] - apiKeyAuth: [] components: schemas: ApiResponseOfConnectionEntitlementsResponse: required: - result - errors type: object properties: result: oneOf: - type: 'null' - $ref: '#/components/schemas/ConnectionEntitlementsResponse' errors: type: array items: $ref: '#/components/schemas/ApiError' description: >- The envelope for a single-resource response: `result` on success, otherwise `null` with one or more `errors`. ApiErrorResponse: required: - result - errors type: object properties: result: {} errors: type: array items: $ref: '#/components/schemas/ApiError' ConnectionEntitlementsResponse: required: - read - inventory - entitlements type: object properties: read: $ref: '#/components/schemas/AccessReadResponse' inventory: type: boolean entitlements: type: array items: $ref: '#/components/schemas/ConnectionEntitlementResponse' ApiError: required: - code type: object properties: code: $ref: '#/components/schemas/MessageCode' params: type: - 'null' - object additionalProperties: type: string causes: type: - 'null' - array items: $ref: '#/components/schemas/MessageResponse' target: type: - 'null' - string AccessReadResponse: required: - readAt - readError - principalsReadAt - principalsError type: object properties: readAt: oneOf: - type: 'null' - $ref: '#/components/schemas/Instant' readError: oneOf: - type: 'null' - $ref: '#/components/schemas/MessageResponse' principalsReadAt: oneOf: - type: 'null' - $ref: '#/components/schemas/Instant' principalsError: oneOf: - type: 'null' - $ref: '#/components/schemas/MessageResponse' description: >- How the latest reads of a connection's accounts and principals went. When an error is set, what the view shows is the last read, and stale. ConnectionEntitlementResponse: required: - entitlement - holders - owned type: object properties: entitlement: $ref: '#/components/schemas/EntitlementResponse' holders: type: integer format: int32 owned: type: integer format: int32 description: >- One thing a connection's accounts can hold: how many hold it, directly or through a principal, and how many of those holdings a policy owns. MessageCode: enum: - details_unavailable - unexpected_error - simulated_link_key_unsupported - simulated_entitlement_field_unsupported - simulated_entitlement_field_unread - simulated_user_not_found - target_operation_failed - target_upstream_text - target_http_failed - plan_catalog_unread - plan_snapshot_missing - plan_grant_unread - plan_linked_worker_unmanaged - plan_failed - plan_script_missing - plan_script_failed - plan_field_not_boolean - plan_field_not_integer - plan_secret_missing - plan_secret_malformed - plan_draft_missing - adoption_worker_managed - adoption_account_gone - plan_source_unsynced - plan_draft_uncompilable - plan_connection_protected - plan_account_write_failed - plan_account_not_created - plan_worker_changed - plan_record_changed - plan_account_busy - plan_link_value_not_worker - plan_link_target_unmanaged - plan_composed_state_invalid - plan_create_found_account - plan_content_altered - payload_field_missing - payload_field_unknown - payload_field_wrong_type - payload_field_too_long - payload_value_not_allowed - payload_key_duplicated - payload_exclusive_conflict - payload_item_null - plan_elements_adopted - plan_element_unendable - plan_element_parent_unwritten - plan_grants_lost - plan_entitlement_unknown - plan_create_only_field_differs - plan_account_exists - plan_identity_shared - plan_account_gone_recreated - plan_account_gone_forgotten - plan_policy_evaluation_failed - plan_released_evaluation_failed - plan_target_not_connected - plan_policies_conflict - validation_error - unauthorized - forbidden - not_found - internal_error - error - precondition_required - precondition_failed - invalid_if_match - worker_not_found - worker_version_not_found - connection_not_found - connection_principal_not_found - policy_not_found - policy_not_published - policy_modified - policy_revision_not_found - lookup_table_not_found - script_not_found - segment_not_found - workspace_secret_not_found - member_not_found - invitation_not_found - user_not_found - workspace_not_found - api_key_not_found - inbox_item_not_found - sync_plan_not_found - connection_account_not_found - managed_account_not_found - adoption_run_not_found - sync_plan_not_ready - sync_plan_stale - sync_plan_digest_mismatch - sync_plan_content_altered - audit_log_delivery_not_found - audit_log_delivery_rejected - subdomain_taken - invalid_subdomain - invalid_invite - last_owner_protected - owner_protected - already_member - already_invited - role_not_assignable - invalid_email - email_required - email_mismatch - invitation_gone - invalid_connector_credentials - wrong_connector_type - connection_not_syncable - connector_o_auth_not_configured - connector_authorization_failed - connector_authorizer_privilege_missing - connection_restore_choice_required - deleted_connection_not_found - connection_system_taken - connection_tenant_mismatch - connector_revision_not_found - invalid_connector_manifest - connector_revision_conflict - connector_activation_refused - invalid_match_rule - adoption_run_composed - adoption_run_empty - adoption_selection_refused - invalid_policy - policy_does_not_compile - policy_secret_missing - policy_lookup_table_missing - policy_script_missing - policy_segment_missing - policy_disabled - policy_edit_target_missing - policy_secret_disclosure_forbidden - notification_send_failed - invalid_workspace_secret - workspace_secret_referenced - workspace_secret_name_conflict - invalid_license_price - license_not_found - license_price_not_found - license_price_date_conflict - license_invoice_not_found - license_invoice_file_gone - license_invoice_too_large - license_invoice_too_many_pages - license_invoice_encrypted - license_invoice_unreadable - invalid_lookup_table - lookup_table_referenced - lookup_table_name_conflict - invalid_script - script_name_conflict - script_referenced - invalid_segment - segment_name_conflict - segment_referenced - segment_worker_missing - api_key_scope_not_granted - api_key_limit_reached - subscription_required - plan_upgrade_required - already_subscribed - no_billing_customer - workspace_pending_deletion - workspace_deletion_confirmation_mismatch - workspace_deletion_already_scheduled - workspace_deletion_not_scheduled - workspace_export_expired - workspace_export_not_found - agent_conversation_not_found - agent_proposal_not_found - agent_proposal_outdated - agent_proposal_expired - agent_proposal_already_applied - agent_proposal_rejected - draft_not_found - notification_kind_unsupported - first_sign_in_not_found - first_sign_in_gone - first_sign_in_not_a_recipient - first_sign_in_recipient_unknown - first_sign_in_locked - first_sign_in_code_refused - first_sign_in_proof_invalid - password_reset_unsupported - invalid_password_rules - avatar_not_owned - unsupported_image_type - image_too_large - audit_log_delivery_bucket_unwritable - audit_log_delivery_overwrites_allowed - audit_log_delivery_key_can_delete - audit_log_delivery_delete_unverified - audit_log_delivery_governance_bypass - audit_log_delivery_key_can_read - audit_log_delivery_key_can_list - audit_log_delivery_seal_missing - audit_log_delivery_batch_mismatch - audit_log_delivery_batch_foreign - audit_log_delivery_write_failed - invalid_s3_bucket_name - invalid_object_key_prefix - name_required - name_too_short - name_too_long - name_without_letter_or_digit - invalid_identifier - email_length_invalid - email_malformed - subdomain_length_invalid - subdomain_malformed - subdomain_reserved - worker_id_malformed - value_not_boolean - value_not_date - script_code_required - policy_category_required - password_length_invalid - password_character_sets_too_few - temporary_access_pass_lifetime_invalid - id_malformed - script_not_java_script - audit_after_id_without_sequence - audit_cursor_with_sequence - worker_field_unknown - segment_manual_with_rules - segment_worker_contradictory - segment_rule_invalid - segment_rule_left_not_attribute - segment_rule_value_kind_invalid - segment_rule_attribute_unknown - segment_rule_needs_values - segment_rule_needs_one_value - segment_rule_value_blank - segment_applied_by_policy - segment_applied_by_draft - license_price_lot_count - license_price_remainder_lot - license_price_lot_seats - license_price_lot_amount - license_invoice_file_name_invalid - adoption_worker_given_two_accounts - adoption_account_unknown - adoption_account_already_managed - assistant_not_configured - assistant_answer_truncated - assistant_refused - assistant_rate_limited - assistant_credentials_rejected - assistant_unreachable - assistant_timed_out - assistant_no_answer - assistant_too_many_steps - assistant_conversation_unknown - assistant_prompt_invalid - assistant_workspace_unresolved - assistant_workspace_busy - assistant_workspace_throttled - assistant_conversation_too_long - assistant_conversation_busy - credential_required - credential_not_https_url - credential_not_guid - credential_not_matched - credential_requires_other - credential_not_base64 - credential_certificate_without_key - credential_certificate_unreadable - credential_not_json - policy_diagnostic - notification_recipients_without_address - notification_to_recipient_missing - notification_too_many_addresses - notification_first_sign_in_missing - notification_worker_departing - notification_account_pending - notification_worker_changed - notification_interrupted - notification_delivery_failed - notification_channel_unsupported - notification_kind_unknown - notification_test_address_missing - notification_webhook_missing - notification_secret_id_invalid - notification_header_secret_missing - notification_webhook_secret_missing - notification_webhooks_partly_posted - notification_kind_not_emailed - notification_kind_not_configurable - inbox_setup_source - inbox_setup_target - inbox_setup_policy - inbox_plan_ready - inbox_plan_applied - inbox_plan_applied_with_errors - inbox_event_plan_applied - inbox_event_plan_applied_with_errors - inbox_event_plan_failed - inbox_plan_notifications_failed - inbox_source_event_dropped - connector_account_gone - connector_account_exists - connector_credentials_rejected - connector_privilege_missing - connector_value_unknown - connector_capacity_exhausted - connector_connection_invalid - connector_write_unsettled - connector_unavailable - connector_response_invalid - connector_refused - connector - connector_key_unsupported - connector_field_unclearable - dropbox_user_admin_required - dropbox_member_update_admin_required description: >- The central catalog of every Message. A code keeps its meaning for good; a new meaning is a new code. MessageResponse: required: - code type: object properties: code: $ref: '#/components/schemas/MessageCode' params: type: - 'null' - object additionalProperties: type: string causes: type: - 'null' - array items: $ref: '#/components/schemas/MessageResponse' Instant: type: string format: date-time EntitlementResponse: required: - entitlementField - fieldLabel - value - label - listed - resource - description - purpose - scopeBinding - principalKind type: object properties: entitlementField: type: string fieldLabel: type: string value: type: string label: type: string listed: type: boolean resource: oneOf: - type: 'null' - $ref: '#/components/schemas/CatalogResource' description: type: - 'null' - string purpose: type: - 'null' - string scopeBinding: oneOf: - type: 'null' - $ref: '#/components/schemas/CatalogScopeBinding' principalKind: type: - 'null' - string description: >- An entitlement as the connection's catalog names it. One the catalog leaves out is named by the vendor's own id. `purpose` is C1's (assignment, permission or ownership), `scopeBinding` the role and scope of a role bound to one, and `principalKind` the kind of principal the entitlement names, when its field is that kind's membership field. CatalogResource: required: - id - label type: object properties: id: type: string description: The vendor's stable id for it. label: type: string parent: oneOf: - type: 'null' - $ref: '#/components/schemas/CatalogResource' description: type: - 'null' - string description: A line about the resource, as C1's resource description. externalLink: type: - 'null' - string description: >- Where the resource opens in the vendor's console, as C1's `ExternalLink`. description: An object an entitlement gives access to, and the object it sits in. CatalogScopeBinding: required: - role - scope type: object properties: role: $ref: '#/components/schemas/CatalogResource' scope: $ref: '#/components/schemas/CatalogResource' description: A Role bound to a Scope, as C1's binding. securitySchemes: cookieAuth: type: apiKey description: >- Cookie-based session. Obtain by completing the `/auth/login/{provider}` OAuth flow; the `/auth/callback` response sets the `klef.session` cookie that subsequent requests send automatically. name: klef.session in: cookie apiKeyAuth: type: http description: >- An API key from **Settings > API keys**, sent as `Authorization: Bearer klef_sk_…`. A key works only on its own workspace's subdomain, and only with the permissions its scopes grant. scheme: bearer bearerFormat: klef_sk_… ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.