curl --request POST \
--url 'https://api.flashcat.cloud/role/permission/factor/list?app_key=' \
--header 'Content-Type: application/json' \
--data '
{
"factor_types": [
"api"
]
}
'import requests
url = "https://api.flashcat.cloud/role/permission/factor/list?app_key="
payload = { "factor_types": ["api"] }
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({factor_types: ['api']})
};
fetch('https://api.flashcat.cloud/role/permission/factor/list?app_key=', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flashcat.cloud/role/permission/factor/list?app_key=",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'factor_types' => [
'api'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flashcat.cloud/role/permission/factor/list?app_key="
payload := strings.NewReader("{\n \"factor_types\": [\n \"api\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flashcat.cloud/role/permission/factor/list?app_key=")
.header("Content-Type", "application/json")
.body("{\n \"factor_types\": [\n \"api\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flashcat.cloud/role/permission/factor/list?app_key=")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"factor_types\": [\n \"api\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"data": [
{
"factor_name": "template:read:info",
"factor_type": "api",
"source": "system"
}
]
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InvalidParameter",
"message": "The specified parameter is not valid."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "Unauthorized",
"message": "You are unauthorized."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "RequestTooFrequently",
"message": "Request too frequently."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InternalError",
"message": "We encountered an internal error, and it has been reported. Please try again later."
}
}List permission factors
Return all permission factors (API, button, menu, URL, visit) granted to the calling member, optionally filtered by type. Requires a member-scoped credential — calls authenticated as the account principal (e.g. an account-level app key) are rejected with a 400, because the account principal implicitly holds every permission.
curl --request POST \
--url 'https://api.flashcat.cloud/role/permission/factor/list?app_key=' \
--header 'Content-Type: application/json' \
--data '
{
"factor_types": [
"api"
]
}
'import requests
url = "https://api.flashcat.cloud/role/permission/factor/list?app_key="
payload = { "factor_types": ["api"] }
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({factor_types: ['api']})
};
fetch('https://api.flashcat.cloud/role/permission/factor/list?app_key=', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flashcat.cloud/role/permission/factor/list?app_key=",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'factor_types' => [
'api'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flashcat.cloud/role/permission/factor/list?app_key="
payload := strings.NewReader("{\n \"factor_types\": [\n \"api\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flashcat.cloud/role/permission/factor/list?app_key=")
.header("Content-Type", "application/json")
.body("{\n \"factor_types\": [\n \"api\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flashcat.cloud/role/permission/factor/list?app_key=")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"factor_types\": [\n \"api\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"data": [
{
"factor_name": "template:read:info",
"factor_type": "api",
"source": "system"
}
]
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InvalidParameter",
"message": "The specified parameter is not valid."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "Unauthorized",
"message": "You are unauthorized."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "RequestTooFrequently",
"message": "Request too frequently."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InternalError",
"message": "We encountered an internal error, and it has been reported. Please try again later."
}
}Restrictions
| Aspect | Value |
|---|---|
| Rate limits | 1,000 requests/minute; 50 requests/second per account |
| Permissions | None — but the credential must belong to a member; account-principal credentials (e.g. an account-level app key) are rejected with a 400 |
Usage
- Permission factors are the fine-grained controls that make up each permission.
factor_typesaccepts:api,button,visit,menu,url.
Authorizations
App key issued from the Flashduty console under Account → APP Keys. Required on every public API call. Keep it secret — it grants the same access as the owning account.
Body
Filters for listing permission factors.
Filter by factor type.
api, button, visit, menu, url Response
Success
Success response envelope. On every 2xx response, request_id identifies the call (also mirrored in the Flashcat-Request-Id header) and data holds the endpoint-specific payload. Failure responses use a different shape — see ErrorResponse.
Was this page helpful?