Back to API Practice

Security/Auth trainer

Permission Matrix API Practice

Practice effective permissions, role inheritance, deny rules, direct API bypass, stale permission caches, tenant scope, and auditability.

Start writing test ideasTry API sandbox

How to use this trainer

Choose, send, inspect, write, improve

Safe client-side simulator. No real backend is called and no real data is sent.

  1. 1Choose a preset case
  2. 2Send a simulated request
  3. 3Read the response and QA note
  4. 4Write what you would test
  5. 5Check your coverage

Interactive sandbox

Try the API request

Pick a preset, send a simulated GET /api/auth/permissions/matrix request, inspect the fake response, and turn it into test ideas.

No real users, roles, or permission data are sent. This is a client-side simulator.

Request

Build the request

GET/api/auth/permissions/matrix

Request JSON

application/json
{
  "userId": "usr_123",
  "resourceType": "project",
  "resourceId": "prj_456",
  "actions": [
    "read",
    "write",
    "delete"
  ]
}

Test case presets

Choose a case, inspect the fake response, then write what you would test.

Happy path

Permissions

Tenant

Validation

Cache

Security

Reliability

Response

Fake API result

Send a simulated request to see status, response JSON, QA note, and what to notice. No real backend is called.

List effective permissions, inherited roles, explicit deny, another user matrix, tenant boundaries, direct API bypass, stale cache, service outages, audit logs, and performance.

Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.

How to structure your answer

Happy pathNegative casesData rulesSecurity/API risksUX/performance
API ReferenceEndpoint, request fields, responses, and business rulesExpand

API reference

Permission Matrix endpoint

Return effective permissions for a user/resource while enforcing tenant boundaries and safe authorization rules.

Endpoint

GET/api/auth/permissions/matrix

Purpose

Return effective permissions for a user/resource while enforcing tenant boundaries and safe authorization rules.

Request fields

  • userId: user identifier, optional current user by default
  • resourceType: protected resource type
  • resourceId: protected resource identifier
  • actions: action list to evaluate

Success response

200 OK

Request body

{
  "userId": "usr_123",
  "resourceType": "project",
  "resourceId": "prj_456",
  "actions": ["read", "write", "delete"]
}

Example response body

{
  "userId": "usr_123",
  "resourceId": "prj_456",
  "effectivePermissions": {
    "read": true,
    "write": true,
    "delete": false
  },
  "sources": ["role:manager", "deny:delete"]
}

Errors

  • 400 validation error
  • 401 unauthenticated
  • 403 forbidden or cross-tenant
  • 404 safe not found
  • 503 permission service unavailable

Security notes

  • Server-side checks must block denied direct API calls
  • Hidden/internal permissions are not returned
  • Role or permission tampering is rejected
  • Permission reads and denied actions are audited

Business rules

  • Matrix is computed from roles and direct grants
  • Explicit deny wins over inherited allow
  • Tenant/workspace context comes from trusted auth claims
  • Cache invalidation follows role updates
  • Backend enforcement must match the matrix