> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List tool permissions

> List the tool calls a project's agents may run without asking, newest first. Requires access to the project.



## OpenAPI

````yaml /openapi.json get /projects/{projectId}/tool-permissions
openapi: 3.1.1
info:
  title: Sazabi Public API
  version: 1.0.0
  description: >
    Public REST API for Sazabi. Authenticate using a secret API key in the
    Authorization header.


    ## Pagination


    This API uses two pagination strategies depending on the endpoint type:


    ### Cursor-Based Pagination (List Endpoints)


    List endpoints (threads, messages, keys) use cursor-based pagination for
    efficient, consistent results:


    - **Parameters**: `limit` (items per page, default 50, max 100), `cursor`
    (opaque pagination token)

    - **Response**: Includes `nextCursor` field - pass this as `cursor` in the
    next request

    - **End of results**: When `nextCursor` is `null`, there are no more results

    - **Example**: `GET
    /v1/threads?limit=20&cursor=01234567-89ab-cdef-0123-456789abcdef`


    ### Page-Based Pagination (Search Endpoints)


    Search endpoints use page-based pagination due to the underlying search
    engine:


    - **Parameters**: `limit` (items per page, default 20, max 100), `page`
    (1-indexed page number)

    - **Response**: Includes `pagination` object with `page`, `limit`,
    `totalResults`, `totalPages`

    - **Example**: `GET /v1/search/threads?q=error&limit=10&page=2`
servers:
  - url: https://api.sazabi.com/v1
    description: Production
security: []
paths:
  /projects/{projectId}/tool-permissions:
    get:
      tags:
        - Tool permissions
      summary: List tool permissions
      description: >-
        List the tool calls a project's agents may run without asking, newest
        first. Requires access to the project.
      operationId: toolPermissions.list
      parameters:
        - name: projectId
          in: path
          required: true
          schema:
            type: string
            format: uuid
            description: Project whose allowlist to read.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The rule's id; revoke takes it.
                        rule:
                          type: string
                          description: >-
                            The stored rule, e.g. `bash(git status)` or
                            `execute(<connectionKey>:<toolName>)`.
                        toolName:
                          type: string
                          description: >-
                            The tool the rule pre-approves, or `unknown` for a
                            rule that does not parse.
                        target:
                          type: string
                          description: >-
                            What the rule matches within the tool: a bash
                            command pattern, an MCP tool name, or `*`.
                        connectionKey:
                          anyOf:
                            - type: string
                            - type: 'null'
                          description: >-
                            The MCP connection an `execute` rule names; null for
                            every other tool.
                        createdAt:
                          type: string
                          format: date-time
                          description: When the rule was added.
                        createdByUserId:
                          anyOf:
                            - type: string
                            - type: 'null'
                          description: >-
                            The id of the user who added the rule, or null when
                            there is no creator the caller can see: none was
                            recorded, the user was deleted, or the user is not
                            visible to the caller. Null does not say which.
                      required:
                        - id
                        - rule
                        - toolName
                        - target
                        - connectionKey
                        - createdAt
                        - createdByUserId
                required:
                  - items

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.