# Access Control

Access Control provides fine-grained, resource-level authorization on top of the
role-based model. Where [Roles](#tag/Roles) and [Permissions](#tag/Permissions) define
what a user can do in general, Access Control governs what a user can do to a
specific resource (e.g., a particular document, channel, or brand).

Document-level access supports two grant types:

| Grant | Description |
|---|---|
| `READ` | User can view and retrieve the resource |
| `MODIFY` | User can update or delete the resource |

- `has-access` — evaluate whether the calling user has access to a specific resource;
  the primary authorization check for content-level operations
- `retrieve-resource-groups` — list the logical resource groups a user has access to,
  used for scoping queries and UI navigation
- `grant-access` — explicitly grant a user or group access to a specific resource
- `revoke-access` — remove a previously granted resource-level access


## Check content access

 - [POST /api/v1/access-control/has-access](https://api.tenovos.com/openapi/content-intelligence/access-control/tenovos.authz.accesscontrolservice.hasaccess.md): Checks whether the authenticated user holds specific permissions on one or more resources. Evaluates both role-based and fine-grained resource access grants to produce the final result.

Request:
resourceIds      - List of resource IDs to evaluate access for.
permissionsIds   - List of permission IDs to check against each resource.

Response:
accessResult     - List of results, one per resource-permission combination. Each entry contains the resourceId, permissionId, and a hasAccess boolean indicating whether access is granted.

## Get resource groups

 - [POST /api/v1/access-control/retrieve-resource-groups](https://api.tenovos.com/openapi/content-intelligence/access-control/tenovos.authz.accesscontrolservice.retrieveresourcegroups.md): Returns the resource group IDs that define the scope of the authenticated user's fine-grained access. Resource groups categorize access by source — use these IDs to scope content queries and permission checks to only what the user can see.

Request:
No parameters required.

Response:
resourceGroupIds      - Groups assigned directly to this user.
contextGroupsIds      - Groups derived from the user's current site or organization context.
permissionGroupsIds   - Groups inherited through the user's membership in one or more user groups.

## Grant content access

 - [POST /api/v1/access-control/grant-access](https://api.tenovos.com/openapi/content-intelligence/access-control/tenovos.authz.accesscontrolservice.grantaccess.md): Grants resource-level access on one or more content entities to specified users or groups. Each grant specifies an access level of READ (view and retrieve) or MODIFY (update and delete).

Request:
entityIds              - List of content entity IDs to grant access on.
principalPermissions   - List of grants, each specifying a user or group ID and the permission level to grant (READ or MODIFY).

Response:
entityIds              - List of entity IDs on which access was successfully granted.
principalPermissions   - The list of grants that were applied.

## Revoke content access

 - [POST /api/v1/access-control/revoke-access](https://api.tenovos.com/openapi/content-intelligence/access-control/tenovos.authz.accesscontrolservice.revokeaccess.md): Revokes all fine-grained access grants for a principal on one or more entities.

Request:
entityIds              - List of entity IDs to revoke access on.
principalResourceId   - The resource ID of the user or group whose access is being revoked.

Response:
entityIds   - List of entity IDs for which access was successfully revoked.