List what each app may do

GET

/permissions

const url = 'http://127.0.0.1:7700/api/permissions';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url http://127.0.0.1:7700/api/permissions \
  --header 'Authorization: Bearer <token>'

Owner only. For each app, what it declares it needs (the keys it reads, tools that spend money, routes strangers may call) plus what the box has seen it use (hosts its tasks reach, agents with a shell, the owner’s folders), and whether the owner allowed each item. Nothing is turned off until the owner turns it off. The box enforces each “off” where it already draws the line: the vault, the broker, task creation and open routes.

Authorizations

deviceToken
accessToken

Responses

200

One entry per app.

application/json

Array<object>

object

app

required

string

title

required

string

answered

required

Whether the owner has answered the app’s first prompt.

boolean

perDayCents

required

The daily spending limit, or null for none.

integer | null

diskBytes

required

The most disk its tasks may hold. Default 5 GB.

integer

items

required

Array<object>

object

required

Such as key:NAME, money, strangers, shell, folders or host:example.com.

string

kind

required

string

Allowed values: key money strangers shell host folders

text

required

string

seen

The box saw the app use it.

boolean

allowed

required

boolean

Example

[
  {
    "app": "example",
    "title": "Example",
    "answered": false,
    "perDayCents": null,
    "diskBytes": 5368709120,
    "items": [
      {
        "id": "key:DEMO_SECRET",
        "kind": "key",
        "text": "Use the key DEMO_SECRET (through GurtOS; the app never sees it)",
        "allowed": true
      },
      {
        "id": "money",
        "kind": "money",
        "text": "Spend money (each task within its budget)",
        "allowed": true
      }
    ]
  }
]

403

The owner’s route, called by someone who is not the box’s own screen or a device paired as the owner.

application/json

object

error

required

What went wrong

string

Example

{
  "error": "only this computer's own screen or the owner's paired device can do this"
}