Paragon Permissions API

openapi: 3.2.0
info:
  title: Paragon Managed Sync Permissions API
  description: Managed Sync provides pipelines to sync data from your users' integration sources (File Storage, CRM, Ticketing) into your app or RAG pipeline. The service handles sync scheduling, normalization to standardized schemas, and enforcement of source-system permissions. Managed Sync exposes a Sync API for record ingestion and a Permissions API for ReBAC-style access checks over synced objects.
  version: 1.0.0
  contact:
    name: Paragon
    url: https://www.useparagon.com
  license:
    name: Proprietary
    url: https://www.useparagon.com/terms-of-service
servers:
- url: https://managed-sync.useparagon.com
  description: Paragon Managed Sync API (Cloud)
security:
- bearerAuth: []
tags:
- name: Permissions
  description: ReBAC-style access checks over synced objects and subjects.
paths:
  /projects/{projectId}/permissions/check-access:
    post:
      operationId: checkAccess
      summary: Paragon Check Access
      description: Checks whether a subject (user, group) has a given relation to a synced object (file, contact, ticket). Useful for enforcing source-system permissions in RAG retrieval.
      tags:
      - Permissions
      parameters:
      - name: projectId
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessCheck'
      responses:
        '200':
          description: Access decision.
          content:
            application/json:
              schema:
                type: object
                properties:
                  allowed:
                    type: boolean
  /projects/{projectId}/permissions/batch-check-access:
    post:
      operationId: batchCheckAccess
      summary: Paragon Batch Check Access
      description: Performs multiple access checks in a single call.
      tags:
      - Permissions
      parameters:
      - name: projectId
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                checks:
                  type: array
                  items:
                    $ref: '#/components/schemas/AccessCheck'
      responses:
        '200':
          description: Per-check access decisions.
          content:
            application/json:
              schema:
                type: object
                properties:
                  results:
                    type: array
                    items:
                      type: object
                      properties:
                        allowed:
                          type: boolean
  /projects/{projectId}/permissions/list-users:
    post:
      operationId: listUsers
      summary: Paragon List Users With Access
      description: Returns the subjects that have access to a given object.
      tags:
      - Permissions
      parameters:
      - name: projectId
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                object:
                  type: string
                relation:
                  type: string
      responses:
        '200':
          description: Subjects with the requested relation.
  /projects/{projectId}/permissions/list-objects:
    post:
      operationId: listObjects
      summary: Paragon List Objects With Access
      description: Returns the objects a subject has the requested relation to.
      tags:
      - Permissions
      parameters:
      - name: projectId
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                subject:
                  type: string
                relation:
                  type: string
      responses:
        '200':
          description: Objects with the requested relation.
  /projects/{projectId}/permissions/expand:
    post:
      operationId: expandRelationships
      summary: Paragon Expand Permission Relationships
      description: Expands the relationship tree for a (subject, relation, object) tuple.
      tags:
      - Permissions
      parameters:
      - name: projectId
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessCheck'
      responses:
        '200':
          description: Expanded relationship graph.
components:
  schemas:
    AccessCheck:
      type: object
      required:
      - subject
      - relation
      - object
      properties:
        subject:
          type: string
          description: The actor (e.g., user@example.com).
        relation:
          type: string
          description: The relation to check (e.g., viewer, editor, owner).
        object:
          type: string
          description: The object identifier (e.g., file:abc123).
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Paragon User Token (JWT) Bearer.