Returns roles and other stable authoring options for Security Statements.
using System.Net.Http.Headers;var client = new HttpClient();var request = new HttpRequestMessage{ Method = HttpMethod.Get, RequestUri = new Uri("https://example.com/api/workspace/admin/entity-definitions/example/security/authoring-options"), Headers = { { "Authorization", "Bearer <token>" }, },};using (var response = await client.SendAsync(request)){ response.EnsureSuccessStatusCode(); var body = await response.Content.ReadAsStringAsync(); Console.WriteLine(body);}const url = 'https://example.com/api/workspace/admin/entity-definitions/example/security/authoring-options';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://example.com/api/workspace/admin/entity-definitions/example/security/authoring-options \ --header 'Authorization: Bearer <token>'Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Query Parameters
Section titled “Query Parameters”Optional access token for clients that cannot set Authorization headers. Prefer Authorization: Bearer <token> when possible.
Responses
Section titled “Responses”OK
object
Returns stable principal references and language metadata for Security editors.
object
Describes one workspace role available to a Statement editor.
object
Describes each resource profile, with localized errors when its catalog is unavailable.
Returns one Security profile’s language metadata or its catalog errors.
object
Language metadata for an already authorized editing subject. Saving still compiles the exact submitted expression against the current subject and schema.
object
Offsets count UTF-16 code units in the submitted source, including CR/LF.
object
A named root with the scalar paths and collections admitted in this description.
object
Id is opaque and stable within this collection scope until its binding changes.
object
Operators admitted for this path in its collection scope, after owner restrictions.
A collection and the scalar paths available inside its item scope.
object
Id is opaque and stable within this collection scope until its binding changes.
object
Operators admitted for this path in its collection scope, after owner restrictions.
Canonical operator spelling and a template with named operand placeholders.
object
Operators and duration units applicable to one value family in this profile.
object
A captured context variable; Name includes its @ prefix.
object
MIN/MAX value and aggregate forms have distinct IDs. Null SQL support is unknown.
object
Ordered argument types and result type of a registered function overload.
object
CommonArguments finds one family from ResultArgumentIndex onward, ignores NULL and widens Integer/Decimal mixtures to Decimal. Argument retains the selected argument family; AverageArgument additionally widens Integer to Decimal. Fixed uses FixedResultFamily. RequireConcreteResult refuses an all-NULL result family. Function arity applies separately.
object
Form is Value, Collection, CollectionItem, SourceLiteral or BoundLiteral. Collection carries a collection path; CollectionItem binds in its item scope. SourceLiteral requires source literal syntax, whereas BoundLiteral permits a compile-time bound literal. A repeated final parameter covers remaining arguments. Numeric limits are inclusive; RegexPattern uses the shared supported regular-expression subset. These constraints do not replace compilation.
object
Compilation limits; source size counts UTF-8 bytes and positions count UTF-16 units.
object
Literal text with placeholders. Limits apply separately to placeholder contents, without braces; there is no template-wide size/placeholder count limit here. Value arguments are evaluated eagerly, including extra arguments and unused coalesce alternatives. Rendering uses invariant culture.
object
OperationId refers to Operations. Values accepts expressions of mixed families; Path requires one bare path from AllowedPathIds. PlaceholderTokenBudget has no separate arity limit: MaximumArguments is the largest simple call within the token budget. FirstArgumentToText uses the first value (missing becomes empty text); FirstNonEmptyArgument retains the first nonempty value, including zero/false. OptionLabelText resolves configured labels, falls back to keys and joins multiple labels with comma-space.
object
Host syntax lowered before normal function binding; empty for profiles without extensions.
Signatures describe source syntax, not value overloads. Choices are complete calls with correlated arguments; they must not be split into independent argument lists. Member selectors still need a declared member. Host forms may be unavailable within collection predicates.
object
One admitted source argument shape; catalog selection further constrains the complete call.
object
Identifier denotes source identifier syntax; StringLiteral never accepts a value expression.
object
A prefix such as target maps to this binding, including an inactive first target. BindingId is opaque. Selector is null when no unique explicit selector represents the binding; the prefix remains valid.
object
Admission after host lowering and binding. MaxCollectionPredicates counts bound EXISTS and COUNT nodes; MaxRelationalJoins includes host intrinsic joins. Boolean operands are required recursively when enabled. MaxSelectedTargets counts distinct target definitions per expression. Nested aggregate admission also follows the common compiler’s collection scope rules.
object
TargetBindingId identifies the edited field. TargetPathId links it to an admitted operand, or is null when its key cannot be used as a DSL path. AggregateMustBeRoot requires exactly one aggregate as the whole expression. Path reads an item field; PresenceCount permits SUM(collection, IF(path IS NULL, 0, 1)). AllowsNullResult describes the bound result family, not whether evaluation can produce a missing value.
object
BETWEEN accepts literals and paths under BetweenBoundPathRoots. Path-to-path binary comparisons require matching GroupId when enabled. NULL and membership constraints apply to operands, not missing runtime values. Owner node counting treats signed numbers and admitted local-day bounds as one operand; MaxBooleanDepth counts AND/OR/NOT, and MaxSourceNestingDepth bounds parentheses and consecutive NOT. These rules supplement the common grammar; field storage and operand compatibility still require compilation.
object
Opaque path identity and comparison group; groups reveal no storage or source-definition identifiers.
object
MaxUsedMembers counts distinct first members under Name; RequiresValues concerns every path read under it.
object
NullComparisonForbiddenOperators reject NULL on either side; AllowsNullMembershipItems concerns list items only. These restrictions supplement individual path operators and full compilation.
object
Name includes @. For these operators, every counterpart of the variable must be one of these paths in its declared collection scope. Membership checks each left/item pair independently. Other membership items may have different forms admitted by the compiler.
object
When a listed operator uses this family, every operand must have the same family and group. Paths carry opaque group IDs. Other operands must be literals bound by a listed operation and resolved to that group by the server. NULL is not such a literal. Function arguments and catalog access still require server validation; group IDs expose no storage or catalog identifiers.
object
Opaque path identity and comparison group; groups reveal no storage or source-definition identifiers.
object
object
object
object
object
object
object
Example
{ "Data": { "Profiles": [ { "Errors": [ { "Type": 0, "Severity": 0 } ] } ] }, "Errors": [ { "Type": 0, "Severity": 0 } ], "Warnings": [ { "Type": 0, "Severity": 0 } ]}Bad Request
object
Returns stable principal references and language metadata for Security editors.
object
Describes one workspace role available to a Statement editor.
object
Describes each resource profile, with localized errors when its catalog is unavailable.
Returns one Security profile’s language metadata or its catalog errors.
object
Language metadata for an already authorized editing subject. Saving still compiles the exact submitted expression against the current subject and schema.
object
Offsets count UTF-16 code units in the submitted source, including CR/LF.
object
A named root with the scalar paths and collections admitted in this description.
object
Id is opaque and stable within this collection scope until its binding changes.
object
Operators admitted for this path in its collection scope, after owner restrictions.
A collection and the scalar paths available inside its item scope.
object
Id is opaque and stable within this collection scope until its binding changes.
object
Operators admitted for this path in its collection scope, after owner restrictions.
Canonical operator spelling and a template with named operand placeholders.
object
Operators and duration units applicable to one value family in this profile.
object
A captured context variable; Name includes its @ prefix.
object
MIN/MAX value and aggregate forms have distinct IDs. Null SQL support is unknown.
object
Ordered argument types and result type of a registered function overload.
object
CommonArguments finds one family from ResultArgumentIndex onward, ignores NULL and widens Integer/Decimal mixtures to Decimal. Argument retains the selected argument family; AverageArgument additionally widens Integer to Decimal. Fixed uses FixedResultFamily. RequireConcreteResult refuses an all-NULL result family. Function arity applies separately.
object
Form is Value, Collection, CollectionItem, SourceLiteral or BoundLiteral. Collection carries a collection path; CollectionItem binds in its item scope. SourceLiteral requires source literal syntax, whereas BoundLiteral permits a compile-time bound literal. A repeated final parameter covers remaining arguments. Numeric limits are inclusive; RegexPattern uses the shared supported regular-expression subset. These constraints do not replace compilation.
object
Compilation limits; source size counts UTF-8 bytes and positions count UTF-16 units.
object
Literal text with placeholders. Limits apply separately to placeholder contents, without braces; there is no template-wide size/placeholder count limit here. Value arguments are evaluated eagerly, including extra arguments and unused coalesce alternatives. Rendering uses invariant culture.
object
OperationId refers to Operations. Values accepts expressions of mixed families; Path requires one bare path from AllowedPathIds. PlaceholderTokenBudget has no separate arity limit: MaximumArguments is the largest simple call within the token budget. FirstArgumentToText uses the first value (missing becomes empty text); FirstNonEmptyArgument retains the first nonempty value, including zero/false. OptionLabelText resolves configured labels, falls back to keys and joins multiple labels with comma-space.
object
Host syntax lowered before normal function binding; empty for profiles without extensions.
Signatures describe source syntax, not value overloads. Choices are complete calls with correlated arguments; they must not be split into independent argument lists. Member selectors still need a declared member. Host forms may be unavailable within collection predicates.
object
One admitted source argument shape; catalog selection further constrains the complete call.
object
Identifier denotes source identifier syntax; StringLiteral never accepts a value expression.
object
A prefix such as target maps to this binding, including an inactive first target. BindingId is opaque. Selector is null when no unique explicit selector represents the binding; the prefix remains valid.
object
Admission after host lowering and binding. MaxCollectionPredicates counts bound EXISTS and COUNT nodes; MaxRelationalJoins includes host intrinsic joins. Boolean operands are required recursively when enabled. MaxSelectedTargets counts distinct target definitions per expression. Nested aggregate admission also follows the common compiler’s collection scope rules.
object
TargetBindingId identifies the edited field. TargetPathId links it to an admitted operand, or is null when its key cannot be used as a DSL path. AggregateMustBeRoot requires exactly one aggregate as the whole expression. Path reads an item field; PresenceCount permits SUM(collection, IF(path IS NULL, 0, 1)). AllowsNullResult describes the bound result family, not whether evaluation can produce a missing value.
object
BETWEEN accepts literals and paths under BetweenBoundPathRoots. Path-to-path binary comparisons require matching GroupId when enabled. NULL and membership constraints apply to operands, not missing runtime values. Owner node counting treats signed numbers and admitted local-day bounds as one operand; MaxBooleanDepth counts AND/OR/NOT, and MaxSourceNestingDepth bounds parentheses and consecutive NOT. These rules supplement the common grammar; field storage and operand compatibility still require compilation.
object
Opaque path identity and comparison group; groups reveal no storage or source-definition identifiers.
object
MaxUsedMembers counts distinct first members under Name; RequiresValues concerns every path read under it.
object
NullComparisonForbiddenOperators reject NULL on either side; AllowsNullMembershipItems concerns list items only. These restrictions supplement individual path operators and full compilation.
object
Name includes @. For these operators, every counterpart of the variable must be one of these paths in its declared collection scope. Membership checks each left/item pair independently. Other membership items may have different forms admitted by the compiler.
object
When a listed operator uses this family, every operand must have the same family and group. Paths carry opaque group IDs. Other operands must be literals bound by a listed operation and resolved to that group by the server. NULL is not such a literal. Function arguments and catalog access still require server validation; group IDs expose no storage or catalog identifiers.
object
Opaque path identity and comparison group; groups reveal no storage or source-definition identifiers.
object
object
object
object
object
object
object
Example
{ "Data": { "Profiles": [ { "Errors": [ { "Type": 0, "Severity": 0 } ] } ] }, "Errors": [ { "Type": 0, "Severity": 0 } ], "Warnings": [ { "Type": 0, "Severity": 0 } ]}Unauthorized
object
Examplegenerated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "instance": "example"}Forbidden
object
Examplegenerated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "instance": "example"}Not Found
object
Returns stable principal references and language metadata for Security editors.
object
Describes one workspace role available to a Statement editor.
object
Describes each resource profile, with localized errors when its catalog is unavailable.
Returns one Security profile’s language metadata or its catalog errors.
object
Language metadata for an already authorized editing subject. Saving still compiles the exact submitted expression against the current subject and schema.
object
Offsets count UTF-16 code units in the submitted source, including CR/LF.
object
A named root with the scalar paths and collections admitted in this description.
object
Id is opaque and stable within this collection scope until its binding changes.
object
Operators admitted for this path in its collection scope, after owner restrictions.
A collection and the scalar paths available inside its item scope.
object
Id is opaque and stable within this collection scope until its binding changes.
object
Operators admitted for this path in its collection scope, after owner restrictions.
Canonical operator spelling and a template with named operand placeholders.
object
Operators and duration units applicable to one value family in this profile.
object
A captured context variable; Name includes its @ prefix.
object
MIN/MAX value and aggregate forms have distinct IDs. Null SQL support is unknown.
object
Ordered argument types and result type of a registered function overload.
object
CommonArguments finds one family from ResultArgumentIndex onward, ignores NULL and widens Integer/Decimal mixtures to Decimal. Argument retains the selected argument family; AverageArgument additionally widens Integer to Decimal. Fixed uses FixedResultFamily. RequireConcreteResult refuses an all-NULL result family. Function arity applies separately.
object
Form is Value, Collection, CollectionItem, SourceLiteral or BoundLiteral. Collection carries a collection path; CollectionItem binds in its item scope. SourceLiteral requires source literal syntax, whereas BoundLiteral permits a compile-time bound literal. A repeated final parameter covers remaining arguments. Numeric limits are inclusive; RegexPattern uses the shared supported regular-expression subset. These constraints do not replace compilation.
object
Compilation limits; source size counts UTF-8 bytes and positions count UTF-16 units.
object
Literal text with placeholders. Limits apply separately to placeholder contents, without braces; there is no template-wide size/placeholder count limit here. Value arguments are evaluated eagerly, including extra arguments and unused coalesce alternatives. Rendering uses invariant culture.
object
OperationId refers to Operations. Values accepts expressions of mixed families; Path requires one bare path from AllowedPathIds. PlaceholderTokenBudget has no separate arity limit: MaximumArguments is the largest simple call within the token budget. FirstArgumentToText uses the first value (missing becomes empty text); FirstNonEmptyArgument retains the first nonempty value, including zero/false. OptionLabelText resolves configured labels, falls back to keys and joins multiple labels with comma-space.
object
Host syntax lowered before normal function binding; empty for profiles without extensions.
Signatures describe source syntax, not value overloads. Choices are complete calls with correlated arguments; they must not be split into independent argument lists. Member selectors still need a declared member. Host forms may be unavailable within collection predicates.
object
One admitted source argument shape; catalog selection further constrains the complete call.
object
Identifier denotes source identifier syntax; StringLiteral never accepts a value expression.
object
A prefix such as target maps to this binding, including an inactive first target. BindingId is opaque. Selector is null when no unique explicit selector represents the binding; the prefix remains valid.
object
Admission after host lowering and binding. MaxCollectionPredicates counts bound EXISTS and COUNT nodes; MaxRelationalJoins includes host intrinsic joins. Boolean operands are required recursively when enabled. MaxSelectedTargets counts distinct target definitions per expression. Nested aggregate admission also follows the common compiler’s collection scope rules.
object
TargetBindingId identifies the edited field. TargetPathId links it to an admitted operand, or is null when its key cannot be used as a DSL path. AggregateMustBeRoot requires exactly one aggregate as the whole expression. Path reads an item field; PresenceCount permits SUM(collection, IF(path IS NULL, 0, 1)). AllowsNullResult describes the bound result family, not whether evaluation can produce a missing value.
object
BETWEEN accepts literals and paths under BetweenBoundPathRoots. Path-to-path binary comparisons require matching GroupId when enabled. NULL and membership constraints apply to operands, not missing runtime values. Owner node counting treats signed numbers and admitted local-day bounds as one operand; MaxBooleanDepth counts AND/OR/NOT, and MaxSourceNestingDepth bounds parentheses and consecutive NOT. These rules supplement the common grammar; field storage and operand compatibility still require compilation.
object
Opaque path identity and comparison group; groups reveal no storage or source-definition identifiers.
object
MaxUsedMembers counts distinct first members under Name; RequiresValues concerns every path read under it.
object
NullComparisonForbiddenOperators reject NULL on either side; AllowsNullMembershipItems concerns list items only. These restrictions supplement individual path operators and full compilation.
object
Name includes @. For these operators, every counterpart of the variable must be one of these paths in its declared collection scope. Membership checks each left/item pair independently. Other membership items may have different forms admitted by the compiler.
object
When a listed operator uses this family, every operand must have the same family and group. Paths carry opaque group IDs. Other operands must be literals bound by a listed operation and resolved to that group by the server. NULL is not such a literal. Function arguments and catalog access still require server validation; group IDs expose no storage or catalog identifiers.
object
Opaque path identity and comparison group; groups reveal no storage or source-definition identifiers.
object
object
object
object
object
object
object
Example
{ "Data": { "Profiles": [ { "Errors": [ { "Type": 0, "Severity": 0 } ] } ] }, "Errors": [ { "Type": 0, "Severity": 0 } ], "Warnings": [ { "Type": 0, "Severity": 0 } ]}