> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Retrieve a partner > Returns one partner in full: its permissions, its scope, its validity window, its IP allowlist and how many applications are attached. Called to open a partner's detail screen, and before a PATCH — the update replaces `permissions` and `scope` wholesale rather than merging entry by entry, so an editor has to start from the current lists. Read-only: nothing changes. Failures: - `404 IDE-1046` — no such partner in your organization. An id that belongs to ANOTHER tenant answers exactly this, deliberately: telling the two apart would confirm another tenant's records exist. - `422` — `id` is not a UUID. - `403` — your token does not hold the `partners` resource. - `503 IDE-0060` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. - `501 IDE-1051` — this deployment publishes the contract but does not serve it yet. ## OpenAPI ````yaml /en/openapi/v3-current/AM-identity.yaml get /v1/partners/{id} openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: >- OpenAPI 3.1 surface for the plugin-access-manager identity component. It exposes the M2M-gated declarations upsert (PUT /v1/declarations/{slug}), through which each plugin declares its own permissions/roles/M2M contract, and partner management (/v1/partners), through which a tenant administrator grants its own customers scoped API credentials. The remaining identity routes stay Fiber-native and are described by the separate OAS 2 document in the same folder. license: name: Apache-2.0 url: https://www.apache.org/licenses/LICENSE-2.0 title: Plugin Access Manager — Identity API version: v1 servers: [] security: [] tags: - description: >- M2M-only: each plugin declares its own permissions, roles and M2M contract, and the server reconciles them. name: Declarations - description: >- A tenant administrator's customers. Each partner holds what its credentials may DO (permissions, per product) and WHERE they may do it (scope, per product and dimension); an M2M application attached to one is confined to that intersection. Administrator-only: authorized on the "partners" resource, and every route resolves the owning organization from the caller's token. name: Partners paths: /v1/partners/{id}: get: tags: - Partners summary: Retrieve a partner description: >- Returns one partner in full: its permissions, its scope, its validity window, its IP allowlist and how many applications are attached. Called to open a partner's detail screen, and before a PATCH — the update replaces `permissions` and `scope` wholesale rather than merging entry by entry, so an editor has to start from the current lists. Read-only: nothing changes. Failures: - `404 IDE-1046` — no such partner in your organization. An id that belongs to ANOTHER tenant answers exactly this, deliberately: telling the two apart would confirm another tenant's records exist. - `422` — `id` is not a UUID. - `403` — your token does not hold the `partners` resource. - `503 IDE-0060` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. - `501 IDE-1051` — this deployment publishes the contract but does not serve it yet. operationId: getPartner parameters: - description: Identifier of the partner, as returned by the create call. in: path name: id required: true schema: description: Identifier of the partner, as returned by the create call. examples: - 00000000-0000-0000-0000-000000000000 format: uuid type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/PartnerResponse' description: OK '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Internal Server Error '503': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Service Unavailable default: content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Error security: - BearerAuth: [] components: schemas: PartnerResponse: additionalProperties: false properties: applicationsCount: description: >- How many M2M applications are currently attached to this partner. A non-zero value is what makes DELETE answer 409 (IDE-1049). examples: - 2 format: int64 type: integer createdAt: description: When the partner was created (RFC 3339). examples: - '2026-01-15T09:30:00Z' type: string displayName: description: Human-readable name, unique within the organization. examples: - Loja do Zé type: string id: description: >- Server-generated identifier of the partner (UUID). This is the value to pass as partnerId when creating an application, and the value that travels in the credential's partner claim. examples: - 00000000-0000-0000-0000-000000000000 type: string ipAllowlist: description: >- The partner's own IP allowlist, or null when it inherits the organization's list. Null and an empty list are NOT the same thing here: null is inheritance, and an empty own list cannot be stored. items: $ref: '#/components/schemas/IPAllowlistEntry' type: - array - 'null' permissions: description: What the partner may do, per product. items: $ref: '#/components/schemas/PartnerPermission' type: - array - 'null' scope: description: >- Where the partner may do it, per product and dimension. An empty list means the partner is not restricted by instance in any product. items: $ref: '#/components/schemas/PartnerScope' type: - array - 'null' state: description: >- Whether the partner's credentials are honoured. Note this never reads "expired": expiry is derived from validUntil at decision time, so a closed window shows here as "active" with a past validUntil. enum: - active - suspended examples: - active type: string updatedAt: description: When it was last modified (RFC 3339). examples: - '2026-01-15T09:30:00Z' type: string validFrom: description: >- Start of the validity window (RFC 3339), or null when it is open-ended. examples: - '2026-01-01T00:00:00Z' format: date-time type: - string - 'null' validUntil: description: >- End of the validity window (RFC 3339), or null when it is open-ended. A past value means every credential of this partner is already refused. examples: - '2027-01-01T00:00:00Z' format: date-time type: - string - 'null' required: - id - displayName - state - permissions - scope - ipAllowlist - validFrom - validUntil - applicationsCount - createdAt - updatedAt type: object Detail: additionalProperties: true properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object IPAllowlistEntry: additionalProperties: false properties: cidr: description: >- Network in CIDR form, or a bare IPv4/IPv6 address which is widened to a host route (/32, /128) on persist. Malformed entries are refused with IDE-0036; the same cidr twice with IDE-1050. examples: - 203.0.113.0/24 type: string description: description: >- Free-text label for this entry, shown to operators. Never influences an access decision; bounded only by length. examples: - Loja do Zé — SP datacenter type: string required: - cidr type: object PartnerPermission: additionalProperties: false properties: actions: description: >- Verbs the partner may use on those collections, lowercase ("get", "post", "patch", "delete"). "head" is granted together with "get". Each resource/action pair must be held by one permission of your organization's editor role in the product, else IDE-1043. "*" is refused (IDE-1047). examples: - - get - post items: type: string type: - array - 'null' product: description: >- Product slug these permissions apply to, as returned by GET /v1/applications/available. Matched by exact equality; a product your organization's editor role holds nothing in is refused with IDE-1043. examples: - midaz type: string resources: description: >- Collections the partner may reach in this product, named exactly as the product declares them ("accounts", "transactions"). Each resource/action pair must be held by one permission of your organization's editor role in the product, else IDE-1043. "*" is refused (IDE-1047). examples: - - accounts - balances items: type: string type: - array - 'null' required: - product - resources - actions type: object PartnerScope: additionalProperties: false properties: field: description: >- Dimension being scoped, as the product's published scope catalog names it (GET /v1/scope-catalog/{product}). A field the catalog does not declare, or any scope line for a product that publishes no catalog, is refused with IDE-1042; a required dimension left out with IDE-0001; several values on a single-valued dimension with IDE-0002. examples: - ledgerId type: string product: description: >- Product slug this scope applies to. Must also appear in permissions, else IDE-1044. examples: - midaz type: string values: description: >- Instance identifiers for this dimension, as UUIDs. Validated for format and field membership only — existence inside the product is NOT checked, so supply values the product's own list API returned. examples: - - 00000000-0000-0000-0000-000000000000 items: type: string type: - array - 'null' required: - product - field - values type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.