> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Retrieve the partner ceiling of a product > Returns the most a partner of your organization can be granted in one product: everything your organization's `-editor-role` holds, as one entry in `grants` per enabled permission bound to that role. It is the ceiling every partner write is checked against, so it is what a partner editor should offer. Read it PAIRWISE. A permission line may grant a `(resource, action)` only when ONE entry holds both — a verb an entry holds for one collection is never available for a collection another entry holds. `head` is granted together with `get`, inside the entry that holds `get`. Asking for more is refused on write with `400 IDE-1043`. Called when a partner editor opens a product, before it renders the grid of collections and verbs. The ceiling can narrow after a partner was written; a partner then keeps only what is still inside it. Read-only: nothing changes. The organization is always the one resolved from your token; there is no parameter that names another. An empty `grants` is a legitimate answer: the role holds nothing in the product, and no partner can be granted anything there. Failures: - `400 IDE-0001` — `product` is missing or blank. - `400 IDE-1057` — the identity provider refused the request (for example an unknown product); the message repeats its code and sentence. - `403` — your token does not hold the `partners` resource. - `503 IDE-0060` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. ## OpenAPI ````yaml /en/openapi/v3-current/AM-identity.yaml get /v1/partners/ceiling openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: >- OpenAPI 3.1 surface for the plugin-access-manager identity component. It exposes the M2M-gated declarations upsert (PUT /v1/declarations/{slug}), through which each plugin declares its own permissions/roles/M2M contract, and partner management (/v1/partners), through which a tenant administrator grants its own customers scoped API credentials. The remaining identity routes stay Fiber-native and are described by the separate OAS 2 document in the same folder. license: name: Apache-2.0 url: https://www.apache.org/licenses/LICENSE-2.0 title: Plugin Access Manager — Identity API version: v1 servers: [] security: [] tags: - description: >- M2M-only: each plugin declares its own permissions, roles and M2M contract, and the server reconciles them. name: Declarations - description: >- A tenant administrator's customers. Each partner holds what its credentials may DO (permissions, per product) and WHERE they may do it (scope, per product and dimension); an M2M application attached to one is confined to that intersection. Administrator-only: authorized on the "partners" resource, and every route resolves the owning organization from the caller's token. name: Partners paths: /v1/partners/ceiling: get: tags: - Partners summary: Retrieve the partner ceiling of a product description: >- Returns the most a partner of your organization can be granted in one product: everything your organization's `-editor-role` holds, as one entry in `grants` per enabled permission bound to that role. It is the ceiling every partner write is checked against, so it is what a partner editor should offer. Read it PAIRWISE. A permission line may grant a `(resource, action)` only when ONE entry holds both — a verb an entry holds for one collection is never available for a collection another entry holds. `head` is granted together with `get`, inside the entry that holds `get`. Asking for more is refused on write with `400 IDE-1043`. Called when a partner editor opens a product, before it renders the grid of collections and verbs. The ceiling can narrow after a partner was written; a partner then keeps only what is still inside it. Read-only: nothing changes. The organization is always the one resolved from your token; there is no parameter that names another. An empty `grants` is a legitimate answer: the role holds nothing in the product, and no partner can be granted anything there. Failures: - `400 IDE-0001` — `product` is missing or blank. - `400 IDE-1057` — the identity provider refused the request (for example an unknown product); the message repeats its code and sentence. - `403` — your token does not hold the `partners` resource. - `503 IDE-0060` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: getPartnerCeiling parameters: - description: Product slug, as returned by GET /v1/applications/available. explode: false in: query name: product required: true schema: description: Product slug, as returned by GET /v1/applications/available. examples: - tracer minLength: 1 type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/PartnerCeiling' description: OK '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Internal Server Error '503': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Service Unavailable default: content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Error security: - BearerAuth: [] components: schemas: PartnerCeiling: additionalProperties: false properties: grants: description: >- One entry per enabled permission bound to your organization's -editor-role. A (resource, action) can be granted to a partner only when ONE entry holds both; head is granted together with get inside the entry that holds get. Empty when the role holds nothing in the product: no partner can then be granted anything in it. items: $ref: '#/components/schemas/PartnerCeilingGrant' type: - array - 'null' product: description: Product slug the ceiling is for. examples: - tracer type: string required: - product - grants type: object Detail: additionalProperties: true properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object PartnerCeilingGrant: additionalProperties: false properties: actions: description: Verbs this permission holds on every one of those collections. examples: - - get - post items: type: string type: - array - 'null' resources: description: Collections this permission holds, as the product names them. examples: - - validations items: type: string type: - array - 'null' required: - resources - actions type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.