> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hebbianrobotics.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Effective capabilities of the request's principal.



## OpenAPI

````yaml https://api.hebbianrobotics.com/openapi.json get /api/access
openapi: 3.1.0
info:
  title: squash
  description: >-
    Semantic search and debugging over LeRobot robot-episode datasets: register
    and index datasets, search episodes by natural language with frame-level
    evidence, inspect and annotate episodes, run episode-level analytics, export
    selections as new LeRobot datasets, and follow every operation live on the
    global event stream.


    Requests may select an organization's data by sending its id in the
    `X-Squash-Organization-Id` header; without it a request is scoped to public
    data.
  license:
    name: Apache-2.0
    identifier: Apache-2.0
  version: 0.0.0
servers:
  - url: https://api.hebbianrobotics.com
    description: Hosted squash API
security:
  - {}
  - bearer_token: []
tags:
  - name: search
    description: Natural-language search over indexed episodes.
  - name: episodes
    description: >-
      Browse, inspect, and stream one episode's metadata, frames, and
      timeseries.
  - name: datasets
    description: Register datasets, follow indexing, and manage catalog entries.
  - name: analytics
    description: >-
      Corpus-level measurements: similarity, near-duplicates, coverage, and
      consistency.
  - name: quality
    description: >-
      Stored Quality Indexing reports: diversity and cleanliness scores over an
      enriched corpus.
  - name: annotations
    description: 'Human curation: episode annotations and mutually-exclusive curation flags.'
  - name: exports
    description: Export a selection of episodes as a new LeRobot dataset.
  - name: jobs
    description: 'Durable pipeline jobs: acquisition, conversion, and their records.'
  - name: backfills
    description: Queue derived-artifact backfills against an active index.
  - name: events
    description: Server-sent event streams of live activity.
  - name: access
    description: The effective capabilities of the calling principal.
paths:
  /api/access:
    get:
      tags:
        - access
      summary: Effective capabilities of the request's principal.
      operationId: get_access
      parameters:
        - name: Authorization
          in: header
          description: Optional bearer credential
          required: false
          schema:
            type:
              - string
              - 'null'
        - name: X-Squash-Organization-Id
          in: header
          description: Optional organization selector for the legacy CLI operator
          required: false
          schema:
            type:
              - string
              - 'null'
      responses:
        '200':
          description: Effective request capabilities
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessResponse'
        '401':
          description: Invalid supplied credential
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiErrorBody'
components:
  schemas:
    AccessResponse:
      type: object
      description: Effective access granted to the principal represented by the request.
      required:
        - scope
        - capabilities
        - writes_require_admin
      properties:
        capabilities:
          type: array
          items:
            $ref: '#/components/schemas/Capability'
        scope:
          $ref: '#/components/schemas/DataScope'
        writes_require_admin:
          type: boolean
          description: >-
            `true` exactly when the server runs in gated mode (an admin token is

            configured): privileged endpoints require an authorization bearer
            token,

            while public reads stay open. `false` in open mode.
    ApiErrorBody:
      type: object
      description: Error payload returned by every failing API route.
      required:
        - code
        - message
      properties:
        code:
          type: string
          description: Machine-readable error code, e.g. `dataset_not_found`.
        message:
          type: string
          description: Human-readable message.
    Capability:
      type: string
      description: Finite wire values returned by `GET /api/access`.
      enum:
        - view_data
        - view_internals
        - curate_data
        - export_data
        - manage_datasets
        - manage_jobs
    DataScope:
      oneOf:
        - type: object
          description: >-
            Historical public-beta data. This remains the deserialization
            default

            for durable records written before tenancy existed.
          required:
            - kind
          properties:
            kind:
              type: string
              enum:
                - public
        - type: object
          description: Data owned by one verified organization.
          required:
            - organization_id
            - kind
          properties:
            kind:
              type: string
              enum:
                - organization
            organization_id:
              $ref: '#/components/schemas/OrganizationId'
      description: >-
        The tenant boundary applied to every dataset, job, event, and storage
        key.
    OrganizationId:
      type: string
      description: |-
        A verified WorkOS-compatible organization identifier.

        The conservative URL-safe alphabet keeps the value safe in request
        headers, object-storage prefixes, and durable workflow keys without
        additional escaping.
  securitySchemes:
    bearer_token:
      type: http
      scheme: bearer
      description: >-
        Capability-bearing token issued by a squash operator. Required for
        curation, exports, dataset registration, and job control when the
        deployment runs in gated mode; public reads stay open. `GET /api/access`
        reports the capabilities a given credential actually carries.

````