---
layout: api
page_title: /sys/capabilities-self - HTTP API
description: |-
  The `/sys/capabilities-self` endpoint is used to fetch the capabilities of
  client token on the given paths.
---

> [!IMPORTANT]  
> **Documentation Update:** Product documentation, which were located in this repository under `/website`, are now located in [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs), colocated with all other product documentation. Contributions to this content should be done in the `web-unified-docs` repo, and not this one. Changes made to `/website` content in this repo will not be reflected on the developer.hashicorp.com website.

# `/sys/capabilities-self`

The `/sys/capabilities-self` endpoint is used to fetch the capabilities of the
token used to make the API call, on the given paths. The capabilities returned
will be derived from the policies that are on the token, and from the policies
to which the token is entitled to through the entity and entity's group
memberships.

## Query self capabilities

This endpoint returns the capabilities of client token on the given paths. The
client token is the Vault token with which this API call is made. Multiple
paths are taken in at once and the capabilities of the token for each path is
returned. For backwards compatibility, if a single path is supplied, a
`capabilities` field will also be returned.

@include 'api/no-capabilities.mdx'

| Method | Path                     |
| :----- | :----------------------- |
| `POST` | `/sys/capabilities-self` |

### Parameters

- `paths` `(list: <required>)` – Paths on which capabilities are being queried.

### Sample payload

```json
{
  "paths": ["secret/foo"]
}
```

### Sample request

```shell-session
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/sys/capabilities-self
```

### Sample response

```json
{
  "capabilities": ["delete", "list", "read", "update"],
  "secret/foo": ["delete", "list", "read", "update"]
}
```