> ## Documentation Index > Fetch the complete documentation index at: https://developers.askparable.com/llms.txt > Use this file to discover all available pages before exploring further. # Read how current the source permissions projection is > Returns, for each Provider whose tables source permissions model, when the access projection was built, the oldest input sync it used, its age, and whether it is current, aging (older than 30 hours) or stale (older than 36 hours), or not built. A read of a modeled table under source permissions uses an aging or stale projection, and is refused while the projection is not built. Each Provider lists its modeled tables and, for each anchored table, the column that holds the row’s anchor key. ## Access This operation needs a Parable token. An MCP token cannot call it. See [Authentication](/getting-started/authentication.md) for the kinds of token. Your roles must grant one of `tenant.providerpolicies.view`, `tenant.providerpolicies.manage`. ## Errors * `WA-PP-007`: Parable could not read the access projection. Try again. ## OpenAPI ````yaml /api-reference/openapi.json get /api/provider-policies/source-permissions/freshness openapi: 3.0.3 info: description: >- Use the Workspace API to work with artifacts, connectors, Parables, and account resources. title: Workspace API version: v2026.10.22.1 servers: [] security: [] paths: /api/provider-policies/source-permissions/freshness: get: tags: - Provider policies summary: Read how current the source permissions projection is description: >- Returns, for each Provider whose tables source permissions model, when the access projection was built, the oldest input sync it used, its age, and whether it is current, aging (older than 30 hours) or stale (older than 36 hours), or not built. A read of a modeled table under source permissions uses an aging or stale projection, and is refused while the projection is not built. Each Provider lists its modeled tables and, for each anchored table, the column that holds the row’s anchor key. operationId: ProviderPoliciesGetSourcePermissionsFreshnessHandler parameters: - description: >- Workspace slug. Overrides subdomain-based workspace resolution when provided. in: header name: X-Tenant required: false schema: example: acme type: string - description: Optional request correlation ID echoed back in the response. in: header name: X-Request-ID required: false schema: example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/SourcePermissionsFreshnessResponse' links: $ref: '#/components/schemas/ResponseLinks' meta: $ref: '#/components/schemas/ResponseMeta' required: - data - meta type: object description: Successful response headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '400': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The request is not valid. `detail` says why. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '401': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The token is missing, malformed, revoked, or expired. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '403': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: >- The token cannot make this request. For example, the roles of its owner do not allow the operation. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '429': content: text/plain: schema: example: Too Many Requests type: string description: >- More than 120 requests a minute came from your address. Wait for the number of seconds in `Retry-After`, then try again. headers: Retry-After: description: The number of seconds to wait before you try again. schema: type: integer X-Request-ID: $ref: '#/components/headers/X-Request-ID' '500': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The request failed on the server. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' security: - bearerAuth: [] x-codeSamples: - label: TypeScript SDK lang: typescript source: >- import { WebApiSDK } from "@parable-platform/web-api-sdk"; const sdk = new WebApiSDK({ baseUrl: process.env.PARABLE_API_URL!, auth: { token: process.env.PARABLE_API_TOKEN! }, requestInterceptor: (config) => ({ ...config, headers: { ...config.headers, "X-Tenant": process.env.PARABLE_WORKSPACE! }, }), }); const result = await sdk.providerPolicies.getSourcePermissionsFreshness(); - label: Python SDK lang: python source: |- import os from parable_web_api_sdk import ClientConfig, WebApiSDK sdk = WebApiSDK( ClientConfig( base_url=os.environ["PARABLE_API_URL"], auth_token=os.environ["PARABLE_API_TOKEN"], default_headers={"X-Tenant": os.environ["PARABLE_WORKSPACE"]}, ) ) result = sdk.provider_policies.get_source_permissions_freshness() - label: Rust SDK lang: rust source: >- use parable_web_api_sdk::{ClientConfig, RequestOptions, WebApiSdk}; let sdk = WebApiSdk::new(ClientConfig::with_base_url( std::env::var("PARABLE_API_URL")?, Some(std::env::var("PARABLE_API_TOKEN")?), None, ))?; let options = RequestOptions::with_header("X-Tenant", std::env::var("PARABLE_WORKSPACE")?, None, None); let result = sdk.provider_policies.get_source_permissions_freshness( Some(&options) ).await?; - label: Go SDK lang: go source: "sdk, err := webapisdk.New(webapisdk.SDKConfig{\n\tBaseURL: os.Getenv(\"PARABLE_API_URL\"),\n\tAuth: &webapisdk.AuthConfig{Token: os.Getenv(\"PARABLE_API_TOKEN\")},\n\tRequestInterceptor: func(ctx context.Context, req *http.Request) error {\n\t\treq.Header.Set(\"X-Tenant\", os.Getenv(\"PARABLE_WORKSPACE\"))\n\t\treturn nil\n\t},\n})\nif err != nil {\n\treturn err\n}\n\nresult, err := sdk.ProviderPoliciesNamespace.GetSourcePermissionsFreshness(ctx)" components: schemas: SourcePermissionsFreshnessResponse: description: How current the source permissions projection is, for each Provider. properties: agingAfterSeconds: description: The ages past which a projection is aging and stale, in seconds. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer providers: description: Each Provider with a modeled table, by schema name. items: $ref: '#/components/schemas/SourcePermissionsProvider' type: array served: description: >- Whether the Workspace's catalog serves the access projection. When it does not, every Provider is not built. type: boolean staleAfterSeconds: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer required: - served - agingAfterSeconds - staleAfterSeconds - providers type: object ResponseLinks: properties: first: nullable: true type: string last: nullable: true type: string next: nullable: true type: string prev: nullable: true type: string type: object ResponseMeta: properties: requestId: description: Unique identifier for the request type: string totalCount: description: Total count of items for paginated responses nullable: true type: integer required: - requestId type: object ProblemDetails: description: An error response in the Problem Details format (RFC 9457). properties: code: description: The stable error code, when the problem has one. example: WA-VL-001 type: string detail: description: What went wrong with this request. type: string details: description: >- Structured facts about the refusal, such as the entity or the path it concerns. Only some refusals have it. errors: description: >- The fields or filters that failed validation. Only a validation or filter error has it. requestId: description: >- The ID of the request, when the problem has one. The `X-Request-ID` response header always has it. type: string status: description: The HTTP status code. example: 400 type: integer title: description: A short summary, usually the text of the HTTP status. example: Bad Request type: string type: description: >- The problem type. It is `about:blank`: the status and `code` identify the problem. example: about:blank type: string required: - type - title - status - detail type: object SourcePermissionsProvider: description: One Provider whose tables source permissions model. properties: ageSeconds: description: |- Now minus computedAt, in whole seconds. 0 when the projection is not built: `state` says which. format: int64 maximum: 9007199254740991 minimum: 0 type: integer computedAt: description: >- When the access job built this Provider's projection. Null when it has not. format: date-time nullable: true type: string oldestInputAt: description: The time of the oldest input sync the projection used. format: date-time nullable: true type: string providerKey: description: >- The catalog's entity_connector_id, as a Provider Policy names it, and the connector id of the access projection's rows. pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string schemaName: description: A URL friendly version of a string maxLength: 255 minLength: 1 pattern: ^[a-z0-9]+(?:[-_][a-z0-9]+)*$ type: string state: $ref: '#/components/schemas/SourcePermissionsFreshnessState' tables: items: $ref: '#/components/schemas/SourcePermissionsTable' type: array required: - providerKey - schemaName - ageSeconds - state - tables type: object SourcePermissionsFreshnessState: description: >- How current one Provider's access projection is. The thresholds are the stale monitor's: `aging` past its warning, `stale` past its critical threshold. A read under source permissions still uses an aging or stale projection. A Provider that is `not_built` has no projection, so a read of its modeled tables under source permissions is refused (QL-TN-009). enum: - current - aging - stale - not_built type: string SourcePermissionsTable: description: |- One table source permissions model, as the catalog's served layouts classify it. properties: access: $ref: '#/components/schemas/SourcePermissionsTableAccess' anchorColumn: description: >- For an anchored table, the column that holds each row's anchor key, as the catalog serves it. A field of a struct column is `column.field`. Null for any other table. nullable: true type: string logicalName: type: string parentTableKey: description: For a child table, its main table's key. nullable: true pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string tableKey: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string tableKind: $ref: '#/components/schemas/CatalogTableKindEnum' required: - tableKey - logicalName - tableKind - access type: object SourcePermissionsTableAccess: description: How source permissions decide the rows of one modeled table. enum: - anchored - source_users - unrestricted - unresolved type: string CatalogTableKindEnum: description: |- Position of a served table in its Tap's mapping plan. SQL over Flight serves the same values under the `parable.annotation.table_kind` schema metadata key. enum: - main - quarantine - child - child_quarantine type: string headers: X-Request-ID: description: >- The ID of the request. It is the `X-Request-ID` value that you sent, or an ID that the server made. Give it when you report a problem. schema: type: string securitySchemes: bearerAuth: description: >- A personal access token, which starts with `pat_`. A Parable token can call each operation that the roles of its owner allow. An MCP token can call only the read operations that are open to agents. A SQL token does not work on this API. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.