GRANSKA

List actions

GEThttps://api.granska.cloud/v1/actions

Lists the follow-up actions this tenant may run against a finished analysis.

Bearer tokenSpends no quota

What an action is

An action takes a finished audit and writes something from it — the grounds for an appeal, a plain-language summary of the findings, a letter. Like profiles, actions are tenant configuration rather than a fixed feature list, so this endpoint is the only authority on what your organisation can run.

Each entry carries an id, a name, a one-line tagline and a longer description. The id is the actionType you send to POST /v1/action; the other three are written to be shown to a person choosing between them.

Naming an actionType that is not in this list answers 403 — and, because the metering middleware runs first, that rejection has already spent a run. Read the list rather than guessing.

Request
curl "https://api.granska.cloud/v1/actions?profileId=lss_utredning" \
  -H "Authorization: Bearer $TOKEN"
Response
{
  "actions": [
    {
      "id": "action_overklagande",
      "name": "Överklagandeunderlag",
      "tagline": "Skriv fram grunderna för ett överklagande",
      "description": "Sammanställer utredningens brister till ett underlag för överklagande.",
      "fitsProfileIds": [
        "lss_utredning"
      ]
    },
    {
      "id": "action_sammanfattning",
      "name": "Sammanfattning",
      "tagline": "Utredningen i klarspråk",
      "description": "Skriver om utredningens slutsatser så att den de gäller kan läsa dem."
    }
  ]
}

The actions for one profile

An action is often written for one kind of audit. Pass profileId — the same id you passed to POST /v1/analyze, and the one POST /v1/action requires — and the list comes back narrowed to the actions written for that profile. A profileId your organisation is not licensed for is a 403, not an empty list: an empty list would read as "this profile has no actions", which is a different fact.

Omit the parameter and nothing changes: the whole list comes back, exactly as it did before this parameter existed.

Each entry also carries fitsProfileIds, the binding itself, so a client that caches the list once can narrow it locally instead of calling this endpoint per profile. Three cases are listed for every profile, and they are deliberate rather than accidental:

  • an action with no fitsProfileIds at all, or an empty one — nobody has decided which profiles it is for, so it is offered everywhere;
  • an action naming the reserved id generell — decided, and decided for everybody;
  • an action whose named profiles your organisation no longer has — a binding that resolves to nothing hides the action from every list rather than from the wrong ones, so it is shown.

A list that is short because a binding could not be resolved is indistinguishable, to whoever reads it, from a list that is short because something is broken. So the narrowing only ever removes an action that certainly belongs to a different profile you actually have.

ParameterDescription
profileId
string·query
Lists only the actions written for this profile — the same id you pass to POST /v1/analyze and POST /v1/action. Omit it and the whole list comes back, exactly as before this parameter existed.An action with no profiles named, one naming the reserved id "generell", and one whose named profiles this workspace no longer has are all listed for every profile. The rule is fail-open: a list that is short because a binding could not be resolved is indistinguishable from a broken one.

Errors

ErrorWhen
401
UNAUTHORIZED
The Authorization header is missing, is not a readable bearer token, or names no tenant.
401
TOKEN_EXPIRED
The access token was issued by this gateway and has since expired. Not probed: it needs a token older than its own lifetime.
403
FORBIDDEN
The profileId named is not one this tenant is licensed for. Refused rather than answered with an empty list, so a typo cannot read as "this profile has no actions".
500
INTERNAL_ERROR
An unexpected server-side failure. Not probable from outside — reaching it means something is wrong.

Send it without writing a client

If your organisation already has an account, an administrator can list the licensed actions from the API tester at /admin/api-tester.