List permissions

October 12, 2026

Table of contents

  1. Request Headers
  2. Responses
  3. Model
  4. Examples
  5. Try It

Read what the Muse agent on this account may do without asking: the two default settings, and the standing rules for single websites and app actions.

  • web covers the websites the agent reaches, for example while it runs code.
  • connectors covers actions in the apps connected to the Muse account, such as email or calendar.

Each one is auto_allow or always_ask:

  • auto_allow is Muse’s “Ask for some actions”, the default. Muse may act without asking, for example send an email from a connected Gmail.
  • always_ask is Muse’s “Always ask”. Muse asks before each such action, and the question comes to the chat as an approval.

Change the defaults with POST /accounts/email/permissions.

A rule allows or denies one website or app action, whatever the default says. A rule is created when you answer an approval with allow_always, or when you allow something for good in the muse.ai app. Change a rule with POST /accounts/email/permissions/permissionId, or remove it with DELETE /accounts/email/permissions/permissionId.

https://api.useapi.net/v1/muse/accounts/email/permissions

  • email is the email of an added account, URL-encoded in the path.
Request Headers 
Authorization: Bearer {API token}
Responses

  • 200 OK

    {
  "email": "[email protected]",
  "defaults": {
    "web": "auto_allow",
    "connectors": "auto_allow"
  },
  "rules": [
    {
      "permissionId": "network_rule:hitl_domain_allow_nodesource_com_afdc93c7",
      "type": "web",
      "mode": "allow",
      "modes": ["allow", "ask", "deny"],
      "title": "nodesource.com",
      "target": "nodesource.com:80,443",
      "note": null,
      "lifetime": "durable",
      "revocable": true,
      "created": null
    },
    {
      "permissionId": "transient_connector:connector-context-write:708c1f254e09d74cffc023608a684291b6a72eaef90880502d28a1ab33381840",
      "type": "connector",
      "mode": "allow",
      "modes": ["allow", "ask", "deny"],
      "title": "Download files in Browser",
      "target": "browser:page.download",
      "note": "For Heartbeat · Scheduled task",
      "lifetime": "durable",
      "revocable": true,
      "created": "2026-10-05T05:12:39.495Z"
    }
  ]
}

  • 401 Unauthorized — Invalid API token.

    {
  "error": "useapi.net ⁝ Unauthorized",
  "code": 401
}

  • 404 Not Found — the account named by email is not added.

    {
  "error": "Account [email protected] is not configured",
  "code": 404
}

  • 503 Service Unavailable — Muse could not be read right now. Retry shortly.

    {
  "error": "Muse could not be read right now (…), please retry",
  "code": 503
}

  • 596 Account Error

    The account needs your attention, and it is paused until you add it again. You receive an email when this happens. There are two causes.

    Meta asks for a security check on the account. Sign in once at muse.ai in a browser, complete the check, then add the account again with POST /accounts using the same email and password. The API keeps using its session, so no new sign-in is needed.

    {
  "error": "Account [email protected]: Meta asks for a security check on account [email protected] (\"This account must complete a security checkpoint on the web\"). Sign in once at https://muse.ai in a browser, complete the check, then add the account again with POST /accounts",
  "code": 596
}

    Or Muse refused to sign the account in again when its session needed renewing, most often because the password was changed. Add the account again with the current password.

    {
  "error": "Account [email protected]: Muse refused to sign in account [email protected] (…). Update its password with POST /accounts, or sign in at https://muse.ai to clear the block, then re-add it",
  "code": 596
}
Model 
{ // TypeScript, all fields are optional
  email: string
  defaults: {
    web: 'auto_allow' | 'always_ask' | null
    connectors: 'auto_allow' | 'always_ask' | null
  }
  rules: Rule[]
  error?: string               // errors only
  code?: number                // errors only
}

type Rule = {
  permissionId: string         // use it in POST / DELETE /accounts/{email}/permissions/{permissionId}
  type: 'web' | 'connector'    // web: a website the agent may reach; connector: an action in a connected app
  mode: string | null          // allow or deny
  modes: string[]              // the modes this rule can take: allow, ask, deny
  title: string | null         // e.g. "nodesource.com", "Download files in Browser"
  target: string | null        // e.g. "nodesource.com:80,443", "browser:page.download"
  note: string | null
  lifetime: string | null      // e.g. durable
  revocable: boolean
  created: string | null       // ISO 8601
}
Examples 
  • EMAIL="[email protected]"
curl -H "Authorization: Bearer …" \
     "https://api.useapi.net/v1/muse/accounts/$(python3 -c "import urllib.parse,sys;print(urllib.parse.quote(sys.argv[1],safe=''))" "$EMAIL")/permissions"

  • const token = "API token";
const email = "Previously added account email";
const apiUrl = `https://api.useapi.net/v1/muse/accounts/${encodeURIComponent(email)}/permissions`;
const response = await fetch(apiUrl, {
  method: "GET",
  headers: {
    "Authorization": `Bearer ${token}`,
  }
});
console.log("response", response.status, await response.json());

  • import requests
from urllib.parse import quote
token = "API token"
email = "Previously added account email"
apiUrl = f"https://api.useapi.net/v1/muse/accounts/{quote(email, safe='')}/permissions"
headers = {
    "Authorization" : f"Bearer {token}"
}
response = requests.get(apiUrl, headers=headers)
print(response, response.json())
Try It