Streamed List Objects (All Syncs)
curl --request POST \
--url https://sync.useparagon.com/api/permissions/streamed-list-objects \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"objectType": "file",
"user": "email@example.com",
"role": "can_read"
}
'import requests
url = "https://sync.useparagon.com/api/permissions/streamed-list-objects"
payload = {
"objectType": "file",
"user": "email@example.com",
"role": "can_read"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({objectType: 'file', user: 'email@example.com', role: 'can_read'})
};
fetch('https://sync.useparagon.com/api/permissions/streamed-list-objects', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://sync.useparagon.com/api/permissions/streamed-list-objects",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'objectType' => 'file',
'user' => 'email@example.com',
'role' => 'can_read'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://sync.useparagon.com/api/permissions/streamed-list-objects"
payload := strings.NewReader("{\n \"objectType\": \"file\",\n \"user\": \"email@example.com\",\n \"role\": \"can_read\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://sync.useparagon.com/api/permissions/streamed-list-objects")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"objectType\": \"file\",\n \"user\": \"email@example.com\",\n \"role\": \"can_read\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://sync.useparagon.com/api/permissions/streamed-list-objects")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"objectType\": \"file\",\n \"user\": \"email@example.com\",\n \"role\": \"can_read\"\n}"
response = http.request(request)
puts response.read_body"<string>"Permissions API
Streamed List Objects (All Syncs)
List all accessible objects across syncs for a user as a streamed response.
POST
/
api
/
permissions
/
streamed-list-objects
Streamed List Objects (All Syncs)
curl --request POST \
--url https://sync.useparagon.com/api/permissions/streamed-list-objects \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"objectType": "file",
"user": "email@example.com",
"role": "can_read"
}
'import requests
url = "https://sync.useparagon.com/api/permissions/streamed-list-objects"
payload = {
"objectType": "file",
"user": "email@example.com",
"role": "can_read"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({objectType: 'file', user: 'email@example.com', role: 'can_read'})
};
fetch('https://sync.useparagon.com/api/permissions/streamed-list-objects', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://sync.useparagon.com/api/permissions/streamed-list-objects",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'objectType' => 'file',
'user' => 'email@example.com',
'role' => 'can_read'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://sync.useparagon.com/api/permissions/streamed-list-objects"
payload := strings.NewReader("{\n \"objectType\": \"file\",\n \"user\": \"email@example.com\",\n \"role\": \"can_read\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://sync.useparagon.com/api/permissions/streamed-list-objects")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"objectType\": \"file\",\n \"user\": \"email@example.com\",\n \"role\": \"can_read\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://sync.useparagon.com/api/permissions/streamed-list-objects")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"objectType\": \"file\",\n \"user\": \"email@example.com\",\n \"role\": \"can_read\"\n}"
response = http.request(request)
puts response.read_body"<string>"Use this endpoint to enumerate every object a principal user can access across all syncs associated with a Connected User.
This is useful when your app connects a user to multiple File Storage syncs, and you want a single list of permitted document IDs to feed into a search or vector index filter.
For queries against a single Sync, use the sync-scoped Streamed List Objects endpoint instead.
If a specific sync fails to enumerate (for example, its authorization store is temporarily unavailable), a single line with an
Parse the response one line at a time. Each line is independently valid JSON; the response body as a whole is not.
Response format
The response is sent asapplication/x-ndjson with Transfer-Encoding: chunked. Each line of the response body is a JSON object tagged with the source syncInstanceId and integration.
Success lines include an object field, whose value is the UUID of a Synced Object the user has access to with the specified role:
{"syncInstanceId":"3f8a1c2e-9b4d-4e71-a6f2-8d0c5b1e7a93","integration":"googledrive","object":"a657df3b-17e2-5989-bc5f-13ddb7fdab41"}
{"syncInstanceId":"3f8a1c2e-9b4d-4e71-a6f2-8d0c5b1e7a93","integration":"googledrive","object":"b842ec1c-2f3a-4a91-9f8d-6cf2b73a1d04"}
{"syncInstanceId":"91cd4f0a-2e58-4b3b-8a1c-7d9e2b0c41ef","integration":"sharepoint","object":"c91f0a2d-4e58-4b3b-8a1c-7d9e2b0c41ef"}
error field is emitted for that sync and the stream continues with the remaining syncs:
{"syncInstanceId":"91cd4f0a-2e58-4b3b-8a1c-7d9e2b0c41ef","integration":"sharepoint","error":"Error streaming list-objects"}
Notes
- Only syncs that belong to the authenticated Connected User and project are queried. Syncs without an authorization store (for example, integrations that do not support Permissions API) are skipped silently.
- Per-sync errors do not abort the stream — inspect each line for an
errorfield so that you can retry or surface individual failures without discarding results from successful syncs.
Authorizations
Paragon User Token. Add to the Authorization header of your requests.
Body
application/json
The type of object to list.
Available options:
file, folder Example:
"file"
The email of the user to list accessible objects for.
Example:
"email@example.com"
The role to use for identifying accessible objects.
Available options:
can_read, can_write, is_owner Example:
"can_read"
Response
A newline-delimited JSON stream. Each line is a JSON object tagged with syncInstanceId and integration. Success lines include an object field with the UUID of a Synced Object the user has access to. If a specific sync fails to enumerate, a line with an error field is emitted for that sync instead, and the stream continues with the remaining syncs.
The response is of type string.
Was this page helpful?