collection.getPermissions

This method returns the private access permissions configured for a flipbook.

Request method

collection.getPermissions uses GET.

Endpoint:

https://api.flipsnack.com/v1/

Request parameters

Name	Type	Required	Description
action	string	Yes	Must be collection.getPermissions.
apiKey	string	Yes	Your Flipsnack API key.
signature	string	Yes	Request signature generated with your API secret.
collectionHash	string	Yes	The hash of the flipbook.

Permission object

The response contains a permissions array. Each item has one of these type values:

Type	Fields	Description
teammate	none	All accepted readers from the workspace have access.
teammate	email	One accepted reader from the workspace has access.
teammate	group	All readers from the specified workspace group have access.
otp	email	A viewer has access through one-time password email authentication.
sso	none	All SSO-authenticated viewers for the workspace/profile have access.
sso	group	SSO-authenticated viewers from the specified group have access.

group is a field containing the group name. It is not a permission type.

notifyViaEmail is not returned by collection.getPermissions. It is a request-only option for collection.setPermissions.

Request example

curl -X GET \
     -G \
     https://api.flipsnack.com/v1/ \
     -d action=collection.getPermissions \
     -d apiKey=<YOUR-API-KEY> \
     -d signature=<YOUR-REQUEST-SIGNATURE> \
     -d collectionHash=<COLLECTION-HASH>

Response examples

Recommended usage is to keep permissions of the same type in one access list.

Teammate response

{
  "code": 20,
  "status": "OK",
  "data": {
    "permissions": [
      {
        "type": "teammate",
        "group": "mygroup2"
      },
      {
        "type": "teammate",
        "email": "[e-mail]"
      }
    ]
  }
}

SSO response

{
  "code": 20,
  "status": "OK",
  "data": {
    "permissions": [
      {
        "type": "sso",
        "group": "mygroup1"
      }
    ]
  }
}

OTP response

{
  "code": 20,
  "status": "OK",
  "data": {
    "permissions": [
      {
        "type": "otp",
        "email": "[e-mail]"
      },
      {
        "type": "otp",
        "email": "[e-mail]"
      }
    ]
  }
}

If no private access permissions are configured:

{
  "code": 20,
  "status": "OK",
  "data": {
    "permissions": []
  }
}

Notes

• The method is available only for flipbooks eligible for private access permissions. Private flipbooks can be created or set using the collection.create and collection.update actions.

• The order of returned permissions follows the saved access rows.

• Unknown/deleted groups or readers that no longer resolve may be omitted from the response.

Error responses

All errors return JSON with at least code and status. Some failures also include a data object.

Request, auth, and access errors

Code	Status	When
30	Missing mandatory parameter	apiKey, signature, action, or collectionHash is missing.
31	Requests per second limit exceeded	API rate limit exceeded.
32	Requests per minute limit exceeded	API rate limit exceeded.
41	Invalid credentials	The API key is invalid.
44	Invalid signature	The request signature is invalid (Flipsnack/MCP keys).
46	Invalid collection hash	The collection hash does not exist.
43	Forbidden	The collection does not belong to the API key workspace, is deleted, or the tenant does not match.
40	Bad Request	The action was sent with the wrong HTTP method (must be GET).

Permissions-specific errors

Code	Status	When
48	Permissions are only available for published private flipbooks	The flipbook is not published, is not private, or has a password set.
40	Bad Request	The permissions service rejected the request (see data.errors when present).
50	Operation failed	The permissions service returned an unexpected response.

Example — not eligible:

{
  "code": 48,
  "status": "Permissions are only available for published private flipbooks"
}