@Sven Geusens my approach a lot simpler/dumb as it just protecting the API controller by checking the root node -1 as the path/node to get permissions for https://github.com/warrenbuckley/Examine-Peek/pull/11 Unless you know of another service & method I should use/call for this ?

csharp
var permissions = umbracoUser.GetPermissions(Constants.System.RootString, _userService);

Yeah, that works out fine. Alternative to the extension method is using the actual call underneath that uses the userservice you pass in.

indeed

Do you know how I could use the GUID from the request to the API as it part of a path as I could use that instead of -1 / root

That is one of the things I need to figure out too for the granular version of my attribute. It is available on the request object in its raw unparsed form. The trick is to pick it up in your authorization handler. We should be able to inject a RequestAccesor in there and go from there.

Hmm OK I will play around and investifate