> ## Documentation Index
> Fetch the complete documentation index at: https://devdocs.xbox.com/llms.txt
> Use this file to discover all available pages before exploring further.

# POST (/users/{requestorId}/permission/validate)

> POST (/users/{requestorId}/permission/validate)

# POST (/users/{requestorId}/permission/validate)

Gets a set of yes-or-no answers about whether the user is allowed to perform specified actions with a set of target users.

* [Remarks](#ID4EQ)
* [URI parameters](#ID4ECB)
* [Authorization](#ID4ENB)
* [Required Request Headers](#ID4ESC)
* [Request body](#ID4E4D)
* [HTTP status codes](#ID4ETE)
* [Required Response Headers](#ID4EIG)
* [Response body](#ID4E5H)

<a id="ID4EQ" />

## Remarks

The request body takes a list of users and a list of settings, and the result is an allowed/blocked result for each user/setting pair.

In cross-network multiplayer scenarios (where privacy communications checks must be performed between users that have an XBOX User ID (XUID) and off-network users that do not), please refer to [PermissionCheckBatchRequest (JSON)](/reference/live/rest/json/json-permissioncheckbatchrequest) for User types.

<a id="ID4ECB" />

## URI parameters

| Parameter   | Type   | Description                                                                                                                                                                                                 |
| ----------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| requestorId | string | Required. Identifier of the user performing the action. The possible values are <code>xuid({xuid})</code> and <code>me</code>. This must be a logged-in user. Example value: <code>xuid(0987654321)</code>. |

<a id="ID4ENB" />

## Authorization

Authorization claims used | Claim| Type| Required?| Example value|
\| --- | --- | --- | --- | --- | --- | --- |
\| Xuid| 64-bit signed integer| yes| 1234567890|

<a id="ID4ESC" />

## Required Request Headers

\| Header| Type| Description|
\| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
\| Authorization| string| Authentication credentials for HTTP authentication. Example values: <code>XBL3.0 x=\<userhash>;\<token></code>|
\| X-RequestedServiceVersion| string| Build name/number of the XBOX LIVE service to which this request should be directed. The request will only be routed to that service after verifying the validity of the header, the claims in the auth token, etc. Example value: 1.|

<a id="ID4E4D" />

## Request body

<a id="ID4EDE" />

### Required members

See [PermissionCheckBatchRequest (JSON)](/reference/live/rest/json/json-permissioncheckbatchrequest).

```cpp theme={null}
{
    "users":
    [
        {"xuid":"12345"},
        {"xuid":"54321"}
    ],
    "permissions":
    [
        "ViewTargetGameHistory",
        "ViewTargetProfile"
    ]
}

```

<a id="ID4ETE" />

## HTTP status codes

The service returns one of the status codes in this section in response to a request made with this method on this resource. For a complete list of standard HTTP status codes used with XBOX Live Services, see [Standard HTTP status codes](/reference/live/rest/additional/httpstatuscodes).

\| Code| Reason phrase| Description|
\| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
\| 200| OK| The session was successfully retrieved.|
\| 400| The request is invalid.| Examples: incorrect setting IDs, incorrect URIs, etc.|
\| 404| The user specified in the URI does not exist.| The specified resource could not be found.|

<a id="ID4EIG" />

## Required Response Headers

\| Header| Type| Description|
\| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
\| Content-Type| string| The MIME type of the body of the request. Example value: <code>application/json</code>|
\| Content-Length| string| The number of bytes being sent in the response. Example value: 34|
\| Cache-Control| string| Polite request from the server to specify caching behavior. Example: <code>no-cache, no-store</code>|

<a id="ID4E5H" />

## Response body

See [PermissionCheckBatchResponse (JSON)](/reference/live/rest/json/json-permissioncheckbatchresponse).

<a id="ID4ELAAC" />

### Sample response

```cpp theme={null}
{
    "responses":
    [
        {
            "user": {"xuid":"12345"},
            "permissions":
            [
                {
                    "isAllowed":true
                },
                {
                    "isAllowed":true
                }
            ]
        },
        {
            "user": {"xuid":"54321"},
            "permissions":
            [
                {
                    "isAllowed":false,
                    "reasons":
                    [
                        {"reason":"NotAllowed"}
                    ]
                },
                {
                    "isAllowed":false,
                    "reasons":
                    [
                        {"reason":"PrivilegeRest", "restrictedSetting":"AllowProfileViewing"}
                    ]
                }
            ]
        }
    ]
}

```

<a id="ID4EVAAC" />

## See also

<a id="ID4EXAAC" />

##### Parent

[/users/{requestorId}/permission/validate](/reference/live/rest/uri/privacy/uri-privacyusersrequestoridpermissionvalidate)

[PermissionId Enumeration](/reference/live/rest/enums/privacy-enum-permissionid)


## Related topics

- [PermissionId Enumeration](/reference/live/rest/enums/privacy-enum-permissionid.md)
- [Enumeración PermissionId](/es/reference/live/rest/enums/privacy-enum-permissionid.md)
- [PermissionId 枚举](/zh-CN/reference/live/rest/enums/privacy-enum-permissionid.md)
- [PermissionId 列挙体](/ja-jp/reference/live/rest/enums/privacy-enum-permissionid.md)
- [XblPermissionDenyReason](/reference/live/xsapi-c/privacy_c/enums/xblpermissiondenyreason.md)