Get effective access on an asset

Read the access that you, or another user, have on an asset, and every grant that gives it. The level is what Athena’s permission checks decide for the user in the asset’s own workspace, whichever workspace is active for your key: ‘view’ can open the asset, ‘edit’ can also change it and manage its sharing, ‘owner’ created it and can edit it, and ‘none’ cannot open it. Each source names one grant: ‘owner’, ‘direct’ (shared with the user), ‘group’ (shared with a workspace group the user belongs to), ‘workspace’ (shared with the whole workspace), ‘drive’ (a role on the drive) or ‘other’ (access the share list does not hold, for example an environment admin). A folder’s sharing reaches each asset inside it as that asset’s own share, so a ‘workspace’ source on a sub-folder shows that a share of its parent folder reached it. Without user_id the route reads your own access; you need view access to the asset and membership in its workspace. To read another user’s access, pass their user_id; you need edit access to the asset, as for sharing it. A user who is not a member of the asset’s workspace, or who does not exist, reads as ‘none’ with is_member false. A suspended member reads as ‘none’ with no sources, and is_member still reports their membership. When a permission check cannot be answered (for example on an asset in a drive while the authorization service is unavailable), the route answers 503 and never a level. The route never changes a permission.