# `LightningWeb.Plugs.AuthorizeAction`
[🔗](https://github.com/OpenFn/lightning/blob/main/lib/lightning_web/plugs/authorize_action.ex#L1)

Refuses an API action early, on facts about the caller alone, before the
action parses a body or loads anything.

    plug AuthorizeAction, {:project_users, :access_project} when action == :show

It runs after the pipeline has authenticated the caller. It builds the
caller's `Lightning.Scope` and asks `Lightning.Policies.Permissions.permit/3`,
which checks only the token grant. A refusal is answered by
`LightningWeb.API.FallbackController`. A pass assigns the scope as `:scope`
for the action to reuse. Passing is not permission: an action with a target
still asks about it through `LightningWeb.API.Target`.

# `call`

# `init`

---

*Consult [api-reference.md](api-reference.md) for complete listing*