---
title: "Ask what someone would see"
description: "Preview the rows and fields a set of roles would see on a table, without granting access; show the result for each role to identify which role grants access."
canonical: "https://grid82.com/docs/builder-api/rules/simulate"
updated: "2026-11-13"
---

# Ask what someone would see

`POST https://studio.grid82.app/v1/apps/{appId}/rules/simulate`

Preview the rows and fields a set of roles would see on a table, without granting access; show the result for each role to identify which role grants access.

Run before changing rules.

Requires the `schema:read` scope. Operation `rules.simulate`. MCP tool `rules_simulate`. CLI: `grid82 rules simulate` (`npx grid82`).

## Path parameters

| Name    | Type   | Required | Description |
| ------- | ------ | -------- | ----------- |
| `appId` | string | yes      |             |

## Headers

| Name              | Type   | Required | Description                                                                                                                                                                                                                                                        |
| ----------------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `Idempotency-Key` | string | no       | Any unique string. Sending the same key with the same request again returns the first response (marked `Idempotency-Replayed: true`) instead of running it twice. Reusing it for a different request is refused with 409. Kept for 24 hours. Up to 255 characters. |

## Request body

| Field     | Type                                       | Required | Description |
| --------- | ------------------------------------------ | -------- | ----------- |
| `roles`   | string\[]                                  | yes      |             |
| `tableId` | string                                     | yes      |             |
| `op`      | "read" or "create" or "update" or "delete" | yes      |             |

**Authorizations**

- `Authorization` (bearer, in header, required)

## Response

**200**: Success

- `data` (`object`, required)
- `data.allowed` (`boolean`, required)
- `data.readableFields` (`string[]`, required)
- `data.writableFields` (`string[]`, required)
- `data.matchedRows` (`integer`, required)
- `data.byRole` (`object[]`, required)
- `data.byRole.role` (`string`, required)
- `data.byRole.allowed` (`boolean`, required)
- `data.byRole.readableFields` (`string[]`, required)

```json
{
  "data": {
    "allowed": true,
    "readableFields": [
      "<string>"
    ],
    "writableFields": [
      "<string>"
    ],
    "matchedRows": 123,
    "byRole": [
      {
        "role": "<string>",
        "allowed": true,
        "readableFields": [
          "<string>"
        ]
      }
    ]
  }
}
```

**4XX**: Refused

- `error` (`object`, required)
- `error.code` (`enum<string>`, required, one of: `not_found, forbidden, unauthenticated, validation_failed, conflict, rate_limited, payment_required, not_implemented, internal`)
- `error.message` (`string`, required)
- `error.details` (`Record<string, unknown>`)

```json
{
  "error": {
    "code": "not_found",
    "message": "<string>",
    "details": {}
  }
}
```

**Example request**

```bash
curl --request POST \
  --url 'https://studio.grid82.app/v1/apps/<appId>/rules/simulate' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "roles": [
    "<string>"
  ],
  "tableId": "<string>",
  "op": "read"
}'
```