Expose resource access explanation API

webui/src/api/admin.ts

@@ -132,6 +132,15 @@ export type AccessScopeExplanationItem = {
   sources: AccessRoleSourceItem[];
 };
 
+export type AccessDecisionProvenanceItem = {
+  kind: string;
+  id?: string | null;
+  label?: string | null;
+  tenant_id?: string | null;
+  source?: string | null;
+  details: Record<string, unknown>;
+};
+
 export type FunctionFactExplanationItem = {
   source_module: string;
   assignment_id: string;
@@ -158,6 +167,14 @@ export type UserAccessExplanationResponse = {
   function_facts: FunctionFactExplanationItem[];
 };
 
+export type ResourceAccessExplanationResponse = {
+  user: UserAdminItem;
+  resource_type: string;
+  resource_id: string;
+  action: string;
+  provenance: AccessDecisionProvenanceItem[];
+};
+
 export type SystemAccountItem = {
   account_id: string;
   email: string;
@@ -463,6 +480,20 @@ export function fetchUserAccessExplanation(settings: ApiSettings, userId: string
   return apiFetch(settings, `/api/v1/admin/users/${userId}/access-explanation`);
 }
 
+export function fetchResourceAccessExplanation(
+  settings: ApiSettings,
+  options: { userId: string; resourceType: string; resourceId: string; action: string; tenantId?: string | null }
+): Promise<ResourceAccessExplanationResponse> {
+  const params = new URLSearchParams({
+    user_id: options.userId,
+    resource_type: options.resourceType,
+    resource_id: options.resourceId,
+    action: options.action
+  });
+  if (options.tenantId) params.set("tenant_id", options.tenantId);
+  return apiFetch(settings, `/api/v1/admin/access/resource-explanation?${params.toString()}`);
+}
+
 export async function fetchGroups(settings: ApiSettings): Promise<GroupSummary[]> {
   const response = await apiFetch<{ groups: GroupSummary[] }>(settings, "/api/v1/admin/groups");
   return response.groups;