> ## Documentation Index
> Fetch the complete documentation index at: https://stytch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Is Authorized

> Check if a user has RBAC authorization for specific resources using the Stytch Vanilla JS SDK

export const organization = "Represents an instance or tenant in your application, typically mapping to each of your top-level customers.";

export const member = "Represents an individual end user's account within a given Organization, uniquely identified within that Organization by their email address.";

export const isReact_0 = undefined

{isReact_0 &&
<Info>
  In React, use the <a href="../../hooks/use-stytch-is-authorized"><code>useStytchIsAuthorized</code></a> hook to easily access the Member's authorization and react to changes.
</Info>
}

`rbac.isAuthorized` is an asynchronous method that returns an authorization verdict on a resource-action pair (that is, whether the logged-in <Tooltip tip={member}>Member</Tooltip> is authorized to perform the specified action on the specified Resource).

Given a resource and action, this method will return a promise that resolve to a boolean value, indicating if the Member is authorized to perform the action on the resource.  Returns `true` if the member can perform the action, `false` otherwise.

If the Member is not logged in, this method will always return `false`. If the resource or action provided are not valid for the configured RBAC policy, this method will return `false`. If the role is granted a `*` wildcard for all actions related to the resource, this method will return `true`.

<Note>
  As a best practice, authorization checks for sensitive actions should also occur on the backend.
</Note>

## Parameters

<ParamField path="resource_id" type="string" required>
  The human-readable ID of the resource to check authorization for.
</ParamField>

<ParamField path="action" type="string" required>
  The action to take on the specified resource.
</ParamField>

## Response

<ResponseField name="authorized" type="Promise<boolean>" required>
  `true` if the Member is authorized to perform the specified action on the specified resource, `false` otherwise.

  Will resolve to `false` if the RBAC policy has not been loaded or if the resource or action provided are not valid for the configured RBAC policy.
</ResponseField>

<Panel>
  <RequestExample>
    ```jsx theme={null}
    import { StytchB2BClient } from '@stytch/vanilla-js/b2b';

    const stytch = new StytchB2BClient('public-token-test-b8c84de4-7d58-4ffc-9341-432b56596862');

    // Check authorization asynchronously
    stytch.rbac
      .isAuthorized('documents', 'edit')
      .then((isAuthorized) => {
        if (isAuthorized) {
          console.log('User is authorized to edit documents');
          // Show edit button
        } else {
          console.log('User is not authorized to edit documents');
          // Hide edit button or show message
        }
      })
      .catch((error) => {
        console.error('Error:', error);
      });
    ```
  </RequestExample>
</Panel>