anchor.diff:  } 
   -----
   
  -Alternatively, the endpoint ```/api/v1/users/:userUuid/permissions/:path``` provides a shortcut for querying permissions for specific users directly, e.g., for user ```anonymous```, which is essentially inheriting all permissions from role ```anonymous```.
  +Alternatively, you can use query the element using the respective API endpoint (e.g. link:++raml#project__nodes__get++[```GET /api/v1/projectName/nodes```]) and use the ```role``` query parameter to find out another role's (i.e. ```anonymous```) permissions on the element:
  +
  +.Try the example with user ```admin```
  +[TIP]
  +https://demo.getmesh.io/api/v1/demo/nodes/88fac3fbc61041c1bac3fbc610d1c182?role=10447951fd264e6a847951fd266e6ae6
  +
  +[source,bash]
  +-----
  +GET https://demo.getmesh.io/api/v1/roles/10447951fd264e6a847951fd266e6ae6/permissions/projects/217f8c981ada4642bf8c981adaa642c3/nodes/88fac3fbc61041c1bac3fbc610d1c182
  +
  +RESPONSE
  +...
  +  "permissions" : { // permissions of requesting user admin
  +    "create" : true,
  +    "read" : true,
  +    "update" : true,
  +    "delete" : true,
  +    "publish" : true,
  +    "readPublished" : true
  +  },
  +  "rolePerms" : { // permissions of requested role anonymous
  +    "create" : false,
  +    "read" : false,
  +    "update" : false,
  +    "delete" : false,
  +    "publish" : false,
  +    "readPublished" : true
  +  }
  +  ...
  +-----
  +
  +==== Querying User Permissions
  +The endpoint link:raml/#users__userUuid__permissions__path__get[```GET /api/v1/users/:userUuid/permissions/:path```] provides a shortcut for querying permissions for specific users directly, e.g., for user ```anonymous```, which is essentially inheriting all permissions from role ```anonymous```.
   
   .Try the example
   [TIP]
  
positive.code: 
  == Permissions
  
  Permissions exist between roles and other elements (including other roles). By organizing link:building-blocks.html#_user[users] with link:building-blocks.html#_group[groups] and by assigning link:building-blocks.html#_role[roles] to groups, users inherit permissions on elements.
  // TODO image (anonymous, and other roles having different permissions)
  
  Most responses within Gentics Mesh will contain a list of permissions which may indicate that CRUD operations on the returned element are restricted in a way:
  
  .Try the example
  [TIP]
  https://demo.getmesh.io/api/v1/demo/nodes/88fac3fbc61041c1bac3fbc610d1c182?version=published
  
  
  [source,json]
  -----
  ...
    "permissions" : {
      "create" : false,        //create other nodes
  
negative.code: ...  
  -----
  
  The example above shows that the requesting user ```anonymous``` has the ```readPublish``` permission on the requested node, only. This means the user is allowed to read the published version of the node but not previous versions or a draft version of the requested element.
  
  Furthermore the user is not allowed to
  
  * ```create``` child nodes
  * ```read``` a draft version of the node
  * ```update``` the requested node
  * ```delete``` the requested node
  * ```publish``` a draft version of the requested node, or ```unpublish``` a node.
  
  IMPORTANT: Gentics Mesh by default returns the ```draft``` version of nodes. This means for supporting the ```anonymous``` user and public content, you need to add the ```?version=published``` query parameter on all requests for nodes to avoid _"Missing permissions on object"_ errors. Find out more in the <<versioning,Versioning>> section.
  
  
  Following, we will discuss how to query, assign and revoke permissions in Gentics Mesh including the available API endpoints.
  
  [caption=]
  .API endpoints for querying, assigning, and revoking permissions
  [options="header",cols="2*"]
  |======
  
  