Permissions API
The gating mechanism for every sensitive browser API. Check permission state before requesting access to avoid unexpected prompt dialogs. The change event lets you react when users revoke permissions in browser settings.
What It Defines
Defines navigator.permissions.query() for checking the status of user-granted permissions. Returns a PermissionStatus with state ('granted', 'denied', 'prompt') and a change event. Covers geolocation, notifications, camera, microphone, push, and more.
Canonical (Normative)
Convenient (Practical)
Publishes web platform specs including CSS, accessibility, security policies, Service Workers, Web App Manifest, and many browser APIs. Also maintains some versioned HTML/DOM specs.
Related Specs
Required for maps, location-based search, delivery tracking, geofencing, and any feature that needs the user's physical location. Understanding accuracy levels (GPS vs Wi-Fi vs IP) and the permission flow is essential.
The display side of web notifications (Push API handles delivery). Used for chat messages, calendar reminders, and real-time alerts. Understanding the permission model and notification lifecycle prevents spam UX.
Required for video calls, audio recording, photo capture, barcode scanning, and AR experiences. Understanding constraints, track lifecycle (enabled, muted, ended), and device enumeration prevents broken camera/mic UX.
Required for web push notifications — the re-engagement channel for PWAs. Works with Service Workers and the Notifications API. Understanding VAPID and the subscription lifecycle prevents broken push implementations.