<p><code>kubectl</code> has the <code>auth can-i</code> subcommand. Which K8s API does the command use? I tried <code>authorization.k8s.io/v1</code> <code>SelfSubjectAccessReview</code> but it requires the extra permissions to perform the request. Does anybody know how it works in the <code>kubectl</code>?</p>

<p>The <code>kubectl auth can-i</code> command makes the following API request:</p>
<pre><code>POST /apis/authorization.k8s.io/v1/selfsubjectaccessreviews
</code></pre>
<p>With a <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#selfsubjectaccessreview-v1-authorization-k8s-io" rel="nofollow noreferrer">SelfSubjectAccessReview</a> object as a body parameter named <code>body</code>.</p>
<p>You can see this by executing the kubectl command with increased verbosity, for example:</p>
<pre class="lang-sh prettyprint-override"><code>kubectl auth can-i create pods -v 6
</code></pre>
<p>And you can find the documentation of the API endpoint in the <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#-strong-write-operations-selfsubjectaccessreview-v1-authorization-k8s-io-strong-" rel="nofollow noreferrer">API reference</a>.</p>
