2018-05-29 21:07:40 +00:00
---
2020-09-01 15:14:13 +00:00
layout: commands
2020-04-07 18:55:19 +00:00
page_title: 'Commands: Intention Check'
2023-01-26 18:42:13 +00:00
description: >-
The `consul intention check` command tests whether a connection between two services is authorized under the current set of intentions.
2018-05-29 21:07:40 +00:00
---
# Consul Intention Check
Command: `consul intention check`
2023-01-25 16:52:43 +00:00
Corresponding HTTP API Endpoint: [\[GET\] /v1/connect/intentions/check](/consul/api-docs/connect/intentions#check-intention-result)
2022-01-10 17:40:11 +00:00
2018-05-29 21:07:40 +00:00
The `intention check` command checks whether a connection attempt between
two services would be authorized given the current set of intentions and
Consul configuration.
This command requires less ACL permissions than other intention-related
tasks because no information about the intention is revealed. Therefore,
callers only need to have `service:read` access for the destination. Richer
2023-01-25 16:52:43 +00:00
commands like [match](/consul/commands/intention/match) require full
2018-05-29 21:07:40 +00:00
intention read permissions and don't evaluate the result.
2020-10-14 15:23:05 +00:00
-> **Note:** This command will always treat intentions with `Permissions`
2020-12-08 23:24:36 +00:00
defined as _deny_ intentions during evaluation, as this endpoint is only suited
2020-10-14 15:23:05 +00:00
for networking layer 4 (e.g. TCP) integration.
2023-01-25 16:52:43 +00:00
The table below shows this command's [required ACLs](/consul/api-docs/api-structure#authentication). Configuration of
[blocking queries](/consul/api-docs/features/blocking) and [agent caching](/consul/api-docs/features/caching)
2022-01-11 14:41:54 +00:00
are not supported from commands, but may be from the corresponding HTTP endpoint.
| ACL Required |
| ----------------------------- |
2023-03-24 22:16:06 +00:00
| `intentions:read`<p> Define intention rules in the `service` policy. Refer to [ACL requirements for intentions](/consul/docs/connect/intentions/create-manage-intentions#acl-requirements) for additional information.</p> |
2022-01-11 14:41:54 +00:00
2018-05-29 21:07:40 +00:00
## Usage
Usage: `consul intention check [options] SRC DST`
2023-01-25 16:52:43 +00:00
`SRC` and `DST` can both take [several forms](/consul/commands/intention#source-and-destination-naming).
2020-06-26 21:59:15 +00:00
#### Enterprise Options
2024-07-18 17:02:45 +00:00
@include 'cli-http-api-partition-options.mdx'
2022-07-27 06:17:11 +00:00
2020-06-26 21:59:15 +00:00
@include 'http_api_namespace_options.mdx'
2022-07-27 06:17:11 +00:00
#### API Options
@include 'http_api_options_client.mdx'
2021-12-15 01:55:21 +00:00
2018-05-29 21:07:40 +00:00
## Examples
2020-05-19 18:32:38 +00:00
```shell-session
2018-05-29 21:07:40 +00:00
$ consul intention check web db
Denied
$ consul intention check web billing
Allowed
```
