Read a person's grants

GET

/v1/identity/users/{userId}/grants

curl --request GET \
  --url https://example.com/v1/identity/users/example/grants \
  --header 'Authorization: Bearer <token>'

• Same-origin — path relative to the deployment root.

What the person may do, as granted directly: tenant admin, project and team roles, the reviewer roster. A tenant admin reads anyone’s; anyone else only their own.

Authorizations

• bearerAuth

Parameters

Path Parameters

userId

required

string

>= 1 characters

Responses

200

The person’s grants.

Media typeapplication/json

What a person may do, as granted directly: tenant admin, a role on a project (its memberships), a role in a team, and the reviewer roster. What a team’s or an org’s grants imply is not expanded.

object

userId

required

string

tenantAdmin

Whether the person is a tenant admin. Absent when the runtime has no authorization store: nothing grants it then.

boolean

tenantMember

Whether the person is a tenant member: they read the tenant’s settings (providers, policies, adapters, signing keys, deployments), not its projects. A person is one from being added. Absent when the runtime has no authorization store, or doesn’t report it.

boolean

projects

required

Direct project memberships.

Array<object>

A person’s direct role on a project.

object

projectId

required

string

role

required

Role on a project, as read. member is only read, on a role given before it was retired: it grants what viewer does, and writes refuse it.

string

Allowed values: viewer editor owner admin member

teams

required

Team memberships.

Array<object>

A person’s role in a team.

object

teamId

required

string

role

required

Role on a team membership.

string

Allowed values: member admin

reviewer

A person’s active entry on the reviewer roster.

object

role

required

Reviewer role class. Hierarchy: standard < senior < admin.

string

Allowed values: standard senior admin

Example

{
  "projects": [
    {
      "role": "viewer"
    }
  ],
  "teams": [
    {
      "role": "member"
    }
  ],
  "reviewer": {
    "role": "standard"
  }
}

401

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

403

Another person’s grants, and not a tenant admin.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

404

No user with that id under this tenant (identity-user-not-found).

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

501

The runtime has no authorization store (person-grants-unsupported).

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}