Who has access to a project, and how

GET

/v1/projects/{projectId}/access

curl --request GET \
  --url 'https://example.com/v1/projects/example/access?limit=25' \
  --header 'Authorization: Bearer <token>'

• Same-origin — path relative to the deployment root.

Everyone the authorization store lets into the project (people and service accounts), each with their effective role and every way in: a direct role, a team’s grant, an admin of the project’s org, a tenant admin. For the project’s editors and admins (write): a viewer sees the project, not who else works in it. Emails show to the project’s admins only. Ordered by role (owner first), then name. 501 project-access-unsupported from a runtime without an authorization store.

Authorizations

• bearerAuth

Parameters

Path Parameters

projectId

required

string

ProjectId — opaque branded string.

Query Parameters

limit

integer

default: 25 >= 1 <= 100

1..100. Default 25.

cursor

string

Where the previous page ended: its nextCursor, as it came. A runtime that seals cursors takes one only for the same list, filters and caller, within a day; otherwise 400 bad-input, and the list starts again without it. Absent → first page.

Responses

200

Page of who has access.

Media typeapplication/json

object

data

required

Array<object>

Someone with access to the project, their effective role, and every way in.

object

principal

required

Whom access is held by: a person, or a service account.

object

kind

required

string

Allowed values: user service-account

id

required

string

>= 1 characters

displayName

A person’s name, or a service account’s.

string

primaryEmail

A person’s email: shown to the project’s admins only.

string

role

required

The effective role: the highest any way in gives.

string

Allowed values: owner admin editor viewer

via

required

Every way in, the highest role first.

Array

>= 1 items

One of: discriminator: kind

object

The principal’s own role on the project. joinedAt when a membership stands behind it: only then do the membership routes change or remove it.

object

kind

required

string

Allowed values: direct

role

required

Role on a project, as read. member is only read, on a role given before it was retired: it grants what viewer does, and writes refuse it.

string

Allowed values: viewer editor owner admin member

joinedAt

string format: date-time

object

A team’s grant on the project, held by every member of the team.

object

kind

required

string

Allowed values: team

teamId

required

string

teamName

string

role

required

A team’s role on a project, held by every member of the team: admin includes editor, which includes viewer. A team never owns a project.

string

Allowed values: viewer editor admin

object

An admin of the project’s org (directly or through a team): admin on the project.

object

kind

required

string

Allowed values: org-admin

orgId

required

string

orgName

string

object

A tenant admin: admin on every project.

object

kind

required

string

Allowed values: tenant-admin

hasMore

required

boolean

nextCursor

string

Example

{
  "data": [
    {
      "principal": {
        "kind": "user"
      },
      "role": "owner",
      "via": [
        {
          "kind": "direct",
          "role": "viewer"
        }
      ]
    }
  ]
}

401

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

404

No project with that id under this tenant.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

501

The runtime has no authorization store (project-access-unsupported).

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}