# Read a person's grants

GET

/v1/identity/users/{userId}/grants

```sh
curl --request GET \
  --url https://example.com/v1/identity/users/example/grants \
  --header 'Authorization: Bearer <token>'
```

What the person may do, as granted directly: tenant admin, project and team roles, the reviewer roster. A tenant admin reads anyone’s; anyone else only their own.

## Authorizations

- **[bearerAuth](https://docs.kindgi.com/v0.1.9/reference/api.md#bearerauth)**

## Parameters

### Path Parameters

**userId**

required

string

\>= 1 characters

## Responses

### 200

The person’s grants.

application/json

What a person may do, as granted directly: tenant admin, a role on a project (its memberships), a role in a team, and the reviewer roster. What a team’s or an org’s grants imply is not expanded.

object

**userId**

required

string

**tenantAdmin**

Whether the person is a tenant admin. Absent when the runtime has no authorization store: nothing grants it then.

boolean

**tenantMember**

Whether the person is a tenant member: they read the tenant’s settings (providers, policies, adapters, signing keys, deployments), not its projects. A person is one from being added. Absent when the runtime has no authorization store, or doesn’t report it.

boolean

**projects**

required

Direct project memberships.

Array\<object>

A person’s direct role on a project.

object

**projectId**

required

string

**role**

required

Role on a project, as read. `member` is only read, on a role given before it was retired: it grants what `viewer` does, and writes refuse it.

string

Allowed values: viewer editor owner admin member

**teams**

required

Team memberships.

Array\<object>

A person’s role in a team.

object

**teamId**

required

string

**role**

required

Role on a team membership.

string

Allowed values: member admin

**reviewer**

A person’s active entry on the reviewer roster.

object

**role**

required

Reviewer role class. Hierarchy: standard < senior < admin.

string

Allowed values: standard senior admin

##### Example

```json
{
  "projects": [
    {
      "role": "viewer"
    }
  ],
  "teams": [
    {
      "role": "member"
    }
  ],
  "reviewer": {
    "role": "standard"
  }
}
```

### 401

Missing / malformed / expired / revoked bearer token.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 403

Another person’s grants, and not a tenant admin.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 404

No user with that id under this tenant (`identity-user-not-found`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 501

The runtime has no authorization store (`person-grants-unsupported`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

## See also

- [`GET /v1/identity/users`: List users in the tenant](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityuserslist.md)
- [`POST /v1/identity/users`: Add a person](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityuserscreate.md)
- [`GET /v1/identity/users/{userId}`: Get a user by id](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityusersget.md)
- [`GET /v1/identity/users/{userId}/sessions`: List active sessions for a user](https://docs.kindgi.com/v0.1.9/reference/api/operations/identityuserslistsessions.md)
- [Error code `identity-user-not-found`](https://docs.kindgi.com/v0.1.9/reference/errors.md#identity-user-not-found)
- [Error code `person-grants-unsupported`](https://docs.kindgi.com/v0.1.9/reference/errors.md#person-grants-unsupported)
- [Every error code](https://docs.kindgi.com/v0.1.9/reference/errors.md)