# Who has access to a project, and how

GET

/v1/projects/{projectId}/access

```sh
curl --request GET \
  --url 'https://example.com/v1/projects/example/access?limit=25' \
  --header 'Authorization: Bearer <token>'
```

Everyone the authorization store lets into the project (people and service accounts), each with their effective role and every way in: a direct role, a team’s grant, an admin of the project’s org, a tenant admin. For the project’s editors and admins (`write`): a viewer sees the project, not who else works in it. Emails show to the project’s admins only. Ordered by role (owner first), then name. 501 `project-access-unsupported` from a runtime without an authorization store.

## Authorizations

- **[bearerAuth](https://docs.kindgi.com/v0.1.9/reference/api.md#bearerauth)**

## Parameters

### Path Parameters

**projectId**

required

string

ProjectId — opaque branded string.

### Query Parameters

**limit**

integer

default: 25 >= 1 <= 100

1..100. Default 25.

**cursor**

string

Where the previous page ended: its `nextCursor`, as it came. A runtime that seals cursors takes one only for the same list, filters and caller, within a day; otherwise `400 bad-input`, and the list starts again without it. Absent → first page.

## Responses

### 200

Page of who has access.

application/json

object

**data**

required

Array\<object>

Someone with access to the project, their effective role, and every way in.

object

**principal**

required

Whom access is held by: a person, or a service account.

object

**kind**

required

string

Allowed values: user service-account

**id**

required

string

\>= 1 characters

**displayName**

A person’s name, or a service account’s.

string

**primaryEmail**

A person’s email: shown to the project’s admins only.

string

**role**

required

The effective role: the highest any way in gives.

string

Allowed values: owner admin editor viewer

**via**

required

Every way in, the highest role first.

Array

\>= 1 items

One of: discriminator: kind

- **object**

  The principal’s own role on the project. `joinedAt` when a membership stands behind it: only then do the membership routes change or remove it.

  object

  **kind**

  required

  string

  Allowed values: direct

  **role**

  required

  Role on a project, as read. `member` is only read, on a role given before it was retired: it grants what `viewer` does, and writes refuse it.

  string

  Allowed values: viewer editor owner admin member

  **joinedAt**

  string format: date-time

- **object**

  A team’s grant on the project, held by every member of the team.

  object

  **kind**

  required

  string

  Allowed values: team

  **teamId**

  required

  string

  **teamName**

  string

  **role**

  required

  A team’s role on a project, held by every member of the team: `admin` includes `editor`, which includes `viewer`. A team never owns a project.

  string

  Allowed values: viewer editor admin

- **object**

  An admin of the project’s org (directly or through a team): admin on the project.

  object

  **kind**

  required

  string

  Allowed values: org-admin

  **orgId**

  required

  string

  **orgName**

  string

- **object**

  A tenant admin: admin on every project.

  object

  **kind**

  required

  string

  Allowed values: tenant-admin

**hasMore**

required

boolean

**nextCursor**

string

##### Example

```json
{
  "data": [
    {
      "principal": {
        "kind": "user"
      },
      "role": "owner",
      "via": [
        {
          "kind": "direct",
          "role": "viewer"
        }
      ]
    }
  ]
}
```

### 401

Missing / malformed / expired / revoked bearer token.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 404

No project with that id under this tenant.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 501

The runtime has no authorization store (`project-access-unsupported`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

## See also

- [`GET /v1/projects/{projectId}`: Fetch a project by id](https://docs.kindgi.com/v0.1.9/reference/api/operations/projectsget.md)
- [`PATCH /v1/projects/{projectId}`: Partially update a project](https://docs.kindgi.com/v0.1.9/reference/api/operations/projectsupdate.md)
- [`DELETE /v1/projects/{projectId}`: Delete a project (idempotent)](https://docs.kindgi.com/v0.1.9/reference/api/operations/projectsdelete.md)
- [`GET /v1/projects/{projectId}/judging-rules`: List a project's judging rules](https://docs.kindgi.com/v0.1.9/reference/api/operations/projectsjudgingruleslist.md)
- [Error code `project-access-unsupported`](https://docs.kindgi.com/v0.1.9/reference/errors.md#project-access-unsupported)
- [Every error code](https://docs.kindgi.com/v0.1.9/reference/errors.md)