List Scope Access

GET

/iam/v1/scopes/{scope_type}/{scope_id}/access

curl --request GET \
  --url https://example.com/iam/v1/scopes/example/example/access

Returns every principal with effective access at a scope, each role tagged direct or inherited (rolled down from ancestor scopes).

Parameters

Path Parameters

scope_type

required

string

The scope type: ORGANISATION, WORKSPACE, or GROUP.

scope_id

required

string

The unique identifier of the scope.

Query Parameters

page_size

integer format: int32

The maximum number of entries to return. The service may return fewer than this value. If unspecified, at most 20 entries will be returned. The maximum value is 100; values above 100 will be coerced to 100.

page_token

string

A page token from a previous ListScopeAccess call.

filter

string

AIP-160 filter expression.

order_by

string

AIP-132 order_by expression.

Responses

200

OK

Media type application/json

ListScopeAccessResponse

Response message for ListScopeAccess.

object

entries

One entry per principal with effective access at the requested scope.

Array<object>

One principal’s effective access at a scope: the principal plus every role they hold there, each tagged direct/inherited.

object

principal

The principal that has access.

object

id

The unique identifier of the principal.

stringOutput only

display_name

Polymorphic human-readable label — a Person’s “name surname” or a service account’s service email.

stringOutput only

status

The lifecycle status of the principal.

string format: enum Output only

Allowed values: PRINCIPAL_STATUS_UNSPECIFIED PRINCIPAL_STATUS_INVITED PRINCIPAL_STATUS_ACTIVE PRINCIPAL_STATUS_DEACTIVATED

type

The discriminated kind of the principal.

string format: enum Output only

Allowed values: PRINCIPAL_TYPE_UNSPECIFIED PRINCIPAL_TYPE_USER PRINCIPAL_TYPE_SERVICE_ACCOUNT

last_seen

Best-effort last-authentication instant; absent until the principal first authenticates.

string format: date-time Output only

created

The timestamp when the principal was created.

string format: date-time Output only

updated

The timestamp when the principal was last updated.

string format: date-time Output only

roles

Every effective role the principal holds at the requested scope.

Array<object>Output only

A single effective role a principal holds at a scope, tagged with its origin.

object

role_id

The unique identifier of the role.

stringOutput only

role_name

The human-readable name of the role.

stringOutput only

origin

Whether the role is direct or inherited.

string format: enum Output only

Allowed values: ROLE_ORIGIN_UNSPECIFIED ROLE_ORIGIN_DIRECT ROLE_ORIGIN_INHERITED

origin_scope_type

The scope type the role was inherited from; empty when origin is DIRECT.

stringOutput only

origin_scope_id

The scope id the role was inherited from; empty when origin is DIRECT.

stringOutput only

next_page_token

A token to retrieve the next page; empty when there are no further pages.

string

Example

{
  "entries": [
    {
      "principal": {
        "status": "PRINCIPAL_STATUS_UNSPECIFIED",
        "type": "PRINCIPAL_TYPE_UNSPECIFIED"
      },
      "roles": [
        {
          "origin": "ROLE_ORIGIN_UNSPECIFIED"
        }
      ]
    }
  ]
}

default

Default error response

Media type application/json

The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.

object

code

The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].

integer format: int32

message

A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.

string

details

A list of messages that carry the error details. There is a common set of message types for APIs to use.

Array<object>

Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.

object

@type

The type of the serialized message.

string

key

additional properties

any

Example ^generated

{
  "code": 1,
  "message": "example",
  "details": [
    {
      "@type": "example"
    }
  ]
}