Skip to content

List Grants for a Subject

Available since

  • v5.4.2 and later

Endpoint: GET /api/auth/subjects/{subjectType}/{subjectId}/grants

Lists all per-instance resource grants for a user, group, or role. Available for admin-only, unless the caller is listing their own grants.

Path parameters

Parameter Description Type Required/ Optional
subjectType The type of subject being granted access. Supported values:
  • USER: A user in Orkes Conductor.
  • ROLE: A system/custom role.
  • GROUP: A group in Orkes Conductor.
 string Required.
subjectId The unique identifier of the subject (e.g., user email, role name, or group name). string Required.

Query parameters

Parameter Description Type Required/ Optional
resourceType The resource type for which access grants are being retrieved. Supported values:
  • WORKFLOW
  • WORKFLOW_DEF
  • WORKFLOW_SCHEDULE
  • EVENT_HANDLER
  • TASK_DEF
  • TASK_REF_NAME
  • TASK_ID
  • APPLICATION
  • USER
  • SECRET_NAME
  • ENV_VARIABLE
  • TAG
  • DOMAIN
  • INTEGRATION_PROVIDER
  • INTEGRATION
  • PROMPT
  • USER_FORM_TEMPLATE
  • SCHEMA
  • CLUSTER_CONFIG
  • WEBHOOK
  • API_GATEWAY_SERVICE
  • API_GATEWAY_SERVICE_ROUTE
  • AUTH_CONFIG
  • GROUP
  • ROLE
  • SERVICE_REGISTRY
 string Optional.

Response

Returns a list of per-instance resource grants for the subject.

Examples

List grants for a subject

Request

curl -X 'GET' \
  'https://<YOUR-SERVER-URL>/api/auth/subjects/USER/jane.doe%40acme.com/grants?resourceType=SECRET_NAME' \
  -H 'accept: application/json' \
  -H 'X-Authorization: <TOKEN>'

Response

[
  {
    "target": {
      "type": "SECRET_NAME",
      "id": "API_KEY_NEURO"
    },
    "access": [
      "READ",
      "DELETE",
      "CREATE",
      "EXECUTE",
      "UPDATE"
    ]
  }
]