---
title: "List integration grants for an agent"
method: GET
path: "/agents/{agentId}/integration-grants"
tags: ["Integrations"]
---

# List integration grants for an agent

`GET /agents/{agentId}/integration-grants`

## Request

- Base URL: `https://api.atako.ai`
- URL: `https://api.atako.ai/agents/{agentId}/integration-grants`
- Auth: HTTP bearer

Readable by the agent's owner or by an admin of the owner's company — the connections themselves belong to the company. 404 for anyone else.

## Path parameters

- `agentId` string, required

## Response `200`

- IntegrationGrant[]
  - `id` string, uuid, required
  - `agentId` string, uuid
  - `connectionId` string, uuid, required
  - `allowedTools` string[]
  - `scope` 'read' | 'write' | 'read_write', required
  - `constraints` object, nullable
  - `grantedBy` string, uuid
  - `expiresAt` string, date-time, nullable
  - `createdAt` string, date-time, required
  - `connection` object: Only present on the list endpoint (joined).
    - `providerKey` string
    - `displayName` string, nullable: null on a masked row.
    - `status` 'active' | 'error' | 'revoked'
    - `visibility` 'company' | 'personal'
  - `masked` boolean: List endpoint only: true for another user's PERSONAL connection (an admin viewing a colleague's agent) — no connection name, only `ownerName`. Revocable, not editable.
  - `ownerName` string, nullable: Masked rows only: the personal connection owner's first name.
  - `isDefault` boolean: Present (true) ONLY on a SYNTHETIC row the list endpoint fabricates for a companyWide+defaultGranted connector (e.g. 'projects') when this agent has no explicit integration_grants row yet — it already has full access by default; this row lets the UI show that instead of "no access". `id`/`connectionId` both equal the connection's own id on a synthetic row (no real grant row exists) — DELETE on that id persists an opt-out (a real row with allowedTools:[]) instead of a no-op. Absent (never false) on a real row.

## Other responses

- `401`: Missing, malformed, or invalid bearer token / API key, or revoked session (SESSION_REVOKED).
- `404`: Not found, or the caller is not authorized to access this resource.

---

[API](https://skmtc.dev/atako/apis/atako-api.md) · [All operations](https://skmtc.dev/atako/apis/atako-api/llms.txt) · [OpenAPI document](https://skmtc.dev/atako/apis/atako-api/revisions/aa555c56fbd7?raw)