---
title: "GET /v1/origin/namespaces/{namespaceSlug}/grants"
method: GET
path: "/v1/origin/namespaces/{namespaceSlug}/grants"
tags: ["OriginService"]
---

# GET /v1/origin/namespaces/{namespaceSlug}/grants

`GET /v1/origin/namespaces/{namespaceSlug}/grants`

## Request

- Base URL: `https://api.cursor.com`
- URL: `https://api.cursor.com/v1/origin/namespaces/{namespaceSlug}/grants`
- Auth: HTTP bearer

Lists who has been granted access to an owner: users, groups, and the
 owning team's built-in admin and member groups. Each grant carries the
 permission it confers on every repository under the owner. Grants made on
 individual repositories are not included; see `ListRepositoryGrants`.
 Requires the `namespace:settings:read` scope. Paginated with `page_size`
 and `page_token`; default page size is 30, maximum is 100.

## Path parameters

- `namespaceSlug` string, required

## Query parameters

- `pageSize` integer
- `pageToken` string

## Response `200`

OK

- ListNamespaceGrantsResponse
  - `grants` NamespaceGrant[]: Grants on this page. Admin grants are listed before all others; within each of those two runs, grants are ordered by principal kind (groups, owning-team admins, owning-team members, users) and then by id. Grants whose user, group, or owning team no longer exists are omitted, so a page may hold fewer than `page_size` grants.
    - `user` OriginUserActor
      - `id` string
      - `email` string, required: The account's email. On pull request, review, comment, check, requested reviewer, and mergeability responses it is empty unless the caller holds `repository:members:read` on the repository.
      - `displayName` string: Human-readable display name: the account's first and last name, each trimmed, joined with a space — exactly the name the product UI renders. Omitted when the account has no name; never synthesized from the email, the id, or any other field.
      - `handle` string: The user's claimed profile handle (the identity behind cursor.com /@handle), without the @ prefix. Present only while the user's profile is publicly visible; omitted for users without a claimed handle and for non-public profiles.
      - `performedVia` OriginUserActorPerformedViaActor: Identifies an actor that acted on behalf of the user.
        - `app` OriginAppActor
          - `id` string
          - `displayName` string: The app's registered display name, never empty when present. Omitted when the app cannot be resolved.
        - `serviceAccount` OriginServiceAccountActor
          - `id` string
          - `type` 'bugbot' | 'automations' | 'agent_serve' | 'agent' | 'grok_bot' | 'env_builds': Which product or feature the account acts for. Unset when this API does not categorize the account or it no longer exists. New values may be added: decode with unknown enum values ignored, and treat an unset or unrecognized type as an unknown product, never as an error.
          - `displayName` string: The product name Cursor shows for the account, such as a Grok bot's name; never empty when present. A Grok bot whose name cannot be read is named "Grok Bot". Omitted when the account has no product name.
    - `group` OriginGroup: Public Origin group identity (`grp_…`). Currently id-only.
      - `id` string
    - `teamGroup` OriginTeamGroup: A fixed group of the team that owns a repository or an owner: every team member or every team admin. These are the owning team's default access shelves, granted on the resource itself; a repository's team-group grant is distinct from the one inherited from its owner.
      - `kind` 'members' | 'admins'
    - `permission` 'PERMISSION_READ' | 'PERMISSION_CONTRIBUTOR' | 'PERMISSION_WRITE' | 'PERMISSION_ADMIN' | 'PERMISSION_CUSTOM': Permission the principal holds on every repository under the owner.
  - `nextPageToken` string: Opaque cursor for the next page; empty when there are no more pages.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: The addressed resource, or its repository, does not exist or is not visible to the caller. Not-found and no-access are deliberately indistinguishable; a 404 never confirms that the resource does not exist.
- `429`: Too Many Requests
- `default`: Default error response

---

[API](https://skmtc.dev/cursor/apis/cursor-origin-api.md) - [All operations](https://skmtc.dev/cursor/apis/cursor-origin-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cursor/apis/cursor-origin-api/revisions/cbc1547d6ef7?raw)