---
title: "Resolve grants accessible to a user"
method: GET
path: "/allowlist/grants"
tags: ["Allowlist"]
---

# Resolve grants accessible to a user

`GET /allowlist/grants`

Returns the list of active grants the user identified by `crn` and `sbi`
is permitted to access.

The user's identity is supplied in the `x-user-context` header as a JWT
containing `crn` and `sbi` claims. The JWT is signed by the calling service
using the shared `ENCRYPTED_AUTH_JWT_SECRET`.

Access rules (evaluated per environment):
- Grants with **no allowlist entries** are **closed to all users**.
- Grants with `allowAll: true` in their `allowlist.yaml` are **open to all users**.
- Otherwise the user must appear in **both** the CRN and SBI lists.

 The `allowlist.yaml` format (per environment, per grant config):

```yaml
dev:
  allowAll: true
test:
  crns:
    - '1234567890'
  sbis:
    - '123456789'
```

## Response `200`

List of grants the user may access

- AllowlistGrantsResponse
  - `grants` Grant[], required
    - `code` string, required — Grant code / slug
    - `title` string, required — Human-readable grant title
    - `description` string, nullable, required — Short description of the grant
    - `url` string, nullable, required — URL to the grant application, or null if not configured

## Other responses

- `401` — Missing or invalid bearer token, or missing crn/sbi in JWT
- `500` — Failed to resolve allowlist

## Changes

- **2026-08-17** `eca9a29240ae` — 2 info
  - the endpoint scheme security `bearerAuth AND userContext` was added to the API
  - the endpoint scheme security `bearerAuth AND encryptedAuth` was removed from the API
- **2026-06-29** `047f9b2e19c3` — 1 warning, 1 info
  - deleted the `header` request parameter `x-encrypted-auth`
  - the endpoint scheme security `bearerAuth AND encryptedAuth` was added to the API
- **2026-06-16** `71d21550b6f1` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/defra/apis/grants-ui-backend-api/changes/allowlist/grants/get.md)

---

[API](https://skmtc.dev/defra/apis/grants-ui-backend-api.md) · [All operations](https://skmtc.dev/defra/apis/grants-ui-backend-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/defra/grants-ui-backend-api/revisions/09665d03cacb/schema)