---
title: "The snowflake-mode access roster."
method: GET
path: "/v1/orgs/{orgId}/snowflake/app-role-grantees"
tags: ["dashboards"]
---

# The snowflake-mode access roster.

`GET /v1/orgs/{orgId}/snowflake/app-role-grantees`

## Request

- Base URL: `http://localhost:8080`
- URL: `http://localhost:8080/v1/orgs/{orgId}/snowflake/app-role-grantees`
- Auth: one of:
  - API key in cookie `dvt_session`
  - HTTP bearer

Which ACCOUNT roles hold each dvt APPLICATION role — who can reach dvt
and at what tier (the /admin Roles tab). Snowflake mode only: outside
it (or off the Snowflake ingress path) this route does not exist (404).
Admin or owner only (audit:read), and the path orgId must be the
caller's own org — this is the install's full access map, the same
posture as the analytics family. Role names are returned exactly as
Snowflake stores them (never case-folded). `unreadable` lists tiers
whose grants could not be read — NOT tiers with no grantees; a client
must never render the two the same way. `account_roles` carries the
full account-role enumeration when the app's owner's-rights identity
can perform it (runtime-detected per consumer account); when
`available` is false the enumeration is absent and clients degrade to
the tier-first roster.

## Response `200`

The access roster.

- object
  - `data` SnowflakeAppRoleGrantees, required: The snowflake-mode access roster (the /admin Roles tab): which ACCOUNT roles hold each dvt APPLICATION role, plus the full account-role enumeration when the app can perform it. Role names are exactly as Snowflake stores them (never case-folded). Field names are a frozen client contract.
    - `contract_version` integer, required: Wire version of this shape (currently 2). The server refuses to forward a body whose version it does not understand — the Go binary and the engine image ship in one SPCS service but can skew across an upgrade.
    - `roles` object, required: Map of dvt APPLICATION role name to the sorted ACCOUNT roles granted it. A tier listed in `unreadable` is ABSENT here, never an empty list — "could not read" and "nobody holds it" must not collapse into one answer.
    - `unreadable` string[], required: Tiers whose grants could not be read. Non-empty means the roster is incomplete and the client must say so rather than render a partial roster as complete.
    - `account_roles` object, required: The SHOW ROLES enumeration behind the "every account role, No access included" page shape. Whether the app's owner's-rights identity can enumerate account roles is consumer-account-dependent and runtime-detected; false degrades the page to the tier-first roster.
      - `available` boolean, required
      - `roles` string[]: Sorted account-role names; present only when available.
  - `meta` Meta, required: Response metadata.
    - `requestId` string, required: Correlates with the X-Request-Id header.
    - `total` integer: Item count, present on collection responses.
    - `nextCursor` string, nullable: Opaque keyset-pagination cursor, present on paginated responses (e.g. GET /v1/dashboards) when more rows exist beyond this page. Pass it back as the `cursor` query param to fetch the next page; absent or null on the last page.
    - `roleResolveDegraded` boolean: Snowflake mode only (DVT-2260), on GET /v1/dashboards: present and true when the caller's live Snowflake role resolution failed or was unavailable — role-shared dashboards may be missing from this page. Omitted (not merely false) whenever resolution succeeded or the role-share arm does not apply (off snowflake mode, an org admin/owner, or off the ingress listener).

## Other responses

- `401`: Missing, invalid, or expired session.
- `403`: The caller's role does not permit this action.
- `404`: Resource does not exist.
- `502`: The engine could not read the Snowflake grant graph.

---

[API](https://skmtc.dev/dvt/apis/dvt-rest-api.md) · [All operations](https://skmtc.dev/dvt/apis/dvt-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dvt/apis/dvt-rest-api/revisions/00016f504165?raw)