---
title: "The ACL the connection mirrors"
method: GET
path: "/v1/admin/source-connections/{id}/principals"
tags: ["Source Plane"]
---

# The ACL the connection mirrors

`GET /v1/admin/source-connections/{id}/principals`

## Request

- Base URL: `https://brain.inite.ai`
- URL: `https://brain.inite.ai/v1/admin/source-connections/{id}/principals`
- Auth: HTTP bearer

Every account the connection’s `principals()` walk saw and the membership tuples it wrote (W5). An identity with `userId: null` is an account NOBODY has linked: it grants no visibility at all, which is why the surface shows it rather than guessing who it is. `epoch` is the tenant’s consistency token — every cached expansion of a membership keys on it, so a revocation takes effect on the next request. Needs SOURCE_PRINCIPALS. Source plane operator surface (docs/roadmap/raw-evidence-sources-2026-09.md) — answers a bare 404 until `SOURCE_PLANE_ENABLED=1`.

Required scope: `brain:admin`.

## Path parameters

- `id` string, required

## Response `200`

The mirror.

- SourcePrincipalsResponse
  - `epoch` integer, required
  - `identities` object[], required
    - `displayName` string, nullable, required
    - `email` string, nullable, required
    - `externalId` string, required
    - `handle` string, nullable, required
    - `linkedBy` string, nullable, required
    - `userId` string, nullable, required
  - `tuples` object[], required
    - `object` string, required
    - `recordedAt` string, required
    - `revokedAt` string, nullable, required
    - `source` string, required
    - `subject` string, required

## Other responses

- `400`: Validation failed.
- `401`: Missing or unknown bearer key.
- `403`: The key lacks the required scope.
- `404`: No such resource in this tenant.

---

[API](https://skmtc.dev/inite/apis/inite-brain-platform-api.md) · [All operations](https://skmtc.dev/inite/apis/inite-brain-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/inite/apis/inite-brain-platform-api/revisions/c7c3eb5e304b?raw)