---
title: "What one subject holds in the organization, from grant. (owner/admin/auditor)"
method: GET
path: "/orgs/{org_id}/grants/holdings"
tags: ["Organizations"]
---

# What one subject holds in the organization, from grant. (owner/admin/auditor)

`GET /orgs/{org_id}/grants/holdings`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/orgs/{org_id}/grants/holdings`
- Auth: HTTP bearer

The org-admin Grants pane's read of one subject's holdings from grant. (canon mn-c0amqk, mn-9rzonp v23), proxied read-only with this API's own grant. credential: class counts of every holding by type, role, route and environment, and the holdings themselves only for resources the calling admin may read by grant.'s own standing. Owner, admin or auditor. Answers `404` exactly as an unknown route while the organization's effective `grant` capability flag is off. `400 invalid_subject` when `subject` is not exactly one id in grant.'s typed subject grammar (grant. is not called). `503 grant_unavailable` when grant. is not configured or does not answer; `403 grant_subject_unavailable` when the caller has no Zitadel subject to send.

## Path parameters

- `org_id` string, required

## Query parameters

- `subject` string, required

## Response `200`

The subject's holdings in the organization

- object
  - `counts` object[], required
    - `type` string, required
    - `role` string, required
    - `route` 'creator' | 'direct' | 'inherited', required
    - `environment` string, required
    - `n` integer, required
  - `holdings` object[], required
    - `resource` object, required
      - `type` string, required
      - `id` string, required
    - `role` string, required
    - `route` 'creator' | 'direct' | 'inherited', required
    - `environment` string, required
    - `expires_at` string, date-time
  - `approximate` boolean, required

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Forbidden
- `404`: Resource not found
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.
- `503`: An upstream dependency is currently unavailable. The request was not processed; retry after the cooldown window.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)