---
title: "Get object access control list"
method: GET
path: "/v1/objects/{object-id}/access-rights"
tags: ["Objects"]
---

# Get object access control list

`GET /v1/objects/{object-id}/access-rights`

Return the object's directly assigned access control list and the flag controlling
whether access rights are inherited from parent objects. Requires read access to the
object.

## Path parameters

- `object-id` integer, required

## Response `200`

Object access rights.

- ObjectAccessRights — Object access control list and the flag controlling inheritance of access rights from parent objects.
  - `inheritAccessRights` boolean — When true, effective rights include those inherited from parent objects in addition to the directly assigned rights below.
  - `accessList` object[] — Directly assigned access control entries. On update this is a full replacement of the object's own access list.
    - `userId` integer — User or group ID. Group IDs have the high bit (0x80000000) set.
    - `access` integer — Bit mask of access rights granted to the user or group on this object.

## Other responses

- `401` — Unauthorized
- `403` — User does not have read access to the object
- `404` — Object with given ID does not exist

## Changes

- **2026-07-15** `63064dc6ef80` — 1 info
  - endpoint added
- **2026-05-08** `c6aaf3632e48` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/netxms/apis/netxms-api/changes/v1/objects/:object-id/access-rights/get.md)

---

[API](https://skmtc.dev/netxms/apis/netxms-api.md) · [All operations](https://skmtc.dev/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/netxms/netxms-api/revisions/5ffc2bc9aab8/schema)