Check what this credential can do

The grant of the credential that calls it: its permissions, mail scope, resources, template, credential kind and expiry. A credential may call it about itself without any permission, including a narrowed key without account:read, so a key can see its own permissions and mail scope. It answers nothing about any other credential. grant is null when the credential carries no grant.