---
title: "List a project's grants with their grant keys (owner-only)"
method: GET
path: "/projects/v1/{project_id}/grants"
tags: ["Org"]
---

# List a project's grants with their grant keys (owner-only)

`GET /projects/v1/{project_id}/grants`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/projects/v1/{project_id}/grants`
- Auth: API key in header `SIGN-IN-WITH-X`

Owner-only. Each grant carries its grant keys nested under `keys` (kind, scope, spend_cap, expiry, revocation) — never a token or `encrypted_secret_ref`.

## Path parameters

- `project_id` string, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Response `200`

Grants with keys

- object
  - `grants` object[]
    - `grant_id` string, uuid
    - `principal_id` string, uuid
    - `wallet` string, nullable
    - `capability` string
    - `policy` object
    - `expires_at` string, date-time, nullable
    - `revoked_at` string, date-time, nullable
    - `created_at` string, date-time
    - `keys` GrantKey[]
      - `key_id` string, uuid
      - `grant_id` string, uuid
      - `kind` 'tempo_access_key' | 'base_disposable_eoa' | 'run402_agent_key' | 'ci_oidc' | 'erc7710'
      - `principal_id` string, uuid
      - `public_subject` string, nullable
      - `scope` object
      - `spend_cap` object, nullable
      - `expires_at` string, date-time, nullable
      - `revoked_at` string, date-time, nullable
      - `created_at` string, date-time

## Other responses

- `403`: Owner role required (FORBIDDEN)

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)