---
title: "List active space grants"
method: GET
path: "/v1/spaces/{spaceId}/grants"
tags: ["Access"]
---

# List active space grants

`GET /v1/spaces/{spaceId}/grants`

## Request

- Base URL: `https://api.spacefast.com`
- URL: `https://api.spacefast.com/v1/spaces/{spaceId}/grants`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Shows a Space's visibility: who can see it, and at which paths. Lists every active grant. Each grant names its source (config, system, or managed) and says if you can edit it here. Read the grants before you change access or make a Space public or private.

## Path parameters

- `spaceId` string, required

## Response `200`

Response for status 200

- object
  - `$schema` string, uri: Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
  - `data` object[], required
    - `grant` object, required
      - `name` string
      - `audience` union, required
        - object
          - `kind` 'public', required
        - object
          - `kind` 'team', required
          - `teamId` string, required
        - object
          - `kind` 'person', required
          - `personId` string, required
        - object
          - `kind` 'link', required
          - `linkId` string, required
        - object
          - `kind` 'password', required
          - `credentialId` string, required
        - object
          - `kind` 'machine', required
          - `machineId` string, required
        - object
          - `kind` 'external', required
          - `issuer` string, required
          - `subject` string, required
      - `resources` object, required
        - `include` string[], required
        - `exclude` string[], required
      - `capabilities` string[], required
      - `constraints` object, required
        - `notBefore` union
          - string, date-time
          - string
        - `expiresAt` union
          - string, date-time
          - string
        - `maxUses` integer
        - `requireVerifiedEmail` boolean
        - `network` object
          - `ipCidrs` string[]: IP address and CIDR Grants are unsupported because the serving runtime has no trusted visitor IP. Remove the IP constraint.
          - `countries` string[]
          - `excludedCountries` string[]
          - `excludedUserAgentSubstrings` string[]
        - `frameOrigin` string
      - `target` union, required
        - object
          - `kind` 'live', required
        - object
          - `kind` 'version', required
          - `versionId` string, required
        - object
          - `kind` 'branch', required
          - `branch` string, required
        - object
          - `kind` 'all_versions', required
      - `id` string, required
      - `source` object, required
        - `kind` 'config' | 'managed' | 'system', required
        - `reference` string, required
    - `generation` integer, required
    - `status` 'scheduled' | 'active' | 'expired', required
    - `sourceExplanation` object, required
      - `editable` boolean, required
      - `label` string, required
      - `detail` string, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required

## Other responses

- `default`: Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

---

[API](https://skmtc.dev/spacefast/apis/spacefast-api.md) · [All operations](https://skmtc.dev/spacefast/apis/spacefast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spacefast/apis/spacefast-api/revisions/bd165bc7c983?raw)