---
title: "List password access credentials"
method: GET
path: "/v1/spaces/{spaceId}/password-credentials"
tags: ["Access"]
---

# List password access credentials

`GET /v1/spaces/{spaceId}/password-credentials`

## Request

- Base URL: `https://api.spacefast.com`
- URL: `https://api.spacefast.com/v1/spaces/{spaceId}/password-credentials`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Returns password credentials and their canonical scoped grants without returning password proofs.

## Path parameters

- `spaceId` string, required

## Response `200`

Response for status 200

- object
  - `$schema` string, uri: Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
  - `data` object[], required
    - `id` string, required
    - `grant` object, required
      - `grant` object, required
        - `name` string
        - `audience` union, required
          - object
            - `kind` 'public', required
          - object
            - `kind` 'team', required
            - `teamId` string, required
          - object
            - `kind` 'person', required
            - `personId` string, required
          - object
            - `kind` 'link', required
            - `linkId` string, required
          - object
            - `kind` 'password', required
            - `credentialId` string, required
          - object
            - `kind` 'machine', required
            - `machineId` string, required
          - object
            - `kind` 'external', required
            - `issuer` string, required
            - `subject` string, required
        - `resources` object, required
          - `include` string[], required
          - `exclude` string[], required
        - `capabilities` string[], required
        - `constraints` object, required
          - `notBefore` union
            - string, date-time
            - string
          - `expiresAt` union
            - string, date-time
            - string
          - `maxUses` integer
          - `requireVerifiedEmail` boolean
          - `network` object
            - `ipCidrs` string[]: IP address and CIDR Grants are unsupported because the serving runtime has no trusted visitor IP. Remove the IP constraint.
            - `countries` string[]
            - `excludedCountries` string[]
            - `excludedUserAgentSubstrings` string[]
          - `frameOrigin` string
        - `target` union, required
          - object
            - `kind` 'live', required
          - object
            - `kind` 'version', required
            - `versionId` string, required
          - object
            - `kind` 'branch', required
            - `branch` string, required
          - object
            - `kind` 'all_versions', required
        - `id` string, required
        - `source` object, required
          - `kind` 'config' | 'managed' | 'system', required
          - `reference` string, required
      - `generation` integer, required
      - `status` 'scheduled' | 'active' | 'expired', required
      - `sourceExplanation` object, required
        - `editable` boolean, required
        - `label` string, required
        - `detail` string, required
      - `createdAt` string, date-time, required
      - `updatedAt` string, date-time, required
    - `rotatedAt` string, date-time, nullable, required
    - `lastUsedAt` string, date-time, nullable, required
    - `revokedAt` string, date-time, nullable, required

## Other responses

- `default`: Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

---

[API](https://skmtc.dev/spacefast/apis/spacefast-api.md) · [All operations](https://skmtc.dev/spacefast/apis/spacefast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spacefast/apis/spacefast-api/revisions/bd165bc7c983?raw)