List the grants held by a subject (membership or group)

GET

/authorization/grants/subject

Lists every role grant held by one subject — what a membership or group has been shared. Authorization: org admin, EXCEPT a non-admin member may inspect their OWN membership’s grants (when the query’s organizationMembershipId equals the caller’s); any other subject requires admin, otherwise 403 forbidden. Query names EXACTLY ONE of organizationMembershipId or groupId. Returns the subject’s grants.

Lists every role grant held by one subject — what a membership or group has been shared. Authorization: org admin, EXCEPT a non-admin member may inspect their OWN membership’s grants (when the query’s `organizationMembershipId` equals the caller’s); any other subject requires admin, otherwise 403 `forbidden`. Query names EXACTLY ONE of `organizationMembershipId` or `groupId`. Returns the subject’s grants.

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Query parameters

organizationMembershipIdstringOptional>=1 character

groupIdstringOptional>=1 character

Response

The resources and roles granted to the subject.

assignmentslist of maps from strings to any

Every grant the subject holds. Shape mirrors RoleGrant plus provider extras.

Errors

403

Forbidden Error

$	curl -G https://api.cloudraker.com/authorization/grants/subject \
>	-H "Authorization: Bearer <token>" \
>	-H "Content-Type: application/json" \
>	-d organizationMembershipId=orgmem-7f3a2b9d

1	{
2	"assignments": [
3	{
4	"roleId": "role-12345",
5	"resourceId": "project-67890",
6	"resourceType": "project",
7	"grantedBy": "user-abcde",
8	"grantedAt": "2024-05-20T15:45:00Z",
9	"expiresAt": "2024-12-31T23:59:59Z",
10	"scope": "read-write"
11	}
12	]
13	}