Skip to content
GitmoapAPIBeta
Organizeaccess
GET/groups/{group_id}/access/explain

Why someone has the access they have on a group.

explain_group_access

Returns the person's or service account's effective rank and permissions, and every grant, limit and inheritance boundary behind them. Name a permission to get a yes-or-no answer, including whether the group's visibility alone allows it. Anyone who can see the group can explain their own access; explaining someone else's needs the right to see who has access here.

Parameters

Path
  • group_idGroupId (string · uuid)Group ID
Query
  • principal_idPrincipalId (string · uuid)optionalThe person or service account to explain; you, when omitted
  • permissionstringoptionalOne permission key to decide, such as code.push

Responses

200Every grant, limit and boundary behind the answerapplication/json
  • effectiveEffectiveAccess
    • The EffectiveAccess schema
    • basisAccessBasisViewgrantsorganization_ownernoneWhere an explained principal's access comes from.
    • permissionsarray of stringEvery permission they hold here, by key.
    • rankAccessLevelguestreporterdevelopermaintainerowneror nulloptional
  • grantsarray of ExplainedGrantEvery grant that bears on them here, and what became of it.
    • The ExplainedGrant schema
    • atAccessScope
    • outcomeGrantOutcomeViewreachesstopped_by_boundaryexpiredWhat became of one grant in an explanation.
    • roleRoleView
      • The RoleView schema
      • namestringThe role's display name: a built-in name such as Developer, or the custom role's name.
      • rankAccessLevelguestreporterdevelopermaintainerownerThe built-in rank the role counts as wherever a rank is compared, such as a protected branch's minimum.
      • builtinAccessLevelguestreporterdevelopermaintainerowneror nulloptionalSet when the role is built in.
      • customRoleId (string · uuid) or nulloptionalSet when the role is one the organization defined.
    • viaGrantRoute
    • expires_atstring · date-time or nulloptional
  • limitsarray of ExplainedLimitEvery limit that capped them here.
    • The ExplainedLimit schema
    • atAccessScope
    • removedarray of stringPermissions the grants gave that this limit took away, by key.
    • subjectLimitSubjectView
    • ceilingRoleView or nulloptionalThe most the limit lets its subject hold. Absent when it allows nothing at all.
      • The RoleView schema
      • namestringThe role's display name: a built-in name such as Developer, or the custom role's name.
      • rankAccessLevelguestreporterdevelopermaintainerownerThe built-in rank the role counts as wherever a rank is compared, such as a protected branch's minimum.
      • builtinAccessLevelguestreporterdevelopermaintainerowneror nulloptionalSet when the role is built in.
      • customRoleId (string · uuid) or nulloptionalSet when the role is one the organization defined.
  • organization_ownerboolean
  • principalPrincipalSummary
    • The PrincipalSummary schema
    • idPrincipalId (string · uuid)
    • kindPrincipalKinduserservice_accountagentA person, a service account or an AI organization's agent.
    • usernamestring
    • avatar_urlstring or nulloptional
  • scopeAccessPageScope
    • The AccessPageScope schema
    • full_pathstring
    • idstring
    • inherits_accessbooleanWhether access granted on the groups above reaches it. When it is false, only access granted here — and the organization's owners — reach it.
    • typeScopeTypegrouprepository
  • boundaryAccessScope or nulloptionalThe nearest group or repository that stops access granted above it, if one does.
  • verdictPermissionVerdict or nulloptionalPresent when the request named one permission.
    • The PermissionVerdict schema
    • by_visibilitybooleanWhether the group's or repository's visibility alone lets them do it, without any grant.
    • grantedboolean
    • permissionstring
200 exampleSynthesized example
{
"effective": {
"basis": "grants",
"permissions": [
"permissions-2e43",
"permissions-eca1"
],
"rank": "guest"
},
"grants": [
{
"at": {
"full_path": "acme/payments-api",
"id": "id-9a1f",
"type": "group"
},
"outcome": "reaches",
"role": {
"name": "payments-api",
"rank": "guest"
},
"via": "direct"
},
{
"at": {
"full_path": "acme/payments-api",
"id": "id-02ea",
"type": "group"
},
"outcome": "reaches",
"role": {
"name": "payments-api",
"rank": "guest"
},
"via": "direct"
}
],
"limits": [
{
"at": {
"full_path": "acme/payments-api",
"id": "id-1072",
"type": "group"
},
"removed": [],
"subject": "principal"
}
],
"organization_owner": false,
"principal": {
"id": "98ba8f2a-e9fa-4452-b790-b7f1448e7d34",
"kind": "user",
"username": "tomas",
"avatar_url": "https://gitmoap.example/acme/ff918d2d"
},
"scope": {
"full_path": "acme/payments-api",
"id": "id-11ed",
"inherits_access": false,
"type": "group"
},
"boundary": {
"full_path": "acme/payments-api",
"id": "id-6d78",
"type": "group"
},
"verdict": {
"by_visibility": false,
"granted": false,
"permission": "permission-dfb7"
}
}
400Unknown permissionapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-4072",
"message": "Inline scalar newtypes but keep their brand"
}
}
401Authentication requiredapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-7813",
"message": "Draw the region map from operation density"
}
}
403The caller cannot see who has access hereapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-5cdf",
"message": "Label every synthesized example"
}
}
404Group or principal not foundapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-1c28",
"message": "Inline scalar newtypes but keep their brand"
}
}

CLI

gitmoap access explain-group-access

  • --group-ididGroup ID (id or group path)
  • --permissionstringoptionalOne permission key to decide, such as `code.push`
  • --principal-ididoptionalThe person or service account to explain; you, when omitted

Used in these guides