Skip to content
GitmoapAPIBeta
Organizeaccess
GET/groups/{group_id}/access/limits

The limits in force on a group: set there, or on a group above it.

list_group_access_limits
  • access:read
    A token needs the access:read scope: See who has access to a group or repository, and whyGranted by read_api, write_api.Every operation this scope unlocks
  • Single-resource

    x-gitmoap-isolation: {"kind":"single_or_self_scoped"}

  • Paginated
    Pass the next_token a page returns to get the next one.

A limit caps what its subject can do whatever they are granted, so one set higher up reaches this group even where inheritance is switched off. Listed oldest first. Callers who can see who has access here may read it (Reporters and above with the built-in roles).

Parameters

Path
  • group_idGroupId (string · uuid)Group ID
Query
  • limitinteger · int64optionalMaximum number of limits, 1-100 (default 50)
  • next_tokenstringoptionalPagination token

Responses

200The limits in force on the group, oldest firstapplication/json
  • limitsarray of AccessLimit
    • The AccessLimit schema
    • atAccessScopeWhere the limit is set. It caps its subject there and everywhere beneath, including beneath a group or repository that does not inherit access.
    • created_atstring · date-time
    • limit_idLimitId (string · uuid)
    • subjectLimitSubjectEntry
    • ceilingRoleView or nulloptionalThe most the subject may hold. Absent when the limit allows nothing at all.
      • The RoleView schema
      • namestringThe role's display name: a built-in name such as Developer, or the custom role's name.
      • rankAccessLevelguestreporterdevelopermaintainerownerThe built-in rank the role counts as wherever a rank is compared, such as a protected branch's minimum.
      • builtinAccessLevelguestreporterdevelopermaintainerowneror nulloptionalSet when the role is built in.
      • customRoleId (string · uuid) or nulloptionalSet when the role is one the organization defined.
    • created_byActorSummary or nulloptional
    • reasonstring or nulloptional
  • scopeAccessPageScope
    • The AccessPageScope schema
    • full_pathstring
    • idstring
    • inherits_accessbooleanWhether access granted on the groups above reaches it. When it is false, only access granted here — and the organization's owners — reach it.
    • typeScopeTypegrouprepository
  • next_tokenstring or nulloptional
200 exampleSynthesized example
{
"limits": [
{
"at": {
"full_path": "acme/payments-api",
"id": "id-0907",
"type": "group"
},
"created_at": "2026-10-11T09:04:37Z",
"limit_id": "9faf664a-2d7d-4d26-aba4-5a9fa37bcd61",
"subject": {
"principal": {
"id": "6449965e-fd13-436a-8b58-5a7765e49e4c",
"kind": "user",
"username": "lin"
}
}
},
{
"at": {
"full_path": "acme/payments-api",
"id": "id-ed55",
"type": "group"
},
"created_at": "2026-10-16T02:06:15Z",
"limit_id": "98ce553a-966e-4744-a5ca-824b2d9ae628",
"subject": {
"principal": {
"id": "44fd5d40-906b-4c16-a084-67443a8d9232",
"kind": "user",
"username": "tomas"
}
}
}
],
"scope": {
"full_path": "acme/payments-api",
"id": "id-23e2",
"inherits_access": false,
"type": "group"
},
"next_token": "next-token-ad13"
}
400Invalid pagination tokenapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-5505",
"message": "Inline scalar newtypes but keep their brand"
}
}
401Authentication requiredapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-6273",
"message": "Label every synthesized example"
}
}
403The caller cannot see who has access hereapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-2f7b",
"message": "Label every synthesized example"
}
}
404Group not foundapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-236a",
"message": "Label every synthesized example"
}
}

CLI

gitmoap access list-group-access-limits

  • --group-ididGroup ID (id or group path)
  • --limitnumberoptionalMaximum number of limits, 1-100 (default 50)
  • --next-tokenstringoptionalPagination token

Used in these guides