1. Docs
  2. API Reference
  3. List denies

List denies

GET/api/v1/denies

One page of the Environment's denies, newest first by default (sort_by: created or node). A deny refuses its permission_keys to its target (an identity, a machine client, or every holder of a role) at its node and everywhere beneath, whatever grants allow. Narrow with node_id (with node_mode: at, the denies made at the node, or applies, those at it or above it, everything that refuses access there), target_type, target_id and permission; q searches target names and permission keys. A person is named only to a reader who may see the Environment's people (identity.view; for an administrator env_identities.view, and production_identities.access in a production Environment); otherwise target.name and target.email are null. Requires deny.view.

Authentication

Bearer TokenAuthorization Option A

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

API KeyX-API-Key Option B

API key for management-tier access. Never send alongside an Authorization header: a request carrying both is refused.

Query Parameters

pagenumber Optional

Page number (1-based)

min 1

takenumber Optional

Items per page (1-100, default 20)

range 1–100

qstring Optional

Search term

max length 200

sort_byenum Optional

`created` (the default, newest first) or `node`.

one of "created" · "node"

orderenum Optional

Sort direction

one of "asc" · "desc"

node_idstring · uuid Optional

Only denies at this node, or that apply here (`node_mode`).

node_modeenum Optional

With `node_id`: `at` (the default) the denies made at the node; `applies` the denies at it or any node above it, everything that refuses access there.

one of "at" · "applies"

target_typeenum Optional

one of "identity" · "oauth_client" · "role"

target_idstring · uuid Optional

Only denies targeting this identity, machine client or role.

permissionstring Optional

Only denies refusing this permission key.

Responses

application/json

  • itemsDenyResponseDto[]*
  • paginationPageMetaDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Pagination

This endpoint returns a paginated collection. Use the query parameters below to page through results.

pagenumber

Page number (1-indexed). Defaults to 1.

takenumber

Items per page (1 to 100). Defaults to 20.

Each response includes an items array alongside a pagination object with item_count, page_count, has_previous_page, and has_next_page fields.

Returned object

DenyResponseDtoView all properties on this resource
Request
curl -X GET "https://auth.canopy-io.com/api/v1/denies?page=0&take=0&q=value&sort_by=created&order=asc&node_id=value&node_mode=at&target_type=identity&target_id=value&permission=value" \
  -H "X-API-Key: $CANOPY_API_KEY"
Response
{
  "items": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "target": {
        "type": "identity",
        "id": "00000000-0000-0000-0000-000000000000",
        "name": "string",
        "email": "string"
      },
      "permission_keys": [
        "documents.view"
      ],
      "node": {
        "id": "00000000-0000-0000-0000-000000000000",
        "name": "string",
        "path": [
          "string"
        ]
      },
      "exception_roles": [
        {
          "id": "00000000-0000-0000-0000-000000000000",
          "name": "string"
        }
      ],
      "reason": "string",
      "created_by": {
        "type": "user",
        "id": "00000000-0000-0000-0000-000000000000",
        "name": "string"
      },
      "created_at": "2026-04-20T12:00:00.000Z"
    }
  ],
  "pagination": {
    "page": 0,
    "take": 0,
    "item_count": 0,
    "page_count": 0,
    "has_previous_page": false,
    "has_next_page": false
  }
}
 Related endpoints
POSTCreate a deny
POSTPreview a deny
GETGet a deny
DELETEDelete a deny
GETWhat a deny refuses today
 Was this page helpful?

Tell us how we can improve this guide.

Canopy