1. Docs
  2. API Reference
  3. Get where a machine client holds each permission

Get where a machine client holds each permission

GET/api/v1/oauth-clients/{id}/grants

Returns one page of where the machine client holds each permission: (permission, node_id) pairs at the nodes its active roles were granted at, not expanded through descendants, with model_version beside the page so an SDK can cache and evaluate locally. id is the client's client_id, the sub of its tokens. A deactivated client answers an empty page. include=windows returns every assignment with its window instead of only those in effect now.

Authentication

Bearer TokenAuthorization Option A

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

API KeyX-API-Key Option B

API key for management-tier access. Never send alongside an Authorization header: a request carrying both is refused.

Path Parameters

idstring Required

Query Parameters

pagenumber Optional

Page number (1-based)

min 1

takenumber Optional

Items per page (1-100, default 20)

range 1–100

includeenum Optional

`windows` adds `effective_from` and `effective_to` to every row and includes assignments outside their window, so the caller applies the window itself.

one of "windows"

Responses

application/json

  • model_versioninteger*

    The version of the authorization model these rows describe. A client that evaluates from them refuses a version it does not know rather than guessing.

  • itemsIdentityGrantResponseDto[]*
  • paginationPageMetaDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Pagination

This endpoint returns a paginated collection. Use the query parameters below to page through results.

pagenumber

Page number (1-indexed). Defaults to 1.

takenumber

Items per page (1 to 100). Defaults to 20.

Each response includes an items array alongside a pagination object with item_count, page_count, has_previous_page, and has_next_page fields.

Returned object

IdentityGrantResponseDtoView all properties on this resource
Request
curl -X GET "https://auth.canopy-io.com/api/v1/oauth-clients/value/grants?page=0&take=0&include=windows" \
  -H "X-API-Key: $CANOPY_API_KEY"
Response
{
  "model_version": 0,
  "items": [
    {
      "permission": "reports.view",
      "node_id": "00000000-0000-0000-0000-000000000000",
      "effective_from": "2026-04-20T12:00:00.000Z",
      "effective_to": "2026-04-20T12:00:00.000Z"
    }
  ],
  "pagination": {
    "page": 0,
    "take": 0,
    "item_count": 0,
    "page_count": 0,
    "has_previous_page": false,
    "has_next_page": false
  }
}
 Related endpoints
GETList OAuth clients for Application
POSTRegister a new OAuth client
GETActive/inactive OAuth client counts for the environment
GETGet OAuth client details
PATCHUpdate OAuth client
DELETEDelete OAuth client
POSTRotate an OAuth client's secret
GETList a machine client's role assignments
POSTAssign a role to a machine client at a node
PATCHChange a machine client's assignment
DELETERemove a machine client's assignment
 Was this page helpful?

Tell us how we can improve this guide.

Canopy