List permission grants

GET/api/v2/workspaces/{slug}/permissions/grants/

Return the grants on one resource as a paginated list, one for each user or teamspace that holds a relation on it. Expired grants aren't included. Newest grants come first.

Grants are listed per resource only. Both resource_type and resource_id are required, and leaving either out returns 400 with resource_type and resource_id are required. There is no workspace-wide listing.

You need the <resource_type>:manage permission on the resource. Otherwise the response is 403. See Who can manage grants.

Path parameters

slug:requiredstring

The workspace slug. It appears in your Plane URLs. In https://app.plane.so/my-team/projects/, the slug is my-team.

Query parameters

resource_type:requiredstring

The kind of resource whose grants you want, as the permission engine names it, for example project, cycle, or module.

resource_id:requiredstring (uuid)

The id of the resource. A value that isn't a UUID returns 400 with resource_id must be a UUID.

Ordering

order_by:optionalstring

Field to sort by. Prefix with - for descending. Defaults to -created_at.

• created_at, -created_at
• id, -id

Pagination

per_page:optionalinteger

Page size. Defaults to 50, maximum 200.

offset:optionalinteger

Number of rows to skip from the start of the result set. Maximum 10000. Use the next value from the response instead of computing offsets yourself.

paginate:optionalstring

Set to cursor to switch to the keyset envelope, which skips the COUNT query and returns next_cursor and has_more instead of next and total_count. Leave it out to get the default offset envelope.

count:optionalboolean

Defaults to true. Set to false to skip the COUNT(*) behind total_count. The field is then omitted from the response.

Response shaping

fields:optionalstring

Comma-separated list of fields to return on each row. Fields you don't request are left out of the response instead of coming back as null, so a missing key means you didn't ask for it and null means the value is null. id is always included, whether or not you name it.

Pass all to get every requestable field. An unknown field name returns 400 with the list of valid names and the closest match, so a typo is caught instead of being silently ignored.

Requestable here: created_at, expires_at, id, permissions_deny, permissions_grant, relation, resource_id, resource_type, subject_id, subject_type, updated_at.

See Sparse fields.

Scopes

workspaces.permissions:read

Errors

Status	Code	Cause
400	invalid_request	resource_type or resource_id is missing, resource_id isn't a UUID, or ?fields= names an unknown field.
401	unauthorized	Missing or invalid credentials.
403	forbidden	You can't manage access to this resource, or your token scope doesn't allow this.
404	not_found	No such workspace.
406	not_acceptable	The Accept header asks for a representation the API can't produce.
429	rate_limited	Throttled. Honor the Retry-After header before retrying.

List permission grants

curl -X GET \
  "https://api.plane.so/api/v2/workspaces/my-team/permissions/grants/?resource_type=project&resource_id=4af68566-94a4-4eb3-94aa-50dc9427067b" \
  -H "X-Api-Key: $PLANE_API_KEY"

import requests

response = requests.get(
    "https://api.plane.so/api/v2/workspaces/my-team/permissions/grants/",
    headers={"X-Api-Key": "your-api-key"},
    params={
        "resource_type": "project",
        "resource_id": "4af68566-94a4-4eb3-94aa-50dc9427067b",
    },
)
print(response.json())

const params = new URLSearchParams({
  resource_type: "project",
  resource_id: "4af68566-94a4-4eb3-94aa-50dc9427067b",
});
const response = await fetch(
  `https://api.plane.so/api/v2/workspaces/my-team/permissions/grants/?${params}`,
  {
    headers: {
      "X-Api-Key": "your-api-key",
    },
  },
);
const data = await response.json();

Response200

{
  "data": [
    {
      "id": "e2f9c4a7-1b8d-4c63-9e05-7a3b6d1f8c94",
      "subject_type": "user",
      "subject_id": "a8d3e5f1-6b2c-4e97-8d40-1c5f7a9b3e26",
      "relation": "guest",
      "resource_type": "project",
      "resource_id": "4af68566-94a4-4eb3-94aa-50dc9427067b",
      "permissions_grant": ["workitem:create"],
      "permissions_deny": [],
      "expires_at": "2026-03-31T23:59:59Z",
      "created_at": "2026-01-20T11:05:17.204918Z",
      "updated_at": "2026-01-20T11:05:17.204918Z"
    },
    {
      "id": "5d7a1e3c-9f24-4b8e-a6c0-2e4f8b1d7a39",
      "subject_type": "teamspace",
      "subject_id": "c41b7e92-5d3a-4f86-b0e1-9a2d6c8f4b57",
      "relation": "contributor",
      "resource_type": "project",
      "resource_id": "4af68566-94a4-4eb3-94aa-50dc9427067b",
      "permissions_grant": [],
      "permissions_deny": [],
      "expires_at": null,
      "created_at": "2026-01-14T09:22:41.478363Z",
      "updated_at": "2026-01-14T09:22:41.478363Z"
    }
  ],
  "next": null,
  "previous": null,
  "total_count": 2,
  "pagination": {
    "style": "offset"
  }
}

Response400

{
  "type": "invalid_request",
  "code": "invalid_request",
  "detail": "resource_type and resource_id are required."
}