List permission grants

GET/api/v2/workspaces/{slug}/permissions/grants/

Return the grants on one resource as a paginated list, one for each user or teamspace that holds a relation on it. Expired grants aren't included. Newest grants come first.

Grants are listed per resource only. Both resource_type and resource_id are required, and leaving either out returns 400 with resource_type and resource_id are required. There is no workspace-wide listing.

You need the <resource_type>:manage permission on the resource. Otherwise the response is 403. See Who can manage grants.

Path Parameters

slug:requiredstring

The workspace slug. It appears in your Plane URLs. In https://app.plane.so/my-team/projects/, the slug is my-team.

Query Parameters

resource_type:requiredstring

The kind of resource whose grants you want, as the permission engine names it, for example project, cycle, or module.

resource_id:requiredstring (uuid)

The id of the resource. A value that isn't a UUID returns 400 with resource_id must be a UUID.

Ordering

order_by:optionalstring

Field to sort by. Prefix with - for descending. Defaults to -created_at.

• created_at, -created_at
• id, -id

Pagination

per_page:optionalinteger

Page size. Defaults to 50, maximum 200.

offset:optionalinteger

Number of rows to skip from the start of the result set. Maximum 10000. Read the next value from the response rather than computing offsets yourself.

paginate:optionalstring

Set to cursor to opt into the COUNT-free keyset envelope, which returns next_cursor and has_more instead of next and total_count. Omit it for the default offset envelope.

count:optionalboolean

Defaults to true. Set to false to skip the COUNT(*) behind total_count. The field is then omitted from the response.

Response shaping

fields:optionalstring

Comma-separated list of fields to return on each row. Unrequested keys are omitted from the response, not returned as null, so absent means "not requested" and null means "actually null". id always comes back whether or not you name it.

Pass all for every requestable field. An unknown name is a 400 that lists the valid set and suggests the closest match, so a typo can't silently cost you the saving.

Requestable here: created_at, expires_at, id, permissions_deny, permissions_grant, relation, resource_id, resource_type, subject_id, subject_type, updated_at.

See Sparse fields.

Scopes

workspaces.permissions:read

Errors

Status	Code	Cause
400	invalid_request	resource_type or resource_id is missing, resource_id isn't a UUID, or ?fields= names an unknown field.
401	unauthorized	Missing or invalid credentials.
402	payment_required	The feature this endpoint belongs to isn't enabled on your plan, or is switched off.
403	forbidden	You can't manage access to this resource, or your token scope doesn't allow this.
404	not_found	No such workspace.
406	not_acceptable	The Accept header asks for a representation the API can't produce.
429	rate_limited	Throttled. Honor the Retry-After header before retrying.

List permission grants

curl -X GET \
  "https://api.plane.so/api/v2/workspaces/my-team/permissions/grants/?resource_type=project&resource_id=4af68566-94a4-4eb3-94aa-50dc9427067b" \
  -H "X-Api-Key: $PLANE_API_KEY"

import requests

response = requests.get(
    "https://api.plane.so/api/v2/workspaces/my-team/permissions/grants/",
    headers={"X-Api-Key": "your-api-key"},
    params={
        "resource_type": "project",
        "resource_id": "4af68566-94a4-4eb3-94aa-50dc9427067b",
    },
)
print(response.json())

const params = new URLSearchParams({
  resource_type: "project",
  resource_id: "4af68566-94a4-4eb3-94aa-50dc9427067b",
});
const response = await fetch(
  `https://api.plane.so/api/v2/workspaces/my-team/permissions/grants/?${params}`,
  {
    headers: {
      "X-Api-Key": "your-api-key",
    },
  },
);
const data = await response.json();

Response200

{
  "data": [
    {
      "id": "e2f9c4a7-1b8d-4c63-9e05-7a3b6d1f8c94",
      "subject_type": "user",
      "subject_id": "a8d3e5f1-6b2c-4e97-8d40-1c5f7a9b3e26",
      "relation": "guest",
      "resource_type": "project",
      "resource_id": "4af68566-94a4-4eb3-94aa-50dc9427067b",
      "permissions_grant": ["workitem:create"],
      "permissions_deny": [],
      "expires_at": "2026-03-31T23:59:59Z",
      "created_at": "2026-01-20T11:05:17.204918Z",
      "updated_at": "2026-01-20T11:05:17.204918Z"
    },
    {
      "id": "5d7a1e3c-9f24-4b8e-a6c0-2e4f8b1d7a39",
      "subject_type": "teamspace",
      "subject_id": "c41b7e92-5d3a-4f86-b0e1-9a2d6c8f4b57",
      "relation": "contributor",
      "resource_type": "project",
      "resource_id": "4af68566-94a4-4eb3-94aa-50dc9427067b",
      "permissions_grant": [],
      "permissions_deny": [],
      "expires_at": null,
      "created_at": "2026-01-14T09:22:41.478363Z",
      "updated_at": "2026-01-14T09:22:41.478363Z"
    }
  ],
  "next": null,
  "previous": null,
  "total_count": 2,
  "pagination": {
    "style": "offset"
  }
}

Response400

{
  "type": "invalid_request",
  "code": "invalid_request",
  "detail": "resource_type and resource_id are required."
}