GoodMemGoodMem
ReferenceAPIREST APIAccess Policy

List authorization grants

GET /v1/access-policy/grants: Lists grants attached to one resource. MANAGE_ACCESS is required on that resource; continuation tokens are bound to the caller and filters.

Lists grants attached to one resource. MANAGE_ACCESS is required on that resource; continuation tokens are bound to the caller and filters.

GET
/v1/access-policy/grants

Authorization

x-api-key<token>

In: header

Query Parameters

resourceKindstring

Required target resource kind

Value in"INSTANCE" | "USER" | "SERVICE_IDENTITY" | "SPACE" | "API_KEY" | "EMBEDDER" | "RERANKER" | "LLM" | "MEMORY" | "EXTENSION" | "RETRIEVE_MEMORY_LOG_POLICY"
resourceId?string

Required target UUID except when resourceKind is INSTANCE

includeRevoked?boolean

Include revoked history

Defaultfalse
maxResults?integer

Page size; 0 or omission uses the default of 50, maximum 1,000

Default50
Formatint32
nextToken?string

Opaque continuation token

Response Body

curl -X GET "https://your-goodmem-server.example.com/v1/access-policy/grants?resourceKind=SPACE&resourceId=550e8400-e29b-41d4-a716-446655440000&includeRevoked=true&maxResults=100&nextToken=string"
{
  "grants": [
    {
      "grantId": "f276b9a4-73d6-4e04-95c5-87b974221f92",
      "audience": {
        "principalId": "70e025f6-76ca-4cbe-b8fc-7dab8e84590a"
      },
      "rule": {
        "assignedResource": {
          "resourceId": "550e8400-e29b-41d4-a716-446655440000"
        }
      },
      "createdById": "70e025f6-76ca-4cbe-b8fc-7dab8e84590a",
      "revokedById": "114ad558-323d-4b76-85b8-37af103b8650"
    }
  ],
  "nextToken": "string"
}
Empty
Empty
Empty
Empty
Empty
Empty

Get a scoped role assignment

GET /v1/access-policy/role-assignments/{id}: Reads one live assignment, or one revoked historical assignment when includeRevoked is true, after requiring MANAGE_ACCESS on its policy target.

List scoped role assignments

GET /v1/access-policy/role-assignments: Lists assignments attached to one required INSTANCE or SPACE boundary after requiring MANAGE_ACCESS. Continuation tokens are bound to the caller and filters.