Get access rule

Read an access rule by its immutable ID.

GET/namespaces/{namespace}/collections/{collection}/access-rules/{rule_id}

PermissionCluster key, or a scoped key with read (write includes read). Key scopes and actions.

Access rules require an enforced collection. Rule targets use logical paths. API-key actions control writes independently of these reader rules.

Request

https://engine.example.com/namespaces/acme/collections/incident-logs/access-rules/acr_01K6Q6N7D8E9F0G1H2J3K4M5N6

GET /namespaces/acme/collections/incident-logs/access-rules/acr_01K6Q6N7D8E9F0G1H2J3K4M5N6 HTTP/1.1
Host: engine.example.com
Authorization: Bearer <GRAPHON_ENGINE_API_KEY>

Replace engine.example.com with your cluster host. Examples use a key placeholder.

Response

200

The requested resource or result.

{
  "id": "acr_01K6Q6N7D8E9F0G1H2J3K4M5N6",
  "folder": "/reports/",
  "readers": [
    "user:ada@acme.example"
  ],
  "sealed": false,
  "created_at": "2026-10-06T10:00:00Z",
  "updated_at": "2026-10-06T10:00:00Z"
}

Path parameters

namespacestringrequired

Namespace name or ns_ ID. It must be visible to this key.

collectionstringrequired

Collection name or col_ ID within the namespace. It must be visible to this key.

rule_idstringrequired

Access-rule ID with the acr_ prefix, returned by create or list.

Responses

200Success

The requested resource or result.

application/json

Response headers

x-engine-request-idstringrequired

The Engine request ID. Retain it when investigating a failed or unexpected request.

x-request-idstringrequired

The X-Request-Id you sent, echoed when it is a valid ID. Otherwise, the Engine request ID.

created_atstring (date-time)required

Time the resource was created, as an ISO 8601 UTC timestamp.

filestringoptionalaccepts null

Exact file path, such as /reports/incident.txt. Send exactly one of file and folder. The rule may exist before the file.

folderstringoptionalaccepts null

Folder prefix, such as /reports/. Start and end with /. The root / covers the collection. Send exactly one of folder and file.

idstringrequired

Immutable access-rule ID with the acr_ prefix.

readersarray<string>required

User or group principals allowed by this rule. Principals match exact strings. Maximum 1,024 readers, each at most 256 UTF-8 bytes. An empty list denies retrieval.

sealedbooleanrequired

Whether this folder rule overrides every rule below it. Only folder rules can be sealed. The highest sealed ancestor governs a file.

updated_atstring (date-time)required

Time the resource last changed, as an ISO 8601 UTC timestamp.

Errors

Select an error in the response example to see its JSON body. See error handling for the common error format.

400invalid_request

A field, path, parameter, or conditional request rule is invalid.

What to do: Correct the request. Unknown fields are rejected.

401unauthenticated

The API key is missing, invalid, or revoked.

What to do: Send an active key in Authorization: Bearer or X-API-Key.

403forbidden

The key can see the resource but lacks permission for this operation.

What to do: Use a key with the required action or scope kind.

404not_found

The resource is absent, deleted, or outside this key’s scope.

What to do: Check the identifier and the key’s namespace and collection scope.

503temporarily_unavailable

A dependency, cluster readiness condition, or capacity limit prevents this operation.

What to do: Inspect retryable and details. Retry only when permitted, preserving the idempotency key for the same write.

500internal_error

An unexpected server failure prevented this request from completing.

What to do: Retain request_id for investigation. Follow retryable before retrying a write.

Was this page helpful?

View as Markdown