List access rules

List access rules or find a rule on an exact target.

GET/namespaces/{namespace}/collections/{collection}/access-rules

PermissionCluster key, or a scoped key with read (write includes read). Key scopes and actions.

Access rules require an enforced collection. Rule targets use logical paths. API-key actions control writes independently of these reader rules.
Lists return items and next_cursor. Keep the same key and filters for the next page. List cursors expire after one hour.
folder and file return only a rule stored on that exact target, not a rule inherited from above. under lists every rule at or below a folder.

Request

https://engine.example.com/namespaces/acme/collections/incident-logs/access-rules

GET /namespaces/acme/collections/incident-logs/access-rules HTTP/1.1
Host: engine.example.com
Authorization: Bearer <GRAPHON_ENGINE_API_KEY>

Replace engine.example.com with your cluster host. Examples use a key placeholder.

Response

200

A page of explicit rules. Exact-target filters do not return inherited rules.

{
  "items": [
    {
      "id": "acr_01K6Q6N7D8E9F0G1H2J3K4M5N6",
      "folder": "/reports/",
      "readers": [
        "user:ada@acme.example"
      ],
      "sealed": false,
      "created_at": "2026-10-06T10:00:00Z",
      "updated_at": "2026-10-06T10:00:00Z"
    }
  ],
  "next_cursor": null
}

Path parameters

namespacestringrequired

Namespace name or ns_ ID. It must be visible to this key.

collectionstringrequired

Collection name or col_ ID within the namespace. It must be visible to this key.

Query parameters

folderstringoptionalaccepts null

Find the rule on this exact folder prefix. Include its trailing /. This does not return an inherited rule. Do not combine with file or under.

filestringoptionalaccepts null

Find the rule on this exact file path. This does not return an inherited rule. Do not combine with folder or under.

understringoptionalaccepts null

Return rules at or below this folder prefix. Include its trailing /. Do not combine with folder or file.

cursorstringoptionalaccepts null

Opaque continuation token from next_cursor. Keep the same key, filters, and other request values. Omit it for the first page.

limitintegeroptional

Maximum resources in this page. Default 50, minimum 1, maximum 100.

Default: 50

Minimum: 1
Maximum: 100

Responses

200Success

A page of explicit rules. Exact-target filters do not return inherited rules.

application/json

Response headers

x-engine-request-idstringrequired

The Engine request ID. Retain it when investigating a failed or unexpected request.

x-request-idstringrequired

The X-Request-Id you sent, echoed when it is a valid ID. Otherwise, the Engine request ID.

itemsarray<object>required

Page of access rules visible to this key. An empty array means no resources matched.

next_cursorstringrequiredaccepts null

Token for the next page, or null when this result has no next page. Do not parse or modify the token.

Errors

Select an error in the response example to see its JSON body. See error handling for the common error format.

400invalid_request

A field, path, parameter, or conditional request rule is invalid.

What to do: Correct the request. Unknown fields are rejected.

400invalid_cursor

The cursor expired or does not belong to this request and key.

What to do: Restart from the first page. Preserve the same key, filters, and request values when continuing.

401unauthenticated

The API key is missing, invalid, or revoked.

What to do: Send an active key in Authorization: Bearer or X-API-Key.

403forbidden

The key can see the resource but lacks permission for this operation.

What to do: Use a key with the required action or scope kind.

404not_found

The resource is absent, deleted, or outside this key’s scope.

What to do: Check the identifier and the key’s namespace and collection scope.

503temporarily_unavailable

A dependency, cluster readiness condition, or capacity limit prevents this operation.

What to do: Inspect retryable and details. Retry only when permitted, preserving the idempotency key for the same write.

500internal_error

An unexpected server failure prevented this request from completing.

What to do: Retain request_id for investigation. Follow retryable before retrying a write.

Was this page helpful?

View as Markdown