> ## Documentation Index
> Fetch the complete documentation index at: https://docs.memorylake.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Access Group Access Scope

> Returns, per resource type, the instances the group gives its members access to

```
GET /openapi/memorylake/admin/v1/access-groups/{group_id}/access-scope
```

Returns, per resource type, the instances the group gives its members access to. The `ETag` header identifies this state for a conditional [Set Access Group Access Scope](/features/memorylake/api-reference/access-control/set-access-group-access-scope).

<Note>
  **Permission required:** `access_group:view`
</Note>

### Path Parameters

<ParamField path="group_id" type="string" required>
  Identifier
</ParamField>

<RequestExample>
  ```bash cURL theme={null}
  curl -X GET 'https://app.memorylake.ai/openapi/memorylake/admin/v1/access-groups/7013fb5c15cfb29411f040967354b8a3/access-scope' \
    -H 'Authorization: Bearer sk_xxxxxx'
  ```
</RequestExample>

### Response

<ResponseField name="data" type="object">
  <Expandable title="Access Group Access Scope object">
    <ResponseField name="group_id" type="string">The group</ResponseField>

    <ResponseField name="scopes" type="array">
      One entry per scopable resource type; a group only ever adds access

      <Expandable title="Access Scope Entry object">
        <ResponseField name="mode" type="string">all = every instance; instances = only the listed ones</ResponseField>
        <ResponseField name="resource_type" type="string">Resource type, e.g. memorylake:project (see GET /permission-catalog)</ResponseField>
        <ResponseField name="available_actions" type="array">Read-only. Instance-level actions the member's role grants for this type — the most a scope entry can allow.</ResponseField>

        <ResponseField name="instances" type="array">
          The instances, when mode is instances

          <Expandable title="Access Scope Instance object">
            <ResponseField name="id" type="string">Instance id, as returned by the data API</ResponseField>
            <ResponseField name="actions" type="array">Actions allowed on this instance. Omit for every action the member's role allows.</ResponseField>
            <ResponseField name="effective_actions" type="array">Read-only. The subset of actions the member's CURRENT role still grants.</ResponseField>
            <ResponseField name="permission_level" type="string">Read-only. The permission level, when via\_permission\_level is true. One of: `read`, `write`, `manage`.</ResponseField>
            <ResponseField name="shadowed_actions" type="array">Read-only. Actions stored here that the member's current role no longer grants.</ResponseField>
            <ResponseField name="via_permission_level" type="boolean">Read-only. The member reaches this instance through a permission level granted on it, not through this scope. May be echoed back on write; such instances are skipped.</ResponseField>
            <ResponseField name="workspace_id" type="string">Parent workspace of a project instance. Required when writing a project instance.</ResponseField>
          </Expandable>
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseExample>
  ```json Success (200) theme={null}
  {
    "success": true,
    "message": "Operation completed successfully",
    "data": {
      "group_id": "75bcd78140d9e42928db031f1fbb59a5",
      "scopes": [
        {
          "mode": "all",
          "resource_type": "example",
          "available_actions": [
            "example"
          ],
          "instances": [
            {
              "id": "bc572b050c9920425b5fd75681eccbb2",
              "actions": [],
              "effective_actions": [],
              "permission_level": "read",
              "shadowed_actions": [],
              "via_permission_level": false,
              "workspace_id": "0fa2d21dc175adc7a003e0b37f156cb1"
            }
          ]
        }
      ]
    }
  }
  ```
</ResponseExample>

### Errors

Errors answer with `success: false`, a `message` and an `error_code`. See [Error Codes](/features/memorylake/api-reference/errors) for every code.

| Status | Meaning |
| - | - |
| `401` | The API key is missing, invalid, disabled or expired |
| `403` | The key is not allowed to do this |
| `404` | The resource does not exist |
| `422` | The body or a parameter failed validation |
| `429` | Too many requests. Wait for the time in `Retry-After` |
| `500` | Server-side error |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.