> ## Documentation Index > Fetch the complete documentation index at: https://docs.memorylake.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get Resource Access > See who can access a resource and why ``` GET /openapi/memorylake/admin/v1/access/{resource_type}/{resource_id} ``` Lists every member and access group that can access the resource and why — their role, an access scope, an access group, the parent workspace or a permission level — plus the members who cannot, and the permission levels you may set here. You must also be able to view the resource yourself. | `resource_type` | `resource_id` is | Permission | | - | - | - | | `workspaces` | `workspace_id` | `workspace:assign` on `workspace_id` or `access_group:view`
Also required: `workspace:read` on `workspace_id` | | `projects` | `project_id` | `project:assign` on `project_id` or `access_group:view`
Also required: `project:read` on `project_id` | | `actors` | `actor_id` | `actor:assign` on `actor_id` or `access_group:view`
Also required: `actor:read` on `actor_id` | | `agents` | `agent_id` | `agent:assign` on `agent_id` or `access_group:view`
Also required: `agent:read` on `agent_id` | | `skills` | `skill_id` | `skill:assign` on `skill_id` or `access_group:view`
Also required: `skill:read` on `skill_id` | | `boundaries` | `boundary_id` | `boundary:assign` on `boundary_id` or `access_group:view`
Also required: `boundary:read` on `boundary_id` | | `workspaces/{workspace_id}/actors` | `actor_id` | `workspace_actor:assign` on `workspace_id}/{actor_id` or `access_group:view`
Also required: `workspace_actor:read` on `workspace_id}/{actor_id` | | `workspaces/{workspace_id}/agents` | `agent_id` | `workspace_agent:assign` on `workspace_id}/{agent_id` or `access_group:view`
Also required: `workspace_agent:read` on `workspace_id}/{agent_id` | ### Path Parameters Resource type — one of the values in the table above Identifier of the resource, as listed in the table above ```bash cURL theme={null} curl -X GET 'https://app.memorylake.ai/openapi/memorylake/admin/v1/access/workspaces/69e585312c30a734cd7727316b1918bd' \ -H 'Authorization: Bearer sk_xxxxxx' ``` ### Response Members and access groups that reach the instance Display name principal\_id, or access group id member or access\_group Actions the explicit sources allow For blocked entries: scope = limited to other instances; permission = their role cannot view this resource type at all Members: the levels the caller may set them to here Whether the caller may remove the member's level (level none) Levels the caller may set this member to (excluding the current one) Why the current level cannot be lowered or removed: outranked = the member's level is not below the caller's; last\_manager = the member is the last one who can manage the resource; no\_permission = the caller cannot share this resource The member's level set on this instance; omitted when none is set. One of: `read`, `write`, `manage`. Access groups: number of members What the member can do on this instance, from every source combined. One of: `read`, `write`, `manage`. Members: their role How many instances of this resource type are in the subject's access scope Members: all = not limited by an access scope for this resource type; instances = limited to the instances in their scope How the subject reaches the instance role: the member's role reaches every instance. scope\_grant: the instance is in the subject's access scope. access\_group: an access group's instance list. parent: granted on the parent workspace. permission\_level: a permission level set on this instance. For access\_group: the group For access\_group: its name Actions this source allows; \["\*"] = all the subject's permissions allow For parent: the parent workspace id For permission\_level: the levels held on this instance Members who can access the instance Members who cannot Display name principal\_id, or access group id member or access\_group Actions the explicit sources allow For blocked entries: scope = limited to other instances; permission = their role cannot view this resource type at all Members: the levels the caller may set them to here Whether the caller may remove the member's level (level none) Levels the caller may set this member to (excluding the current one) Why the current level cannot be lowered or removed: outranked = the member's level is not below the caller's; last\_manager = the member is the last one who can manage the resource; no\_permission = the caller cannot share this resource The member's level set on this instance; omitted when none is set. One of: `read`, `write`, `manage`. Access groups: number of members What the member can do on this instance, from every source combined. One of: `read`, `write`, `manage`. Members: their role How many instances of this resource type are in the subject's access scope Members: all = not limited by an access scope for this resource type; instances = limited to the instances in their scope How the subject reaches the instance role: the member's role reaches every instance. scope\_grant: the instance is in the subject's access scope. access\_group: an access group's instance list. parent: granted on the parent workspace. permission\_level: a permission level set on this instance. For access\_group: the group For access\_group: its name Actions this source allows; \["\*"] = all the subject's permissions allow For parent: the parent workspace id For permission\_level: the levels held on this instance Permission levels the caller may set on this instance; empty when the caller cannot share it Instance id; \/\ for workspace actors and agents Resource type ```json Success (200) theme={null} { "success": true, "message": "Operation completed successfully", "data": { "allowed": [ { "name": "Example name", "subject_id": "e9225468996bae25743a2b64eeb19cc7", "subject_type": "member", "actions": [ "example" ], "blocked_by": "scope", "level_options": { "can_set_none": true, "settable_levels": [ "example" ], "blocked_reason": "outranked", "current_level": "read" }, "member_count": 1, "permission_level": "read", "role": "tenant_member", "scope_grant_count": 1, "scope_mode": "all", "sources": [ { "type": "role", "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366", "access_group_name": "Example access group", "actions": [], "parent_id": "ba8581988563142580f3237fbf400514", "permission_levels": [] } ] } ], "allowed_count": 1, "blocked": [ { "name": "Example name", "subject_id": "e9225468996bae25743a2b64eeb19cc7", "subject_type": "member", "actions": [ "example" ], "blocked_by": "scope", "level_options": { "can_set_none": true, "settable_levels": [ "example" ], "blocked_reason": "outranked", "current_level": "read" }, "member_count": 1, "permission_level": "read", "role": "tenant_member", "scope_grant_count": 1, "scope_mode": "all", "sources": [ { "type": "role", "access_group_id": "21b69c2e4fc3734ad8c25bf8b5224366", "access_group_name": "Example access group", "actions": [], "parent_id": "ba8581988563142580f3237fbf400514", "permission_levels": [] } ] } ], "grantable_levels": [ "example" ], "instance_id": "a88bb6c846106e751d8cf36bdeb592fe", "resource_type": "example" } } ``` ### Errors Errors answer with `success: false`, a `message` and an `error_code`. See [Error Codes](/features/memorylake/api-reference/errors) for every code. | Status | Meaning | | - | - | | `401` | The API key is missing, invalid, disabled or expired | | `403` | The key is not allowed to do this | | `404` | The resource does not exist | | `429` | Too many requests. Wait for the time in `Retry-After` | | `500` | Server-side error | | `503` | Temporarily unavailable. Retry later | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.