Skip to content
Olivares AI docs

Returns one administrable Channel, its precondition ETag and a bounded page of the stored grant generations the requested filters select, without opening content or changing any state.

GET
/v1/m/sessions/channels/{id}/grants
 
curl --request GET \
  --url 'https://example.com/v1/m/sessions/channels/example/grants?workspace_id=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0&state=active&subject_kind=user&limit=50' \
  --header 'Authorization: Bearer <token>'

Returns one administrable Channel, its precondition ETag and a bounded page of the stored grant generations the requested filters select, without opening content or changing any state.

Authorizations

Section titled “ Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “ Path Parameters ”
id
required
string

Path parameter id.

Header Parameters

Section titled “ Header Parameters ”
X-Olivares-Tenant
string format: uuid

Target tenant id; required when the principal can act in more than one tenant.

Query Parameters

Section titled “ Query Parameters ”
workspace_id
required
string format: uuid
/^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/

Canonical stored workspace UUID selected for this personal collection; it is revalidated and never grants authority.

state
string
default: active
Allowed values: active revoked expired all

PERSISTED grant state selection: active (default), revoked, expired or all. It is not a temporal predicate — an active row whose expiry has passed is still selected by active, because it is the row the next mutation must reckon with.

subject_kind
string
Allowed values: user user_group agent agent_group session

Exact grant subject kind; required together with subject_ref. Groups are not expanded and names are not resolved.

subject_ref
string
>= 1 characters <= 256 characters

Exact grant subject reference; required together with subject_kind.

continuation
string
>= 1 characters <= 2048 characters

Authenticated c3g1 continuation returned by the preceding page, anchored to the last grant it returned and bound to the Channel revision that page observed; a revision change between pages is 409 channel_snapshot_changed, never a mixed listing.

limit
integer
default: 50 >= 1 <= 200

Grant page size from 1 through 200; default 50.

Responses

Section titled “ Responses ”

200

Section titled “ 200 ”

Administrable Channel, its precondition ETag and one page of stored grant generations

Media type application/json
object
channel
required
object
acl_revision
required
integer format: int64
content_protection
required
string
created_at
required
string format: date-time
default_ack_policy
required
string
default_ack_timeout_ms
required
integer format: int64
default_wake
required
string
description
string
id
required
string format: uuid
kind
required
string
max_automation_depth
required
integer format: int64
max_fanout
required
integer format: int64
name
required
string
protection_generation
required
integer format: int64
retention_policy_ref
string
route_revision
required
integer format: int64
sensitivity
required
string
slug
required
string
state
required
string
subscription_revision
required
integer format: int64
tenant_id
required
string format: uuid
updated_at
required
string format: date-time
version
required
integer format: int64
workspace_id
required
string format: uuid
continuation

Authenticated c3g1 token anchored to the last returned grant and bound to the Channel revision observed; present only when has_more is true.

string
etag
required

Strong Channel validator and the If-Match precondition of the existing mutations; the page carries no HTTP ETag and no 304 because filters, pagination and observed_at change the body without changing Channel.version.

string
has_more
required
boolean
items
required
Array<object>
object
grant
required
object
can_admin
required
boolean
can_read
required
boolean
can_write
required
boolean
channel_id
required
string format: uuid
created_at
required
string format: date-time
expires_at
Any of:
string format: date-time
generation
required
integer format: int64
granted_by
required
object
kind
required
string
Allowed values: user agent session system
ref
required
string
>= 1 characters <= 1024 characters
id
required
string format: uuid
revoked_by
Any of:
object
kind
required
string
Allowed values: user agent session system
ref
required
string
>= 1 characters <= 1024 characters
state
required
string
subject
required
object
kind
required
string
Allowed values: user user_group agent agent_group session
ref
required
string
>= 1 characters <= 1024 characters
supersedes_id
string format: uuid
tenant_id
required
string format: uuid
updated_at
required
string format: date-time
version
required
integer format: int64
workspace_id
required
string format: uuid
temporal_state
required

Whether this row is in force at observed_at. A persisted active row whose expiry has passed reads expired without its stored state being changed.

string
Allowed values: active revoked expired
observed_at
required
string format: date-time
Example 
{
  "items": [
    {
      "grant": {
        "granted_by": {
          "kind": "user"
        },
        "revoked_by": {
          "kind": "user"
        },
        "subject": {
          "kind": "user"
        }
      },
      "temporal_state": "active"
    }
  ]
}

Headers

Section titled “ Headers ”
Cache-Control
required
string
Allowed values: no-store

Always no-store. These pages are authorization-dependent and observation-dependent: the same request from the same client can legitimately produce a different answer a moment later, and a refusal must never be replayed from a cache after the authority behind it changed. There is no HTTP ETag and no 304 on these routes; the etag in the body is the Channel precondition for the existing mutations, not a representation validator.

400

Section titled “ 400 ”

Bad request

Media type application/json
object
Example generated 
{}

Headers

Section titled “ Headers ”
Cache-Control
required
string
Allowed values: no-store

Always no-store. These pages are authorization-dependent and observation-dependent: the same request from the same client can legitimately produce a different answer a moment later, and a refusal must never be replayed from a cache after the authority behind it changed. There is no HTTP ETag and no 304 on these routes; the etag in the body is the Channel precondition for the existing mutations, not a representation validator.

401

Section titled “ 401 ”

Unauthenticated

Media type application/json
object
Example generated 
{}

Headers

Section titled “ Headers ”
Cache-Control
required
string
Allowed values: no-store

Always no-store. These pages are authorization-dependent and observation-dependent: the same request from the same client can legitimately produce a different answer a moment later, and a refusal must never be replayed from a cache after the authority behind it changed. There is no HTTP ETag and no 304 on these routes; the etag in the body is the Channel precondition for the existing mutations, not a representation validator.

403

Section titled “ 403 ”

Forbidden

Media type application/json
object
Example generated 
{}

Headers

Section titled “ Headers ”
Cache-Control
required
string
Allowed values: no-store

Always no-store. These pages are authorization-dependent and observation-dependent: the same request from the same client can legitimately produce a different answer a moment later, and a refusal must never be replayed from a cache after the authority behind it changed. There is no HTTP ETag and no 304 on these routes; the etag in the body is the Channel precondition for the existing mutations, not a representation validator.

404

Section titled “ 404 ”

Not found

Media type application/json
object
Example generated 
{}

Headers

Section titled “ Headers ”
Cache-Control
required
string
Allowed values: no-store

Always no-store. These pages are authorization-dependent and observation-dependent: the same request from the same client can legitimately produce a different answer a moment later, and a refusal must never be replayed from a cache after the authority behind it changed. There is no HTTP ETag and no 304 on these routes; the etag in the body is the Channel precondition for the existing mutations, not a representation validator.

409

Section titled “ 409 ”

Conflict

Media type application/json
object
Example generated 
{}

Headers

Section titled “ Headers ”
Cache-Control
required
string
Allowed values: no-store

Always no-store. These pages are authorization-dependent and observation-dependent: the same request from the same client can legitimately produce a different answer a moment later, and a refusal must never be replayed from a cache after the authority behind it changed. There is no HTTP ETag and no 304 on these routes; the etag in the body is the Channel precondition for the existing mutations, not a representation validator.

429

Section titled “ 429 ”

Rate limited

Media type application/json
object
Example generated 
{}

Headers

Section titled “ Headers ”
Cache-Control
required
string
Allowed values: no-store

Always no-store. These pages are authorization-dependent and observation-dependent: the same request from the same client can legitimately produce a different answer a moment later, and a refusal must never be replayed from a cache after the authority behind it changed. There is no HTTP ETag and no 304 on these routes; the etag in the body is the Channel precondition for the existing mutations, not a representation validator.

503

Section titled “ 503 ”

Current authority, custody or store evidence is unavailable; or, with code commit_outcome_unknown, the write was issued and its outcome was never learned, so it may be durable and must not be retried automatically

Media type application/json
object
Example generated 
{}

Headers

Section titled “ Headers ”
Cache-Control
required
string
Allowed values: no-store

Always no-store. These pages are authorization-dependent and observation-dependent: the same request from the same client can legitimately produce a different answer a moment later, and a refusal must never be replayed from a cache after the authority behind it changed. There is no HTTP ETag and no 304 on these routes; the etag in the body is the Channel precondition for the existing mutations, not a representation validator.