Get an agent's grants
curl --request GET \
--url https://api.onecli.sh/v1/agents/{agentId}/grants \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.onecli.sh/v1/agents/{agentId}/grants"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.onecli.sh/v1/agents/{agentId}/grants', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.onecli.sh/v1/agents/{agentId}/grants",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.onecli.sh/v1/agents/{agentId}/grants"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.onecli.sh/v1/agents/{agentId}/grants")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.onecli.sh/v1/agents/{agentId}/grants")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"agentId": "<string>",
"mode": "all",
"connections": [
{
"connectionId": "<string>",
"provider": "<string>",
"label": "<string>",
"scope": "workspace",
"access": "full",
"allow": [
"<string>"
],
"ask": [
"<string>"
],
"resources": {
"repositories": [
"<string>"
]
}
}
],
"secrets": [
{
"secretId": "<string>",
"name": "<string>",
"type": "<string>",
"scope": "workspace"
}
]
}{
"error": "<string>"
}Grants
Get the connections and secrets granted to an agent
Lists everything granted to one agent, including app connections with per-tool allow and ask lists, resource scoping, and attached secrets.
GET
/
agents
/
{agentId}
/
grants
Get an agent's grants
curl --request GET \
--url https://api.onecli.sh/v1/agents/{agentId}/grants \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.onecli.sh/v1/agents/{agentId}/grants"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.onecli.sh/v1/agents/{agentId}/grants', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.onecli.sh/v1/agents/{agentId}/grants",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.onecli.sh/v1/agents/{agentId}/grants"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.onecli.sh/v1/agents/{agentId}/grants")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.onecli.sh/v1/agents/{agentId}/grants")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"agentId": "<string>",
"mode": "all",
"connections": [
{
"connectionId": "<string>",
"provider": "<string>",
"label": "<string>",
"scope": "workspace",
"access": "full",
"allow": [
"<string>"
],
"ask": [
"<string>"
],
"resources": {
"repositories": [
"<string>"
]
}
}
],
"secrets": [
{
"secretId": "<string>",
"name": "<string>",
"type": "<string>",
"scope": "workspace"
}
]
}{
"error": "<string>"
}Returns the agent’s writable grant intent. To see the effect after organization rules apply, call the Effective policy endpoints. See Agent access for how grants work.
Everything granted to one agent: the app connections it may use (with the per-tool
allow/ask lists when access is custom, and any resource scoping) and the secrets attached to it.
Grants are the writable intent. To see the effect — what requests actually get through once organization policy is applied on top — use GET /agents/{agentId}/effective-credentials and GET /policy/effective-app-permissions.
Availability: Cloud · Community (self-hosted) · Enterprise (self-hosted)
Authorizations
A workspace API key (oc_…) or organization API key (oc_org_…). Workspace-scoped endpoints called with an organization key also need X-Workspace-Id.
Path Parameters
Response
The agent's grant set
An agent's full grant set — returned by grant reads and by every grant write.