List access grants in a tenant

List

curl --request GET \
  --url https://{region}.api.plerion.com/v1/tenant/aws/access-grants \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://{region}.api.plerion.com/v1/tenant/aws/access-grants"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://{region}.api.plerion.com/v1/tenant/aws/access-grants', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{region}.api.plerion.com/v1/tenant/aws/access-grants",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{region}.api.plerion.com/v1/tenant/aws/access-grants"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://{region}.api.plerion.com/v1/tenant/aws/access-grants")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "data": [
    {
      "id": "0f9a1c3e-5b7d-4c21-9e8f-2a6b4d10c7f3",
      "organizationId": "dc16d897-7f52-4b73-be57-96c7c9a853da",
      "tenantId": "42749bc1-c99b-4c2c-a081-a6cda9370081",
      "integrationId": "458511a1-9bc2-4fce-97a0-0e3139588e6e",
      "assetId": "prn:assets:458511a1-9bc2-4fce-97a0-0e3139588e6e:aws:s3:bucket:ap-southeast-2:acme-prod-exports",
      "resourceType": "AWS::S3::Bucket",
      "awsAccountId": "111122223333",
      "region": "ap-southeast-2",
      "assetName": "acme-prod-exports",
      "service": "AWS::S3",
      "grantType": "resource_policy_statement",
      "mechanism": "resource_policy",
      "principal": "arn:aws:iam::444455556666:root",
      "principalType": "aws_account",
      "principalLabel": "Vendor - External",
      "principalDetail": null,
      "principalAccountId": "444455556666",
      "grantScope": "cross-org",
      "grantOrigin": "external",
      "allowedActions": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "allowedNotActions": null,
      "conditions": {
        "StringEquals": {
          "aws:PrincipalOrgID": "o-abc123"
        }
      },
      "blockedByRcp": false,
      "rcpStatus": "not-applicable",
      "hasRuntimeConditions": true,
      "trustStatus": "untrusted",
      "grantOwner": "platform-team",
      "reviewDecision": "keep",
      "reviewComment": "Vendor export feed, contract renewed 2026-07",
      "nextReviewAt": "2027-01-31T00:00:00.000Z",
      "reviewedBy": "ci-audit-key (API key)",
      "reviewedAt": "2026-07-20T05:41:09.000Z",
      "reviewHistory": [
        {
          "reviewedBy": "my-api-key (API key)",
          "reviewedAt": "2026-07-20T05:41:09.000Z",
          "decision": "keep",
          "owner": "platform-team",
          "comment": "Vendor export feed, contract renewed 2026-07",
          "nextReviewAt": "2027-01-31T00:00:00.000Z"
        }
      ],
      "firstObservedAt": "2026-05-14T02:11:47.000Z",
      "lastObservedAt": "2026-07-28T01:03:12.000Z"
    }
  ],
  "meta": {
    "perPage": 25,
    "total": 412,
    "cursor": "eyJmaXJzdE9ic2VydmVkQXQiOiIyMDI2LTAzLTAyVDIyOjA4OjAwLjAwMFoiLCJpZCI6IjZiMzFkODRhIn0="
  }
}

{
  "errors": [
    {
      "field": "<string>",
      "code": "<string>",
      "message": "<string>"
    }
  ]
}

{
  "message": "Internal server error"
}

GET

tenant

aws

access-grants

List

curl --request GET \
  --url https://{region}.api.plerion.com/v1/tenant/aws/access-grants \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://{region}.api.plerion.com/v1/tenant/aws/access-grants"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://{region}.api.plerion.com/v1/tenant/aws/access-grants', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{region}.api.plerion.com/v1/tenant/aws/access-grants",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{region}.api.plerion.com/v1/tenant/aws/access-grants"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://{region}.api.plerion.com/v1/tenant/aws/access-grants")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "data": [
    {
      "id": "0f9a1c3e-5b7d-4c21-9e8f-2a6b4d10c7f3",
      "organizationId": "dc16d897-7f52-4b73-be57-96c7c9a853da",
      "tenantId": "42749bc1-c99b-4c2c-a081-a6cda9370081",
      "integrationId": "458511a1-9bc2-4fce-97a0-0e3139588e6e",
      "assetId": "prn:assets:458511a1-9bc2-4fce-97a0-0e3139588e6e:aws:s3:bucket:ap-southeast-2:acme-prod-exports",
      "resourceType": "AWS::S3::Bucket",
      "awsAccountId": "111122223333",
      "region": "ap-southeast-2",
      "assetName": "acme-prod-exports",
      "service": "AWS::S3",
      "grantType": "resource_policy_statement",
      "mechanism": "resource_policy",
      "principal": "arn:aws:iam::444455556666:root",
      "principalType": "aws_account",
      "principalLabel": "Vendor - External",
      "principalDetail": null,
      "principalAccountId": "444455556666",
      "grantScope": "cross-org",
      "grantOrigin": "external",
      "allowedActions": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "allowedNotActions": null,
      "conditions": {
        "StringEquals": {
          "aws:PrincipalOrgID": "o-abc123"
        }
      },
      "blockedByRcp": false,
      "rcpStatus": "not-applicable",
      "hasRuntimeConditions": true,
      "trustStatus": "untrusted",
      "grantOwner": "platform-team",
      "reviewDecision": "keep",
      "reviewComment": "Vendor export feed, contract renewed 2026-07",
      "nextReviewAt": "2027-01-31T00:00:00.000Z",
      "reviewedBy": "ci-audit-key (API key)",
      "reviewedAt": "2026-07-20T05:41:09.000Z",
      "reviewHistory": [
        {
          "reviewedBy": "my-api-key (API key)",
          "reviewedAt": "2026-07-20T05:41:09.000Z",
          "decision": "keep",
          "owner": "platform-team",
          "comment": "Vendor export feed, contract renewed 2026-07",
          "nextReviewAt": "2027-01-31T00:00:00.000Z"
        }
      ],
      "firstObservedAt": "2026-05-14T02:11:47.000Z",
      "lastObservedAt": "2026-07-28T01:03:12.000Z"
    }
  ],
  "meta": {
    "perPage": 25,
    "total": 412,
    "cursor": "eyJmaXJzdE9ic2VydmVkQXQiOiIyMDI2LTAzLTAyVDIyOjA4OjAwLjAwMFoiLCJpZCI6IjZiMzFkODRhIn0="
  }
}

{
  "errors": [
    {
      "field": "<string>",
      "code": "<string>",
      "message": "<string>"
    }
  ]
}

{
  "message": "Internal server error"
}

Authorizations

Authorization

string

header

required

Bearer API Key. For example, "Bearer {Tenant API Key}"

Headers

Authorization

string

required

Bearer API Key. For example, "Bearer {Tenant API Key}"

Query Parameters

grantOrigin

string

Filter by whether the principal is outside your AWS organization or inside it. Accepts a single value.

Available options: external, internal

Example:

"external"

trustStatuses

string

Filter by trust status. Accepts a comma-separated list. Grants that have not been evaluated have no trust status and are excluded by this filter.

Available options: trusted, untrusted

Example:

"trusted,untrusted"

grantScopes

string

Filter by trust-boundary relationship. Accepts a comma-separated list.

Available options: cross-org, federated, public, same-account, same-org, aws-service

Example:

"cross-org,public"

mechanisms

string

Filter by the mechanism granting the access. Accepts a comma-separated list.

Available options: resource_policy, trust_policy, ram_share, attribute_share

Example:

"resource_policy,trust_policy"

principalTypes

string

Filter by what the principal is. Accepts a comma-separated list.

Available options: aws_account, aws_role, aws_user, public, conditional, aws_org, oidc, saml, cognito_identity, canonical_user, external_idp, aws_service, aws_support

Example:

"aws_account,public"

resourceTypes

string

Filter by the CloudFormation resource type of the granting resource. Accepts a comma-separated list.

Example:

"AWS::S3::Bucket,AWS::IAM::Role"

integrationIds

string

Filter by integration IDs. Accepts a comma-separated list of UUIDs.

Example:

"458511a1-9bc2-4fce-97a0-0e3139588e6e"

awsAccountIds

string

Filter by the AWS account owning the granting resource. Accepts a comma-separated list of 12-digit account IDs.

Example:

"111122223333"

principalAccountIds

string

Filter by the AWS account of the principal. Accepts a comma-separated list of 12-digit account IDs.

Example:

"444455556666"

assetName

string

Filter to grants whose resource name or asset ID contains this value. Case-insensitive substring match, maximum 256 characters.

Maximum string length: 256

Example:

"acme-prod"

principal

string

Filter to grants whose principal contains this value. Case-insensitive substring match, maximum 256 characters.

Maximum string length: 256

Example:

"444455556666"

string

Filter to grants where the principal, resource name, principal name or asset ID contains this value. Case-insensitive substring match, maximum 256 characters.

Maximum string length: 256

Example:

"vendor"

ids

string

Filter to specific grant IDs. Accepts a comma-separated list of UUIDs. Use this to re-fetch grants whose IDs you already hold.

Example:

"0f9a1c3e-5b7d-4c21-9e8f-2a6b4d10c7f3"

reviewDecisions

string

Filter by recorded review decision. Accepts a comma-separated list of keep, remove and review_later. Grants with no decision recorded are excluded, so this cannot be used to find unreviewed grants.

Example:

"keep,review_later"

grantOwner

string

Filter to grants whose recorded owner contains this value. Case-insensitive substring match, maximum 256 characters.

Maximum string length: 256

Example:

"platform-team"

nextReviewAtEnd

string<date-time>

Filter to grants due for review by this date. Inclusive upper bound on nextReviewAt; a grant with no next-review date set is not due and is excluded.

Example:

"2026-09-15T00:00:00.000Z"

cursor

string

Get the next page of access grants. Pass the meta.cursor value from the previous response.

Example:

"eyJmaXJzdE9ic2VydmVkQXQiOiIyMDI2LTAzLTAyVDIyOjA4OjAwLjAwMFoiLCJpZCI6IjZiMzFkODRhIn0="

perPage

integer

default:100

Number of items per page, from 1 to 1000. Defaults to 100. A value above 1000 is rejected with a 400.

Required range: 1 <= x <= 1000

Example:

50

Response

Access grants list

data

object[]

Show child attributes

Overview

API documentation

Authorizations

Headers

Query Parameters

Response