OrdinateDB

Documentation

product Pre-releaseunwritten sections are marked
GET/v1/auth/grants

List authorization grants

operation ID: get_v1_auth_grants

Overview

List authorization grants. The authentication API establishes identity and manages the roles, grants, sessions, and service credentials used for authorization.

When to use it

  • Use it when an application needs to list authorization grants.
  • Use it when a client needs to sign in, inspect its identity, or an administrator needs to manage access.

Quick example

Set the base URL and replace generated identifiers or credentials with values from your installation.

cURL

curl --request GET \
  --url "$ORDINATE_URL/v1/auth/grants" \
  --header "Authorization: Bearer $ORDINATE_TOKEN"

Expected output · 200

Grants

Example 200 output

{
  "entries": [
    {
      "grant_id": "00000000-0000-4000-8000-000000000001",
      "principal": "string",
      "role_id": "00000000-0000-4000-8000-000000000001",
      "scope_kind": "site",
      "scope_id": "00000000-0000-4000-8000-000000000001",
      "valid_from_ns": 0,
      "valid_to_ns": 0,
      "tx_id": 0
    }
  ]
}

The cURL request supplies the documented path and query values and asks OrdinateDB to list authorization grants. The documented 200 response is grants.

How it works

OrdinateDB resolves a session or bearer credential to a principal, then evaluates roles, capabilities, and resource scope for each protected operation.

Reference

Required capability
admin
Authorization scope
handler-resolved target

Parameters

NameInRequiredType and constraints
as_of_nsqueryno
integer

UTC Unix timestamp in nanoseconds

format: int64

Request body

This operation has no request body.

Responses

200Grants

application/json

entriesarrayrequired

array

grant_idstringrequired
format: uuid
principalPrincipalStringrequired
PrincipalString
string

Grant-subject grammar: system, user UUID, service UUID, or an IdP group name.

pattern: ^(system|(user|svc):[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|group:.+)$
role_idstringrequired
format: uuid
scope_idstringrequired
format: uuid
scope_kindstringrequired
tx_idintegerrequired
format: int64
valid_from_nsintegerrequired

UTC Unix timestamp in nanoseconds

format: int64
valid_to_nsany ofrequired

any of

option 1

integer

UTC Unix timestamp in nanoseconds

format: int64

option 2

null
unknown fields rejected
unknown fields rejected

Example 200 output

{
  "entries": [
    {
      "grant_id": "00000000-0000-4000-8000-000000000001",
      "principal": "string",
      "role_id": "00000000-0000-4000-8000-000000000001",
      "scope_kind": "site",
      "scope_id": "00000000-0000-4000-8000-000000000001",
      "valid_from_ns": 0,
      "valid_to_ns": 0,
      "tx_id": 0
    }
  ]
}
401Authentication required

application/json

ErrorEnvelope
codestringrequired
correlation_idstringrequired
format: uuid
detailsobjectoptional
errorstringrequired

Example 401 output

{
  "error": "string",
  "code": "account-sealed",
  "correlation_id": "00000000-0000-4000-8000-000000000001"
}
403Required capability is not granted

application/json

ErrorEnvelope
codestringrequired
correlation_idstringrequired
format: uuid
detailsobjectoptional
errorstringrequired

Example 403 output

{
  "error": "string",
  "code": "account-sealed",
  "correlation_id": "00000000-0000-4000-8000-000000000001"
}
503Model database is not configured

application/json

ErrorEnvelope
codestringrequired
correlation_idstringrequired
format: uuid
detailsobjectoptional
errorstringrequired

Example 503 output

{
  "error": "string",
  "code": "account-sealed",
  "correlation_id": "00000000-0000-4000-8000-000000000001"
}

Code examples

These examples are generated from the source contract. Replace the base URL, credentials, identifiers, and minimal generated values for your instance.

JavaScript

const ordinateUrl = "http://localhost:8080";
const token = "<bearer-token>";

const response = await fetch(`${ordinateUrl}/v1/auth/grants`, {
  method: "GET",
  headers: {
    Authorization: `Bearer ${token}`
  }
});

if (!response.ok) {
  throw new Error(`OrdinateDB returned ${response.status}: ${await response.text()}`);
}

const data = await response.json();
console.log(data);

Related topics