The grants over the identity, live and revoked, with their ids, ops, bounds and parent: every one for the identity itself, the operator and the identities principal; a holder's own for any other caller; ERR-NotAuthorised to a caller holding none (amendment 0026).

GET

/v1/identities/{identity}/grants

const url = 'https://example.com/v1/identities/example/grants';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://example.com/v1/identities/example/grants \
  --header 'Authorization: Bearer <token>'

Authorizations

bearer

Parameters

Path Parameters

identity

required

string

A did:aledgent identifier.

Responses

200

The answer, from one consistent view (REQ-QR-2).

application/json

grants(identity) (amendment 0026): the grants whose subject is the identity, live and revoked: every one for the identity itself, the operator and the identities principal; the caller’s own for anyone else.

object

identity

required

The identity, did:-shaped.

string

items

required

The grants, in identifier order.

Array<object>

One grant over an account, as grants(account) shows it (REQ-RC-7).

object

grant

required

The grant, did:-shaped.

string

granted_at

required

When it was granted.

integer format: uint64

grantor

required

Who granted it.

string

revoked

When it was revoked, if it was.

integer | null format: uint64

terms

required

What it says: kind, holder, subject, operations, bounds, expiry.

object

assets

The assets it is limited to.

Array<string> | null

counterparties

The counterparties it is limited to.

Array<string> | null

expires

When it stops working.

integer | null format: uint64

kind

required

One of:

Granted by a holder, or narrowed from such a grant.

string

Allowed value: delegated

ops

required

What it may be used for.

Array

parent

The grant it narrows.

string | null

per_operation

The most one operation may move, in minor units.

string | null

per_window

Any of:

object
null

A per-window bound.

object

length

required

The window’s length, in milliseconds.

integer format: uint64

limit

required

The most that may move in one window, in minor units.

string

principal

required

Who will hold it.

string

subject

required

One of:

One ledger account.

object

account

required

string

One identity, did:-shaped (amendment 0025): a delegated grant to open the accounts it will own.

object

identity

required

string

Example

{
  "items": [
    {
      "terms": {
        "kind": "delegated",
        "ops": [
          "transfer"
        ],
        "subject": "delegated_accounts"
      }
    }
  ]
}

4XX

Refused, with the named condition. The status is the alternative’s x-http-status.

application/json

One of:

ERR-NotAuthorised

object

description

required

Allowed value: The initiating principal holds no authority that covers this operation, account, asset or bound

error

required

Allowed value: ERR-NotAuthorised

Example

{
  "description": "The initiating principal holds no authority that covers this operation, account, asset or bound",
  "error": "ERR-NotAuthorised"
}

5XX

Refused, with the named condition. The status is the alternative’s x-http-status.

application/json

One of:

ERR-NotAuthorised

object

description

required

Allowed value: The initiating principal holds no authority that covers this operation, account, asset or bound

error

required

Allowed value: ERR-NotAuthorised

Example

{
  "description": "The initiating principal holds no authority that covers this operation, account, asset or bound",
  "error": "ERR-NotAuthorised"
}

Headers

Retry-After

integer

On ERR-DecisionUnavailable (503): seconds to wait before retrying with the same client key (DEC-27 (g)).