List ACL entries on a collection

GET

/collections/{id}/acls

• Local development behind nginx (port 8088 by default)

Returns every ACL row attached to this collection. ACLs are additive grants on top of the collection’s visibility + collection_grant rows.

Requires WRITE access to the collection — owner, collections.admin or system.admin — not merely read access (#933). Who else was granted what, by whom, and until when is management information about the collection rather than part of its content, so the grant disjunct that the row-visibility predicate carries is deliberately dropped here (#661).

A public collection is no exception, and that is the #933 change. visibility: public says the collection’s CONTENTS are public; it says nothing about who the owner individually shared it with. Admitting every authenticated caller to the grant list disclosed each grantee’s principal and permission level to anyone with an account and no connection to the collection.

This is now the same rule listPostAcls applies (#876). The two surfaces no longer diverge.

Authorizations

• cookieAuth
• bearerAuth

Parameters

Path Parameters

id

required

string format: uuid

Responses

200

ACL entries

Array<object>

object

principal_type

required

string

Allowed values: user role team

principal_id

required

BIGINT user.ref for principal_type=user; UUID for role/team. Stored as text so the polymorphic column fits all three.

string

<= 64 characters

permission

required

string

Allowed values: read write admin

granted_at

required

string format: date-time

granted_by_user_ref

integer format: int64

nullable

expires_at

Time-boxed grant. NULL = permanent. The handler-side check ignores rows whose expires_at < NOW().

string format: date-time

nullable

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

403

Authenticated but missing required capabilities

object

error

required

Human-readable error summary

string

Example

the request could not be completed

404

Resource not found

object

error

required

Human-readable error summary

string

Example

the request could not be completed