List ACL entries on a post

GET

/posts/{id}/acls

• Local development behind nginx (port 8088 by default)

Returns every ACL row attached to this post. ACL rows are additive grants on top of the post’s visibility and the role / team-scope checks.

Requires WRITE access to the post — author, posts.admin or system.admin — not merely read access (#876). Who a post is shared with, who granted it and when it expires is management information about the post, not part of the post’s content: being able to read something must not disclose the rest of its guest list.

listCollectionAcls applies the same rule. It used to diverge — it additionally admitted any authenticated caller when the collection was public — and #933 closed that.

Authorizations

• cookieAuth
• bearerAuth

Parameters

Path Parameters

id

required

string format: uuid

Responses

200

ACL entries

Array<object>

object

principal_type

required

string

Allowed values: user role team

principal_id

required

BIGINT user.ref for principal_type=user; UUID for role/team. Stored as text so the polymorphic column fits all three.

string

<= 64 characters

permission

required

string

Allowed values: read write admin

granted_at

required

string format: date-time

granted_by_user_ref

integer format: int64

nullable

expires_at

Time-boxed grant. NULL = permanent. The handler-side check ignores rows whose expires_at < NOW().

string format: date-time

nullable

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

403

Authenticated but missing required capabilities

object

error

required

Human-readable error summary

string

Example

the request could not be completed

404

Resource not found

object

error

required

Human-readable error summary

string

Example

the request could not be completed