Skip to main content
GET
List access states
The identifier field is brittle — don’t use it as a key. It is a human-readable label for the grantee’s account within the application, chosen per integration (an email address for Slack, a username for GitHub, an ARN for AWS), and it can change over time, for example when the person’s email changes.When there is no application-specific identifier, identifier falls back to the user’s primary email, matching what the UI shows. That fallback is especially unreliable: an email can be reused by a different person. If an account is deactivated and its email is later inherited by a new hire, the identifier looks unchanged while the person behind it is different.For anything you match, join, or store, use the stable IDs instead — grantee_user_id (the user in AccessOwl) and grantee_user_account_id (their account within the app). Comparing the stable ID is how you detect that the person behind a reused email has actually changed.

Authorizations

Authorization
string
header
required

Bearer token authentication. Pass your AccessOwl API token in the Authorization header as Bearer <token>.

Query Parameters

limit
integer

Maximum results to return (default: 20, max: 100)

cursor
string

Opaque cursor returned in the previous response's meta.next_cursor. Omit for the first page.

application_id
string<uuid>

Filter by application ID

grantee_user_id
string<uuid>

Filter by grantee user ID

expand
string

Comma-separated list of related objects to embed inline alongside their ID fields. Allowed values: grantee_user, application, resource, target_permissions. Embedded objects carry their own top-level fields only (no further nesting). An unknown value returns 400.

Response

Access state list

Paginated list of access states

data
AccessState · object[]
required

List of access states

meta
PaginationMeta · object
required

Pagination metadata

Example:
Last modified on September 12, 2026