List a resource's individual access policies and pending invitations
GET
/v1/resource-invitations/resources/{resourceType}/{resourceId}/peopleRequires resource read access and the resource service read scope. Active organization members and access managers see the roster; external read-only recipients see only their own entry. canManage reports current resource access-management authority. Responses are private and not cached. Pending invitations grant no access.
How to call this endpoint
Every ACP API request uses bearer authentication. The examples here show the actual request path, auth header, and body shape that the platform expects.
Path, query, and header parameters
These parameters control which ACP object the endpoint acts on and how the request is processed.
Path parameters
| Name | Location | Type | Required | Description |
|---|---|---|---|---|
| resourceType | path | skill | channel | resource_package | project | environment | agent | prompt | knowledge_library | database | server | security_repository | guardrail | evaluation | fine_tuning | test_plan | assurance_policy | metronome_workflow | batch_job | inference_endpoint | Yes | — |
| resourceId | path | string | Yes | — |
Query parameters
None.
Header parameters
| Name | Location | Type | Required | Description |
|---|---|---|---|---|
| X-Computer-Agents-Organization | header | string | Yes | — |
Body schema
This endpoint does not require a request body.
None.
What the API returns
Each response code below includes the documented payload shape for the ACP API.
200People ordered by invitation creation timeapplication/json
| Field | Type | Required | Description |
|---|---|---|---|
| data | object[] | Yes | — |
| data[].id | string | Yes | Unique identifier. |
| data[].kind | person | Yes | — |
| data[].email | string | Yes | — |
| data[].name | string | Yes | Human-readable name. |
| data[].userId | string | Yes | User ID. |
| data[].profileImageUrl | string | Yes | — |
| data[].status | pending | accepted | declined | revoked | expired | Yes | Current lifecycle status. |
| data[].accessLevel | use | edit | manage | Yes | — |
| data[].permissionSet | object | Yes | Resource-specific policy, not agent runtime permissions. Action identifiers must belong to the named resource type. Missing default access is normalized to no_access. |
| data[].permissionSet.version | integer | No | — |
| data[].permissionSet.defaultAccess | full_access | ask_for_permission | read_only | no_access | No | — |
| data[].permissionSet.rings | object | No | — |
| data[].permissionSet.actions | object | No | — |
| data[].expiresAt | string | Yes | — |
| data[].createdAt | string | Yes | ISO 8601 timestamp. |
| data[].updatedAt | string | Yes | ISO 8601 timestamp. |
| canManage | boolean | Yes | — |
400Invalid resource type or missing organization header
None.
401Authentication required
None.
403Resource read permission required
None.
404Resource unavailable in the selected organization
None.
409Project conversations inherit access from their parent project
None.
503PostgreSQL required
None.
List a resource's individual access policies and pending invitations
Loading...
Response 200
Loading...