> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://support.atomicwork.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://support.atomicwork.com/_mcp/server. # List grants with filters POST https://{tenant}.atomicwork.com/api/v1/iga/grants/list Content-Type: application/json Search and list identity grants with advanced filtering. Supports filtering by user, app, entitlement, status, and date ranges via request body filters. ### Filtering The request body is an **array of filter objects**. Send an empty array (`[]`) to retrieve all records. Each filter object has the following fields: | Field | Type | Description | | ----------- | ------ | ------------------------------------------------------- | | `attribute` | string | The field to filter on (see Supported attributes below) | | `operator` | string | Comparison operator (see Available operators below) | | `values` | array | One or more `{ "value": }` objects | **Supported attributes** | Attribute | Typical operator | Description | | ------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `status` | `IS_ANY_OF` | Grant status **bucket** (not the raw status). Accepted values: `ACTIVE` (includes GRANTED and EXTENDED grants), `INACTIVE` (includes REVOKED and EXPIRED grants), `REVOKED` (revoked only). See the Status Reference table below. | | `user` | `IS_ANY_OF` | Numeric user ID of the grant recipient (the `id` field from `GET /api/v1/users`). Pass one or more user IDs to filter grants belonging to specific people. | | `app` | `IS_ANY_OF` | Application ID — the identity resource app the entitlement belongs to (the `id` field from `GET /api/v1/iga/apps`). Filters grants to entitlements under a specific app. | | `entitlement` | `IS_ANY_OF` | Entitlement ID — the specific entitlement (group, role, license, etc.) the grant was issued for. Use `GET /api/v1/iga/entitlements` to discover IDs. | | `entitlement_value` | `IS_ANY_OF` | Entitlement value string — filters by the human-readable entitlement value (e.g. the group name or role name) rather than the numeric ID. | | `granted_at` | `IS_BETWEEN` | Grant creation timestamp. Requires exactly **two** values: `[start, end]` (both inclusive). Accepts ISO 8601 format (`2024-01-01T00:00:00Z`). | | `expires_at` | `IS_BETWEEN` | Grant expiration timestamp. Same format as `granted_at`. Use this to find grants expiring within a specific window. | | `last_login_at` | `IS_BETWEEN` | Last login timestamp for the grant recipient. Same format as `granted_at`. Useful for identifying unused grants where the user hasn't logged in recently. | **Available operators** | Operator | Meaning | | ------------------------------------ | --------------------------------------------------------- | | `EQUALS` | Exact match | | `NOT_EQUALS` | Exclude exact match | | `IN` / `IS_ANY_OF` | Match any value in the list | | `IS_NOT_ANY_OF` | Exclude all listed values | | `IS_BETWEEN` | Inclusive range — pass exactly two values: `[start, end]` | | `IS_ON_OR_BEFORE` / `IS_ON_OR_AFTER` | Date/time boundary comparisons | | `CONTAINS` / `TEXT_CONTAINS` | Substring or set membership | | `IS_NULL` / `IS_NOT_NULL` | Null checks — `values` array can be empty | | `STARTS_WITH` / `ENDS_WITH` | String prefix/suffix match | **Status Reference** Grants have a raw status and a **status bucket** used for filtering: | Filter value | Raw statuses included | Description | | ------------ | --------------------- | -------------------------------------- | | `ACTIVE` | GRANTED, EXTENDED | Currently valid grants | | `INACTIVE` | REVOKED, EXPIRED | No longer valid grants | | `REVOKED` | REVOKED | Only manually or system-revoked grants | **Grant types** (returned in responses, not used as filter attributes) | Type | Description | | ------------- | ------------------------------------------------------------------------ | | `BIRTHRIGHT` | Automatically assigned based on user attributes (department, role, etc.) | | `PREAPPROVED` | Pre-approved via an access policy — no approval workflow required | | `APPROVED` | Granted after completing an approval workflow | **Entitlement types** (filter via the entitlements endpoint, not on grants directly) | Type | Description | | --------- | -------------------------------------------------------------------- | | `GROUP` | Identity provider group membership (e.g. Azure AD group, Okta group) | | `ROLE` | Application role assignment | | `LICENSE` | Software license entitlement | | `REPO` | Repository access | | `OTHER` | Custom entitlement type | **Provisioning providers** (shown in grant responses) | Provider | Description | | ------------------ | --------------------------------------------------------- | | `OKTA` | Okta identity provider | | `AZURE_AD` | Microsoft Entra ID (Azure AD) | | `JUMPCLOUD` | JumpCloud directory | | `GOOGLE_WORKSPACE` | Google Workspace | | `MS_INTUNE` | Microsoft Intune device management | | `MANUAL` | Manual provisioning (service request created for IT team) | **Example** ```json [ { "attribute": "status", "operator": "IS_ANY_OF", "values": [ { "value": "ACTIVE" } ] }, { "attribute": "app", "operator": "IS_ANY_OF", "values": [ { "value": 42 } ] }, { "attribute": "granted_at", "operator": "IS_BETWEEN", "values": [ { "value": "2024-01-01T00:00:00Z" }, { "value": "2024-12-31T23:59:59Z" } ] }, { "attribute": "user", "operator": "IS_ANY_OF", "values": [ { "value": 123 }, { "value": 456 } ] } ] ``` Reference: https://support.atomicwork.com/api-reference/atomicwork-public-api/access-management/postapi-v-1-iga-grants-list ## Authentication - `X-Api-Key` header (required) — API Key authentication via header ## Request ### Query parameters - `search_key` (string, optional) - `sort_order` (enum, optional) - Allowed values: `CREATED_AT_ASC`, `CREATED_AT_DESC`, `UPDATED_AT_ASC`, `UPDATED_AT_DESC`, `NAME_ASC`, `NAME_DESC`, `PUBLISHED_DESC`, `UNPUBLISHED_DESC`, `EXPIRES_AT_ASC`, `EXPIRES_AT_DESC`, `GRANTED_AT_ASC`, `GRANTED_AT_DESC` - `policy_id` (string, optional) - `app_id` (long, optional) - `page` (integer, optional, default: 1) - `per_page` (integer, optional, default: 25) - `next_page_token` (string, optional) — Token from previous response to fetch the next page. When provided, takes priority over page and per_page parameters. - `ids` (string, optional) — Comma-separated list of grant IDs to filter by. When provided, returns only grants matching these IDs. ### Headers - `X-Workspace-Id` (string, optional) ### Body (application/json) This endpoint expects a list of ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItems. - `list of ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItems` ## Response ### 200 Successful response ## Types ### ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItems - `attribute` (string, optional) - `operator` (enum, optional) - Allowed values: `EQUALS`, `NOT_EQUALS`, `CONTAINS`, `NOT_CONTAINS`, `IN`, `NOT_IN`, `GREATER_THAN`, `LESS_THAN`, `GREATER_THAN_EQUALS`, `LESS_THAN_EQUALS`, `IS_BETWEEN`, `IS_NULL`, `IS_NOT_NULL`, `STARTS_WITH`, `ENDS_WITH`, `TEXT_CONTAINS`, `TEXT_DOES_NOT_CONTAINS`, `IS_ANY_OF`, `IS_NOT_ANY_OF`, `IS_EXACTLY`, `IS_ON_OR_BEFORE`, `IS_ON_OR_AFTER`, `IS_WITHIN` - `values` (list of ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItems, optional) ### ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItems - `value` (ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItemsValue, optional) — A bare scalar - number, string or boolean - never a JSON object or array. For entity-reference attributes pass the numeric id (e.g. 4009, not \{"id": 4009}). - `nested_filter` (any, optional) ### ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItemsValue A bare scalar - number, string or boolean - never a JSON object or array. For entity-reference attributes pass the numeric id (e.g. 4009, not \{"id": 4009}). ## Examples **Request** ```json [ { "attribute": "status", "operator": "IS_ANY_OF", "values": [ { "value": "ACTIVE" } ] }, { "attribute": "app", "operator": "IS_ANY_OF", "values": [ { "value": 42 } ] }, { "attribute": "granted_at", "operator": "IS_BETWEEN", "values": [ { "value": "2024-01-01T00:00:00Z" }, { "value": "2024-12-31T23:59:59Z" } ] }, { "attribute": "user", "operator": "IS_ANY_OF", "values": [ { "value": 123 }, { "value": 456 } ] } ] ``` **Response** ```json {} ``` **SDK Code** ```python Access Management_postapi_v1_iga_grants_list_example import requests url = "https://{tenant}.atomicwork.com/api/v1/iga/grants/list" querystring = {"sort_order":"CREATED_AT_ASC"} payload = [ { "attribute": "status", "operator": "IS_ANY_OF", "values": [{ "value": "ACTIVE" }] }, { "attribute": "app", "operator": "IS_ANY_OF", "values": [{ "value": 42 }] }, { "attribute": "granted_at", "operator": "IS_BETWEEN", "values": [{ "value": "2024-01-01T00:00:00Z" }, { "value": "2024-12-31T23:59:59Z" }] }, { "attribute": "user", "operator": "IS_ANY_OF", "values": [{ "value": 123 }, { "value": 456 }] } ] headers = { "X-Workspace-Id": "{{workspace_id}}", "X-Api-Key": "", "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers, params=querystring) print(response.json()) ``` ```javascript Access Management_postapi_v1_iga_grants_list_example const url = 'https://{tenant}.atomicwork.com/api/v1/iga/grants/list?sort_order=CREATED_AT_ASC'; const options = { method: 'POST', headers: { 'X-Workspace-Id': '{{workspace_id}}', 'X-Api-Key': '', 'Content-Type': 'application/json' }, body: '[{"attribute":"status","operator":"IS_ANY_OF","values":[{"value":"ACTIVE"}]},{"attribute":"app","operator":"IS_ANY_OF","values":[{"value":42}]},{"attribute":"granted_at","operator":"IS_BETWEEN","values":[{"value":"2024-01-01T00:00:00Z"},{"value":"2024-12-31T23:59:59Z"}]},{"attribute":"user","operator":"IS_ANY_OF","values":[{"value":123},{"value":456}]}]' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go Access Management_postapi_v1_iga_grants_list_example package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://{tenant}.atomicwork.com/api/v1/iga/grants/list?sort_order=CREATED_AT_ASC" payload := strings.NewReader("[\n {\n \"attribute\": \"status\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": \"ACTIVE\"\n }\n ]\n },\n {\n \"attribute\": \"app\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": 42\n }\n ]\n },\n {\n \"attribute\": \"granted_at\",\n \"operator\": \"IS_BETWEEN\",\n \"values\": [\n {\n \"value\": \"2024-01-01T00:00:00Z\"\n },\n {\n \"value\": \"2024-12-31T23:59:59Z\"\n }\n ]\n },\n {\n \"attribute\": \"user\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": 123\n },\n {\n \"value\": 456\n }\n ]\n }\n]") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("X-Workspace-Id", "{{workspace_id}}") req.Header.Add("X-Api-Key", "") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby Access Management_postapi_v1_iga_grants_list_example require 'uri' require 'net/http' url = URI("https://{tenant}.atomicwork.com/api/v1/iga/grants/list?sort_order=CREATED_AT_ASC") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Post.new(url) request["X-Workspace-Id"] = '{{workspace_id}}' request["X-Api-Key"] = '' request["Content-Type"] = 'application/json' request.body = "[\n {\n \"attribute\": \"status\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": \"ACTIVE\"\n }\n ]\n },\n {\n \"attribute\": \"app\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": 42\n }\n ]\n },\n {\n \"attribute\": \"granted_at\",\n \"operator\": \"IS_BETWEEN\",\n \"values\": [\n {\n \"value\": \"2024-01-01T00:00:00Z\"\n },\n {\n \"value\": \"2024-12-31T23:59:59Z\"\n }\n ]\n },\n {\n \"attribute\": \"user\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": 123\n },\n {\n \"value\": 456\n }\n ]\n }\n]" response = http.request(request) puts response.read_body ``` ```java Access Management_postapi_v1_iga_grants_list_example import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://{tenant}.atomicwork.com/api/v1/iga/grants/list?sort_order=CREATED_AT_ASC") .header("X-Workspace-Id", "{{workspace_id}}") .header("X-Api-Key", "") .header("Content-Type", "application/json") .body("[\n {\n \"attribute\": \"status\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": \"ACTIVE\"\n }\n ]\n },\n {\n \"attribute\": \"app\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": 42\n }\n ]\n },\n {\n \"attribute\": \"granted_at\",\n \"operator\": \"IS_BETWEEN\",\n \"values\": [\n {\n \"value\": \"2024-01-01T00:00:00Z\"\n },\n {\n \"value\": \"2024-12-31T23:59:59Z\"\n }\n ]\n },\n {\n \"attribute\": \"user\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": 123\n },\n {\n \"value\": 456\n }\n ]\n }\n]") .asString(); ``` ```php Access Management_postapi_v1_iga_grants_list_example request('POST', 'https://{tenant}.atomicwork.com/api/v1/iga/grants/list?sort_order=CREATED_AT_ASC', [ 'body' => '[ { "attribute": "status", "operator": "IS_ANY_OF", "values": [ { "value": "ACTIVE" } ] }, { "attribute": "app", "operator": "IS_ANY_OF", "values": [ { "value": 42 } ] }, { "attribute": "granted_at", "operator": "IS_BETWEEN", "values": [ { "value": "2024-01-01T00:00:00Z" }, { "value": "2024-12-31T23:59:59Z" } ] }, { "attribute": "user", "operator": "IS_ANY_OF", "values": [ { "value": 123 }, { "value": 456 } ] } ]', 'headers' => [ 'Content-Type' => 'application/json', 'X-Api-Key' => '', 'X-Workspace-Id' => '{{workspace_id}}', ], ]); echo $response->getBody(); ``` ```csharp Access Management_postapi_v1_iga_grants_list_example using RestSharp; var client = new RestClient("https://{tenant}.atomicwork.com/api/v1/iga/grants/list?sort_order=CREATED_AT_ASC"); var request = new RestRequest(Method.POST); request.AddHeader("X-Workspace-Id", "{{workspace_id}}"); request.AddHeader("X-Api-Key", ""); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "[\n {\n \"attribute\": \"status\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": \"ACTIVE\"\n }\n ]\n },\n {\n \"attribute\": \"app\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": 42\n }\n ]\n },\n {\n \"attribute\": \"granted_at\",\n \"operator\": \"IS_BETWEEN\",\n \"values\": [\n {\n \"value\": \"2024-01-01T00:00:00Z\"\n },\n {\n \"value\": \"2024-12-31T23:59:59Z\"\n }\n ]\n },\n {\n \"attribute\": \"user\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": 123\n },\n {\n \"value\": 456\n }\n ]\n }\n]", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift Access Management_postapi_v1_iga_grants_list_example import Foundation let headers = [ "X-Workspace-Id": "{{workspace_id}}", "X-Api-Key": "", "Content-Type": "application/json" ] let parameters = [ [ "attribute": "status", "operator": "IS_ANY_OF", "values": [["value": "ACTIVE"]] ], [ "attribute": "app", "operator": "IS_ANY_OF", "values": [["value": 42]] ], [ "attribute": "granted_at", "operator": "IS_BETWEEN", "values": [["value": "2024-01-01T00:00:00Z"], ["value": "2024-12-31T23:59:59Z"]] ], [ "attribute": "user", "operator": "IS_ANY_OF", "values": [["value": 123], ["value": 456]] ] ] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://{tenant}.atomicwork.com/api/v1/iga/grants/list?sort_order=CREATED_AT_ASC")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```