---
title: "GET /templates/{TemplateArn}/accessControlEntries/{GroupSecurityIdentifier}"
method: GET
path: "/templates/{TemplateArn}/accessControlEntries/{GroupSecurityIdentifier}"
---

# GET /templates/{TemplateArn}/accessControlEntries/{GroupSecurityIdentifier}

`GET /templates/{TemplateArn}/accessControlEntries/{GroupSecurityIdentifier}`

Retrieves the group access control entries for a template.

## Path parameters

- `GroupSecurityIdentifier` string, required
- `TemplateArn` string, required

## Response `200`

Success

- GetTemplateGroupAccessControlEntryResponse
  - `AccessControlEntry` object — An access control entry allows or denies an Active Directory group from enrolling and/or autoenrolling with a template.
    - `AccessRights` object — Permissions to allow or deny an Active Directory group to enroll or autoenroll certificates issued against a template.
      - `AutoEnroll` 'ALLOW' | 'DENY' — Allow or deny an Active Directory group from autoenrolling certificates issued against a template. The Active Directory group must be allowed to enroll to allow autoenrollment
      - `Enroll` 'ALLOW' | 'DENY' — Allow or deny an Active Directory group from enrolling certificates issued against a template.
    - `CreatedAt` string, date-time — The date and time that the Access Control Entry was created.
    - `GroupDisplayName` string — Name of the Active Directory group. This name does not need to match the group name in Active Directory.
    - `GroupSecurityIdentifier` string — Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".
    - `TemplateArn` string — The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_CreateTemplate.html">CreateTemplate</a>.
    - `UpdatedAt` string, date-time — The date and time that the Access Control Entry was updated.

## Other responses

- `480` — AccessDeniedException
- `481` — ValidationException
- `482` — ResourceNotFoundException
- `483` — ThrottlingException
- `484` — InternalServerException

---

[API](https://skmtc.net/aws/apis/pca-connector-ad.md) · [All operations](https://skmtc.net/aws/apis/pca-connector-ad/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/pca-connector-ad/versions/ab51ba01ae5f/schema)