---
title: "Get object access control list"
method: GET
path: "/v1/objects/{object-id}/access-rights"
tags: ["Objects"]
---

# Get object access control list

`GET /v1/objects/{object-id}/access-rights`

Return the object's directly assigned access control list and the flag controlling
whether access rights are inherited from parent objects. Requires read access to the
object.

## Path parameters

- `object-id` integer, required

## Response `200`

Object access rights.

- ObjectAccessRights — Object access control list and the flag controlling inheritance of access rights from parent objects.
  - `inheritAccessRights` boolean — When true, effective rights include those inherited from parent objects in addition to the directly assigned rights below.
  - `accessList` object[] — Directly assigned access control entries. On update this is a full replacement of the object's own access list.
    - `userId` integer — User or group ID. Group IDs have the group flag bit (0x40000000) set.
    - `access` integer — Bit mask of access rights granted to the user or group on this object. Attribute is 64 bit wide since schema version 70.25, although only low 32 bits are allocated so far - bit 31 (0x80000000) is a valid access bit (execute script), not a flag.

## Other responses

- `401` — Unauthorized
- `403` — User does not have read access to the object
- `404` — Object with given ID does not exist

---

[API](https://skmtc.net/netxms/apis/netxms-api.md) · [All operations](https://skmtc.net/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/netxms/netxms-api/revisions/ae3bfc65fa61/schema)