---
title: "Get object access control list"
method: GET
path: "/v1/objects/{object-id}/access-rights"
tags: ["Objects"]
---

# Get object access control list

`GET /v1/objects/{object-id}/access-rights`

Return the object's directly assigned access control list and the flag controlling
whether access rights are inherited from parent objects. Requires read access to the
object.

## Path parameters

- `object-id` integer, required

## Response `200`

Object access rights.

- ObjectAccessRights — Object access control list and the flag controlling inheritance of access rights from parent objects.
  - `inheritAccessRights` boolean — When true, rights are inherited from parent objects for users that no entry in the list below matches, either directly or through one of their groups, and are combined across all parents. Inherited rights do not add to directly assigned rights - a matching entry below replaces them entirely, even when it grants nothing. See EffectiveRights for the full resolution order.
  - `accessList` object[] — Directly assigned access control entries. On update this is a full replacement of the object's own access list.
    - `userId` integer — User or group ID. Group IDs have the group flag bit (0x40000000) set.
    - `access` integer — Bit mask of access rights granted to the user or group on this object. Attribute is 64 bit wide since schema version 70.25, although only low 32 bits are allocated so far - bit 31 (0x80000000) is a valid access bit (execute script), not a flag.

## Other responses

- `401` — Unauthorized
- `403` — User does not have read access to the object
- `404` — Object with given ID does not exist

---

[API](https://skmtc.net/netxms/apis/netxms-api.md) · [All operations](https://skmtc.net/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/netxms/netxms-api/revisions/e9197a1d31c4/schema)