---
title: "Get object access control list"
method: GET
path: "/v1/objects/{object-id}/access-rights"
tags: ["Objects"]
---

# Get object access control list

`GET /v1/objects/{object-id}/access-rights`

Return the object's directly assigned access control list and the flag controlling
whether access rights are inherited from parent objects. Requires read access to the
object.

## Path parameters

- `object-id` integer, required

## Response `200`

Object access rights.

- ObjectAccessRights — Object access control list and the flag controlling inheritance of access rights from parent objects.
  - `inheritAccessRights` boolean — When true, effective rights include those inherited from parent objects in addition to the directly assigned rights below.
  - `accessList` object[] — Directly assigned access control entries. On update this is a full replacement of the object's own access list.
    - `userId` integer — User or group ID. Group IDs have the high bit (0x80000000) set.
    - `access` integer — Bit mask of access rights granted to the user or group on this object.

## Other responses

- `401` — Unauthorized
- `403` — User does not have read access to the object
- `404` — Object with given ID does not exist

---

[API](https://skmtc.net/netxms/apis/netxms-api.md) · [All operations](https://skmtc.net/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/netxms/netxms-api/versions/14d93e5115dd/schema)