---
title: "all users and groups with document access"
method: GET
path: "/v1/documents/{documentId}/access-list"
tags: ["Document permissions"]
---

# all users and groups with document access

`GET /v1/documents/{documentId}/access-list`

List all users and groups with access to a document. 

The paginated response includes a list of `principal` objects, where each entry represents a distinct access grant with its own role and settings. A `principal` may appear twice in the response if they have both `direct` access and `folder`-based access to the same document.

## Path parameters

- `documentId` string, required

## Query parameters

- `pageSize` integer
- `cursor` string
- `sortField` 'name' | 'email' | 'role'
- `sortDirection` 'asc' | 'desc'
- `accessSource` 'direct' | 'folder'
- `type` 'user' | 'userGroup'

## Response `200`

Successfully retrieved access list

- object
  - `principals` DocumentAccessPrincipal[]
    - `id` string — The ID of the user or user group.
    - `name` string — Display name of the user or user group.
    - `email` string — Email address. Only present for users, not user groups.
    - `type` 'user' | 'userGroup' — The type of principal.
    - `role` 'VIEWER' | 'INTERACTOR' | 'EDITOR' | 'MANAGER' — Permission level assigned to this principal.
    - `accessBoost` boolean — Whether elevated access is enabled for this principal.
    - `accessSource` 'direct' | 'folder' — How access was granted: - `direct` — Explicit document permissions - `folder` — Inherited from folder permissions
    - `isOwner` boolean — Whether this user owns the document. Only present for users, not user groups.
    - `folderInfo` object — Information about the folder that grants access. Only present when `accessSource` is `folder`.
      - `id` string — The ID of the folder.
      - `name` string — The name of the folder.
      - `path` string — The full path of the folder.
  - `pageInfo` PageInfo — Pagination information for paginated responses.
    - `hasNextPage` boolean — Indicates if there are more records available.
    - `nextCursor` string, nullable — Cursor for the next page of results. `null` if no more results.
    - `pageSize` integer — Number of records per page.
    - `totalRecords` integer — Total number of records matching the query.

## Other responses

- `400` — Bad Request. Possible causes: - Invalid `pageSize` value (must be 1-100) - Invalid `sortField` value - Invalid `sortDirection` value - Invalid `accessSource` value - Invalid `type` value - Invalid `cursor` value
- `403` — Forbidden. The user sending the API request must have **Manager** permissions for the document.
- `404` — Document not found
- `429` — Too Many Requests - Rate limit exceeded (60 requests/minute)

---

[API](https://skmtc.net/omni/apis/omni-api.md) · [All operations](https://skmtc.net/omni/apis/omni-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/omni/omni-api/revisions/6b02f7349d0e/schema)