List access grants
List the team’s access grants — the live records minted when an access request is approved, each revocable by its id. Admin only (a member key is rejected with 403). Optional userId, namespaceId, scopeType, and status filters (combined with AND) plus cursor pagination. status is the derived effective status: an active grant whose expiresAt has passed reads as expired.
Authentication
WorkOS API key (Authorization: Bearer sk_…). Scope comes from the key’s permissions: a key carrying passport:admin has admin scope (full catalog CRUD), any other key has member scope (reads + access requests). Organization-owned keys are admin by ownership and carry no associated user; keys minted for a user carry theirs, which is what access requests and createdBy are attributed to.
Query parameters
Page size (1–100, default 50).
Opaque pagination cursor from a previous page’s pagination.nextCursor.
Narrow to the grants of one WorkOS user (user_...). Pass it once; a repeated parameter is rejected with 400.
Narrow to the grants in one namespace. Must be a UUID (400 otherwise).
Narrow to one kind of grant scope (what the grant authorizes).
Narrow by the derived effective status. expired is an active grant whose expiresAt has passed; revoked grants stay listed as history.