> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nekt.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Permission Recipients

> The users and groups that can receive a Catalog grant.

Assigning a permission requires the UUID of a user or a permission group, and this is the endpoint that provides them. There is no separate public listing of workspace users or groups.

## Only members are returned

The response contains **active Members only**. Owners and Admins are deliberately absent: they bypass data-level permissions entirely, so a grant to them would change nothing. If you are looking for a colleague and cannot find them here, check their role first.

## Query parameters

| Parameter | Type   | Description                                                                               |
| --------- | ------ | ----------------------------------------------------------------------------------------- |
| `layer`   | UUID   | Recipients who do **not** already hold a grant on this layer.                             |
| `folder`  | UUID   | Recipients who do **not** already hold a grant on this folder.                            |
| `table`   | UUID   | Recipients who do **not** already hold a grant on this table.                             |
| `volume`  | UUID   | Recipients who do **not** already hold a grant on this volume.                            |
| `search`  | string | Match users by name, username, or email, and groups by name or description.               |
| `expand`  | string | `users`, `groups`, or both. See [Expanding Responses](/platform-api/expanding-responses). |

<Note>
  Passing a resource **excludes recipients who already have access there**. This is picker
  semantics: the list answers "who can still be added", never "who has access". To read existing
  access, use [List Permissions](/platform-api/permissions/catalog/list) instead. Without a resource
  parameter you get every eligible member and group.
</Note>

A resource id that does not exist, or that your API key cannot see, returns `400` rather than an empty list — so a typo fails loudly instead of looking like "nobody available".

## Response

By default the endpoint returns bare id lists:

```json theme={null}
{
  "groups": ["b8c5e1e3-6d02-4f45-ad20-8f4b6e2d0e13"],
  "users": ["3f7c1e88-9a41-4b2d-8e5f-6c0a2d4b9e11"]
}
```

Pass `expand` to get full objects instead, which is what you want when you need to match people by email:

```bash theme={null}
curl --request GET \
  --url "https://api.nekt.ai/api/v1/permission-recipients/?expand=users,groups" \
  --header "x-api-key: YOUR_API_KEY"
```

## Find a person by email, then grant

```python theme={null}
import requests

API_KEY = "YOUR_API_KEY"
BASE_URL = "https://api.nekt.ai"
TARGET_EMAIL = "analyst@example.com"
TABLE_ID = "a7b4f0d2-5c91-4e34-9c1f-7e3a5f1c9d02"

headers = {"x-api-key": API_KEY, "Content-Type": "application/json"}

recipients = requests.get(
    f"{BASE_URL}/api/v1/permission-recipients/",
    headers=headers,
    params={"expand": "users", "search": TARGET_EMAIL},
).json()

if not recipients["users"]:
    raise SystemExit(f"{TARGET_EMAIL} is not an active member of this workspace.")

requests.post(
    f"{BASE_URL}/api/v1/permissions/",
    headers=headers,
    json={
        "assignments": [
            {
                "permission_level": "viewer",
                "users": [recipients["users"][0]["id"]],
                "tables": [TABLE_ID],
            }
        ]
    },
)
```

## Related

* [Assign Permissions](/platform-api/permissions/catalog/assign) — what to do with the ids.
* [List Object Permission Recipients](/platform-api/permissions/objects/recipients) — the equivalent for secrets and live connections.


## OpenAPI

````yaml GET /api/v1/permission-recipients/
openapi: 3.0.3
info:
  title: Nekt API
  version: v1
  description: Nekt API Documentation
  contact:
    email: support@nekt.ai
servers:
  - url: https://api.nekt.ai
security: []
paths:
  /api/v1/permission-recipients/:
    get:
      tags:
        - v1
      summary: List permission recipients
      description: >-
        Users and groups that can receive a Catalog grant. Ids only by default;
        pass `expand=users,groups` for full objects. Only active **members** are
        returned — Owners and Admins already bypass object-level permissions, so
        granting to them is meaningless.
      operationId: v1_permission_recipients_retrieve
      parameters:
        - in: query
          name: folder
          schema:
            type: string
          description: Only recipients who can still be granted on this folder.
        - in: query
          name: layer
          schema:
            type: string
          description: Only recipients who can still be granted on this layer.
        - in: query
          name: search
          schema:
            type: string
          description: >-
            Match users by name, username or email, and groups by name or
            description.
        - in: query
          name: table
          schema:
            type: string
          description: Only recipients who can still be granted on this table.
        - in: query
          name: volume
          schema:
            type: string
          description: Only recipients who can still be granted on this volume.
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionRecipients'
          description: ''
      security:
        - ApiKeyAuth: []
components:
  schemas:
    PermissionRecipients:
      type: object
      properties:
        groups:
          type: array
          items:
            type: string
            format: uuid
        users:
          type: array
          items:
            type: string
            format: uuid
      required:
        - groups
        - users
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: 'API Key authentication. Format: ''x-api-key: api_key'''

````