> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nekt.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Object permission object

> A single grant on a secret or a live connection.

The shape of a grant on the axis that sits outside the Catalog. Same skeleton as the [Catalog permission object](/platform-api/permissions/catalog/permission), plus one field the Catalog does not have.

| Field              | Type                              | Notes                                                                                                               |
| ------------------ | --------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| `id`               | UUID                              |                                                                                                                     |
| `permission_level` | `viewer` \| `editor` \| `manager` |                                                                                                                     |
| `tool_scope`       | array of strings, or `null`       | **Live connections only.** `null` means the connection's full available set, and keeps tracking it as tools change. |
| `user`             | UUID                              | Expandable.                                                                                                         |
| `group`            | UUID                              | Expandable.                                                                                                         |
| `secret`           | UUID                              | Expandable.                                                                                                         |
| `live_connection`  | UUID                              | Expandable.                                                                                                         |
| `granted_by`       | UUID                              | Expandable.                                                                                                         |
| `created_at`       | datetime                          |                                                                                                                     |
| `updated_at`       | datetime                          |                                                                                                                     |

Exactly one of `user` / `group` is set, and exactly one of `secret` / `live_connection`.

<Warning>
  A `manager` grant never carries a `tool_scope` — a manager holds the full set by definition. Reading `tool_scope: null` on a `manager` row therefore tells you nothing about intent.
</Warning>