> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nekt.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Object Permission Recipients

> The users and groups that can receive a secret or live connection grant.

The counterpart of [List Permission Recipients](/platform-api/permissions/catalog/recipients) for the secrets and live-connection axis, with the same contract: **active Members only**, ids by default, full objects with `expand`, and picker semantics — passing a resource excludes whoever already holds a grant there.

## Query parameters

| Parameter         | Type   | Description                                                                 |
| ----------------- | ------ | --------------------------------------------------------------------------- |
| `secret`          | UUID   | Recipients who do **not** already hold a grant on this secret.              |
| `live_connection` | UUID   | Recipients who do **not** already hold a grant on this live connection.     |
| `search`          | string | Match users by name, username, or email, and groups by name or description. |
| `expand`          | string | `users`, `groups`, or both.                                                 |

```bash theme={null}
curl --request GET \
  --url "https://api.nekt.ai/api/v1/organization/object-permission-recipients/?expand=users" \
  --header "x-api-key: YOUR_API_KEY"
```

```json theme={null}
{
  "groups": ["b8c5e1e3-6d02-4f45-ad20-8f4b6e2d0e13"],
  "users": ["3f7c1e88-9a41-4b2d-8e5f-6c0a2d4b9e11"]
}
```


## OpenAPI

````yaml GET /api/v1/organization/object-permission-recipients/
openapi: 3.0.3
info:
  title: Nekt API
  version: v1
  description: Nekt API Documentation
  contact:
    email: support@nekt.ai
servers:
  - url: https://api.nekt.ai
security: []
paths:
  /api/v1/organization/object-permission-recipients/:
    get:
      tags:
        - v1
      summary: List object permission recipients
      description: >-
        Users and groups that can receive a secret or live-connection grant. Ids
        only by default; pass `expand=users,groups` for full objects. Only
        active **members** are returned — Owners and Admins already bypass
        object-level permissions.
      operationId: v1_organization_object_permission_recipients_retrieve
      parameters:
        - in: query
          name: live_connection
          schema:
            type: string
          description: Only recipients who can still be granted on this live connection.
        - in: query
          name: search
          schema:
            type: string
          description: >-
            Match users by name, username or email, and groups by name or
            description.
        - in: query
          name: secret
          schema:
            type: string
          description: Only recipients who can still be granted on this secret.
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ObjectPermissionRecipients'
          description: ''
      security:
        - ApiKeyAuth: []
components:
  schemas:
    ObjectPermissionRecipients:
      type: object
      properties:
        groups:
          type: array
          items:
            type: string
            format: uuid
        users:
          type: array
          items:
            type: string
            format: uuid
      required:
        - groups
        - users
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: 'API Key authentication. Format: ''x-api-key: api_key'''

````