GET /v1/config/access-list

Returns every user on the current project's access list. An empty array means the project is open — every tenant member can trigger analyses from chat.

Authentication

API key with config:read permission. Project-scoped or tenant-scoped (with X-Project-Id).

Endpoint

GET /v1/config/access-list

Response

200 OK

{
  "success": true,
  "data": [
    {
      "userId": "8b29f4a1-...",
      "addedBy": "1c4f6e8a-...",
      "createdAt": "2026-04-12T10:14:00Z"
    }
  ]
}

Field	Type	Notes
`userId`	UUID	The tenant member who is allowed to trigger analyses
`addedBy`	UUID \| null	The tenant member (or API key owner) who added this entry
`createdAt`	ISO 8601	When the entry was added

The list is unpaginated — access lists stay small in practice.

Error responses

Status	`error.code`	When
400	`MISSING_PROJECT`	Tenant-scoped key without `X-Project-Id`
401	`UNAUTHORIZED`	Missing or invalid API key
403	`FORBIDDEN`	Key lacks `config:read`

Example

curl https://api.sigsentry.com/v1/config/access-list \
  -H "Authorization: Bearer ss_secret_..." \
  -H "X-Project-Id: 6f1c89bb-3b50-4c4a-9c5f-..."