List file permissions
Lists who has access to a file and at what level.
GET
/v1/files/:id/permissions
Permission
The key must be granted files.read
A key without it gets 403 insufficient_scope, with the missing permission named in details.
Needs manage access on the document itself, not only the scope: reading who something is shared with is not something a viewer may do.
Path parameters
| Field | Type | Description |
|---|---|---|
id required |
string | The file or document to read access for. |
Request
curl https://api.veruapis.com/v1/files/:id/permissions \
-H "Authorization: Bearer vak_live_..."Response
| Field | Type | Description |
|---|---|---|
id |
string | Pass it back to revoke this grant. |
principal_type |
string |
usergroup
|
principal_id |
string | |
role |
string | What the grant allows. |
created_by |
string | Who shared it. |
created_at |
RFC 3339 |
{
"data": [
{ "id": "0192c001-0000-7a41-b8d2-5e9f0c3a7b41", "principal_type": "user", "principal_id": "01918e4b-9999-7f11-b4a9-0242ac130003", "role": "editor", "created_by": "01918e4b-7c2e-7f11-b4a9-0242ac130003", "created_at": "2026-09-02T11:00:00Z" }
],
"meta": { "request_id": "req_01j8z9...", "timestamp": "2026-09-02T10:00:00Z" },
"pagination": { "next_cursor": "eyJ1aWQiOjQyMTF9", "has_more": true, "limit": 25 }
}
Worth knowing
Needs manage access on the document itself, not just the scope: who something is shared with is not something a viewer may read.
Errors
Every failure uses the same shape, with a stable string code you can branch on. See the error reference.
Related
- DELETE Abort an upload
- POST Complete an upload
- POST Create a folder
- POST Start an upload
- DELETE Delete a file
- DELETE Delete a folder
- GET Download a file
- GET Get file metadata
- GET Get upload status
- GET List files
- GET List folders
- POST Share a file
- DELETE Revoke file access
- PATCH Rename or move a file
- PATCH Rename or move a folder
- PUT Upload a part