> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.athenaintel.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.athenaintel.com/_mcp/server.

# Get effective access on an asset

GET https://api.athenaintel.com/api/v0/assets/{asset_id}/access

Read the access that you, or another user, have on an asset, and every grant that gives it. The level is what Athena's permission checks decide for the user in the asset's own workspace, whichever workspace is active for your key: 'view' can open the asset, 'edit' can also change it and manage its sharing, 'owner' created it and can edit it, and 'none' cannot open it. Each source names one grant: 'owner', 'direct' (shared with the user), 'group' (shared with a workspace group the user belongs to), 'workspace' (shared with the whole workspace), 'drive' (a role on the drive) or 'other' (access the share list does not hold, for example an environment admin). A folder's sharing reaches each asset inside it as that asset's own share, so a 'workspace' source on a sub-folder shows that a share of its parent folder reached it. Without user_id the route reads your own access; you need view access to the asset and membership in its workspace. To read another user's access, pass their user_id; you need edit access to the asset, as for sharing it. A user who is not a member of the asset's workspace, or who does not exist, reads as 'none' with is_member false. A suspended member reads as 'none' with no sources, and is_member still reports their membership. When a permission check cannot be answered (for example on an asset in a drive while the authorization service is unavailable), the route answers 503 and never a level. The route never changes a permission.

Reference: https://docs.athenaintel.com/api-reference/assets/get-access

## Authentication

- `X-API-KEY` header (required) — API Key authentication via header

## Request

### Path parameters

- `asset_id` (string, required) — Unique identifier of the asset

### Query parameters

- `user_id` (string, optional, nullable) — The user whose access to read. Leave it out to read your own. Reading another user's access needs edit access to the asset.

## Response

### 200

The user's effective access on the asset

- `asset_id` (string, required) — ID of the asset
- `is_member` (boolean, required) — Whether the user has an active membership in the asset's workspace. A user who is not a member reads as 'none'; the one exception is the workspace's own external viewer, who can still open what is shared with them. A suspended member reads as 'none' with no sources, and this field still reports their membership.
- `level` (enum, required) — The access the user has, as Athena's permission checks decide it: 'view' can open the asset, 'edit' can also change it and manage its sharing, 'owner' created it and can edit it, 'none' cannot open it. When a check refuses what a listed source grants, the level is lower than that source, and the level is what holds.
  - Allowed values: `owner`, `edit`, `view`, `none`
- `sources` (list of AssetAccessSourceOut, required) — Every grant that contributes to the level
- `user_id` (string, required) — The user whose access was read
- `workspace_id` (string, required, nullable) — The workspace the asset belongs to

## Errors

### 403 Forbidden Error

Forbidden - you are not a member of the asset's workspace, cannot view the asset, or asked about another user without edit access to the asset

- `message` (string, required)

### 404 Not Found Error

Asset not found

- `message` (string, required)

### 422 Unprocessable Entity Error

Validation Error

- `detail` (list of ValidationError, optional)

### 503 Service Unavailable Error

The access could not be read; try again

- `any`

## Types

### AssetAccessSourceOut

One grant that contributes to a user's access on an asset.

- `kind` (enum, required) — Where the grant comes from: 'owner' (the user created the asset), 'direct' (the asset is shared with the user), 'group' (it is shared with a workspace group the user belongs to), 'workspace' (it is shared with the whole workspace), 'drive' (a role on the drive the asset is in) or 'other' (access the share list does not hold, for example an environment admin, also on an asset in a drive, or the view of a folder that holds an asset the user can open). A folder's sharing reaches each asset inside it as that asset's own share, so a 'workspace' source on a sub-folder shows that a share of its parent folder reached it.
  - Allowed values: `owner`, `direct`, `group`, `workspace`, `drive`, `other`
- `level` (enum, required) — The level this grant gives
  - Allowed values: `owner`, `edit`, `view`
- `group_id` (string, optional, nullable) — The workspace group, when kind is 'group'
- `group_name` (string, optional, nullable) — The workspace group's name, when kind is 'group'

### ValidationError

- `loc` (list of ValidationErrorLocItems, required)
- `msg` (string, required)
- `type` (string, required)
- `ctx` (ValidationErrorCtx, optional)
- `input` (any, optional)

### ValidationErrorLocItems

- string
- integer

### ValidationErrorCtx

## Examples

**Response**

```json
{
  "asset_id": "asset_92492920-d118-42d3-95b4-00eccfe0754f",
  "is_member": true,
  "level": "view",
  "sources": [
    {
      "kind": "workspace",
      "level": "view"
    }
  ],
  "user_id": "user_8c1f4e2a",
  "workspace_id": "workspace_eb171baf"
}
```

**SDK Code**

```python assets_get_access_example
import requests

url = "https://api.athenaintel.com/api/v0/assets/asset_id/access"

headers = {"X-API-KEY": "<apiKey>"}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript assets_get_access_example
const url = 'https://api.athenaintel.com/api/v0/assets/asset_id/access';
const options = {method: 'GET', headers: {'X-API-KEY': '<apiKey>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go assets_get_access_example
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.athenaintel.com/api/v0/assets/asset_id/access"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-API-KEY", "<apiKey>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby assets_get_access_example
require 'uri'
require 'net/http'

url = URI("https://api.athenaintel.com/api/v0/assets/asset_id/access")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["X-API-KEY"] = '<apiKey>'

response = http.request(request)
puts response.read_body
```

```java assets_get_access_example
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.athenaintel.com/api/v0/assets/asset_id/access")
  .header("X-API-KEY", "<apiKey>")
  .asString();
```

```php assets_get_access_example
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.athenaintel.com/api/v0/assets/asset_id/access', [
  'headers' => [
    'X-API-KEY' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp assets_get_access_example
using RestSharp;

var client = new RestClient("https://api.athenaintel.com/api/v0/assets/asset_id/access");
var request = new RestRequest(Method.GET);
request.AddHeader("X-API-KEY", "<apiKey>");
IRestResponse response = client.Execute(request);
```

```swift assets_get_access_example
import Foundation

let headers = ["X-API-KEY": "<apiKey>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.athenaintel.com/api/v0/assets/asset_id/access")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```