List Origin Namespace Grants via the API

List who has been granted access to an owner with GET https://api.cursor.com/v1/origin/owners/{ownerSlug}/grants. Official reference: Origin API → List Namespace Grants, and Origin Grants API.

Origin is in Early Beta and subject to change. Authenticate with an installation access token (oit_…) or a Cursor user access token that carries namespace:settings:read. Availability: Early Beta per the API overview.

Each grant carries the permission it confers on every repository under the owner. Grants made on individual repositories are not included; read those with List Repository Grants. A principal that no longer resolves is omitted, so a page can hold fewer grants than pageSize.

Cost: 1 point against the principal budget (ordinary read).

Path parameters

Param	Required	Meaning
ownerSlug	yes	Slug of the owner whose grants to list

Query parameters

Param	Required	Meaning
pageSize	no	Max grants to return. Defaults to 30 when unset or 0. Values above 100 are clamped to 100. Ignored when pageToken is set.
pageToken	no	Opaque cursor from a previous response's nextPageToken. Empty for the first page.

curl --request GET \
  --url 'https://api.cursor.com/v1/origin/owners/OWNER_SLUG/grants' \
  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

Response

Field	Meaning
grants	Page of grants. Admin grants come first; within each run, ordered by principal kind then id
grants[].user	User principal (id prefixed user_, plus optional email, displayName, handle). Exactly one of user, group, or teamGroup is present.
grants[].group	Cursor group principal (id prefixed grp_)
grants[].teamGroup	Built-in owning-team group; kind is members or admins
grants[].permission	PERMISSION_READ, PERMISSION_CONTRIBUTOR, PERMISSION_WRITE, PERMISSION_ADMIN, or PERMISSION_CUSTOM. PERMISSION_CUSTOM reports a custom policy that Upsert Namespace Grant does not accept.
nextPageToken	Opaque cursor for the next page; empty when there are no more pages

Namespace permission strings use the PERMISSION_* ladder (including PERMISSION_CONTRIBUTOR). Repository grants use the shorter read / write / admin / custom values.

Treat page tokens as opaque and restart pagination when filters change. For interactive or scripted user calls, prefer origin api after origin auth login (or CURSOR_API_KEY). Do not put a Cursor API key directly in the Origin Authorization header.

Base URL: https://api.cursor.com/v1/origin.