List Origin Repository Grants via the API

List users, groups, and owning-team groups that hold a permission granted directly on a repository with GET https://api.cursor.com/v1/origin/repos/{ownerSlug}/{repoName}/grants. Official reference: Origin API → List Repository Grants, and the concepts page Origin Grants API.

Origin is in Early Beta and subject to change. Authenticate with an installation access token (oit_…) or a Cursor user access token that carries repository:settings:read. Availability: Early Beta per the API overview.

Permissions inherited from the repository's owner are not included. A principal that no longer resolves to an active user, group, or owning team is omitted, so a page can hold fewer grants than pageSize.

Cost: 1 point against the principal budget (ordinary read).

Path parameters

Param	Required	Meaning
ownerSlug	yes	Owning entity's unique slug
repoName	yes	Repo name, unique to the owner

Query parameters

Param	Required	Meaning
pageSize	no	Max grants to return. Defaults to 30 when unset or 0. Values above 100 are clamped to 100. Ignored when pageToken is set.
pageToken	no	Opaque cursor from a previous response's nextPageToken. Empty for the first page.

curl --request GET \
  --url 'https://api.cursor.com/v1/origin/repos/OWNER_SLUG/REPO_NAME/grants' \
  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

Response

Field	Meaning
grants	Grants held directly on the repository, ordered by principal kind (groups, owning-team admins, owning-team members, users) then by id
grants[].user	User principal (id prefixed user_, plus optional email, displayName, handle). Exactly one of user, group, or teamGroup is present.
grants[].group	Cursor group principal (id prefixed grp_)
grants[].teamGroup	Built-in owning-team group; kind is members or admins
grants[].permission	read, write, admin, or custom. custom reports a custom policy that Upsert Repository Grant does not accept.
repository	The repository every grant in this response belongs to (same fields as Get Repo)
nextPageToken	Opaque cursor for the next page; empty when there are no more pages

Treat page tokens as opaque and restart pagination when filters change. For interactive or scripted user calls, prefer origin api after origin auth login (or CURSOR_API_KEY) so the CLI exchanges a personal user API key for a short-lived user access token. Do not put a Cursor API key directly in the Origin Authorization header.

Base URL: https://api.cursor.com/v1/origin.