> ## Documentation Index > Fetch the complete documentation index at: https://docs.flowpayroll.ai/llms.txt > Use this file to discover all available pages before exploring further. # List who has access through an organisation group > Needs permission user:read. Everybody with access through one of your account's organisation groups, with the role it gives them: the `Group` rows `GET /organisations/{organisationId}/access` shows for this group, the same shape, `via.type` always `Group`. Ordered by principal id. Paginated: `pageSize` (default 50, at most 100) and `paginationToken`; follow the token until it is absent. `createdBy` and `createdDate` say who gave the access and when, where the grant records it. 404 `group_not_found` when your account has no such group, or it is being deleted. 403 when you hold no access in your account. Once roles other than administrator can be given, seeing this list needs `user:read` across your account (403 `access_view_denied`), and API tokens are listed only to somebody who also holds `api-token:read`. ## OpenAPI ````yaml /api-reference/specs/administration.json get /organisation-groups/{groupId}/access openapi: 3.0.4 info: title: Administration API description: >- Manage your Flow Payroll account: the organisations it owns, the people who can sign in to it, the API tokens it holds, its brand, and a feed of recent administration activity. Every resource is scoped to the account your credentials belong to, so no request ever names a customer and the `X-Org-Id` header is not used. version: v1 servers: - url: https://api.sandbox.flowpayroll.ai/v1/administration security: - X-Auth-Token: [] tags: - name: Customer description: >- Your account: the customer every other resource on this API belongs to. Read it and rename it. - name: Organisations description: >- The organisations your account owns or manages: list them with headcounts and your access to each, get one in full, add one or several at a time, see everybody who can reach one, and read which of its data an outside system manages. - name: Organisation groups description: >- Named sets of your organisations, such as the clients one team looks after. Give a person or API token a group, and they reach every organisation in it, including ones added later. - name: Users description: >- The people who can sign in to your account: list, invite (one or many), resend invitations, and manage each person's direct grants and account-wide access. - name: Roles description: >- What people and API tokens can do where they have access: the built-in roles, roles of your own, and the default role. Only Administrator can be given today. - name: API tokens description: >- The client credentials your integrations authenticate with: create (the secret is shown once), rename, rotate, revoke, and manage which organisations each token reaches. - name: Branding description: >- Your white-label brand: edit a draft, publish it, upload its files, and set a company logo for each organisation. - name: Activity description: >- Recent administration actions in your account, and every change to who has access, newest first. - name: SCIM description: >- SCIM 2.0 provisioning: your identity provider adds, updates, suspends and removes your account's people, and gives them account-wide roles. paths: /organisation-groups/{groupId}/access: get: tags: - Organisation groups summary: List who has access through an organisation group description: >- Needs permission user:read. Everybody with access through one of your account's organisation groups, with the role it gives them: the `Group` rows `GET /organisations/{organisationId}/access` shows for this group, the same shape, `via.type` always `Group`. Ordered by principal id. Paginated: `pageSize` (default 50, at most 100) and `paginationToken`; follow the token until it is absent. `createdBy` and `createdDate` say who gave the access and when, where the grant records it. 404 `group_not_found` when your account has no such group, or it is being deleted. 403 when you hold no access in your account. Once roles other than administrator can be given, seeing this list needs `user:read` across your account (403 `access_view_denied`), and API tokens are listed only to somebody who also holds `api-token:read`. operationId: GetOrganisationGroupAccess parameters: - name: groupId in: path required: true schema: type: string - name: pageSize in: query schema: type: string - name: paginationToken in: query schema: type: string responses: '200': description: OK content: application/json: schema: $ref: >- #/components/schemas/OrganisationAccessListResponseResponseBody '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' components: schemas: OrganisationAccessListResponseResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/OrganisationAccessListResponseContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false ObjectResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/ObjectContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false MessageWithTokenResponse: type: object properties: text: type: string token: type: string tokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false OrganisationAccessListResponseContentResponse: type: object properties: data: $ref: '#/components/schemas/OrganisationAccessListResponse' metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssue: type: object properties: field: type: string reason: type: string reasonToken: type: string reasonTokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false ObjectContentResponse: type: object properties: data: {} metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssueArgument: type: object properties: name: type: string value: {} additionalProperties: false OrganisationAccessListResponse: type: object properties: access: type: array items: $ref: '#/components/schemas/OrganisationAccessResponse' paginationToken: type: string description: >- Null on the last page. Also at `content.metadata.paginationToken`, which to prefer. nullable: true additionalProperties: false description: >- A page of who has access to an organisation: given it directly, then through each organisation group, then account-wide. ContentMetadataResponse: type: object properties: dateFormat: type: string dateTimeFormat: type: string paginationToken: type: string nullable: true additionalProperties: false OrganisationAccessResponse: type: object properties: principalId: type: string description: The person (`USER#…`) or API token (`M2M#…`). type: enum: - Person - ApiToken type: string description: '`Person` or `ApiToken`.' displayName: type: string description: >- The person's name, or their email address when no name is stored; the API token's name. roleId: type: string description: >- The role this way in gives them, such as `administrator` or `custom.hr-team`. roleName: type: string description: The role's name, as the account that gave it calls it. via: $ref: '#/components/schemas/OrganisationAccessViaResponse' accountOwner: type: boolean description: >- True for the account's owner, who is an administrator of everything the account has and cannot be removed here. nullable: true createdBy: type: string description: >- Who gave this access, as recorded: their email address, or their sign-in id when none was known. Null on access given before this was recorded, for an account's owner, and when another account gave it. nullable: true createdDate: type: string description: >- When this access was given (ISO 8601, UTC). Null on access given before this was recorded and for an account's owner. nullable: true additionalProperties: false description: >- One person or API token with access to an organisation, one way in. Somebody with two ways in is listed twice. OrganisationAccessViaResponse: type: object properties: type: enum: - Direct - Group - Account type: string description: >- `Direct`: given this organisation. `Group`: given an organisation group it is in. `Account`: given every organisation of the account that owns or manages it. groupId: type: string description: >- On `Group`, when the group is your account's: the organisation group. Another account's group is not identified. nullable: true groupName: type: string description: 'On `Group`, when the group is your account''s: its name.' nullable: true customerId: type: string description: >- On `Account`: the account. On `Group`: the account the group belongs to. nullable: true customerName: type: string description: The account's name. nullable: true additionalProperties: false description: How somebody has access to an organisation. securitySchemes: X-Auth-Token: type: apiKey description: FlowPayroll JWT (raw token, no Bearer prefix) name: X-Auth-Token in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.