Get-ZrGrant
Shows the effective role, scope, and permission grants a subject holds — the combined view of what an identity is actually permitted to do.
Syntax
Get-ZrGrant
-Subject <string>
[-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
Description
Get-ZrGrant queries the first available manager and emits a SecurityEffectiveGrant object for each effective grant a subject holds, resolving the combined role, scope, and permissions in force. Use it to audit exactly what an identity can do before granting or revoking access. Requires a connected manager (an active workspace or explicit -Managers) and an admin token. See Authorization & RBAC for how grants resolve.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
-Subject | string | Yes | The subject whose effective grants are resolved and returned. Position 0. |
-Managers | string[] | No | Management Service endpoints to target; when omitted the active workspace's managers are used. |
-Port | int | No | Management Service port for bare-host managers. Default 7801. |
-Token | string | No | Admin bearer token for authenticated control-plane calls. |
-TimeoutSec | int | No | Per-request timeout in seconds. Default 30. |
Examples
Show the effective grants (role, scope, permissions) currently held by app1.
Get-ZrGrant -Subject app1