Get Company Access Control Rules

GET/companies/{id}/access-control-rules

Agency-scoped keys

This endpoint is not available for agency-scoped API keys.

Summary

Returns a paginated list of access control rules for a company within the API key scope. Requires read:companies.

Company-level rules only; excludes project, agency and user overrides. This is configuration, not a user’s effective permissions.

URL Parameters

Name	Type	Required	Description
id	string	Yes	Company ObjectId or reference

Query Parameters

Name	Type	Required	Description
page	integer	No	Page number (default 1)
limit	integer	No	Records per page (default 50, max 200)
query	string	No	Case-insensitive search against feature, key, label and description
sortBy	string	No	createdAt, updatedAt, feature, key, label; default feature
sortOrder	string	No	asc or desc; default asc
fields	string	No	Comma-separated response fields or nested dot paths

Request Example

cURL

curl -X GET 'https://api.requidex.com/api/open/v1/companies/{id}/access-control-rules' \
  -H 'Authorization: Bearer <API_KEY>' \
  -H 'Accept: application/json'

JavaScript

const response = await fetch(
  "https://api.requidex.com/api/open/v1/companies/{id}/access-control-rules",
  {
    method: "GET",
    headers: {
      Authorization: "Bearer <API_KEY>",
      Accept: "application/json",
    },
  },
);

const json = await response.json();

Python

import requests

response = requests.request(
    'GET',
    'https://api.requidex.com/api/open/v1/companies/{id}/access-control-rules',
    headers={
        'Authorization': 'Bearer <API_KEY>',
        'Accept': 'application/json',
    },
    timeout=30,
)

print(response.json())

Go

package main

import (
  "fmt"
  "io"
  "net/http"
)

func main() {
  req, _ := http.NewRequest("GET", "https://api.requidex.com/api/open/v1/companies/{id}/access-control-rules", nil)
  req.Header.Set("Authorization", "Bearer <API_KEY>")
  req.Header.Set("Accept", "application/json")

  client := &http.Client{}
  resp, err := client.Do(req)
  if err != nil {
    panic(err)
  }
  defer resp.Body.Close()

  payload, _ := io.ReadAll(resp.Body)
  fmt.Println(string(payload))
}

Response Fields

Each item in data contains the following fields. meta contains page, limit and total; the total counts matching records before pagination.

Field	Type	Description
id	string	Access control rule ObjectId
company	string	Company ObjectId
feature	string	Allowed values: Workers, Rates, Billing, Agencies
key	string	Configuration key
label	string	Rule label
description	string	Rule description
items	string[]	Restricted items; agency ObjectIds for the Agencies feature
subItems	string[]	Restricted sub-items
restrictedActions	string[]	Restricted agency actions
restrictionBasis	string	Allowed values: role, user
restrictedRoles	string[]	Base role names or companyRole:<ObjectId> custom role tokens
exemptUsers	string[]	Exempt user ObjectIds
restrictedUsers	string[]	Restricted user ObjectIds
createdAt	string	createdAt
updatedAt	string	updatedAt

Response Example (200)

{
  "success": true,
  "data": [
    {
      "id": "507f1f77bcf86cd799439019",
      "company": "507f1f77bcf86cd799439011",
      "feature": "Rates",
      "key": "RATES",
      "label": "",
      "description": "Restrict rate visibility",
      "items": [],
      "subItems": [],
      "restrictedActions": [],
      "restrictionBasis": "role",
      "restrictedRoles": ["projectRequestor"],
      "exemptUsers": [],
      "restrictedUsers": [],
      "createdAt": "2026-01-10T12:00:00.000Z",
      "updatedAt": "2026-01-10T12:00:00.000Z"
    }
  ],
  "meta": {
    "page": 1,
    "limit": 50,
    "total": 1
  }
}

MCP Tool

The MCP server exposes this operation as open_api_list_company_access_control_rules with inputs id, page, limit, query, sortBy, sortOrder and fields.

Errors

HTTP Status	Description
400	Invalid filters or parameters
401	Missing, invalid, revoked, or expired API key
403	Missing scope, IP restriction, or agency-scoped key
404	Company not found within the key scope
405	Method not allowed on Open API routes
429	Rate limit exceeded
500	Failed to fetch company access control rules