---
type: api
title: Get an agent's access control list
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-get-agent-builder-agents-id-access-control
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-get-agent-builder-agents-id-access-control
products:
  - Kibana
---

# Get an agent's access control list

Availability:

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/agent_builder/agents/{id}/access_control`
- `GET` `/s/{space_id}/api/agent_builder/agents/{id}/access_control`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/authentication#apikeyauth)

#### Path Parameters

- `id` (string)
  The unique identifier of the agent whose access control to retrieve.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get the access control for a specific agent. Callers without permission to manage access control receive `permissions.update_access_control: false` and only their own entry. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.

## Responses

#### `200`

Indicates a successful response

#### `404`

Not Found — no agent with this ID is visible to the caller. Matches the existing `agentNotFound` shape, so unprivileged callers cannot probe for hidden agents.

## Code Examples

#### Console

```console
GET kbn://api/agent_builder/agents/{id}/access_control
```

#### curl

```curl
curl \
  -X GET "${KIBANA_URL}/api/agent_builder/agents/{id}/access_control" \
  -H "Authorization: ApiKey ${API_KEY}"
```

## Response Examples

#### Get agent access control masked response

Example response for a caller without manage permission — only the caller's own entry is returned.

```json
{
  "access_control": {
    "access_mode": "private",
    "entries": [
      {
        "added_at": "2026-02-11T10:15:00.000Z",
        "id": "u_bob_profile_uid",
        "role": "user",
        "type": "user"
      }
    ]
  },
  "permissions": {
    "update_access_control": false
  }
}
```

#### Get agent access control response

Example response for a caller who can manage access control — the agent has two grantees keyed on their Kibana user profile uid.

```json
{
  "access_control": {
    "access_mode": "private",
    "entries": [
      {
        "added_at": "2026-02-11T10:15:00.000Z",
        "id": "u_alice_profile_uid",
        "role": "editor",
        "type": "user"
      },
      {
        "added_at": "2026-02-11T10:15:00.000Z",
        "id": "u_bob_profile_uid",
        "role": "user",
        "type": "user"
      }
    ]
  },
  "permissions": {
    "update_access_control": true
  }
}
```

#### Agent not found response

```json
{
  "attributes": {
    "trace_id": "8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e"
  },
  "error": "Not Found",
  "message": "Agent custom-agent-id not found",
  "statusCode": 404
}
```