> For the complete documentation index, see [llms.txt](https://developers.make.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers.make.com/api-documentation/api-reference/connections/access-list.md).

# Access list

The following endpoints let you view and manage the access list (entity ACL) of a connection — the users granted a role on it.

## List a connection's access list

> Returns the access list (entity ACL) of a connection — the principals granted a role on it.\
> \
> A caller holding the \`entity use\` permission on the connection sees every member; any other member of the connection's team sees only the Entity Admins. The connection must belong to the team in the path.\
> \
> Requires the locked connections feature to be enabled for the organization the team belongs to; otherwise the endpoint returns \`400\` (\`IM903\`).

```json
{"openapi":"3.0.0","info":{"title":"Web API v2 - Public ","version":"1.0.0"},"tags":[{"name":"Connections / Access list","description":"The following endpoints let you view and manage the access list (entity ACL) of a connection — the users granted a role on it."}],"servers":[{"url":"https://eu1.make.com/api/v2","description":"EU1 production zone"},{"url":"https://eu2.make.com/api/v2","description":"EU2 production zone"},{"url":"https://us1.make.com/api/v2","description":"US1 production zone"},{"url":"https://us2.make.com/api/v2","description":"US2 production zone"},{"url":"https://eu1.make.celonis.com/api/v2","description":"Celonis EU1 production zone"},{"url":"https://us1.make.celonis.com/api/v2","description":"Celonis US1 production zone"}],"security":[{"token":["connections:read"]}],"components":{"securitySchemes":{"token":{"type":"apiKey","name":"Authorization","in":"header","description":"Authorize the API call with your API token in the `Authorization` header with the value: `Token your-api-token`.\n\nIf you don't have an API token yet, please refer to the [\"Authentication\" section](/api-documentation/authentication) to learn how to create one.\n"}}},"paths":{"/teams/{teamId}/connections/{connectionId}/access-list":{"get":{"tags":["Connections / Access list"],"summary":"List a connection's access list","description":"Returns the access list (entity ACL) of a connection — the principals granted a role on it.\n\nA caller holding the `entity use` permission on the connection sees every member; any other member of the connection's team sees only the Entity Admins. The connection must belong to the team in the path.\n\nRequires the locked connections feature to be enabled for the organization the team belongs to; otherwise the endpoint returns `400` (`IM903`).","parameters":[{"name":"teamId","in":"path","required":true,"schema":{"type":"integer","minimum":1},"description":"The ID of the team that owns the connection."},{"name":"connectionId","in":"path","schema":{"type":"integer"},"required":true,"description":"The ID of the connection. You can get connection ID's of all your connections with the the [List connections](./get--connections.md) endpoint."}],"responses":{"200":{"description":"The access-list members visible to the caller.","content":{"application/json":{"schema":{"type":"object","properties":{"accessList":{"type":"array","description":"The access-list members visible to the caller.","items":{"type":"object","description":"A single access-list member — a principal with its entity-tier role and, for users, display fields.","required":["membershipType","membershipId","role"],"properties":{"membershipType":{"type":"string","enum":["user","group"],"description":"The kind of principal. Always `user` in the current version."},"membershipId":{"type":"integer","description":"The principal's id. For a `user` principal this is the user id."},"role":{"type":"string","enum":["entity:entity-admin","entity:entity-member"],"description":"The principal's entity-tier role on the connection or key."},"name":{"type":"string","nullable":true,"description":"Display name of the user. Null for non-user principals or an unknown user."},"email":{"type":"string","nullable":true,"description":"Email of the user. Null for non-user principals."}}}}}}}}},"400":{"description":"The locked connections feature is not enabled for the organization (`IM903`)."},"403":{"description":"The caller is not allowed to view this access list (`IM002`)."},"404":{"description":"The connection does not exist in the given team (`IM304`)."}}}}}}
```

## Add a member to a connection's access list

> Adds a user to a connection's access list (entity ACL) with a role.\
> \
> Requires \`entity manage\` on the connection, and the target user must already be a member of the connection's team. Returns \`409\` when the user is already on the access list and \`400\` when they are not a team member or the feature is disabled.

```json
{"openapi":"3.0.0","info":{"title":"Web API v2 - Public ","version":"1.0.0"},"tags":[{"name":"Connections / Access list","description":"The following endpoints let you view and manage the access list (entity ACL) of a connection — the users granted a role on it."}],"servers":[{"url":"https://eu1.make.com/api/v2","description":"EU1 production zone"},{"url":"https://eu2.make.com/api/v2","description":"EU2 production zone"},{"url":"https://us1.make.com/api/v2","description":"US1 production zone"},{"url":"https://us2.make.com/api/v2","description":"US2 production zone"},{"url":"https://eu1.make.celonis.com/api/v2","description":"Celonis EU1 production zone"},{"url":"https://us1.make.celonis.com/api/v2","description":"Celonis US1 production zone"}],"security":[{"token":["connections:write"]}],"components":{"securitySchemes":{"token":{"type":"apiKey","name":"Authorization","in":"header","description":"Authorize the API call with your API token in the `Authorization` header with the value: `Token your-api-token`.\n\nIf you don't have an API token yet, please refer to the [\"Authentication\" section](/api-documentation/authentication) to learn how to create one.\n"}}},"paths":{"/teams/{teamId}/connections/{connectionId}/access-list/users":{"post":{"tags":["Connections / Access list"],"summary":"Add a member to a connection's access list","description":"Adds a user to a connection's access list (entity ACL) with a role.\n\nRequires `entity manage` on the connection, and the target user must already be a member of the connection's team. Returns `409` when the user is already on the access list and `400` when they are not a team member or the feature is disabled.","parameters":[{"name":"teamId","in":"path","required":true,"schema":{"type":"integer","minimum":1},"description":"The ID of the team that owns the connection."},{"name":"connectionId","in":"path","schema":{"type":"integer"},"required":true,"description":"The ID of the connection. You can get connection ID's of all your connections with the the [List connections](./get--connections.md) endpoint."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["userId","role"],"properties":{"userId":{"type":"integer","minimum":1,"description":"The id of the user to add. Must already be a member of the entity's team."},"role":{"type":"string","enum":["entity:entity-admin","entity:entity-member"],"description":"The entity-tier role to grant the user on the connection or key."}}}}}},"responses":{"200":{"description":"The created access-list member.","content":{"application/json":{"schema":{"type":"object","properties":{"member":{"type":"object","description":"A single access-list member — a principal with its entity-tier role and, for users, display fields.","required":["membershipType","membershipId","role"],"properties":{"membershipType":{"type":"string","enum":["user","group"],"description":"The kind of principal. Always `user` in the current version."},"membershipId":{"type":"integer","description":"The principal's id. For a `user` principal this is the user id."},"role":{"type":"string","enum":["entity:entity-admin","entity:entity-member"],"description":"The principal's entity-tier role on the connection or key."},"name":{"type":"string","nullable":true,"description":"Display name of the user. Null for non-user principals or an unknown user."},"email":{"type":"string","nullable":true,"description":"Email of the user. Null for non-user principals."}}}}}}}},"400":{"description":"The locked connections and keys feature is disabled (`IM903`), or the user is not a team member / the role is invalid (`IM005`)."},"403":{"description":"The caller lacks `entity manage` on the connection (`IM002`)."},"404":{"description":"The connection does not exist in the given team (`IM304`)."},"409":{"description":"The user is already on the connection's access list (`SC409`)."}}}}}}
```

## Remove a member from a connection's access list

> Removes a user from a connection's access list.\
> \
> Requires \`entity manage\`. Returns \`404\` if the user is not on the access list, and \`409\` if removing them would leave the connection without an Entity Admin.

```json
{"openapi":"3.0.0","info":{"title":"Web API v2 - Public ","version":"1.0.0"},"tags":[{"name":"Connections / Access list","description":"The following endpoints let you view and manage the access list (entity ACL) of a connection — the users granted a role on it."}],"servers":[{"url":"https://eu1.make.com/api/v2","description":"EU1 production zone"},{"url":"https://eu2.make.com/api/v2","description":"EU2 production zone"},{"url":"https://us1.make.com/api/v2","description":"US1 production zone"},{"url":"https://us2.make.com/api/v2","description":"US2 production zone"},{"url":"https://eu1.make.celonis.com/api/v2","description":"Celonis EU1 production zone"},{"url":"https://us1.make.celonis.com/api/v2","description":"Celonis US1 production zone"}],"security":[{"token":["connections:write"]}],"components":{"securitySchemes":{"token":{"type":"apiKey","name":"Authorization","in":"header","description":"Authorize the API call with your API token in the `Authorization` header with the value: `Token your-api-token`.\n\nIf you don't have an API token yet, please refer to the [\"Authentication\" section](/api-documentation/authentication) to learn how to create one.\n"}}},"paths":{"/teams/{teamId}/connections/{connectionId}/access-list/users/{userId}":{"delete":{"tags":["Connections / Access list"],"summary":"Remove a member from a connection's access list","description":"Removes a user from a connection's access list.\n\nRequires `entity manage`. Returns `404` if the user is not on the access list, and `409` if removing them would leave the connection without an Entity Admin.","parameters":[{"name":"teamId","in":"path","required":true,"schema":{"type":"integer","minimum":1},"description":"The ID of the team that owns the connection."},{"name":"connectionId","in":"path","schema":{"type":"integer"},"required":true,"description":"The ID of the connection. You can get connection ID's of all your connections with the the [List connections](./get--connections.md) endpoint."},{"name":"userId","in":"path","required":true,"schema":{"type":"integer","minimum":1},"description":"The ID of the user to remove."}],"responses":{"204":{"description":"The user was removed from the access list."},"400":{"description":"The locked connections and keys feature is disabled (`IM903`)."},"403":{"description":"The caller lacks `entity manage` on the connection (`IM002`)."},"404":{"description":"The connection is not in the team, or the user is not on its access list (`IM304` / `SC404`)."},"409":{"description":"Removing the user would leave the connection without an Entity Admin (`SC409`)."}}}}}}
```

## Change a connection access-list member's role

> Changes the entity-tier role of a user already on a connection's access list.\
> \
> Requires \`entity manage\`. Returns \`404\` if the user is not on the access list, and \`409\` if the change would demote the connection's last Entity Admin.

```json
{"openapi":"3.0.0","info":{"title":"Web API v2 - Public ","version":"1.0.0"},"tags":[{"name":"Connections / Access list","description":"The following endpoints let you view and manage the access list (entity ACL) of a connection — the users granted a role on it."}],"servers":[{"url":"https://eu1.make.com/api/v2","description":"EU1 production zone"},{"url":"https://eu2.make.com/api/v2","description":"EU2 production zone"},{"url":"https://us1.make.com/api/v2","description":"US1 production zone"},{"url":"https://us2.make.com/api/v2","description":"US2 production zone"},{"url":"https://eu1.make.celonis.com/api/v2","description":"Celonis EU1 production zone"},{"url":"https://us1.make.celonis.com/api/v2","description":"Celonis US1 production zone"}],"security":[{"token":["connections:write"]}],"components":{"securitySchemes":{"token":{"type":"apiKey","name":"Authorization","in":"header","description":"Authorize the API call with your API token in the `Authorization` header with the value: `Token your-api-token`.\n\nIf you don't have an API token yet, please refer to the [\"Authentication\" section](/api-documentation/authentication) to learn how to create one.\n"}}},"paths":{"/teams/{teamId}/connections/{connectionId}/access-list/users/{userId}":{"patch":{"tags":["Connections / Access list"],"summary":"Change a connection access-list member's role","description":"Changes the entity-tier role of a user already on a connection's access list.\n\nRequires `entity manage`. Returns `404` if the user is not on the access list, and `409` if the change would demote the connection's last Entity Admin.","parameters":[{"name":"teamId","in":"path","required":true,"schema":{"type":"integer","minimum":1},"description":"The ID of the team that owns the connection."},{"name":"connectionId","in":"path","schema":{"type":"integer"},"required":true,"description":"The ID of the connection. You can get connection ID's of all your connections with the the [List connections](./get--connections.md) endpoint."},{"name":"userId","in":"path","required":true,"schema":{"type":"integer","minimum":1},"description":"The ID of the user whose role to change."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["role"],"properties":{"role":{"type":"string","enum":["entity:entity-admin","entity:entity-member"],"description":"The entity-tier role to set for the user on the connection or key."}}}}}},"responses":{"200":{"description":"The updated access-list member.","content":{"application/json":{"schema":{"type":"object","properties":{"member":{"type":"object","description":"A single access-list member — a principal with its entity-tier role and, for users, display fields.","required":["membershipType","membershipId","role"],"properties":{"membershipType":{"type":"string","enum":["user","group"],"description":"The kind of principal. Always `user` in the current version."},"membershipId":{"type":"integer","description":"The principal's id. For a `user` principal this is the user id."},"role":{"type":"string","enum":["entity:entity-admin","entity:entity-member"],"description":"The principal's entity-tier role on the connection or key."},"name":{"type":"string","nullable":true,"description":"Display name of the user. Null for non-user principals or an unknown user."},"email":{"type":"string","nullable":true,"description":"Email of the user. Null for non-user principals."}}}}}}}},"400":{"description":"The locked connections and keys feature is disabled (`IM903`), or the role is invalid (`IM005`)."},"403":{"description":"The caller lacks `entity manage` on the connection (`IM002`)."},"404":{"description":"The connection is not in the team, or the user is not on its access list (`IM304` / `SC404`)."},"409":{"description":"The change would leave the connection without an Entity Admin (`SC409`)."}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developers.make.com/api-documentation/api-reference/connections/access-list.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.