Querying an ACL of a Bucket

Last Updated At: 2025-10-21 09:10:00

Description

The GET Bucket acl API is used to query the access control list (ACL) of a bucket.

Request

Request Example

GET /?acl HTTP/1.1
Host: <BucketName-APPID>.<Endpoint>
Date: GMT Date
Authorization: Auth String

Note:

Authorization: Auth String (See Request Signature for details.)

Request Header

Common Headers

This request uses common request headers. For details, see Public Request Headers.

Non-common Headers

This request has no special request header information.

Request Body

The request does not have a request body.

Response

Response Headers

Common Response Headers

This response uses common response headers. For details, see Common Response Headers.

Special Response Headers

There are no special response headers for this response operation.

Response Body

The response body is returned as application/xml. An example including the complete node data is shown below:

<AccessControlPolicy>
  <Owner>
    <ID>qcs::cam::uin/1250000000:uin/1250000000</ID>
    <DisplayName>qcs::cam::uin/1250000000:uin/1250000000</DisplayName>
  </Owner>
  <AccessControlList>
    <Grant>
      <Grantee xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"CanonicalUser\">
        <ID>qcs::cam::uin/1250000000:uin/1250000000</ID>
        <DisplayName>qcs::cam::uin/1250000000:uin/1250000000</DisplayName>
      </Grantee>
      <Permission>FULL_CONTROL</Permission>
    </Grant>
  </AccessControlList>
</AccessControlPolicy>

The data are as follows:

Node Name (Keyword) Parent Node Description Type
AccessControlPolicy No Container for storing the result of the GET Bucket acl Container

Content of AccessControlPolicy:

Node Name (Keyword) Parent Node Description Type
Owner AccessControlPolicy Information of the object owner Container
AccessControlList AccessControlPolicy Information about the grantee and permissions Container

Content of Owner:

Node Name (Keyword) Parent Node Description Type
ID AccessControlPolicy.Owner ID of the Bucket Owner,
formatted as qcs::cam::uin/ :uin/. This is the root account, so and have the same value.
String
DisplayName AccessControlPolicy.Owner Name of the Bucket Owner String

Content of AccessControlList:

Node Name (Keyword) Parent Node Description Type
Grant AccessControlPolicy.AccessControlList Permission information for a single bucket. An AccessControlList can have 100 grants. Container

Contents of Grant:

Node Name (Keyword) Parent Node Description Type
Grantee AccessControlPolicy.AccessControlList.Grant Grantee Information. If type is RootAccount or CanonicalUser, the account in the ID is the root account. Container
Permission AccessControlPolicy.AccessControlList.Grant Specifies the permissions granted to the grantee, with enum values: READ, FULL_CONTROL. String

Contents of Grantee:

Node Name (Keyword) Parent Node Description Type
ID AccessControlPolicy.Owner ID of the user, which is the root account, formatted as qcs::cam::uin/:uin/ or qcs::cam::anyone:anyone (referring to all users). String
DisplayName AccessControlPolicy.Owner User name String

Error Code

This request returns common error responses and error codes. For more information, see Error Codes.

Practical Case

Request

GET /?acl HTTP/1.1
Host: <BucketName-APPID>.<Endpoint>
Date: Fri, 10 Mar 2016 09:45:46 GMT
Authorization: q-sign-algorithm=sha1&q-ak=AKIDxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&q-sign-time=1484213027;32557109027&q-key-time=1484213027;32557109027&q-header-list=host&q-url-param-list=acl&q-signature=dcc1eb2022b79cb2a780bf062d3a40e120b40652

Response

HTTP/1.1 200 OK
Content-Type: application/xml
Content-Length: 266
Connection: keep-alive
Date: Fri, 10 Mar 2016 09:45:46 GMT
x-cos-request-id: NTg3NzRiMjVfYmRjMzVfMTViMl82ZGZmNw==
<AccessControlPolicy>
  <Owner>
    <ID>qcs::cam::uin/1250000000:uin/1250000000</ID>
    <DisplayName>qcs::cam::uin/1250000000:uin/1250000000</DisplayName>
  </Owner>
  <AccessControlList>
    <Grant>
      <Grantee xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"CanonicalUser\">
        <ID>qcs::cam::uin/1250000000:uin/1250000000</ID>
        <DisplayName>qcs::cam::uin/1250000000:uin/1250000000</DisplayName>
      </Grantee>
      <Permission>FULL_CONTROL</Permission>
    </Grant>
  </AccessControlList>
</AccessControlPolicy>