> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developer-test.atomicwork.com/llms.txt.
> For full documentation content, see https://developer-test.atomicwork.com/llms-full.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer-test.atomicwork.com/_mcp/server.

# List grants with filters

POST https://{tenant}.atomicwork.com/api/v1/iga/grants/list
Content-Type: application/json

Search and list identity grants with advanced filtering. This is the primary query endpoint for building compliance dashboards, access reviews, and audit reports.

Supports filtering by user, app, entitlement, status, and date ranges via request body filters. Combine multiple filters for precise queries — for example, find all active grants for a specific app that were created in the last 90 days.

Use query parameters for quick filtering (`app_id`, `policy_id`, `sort_order`) or the request body for structured filter objects with operators like `IS_ANY_OF`, `IS_BETWEEN`, etc.

**Pagination:** Returns paginated results with `page`, `per_page` (default 25), and `next_page_token` for cursor-based pagination. Pass `next_page_token` from the previous response to fetch the next page.

**Response** includes full grant details: user info, entitlement, app, policy, provisioning status, revocation status, and timestamps.

### Filtering

The request body is an **array of filter objects**. Send an empty array (`[]`) to retrieve all records.

Each filter object has the following fields:

| Field | Type | Description |
|---|---|---|
| `attribute` | string | The field to filter on (see Supported attributes below) |
| `operator` | string | Comparison operator (see Available operators below) |
| `values` | array | One or more `{ "value": <scalar> }` objects |

**Supported attributes**

| Attribute | Typical operator | Description |
|---|---|---|
| `status` | `IS_ANY_OF` | Grant status **bucket** (not the raw status). Accepted values: `ACTIVE` (includes GRANTED and EXTENDED grants), `INACTIVE` (includes REVOKED and EXPIRED grants), `REVOKED` (revoked only). See the Status Reference table below. |
| `user` | `IS_ANY_OF` | Numeric user ID of the grant recipient (the `id` field from `GET /api/v1/users`). Pass one or more user IDs to filter grants belonging to specific people. |
| `app` | `IS_ANY_OF` | Application ID — the identity resource app the entitlement belongs to (the `id` field from `GET /api/v1/iga/apps`). Filters grants to entitlements under a specific app. |
| `entitlement` | `IS_ANY_OF` | Entitlement ID — the specific entitlement (group, role, license, etc.) the grant was issued for. Use `GET /api/v1/iga/entitlements` to discover IDs. |
| `entitlement_value` | `IS_ANY_OF` | Entitlement value string — filters by the human-readable entitlement value (e.g. the group name or role name) rather than the numeric ID. |
| `granted_at` | `IS_BETWEEN` | Grant creation timestamp. Requires exactly **two** values: `[start, end]` (both inclusive). Accepts ISO 8601 format (`2024-01-01T00:00:00Z`). |
| `expires_at` | `IS_BETWEEN` | Grant expiration timestamp. Same format as `granted_at`. Use this to find grants expiring within a specific window. |
| `last_login_at` | `IS_BETWEEN` | Last login timestamp for the grant recipient. Same format as `granted_at`. Useful for identifying unused grants where the user hasn't logged in recently. |

**Available operators**

| Operator | Meaning |
|---|---|
| `EQUALS` | Exact match |
| `NOT_EQUALS` | Exclude exact match |
| `IN` / `IS_ANY_OF` | Match any value in the list |
| `IS_NOT_ANY_OF` | Exclude all listed values |
| `IS_BETWEEN` | Inclusive range — pass exactly two values: `[start, end]` |
| `IS_ON_OR_BEFORE` / `IS_ON_OR_AFTER` | Date/time boundary comparisons |
| `CONTAINS` / `TEXT_CONTAINS` | Substring or set membership |
| `IS_NULL` / `IS_NOT_NULL` | Null checks — `values` array can be empty |
| `STARTS_WITH` / `ENDS_WITH` | String prefix/suffix match |


**Status Reference**

Grants have a raw status and a **status bucket** used for filtering:

| Filter value | Raw statuses included | Description |
|---|---|---|
| `ACTIVE` | GRANTED, EXTENDED | Currently valid grants |
| `INACTIVE` | REVOKED, EXPIRED | No longer valid grants |
| `REVOKED` | REVOKED | Only manually or system-revoked grants |

**Grant types** (returned in responses, not used as filter attributes)

| Type | Description |
|---|---|
| `BIRTHRIGHT` | Automatically assigned based on user attributes (department, role, etc.) |
| `PREAPPROVED` | Pre-approved via an access policy — no approval workflow required |
| `APPROVED` | Granted after completing an approval workflow |

**Entitlement types** (filter via the entitlements endpoint, not on grants directly)

| Type | Description |
|---|---|
| `GROUP` | Identity provider group membership (e.g. Azure AD group, Okta group) |
| `ROLE` | Application role assignment |
| `LICENSE` | Software license entitlement |
| `REPO` | Repository access |
| `OTHER` | Custom entitlement type |

**Provisioning providers** (shown in grant responses)

| Provider | Description |
|---|---|
| `OKTA` | Okta identity provider |
| `AZURE_AD` | Microsoft Entra ID (Azure AD) |
| `JUMPCLOUD` | JumpCloud directory |
| `GOOGLE_WORKSPACE` | Google Workspace |
| `MS_INTUNE` | Microsoft Intune device management |
| `MANUAL` | Manual provisioning (service request created for IT team) |


**Example**

```json
[
  {
    "attribute": "status",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": "ACTIVE"
      }
    ]
  },
  {
    "attribute": "app",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 42
      }
    ]
  },
  {
    "attribute": "granted_at",
    "operator": "IS_BETWEEN",
    "values": [
      {
        "value": "2024-01-01T00:00:00Z"
      },
      {
        "value": "2024-12-31T23:59:59Z"
      }
    ]
  },
  {
    "attribute": "user",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 123
      },
      {
        "value": 456
      }
    ]
  }
]
```


Reference: https://developer-test.atomicwork.com/atomicwork-public-api/access-management/postapi-v-1-iga-grants-list

## OpenAPI Specification

```yaml
openapi: 3.1.0
info:
  title: collection
  version: 1.0.0
paths:
  /api/v1/iga/grants/list:
    post:
      operationId: postapi-v-1-iga-grants-list
      summary: List grants with filters
      description: >
        Search and list identity grants with advanced filtering. This is the
        primary query endpoint for building compliance dashboards, access
        reviews, and audit reports.


        Supports filtering by user, app, entitlement, status, and date ranges
        via request body filters. Combine multiple filters for precise queries —
        for example, find all active grants for a specific app that were created
        in the last 90 days.


        Use query parameters for quick filtering (`app_id`, `policy_id`,
        `sort_order`) or the request body for structured filter objects with
        operators like `IS_ANY_OF`, `IS_BETWEEN`, etc.


        **Pagination:** Returns paginated results with `page`, `per_page`
        (default 25), and `next_page_token` for cursor-based pagination. Pass
        `next_page_token` from the previous response to fetch the next page.


        **Response** includes full grant details: user info, entitlement, app,
        policy, provisioning status, revocation status, and timestamps.


        ### Filtering


        The request body is an **array of filter objects**. Send an empty array
        (`[]`) to retrieve all records.


        Each filter object has the following fields:


        | Field | Type | Description |

        |---|---|---|

        | `attribute` | string | The field to filter on (see Supported
        attributes below) |

        | `operator` | string | Comparison operator (see Available operators
        below) |

        | `values` | array | One or more `{ "value": <scalar> }` objects |


        **Supported attributes**


        | Attribute | Typical operator | Description |

        |---|---|---|

        | `status` | `IS_ANY_OF` | Grant status **bucket** (not the raw status).
        Accepted values: `ACTIVE` (includes GRANTED and EXTENDED grants),
        `INACTIVE` (includes REVOKED and EXPIRED grants), `REVOKED` (revoked
        only). See the Status Reference table below. |

        | `user` | `IS_ANY_OF` | Numeric user ID of the grant recipient (the
        `id` field from `GET /api/v1/users`). Pass one or more user IDs to
        filter grants belonging to specific people. |

        | `app` | `IS_ANY_OF` | Application ID — the identity resource app the
        entitlement belongs to (the `id` field from `GET /api/v1/iga/apps`).
        Filters grants to entitlements under a specific app. |

        | `entitlement` | `IS_ANY_OF` | Entitlement ID — the specific
        entitlement (group, role, license, etc.) the grant was issued for. Use
        `GET /api/v1/iga/entitlements` to discover IDs. |

        | `entitlement_value` | `IS_ANY_OF` | Entitlement value string — filters
        by the human-readable entitlement value (e.g. the group name or role
        name) rather than the numeric ID. |

        | `granted_at` | `IS_BETWEEN` | Grant creation timestamp. Requires
        exactly **two** values: `[start, end]` (both inclusive). Accepts ISO
        8601 format (`2024-01-01T00:00:00Z`). |

        | `expires_at` | `IS_BETWEEN` | Grant expiration timestamp. Same format
        as `granted_at`. Use this to find grants expiring within a specific
        window. |

        | `last_login_at` | `IS_BETWEEN` | Last login timestamp for the grant
        recipient. Same format as `granted_at`. Useful for identifying unused
        grants where the user hasn't logged in recently. |


        **Available operators**


        | Operator | Meaning |

        |---|---|

        | `EQUALS` | Exact match |

        | `NOT_EQUALS` | Exclude exact match |

        | `IN` / `IS_ANY_OF` | Match any value in the list |

        | `IS_NOT_ANY_OF` | Exclude all listed values |

        | `IS_BETWEEN` | Inclusive range — pass exactly two values: `[start,
        end]` |

        | `IS_ON_OR_BEFORE` / `IS_ON_OR_AFTER` | Date/time boundary comparisons
        |

        | `CONTAINS` / `TEXT_CONTAINS` | Substring or set membership |

        | `IS_NULL` / `IS_NOT_NULL` | Null checks — `values` array can be empty
        |

        | `STARTS_WITH` / `ENDS_WITH` | String prefix/suffix match |



        **Status Reference**


        Grants have a raw status and a **status bucket** used for filtering:


        | Filter value | Raw statuses included | Description |

        |---|---|---|

        | `ACTIVE` | GRANTED, EXTENDED | Currently valid grants |

        | `INACTIVE` | REVOKED, EXPIRED | No longer valid grants |

        | `REVOKED` | REVOKED | Only manually or system-revoked grants |


        **Grant types** (returned in responses, not used as filter attributes)


        | Type | Description |

        |---|---|

        | `BIRTHRIGHT` | Automatically assigned based on user attributes
        (department, role, etc.) |

        | `PREAPPROVED` | Pre-approved via an access policy — no approval
        workflow required |

        | `APPROVED` | Granted after completing an approval workflow |


        **Entitlement types** (filter via the entitlements endpoint, not on
        grants directly)


        | Type | Description |

        |---|---|

        | `GROUP` | Identity provider group membership (e.g. Azure AD group,
        Okta group) |

        | `ROLE` | Application role assignment |

        | `LICENSE` | Software license entitlement |

        | `REPO` | Repository access |

        | `OTHER` | Custom entitlement type |


        **Provisioning providers** (shown in grant responses)


        | Provider | Description |

        |---|---|

        | `OKTA` | Okta identity provider |

        | `AZURE_AD` | Microsoft Entra ID (Azure AD) |

        | `JUMPCLOUD` | JumpCloud directory |

        | `GOOGLE_WORKSPACE` | Google Workspace |

        | `MS_INTUNE` | Microsoft Intune device management |

        | `MANUAL` | Manual provisioning (service request created for IT team) |



        **Example**


        ```json

        [
          {
            "attribute": "status",
            "operator": "IS_ANY_OF",
            "values": [
              {
                "value": "ACTIVE"
              }
            ]
          },
          {
            "attribute": "app",
            "operator": "IS_ANY_OF",
            "values": [
              {
                "value": 42
              }
            ]
          },
          {
            "attribute": "granted_at",
            "operator": "IS_BETWEEN",
            "values": [
              {
                "value": "2024-01-01T00:00:00Z"
              },
              {
                "value": "2024-12-31T23:59:59Z"
              }
            ]
          },
          {
            "attribute": "user",
            "operator": "IS_ANY_OF",
            "values": [
              {
                "value": 123
              },
              {
                "value": 456
              }
            ]
          }
        ]

        ```
      tags:
        - subpackage_accessManagement
      parameters:
        - name: search_key
          in: query
          description: Free-text search across grant, entitlement, and user fields.
          required: false
          schema:
            type: string
        - name: sort_order
          in: query
          description: >-
            Sort order for results. Common values: GRANTED_AT_DESC (newest
            first), GRANTED_AT_ASC (oldest first), EXPIRES_AT_ASC (expiring
            soonest first).
          required: false
          schema:
            $ref: '#/components/schemas/ApiV1IgaGrantsListPostParametersSortOrder'
        - name: policy_id
          in: query
          description: Filter grants linked to a specific access policy by its UUID key.
          required: false
          schema:
            type: string
        - name: app_id
          in: query
          description: >-
            Filter grants to entitlements under a specific app (from GET
            /iga/apps).
          required: false
          schema:
            type: integer
            format: int64
        - name: page
          in: query
          description: Page number (1-indexed). Default 1.
          required: false
          schema:
            type: integer
            default: 1
        - name: per_page
          in: query
          description: Results per page (default 25, max 100).
          required: false
          schema:
            type: integer
            default: 25
        - name: next_page_token
          in: query
          description: >-
            Token from previous response to fetch the next page. When provided,
            takes priority over page and per_page parameters.
          required: false
          schema:
            type: string
        - name: ids
          in: query
          description: >-
            Comma-separated list of grant IDs to filter by. When provided,
            returns only grants matching these IDs.
          required: false
          schema:
            type: string
        - name: X-Api-Key
          in: header
          required: true
          schema:
            type: string
        - name: X-Workspace-Id
          in: header
          required: false
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/Access
                  Management_postapi_v1_iga_grants_list_Response_200
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: >-
                  #/components/schemas/ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItems
servers:
  - url: https://{tenant}.atomicwork.com
components:
  schemas:
    ApiV1IgaGrantsListPostParametersSortOrder:
      type: string
      enum:
        - CREATED_AT_ASC
        - CREATED_AT_DESC
        - UPDATED_AT_ASC
        - UPDATED_AT_DESC
        - NAME_ASC
        - NAME_DESC
        - PUBLISHED_DESC
        - UNPUBLISHED_DESC
        - EXPIRES_AT_ASC
        - EXPIRES_AT_DESC
        - GRANTED_AT_ASC
        - GRANTED_AT_DESC
      title: ApiV1IgaGrantsListPostParametersSortOrder
    ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsOperator:
      type: string
      enum:
        - EQUALS
        - NOT_EQUALS
        - CONTAINS
        - NOT_CONTAINS
        - IN
        - NOT_IN
        - GREATER_THAN
        - LESS_THAN
        - GREATER_THAN_EQUALS
        - LESS_THAN_EQUALS
        - IS_BETWEEN
        - IS_NULL
        - IS_NOT_NULL
        - STARTS_WITH
        - ENDS_WITH
        - TEXT_CONTAINS
        - TEXT_DOES_NOT_CONTAINS
        - IS_ANY_OF
        - IS_NOT_ANY_OF
        - IS_EXACTLY
        - IS_ON_OR_BEFORE
        - IS_ON_OR_AFTER
        - IS_WITHIN
      title: >-
        ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsOperator
    ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItemsValue:
      type: object
      properties: {}
      title: >-
        ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItemsValue
    ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItems:
      type: object
      properties:
        value:
          $ref: >-
            #/components/schemas/ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItemsValue
        nested_filter:
          description: Any type
      title: >-
        ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItems
    ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItems:
      type: object
      properties:
        attribute:
          type: string
        operator:
          $ref: >-
            #/components/schemas/ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsOperator
        values:
          type: array
          items:
            $ref: >-
              #/components/schemas/ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItems
      title: ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItems
    Access Management_postapi_v1_iga_grants_list_Response_200:
      type: object
      properties: {}
      description: Empty response body
      title: Access Management_postapi_v1_iga_grants_list_Response_200
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-Api-Key

```

## SDK Code Examples

```python
import requests

url = "https://{tenant}.atomicwork.com/api/v1/iga/grants/list"

querystring = {"sort_order":"CREATED_AT_ASC"}

payload = [
    {
        "attribute": "status",
        "operator": "IS_ANY_OF",
        "values": [{ "value": "ACTIVE" }]
    },
    {
        "attribute": "app",
        "operator": "IS_ANY_OF",
        "values": [{ "value": 42 }]
    },
    {
        "attribute": "granted_at",
        "operator": "IS_BETWEEN",
        "values": [{ "value": "2024-01-01T00:00:00Z" }, { "value": "2024-12-31T23:59:59Z" }]
    },
    {
        "attribute": "user",
        "operator": "IS_ANY_OF",
        "values": [{ "value": 123 }, { "value": 456 }]
    }
]
headers = {
    "X-Workspace-Id": "{{workspace_id}}",
    "X-Api-Key": "<apiKey>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers, params=querystring)

print(response.json())
```

```javascript
const url = 'https://{tenant}.atomicwork.com/api/v1/iga/grants/list?sort_order=CREATED_AT_ASC';
const options = {
  method: 'POST',
  headers: {
    'X-Workspace-Id': '{{workspace_id}}',
    'X-Api-Key': '<apiKey>',
    'Content-Type': 'application/json'
  },
  body: '[{"attribute":"status","operator":"IS_ANY_OF","values":[{"value":"ACTIVE"}]},{"attribute":"app","operator":"IS_ANY_OF","values":[{"value":42}]},{"attribute":"granted_at","operator":"IS_BETWEEN","values":[{"value":"2024-01-01T00:00:00Z"},{"value":"2024-12-31T23:59:59Z"}]},{"attribute":"user","operator":"IS_ANY_OF","values":[{"value":123},{"value":456}]}]'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://{tenant}.atomicwork.com/api/v1/iga/grants/list?sort_order=CREATED_AT_ASC"

	payload := strings.NewReader("[\n  {\n    \"attribute\": \"status\",\n    \"operator\": \"IS_ANY_OF\",\n    \"values\": [\n      {\n        \"value\": \"ACTIVE\"\n      }\n    ]\n  },\n  {\n    \"attribute\": \"app\",\n    \"operator\": \"IS_ANY_OF\",\n    \"values\": [\n      {\n        \"value\": 42\n      }\n    ]\n  },\n  {\n    \"attribute\": \"granted_at\",\n    \"operator\": \"IS_BETWEEN\",\n    \"values\": [\n      {\n        \"value\": \"2024-01-01T00:00:00Z\"\n      },\n      {\n        \"value\": \"2024-12-31T23:59:59Z\"\n      }\n    ]\n  },\n  {\n    \"attribute\": \"user\",\n    \"operator\": \"IS_ANY_OF\",\n    \"values\": [\n      {\n        \"value\": 123\n      },\n      {\n        \"value\": 456\n      }\n    ]\n  }\n]")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Workspace-Id", "{{workspace_id}}")
	req.Header.Add("X-Api-Key", "<apiKey>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://{tenant}.atomicwork.com/api/v1/iga/grants/list?sort_order=CREATED_AT_ASC")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Workspace-Id"] = '{{workspace_id}}'
request["X-Api-Key"] = '<apiKey>'
request["Content-Type"] = 'application/json'
request.body = "[\n  {\n    \"attribute\": \"status\",\n    \"operator\": \"IS_ANY_OF\",\n    \"values\": [\n      {\n        \"value\": \"ACTIVE\"\n      }\n    ]\n  },\n  {\n    \"attribute\": \"app\",\n    \"operator\": \"IS_ANY_OF\",\n    \"values\": [\n      {\n        \"value\": 42\n      }\n    ]\n  },\n  {\n    \"attribute\": \"granted_at\",\n    \"operator\": \"IS_BETWEEN\",\n    \"values\": [\n      {\n        \"value\": \"2024-01-01T00:00:00Z\"\n      },\n      {\n        \"value\": \"2024-12-31T23:59:59Z\"\n      }\n    ]\n  },\n  {\n    \"attribute\": \"user\",\n    \"operator\": \"IS_ANY_OF\",\n    \"values\": [\n      {\n        \"value\": 123\n      },\n      {\n        \"value\": 456\n      }\n    ]\n  }\n]"

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://{tenant}.atomicwork.com/api/v1/iga/grants/list?sort_order=CREATED_AT_ASC")
  .header("X-Workspace-Id", "{{workspace_id}}")
  .header("X-Api-Key", "<apiKey>")
  .header("Content-Type", "application/json")
  .body("[\n  {\n    \"attribute\": \"status\",\n    \"operator\": \"IS_ANY_OF\",\n    \"values\": [\n      {\n        \"value\": \"ACTIVE\"\n      }\n    ]\n  },\n  {\n    \"attribute\": \"app\",\n    \"operator\": \"IS_ANY_OF\",\n    \"values\": [\n      {\n        \"value\": 42\n      }\n    ]\n  },\n  {\n    \"attribute\": \"granted_at\",\n    \"operator\": \"IS_BETWEEN\",\n    \"values\": [\n      {\n        \"value\": \"2024-01-01T00:00:00Z\"\n      },\n      {\n        \"value\": \"2024-12-31T23:59:59Z\"\n      }\n    ]\n  },\n  {\n    \"attribute\": \"user\",\n    \"operator\": \"IS_ANY_OF\",\n    \"values\": [\n      {\n        \"value\": 123\n      },\n      {\n        \"value\": 456\n      }\n    ]\n  }\n]")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://{tenant}.atomicwork.com/api/v1/iga/grants/list?sort_order=CREATED_AT_ASC', [
  'body' => '[
  {
    "attribute": "status",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": "ACTIVE"
      }
    ]
  },
  {
    "attribute": "app",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 42
      }
    ]
  },
  {
    "attribute": "granted_at",
    "operator": "IS_BETWEEN",
    "values": [
      {
        "value": "2024-01-01T00:00:00Z"
      },
      {
        "value": "2024-12-31T23:59:59Z"
      }
    ]
  },
  {
    "attribute": "user",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 123
      },
      {
        "value": 456
      }
    ]
  }
]',
  'headers' => [
    'Content-Type' => 'application/json',
    'X-Api-Key' => '<apiKey>',
    'X-Workspace-Id' => '{{workspace_id}}',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://{tenant}.atomicwork.com/api/v1/iga/grants/list?sort_order=CREATED_AT_ASC");
var request = new RestRequest(Method.POST);
request.AddHeader("X-Workspace-Id", "{{workspace_id}}");
request.AddHeader("X-Api-Key", "<apiKey>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "[\n  {\n    \"attribute\": \"status\",\n    \"operator\": \"IS_ANY_OF\",\n    \"values\": [\n      {\n        \"value\": \"ACTIVE\"\n      }\n    ]\n  },\n  {\n    \"attribute\": \"app\",\n    \"operator\": \"IS_ANY_OF\",\n    \"values\": [\n      {\n        \"value\": 42\n      }\n    ]\n  },\n  {\n    \"attribute\": \"granted_at\",\n    \"operator\": \"IS_BETWEEN\",\n    \"values\": [\n      {\n        \"value\": \"2024-01-01T00:00:00Z\"\n      },\n      {\n        \"value\": \"2024-12-31T23:59:59Z\"\n      }\n    ]\n  },\n  {\n    \"attribute\": \"user\",\n    \"operator\": \"IS_ANY_OF\",\n    \"values\": [\n      {\n        \"value\": 123\n      },\n      {\n        \"value\": 456\n      }\n    ]\n  }\n]", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = [
  "X-Workspace-Id": "{{workspace_id}}",
  "X-Api-Key": "<apiKey>",
  "Content-Type": "application/json"
]
let parameters = [
  [
    "attribute": "status",
    "operator": "IS_ANY_OF",
    "values": [["value": "ACTIVE"]]
  ],
  [
    "attribute": "app",
    "operator": "IS_ANY_OF",
    "values": [["value": 42]]
  ],
  [
    "attribute": "granted_at",
    "operator": "IS_BETWEEN",
    "values": [["value": "2024-01-01T00:00:00Z"], ["value": "2024-12-31T23:59:59Z"]]
  ],
  [
    "attribute": "user",
    "operator": "IS_ANY_OF",
    "values": [["value": 123], ["value": 456]]
  ]
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://{tenant}.atomicwork.com/api/v1/iga/grants/list?sort_order=CREATED_AT_ASC")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```