> ## Documentation Index
> Fetch the complete documentation index at: https://docs.entire.com/llms.txt
> Use this file to discover all available pages before exploring further.

# grant

> Manage Entire access grants and organization membership.

Manage Entire access grants and organization membership.

```bash theme={null}
entire org grant COMMAND
entire project grant COMMAND
entire repo grant COMMAND
```

Grants are managed at three levels, each under the command for the thing it governs: membership in an [organization](/cli-reference/org.md), access to a [project](/cli-reference/project.md), and access to a [repository](/cli-reference/repo.md).

A **grantee** is addressed as a provider-qualified handle, such as `github:alice`, and nothing else. An account ULID is refused, including by `remove`. Orgs and projects are addressed by name or ULID, and repositories by their `/et/PROJECT/REPO` path.

Omit the grantee on a terminal and most of these offer an interactive multi-select of candidates, with a role per grantee for `add`. `entire org grant add` is the exception: it always requires the grantee.

`add` and `list` accept `--json` to print raw JSON instead of a table. `remove` does not.

> [!NOTE]
>
> Access to a [GitHub mirror](/guides/repositories/mirrors.md) follows GitHub collaborator permissions and syncs hourly, rather than being managed with these commands. `entire repo grant list` reads a mirror's access with a `/gh/` reference, but `add` and `remove` take `/et/` references only. See [Mirror Access and Permissions](/guides/repositories/mirror-access-and-permissions.md).

## entire org grant

Manage organization membership.

### `entire org grant add`

Grant a user org access.

```bash theme={null}
entire org grant add ORG GRANTEE [flags]
```

| Flag | Description |
| - | - |
| `--json` | Output raw JSON instead of a table. |
| `--role ROLE` | Org role: `owner`, `admin`, or `member`. Defaults to `member`. |

```bash theme={null}
entire org grant add acme github:alice --role admin
```

### `entire org grant list`

List who has org access.

```bash theme={null}
entire org grant list ORG [flags]
```

| Flag | Description |
| - | - |
| `--json` | Output raw JSON instead of a table. |

### `entire org grant remove`

Revoke a user's org access.

```bash theme={null}
entire org grant remove ORG [GRANTEE]
```

```bash theme={null}
entire org grant remove acme github:alice
```

## entire project grant

Manage project access.

### `entire project grant add`

Grant a user project access.

```bash theme={null}
entire project grant add PROJECT [GRANTEE] --role ROLE [flags]
```

| Flag | Description |
| - | - |
| `--json` | Output raw JSON instead of a table. |
| `--role ROLE` | Project role: `reader`, `writer`, or `admin`. Required, though Entire asks for it if you omit it on a terminal. |

```bash theme={null}
entire project grant add widgets github:alice --role writer
```

### `entire project grant list`

List who has project access.

```bash theme={null}
entire project grant list PROJECT [flags]
```

| Flag | Description |
| - | - |
| `--json` | Output raw JSON instead of a table. |

### `entire project grant remove`

Revoke a grantee's project access.

```bash theme={null}
entire project grant remove PROJECT [GRANTEE]
```

```bash theme={null}
entire project grant remove widgets github:alice
```

## entire repo grant

Manage repository access. The repository is addressed by its `/et/PROJECT/REPO` path.

### `entire repo grant add`

Grant a user repo access. Takes an `/et/PROJECT/REPO` reference; a mirror's access is managed on GitHub.

```bash theme={null}
entire repo grant add REPO [GRANTEE] --role ROLE [flags]
```

Omit `GRANTEE` on a terminal to choose from the members of the owning org who do not have repo access yet, and set a role for each.

| Flag | Description |
| - | - |
| `--json` | Output raw JSON instead of a table. |
| `--role ROLE` | Repo role: `reader`, `writer`, or `admin`. Required, though Entire asks for it if you omit it on a terminal. |

```bash theme={null}
entire repo grant add /et/acme/web github:alice --role writer
```

### `entire repo grant list`

List who can reach a repository. This one answers for both forges.

```bash theme={null}
entire repo grant list REPO [flags]
```

An `/et/PROJECT/REPO` reference lists the repository's grants: each grantee, their `reader`, `writer`, or `admin` role, and whether the grant is held on the repository itself or inherited.

A `/gh/OWNER/REPO` reference lists who can pull the mirror. That access follows the upstream GitHub repository and is read-only here. The check runs live against your own GitHub identity, so you must be a current admin of the upstream repository or the owner of a personal one. Run it as yourself rather than with a service-account token.

```bash theme={null}
entire repo grant list /et/acme/web
entire repo grant list /gh/acme/widget
```

| Flag | Description |
| - | - |
| `--json` | Output raw JSON instead of a table. Every row carries `granteeId`, `role`, and `source`, plus `granteeName` when a name resolved, so one script reads either forge. A mirror's rows carry no `granteeType`, because that endpoint reports no grantee kind. |

### `entire repo grant remove`

Revoke a grantee's repo access. Takes an `/et/PROJECT/REPO` reference.

```bash theme={null}
entire repo grant remove REPO [GRANTEE]
```

```bash theme={null}
entire repo grant remove /et/acme/web github:alice
```

## Continue With

> **[repo edit](/cli-reference/repo.md#entire-repo-edit)**
>
> Make a repository readable by all authenticated Entire users.

> **[Mirror Access and Permissions](/guides/repositories/mirror-access-and-permissions.md)**
>
> Understand GitHub-synced access for mirrors.