To get a list of subject_ids (users) that have access to a specific object in Ory Keto, you should use the Expand API. This API expands a subject set (such as "who has access to object X") into a tree of all effective subjects, showing both direct and indirect access, and the reasons for access. How to use the Expand API: - Specify the object, relation (e.g., "access" or "view"), and namespace. - The API will return a tree structure listing all subjects (subject_ids) who have the specified relation to the object, including those who have access via group membership or other indirect means. Example scenario: Suppose you want to see who has

access

to the file with ID

ec788a82-a12e-45a4-b906-3e69f78c94e4

in the

files

namespace. You would expand the subject set

files:ec788a82-a12e-45a4-b906-3e69f78c94e4#access

. The result will show all users (subject_ids) with access, and why they have it. Example expansion tree:

∪ ec788a82-a12e-45a4-b906-3e69f78c94e4#access   ├─ ∪ ec788a82-a12e-45a4-b906-3e69f78c94e4#owner   │  ├─ ☘ demeter   ├─ ☘ athena

In this example, both

demeter

and

athena

have access to the file, either directly or via ownership [A basic, down-to-earth full feature example](https://www.ory.sh/docs/keto/examples/olymp-file-sharing#a-basic-down-to-earth-full-feature-example). API Reference: - [Expand API: display who has access to an object](https://www.ory.sh/docs/keto/guides/expand-api-display-who-has-access) - [Keto API Concepts: Expand subject sets](https://www.ory.sh/docs/keto/concepts/api-overview) Summary: Use the Expand API to get a tree of all subject_ids with access to a specific object. This is the recommended and supported way to audit and display access in Ory Keto.