> ## Documentation Index > Fetch the complete documentation index at: https://docs.anny.co/llms.txt > Use this file to discover all available pages before exploring further. # List access-control grants for a customer > Retrieve all access-control grants for a specific customer account. Use the `filter[valid_today]` parameter to return only grants that are active or overlapping today. Access-control grants connect a booking (or community membership) to a physical lock. Each grant specifies an `access_type` — for `pin` types the `access_value` contains the unlock code; for `remote-open` types the lock can be opened via the remote-open endpoint. ## OpenAPI ````yaml /developers/openapi/customer-internal.openapi.json get /api/v1/customer-accounts/{customer_account_id}/access-control-grants openapi: 3.1.0 info: title: customer-api version: '1.0' contact: name: anny GmbH url: anny.co email: support@anny.co description: >- The Customer API is the **public booking surface** for end-user facing applications. It covers everything a customer can see and do — searching availability, placing bookings, managing their account, and more. --- ## When to use the Customer API Use the Customer API when you are **building something your customers interact with directly**: - **Custom booking flow** — embed a fully branded booking experience inside your own app or website instead of redirecting to anny - **Headless checkout** — drive the cart, checkout, and payment steps entirely from your own frontend - **Custom confirmation pages** — retrieve booking and order details after checkout to render a tailored confirmation - **Opening hours and availability on public pages** — display live schedule data on your website with no authentication required - **White-label experiences** — build lobby screens, kiosks, or mobile apps on top of the Customer API Many endpoints work **without any authentication**. For a custom OAuth2 client to authenticate your own users, contact [support@anny.co](mailto:support@anny.co) with your use case. --- ## Authentication — Optional Auth Most Customer API endpoints work without a token. Providing a customer bearer token unlocks personal data and additional actions: | Auth state | What's accessible | |---|---| | Anonymous | Availability, public resource/service info, booking lookup by number, checkout | | Customer token | Own bookings, account data, communities, passes, queue tickets | ``` Authorization: Bearer {customer_access_token} ``` To authenticate your own users, you need a custom OAuth2 client — contact [support@anny.co](mailto:support@anny.co). See the [Authentication guide](/developers/guides/authentication) for the full token flow. --- ## Customer API vs Admin API | Feature | Customer API | Admin API | |---|---|---| | **Use case** | End-user apps, booking widgets | Server-side automation, backend tooling | | **Auth** | Optional — many endpoints work without a token | Required — API token or OAuth2 | | **Identifiers** | Slugs, booking numbers, order numbers | Immutable UUIDs and integer IDs | | **Access** | Public and customer-owned data only | Full read/write | → [Go to the Admin API](/developers/api-reference/admin) --- ## Resource Identifiers The Customer API uses **human-readable identifiers** that appear in booking URLs: | Entity | Identifier | Example | |---|---|---| | Resources | Slug | `conference-room-berlin` | | Services | Slug | `hourly-desk-booking` | | Organizations | Slug | `acme-gmbh` | | Bookings | Booking number | `BB123456789` | | Orders | Order number | `BO123456789` | Use the Admin API if you need immutable internal IDs for storage in external systems. --- ## Starting Points | Guide | What it covers | |---|---| | [Getting Started](/developers) | First steps and quickstart | | [JSON:API Conventions](/developers/guides/json-api-conventions) | Request and response format | | [Authentication](/developers/guides/authentication) | Customer token flow, OAuth2, anonymous access | | [Availability & Booking Search](/developers/guides/availability) | Search open slots, filter by service and resource | | [Customer Booking Lifecycle](/developers/guides/customer/booking-lifecycle) | View, modify, and cancel bookings | | [Order & Checkout Flow](/developers/guides/customer/checkout) | Cart, checkout steps, payment | | [Plans & Subscriptions](/developers/guides/customer/plans-subscriptions) | Membership plans and recurring billing | | [Communities & Access Control](/developers/guides/customer/communities) | Community membership and access gates | | [Waitlist](/developers/guides/customer/waitlist) | Join and manage waitlists | --- ## Base URLs | Environment | URL | |---|---| | Production | `https://b.anny.co` | | Gov-Cloud | `https://b.anny.eu` | termsOfService: https://anny.co/terms-of-use x-logo: url: https://cdn.anny.co/cms/anny_logo_main_colour_blue_4865e76654.svg altText: anny logo href: https://anny.co servers: - url: https://b.anny.co description: Production - url: https://b.anny.eu description: Gov-Cloud security: [] tags: - name: Addresses - name: Business Accounts - name: Access Control - name: Connections - name: Notifications - name: Payment Setups paths: /api/v1/customer-accounts/{customer_account_id}/access-control-grants: parameters: - schema: type: string format: uuid name: customer_account_id in: path required: true description: UUID of the customer account get: tags: - Access Control summary: List access-control grants for a customer description: >- Retrieve all access-control grants for a specific customer account. Use the `filter[valid_today]` parameter to return only grants that are active or overlapping today. Access-control grants connect a booking (or community membership) to a physical lock. Each grant specifies an `access_type` — for `pin` types the `access_value` contains the unlock code; for `remote-open` types the lock can be opened via the remote-open endpoint. operationId: get-customer-accounts-record-access-control-grants parameters: - schema: type: string in: header name: Authorization description: Bearer Token required: true - schema: type: integer enum: - 1 in: query name: filter[valid_today] description: >- When set to `1`, returns only grants valid today or overlapping with today responses: '200': description: OK content: application/json: schema: type: object properties: data: type: array items: type: object properties: type: type: string default: access-control-grants id: type: string format: uuid attributes: type: object properties: uuid: type: string format: uuid integration_key: type: string description: >- Integration that manages this lock (e.g. `nuki`, `dormakaba`) label: type: string description: Human-readable label for the door/lock granted_through_type: type: string description: >- How the grant was created (`bookings` or `communities`) access_type: type: string description: >- How to use the grant (`pin`, `remote-open`, `app`, etc.) access_value: type: - string - 'null' description: Access credential (PIN code, token, etc.) lock_name: type: string description: Name of the physical lock valid_from: type: string format: date-time valid_until: type: - string - 'null' format: date-time description: >- Null for community-based grants (valid until membership ends) validity_status: type: string enum: - active - expired - pending is_removed: type: integer enum: - 0 - 1 created_at: type: string format: date-time updated_at: type: string format: date-time examples: default: value: data: - type: access-control-grants id: 123453-2345-4dd0-2345-23456346 attributes: uuid: 123453-2345-4dd0-2345-23456346 integration_key: nuki label: Meetingroom A Door granted_through_type: bookings access_type: pin access_value: '723497' lock_name: anny Meeting Room valid_from: '2025-07-21T11:00:00.000000Z' valid_until: '2025-07-29T11:00:00.000000Z' validity_status: active is_removed: 0 created_at: '2025-07-19T11:13:19.000000Z' updated_at: '2025-07-19T11:15:21.000000Z' '401': description: Unauthorized '404': description: Not Found security: - Bearer: [] components: securitySchemes: Bearer: type: oauth2 flows: authorizationCode: tokenUrl: https://auth.anny.co/oauth/token refreshUrl: https://auth.anny.co/oauth/token/refresh scopes: {} authorizationUrl: https://auth.anny.co/oauth/authorize ````