Get a single active grant by UUID

GET 
/rbac/grants/:identifier

Returns the enriched grant. Missing, soft-deleted, expired, and wrong-entity grants all return 404 (anti-enumeration). Requires GRANT_READ permission.

Request

Responses

200

OK

401

Missing/invalid JWT or entity selection

403

Caller lacks GRANT_READ permission

404

Grant not found (RBAC_GRANT_NOT_FOUND)