# Who has access to a business

`GET /businesses/{bid}/access`

Requires the `businesses` scope.

Every person the owner let in (section 4, Shared access), newest first, revoked rows included. Owner only: a credential that holds the business by grant answers `404`. Also returns the role presets and the Hebrew/English label of every scope, so a UI never keeps its own copy.

## Path parameters

| Name | Type | | Description |
|---|---|---|---|
| `bid` | string | **required** | Business id, from `POST /businesses`. |

## Response

`200`: `{ "ok": true, … }`

| Field | Type | | Description |
|---|---|---|---|
| `ok` | boolean | **required** |  |
| `access` | array of BusinessAccess | **required** |  |
| `roles` | object |  | Preset name → `{ label, scopes }`. |
| `scopeLabels` | object |  | Fine scope → `{ he, en }`. |

Errors: `400`, `401`, `403`, `404`, `429`. Every failure answers `{ "error", "reason", "hint", "param", "doc_url", "retryable", "request_id" }`: branch on `reason`, and read `hint` for what to change (https://docs.billos.co.il/errors.md).

## Examples

### cURL

```bash
curl -X GET "$BASE/businesses/$BID/access" \
  -H "X-Api-Key: $KEY"
```
### Node

```node
const res = await fetch(`${BASE}/businesses/${BID}/access`, {
  method: 'GET',
  headers: {
    'X-Api-Key': KEY,
  },
})
const data = await res.json()
if (!data.ok) throw new Error(data.reason)
```
### Python

```python
import requests
res = requests.get(
    f"{BASE}/businesses/{BID}/access",
    headers={"X-Api-Key": KEY},
)
data = res.json()
```