The ObjectAccessControls resources represent the Access Control Lists (ACLs) for objects within Cloud Storage. ACLs let you specify who has access to your data and to what extent.

> [!NOTE]
> **Important:** The methods for this resource fail with a `400 Bad Request` response for buckets with uniform bucket-level access enabled. Use [`storage.buckets.getIamPolicy`](https://docs.cloud.google.com/storage/docs/json_api/v1/buckets/getIamPolicy.md.txt) and [`storage.buckets.setIamPolicy`](https://docs.cloud.google.com/storage/docs/json_api/v1/buckets/setIamPolicy.md.txt) to control access instead.

There are two roles that can be assigned to an entity:  

- `READER`s can [get](https://docs.cloud.google.com/storage/docs/json_api/v1/objects/get.md.txt) an object, though the `acl` property will not be revealed.
- `OWNER`s are `READER`s, and they can get the `acl` property, [update](https://docs.cloud.google.com/storage/docs/json_api/v1/objects/update.md.txt) an object, and call all objectAccessControls methods on the object. The owner of an object is always an `OWNER`.  

For more information, see [Access Control](https://docs.cloud.google.com/storage/docs/accesscontrol), with the caveat that this API uses `READER` and `OWNER` instead of `READ` and `FULL_CONTROL`.

<br />

To try out the methods for this resource, see [Methods](https://docs.cloud.google.com/storage/docs/json_api/v1/objectAccessControls.md.txt#methods).

## Resource representations

<br />

```
{
  "kind": "storage#objectAccessControl",
  "object": string,
  "generation": "long",
  "id": string,
  "selfLink": string,
  "bucket": string,
  "entity": string,
  "role": string,
  "email": string,
  "domain": string,
  "entityId": string,
  "etag": string,
  "projectTeam": {
    "projectNumber": string,
    "team": string
  }
}
```

| Property name | Value | Description | Notes |
|---|---|---|---|
| `bucket` | `string` | The name of the bucket. |   |
| `domain` | `string` | The domain associated with the entity, if any. |   |
| `email` | `string` | The email address associated with the entity, if any. |   |
| `entity` | `string` | The entity holding the permission, in one of the following forms: - `user-email` - `group-groupId` - `group-email` - `domain-domain` - `project-team-projectId` - `allUsers` - `allAuthenticatedUsers` Examples: <!-- --> - The user `liz@example.com` would be `user-liz@example.com`. - The group `example@googlegroups.com` would be `group-example@googlegroups.com`. - To refer to all members of the domain `example.com`, the entity would be `domain-example.com`. | writable |
| `entityId` | `string` | The ID for the entity, if any. |   |
| `etag` | `string` | HTTP 1.1 [Entity tag](https://datatracker.ietf.org/doc/html/rfc7232#section-2.3) for the access-control entry. |   |
| `generation` | `long`^1^ | The content generation of the object, if applied to an object. |   |
| `id` | `string` | The ID of the access-control entry. |   |
| `kind` | `string` | The kind of item this is. For object access control entries, this is always `storage#objectAccessControl`. |   |
| `object` | `string` | The name of the object, if applied to an object. |   |
| `projectTeam` | `object` | The project team associated with the entity, if any. |   |
| `projectTeam.projectNumber` | `string` | The project number. |   |
| `projectTeam.team` | `string` | The team. <br /> Acceptable values are: - "`editors`" - "`owners`" - "`viewers`" |   |
| `role` | `string` | The access permission for the entity. <br /> Acceptable values are: - "`OWNER`" - "`READER`" | writable |
| `selfLink` | `string` | The link to this access-control entry. |   |

^1^ This property is a string formatted as the specified value type.

## Methods

The methods for working with an object's access controls are as follows:

[delete](https://docs.cloud.google.com/storage/docs/json_api/v1/objectAccessControls/delete.md.txt)
:   Permanently deletes the ACL entry for the specified entity on the specified [object](https://docs.cloud.google.com/storage/docs/json_api/v1/objects.md.txt).

[get](https://docs.cloud.google.com/storage/docs/json_api/v1/objectAccessControls/get.md.txt)
:   Returns the ACL entry for the specified entity on the specified [object](https://docs.cloud.google.com/storage/docs/json_api/v1/objects.md.txt#resource).

[insert](https://docs.cloud.google.com/storage/docs/json_api/v1/objectAccessControls/insert.md.txt)
:   Creates a new ACL entry on the specified [object](https://docs.cloud.google.com/storage/docs/json_api/v1/objects.md.txt#resource).

[list](https://docs.cloud.google.com/storage/docs/json_api/v1/objectAccessControls/list.md.txt)
:   Retrieves ACL entries on the specified [object](https://docs.cloud.google.com/storage/docs/json_api/v1/objects.md.txt#resource).

[patch](https://docs.cloud.google.com/storage/docs/json_api/v1/objectAccessControls/patch.md.txt)
:   Updates an ACL entry on the specified [object](https://docs.cloud.google.com/storage/docs/json_api/v1/objects.md.txt). This method supports [patch](https://docs.cloud.google.com/storage/docs/json_api.md.txt#patch) semantics.

[update](https://docs.cloud.google.com/storage/docs/json_api/v1/objectAccessControls/update.md.txt)
:   Updates an ACL entry on the specified [object](https://docs.cloud.google.com/storage/docs/json_api/v1/objects.md.txt#resource).