To list a bucket's ACLs you make a GET request that is scoped to a bucket and
you use the `acl` query string parameter. The ACLs are returned in
an XML document in the response body.

## Query string parameters

| Parameter | Description | Required |
|---|---|---|
| `acl` | You can use this to display the ACLs of an existing bucket. | No |

See [signed URL query string parameters](https://docs.cloud.google.com/storage/docs/authentication/canonical-requests.md.txt#required-query-parameters) for information on the parameters
you include when creating and using [signed URLs](https://docs.cloud.google.com/storage/docs/access-control/signed-urls.md.txt).

## Request headers

See [common request headers](https://docs.cloud.google.com/storage/docs/xml-api/get-bucket.md.txt#request-headers).

## Request body elements

This request does not include an XML document in the request body.

## Request syntax

The following syntax applies to GET Bucket requests that use the
`acl` query string parameter.

```
GET /?acl HTTP/1.1
Host: BUCKET_NAME.storage.googleapis.com
Date: DATE
Content-Length: 0
Authorization: AUTHENTICATION_STRING
```

## Response headers

The request can return a variety of response headers depending on the request headers you use.

## Response body elements

The following response body elements are applicable only if you use the
`acl` query string parameter to list a bucket's ACLs.

| Element | Description |
|---|---|
| `Owner` | Container for bucket owner information. |
| `ID` | The Cloud Storage ID of the bucket owner or theCloud Storage ID of the user or group for whom the ACLs apply. |
| `Name` | Comment field for `GroupByEmail`, `GroupById`, `UserByEmail`, and `UserById`. |
| `AccessControlList` | Container for the ACLs you are retrieving. |
| `Entries` | Container for the ACL entries you are retrieving. |
| `Entry` | The ACL entry you are retrieving. |
| `Scope` | The scope to which the ACLs apply. |
| `Permission` | The permission that has been granted. Can be any of the Cloud Storage permissions, including `READ`, `WRITE`, or `FULL_CONTROL` |
| `EmailAddress` | A user account email address, a service account email address, or a Google group email address. |
| `Domain` | A Google Workspace or Cloud Identity domain. |