# grant_access
> Give users, roles, or your organization access to open a Dive or run a Flight, through the MCP server.
Give users, roles, or your whole organization access to a [Dive](/key-tasks/dives/) or a [Flight](/concepts/compute/flights):

- **Dive:** `read` access lets them open it. The SQL equivalent is [`GRANT READ ON DIVE`](/sql-reference/motherduck-sql-reference/dives/grant-read-on-dive).
- **Flight:** `run` access lets them run it, for example from a [Dive app](/key-tasks/dives/run-flights-from-dives). The SQL equivalent is [`GRANT RUN ON FLIGHT`](/sql-reference/motherduck-sql-reference/flights/grant-run-on-flight).

## Description

Who can grant access depends on the object:

- **Dive:** the Dive's owner or an organization Admin.
- **Flight:** only the Flight's owner. An Admin who tries gets `Only the owner of this Flight can add grants`. A run always uses the owner's token and secrets, whoever starts it.

An object you can't change is reported as not found, so `Could not find Dive` or `Could not find Flight` can mean you lack permission rather than that the ID is wrong.

Sharing a Dive doesn't share the data behind it or let viewers run its Flights. Viewers also need access to the databases the Dive queries, which the owner can share with [`share_dive_data`](/sql-reference/mcp/dives/share-dive-data), and each Flight the Dive runs needs its own `run` grant. When you ask your AI agent to share a Dive that runs Flights, it recommends which Flights to grant and to whom, and grants only after you confirm.

A user grantee needs the MotherDuck username, not an email address. For a group of people, grant to a role. Granting access that already exists succeeds and changes nothing.

## Input parameters

| Parameter | Type | Required | Description |
|---|---|---|---|
| `resource_type` | string | Yes | `"dive"` or `"flight"`. |
| `id` | string (UUID) | Yes | The Dive or Flight UUID. |
| `grantees` | object[] | Yes | 1 to 100 grantees, each `{ "type": "user" \| "role" \| "organization", "name": string }`. Omit `name` for the organization, or pass `null`; any other name for an organization grantee is an error. An unknown name fails the whole call. |
| `permission` | string | No | `"read"` for a Dive or `"run"` for a Flight. Each object supports only its own permission, which is the default. Any other value fails with `Permission '<permission>' is not supported on a <resource_type>`. |

## Output schema

On success:

```json
{
  "success": true,
  "resource_type": string,
  "id": string,
  "permission": string,
  "grantees": [{ "type": string, "name": string }]
}
```

`grantees` echoes the grantees you passed. An organization grantee has no `name`.

On failure, only the error:

```json
{
  "success": false,
  "error": string
}
```

## Example usage

Let the `finance` role open a Dive:

```json
{
  "resource_type": "dive",
  "id": "80000000-0000-4000-8000-000000000001",
  "grantees": [{ "type": "role", "name": "finance" }]
}
```

Let the `order_approvers` role run a Flight:

```json
{
  "resource_type": "flight",
  "id": "7b1e2c3d-0000-4000-8000-000000000001",
  "grantees": [{ "type": "role", "name": "order_approvers" }]
}
```

Typical prompts:

```text
Share the revenue Dive with the finance role.
Let the order_approvers role run the decide_order Flight.
```

## Related

- [`revoke_access`](../revoke-access) — Remove access.
- [`GRANT READ ON DIVE`](/sql-reference/motherduck-sql-reference/dives/grant-read-on-dive) — SQL equivalent for Dives, plus `SHOW GRANTS ON DIVE`.
- [`GRANT RUN ON FLIGHT`](/sql-reference/motherduck-sql-reference/flights/grant-run-on-flight) — SQL equivalent for Flights, plus `SHOW GRANTS ON FLIGHT`.
- [Choose who can open a Dive](/key-tasks/dives/#choose-who-can-open-a-dive)
- [Build Dive apps](/key-tasks/dives/run-flights-from-dives)


---

## Docs feedback

MotherDuck accepts optional user-submitted feedback about this page at `GET https://motherduck.com/docs/api/feedback/agent`.
For agents and automated tools, feedback submission should be user-confirmed before sending.

URL-encode query parameter values and send a GET request:

```text
GET https://motherduck.com/docs/api/feedback/agent?page_path=%2Fsql-reference%2Fmcp%2Fflights%2Fgrant-access%2F&page_title=grant_access&text=<url-encoded user feedback, max 2000 characters>
```

Optionally append `&source=<url-encoded interface identifier>` such as `claude.ai` or `chatgpt`.

`page_path` and `text` are required; `page_title` and `source` are optional. Responses: `200 {"feedback_id": "<uuid>"}`, `400` for malformed query parameters, and `429` when rate-limited.