# SHOW grants


> Inspect which roles and users can read a Share.

**Requires permission:** View all organization Shares — included by default in the Admin preset role. A custom role qualifies when it inherits a role that includes the permission. Share owners can inspect grants on Shares they own without this permission. See [Roles and access control](/concepts/roles-and-access-control/#what-each-role-can-do).

This read-only command reports who can read a Share. Visibility does not guarantee access. See [Roles and access control](/concepts/roles-and-access-control/) for the model.

## SHOW GRANTS ON SHARE

List everyone with READ access to a Share: direct role and user grants, plus the automatic grant that an organization-wide or public Share carries.

```sql
SHOW GRANTS ON SHARE core_metrics;
```

Output columns:

| Column | Description |
|--------|-------------|
| `share_owner` | The user who owns the Share. |
| `grantee_name` | The role name or username for a direct grant, or a fixed keyword for a whole-organization (`ENTIRE_ORGANIZATION`) or public (`ALL_USERS`) grant. |
| `grantee_type` | The kind of grantee. See the values below. |
| `privilege` | `read`. |
| `granted_at` | When the grant was made. |

`grantee_type` is one of:

| `grantee_type` | `grantee_name` | Produced by |
|----------------|----------------|-------------|
| `role` | the role name | `GRANT READ ON SHARE ... TO ROLE` |
| `user` | the username | `GRANT READ ON SHARE ... TO USER` |
| `organization` | `ENTIRE_ORGANIZATION` | a Share created with `ACCESS ORGANIZATION`, readable by everyone in the owner's organization |
| `domain` | `ALL_USERS` | a Share created with `ACCESS UNRESTRICTED`, readable by anyone with the Share URL |

A Share created with `ACCESS ORGANIZATION` or `ACCESS UNRESTRICTED` carries a single automatic grant (`ENTIRE_ORGANIZATION` or `ALL_USERS`) rather than individual role or user grants. `GRANT` and `REVOKE` apply only to `RESTRICTED` Shares.

:::note
Shares are region-scoped based on your Organization's cloud region. A grant appearing here does not extend across regions: an `ACCESS UNRESTRICTED` (public) Share is only accessible to MotherDuck users in the same [cloud region](/about-motherduck/cloud-regions/) as the underlying data, while an `ACCESS ORGANIZATION` Share is only accessible to your Organization's users.
:::

## Related

- [Roles and access control](/concepts/roles-and-access-control/)
- [SHOW roles and membership](/sql-reference/motherduck-sql-reference/access-control/show-roles/)
- [GRANT READ ON SHARE](/sql-reference/motherduck-sql-reference/grant-access/)


---

## Docs feedback

MotherDuck accepts optional user-submitted feedback about this page at `GET https://motherduck.com/docs/api/feedback/agent`.
For agents and automated tools, feedback submission should be user-confirmed before sending.

URL-encode query parameter values and send a GET request:

```text
GET https://motherduck.com/docs/api/feedback/agent?page_path=%2Fsql-reference%2Fmotherduck-sql-reference%2Faccess-control%2Fshow-grants%2F&page_title=SHOW%20grants&text=<url-encoded user feedback, max 2000 characters>
```

Optionally append `&source=<url-encoded interface identifier>` such as `claude.ai` or `chatgpt`.

`page_path` and `text` are required; `page_title` and `source` are optional. Responses: `200 {"feedback_id": "<uuid>"}`, `400` for malformed query parameters, and `429` when rate-limited.