# WebFunctionEndpointGrants

Collection of grant methods for a WebFunction endpoint.

- Source: [`aws-lambda/lib/webfunction-endpoint-grants.ts`](https://github.com/aws/aws-cdk/blob/v2.276.0/packages/aws-cdk-lib/aws-lambda/lib/webfunction-endpoint-grants.ts#L7)
- Type last changed: v2.276.0 · 10 Nov 2026

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_lambda as lambda } from 'aws-cdk-lib';
import { aws_lambda as interfaces_lambda } from 'aws-cdk-lib/interfaces';

declare const webFunctionEndpointRef: interfaces_lambda.IWebFunctionEndpointRef;
const webFunctionEndpointGrants = lambda.WebFunctionEndpointGrants.fromWebFunctionEndpoint(webFunctionEndpointRef);
```

## Methods

- `fromWebFunctionEndpoint(endpoint: IWebFunctionEndpointRef): WebFunctionEndpointGrants // chainable` (static) — Creates grants for a WebFunction endpoint.

- `invoke(grantee: IGrantable): Grant` — Grants permission to invoke the endpoint over HTTP.

  Only meaningful for an endpoint with `WebFunctionAuthType.IAM_AUTH`; requests to it must be
  signed by the grantee.

  A role or user in this account gets the permission in its own policy. Any other grantee, such
  as a service principal or another account, gets a statement in the resource-based policy of
  the WebFunction the endpoint serves, which requires that function to be defined in this app.