# Get a user's effective permissions

`GET /v1/users/{user_id}/effective-permissions` · permission `users:read`

Returns the permissions the user effectively has, for support and debugging: the permissions of the user's direct environment roles and, when `org_id` is given, of the roles of the user's active membership in that organization. Each permission lists the roles that grant it. Permissions of deleted APIs are not included. The list is not paginated and is ordered by API, then by permission value.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `user_id` | path | yes | User ID (`usr_…`). |
| `org_id` | query | no | Organization ID (`org_…`); also includes the roles of the user's active membership there. |
| `api_id` | query | no | API ID (`api_…`); only that API's permissions. An unknown API gives an empty list. |

No request body.

## Response

`200 OK` with the permissions.

```json
{
  "permissions": [
    {
      "permission_id": "perm_01j9xs0a2b4c6d8e0f2g4h6j8k",
      "api_id": "api_01j9xq1b3c5d7e9f1g3h5j7k9m",
      "value": "read:invoices",
      "role_ids": [
        "rol_01j9xr7s1t2w6x8y0z2a4b6c8e"
      ]
    }
  ]
}
```

## Errors

| HTTP | code | When |
|---|---|---|
| 404 | `not_found` | The user, or the organization given in `org_id`, does not exist in this environment. |
| 422 | `validation_failed` | `org_id` or `api_id` is malformed or repeated. |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl -i -X GET "https://api.eu.keenauth.com/v1/users/usr_01j9xh2k6p7q1r3s5t7v9w1x3y/effective-permissions?org_id=org_01j9xk3m7q8r2s4t6v8w0y2z4a" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```