Get a user's effective permissions

GET /v1/users/{user_id}/effective-permissions · permission users:read

Returns the permissions the user effectively has, for support and debugging: the permissions of the user's direct environment roles and, when org_id is given, of the roles of the user's active membership in that organization. Each permission lists the roles that grant it. Permissions of deleted APIs are not included. The list is not paginated and is ordered by API, then by permission value.

Request

Field Type Required Description
user_id path yes User ID (usr_…).
org_id query no Organization ID (org_…); also includes the roles of the user's active membership there.
api_id query no API ID (api_…); only that API's permissions. An unknown API gives an empty list.

No request body.

Response

200 OK with the permissions.

{
  "permissions": [
    {
      "permission_id": "perm_01j9xs0a2b4c6d8e0f2g4h6j8k",
      "api_id": "api_01j9xq1b3c5d7e9f1g3h5j7k9m",
      "value": "read:invoices",
      "role_ids": [
        "rol_01j9xr7s1t2w6x8y0z2a4b6c8e"
      ]
    }
  ]
}

Errors

HTTP code When
404 not_found The user, or the organization given in org_id, does not exist in this environment.
422 validation_failed org_id or api_id is malformed or repeated.
401 unauthenticated The credential is missing, invalid or revoked.
403 insufficient_permissions The credential lacks the required permission.
429 rate_limited The rate limit was exceeded; retry after the Retry-After period.
503 service_unavailable A dependency is temporarily unavailable; retry after the Retry-After period.

Example

curl -i -X GET "https://api.eu.keenauth.com/v1/users/usr_01j9xh2k6p7q1r3s5t7v9w1x3y/effective-permissions?org_id=org_01j9xk3m7q8r2s4t6v8w0y2z4a" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"