LogoLogo
CommunitySupport PortalYouTubeStart a free trial
  • Welcome
  • Commerce Engine
  • Orchestration Engine
  • API Documentation
  • Release Notes
  • Changelog
  • Emporix API
  • OpenAPI Generator
  • Standard Practices
    • General Info
    • Mixins
    • Query Parameter
    • Translations
    • Custom ID
    • Upsert
    • B2B Token
  • API Guides and References
    • Authorization
      • OAuth Service
        • API Reference
          • Customer Token
          • Anonymous Token
          • Service Access Token
          • Models
        • Download API Specification
    • Artificial Intelligence
      • AI Service
        • AI Tutorials
        • API Reference
          • Text Generation
          • AI Completions
          • Models
        • Download API Specification
    • Configuration
      • Configuration Service
        • Language Tutorials
        • API Reference
          • Tenant configurations
          • Client configurations
          • Global configurations
          • Models
        • Download API Specification
      • Country Service
        • Country Tutorial
        • API Reference
          • Countries
          • Regions
          • Models
        • Download API Specification
      • Currency Service
        • Currency Tutorial
        • API Reference
          • Currencies
          • Currency exchange
          • Models
        • Download API Specification
      • Unit Handling Service
        • Unit Handling Tutorial
        • API Reference
          • Unit management
          • Unit conversion
          • Type management
          • Models
        • Download API Specification
      • Site Settings Service
        • Site Settings Tutorial
        • API Reference
          • Mixins
          • Site settings
          • Models
        • Download API Specification
      • Indexing Service
        • Indexing Tutorial
        • API Reference
          • Configuration
          • Public Configuration
          • Reindex
          • Models
        • Download API Specification
    • Catalogs and Categories
      • Catalog Service
        • Catalog Tutorials
        • API Reference
          • List catalogs
          • Catalog management
          • Models
        • Download API Specification
      • Category Service
        • Category Tutorials
        • API Reference
          • Category Resources
          • Category Assignment Resources
          • Assignment Resources
          • Category Tree Resources
          • Models
        • Download API Specification
    • Products, Labels and Brands
      • Product Service
        • Product Tutorial
        • API Reference
          • Products
          • Product Templates
          • Models
        • Download API Specification
      • Label Service
        • Label Tutorial
        • API Reference
          • Label
          • Media
          • Models
        • Download API Specification
      • Brand Service
        • Brand Tutorial
        • API Reference
          • Brands
          • Media
          • Models
        • Download API Specification
    • Prices and Taxes
      • Price Service
        • Price Tutorials
        • API Reference
          • Price lists
          • Price matching
          • Price models
          • Prices
          • Prices assigned to price lists
          • Models
        • Download API Specification
      • Tax Service
        • Tax Tutorials
        • API Reference
          • Taxes
          • Tax calculation
          • Models
        • Download API Specification
    • Users and Permissions
      • IAM Service
        • IAM Tutorial
        • API Reference
          • Access Controls
          • Group Assignments
          • Groups
          • Permissions
          • Resources
          • Roles
          • Access Control Templates
          • Users
          • Management Dashboard Users
          • Models
        • Download API Specification
      • Session-context Service
        • Session-context Tutorial
        • API Reference
          • Session management
          • Session context modification
          • Own session management
          • Own session context modification
          • Models
        • Download API Specification
    • Companies and Customers
      • Customer Management
        • Customer Management Tutorial
        • API Reference
          • Locations
          • Contact Assignments
          • Legal Entities
          • Models
        • Download API Specification
      • Customer Service (Customer Managed)
        • API Reference
          • Addresses
          • Account and profile
          • Authentication and authorization
          • Double opt In
          • Credentials
          • Models
        • Download API Specification
      • Customer Service (Tenant Managed)
        • API Reference
          • Account and profile
          • Addresses
          • Models
        • Download API Specification
      • Customer Segments
        • Segments Tutorial
        • API Reference
          • Segments
          • Items Assignments
          • Customers Assignments
          • Models
        • Download API Specification
      • Approval Service
        • Approval Tutorials
        • API Reference
          • Approvals
          • Approval
          • Search
          • Models
        • Download API Specification
    • Delivery and Shipping
      • Shipping Service
        • Shipping Tutorial
        • API Reference
          • Customer Group Relations
          • Delivery Windows
          • Shipping Cost
          • Shipping Zones
          • Shipping Methods
          • Shipping Groups
          • Sites
          • Delivery Times Management
          • Delivery Times Slots Management
          • Delivery Cycles
          • Models
        • Download API Specification
      • Delivery Providers Service
        • API Reference
          • Delivery Orders
          • Delivery Plan
          • Models
        • Download API Specification
    • Rewards and Promotions
      • Coupon Service
        • Coupon Tutorial
        • API Reference
          • Coupon Management
          • Coupon Validation
          • Coupon Redemption
          • Referral Coupon Management
          • Models
        • Download API Specification
      • Reward-points Service
        • Reward-points Tutorial
        • API Reference
          • Redeem Options Management
          • Reward Points Management
          • Signed In Customer Reward Points
          • Models
        • Download API Specification
    • Quotes
      • Quote Service
        • Quote Tutorial
        • API Reference
          • Quote management
          • Quote history
          • Quote pdf
          • Quote reason
          • Models
        • Download API Specification
    • Checkout
      • Cart Service
        • Cart Tutorial
        • API Reference
          • Carts
          • Cart items
          • Discounts
          • Models
        • Download API Specification
      • Payment-gateway Service
        • Payment-gateway Tutorial
        • API Reference
          • Payment
          • Payment mode
          • Payment frontend
          • Payment mode frontend
          • Transaction
          • Models
        • Download API Specification
      • Checkout Service
        • Checkout Tutorial
        • API Reference
          • Checkouts
          • Models
        • Download API Specification
      • Fee Service
        • Fee Tutorial
        • API Reference
          • Fee management
          • Item Fee management
          • Product Fees management
          • Item Fee search
          • Models
        • Download API Specification
      • Shopping List
        • API Reference
          • Shopping Lists
          • Models
        • Download API Specification
    • Orders
      • Availability Service
        • Availability Tutorial
        • API Reference
          • Locations
          • Availabilities
          • Models
        • Download API Specification
      • Order Service
        • Order Tutorial
        • API Reference
          • Orders (tenant Managed)
          • Orders (customer Managed)
          • Models
        • Download API Specification
      • Pick-pack Service
        • API Reference
          • Orders
          • Order cycles
          • Assignees
          • Recalculations
          • Events
          • Models
        • Download API Specification
      • Invoice Service
        • Invoice Tutorial
        • API Reference
          • Invoice Jobs
          • Models
        • Download API Specification
      • Returns Service
        • Returns Tutorial
        • API Reference
          • Returns
          • Models
        • Download API Specification
      • SEPA Export Service
        • API Reference
          • Files
          • Jobs
          • Models
        • Download API Specification
    • Utilities
      • Schema Service
        • Schema Tutorial
        • API Reference
          • Schema
          • Type
          • Reference
          • Custom Schema Type
          • Custom Instance
          • Models
        • Download API Specification
      • Sequential-id Service
        • Sequential-id Tutorial
        • API Reference
          • Sequential IDs management
          • Models
        • Download API Specification
    • Media
      • Media Service
        • Media Tutorial
        • API Reference
          • Assets
          • Models
        • Download API Specification
    • Webhooks
      • Webhook Service
        • Webhooks Tutorial
        • API Reference
          • Config
          • Events
          • Svix Emporix Shared Account
          • Models
        • Download API Specification
      • Events-Availability
      • Events-Cart
      • Events-Catalog
      • Events-Category
      • Events-Client Management
      • Events-Customer
      • Events-Index
      • Events-Order
      • Events-Price
      • Events-Product
      • Events-Quote
      • Events-Product
    • Integrations
      • Emporix and Make
      • Identity Providers
      • Workflow Automation
Powered by GitBook
On this page

Was this helpful?

Export as PDF
  1. API Guides and References
  2. Users and Permissions
  3. IAM Service
  4. API Reference

Users

PreviousAccess Control TemplatesNextManagement Dashboard Users

Was this helpful?

LogoLogo

Resources

  • Emporix.com
  • Developer Policy
  • Terms of Use

Find us

  • LinkedIn

© 2025 Emporix. All Rights Reserved.

Retrieving all access controls assigned to a user

get

Retrieves all access controls assigned to a specified user. You can expand the result by resolving the role and resource references.


Required scopes

  • iam.access_read

Authorizations
Path parameters
userIdstringRequired

User's unique identifier, generated when the user is created.

tenantstring · min: 3 · max: 16Required

Your Emporix tenant's name.

Note: The tenant name should always be written in lowercase.

Pattern: ^[a-z][a-z0-9]+$
Query parameters
pageNumberinteger · min: 1Optional

Page number to be retrieved. The number of the first page is 1.

Default: 1
pageSizeinteger · min: 1Optional

Number of items to be retrieved per page.

Default: 60
expandstring · enumOptional

Adds expanded resource and/or role objects to the response.

Example: role,resourcePossible values:
Header parameters
X-Total-CountbooleanOptional

Flag indicating whether the total number of retrieved items should be returned.

Default: falseExample: true
Accept-LanguagestringOptional

List of language codes acceptable for the response. You can specify factors that indicate which language should be retrieved if the one with a higher factor was not found in the localized fields. If the value is specified, then it must be present in the tenant configuration.

  • If the header is set to a particular language or a list of languages, all localized fields are retrieved as strings.
  • If the header is set to *, all localized fields are retrieved as maps of translations, where the keys are language codes and values are the fields in their respective languages.
  • If the header is empty, localized fields are retrieved in the default language defined in the Configuration Service.
Responses
200
The request was successful. A list of user access controls is returned.
application/json
400
Unsupported language provided.
application/json
401
Given request is unauthorized - the authorization token is invalid or has expired. It usually means that tenant from the token does not match tenant from path.
application/json
403
Scope validation failed, details will be provided in response message
application/json
404
Given resources cannot be found.
application/json
get
GET /iam/{tenant}/users/{userId}/access-controls HTTP/1.1
Host: api.emporix.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*
[
  {
    "id": "I981dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "roleId": "Z843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "resourceId": "S843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "name": {
      "en": "Example name",
      "de": "Beispielname"
    },
    "role": {
      "id": "Z843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
      "name": {
        "en": "Example name",
        "de": "Beispielname"
      },
      "description": {
        "en": "Example role description",
        "de": "Beispiel Berechtigungsbeschreibung"
      },
      "permissions": [
        {
          "id": "F243dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
          "applicablePermissionResources": [
            "Q1233dc9e-a3f6-4573-bb01-a8ae21d2d43g"
          ]
        },
        {
          "id": "F343dc9e-a3f6-4573-bb01-a8ae21d2d4ae"
        }
      ],
      "metadata": {
        "version": 1,
        "createdAt": "2022-01-04 10:44:51.871Z",
        "modifiedAt": "2022-01-05 12:44:51.456Z"
      }
    },
    "resource": {
      "id": "S843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
      "name": {
        "en": "Example name",
        "de": "Beispielname"
      },
      "description": {
        "en": "Example resource description",
        "de": "Beispiel Domainbeschreibung 2"
      },
      "code": "serviceName.resource",
      "metadata": {
        "version": 1,
        "createdAt": "2022-01-04 10:44:51.871Z",
        "modifiedAt": "2022-01-05 12:44:51.456Z"
      }
    },
    "metadata": {
      "version": 1,
      "createdAt": "2019-08-24T14:15:22Z",
      "modifiedAt": "2019-08-24T14:15:22Z"
    }
  },
  {
    "id": "PO43dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "roleId": "Rvsf43dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "resourceId": "L343dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "name": {
      "en": "Example name 2",
      "de": "Beispielname 2"
    },
    "role": {
      "id": "Rvsf43dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
      "name": {
        "en": "Example name 2",
        "de": "Beispielname 2"
      },
      "description": {
        "en": "Example role description 2",
        "de": "Beispiel Berechtigungsbeschreibung 2"
      },
      "permissions": [
        {
          "id": "M243dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
          "applicablePermissionResources": [
            "N943dc9e-a3f6-4573-bb01-a8ae21d2d43g"
          ]
        },
        {
          "id": "Z243dc9e-a3f6-4573-bb01-a8ae21d2d4ae"
        }
      ],
      "metadata": {
        "version": 1,
        "createdAt": "2022-01-04 10:44:51.871Z",
        "modifiedAt": "2022-01-05 12:44:51.456Z"
      }
    },
    "resource": {
      "id": "L343dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
      "name": {
        "en": "Example name 2",
        "de": "Beispielname 2"
      },
      "description": {
        "en": "Example resource description 2",
        "de": "Beispiel Domainbeschreibung 2"
      },
      "code": "serviceName.resource",
      "metadata": {
        "version": 1,
        "createdAt": "2022-01-04 10:44:51.871Z",
        "modifiedAt": "2022-01-05 12:44:51.456Z"
      }
    },
    "metadata": {
      "version": 1,
      "createdAt": "2019-08-24T14:15:22Z",
      "modifiedAt": "2019-08-24T14:15:22Z"
    }
  }
]

Retrieving user access controls for a resource

get

Retrieves a specified user's access controls for a specified resource.


Required scopes

  • iam.access_read

Authorizations
Path parameters
tenantstring · min: 3 · max: 16Required

Your Emporix tenant's name.

Note: The tenant name should always be written in lowercase.

Pattern: ^[a-z][a-z0-9]+$
userIdstringRequired

User's unique identifier, generated when the user is created.

resourceIdstringRequired

Unique identifier of a resource.

Query parameters
expandstring · enumOptional

Adds expanded resource and/or role objects to the response.

Example: role,resourcePossible values:
Header parameters
Accept-LanguagestringOptional

List of language codes acceptable for the response. You can specify factors that indicate which language should be retrieved if the one with a higher factor was not found in the localized fields. If the value is specified, then it must be present in the tenant configuration.

  • If the header is set to a particular language or a list of languages, all localized fields are retrieved as strings.
  • If the header is set to *, all localized fields are retrieved as maps of translations, where the keys are language codes and values are the fields in their respective languages.
  • If the header is empty, localized fields are retrieved in the default language defined in the Configuration Service.
Responses
200
The request was successful. A list of user access controls for the resource is returned.
application/json
400
Unsupported language provided.
application/json
401
Given request is unauthorized - the authorization token is invalid or has expired. It usually means that tenant from the token does not match tenant from path.
application/json
403
Scope validation failed, details will be provided in response message
application/json
404
Given resources cannot be found.
application/json
get
GET /iam/{tenant}/users/{userId}/access-controls/{resourceId} HTTP/1.1
Host: api.emporix.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*
[
  {
    "id": "I981dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "roleId": "Z843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "resourceId": "S843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "name": {
      "en": "Example name",
      "de": "Beispielname"
    },
    "role": {
      "id": "Z843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
      "name": {
        "en": "Example name",
        "de": "Beispielname"
      },
      "description": {
        "en": "Example role description",
        "de": "Beispiel Berechtigungsbeschreibung"
      },
      "permissions": [
        {
          "id": "F243dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
          "applicablePermissionResources": [
            "Q1233dc9e-a3f6-4573-bb01-a8ae21d2d43g"
          ]
        },
        {
          "id": "F343dc9e-a3f6-4573-bb01-a8ae21d2d4ae"
        }
      ],
      "metadata": {
        "version": 1,
        "createdAt": "2022-01-04 10:44:51.871Z",
        "modifiedAt": "2022-01-05 12:44:51.456Z"
      }
    },
    "resource": {
      "id": "S843dc9e-a3f6-4573-bb01-a8ae21d2d4ab",
      "name": {
        "en": "Example name",
        "de": "Beispielname"
      },
      "description": {
        "en": "Example resource description",
        "de": "Beispiel Domainbeschreibung 2"
      },
      "code": "serviceName.resource",
      "metadata": {
        "version": 1,
        "createdAt": "2022-01-04 10:44:51.871Z",
        "modifiedAt": "2022-01-05 12:44:51.456Z"
      }
    },
    "metadata": {
      "version": 1,
      "createdAt": "2019-08-24T14:15:22Z",
      "modifiedAt": "2019-08-24T14:15:22Z"
    }
  },
  {
    "id": "PO43dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "roleId": "Rvsf43dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "resourceId": "S843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "name": {
      "en": "Example name 2",
      "de": "Beispielname 2"
    },
    "role": {
      "id": "Rvsf43dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
      "name": {
        "en": "Example name 2",
        "de": "Beispielname 2"
      },
      "description": {
        "en": "Example role description 2",
        "de": "Beispiel Berechtigungsbeschreibung 2"
      },
      "permissions": [
        {
          "id": "M243dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
          "applicablePermissionResources": [
            "N943dc9e-a3f6-4573-bb01-a8ae21d2d43g"
          ]
        },
        {
          "id": "Z243dc9e-a3f6-4573-bb01-a8ae21d2d4ae"
        }
      ],
      "metadata": {
        "version": 1,
        "createdAt": "2022-01-04 10:44:51.871Z",
        "modifiedAt": "2022-01-05 12:44:51.456Z"
      }
    },
    "resource": {
      "id": "S843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
      "name": {
        "en": "Example name 2",
        "de": "Beispielname 2"
      },
      "description": {
        "en": "Example resource description 2",
        "de": "Beispiel Domainbeschreibung 2"
      },
      "code": "serviceName.resource",
      "metadata": {
        "version": 1,
        "createdAt": "2022-01-04 10:44:51.871Z",
        "modifiedAt": "2022-01-05 12:44:51.456Z"
      }
    },
    "metadata": {
      "version": 1,
      "createdAt": "2019-08-24T14:15:22Z",
      "modifiedAt": "2019-08-24T14:15:22Z"
    }
  }
]

Retrieving all groups to which a user is assigned

get

Retrieves all groups to which a specified user is assigned.


Required scopes

  • iam.group_read

Authorizations
Path parameters
tenantstring · min: 3 · max: 16Required

Your Emporix tenant's name.

Note: The tenant name should always be written in lowercase.

Pattern: ^[a-z][a-z0-9]+$
userIdstringRequired

User's unique identifier, generated when the user is created.

Query parameters
pageNumberinteger · min: 1Optional

Page number to be retrieved. The number of the first page is 1.

Default: 1
pageSizeinteger · min: 1Optional

Number of items to be retrieved per page.

Default: 60
sortstringOptional

List of properties used to sort the results, separated by colons. The order of properties indicates their priority in sorting.

Possible values:

  • {fieldName}
  • {fieldName}:asc
  • {fieldName}:desc

Note: If you want to sort the results by localized properties, the possible values are as follows:

  • {fieldName}.{language}
  • {fieldName}.{language}:asc
  • {fieldName}.{language}:desc

If the sorting direction is not specified, the fields are sorted in ascending order.

Header parameters
Accept-LanguagestringOptional

List of language codes acceptable for the response. You can specify factors that indicate which language should be retrieved if the one with a higher factor was not found in the localized fields. If the value is specified, then it must be present in the tenant configuration.

  • If the header is set to a particular language or a list of languages, all localized fields are retrieved as strings.
  • If the header is set to *, all localized fields are retrieved as maps of translations, where the keys are language codes and values are the fields in their respective languages.
  • If the header is empty, localized fields are retrieved in the default language defined in the Configuration Service.
X-Total-CountbooleanOptional

Flag indicating whether the total number of retrieved items should be returned.

Default: falseExample: true
Responses
200
The request was successful. A list of groups is returned.
application/json
400
Unsupported language provided.
application/json
401
Given request is unauthorized - the authorization token is invalid or has expired. It usually means that tenant from the token does not match tenant from path.
application/json
403
Scope validation failed, details will be provided in response message
application/json
get
GET /iam/{tenant}/users/{userId}/groups HTTP/1.1
Host: api.emporix.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*
[
  {
    "id": "Z843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "name": {
      "en": "Example name",
      "de": "Beispielname"
    },
    "description": {
      "en": "Example group description",
      "de": "Beispiel Berechtigungsbeschreibung"
    },
    "accessControls": [
      "f543dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
      "r243dc9e-a3f6-4573-zz01-a8ae21d2d4ae"
    ],
    "userType": "CUSTOMER",
    "metadata": {
      "version": 1,
      "createdAt": "2022-01-04 10:44:51.871Z",
      "modifiedAt": "2022-01-05 12:44:51.456Z"
    }
  }
]

Removing a user from all groups

delete

Removes a specified user from all groups.


Required scopes

  • iam.assignment_manage

Authorizations
Path parameters
tenantstring · min: 3 · max: 16Required

Your Emporix tenant's name.

Note: The tenant name should always be written in lowercase.

Pattern: ^[a-z][a-z0-9]+$
userIdstringRequired

User's unique identifier, generated when the user is created.

Responses
204
The request was successful. The user has been removed from all groups.
401
Given request is unauthorized - the authorization token is invalid or has expired. It usually means that tenant from the token does not match tenant from path.
application/json
403
Permission denied due to insufficient rights. This may happen when request does not contain sufficient scopes for given query values.
application/json
delete
DELETE /iam/{tenant}/users/{userId}/groups HTTP/1.1
Host: api.emporix.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

No content

Retrieving user group info

get

Retrieves user specific group.


Required scopes

  • iam.group_read

Authorizations
Path parameters
tenantstring · min: 3 · max: 16Required

Your Emporix tenant's name.

Note: The tenant name should always be written in lowercase.

Pattern: ^[a-z][a-z0-9]+$
userIdstringRequired

User's unique identifier, generated when the user is created.

groupIdstringRequired

Unique identifier of a group, generated when the group is created.

Header parameters
Accept-LanguagestringOptional

List of language codes acceptable for the response. You can specify factors that indicate which language should be retrieved if the one with a higher factor was not found in the localized fields. If the value is specified, then it must be present in the tenant configuration.

  • If the header is set to a particular language or a list of languages, all localized fields are retrieved as strings.
  • If the header is set to *, all localized fields are retrieved as maps of translations, where the keys are language codes and values are the fields in their respective languages.
  • If the header is empty, localized fields are retrieved in the default language defined in the Configuration Service.
Responses
200
The request was successful. The group is returned.
application/json
400
Unsupported language provided.
application/json
401
Given request is unauthorized - the authorization token is invalid or has expired. It usually means that tenant from the token does not match tenant from path.
application/json
403
Scope validation failed, details will be provided in response message
application/json
404
Given resources cannot be found.
application/json
get
GET /iam/{tenant}/users/{userId}/groups/{groupId} HTTP/1.1
Host: api.emporix.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*
{
  "id": "Z843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
  "name": {
    "en": "Example name",
    "de": "Beispielname"
  },
  "description": {
    "en": "Example group description",
    "de": "Beispiel Berechtigungsbeschreibung"
  },
  "accessControls": [
    "f543dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "r243dc9e-a3f6-4573-zz01-a8ae21d2d4ae"
  ],
  "userType": "CUSTOMER",
  "metadata": {
    "version": 1,
    "createdAt": "2022-01-04 10:44:51.871Z",
    "modifiedAt": "2022-01-05 12:44:51.456Z"
  }
}

Retrieving user permissions for a resource

get

Retrieves a specified user's permissions for a specific resource. The permissions are calculated based on the user's group assignments and the access control lists of those groups.


Required scopes

  • iam.permission_read

Authorizations
Path parameters
tenantstring · min: 3 · max: 16Required

Your Emporix tenant's name.

Note: The tenant name should always be written in lowercase.

Pattern: ^[a-z][a-z0-9]+$
userIdstringRequired

User's unique identifier, generated when the user is created.

resourceIdstringRequired

Unique identifier of a resource.

Header parameters
Accept-LanguagestringOptional

List of language codes acceptable for the response. You can specify factors that indicate which language should be retrieved if the one with a higher factor was not found in the localized fields. If the value is specified, then it must be present in the tenant configuration.

  • If the header is set to a particular language or a list of languages, all localized fields are retrieved as strings.
  • If the header is set to *, all localized fields are retrieved as maps of translations, where the keys are language codes and values are the fields in their respective languages.
  • If the header is empty, localized fields are retrieved in the default language defined in the Configuration Service.
Responses
200
The request was successful. A list of user permissions for the resource is returned.
application/json
400
Unsupported language provided.
application/json
401
Given request is unauthorized - the authorization token is invalid or has expired. It usually means that tenant from the token does not match tenant from path.
application/json
403
Scope validation failed, details will be provided in response message
application/json
get
GET /iam/{tenant}/users/{userId}/permissions/{resourceId} HTTP/1.1
Host: api.emporix.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*
[
  {
    "id": "Z843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "name": {
      "en": "Example name",
      "de": "Beispielname"
    },
    "description": {
      "en": "Example permission description",
      "de": "Beispiel Berechtigungsbeschreibung"
    },
    "applicableResources": [
      "SQ43dc9e-a3f6-4573-bb01-a8ae21d2d4ca",
      "RE43dc9e-a3f6-4573-bb01-a8ae21d2d4g1"
    ],
    "code": "read",
    "metadata": {
      "version": 1,
      "createdAt": "2022-01-04 10:44:51.871Z",
      "modifiedAt": "2022-01-05 12:44:51.456Z"
    }
  }
]

Retrieving scopes of a specific user

get

Retrieves all scopes granted to a user specified by id. Those are calculated based on user group assignments. For each particular group all access controls are resolved to scopes based on defined role(s) and resource(s).


Required scopes

  • iam.scope_read

Authorizations
Path parameters
tenantstring · min: 3 · max: 16Required

Your Emporix tenant's name.

Note: The tenant name should always be written in lowercase.

Pattern: ^[a-z][a-z0-9]+$
userIdstringRequired

User's unique identifier, generated when the user is created.

Responses
200
The request was successful. A list of scopes is returned.
application/json
401
Given request is unauthorized - the authorization token is invalid or has expired. It usually means that tenant from the token does not match tenant from path.
application/json
403
Scope validation failed, details will be provided in response message
application/json
get
GET /iam/{tenant}/users/{userId}/scopes HTTP/1.1
Host: api.emporix.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*
{
  "userId": "Z843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
  "scopes": "iam.group_read iam.roles_read tenant=yourtenant"
}

Retrieving all access controls assigned to a requested user

get

Retrieves all access controls assigned to a requested user. You can expand the result by resolving the role and resource references.

Authorizations
Path parameters
tenantstring · min: 3 · max: 16Required

Your Emporix tenant's name.

Note: The tenant name should always be written in lowercase.

Pattern: ^[a-z][a-z0-9]+$
Query parameters
pageNumberinteger · min: 1Optional

Page number to be retrieved. The number of the first page is 1.

Default: 1
pageSizeinteger · min: 1Optional

Number of items to be retrieved per page.

Default: 60
expandstring · enumOptional

Adds expanded resource and/or role objects to the response.

Example: role,resourcePossible values:
Header parameters
X-Total-CountbooleanOptional

Flag indicating whether the total number of retrieved items should be returned.

Default: falseExample: true
Accept-LanguagestringOptional

List of language codes acceptable for the response. You can specify factors that indicate which language should be retrieved if the one with a higher factor was not found in the localized fields. If the value is specified, then it must be present in the tenant configuration.

  • If the header is set to a particular language or a list of languages, all localized fields are retrieved as strings.
  • If the header is set to *, all localized fields are retrieved as maps of translations, where the keys are language codes and values are the fields in their respective languages.
  • If the header is empty, localized fields are retrieved in the default language defined in the Configuration Service.
Responses
200
The request was successful. A list of user access controls is returned.
application/json
400
Unsupported language provided.
application/json
401
Given request is unauthorized - the authorization token is invalid or has expired. It usually means that tenant from the token does not match tenant from path.
application/json
403
Scope validation failed, details will be provided in response message
application/json
404
Given resources cannot be found.
application/json
get
GET /iam/{tenant}/users/me/access-controls HTTP/1.1
Host: api.emporix.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*
[
  {
    "id": "I981dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "roleId": "Z843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "resourceId": "S843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "name": {
      "en": "Example name",
      "de": "Beispielname"
    },
    "role": {
      "id": "Z843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
      "name": {
        "en": "Example name",
        "de": "Beispielname"
      },
      "description": {
        "en": "Example role description",
        "de": "Beispiel Berechtigungsbeschreibung"
      },
      "permissions": [
        {
          "id": "F243dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
          "applicablePermissionResources": [
            "Q1233dc9e-a3f6-4573-bb01-a8ae21d2d43g"
          ]
        },
        {
          "id": "F343dc9e-a3f6-4573-bb01-a8ae21d2d4ae"
        }
      ],
      "metadata": {
        "version": 1,
        "createdAt": "2022-01-04 10:44:51.871Z",
        "modifiedAt": "2022-01-05 12:44:51.456Z"
      }
    },
    "resource": {
      "id": "S843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
      "name": {
        "en": "Example name",
        "de": "Beispielname"
      },
      "description": {
        "en": "Example resource description",
        "de": "Beispiel Domainbeschreibung 2"
      },
      "code": "serviceName.resource",
      "metadata": {
        "version": 1,
        "createdAt": "2022-01-04 10:44:51.871Z",
        "modifiedAt": "2022-01-05 12:44:51.456Z"
      }
    },
    "metadata": {
      "version": 1,
      "createdAt": "2019-08-24T14:15:22Z",
      "modifiedAt": "2019-08-24T14:15:22Z"
    }
  },
  {
    "id": "PO43dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "roleId": "Rvsf43dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "resourceId": "L343dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
    "name": {
      "en": "Example name 2",
      "de": "Beispielname 2"
    },
    "role": {
      "id": "Rvsf43dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
      "name": {
        "en": "Example name 2",
        "de": "Beispielname 2"
      },
      "description": {
        "en": "Example role description 2",
        "de": "Beispiel Berechtigungsbeschreibung 2"
      },
      "permissions": [
        {
          "id": "M243dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
          "applicablePermissionResources": [
            "N943dc9e-a3f6-4573-bb01-a8ae21d2d43g"
          ]
        },
        {
          "id": "Z243dc9e-a3f6-4573-bb01-a8ae21d2d4ae"
        }
      ],
      "metadata": {
        "version": 1,
        "createdAt": "2022-01-04 10:44:51.871Z",
        "modifiedAt": "2022-01-05 12:44:51.456Z"
      }
    },
    "resource": {
      "id": "L343dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
      "name": {
        "en": "Example name 2",
        "de": "Beispielname 2"
      },
      "description": {
        "en": "Example resource description 2",
        "de": "Beispiel Domainbeschreibung 2"
      },
      "code": "serviceName.resource",
      "metadata": {
        "version": 1,
        "createdAt": "2022-01-04 10:44:51.871Z",
        "modifiedAt": "2022-01-05 12:44:51.456Z"
      }
    },
    "metadata": {
      "version": 1,
      "createdAt": "2019-08-24T14:15:22Z",
      "modifiedAt": "2019-08-24T14:15:22Z"
    }
  }
]

Retrieving scopes of a requested user

get

Retrieves all own scopes granted to the user sending the request. Those are calculated based on user group assignments. For each particular group all access controls are resolved to scopes based on defined role(s) and resource(s).

Authorizations
Path parameters
tenantstring · min: 3 · max: 16Required

Your Emporix tenant's name.

Note: The tenant name should always be written in lowercase.

Pattern: ^[a-z][a-z0-9]+$
Responses
200
The request was successful. A list of scopes is returned.
application/json
401
Given request is unauthorized - the authorization token is invalid or has expired. It usually means that tenant from the token does not match tenant from path.
application/json
403
Scope validation failed, details will be provided in response message
application/json
get
GET /iam/{tenant}/users/me/scopes HTTP/1.1
Host: api.emporix.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*
{
  "userId": "Z843dc9e-a3f6-4573-bb01-a8ae21d2d4ae",
  "scopes": "iam.group_read iam.roles_read tenant=yourtenant"
}
  • GETRetrieving all access controls assigned to a user
  • GETRetrieving user access controls for a resource
  • GETRetrieving all groups to which a user is assigned
  • DELETERemoving a user from all groups
  • GETRetrieving user group info
  • GETRetrieving user permissions for a resource
  • GETRetrieving scopes of a specific user
  • GETRetrieving all access controls assigned to a requested user
  • GETRetrieving scopes of a requested user