Get a permission set assignment

GET 
/permission-set-assignments/:id

Returns one assignment in full, including the provisioning fields the list view leaves out: status, roleName, errorMessage, provisionedAt and the timestamps.

This is the only way to find out whether an assignment has actually reached AWS. After a POST, poll here until status becomes PROVISIONED; and treat a 404 as provisioning having failed, because Prism deletes the row rather than leave a phantom entry behind when the background work does not succeed.

Unlike the list endpoint, this one still returns an assignment whose permission set has since been deleted; permissionSetName comes back as an empty string in that case.

Request

Responses

200

The assignment.

401

Authentication failed: the X-API-Token header was missing, malformed, expired or not recognised.

This response is text/plain, not JSON. It is written by http.Error in the authentication middleware, which runs before any handler and therefore before anything that would build a JSON envelope. A client that unconditionally JSON-parses response bodies will fail on this one, so check the status code first.

403

The token is valid, but it is not allowed to act on this tenant.

An API token is minted inside one tenant and stays bound to it for life. Sending it to a path whose tenant segment names a different tenant is refused here, in middleware, before the operation runs, so this says nothing about the resource you asked for, only about which tenant the path named. Check the tenant server variable against the console the token was created in.

404

No assignment with this id exists in your tenant: either it never did, it belongs to another tenant, it has been deleted, or its background provisioning failed and Prism removed it. Nothing in this response distinguishes those cases.

500

The assignment could not be read from the database.