Skip to main content

List everything a user can reach

GET 
/users/:username/effective-assignments

Returns every access path a user has, resolved: the AWS permission sets they can assume, the custom applications they can open, and the groups those inherited entitlements come through. Direct grants and group-inherited ones are merged into one answer, each entry saying which kind it is.

This is the endpoint to call before deleting a user, and the one to call to answer "what can this person actually do".

Three things to get right when reading the body:

  • count counts assignments only. It is not the total number of entitlements; the applications are not in it.
  • assignments is null when it is empty, while applicationAssignments and groups are []. Three arrays, two different ways of saying "nothing", in one object. Guard the first against null.
  • The two assignmentType fields do not use the same words. Under assignments an inherited entry says indirect; under applicationAssignments it says group. Handle each where it appears.

There is no pagination. The response grows with the user's access, and every entitlement comes back in one body.

A user who does not exist gets a 200, not a 404. The group lookup that would have failed is caught and treated as "no groups", so an unknown username (or a username misspelt, or an email address sent where a username belongs) returns a perfectly well-formed empty answer that is indistinguishable from a real user with no access. Confirm the user exists with GET /users/{username} before reading an empty result as meaningful.

Request​

Responses​

The user's resolved access. Also what an unknown user returns; see the note above.