Skip to main content

List what a group grants

GET 
/groups/:groupName/assignments

Returns everything the group hands to its members: the AWS permission sets assigned to it, and the custom applications assigned to it.

This is the endpoint to read before adding someone to a group (it is exactly what they will inherit) and before deleting one, since DELETE /groups/{groupName} is refused while any permission set assignment remains.

Three things to get right when reading the body:

  • count counts assignments only. It is not the total number of entitlements; the applications are not in it.
  • assignments is null when it is empty, while applicationAssignments is []. Two arrays, two different ways of saying "nothing", in one object. Guard the first against null.
  • Only what is assigned to this group is here. Access a member holds directly, or through a different group, is not. Use GET /users/{username}/effective-assignments for one person's full picture.

There is no pagination; everything comes back in one body.

A group that does not exist gets a 200, not a 404. Since the name is never checked against the directory, a misspelt one returns a well-formed empty answer indistinguishable from a real group that grants nothing. The sibling operations disagree with this one and with each other: GET /groups/{groupName} and GET /groups/{groupName}/members answer 404 for an unknown group, while POST and DELETE on the members path answer 500. Confirm the group exists with GET /groups/{groupName} before reading an empty result as meaningful.

Request​

Responses​

What the group grants. Also what an unknown group name returns; see the note above.