List permission set assignments

GET 
/permission-set-assignments

Returns the permission set assignments in your tenant. An assignment is one grant of one permission set to one user or group, for one AWS account: the record behind an actual IAM role in an actual account.

This endpoint is not paginated. Unlike users, groups and permission sets, it takes no page or pageSize: every matching assignment comes back in a single array, in a single response. A tenant with many accounts and many principals can make that a very large body, so narrow it with the filters below rather than fetching everything. Row order is unspecified and not stable between calls; sort client-side if you need an order.

List items are summaries, not the full resource. In particular they carry no status, so an assignment that is still being provisioned looks exactly like one that is live. Fetch GET /permission-set-assignments/{id} when you need that.

Keys are camelCase both in the wrapper and inside each item; this group does not have the mixed-case quirk the permission set endpoints do.

Request

Responses

200

The matching assignments. An empty result is still a 200.

401

Authentication failed: the X-API-Token header was missing, malformed, expired or not recognised.

This response is text/plain, not JSON. It is written by http.Error in the authentication middleware, which runs before any handler and therefore before anything that would build a JSON envelope. A client that unconditionally JSON-parses response bodies will fail on this one, so check the status code first.

403

The token is valid, but it is not allowed to act on this tenant.

An API token is minted inside one tenant and stays bound to it for life. Sending it to a path whose tenant segment names a different tenant is refused here, in middleware, before the operation runs, so this says nothing about the resource you asked for, only about which tenant the path named. Check the tenant server variable against the console the token was created in.

404

No tenant matches the tenant segment of the request path. Check the tenant server variable rather than the query; filters that match nothing return a 200, never a 404.

500

The assignments could not be read from the database.