Genesys Cloud - Developer Community!

I'm assuming this must be possible because the UI can differentiate them when I view a specific user. If a role is only assigned via individual assignment, then it would be easy enough to identify because the role will not be assigned to ANY group.  However, I have an example where a role is assigned to a Group, for all divisions. I then add the user to the Group. Now assume that the role was previously assigned directly to the user, for the Home division. The UI will show me that the user has permission to the role, in the Home division, and the Group Inheritance column will be blank for that row.  The UI will also show me that the user has the role for the remaining divisions, and that it was inherited by the Group.

I have scrubbed through many of the endpoints but can't seem to find how to differentiate between a role that was individually assigned and a role that was inherited from a Group assignment.  What am I missing?

Thanks,

-Pete

Hi Peter,

I believe in your case the endpoint /api/v2/authorization/subjects/{subjectId} might be helpful. You can replace subjectId with the user's userId, which will list the roles and permissions assigned to that user.

When this API returns the data, it also shows the subjectId for each role.
If the role was assigned individually, that value will match the userId.
If it was assigned through a group, the value will correspond to the groupId.

I'm assuming this must be possible because the UI can differentiate them when I view a specific user. If a role is only assigned via individual assignment, then it would be easy enough to identify because the role will not be assigned to ANY group.  However, I have an example where a role is assigned to a Group, for all divisions. I then add the user to the Group. Now assume that the role was previously assigned directly to the user, for the Home division. The UI will show me that the user has permission to the role, in the Home division, and the Group Inheritance column will be blank for that row.  The UI will also show me that the user has the role for the remaining divisions, and that it was inherited by the Group.

I have scrubbed through many of the endpoints but can't seem to find how to differentiate between a role that was individually assigned and a role that was inherited from a Group assignment.  What am I missing?

Thanks,

-Pete

Excellent.  Thank you, Elisson.

Hi Peter,

I believe in your case the endpoint /api/v2/authorization/subjects/{subjectId} might be helpful. You can replace subjectId with the user's userId, which will list the roles and permissions assigned to that user.

When this API returns the data, it also shows the subjectId for each role.
If the role was assigned individually, that value will match the userId.
If it was assigned through a group, the value will correspond to the groupId.

I'm assuming this must be possible because the UI can differentiate them when I view a specific user. If a role is only assigned via individual assignment, then it would be easy enough to identify because the role will not be assigned to ANY group.  However, I have an example where a role is assigned to a Group, for all divisions. I then add the user to the Group. Now assume that the role was previously assigned directly to the user, for the Home division. The UI will show me that the user has permission to the role, in the Home division, and the Group Inheritance column will be blank for that row.  The UI will also show me that the user has the role for the remaining divisions, and that it was inherited by the Group.

I have scrubbed through many of the endpoints but can't seem to find how to differentiate between a role that was individually assigned and a role that was inherited from a Group assignment.  What am I missing?

Thanks,

-Pete

Hi Peter,

I believe in your case the endpoint /api/v2/authorization/subjects/{subjectId} might be helpful. You can replace subjectId with the user's userId, which will list the roles and permissions assigned to that user.

When this API returns the data, it also shows the subjectId for each role.
If the role was assigned individually, that value will match the userId.
If it was assigned through a group, the value will correspond to the groupId.

I'm assuming this must be possible because the UI can differentiate them when I view a specific user. If a role is only assigned via individual assignment, then it would be easy enough to identify because the role will not be assigned to ANY group.  However, I have an example where a role is assigned to a Group, for all divisions. I then add the user to the Group. Now assume that the role was previously assigned directly to the user, for the Home division. The UI will show me that the user has permission to the role, in the Home division, and the Group Inheritance column will be blank for that row.  The UI will also show me that the user has the role for the remaining divisions, and that it was inherited by the Group.

I have scrubbed through many of the endpoints but can't seem to find how to differentiate between a role that was individually assigned and a role that was inherited from a Group assignment.  What am I missing?

Thanks,

-Pete