Get all permissions for a user

1 min

GET

https://api.upstartcommerce.com/profile-permissions/users/{userId}/permissions

Returns all permissions the user has, including the source of each permission (which role granted it).

Required Permission: None if viewing own permissions (userId matches token subject). Otherwise requires profile-permissions.users.read.

Path Parameters

userIdstring<uuid>required
Description
User identifier
Format
uuid

Query Parameters

prefixstring
Example
order
Description
Filter permissions by prefix (e.g., "order" returns order.read, order.write, etc.)

Responses

200List of user permissions

UserPermissionsResponse
Description
Every permission a user holds, each with the roles it came from.
- userIdstring<uuid>required
  Format
  uuid
- permissionsUserPermission[]required
  Description
  A single permission a user holds, and all of the roles that grant it.
  - namestringrequired
    Example
    order.read
    Description
    Permission name
  - permissionDescriptionstring
    Description
    Human-readable description
  - sourcesstring[]required
    Example
    [ "role:operator", "role:admin" ]
    Description
    All roles that grant this permission to the user
  - grantedAtstring<date-time>required
    Description
    When the permission was first granted (earliest across all sources)
    Format
    date-time

401Missing or invalid authentication token

ErrorResponse
Description
Error payload identifying the failure by error code and message, with optional detail.
- errorstring<bad_request | unauthorized | forbidden | not_found | conflict | internal_error>required
  Example
  not_found
  Description
  Error code
  Allowed
  bad_requestunauthorizedforbiddennot_foundconflictinternal_error
- messagestringrequired
  Example
  Role not found
  Description
  Human-readable error message
- detailsmap<string, string>
  Description
  Additional error details

404User not found

ErrorResponse
Description
Error payload identifying the failure by error code and message, with optional detail.
- errorstring<bad_request | unauthorized | forbidden | not_found | conflict | internal_error>required
  Example
  not_found
  Description
  Error code
  Allowed
  bad_requestunauthorizedforbiddennot_foundconflictinternal_error
- messagestringrequired
  Example
  Role not found
  Description
  Human-readable error message
- detailsmap<string, string>
  Description
  Additional error details

500Internal server error

ErrorResponse
Description
Error payload identifying the failure by error code and message, with optional detail.
- errorstring<bad_request | unauthorized | forbidden | not_found | conflict | internal_error>required
  Example
  not_found
  Description
  Error code
  Allowed
  bad_requestunauthorizedforbiddennot_foundconflictinternal_error
- messagestringrequired
  Example
  Role not found
  Description
  Human-readable error message
- detailsmap<string, string>
  Description
  Additional error details

curl

curl --request GET \
     --url https://api.upstartcommerce.com/profile-permissions/users/{userId}/permissions \
     --header 'accept: application/json'

javascript

var myHeaders = new Headers();
myHeaders.append("accept", "application/json");
myHeaders.append("content-type", "application/json");

var requestOptions = {
   method: 'GET',
   headers: myHeaders,
   redirect: 'follow'
};

fetch("https://api.upstartcommerce.com/profile-permissions/users/{userId}/permissions", requestOptions)
   .then(response => response.text())
   .then(result => console.log(result))
   .catch(error => console.log('error', error));

ruby

require "uri"
require "json"
require "net/http"

url = URI("https://api.upstartcommerce.com/profile-permissions/users/{userId}/permissions")

https = Net::HTTP.new(url.host, url.port)
https.use_ssl = true

request = Net::HTTP::Get.new(url)
request["accept"] = "application/json"
request["content-type"] = "application/json"

response = https.request(request)
puts response.read_body

python

import requests
import json

url = "https://api.upstartcommerce.com/profile-permissions/users/{userId}/permissions"

payload = {}
headers = {
   'accept': 'application/json',
   'content-type': 'application/json'
}

response = requests.request("GET", url, headers=headers, data=payload)

print(response.text)

200

// List of user permissions
{
  "userId": "",
  "permissions": [
    {
      "name": "order.read",
      "permissionDescription": "",
      "sources": [
        ""
      ],
      "grantedAt": ""
    }
  ]
}

401

// Missing or invalid authentication token
{
  "error": "not_found",
  "message": "Role not found",
  "details": ""
}

404

// User not found
{
  "error": "not_found",
  "message": "Role not found",
  "details": ""
}

500

// Internal server error
{
  "error": "not_found",
  "message": "Role not found",
  "details": ""
}