- Getting started
- Authentication
- Scopes and permissions
- Platform Management APIs
- API rate limits for Identity Server
- Retrieving partitionGlobalId for API use
- Alerts
- Get organization-level effective access
- Export user role assignments
Organization-level effective access API for retrieving a principal's roles and assignments across active tenants in Automation Cloud.
Retrieves effective access for a user, group, or external application across an organization. The response combines organization-scoped assignments with tenant-level assignments from every active tenant. Folder-level assignment details are not included.
API endpoint
POST {accessURL}/{organizationName}/pdp_/api/geteffectiveaccess
Replace {accessURL} with the base URL for your cloud platform:
| Cloud platform | Access URL |
|---|---|
| Automation Cloud | https://cloud.uipath.com |
| Automation Cloud Public Sector | https://govcloud.uipath.us |
| Automation Cloud Dedicated | https://{customURL}.dedicated.uipath.com |
Permissions
For requests made with a user access token, the caller must be an Organization Administrator. Tenant Administrators receive a 403 Forbidden response.
Request headers
Authorization: Bearer {access_token}
Content-Type: application/json
Authorization: Bearer {access_token}
Content-Type: application/json
For information about obtaining an access token, see Authentication methods.
Query parameters
| Query parameter | Data type | Description |
|---|---|---|
top | Integer | Maximum number of role-assignment groups to return. The default is 10, and the maximum is 50. The value cannot be negative. |
skip | Integer | Number of role-assignment groups to skip. The default is 0, and the value cannot be negative. |
Request body
The following example retrieves organization-level effective access for one security principal:
{
"securityPrincipalId": "00000000-0000-0000-0000-000000000001",
"scopeIdentifier": {
"scopeType": "Organization"
}
}
{
"securityPrincipalId": "00000000-0000-0000-0000-000000000001",
"scopeIdentifier": {
"scopeType": "Organization"
}
}
| Property | Data type | Description |
|---|---|---|
securityPrincipalId | String (GUID) | Identifier of the user, group, or external application whose effective access is returned. |
scopeIdentifier.scopeType | String | Must be Organization for organization-level results. The value is case-insensitive. |
scopeIdentifier.value.id | String (GUID) | Optional organization identifier. If included, it must match the caller's organization. |
serviceName | String | Optional service-name filter. Only assignments for the specified service are returned. |
roleNameStartsWith | String | Optional role-name prefix filter. Only assignments whose role name starts with the specified value are returned. |
Responses
200 OK
Returns the effective access information for the requested security principal.
| Response property | Description |
|---|---|
roleAssignments | Paginated assignment groups, keyed by tenant and role. Groups without a tenantId contain organization-scoped assignments. Organization-scoped groups appear before tenant-scoped groups. |
grantedServicesMetadata | Non-paginated organization-wide list of services for which the principal has a role assignment. |
grantedRolesMetadata | Non-paginated organization-wide list of roles granted to the principal. |
400 Bad Request
Returned when pagination values are invalid or when scopeIdentifier.value.id does not match the caller's organization.
401 Unauthorized
Returned when the bearer token is missing or invalid.
403 Forbidden
Returned when a user-token caller is not an Organization Administrator.
Example request
curl --location --request POST 'https://cloud.uipath.com/{organizationName}/pdp_/api/geteffectiveaccess?top=10&skip=0' \
--header 'Authorization: Bearer {access_token}' \
--header 'Content-Type: application/json' \
--data-raw '{
"securityPrincipalId": "00000000-0000-0000-0000-000000000001",
"scopeIdentifier": {
"scopeType": "Organization"
}
}'
curl --location --request POST 'https://cloud.uipath.com/{organizationName}/pdp_/api/geteffectiveaccess?top=10&skip=0' \
--header 'Authorization: Bearer {access_token}' \
--header 'Content-Type: application/json' \
--data-raw '{
"securityPrincipalId": "00000000-0000-0000-0000-000000000001",
"scopeIdentifier": {
"scopeType": "Organization"
}
}'