Returns every permission the user holds, for auditing access. Currently reports audience management permissions and space permissions; further domains may be added to the permissions object over time.
Audience membership is not reported here - it is already available as the audiences field on the user object.
Space permissions report what the user has been granted: their own space memberships plus any granted through a group they belong to, minus any space they have left or been removed from. Access that a space grants to everyone, regardless of membership, is not reported.
Grants are reported as stored, so a space that has since been deleted or archived is still listed while the membership record exists, and a suspended or expired user is still reported with the roles they hold. Suppressing either would hide access an audit exists to surface. This row reports deleted; for the user's status, read GET /users/{id}.
HTTP Basic authentication using your Tenant ID and API secret.
- Username is the Tenant ID (i.e.
eu-west-2_AbcdEfghI) - Password is the API secret you would have received.
You can also authenticate using OAuth 2.0 client credentials (oauth2 security scheme) instead of Basic auth.
OAuth 2.0 client credentials authentication.
Use the following token endpoints (replace :tenantId with your Tenant ID):
Public API access tokens
- Staging:
https://public.api.learnstaging.link/oauth2/token/:tenantId - Production:
https://public.api.learn.link/oauth2/token/:tenantId - Staging MEA:
https://public.api.meastaging.learn.tech/oauth2/token/:tenantId - Production MEA:
https://public.api.mea.learn.tech/oauth2/token/:tenantId
- Staging:
Webhooks access tokens
- Staging:
https://user.api.learnstaging.link/oauth2/token/:tenantId - Production:
https://user.api.learn.link/oauth2/token/:tenantId - Staging MEA:
https://user.api.meastaging.learn.tech/oauth2/token/:tenantId - Production MEA:
https://user.api.mea.learn.tech/oauth2/token/:tenantId
- Staging:
All access tokens must be sent using the Authorization: Bearer <access_token> header.
Scopes
For API access (non-webhooks), the following scopes are available:
api/all– Full read and write access to the API.api/read– Read-only access to the API.api/write– Write access to the API.
For webhooks, the following scopes are available:
api/webhooks– Access to webhook functionality.api/all– Full read and write access to the API, including webhooks.
Tokens must include appropriate scopes for the endpoints you wish to call.
Filter by user
The user's permissions
{
"userId": "646767d82535201223349e09",
"ref": "xyzabc",
"permissions": {
"audiences": [
{
"audienceId": "651f0f5a2535201223349e09",
"name": "Store Managers",
"reference": "store-managers",
"permissions": {
"audienceManager": {
"manageMembers": true,
"manageUsers": false,
"manageContent": true,
"assignments": true,
"canViewUserAnalytics": false
},
"peopleManager": {
"analyticsAndReports": false,
"insights": true,
"canManageGoals": false,
"manage": true,
"canViewLearnPage": true,
"canViewComplianceReports": false
}
}
}
],
"spaces": [
{
"spaceId": "651f0f5a2535201223349e09",
"roles": [
"space.admin"
],
"permissions": [
"space.analytics.view",
"space.blocks.edit",
"space.interact",
"space.manage",
"space.members.manage",
"space.moderate",
"space.publish",
"space.view"
]
}
]
}
}A permission audit row for a single user.
The user's ID.
The user's ref.
Whether the user has been deleted. Deleted users are reported rather than omitted, so permissions they still hold remain visible to an audit instead of disappearing from it.
A user's permissions, grouped by domain. Additional domains may be added over time, so treat unknown keys as forward-compatible additions rather than errors.
Audiences the user holds a management role on. Audience membership is reported separately, in the audiences field of the user object.
One audience a user holds management permissions on.
The audience's ID.
The audience's name.
The audience's reference, when it has one.
The permissions a user holds on a single audience, grouped by the role that grants them. A role key is present only if the user holds that role on the audience, so the keys present are themselves the role attribution.
The administrator permissions set - only available on structures/ parent audiences.
Whether the user can create/edit child audiences.
Whether the user can add or edit managers for child audiences.
The audience manager permissions set
Whether the user can add/remove members for the audience.
Whether the user can manage users within the audience.
Whether the user can share/unshare content for the audience.
Whether the user can create/edit/remove assignments for the audience.
Whether the user can view analytics for audience members.
The people manager permissions set
Whether the user can view analytics and reports.
Whether the user can view insights into how the audience is using content and search.
Whether the user can add/edit goals for audience members.
Whether the user can manage audience members.
Whether the user can view the learn page of audience members.
Whether the user can run compliance reports on assignments associated to audience members.
Spaces the user holds access to. Reports only permissions granted to this user, so a space open to everyone is listed only where the user also holds a role on it.
One space the user holds access to, whether granted to them directly or through a group they belong to.
A space the user has left, or has been removed from, is not reported at all - even where a group would otherwise still grant it.
Reported as stored: a space that has since been deleted or archived is still listed while its membership record exists.
The space's ID.
The roles the user holds on the space, deduplicated across direct and group-derived grants, and sorted.
A role outside the published catalogue is still reported here, and contributes nothing to permissions.
What those roles let the user do, deduplicated and sorted. Empty when none of the user's roles is recognised.
Bad Request
Bad Request
Unauthorized
Unauthorized
Not Found
Not found
Internal Server Error
Internal Server Error