# User Management API

> For AI agents: a documentation index is available at [/docs/llms.txt](/docs/llms.txt). Append `.md` to any page URL for markdown, or send `Accept: text/markdown`.

The User Management API lets you manage RBAC project role assignments, group membership, and effective access through API calls instead of the Amplitude UI.

Use it to automate access management at scale—for example during migrations, when integrating with identity providers, or when you need to script role changes across many users and projects.

## Prerequisites

- An **Enterprise** Amplitude organization.
- An **Organization API key** and **Organization secret key** (HTTP Basic auth). Contact [Amplitude Support](https://support.amplitude.com) with your Organization ID to request a secret key if you do not have one.
- Your **Organization ID**.

## Regions

The base URL depends on your organization's data residency. Use the **US** or **EU** base URL from the table below.

| Data residency | Base URL |
| --- | --- |
| US | `https://core.amplitude.com` |
| EU | `https://core.eu.amplitude.com` |

All routes are under `/user-management/1/`. The organization is determined by your API credentials, not the URL.

## What you can do

| Area | Description |
| --- | --- |
| [Project role assignments](https://amplitude.com/docs/apis/user-management/project-role-assignments/list-project-role-assignments) | Create, list, update, and delete explicit project role assignments for users and groups. |
| [Roles](https://amplitude.com/docs/apis/user-management/roles/list-roles) | List and fetch role definitions in your organization. |
| [Groups](https://amplitude.com/docs/apis/user-management/groups/remove-group-member) | Remove a user from a permission group. |
| [Effective access](https://amplitude.com/docs/apis/user-management/effective-access/get-user-effective-access) | Read resolved access for a user or project. |

## Common use cases

### Automate project role assignments

Assign or update project-level roles programmatically when onboarding users, running migrations, or syncing access from an internal system.

### Complement SCIM provisioning

[SCIM](https://amplitude.com/docs/apis/analytics/scim) automates user provisioning and permission-group membership from an identity provider. The User Management API adds programmatic control over **project role assignments**, the layer SCIM does not manage directly.

Typical pattern: define groups and project roles in Amplitude, keep group membership in sync with SCIM, and use the User Management API to assign or change project roles at scale.

### Verify access before or after changes

Use effective-access endpoints to confirm what access a user or project has after assignment changes.