# Get user effective access

> For AI agents: a documentation index is available at [/docs/llms.txt](/docs/llms.txt). Append `.md` to any page URL for markdown, or send `Accept: text/markdown`.

## Get user effective access

**GET** `/user-management/1/users/{userId}/effective-access`

Full URL: `https://core.amplitude.com/user-management/1/users/{userId}/effective-access`

**Servers:**
- US region: `https://core.amplitude.com/user-management/1/users/{userId}/effective-access`
- EU region: `https://core.eu.amplitude.com/user-management/1/users/{userId}/effective-access`

Get user effective access

Returns the resolved project access for a user, including access granted directly, via groups, and via organization-level grants.

## Authorizations

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| Authorization | string | Yes | — | **Contact Amplitude Support** to obtain your organization's **org API key** and **org secret key**. Send them as **HTTP Basic** credentials on every request: org API key in the **username** field, org secret key in the **password** field. Also include `orgId` as a query parameter for your organization. **401**: invalid credentials. **403** (`org_not_enrolled`): your organization is not enabled for this API. |

## Path parameters

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| userId (path) | string | Yes | — | User id to resolve effective project access for. |

## Query parameters

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| orgId (query) | integer | Yes | — | Organization id for the authenticated API caller. Must match the organization tied to the org key pair in the Authorization header. Constraints: min: 1 |
| cursor (query) | string | No | — | Opaque pagination cursor from a previous response `pagination.nextCursor`. Omit to start at the first page. |
| limit (query) | integer | No | — | Maximum number of items per page. Defaults to 50 when omitted and is capped at 200. Constraints: min: 1, max: 200 |

## Response (application/json)

**200** — User effective access found

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| data | object[] | Yes | — | — |
| data.principalId | string | Yes | — | — |
| data.principalType | string | Yes | — | Allowed values: user, group |
| data.appId | integer | Yes | — | Constraints: min: 0 |
| data.role | object | Yes | {"uuid":"3fa85f64-5717-4562-b3fc-2c963f66afa6","name":"Experiment Manager","orgId":36958,"tags":{"product":["experiment"],"type":"custom"}} | A role as returned by the User Management API. Omits internal permission actions. |
| data.role.uuid | string | Yes | — | Constraints: format: uuid |
| data.role.name | string | Yes | — | — |
| data.role.orgId | integer | No | — | Constraints: min: 0 |
| data.role.tags | object | Yes | {"product":["experiment"],"type":"custom"} | Tags associated with a role. Use the "description" key for a human readable summary. |
| data.source | string | Yes | — | Allowed values: direct, group, org-direct, org-group |
| pagination | object | Yes | {"nextCursor":0,"hasMore":true} | Cursor pagination metadata. `nextCursor` is the cursor to pass to fetch the next page, or `null` when there are no more results. `hasMore` indicates whether another page is available. |
| pagination.nextCursor | string | Yes | — | Constraints: nullable |
| pagination.hasMore | boolean | Yes | — | — |

```json
{
  "data": [
    {
      "principalId": "john.doe@amplitude.com",
      "principalType": "user",
      "appId": 187520,
      "role": {
        "uuid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
        "name": "Experiment Manager",
        "orgId": 36958,
        "tags": {
          "product": [
            "experiment"
          ],
          "type": "custom"
        }
      },
      "source": "direct"
    }
  ],
  "pagination": {
    "nextCursor": null,
    "hasMore": false
  }
}
```

**400** — Invalid request parameters or body

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| type | string | Yes | — | RFC 7807 problem type URI Constraints: format: uri |
| title | string | Yes | — | — |
| status | integer | Yes | — | — |
| detail | string | No | — | Constraints: nullable |
| instance | string | No | — | Constraints: nullable |
| error_code | string | Yes | — | Allowed values: invalid_request, authentication_required, insufficient_permissions, org_id_mismatch, org_not_enrolled, not_found, conflict, rate_limited, internal_error |
| retryable | boolean | Yes | — | — |
| retry_after_seconds | integer | No | — | Constraints: nullable |

```json
{
  "type": "https://amplitude.com/problems/user-management/invalid-request",
  "title": "Invalid request parameters or body",
  "status": 400,
  "error_code": "invalid_request",
  "detail": "Request body failed validation",
  "instance": null,
  "retryable": false,
  "retry_after_seconds": null
}
```

**401** — Missing or invalid credentials

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| type | string | Yes | — | RFC 7807 problem type URI Constraints: format: uri |
| title | string | Yes | — | — |
| status | integer | Yes | — | — |
| detail | string | No | — | Constraints: nullable |
| instance | string | No | — | Constraints: nullable |
| error_code | string | Yes | — | Allowed values: invalid_request, authentication_required, insufficient_permissions, org_id_mismatch, org_not_enrolled, not_found, conflict, rate_limited, internal_error |
| retryable | boolean | Yes | — | — |
| retry_after_seconds | integer | No | — | Constraints: nullable |

```json
{
  "type": "https://amplitude.com/problems/user-management/authentication-required",
  "title": "Missing or invalid credentials",
  "status": 401,
  "error_code": "authentication_required",
  "detail": "Missing or invalid org API credentials",
  "instance": null,
  "retryable": false,
  "retry_after_seconds": null
}
```

**403** — Not allowed (org not enrolled, orgId mismatch, or insufficient permissions)

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| type | string | Yes | — | RFC 7807 problem type URI Constraints: format: uri |
| title | string | Yes | — | — |
| status | integer | Yes | — | — |
| detail | string | No | — | Constraints: nullable |
| instance | string | No | — | Constraints: nullable |
| error_code | string | Yes | — | Allowed values: invalid_request, authentication_required, insufficient_permissions, org_id_mismatch, org_not_enrolled, not_found, conflict, rate_limited, internal_error |
| retryable | boolean | Yes | — | — |
| retry_after_seconds | integer | No | — | Constraints: nullable |

```json
{
  "type": "https://amplitude.com/problems/user-management/org-not-enrolled",
  "title": "Not allowed (org not enrolled, orgId mismatch, or insufficient permissions)",
  "status": 403,
  "error_code": "org_not_enrolled",
  "detail": "This organization is not enrolled in the User Management API",
  "instance": null,
  "retryable": false,
  "retry_after_seconds": null
}
```

**404** — This user does not exist or belongs to another org

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| type | string | Yes | — | RFC 7807 problem type URI Constraints: format: uri |
| title | string | Yes | — | — |
| status | integer | Yes | — | — |
| detail | string | No | — | Constraints: nullable |
| instance | string | No | — | Constraints: nullable |
| error_code | string | Yes | — | Allowed values: invalid_request, authentication_required, insufficient_permissions, org_id_mismatch, org_not_enrolled, not_found, conflict, rate_limited, internal_error |
| retryable | boolean | Yes | — | — |
| retry_after_seconds | integer | No | — | Constraints: nullable |

```json
{
  "type": "https://amplitude.com/problems/user-management/not-found",
  "title": "This user does not exist or belongs to another org",
  "status": 404,
  "error_code": "not_found",
  "detail": "The requested resource does not exist or belongs to another org",
  "instance": null,
  "retryable": false,
  "retry_after_seconds": null
}
```

**429** — Rate limit exceeded

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| type | string | Yes | — | RFC 7807 problem type URI Constraints: format: uri |
| title | string | Yes | — | — |
| status | integer | Yes | — | — |
| detail | string | No | — | Constraints: nullable |
| instance | string | No | — | Constraints: nullable |
| error_code | string | Yes | — | Allowed values: invalid_request, authentication_required, insufficient_permissions, org_id_mismatch, org_not_enrolled, not_found, conflict, rate_limited, internal_error |
| retryable | boolean | Yes | — | — |
| retry_after_seconds | integer | No | — | Constraints: nullable |

```json
{
  "type": "https://amplitude.com/problems/user-management/rate-limited",
  "title": "Rate limit exceeded",
  "status": 429,
  "error_code": "rate_limited",
  "detail": "Rate limit exceeded",
  "instance": null,
  "retryable": true,
  "retry_after_seconds": 60
}
```

**500** — Unexpected server error

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| type | string | Yes | — | RFC 7807 problem type URI Constraints: format: uri |
| title | string | Yes | — | — |
| status | integer | Yes | — | — |
| detail | string | No | — | Constraints: nullable |
| instance | string | No | — | Constraints: nullable |
| error_code | string | Yes | — | Allowed values: invalid_request, authentication_required, insufficient_permissions, org_id_mismatch, org_not_enrolled, not_found, conflict, rate_limited, internal_error |
| retryable | boolean | Yes | — | — |
| retry_after_seconds | integer | No | — | Constraints: nullable |

```json
{
  "type": "https://amplitude.com/problems/user-management/internal-error",
  "title": "Unexpected server error",
  "status": 500,
  "error_code": "internal_error",
  "detail": "An unexpected error occurred",
  "instance": null,
  "retryable": false,
  "retry_after_seconds": null
}
```

## Code samples

### cURL

```bash
curl -X GET "https://core.amplitude.com/user-management/1/users/{userId}/effective-access" \
  -u "$AMP_API_KEY:$AMP_SECRET" \
  -H "Content-Type: application/json"
```

### Python

```python
import requests

response = requests.get(
    "https://core.amplitude.com/user-management/1/users/{userId}/effective-access",
    headers={
        "Content-Type": "application/json"
    },
    auth=("$AMP_API_KEY", "$AMP_SECRET")
)
data = response.json()
```

### JavaScript

```javascript
const response = await fetch("https://core.amplitude.com/user-management/1/users/{userId}/effective-access", {
  method: "GET",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "Basic " + btoa("$AMP_API_KEY:$AMP_SECRET")
  }
});
const data = await response.json();
```

### PHP

```php
<?php
$ch = curl_init("https://core.amplitude.com/user-management/1/users/{userId}/effective-access");
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Content-Type: application/json"
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_USERPWD, "$AMP_API_KEY:$AMP_SECRET");
$response = curl_exec($ch);
curl_close($ch);
```

### Go

```go
package main

import (
  "bytes"
  "net/http"
)

func main() {
req, _ := http.NewRequest("GET", "https://core.amplitude.com/user-management/1/users/{userId}/effective-access", nil)
req.Header.Set("Content-Type", "application/json")
req.SetBasicAuth("$AMP_API_KEY", "$AMP_SECRET")
  client := &http.Client{}
  resp, _ := client.Do(req)
  defer resp.Body.Close()
}
```

### Java

```java
HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
      .uri(URI.create("https://core.amplitude.com/user-management/1/users/{userId}/effective-access"))
      .method("GET", HttpRequest.BodyPublishers.noBody())
.header("Content-Type", "application/json")
      .header("Authorization", "Basic " + Base64.getEncoder().encodeToString("$AMP_API_KEY:$AMP_SECRET".getBytes()))
      .build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
```

### Ruby

```ruby
require "net/http"
require "json"

uri = URI("https://core.amplitude.com/user-management/1/users/{userId}/effective-access")
request = Net::HTTP::Get.new(uri)
request["Content-Type"] = "application/json"
request.basic_auth("$AMP_API_KEY", "$AMP_SECRET")
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end
```