List User Permissions

GET/companies/{id}/user-permissions

Agency-scoped keys

This endpoint is not available for agency-scoped API keys.

Summary

Returns project-role users, their assigned projects, and effective project permissions using the same rules as the UI exports. Requires a company-scoped key with read:users access.

Results include inactive users and users with no assigned projects. Only projects belonging to the requested company are returned. Permissions reflect role defaults and project overrides; workflow and record-level restrictions can still apply.

Permission Coverage

This endpoint is not a complete list of everything a user can do. It reports the project-level permission rules shown in the UI permission export, evaluated through entity-based access control (EBAC) using user-specific project permissions and applicable role defaults.

Standalone role-based access control (RBAC) actions that are not represented by these permission rules are not listed. Approval value limits and additional workflow or record-level restrictions are not included in the response.

A permitted: true value means the reported project-level rule is granted; it does not guarantee that the user can perform that action on every record. An action missing from the response should not be treated as denied.

For default role-to-action mappings, see List Access Rule Mappings. Those defaults also do not describe a user's complete effective access.

URL Parameters

Name	Type	Required	Description
id	string	Yes	Company id or nanoid within the key's company scope

Query Parameters

Name	Type	Required	Description
status	string	No	active or inactive; omit to include all users
page	integer	No	Page number (default 1)
limit	integer	No	Users per page (default 50, maximum 200)
fields	string	No	Comma-separated response fields or nested paths, such as id,name,projects.id

Use ?status=active to fetch only active users. Users are treated as active unless explicitly marked inactive. The filter applies before pagination, and meta.total counts matching users. Results are ordered by name and id.

Request Example

cURL

curl -X GET 'https://api.requidex.com/api/open/v1/companies/{id}/user-permissions' \
  -H 'Authorization: Bearer <API_KEY>' \
  -H 'Accept: application/json'

JavaScript

const response = await fetch("https://api.requidex.com/api/open/v1/companies/{id}/user-permissions", {
  method: "GET",
  headers: {
    Authorization: "Bearer <API_KEY>",
    Accept: "application/json",
  },
});

const json = await response.json();

Python

import requests

response = requests.request(
    'GET',
    'https://api.requidex.com/api/open/v1/companies/{id}/user-permissions',
    headers={
        'Authorization': 'Bearer <API_KEY>',
        'Accept': 'application/json',
    },
    timeout=30,
)

print(response.json())

Go

package main

import (
  "fmt"
  "io"
  "net/http"
)

func main() {
  req, _ := http.NewRequest("GET", "https://api.requidex.com/api/open/v1/companies/{id}/user-permissions", nil)
  req.Header.Set("Authorization", "Bearer <API_KEY>")
  req.Header.Set("Accept", "application/json")

  client := &http.Client{}
  resp, err := client.Do(req)
  if err != nil {
    panic(err)
  }
  defer resp.Body.Close()

  payload, _ := io.ReadAll(resp.Body)
  fmt.Println(string(payload))
}

Response Fields

Field	Type	Description
id	string	User id
name	string	User name
email	string	User email address
role	string	Friendly project-role label
customRole	object or null	Custom role in the requested company: id and name, or null
jobTitle	string	User job title
status	string	Active or Inactive
projects	array	Assigned projects in the requested company Show child attributes id string - Project id name string - Project name permissions array - Effective project permissions Show child attributes id string - Permission rule id name string - Permission display name category string - Permission category permitted boolean - Whether the project-level permission is granted

The response envelope contains success, a data array of users, and meta with page, limit, and total user count. Raw permission records and references to other companies' projects are excluded.

The role field remains the friendly base-role label. customRole is { "id": "…", "name": "…" } for a role assigned in the requested company, or null when no custom role is assigned. Roles from other companies are not included.

Response Example (200)

{
  "success": true,
  "data": [
    {
      "id": "67bc36db80a1616ec3f47001",
      "name": "Alex Smith",
      "email": "alex@example.com",
      "role": "Project Approver",
      "customRole": { "id": "67bc36db80a1616ec3f47003", "name": "Contractor Approver" },
      "jobTitle": "Project Manager",
      "status": "Active",
      "projects": [
        {
          "id": "67bc36db80a1616ec3f47002",
          "name": "Central Office",
          "permissions": [
            {
              "id": "67bc36db80a1616ec3f47003",
              "name": "Approve Requisition",
              "category": "Requisition",
              "permitted": true
            }
          ]
        }
      ]
    }
  ],
  "meta": { "page": 1, "limit": 50, "total": 1 }
}

MCP Tool

The MCP server exposes this operation as open_api_list_company_user_permissions (operation ListCompanyUserPermissions) with inputs id, status, page, limit, and fields. The same company-only access restriction applies.

Errors

HTTP Status	Description
400	Missing company identifier or invalid user status
401	Missing, invalid, revoked, or expired API key
403	Agency-scoped key, missing read:users, or other access restriction
404	Company not found within the key's scope
429	Rate limit exceeded
500	Unexpected internal error