> ## Documentation Index > Fetch the complete documentation index at: https://docs.opal.dev/llms.txt > Use this file to discover all available pages before exploring further. # Get a user's access > Returns all of the resources and groups the user has access to, in a single list. All results are returned unless `page_size` is set, in which case the list is paginated. Includes access the user has directly and access they have indirectly (for example, through group membership or nested groups). Use `has_direct_access` and `num_access_paths` to tell them apart. Each row is one (resource or group, access level) pair. Only assignments the caller is allowed to read are returned, so the list can be empty or partial for a caller without permission to read assignments on the user's resources and groups. Results are ordered by entity ID; the order is stable across pages but has no other meaning. ## OpenAPI ````yaml https://app.opal.dev/openapi.yaml get /users/{user_id}/access openapi: 3.1.0 info: contact: email: hello@opal.dev name: Opal Team url: https://www.opal.dev/ description: >- The Opal API is a RESTful API that allows you to interact with the Opal Security platform programmatically. title: Opal API version: '1.0' servers: - description: Production url: https://api.opal.dev/v1 security: [] tags: - name: access-rules description: Operations related to access rules - name: agent-activity description: Operations related to agent activity telemetry - name: apps description: Operations related to apps - name: bundles description: Operations related to bundles - name: campaigns description: Operations related to access review campaigns - name: configuration-templates description: Operations related to configuration templates - name: delegations description: Operations related to request reviewer delegations - name: event-streams description: Operations related to event streaming connections - name: events description: Operations related to events - name: groups description: Operations related to groups - name: group-bindings description: Operations related to group bindings - name: idp-group-mappings description: Operations related to IDP group mappings - name: message-channels description: Operations related to message channels - name: non-human-identities description: Operations related to non-human identities - name: on-call-schedules description: Operations related to on-call schedules - name: opal-queries description: Operations related to OpalQuery - name: opal-scripts description: Operations related to OpalScripts - name: owners description: Operations related to owners - name: requests description: Operations related to requests - name: resources description: Operations related to resources - name: role-assignments description: >- Operations related to role assignments (general grants between an entity and a principal) - name: paladin description: Operations related to Paladin - name: service-users description: Operations related to service users (non-human identities owned by a team) - name: sessions description: Operations related to sessions - name: tags description: Operations related to tags - name: tokens description: Operations related to API tokens - name: uars description: Operations related to UARs. Deprecated in favor of the `campaigns` API. - name: users description: Operations related to users paths: /users/{user_id}/access: get: tags: - users summary: Get a user's access description: > Returns all of the resources and groups the user has access to, in a single list. All results are returned unless `page_size` is set, in which case the list is paginated. Includes access the user has directly and access they have indirectly (for example, through group membership or nested groups). Use `has_direct_access` and `num_access_paths` to tell them apart. Each row is one (resource or group, access level) pair. Only assignments the caller is allowed to read are returned, so the list can be empty or partial for a caller without permission to read assignments on the user's resources and groups. Results are ordered by entity ID; the order is stable across pages but has no other meaning. operationId: get_user_access parameters: - description: The ID of the user whose access to return. example: 32acc112-21ff-4669-91c2-21e27683eaa1 name: user_id in: path required: true schema: type: string format: uuid style: simple - description: >- The `next` cursor from a previous response. Resumes the list at that point. example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw explode: true in: query name: cursor required: false schema: type: string style: form - description: > Number of results to return per page. Maximum is 1000. If omitted, all results are returned in a single response and `next` is null. example: 200 explode: true in: query name: page_size required: false schema: type: integer maximum: 1000 style: form - description: >- Only return access to this type of entity. Omit to return both resources and groups. explode: true in: query name: entity_type required: false schema: $ref: '#/components/schemas/UserAccessEntityTypeEnum' style: form - description: Include the user's access to unmanaged resources. example: false explode: true in: query name: include_unmanaged required: false schema: type: boolean style: form responses: '200': content: application/json: schema: $ref: '#/components/schemas/UserAccessList' description: The resources and groups the user has access to. '400': description: The cursor, `entity_type`, or `user_id` is invalid. '404': description: The user was not found. security: - BearerAuth: [] components: schemas: UserAccessEntityTypeEnum: description: The type of entity a user has access to. enum: - GROUP - RESOURCE example: RESOURCE type: string UserAccessList: description: >- A user's access to resources and groups, or one page of it if `page_size` was set. properties: results: items: $ref: '#/components/schemas/UserAccess' type: array next: description: >- The cursor with which to continue pagination if additional result pages exist. example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw nullable: true type: string previous: description: The cursor used to obtain the current result page. example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ nullable: true type: string required: - results type: object UserAccess: description: >- # User Access Object ### Description The `UserAccess` object represents a user's access to a single resource or group at one access level, either directly or indirectly (for example, through group membership). ### Usage Example Fetch from the `GET /users/{user_id}/access` endpoint. example: entity_type: RESOURCE entity_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3 entity_name: AdministratorAccess description: Full access to all resources and settings. access_level: access_level_name: AdminRole access_level_remote_id: arn:aws:iam::590304332660:role/AdministratorAccess expiration_date: '2022-01-23T04:56:07.000Z' has_direct_access: false num_access_paths: 2 properties: entity_type: $ref: '#/components/schemas/UserAccessEntityTypeEnum' entity_id: description: The ID of the resource or group. example: 1b978423-db0a-4037-a4cf-f79c60cb67b3 format: uuid type: string entity_name: description: The name of the resource or group. example: AdministratorAccess type: string description: description: The description of the resource or group. example: Full access to all resources and settings. type: string access_level: $ref: '#/components/schemas/UserAccessLevel' expiration_date: description: >- The day and time the user's access will expire. If the user has more than one way to access the entity, this is the latest expiration. Null if the access does not expire. example: '2022-01-23T04:56:07.000Z' format: date-time nullable: true type: string has_direct_access: description: >- The user has direct access to this entity (vs. indirectly, like through a group). example: true type: boolean num_access_paths: description: >- The number of ways in which the user has access to this entity (directly and indirectly). example: 2 format: int32 type: integer propagation_status: $ref: '#/components/schemas/PropagationStatus' required: - entity_type - entity_id - entity_name - description - access_level - has_direct_access - num_access_paths type: object UserAccessLevel: description: >- The level of access the user has to a resource or group. The "default" access level is an object whose fields are all empty strings. example: access_level_name: Developer access_level_remote_id: '20' properties: access_level_name: description: The human-readable name of the access level. example: Developer type: string access_level_remote_id: description: The machine-readable identifier of the access level. example: '20' type: string required: - access_level_name - access_level_remote_id type: object PropagationStatus: description: >- The state of whether the push action was propagated to the remote system. If this is null, the access was synced from the remote system. properties: status: $ref: '#/components/schemas/PropagationStatusEnum' required: - status PropagationStatusEnum: description: >- The status of whether the user has been synced to the group or resource in the remote system. enum: - SUCCESS - ERR_REMOTE_INTERNAL_ERROR - ERR_REMOTE_USER_NOT_FOUND - ERR_REMOTE_USER_NOT_LINKED - ERR_REMOTE_RESOURCE_NOT_FOUND - ERR_REMOTE_THROTTLE - ERR_NOT_AUTHORIZED_TO_QUERY_RESOURCE - ERR_REMOTE_PROVISIONING_VIA_IDP_FAILED - ERR_IDP_EMAIL_UPDATE_CONFLICT - ERR_TIMEOUT - ERR_UNKNOWN - ERR_OPAL_INTERNAL_ERROR - ERR_ORG_READ_ONLY - ERR_OPERATION_UNSUPPORTED - PENDING - PENDING_MANUAL_PROPAGATION - PENDING_TICKET_CREATION - ERR_TICKET_CREATION_SKIPPED - ERR_DRY_RUN_MODE_ENABLED - ERR_HR_IDP_PROVIDER_NOT_LINKED - ERR_REMOTE_UNRECOVERABLE_ERROR - ERR_REMOTE_TICKET_NOT_FOUND - ERR_CONNECTION_VALIDATION_FAILED example: - SUCCESS type: string securitySchemes: BearerAuth: scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.