List role assignments from the local PDP

List the role assignments stored in your container policy decision point (PDP), filtered by user, tenant, role, resource type, or resource instance. This page is for developers who need a user's roles, or the roles on a resource, at request time. The PDP answers from the policy data it already holds, so the request doesn't go to the Permit cloud API.

Prerequisites

• A container PDP, version permitio/pdp-v2:0.3.0 or later (Deploy the PDP to production). The Cloud PDP doesn't serve local APIs (Cloud PDP capabilities).
• The Python SDK client (from permit.sync import Permit) configured with the container PDP address, or HTTP access to the PDP

To request another local API, ask in the Permit Slack community.

List role assignments

Call permit.pdp_api.role_assignments.list() in the Python SDK, or GET /local/role_assignments on the PDP. Every filter is optional, and you can combine filters to narrow the result.

Python argument	REST query parameter	Returns role assignments
user_key	user	Granted to this user.
role_key	role	Granting this role.
tenant_key	tenant	Granted in this tenant.
resource_key	resource	Granted on instances of this resource type.
resource_instance_key	resource_instance	Granted on this resource instance, in resource_type:resource_key format.
page	page	Page number, starting from 1.
per_page	per_page	Results per page, up to 100. The Python SDK default is 100; the REST default is 30.

The result is paginated. To get every role assignment, request the next page until a page returns fewer results than per_page.

Read the role assignments result

The result is a list of role assignments with these fields:

Field	Description
user	The user the role is assigned to.
role	The assigned role.
tenant	The tenant of the role assignment. For a resource role, the tenant of the resource instance.
resource_instance	For a resource role only: the resource instance, in resource_type:resource_key format.

[
    {
        "user": "jane@coolcompany.com",
        "role": "admin",
        "tenant": "stripe-inc"
    },
    {
        "user": "jane@coolcompany.com",
        "role": "admin",
        "tenant": "stripe-inc",
        "resource_instance": "document:doc-1234"
    }
]

The first item is a tenant-level role assignment. The second item is a role on the resource instance document:doc-1234.

Filter role assignments

List all role assignments

Call list() without filters to return the first page of all role assignments in the PDP.

Python

from typing import List
from permit.pdp_api.models import RoleAssignment

role_assignments: List[RoleAssignment] = permit.pdp_api.role_assignments.list()

List the role assignments of a user

Pass user_key to get every role assigned to one user, for example to decide what to show that user.

Python

from typing import List
from permit.pdp_api.models import RoleAssignment

role_assignments: List[RoleAssignment] = permit.pdp_api.role_assignments.list(
    user_key="john@permit.io",
)

List the role assignments on a resource instance

Pass resource_instance_key to get every role assigned on one resource instance, for example to list who has access to a document.

Python

from typing import List
from permit.pdp_api.models import RoleAssignment

role_assignments: List[RoleAssignment] = permit.pdp_api.role_assignments.list(
    resource_instance_key="document:onboarding-doc",
)

Next steps

• List the users authorized on a resource
• Get all permissions of a user
• Check permissions with permit.check()