Get all permissions of a user

Get every permission a user has, in every tenant and on every resource instance, in one call to the policy decision point (PDP). This page is for developers who build permission-aware UIs or pre-filter data, and need "what can this user do?" instead of a single yes-or-no permit.check().

Prerequisites

• A Permit SDK client connected to a PDP (Run the PDP)
• Users with role assignments in Permit (Sync users)

Get user permissions function by SDK

SDK	Function
Node.js	permit.getUserPermissions(user, tenants?, resources?, resource_types?)
Python	permit.get_user_permissions(user, tenants=None, resources=None, resource_types=None)
Java	permit.getUserPermissions(GetUserPermissionsQuery query)
Go	permit.GetUserPermissions(user, tenants ...string) and permit.GetUserPermissionsWithOptions(user, opts ...)
PDP API	POST /user-permissions

Get all permissions of a user

Pass the user key. Optionally pass tenant keys to limit the result to those tenants.

Node.js

const { Permit } = require("permitio");

const permit = new Permit({ token: "<YOUR_API_KEY>", pdp: "http://localhost:7766" });
const userPermissions = await permit.getUserPermissions("john@doe.com");

Java

import io.permit.sdk.Permit;
import io.permit.sdk.PermitConfig;
import io.permit.sdk.enforcement.*;
import java.util.Arrays;


Permit permit = new Permit(
    new PermitConfig.Builder("[YOUR_API_KEY]").build()
);

UserPermissions permissions = permit.getUserPermissions(
	new GetUserPermissionsQuery(
		User.fromString("john@doe.com")
	)
);

GoLang

package main

import (
	"encoding/json"
	"fmt"
)
import p "github.com/permitio/permit-golang/pkg/permit"
import "github.com/permitio/permit-golang/pkg/config"
import "github.com/permitio/permit-golang/pkg/enforcement"

func main() {
	// Create permit client
	permitConfig := config.NewConfigBuilder("<YOUR_API_TOKEN>").Build()
	permit := p.NewPermit(permitConfig)

	// Create user and resource variables
	user := enforcement.UserBuilder("john@doe.com").Build()

	var userPermissions enforcement.UserPermissions
	// List user permissions
	userPermissions, err := permit.GetUserPermissions(
		user,
		// Optionally, you can specify a list of tenants to filter
		"tenant-1",
		"tenant-2",
    )
	if err != nil {
		fmt.Printf("Error getting user permissions: %s", err)
	} else if len(userPermissions) > 0 {
		fmt.Println("John has a role assigned to some tenant in the environment")
		for tenant, permissionsInTenant := range userPermissions {
			attributes, _ := json.MarshalIndent(permissionsInTenant.Tenant.Attributes, "", "\t")
			fmt.Printf("Allowed Tenant is '%s', attributes are:\n%s\nAllowed permissions are:\n%+q",
				tenant, attributes, permissionsInTenant.Permissions,
			)
		}
	} else {
		fmt.Println("John is NOT PERMITTED to perform any action in any tenant in the environment")
	}
}

Read the user permissions result

The result is an object keyed by the object the permissions apply to: a tenant or a resource instance. Each value contains:

Field	Description
tenant	The tenant key and tenant attributes.
resource	For a resource instance: the resource type, key, and attributes.
permissions	The permissions the user has on the object, in resource:action format, for example document:read.
roles	The roles that grant the permissions.

An empty object means the user has no permissions in the environment.

Include ABAC permissions in the result

By default, the result includes only permissions from role assignments: role-based access control (RBAC) and relationship-based access control (ReBAC). To also include permissions granted by attribute-based access control (ABAC) rules, set enable_abac_user_permissions to true in the request context. ABAC evaluation takes more PDP resources, so enable the flag only on requests that need it.

When you enable ABAC permissions:

• Pass resource_types. The PDP needs the resource types to evaluate ABAC rules.
• Add __tenant to resource_types to keep tenant-level (RBAC) permissions in the result.
• Run a container PDP. The Cloud PDP doesn't evaluate ABAC policies (Cloud PDP capabilities).

The Node.js and Python SDK functions don't take a context argument. From those languages, call the PDP API directly.

cURL

Replace localhost:7766 with the PDP address as seen from the caller, and <api key> with your environment API key.

curl --location 'http://localhost:7766/user-permissions' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <api key>' \
--data '{
    "user": {
        "key": "eddie"
    },
    "resource_types": [
        "document",
        "__tenant"
    ],
    "context": {
        "enable_abac_user_permissions": true
    }
}'

Java

import io.permit.sdk.Permit;
import io.permit.sdk.PermitConfig;
import io.permit.sdk.enforcement.*;
import io.permit.sdk.util.Context;
import java.util.Arrays;


Permit permit = new Permit(
    new PermitConfig.Builder("[YOUR_API_KEY]").build()
);

Context context = new Context();
context.put("enable_abac_user_permissions", new Boolean(true));

UserPermissions permissions = permit.getUserPermissions(
	new GetUserPermissionsQuery(
		User.fromString("john@doe.com"), // user key
		null, // tenants filter is not required for ABAC
		Arrays.asList("document", "__tenant"), // resource types is always required for ABAC, __tenants is required to not ignore RBAC-based permissions
		null, // resources not required
		context
	)
);

Get user permissions directly from OPA

The PDP evaluates policies with an embedded Open Policy Agent (OPA) engine. Under high load, the Java SDK can query OPA directly with permit.getUserPermissionsFromOPA(), which skips the PDP's HTTP layer. To use it:

1. Expose the OPA port (8181) of the PDP container. See Exposing OPA within the PDP.
2. If OPA isn't at http://localhost:8181, set the address with PermitConfig.Builder.withOpaAddress().

import io.permit.sdk.Permit;
import io.permit.sdk.PermitConfig;
import io.permit.sdk.enforcement.*;
import io.permit.sdk.util.Context;
import java.util.Arrays;


Permit permit = new Permit(
    new PermitConfig.Builder("[YOUR_API_KEY]").build()
);

UserPermissions permissions = permit.getUserPermissionsFromOPA(
	new GetUserPermissionsQuery(
		User.fromString("john@doe.com")
	)
);

Filter the user permissions result

Limit the result with one or more filters:

Filter	Returns
tenants	Permissions in the listed tenants only.
resource_types	Permissions on instances of the listed resource types only. Use __tenant to get tenant-level permissions only.
resources	Permissions on the listed resource instances only, in resource_type:resource_key format.

The argument order differs by SDK. In Node.js and Python, the order is tenants, resources, resource_types. In the Java GetUserPermissionsQuery constructor, the order is tenants, resource_types, resources. In Go, use enforcement.WithTenants(), enforcement.WithResources(), and enforcement.WithResourceTypes() with GetUserPermissionsWithOptions().

Node.js

const { Permit } = require("permitio");

const permit = new Permit({ token: "<YOUR_API_KEY>", pdp: "http://localhost:7766" });
const userPermissions = await permit.getUserPermissions(
    "john@doe.com",
    ["tenant-1", "tenant-2"], // tenants
    ["document:doc-1", "document:doc-2"], // resources
    ["document", "__tenant"], // resource_types
);

Java

import io.permit.sdk.Permit;
import io.permit.sdk.PermitConfig;
import io.permit.sdk.enforcement.*;
import java.util.Arrays;


Permit permit = new Permit(
new PermitConfig.Builder("[YOUR_API_KEY]").build()
);

UserPermissions permissions = permit.getUserPermissions(
    new GetUserPermissionsQuery(
        User.fromString("john@doe.com"),
        Arrays.asList("tenant-1", "tenant-2"), // tenants
        Arrays.asList("document", "__tenant"), // resource_types
        Arrays.asList("document:doc-1", "document:doc-2") // resources
    )
);

Next steps

• List the users who can act on a resource
• Check a permission across all tenants
• Filter data by permission