GetUserRESTfulAPIMethods

Get the RESTful API methods a user has been given access to.

Only an Administrator can call this route. It cannot be run as another user, who is never an Administrator.

Only access given to the user directly is returned, which is the access that Update User RESTful API Methods changes. A method that one of their groups gives them is not listed here, and is returned by Get Group RESTful API Methods for that group. A user who has no API key has no direct access, and an empty list is returned.

Each method is returned as it appears in Get Available RESTful API Methods, sorted by name, ignoring case, so the two lists can be compared.

Headers

GET /api/ss/user/:id/methods HTTP/1.1
Host: demo.attackforge.com
X-SSAPI-KEY: APIKey
Content-Type: application/json

Request

Path Parameters

id - string | required

ID of the user. Must be a 24-character hexadecimal id.

Example

Request

curl --request GET \
	--url https://demo.attackforge.com/api/ss/user/5eacb8450c8d520a8281e539/methods \
	--header 'content-type: application/json' \
	--header 'x-ssapi-key: ************'

Response

{
  "count": 999,
  "methods": [
    {
      "name": "getProjects",
      "verb": "GET",
      "uri": "/api/ss/projects",
      "description": "Get all projects"
    }
  ]
}

Access and failures

Errors are returned in error, with a count of 0 and an empty list:

• Unauthorized - the caller is not an Administrator.

• User Not Found or Error Finding User - the user could not be found.

• Error Finding Methods - the user's methods could not be read.