GetUserRunAsUsers

Get the users an Administrator can run requests as, which are the settings that Update User Run-As Users changes.

Only an Administrator can call this route. It cannot be run as another user, who is never an Administrator.

run_as_any_user is whether the user can run as any user. users is the user's run-as users, in the order they are stored. The two settings are independent, so the list is returned whether or not run_as_any_user is true.

Each user is returned as it appears in Get Users, without custom fields. A run-as user who has since been deleted is not listed. A user who has no run-as users returns an empty list, whatever their role.

Headers

GET /api/ss/user/:id/run-as-users HTTP/1.1
Host: demo.attackforge.com
X-SSAPI-KEY: APIKey
Content-Type: application/json

Request

Path Parameters

id - string | required

ID of the user. Must be a 24-character hexadecimal id.

Example

Request

curl --request GET \
	--url https://demo.attackforge.com/api/ss/user/5eacb8450c8d520a8281e539/run-as-users \
	--header 'content-type: application/json' \
	--header 'x-ssapi-key: ************'

Response

{
  "run_as_any_user": false,
  "count": 999,
  "users": [
    {
      "status": "...",
      "role": "...",
      "first_name": "...",
      "last_name": "...",
      "email_address": "...",
      "username": "...",
      "mfa_enabled": "...",
      "is_deleted": "...",
      "last_logged_in": "...",
      "created": "...",
      "id": "..."
    }
  ]
}

Access and failures

Errors are returned in error, with a count of 0, an empty list and no run_as_any_user:

• Unauthorized - the caller is not an Administrator.

• User Not Found or Error Finding User - the user could not be found.

• Error Finding Run-As Users - the user's run-as users could not be read.