# How to enumerate user permissions from API

**URL:** <https://speciforum.org/t/how-to-enumerate-user-permissions-from-api/2742>\
**Category:** Get Help\
**Created:** [July 30, 2025, 2:25pm UTC](https://speciforum.org/t/how-to-enumerate-user-permissions-from-api/2742 "2025-07-30T14:25:41Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Grant](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/grant/32/4255_2.png) [@Grant](https://speciforum.org/u/Grant)\
**Post date:** [August 7, 2025, 2:26pm UTC](https://speciforum.org/t/how-to-enumerate-user-permissions-from-api/2742/2 "2025-08-07T14:26:42Z")

</div>

Hi @fedoras,

I was on vacation, apologies for the late reply.

In Specify 7, there are different tables that capture the complete picture of a particular user’s permissions:

| Table Name | Role |
| --- | --- |
| spuserpolicy | Stores individual user policies (collection-scoped or global). |
| spuserrole | Associates Specify users with roles. |
| sprole | Defines roles at the collection and institution level (group of policies). |
| sprolepolicy | Stores policies attached to each role (collection-scoped or global). |

The Specify 6 permissions are set in the `sppermission`, `spprincipal`, and other tables. They do not affect the permissions a user has in Specify 7.

To build a comprehensive report of what a user can do, you’ll want to combine two sets of permissions: those applied directly to the user and those granted by the roles they belong to.

You can see the full list of `permissions` API endpoints here: [Specify 7 Operations API](https://sp7demofish.specifycloud.org/documentation/api/operations/#permissions:~:text=/%7Bresourceid%7D/-,permissions,-GET)

 ![API endpoints](https://canada1.discourse-cdn.com/flex029/uploads/specifysoftware/original/2X/d/d1a5c9a52c8aa5ff3e933f9af8beab8b92ae7eac.png)

### Step 1: Retrieve Direct User-Specific Policies

The API has an endpoint specifically for this. You’ll need the user’s ID and the collection ID you want to check against (can be obtained via a query or via another API request to the `specifyuser` and `collection` tables).

Make a `GET` request to this endpoint:

```url
/permissions/user_policies/{collectionid}/{userid}/

```

For example, for user ID `12` in collection `4`, the call would be `/permissions/user_policies/4/12/`.

The response will be a JSON object containing the list of permissions that user is **explicitly** allowed to perform on that resource. This shows you any permissions assigned directly to that user, separate from what is given to them by their roles (by default, most users will only have collection access):

```json
{
	"/system/sp7/collection": ["access"]
}

```

Don’t forget that users can also have **institution-level policies** that apply across all collections. You can get those with a similar call, which would also reveal if the user is an Institution Admin (has all permissions) or not:

```url
/permissions/user_policies/institution/{userid}/

```

* * *

### Step 2: Retrieve Role-Based Policies

Next, you need to find out what roles the user has and what permissions those roles grant. This is a two-part lookup.

First, get the list of roles assigned to the user within that same collection by making a `GET` request to the `user_roles` endpoint:

```url
/permissions/user_roles/{collectionid}/{userid}/

```

This will return an array of the user’s roles, each with an ID and a name.

```json
[
    {
        "id": 1,
        "name": "Data Entry Clerk"
    },
    {
        "id": 5,
        "name": "Researcher"
    }
]

```

Second, for **each role ID** you get back, you’ll make another `GET` request to the `role` endpoint to see its specific policies:

```url
/permissions/role/{roleid}/

```

For example, a call to `/permissions/role/5/` for the “Researcher” role might return this:

```json
{
  "id": 5,
  "name": "Researcher",
  "description": "Grants read, create and update access to all data tables. read only access to all tables. Query builder and Record sets",
  "policies": {
    "/querybuilder/query": [
      "execute",
      "export_csv",
      "create_recordset",
      "export_kml"
    ],
    "/table/agent": [
      "read",
      "create",
      "update"
    ],
...

```

You can combine the user policies from **Step 1** with the policies from all of their roles in **Step 2** to create a complete list of that user’s permissions for the specified collection. If you do build a tool to effectively report this, please let us know as this has been a requested feature for other institutions as well:

> <https://github.com/specify/specify7/issues/1941>
>
> There should be a way to export users with their roles and collections as a matr…ix.
> 
> \*\*Requested By:\*\* Corinna at CSIRO

---

_[View the full topic](https://speciforum.org/t/how-to-enumerate-user-permissions-from-api/2742)._