GET/api/resource-server/organizations/{organization_id}/members/{uid}/rolePublic

Look up a user's organization role

Tells a resource server which role (owner, member, ...) a user holds in an organization, or null when they are not a member or do not exist. The service account of a client application (the subject of its client_credentials tokens) holds the role its app's managers configured with PUT /api/apps/{app_id}/service-account/organization-membership in the organization that owns the app, and no role anywhere else. The calling API server names itself in the X-Api-Server-Id header and proves it with a single-use JWKS access assertion signed with its JWKS access private key. It may always ask about the organization that owns it. It may ask about any other organization only when a platform administrator set its organization membership visibility to all_organizations (PUT /api/apis/{api_server_id}/organization-membership-visibility), and then only about a user who presents an active access token for the API server, forwarded in X-Subject-Token. Resource servers built on @schemavaults/auth-server-sdk call this through isUserInOrganization().

operationId get_api_resource_server_organizations_organization_id_members_uid_roleResource servers

Authentication & permissionsPublic

Anyone — no credentials required

Accepted credentials: None required
Notes: Requires Authorization: Bearer <JWKS access assertion> (the schemavaults-jwks-access-assertion scheme) signed by the API server named in X-Api-Server-Id; the handler verifies it after the path and header validation, so a malformed request is refused with 400 before the credential is examined, a missing or invalid assertion with 401. The API server must belong to organization_id, or hold the all_organizations membership visibility and forward the user's access token for it in X-Subject-Token (403 otherwise).

Path parameters

Name	Type	Description
organization_id*	string	Organization the API server belongs to
uid*	string (uuid)	User id to look up

Request headers

Name	Type	Description
x-api-server-id*	string	Id of the calling API server; the assertion must be signed with its JWKS access key
x-subject-token	string	The user's access token for the calling API server, exactly as it was presented to the resource server: a JWE in compact serialization of at most 4096 characters. Required when `organization_id` is not the API server's own organization (only API servers with the `all_organizations` membership visibility may ask about other organizations); otherwise not needed, but still refused with 400 when sent malformed.

Responses

application/json

OrganizationMemberRoleResponse

Property	Type	Description
success*	true
data*	object
organization_id*	string	minLength: 4maxLength: 32pattern: ^[a-z][a-z0-9_-]+$
uid*	string (uuid)
role*	string \| null \| null	The user's role in the organization, or null when not a member (or no such user)

JSONExample

"success"true

"data"

"organization_id""string"

"uid""123e4567-e89b-12d3-a456-426614174000"

"role""member"

Example request

bashcurl

curl -X GET 'https://auth.schemavaults.com/api/resource-server/organizations/<organization_id>/members/<uid>/role' \
  -H 'x-api-server-id: <x-api-server-id>'

Authentication & permissionsPublic

Path parameters

Request headers

Responses

200The user's role (null when not a member)

400The path parameters or X-Api-Server-Id failed validation, or X-Subject-Token was sent but cannot be one of the platform's access tokens (not a JWE in compact serialization, too long, or a protected header without the platform's algorithm, enc, keyset_id and aud)

401No Authorization: Bearer <assertion> header, or the assertion did not verify for the API server named in X-Api-Server-Id

403The API server does not belong to the organization and may not look up other organizations' memberships, or it may but X-Subject-Token is missing or is not an active access token of uid for the API server

500Failed to look up the API server or the membership

Example request