GET/api/resource-server/users/{uid}/organizationsAuthenticated

List a user's organization memberships

Tells a resource server which organizations a user belongs to, with their role in each, in the shape of GET /api/me/organizations. The calling API server names itself in the X-Api-Server-Id header, proves it with a single-use JWKS access assertion, and forwards the user's access token for the API server in X-Subject-Token: a resource server can only list the memberships of a user who is currently signed in to it. Only memberships the API server may see are returned: its owning organization's, or every organization's when a platform administrator set its organization membership visibility to all_organizations (PUT /api/apis/{api_server_id}/organization-membership-visibility). Resource servers built on @schemavaults/auth-server-sdk call this through listUserOrganizations() (or ctx.auth.listOrganizationMemberships() in operation handlers).

operationId get_api_resource_server_users_uid_organizationsResource servers

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials: JWKS access assertion (Bearer)Authorization: Bearer <JWT>
Who may call: Any authenticated user
Notes: The assertion must be signed by the API server named in X-Api-Server-Id; every assertion is accepted once. X-Subject-Token must be an active access token of uid for that API server (403 otherwise).

Path parameters

Name	Type	Description
uid*	string (uuid)	User id to list the memberships of; must be the subject of `X-Subject-Token`

Request headers

Name	Type	Description
x-api-server-id*	string	Id of the calling API server; the assertion must be signed with its JWKS access key
x-subject-token*	string	The user's access token for the calling API server, exactly as it was presented to the resource server: a JWE in compact serialization of at most 4096 characters

Responses

application/json

ResourceServerUserOrganizationsResponse

Property	Type	Description
success*	true
data*	object
uid*	string (uuid)
organization_membership_visibility*	"owning_organization" \| "all_organizations"	The calling API server's visibility: `owning_organization` lists at most the membership of its own organization, `all_organizations` every membership
memberships*	OrganizationMembershipRoleDetails[]	The user's memberships the API server may see (empty when the user no longer exists)
organization_id*	string	minLength: 4maxLength: 32pattern: ^[a-z][a-z0-9_-]+$
organization_name*	string	minLength: 1maxLength: 64pattern: ^[a-zA-Z0-9]([a-zA-Z0-9 _-]*[a-zA-Z0-9])?$
role*	string
created_at*	integer	minimum: 0
joined_at*	integer	minimum: 0

JSONExample

"success"true

"data"

"uid""123e4567-e89b-12d3-a456-426614174000"

"organization_membership_visibility""owning_organization"

"memberships"

Example request

bashcurl

curl -X GET 'https://auth.schemavaults.com/api/resource-server/users/<uid>/organizations' \
  -H 'Authorization: Bearer <access_token>' \
  -H 'x-api-server-id: <x-api-server-id>' \
  -H 'x-subject-token: <x-subject-token>'

Authentication & permissionsAuthenticated

Path parameters

Request headers

Responses

200The memberships the API server may see

400X-Api-Server-Id or X-Subject-Token is missing or malformed (X-Subject-Token must be a JWE in compact serialization, not too long, whose protected header names the platform's algorithm and carries enc, keyset_id and aud), or the request failed validation

401No Authorization: Bearer <assertion> header was sent, or the assertion is malformed, expired, issued for another API server, not signed with the API server's active JWKS access key, or has already been used

403X-Subject-Token is not an active access token of uid for the calling API server

500Failed to verify the subject token or list the memberships

Example request