Get a user's roles
Returns the roles assigned to a specific user across the projects they belong to.
Only users with hub admin permissions can call this endpoint. To verify a user’s permissions, call GET users.
Note: This operation is forward compatible. Autodesk may add attributes to the response without prior notice, so your app should ignore any attribute it does not recognize.
Authentication
OAuth 2.0 (2-legged) — application context required.
Client Credentials Flow
Token URL: https://developer.api.autodesk.com/authentication/v2/token
Scopes:
account:read— read account and project dataaccount:write— modify account and project datadata:read— read data the application can access
OAuth 2.0 (2-legged with impersonation) — application context with user impersonation
required. Send a User-Id header identifying the
member to act on behalf of; the token authorizes the application, while the operation is
evaluated against that member’s project permissions.
Client Credentials Flow
Token URL: https://developer.api.autodesk.com/authentication/v2/token
Scopes:
account:read— read account and project dataaccount:write— modify account and project data
OAuth 2.0 (3-legged) — user context required. Also accepts a Secure Service Account (SSA) token, which is headless like a two-legged flow but classified as three-legged because it preserves user context.
Authorization Code Flow
Authorization URL: https://developer.api.autodesk.com/authentication/v2/authorize
Token URL: https://developer.api.autodesk.com/authentication/v2/token
Refresh URL: https://developer.api.autodesk.com/authentication/v2/token
Scopes:
data:read— read your dataaccount:read— read account and project dataaccount:write— modify account and project data
Path parameters
The ID of the hub that contains the projects. This corresponds to the hub ID used in the Data Management API, with the “b.” prefix removed. For example, b.c8b0c73d-3ae9 becomes c8b0c73d-3ae9.
The ID of the user. To find the ID call GET users. You can use either the Forma ID (id) or the Autodesk ID (autodeskId).
Headers
Specifies the region where your request should be routed. If not set, the request is routed automatically, which may result in a slight increase in latency.
Possible values: US, EMEA. For a complete list of supported regions, see the Regions page.
The ID of a user on whose behalf your request is acting.
Your app has access to all users specified by the administrator in the SaaS integrations UI. Provide this header value to identify the user to be affected by the request.
You can use either the user’s Forma ID (id), or their Autodesk ID (autodeskId).
Note that this header is required for hub Admin POST, PATCH, and DELETE endpoints if you want to use a 2-legged authentication context. This header is optional for hub Admin GET endpoints.
Query parameters
Filters roles by their status. Accepts one or more of the following values:
active – The role is currently in use.
inactive – The role has been removed or is no longer in use.
Filters roles by name.
By default, this performs a partial match (case-insensitive).
You can control how the match behaves by using the filterTextMatch parameter. For example, to match only names that start with (startsWith), end with (endsWith), or exactly equal (equals) the provided value.
Specifies how text-based filters should match values in supported fields.
This parameter can be used in any endpoint that supports text-based filtering (e.g., filter[name], filter[jobNumber], filter[companyName], etc.).
Possible values:
contains (default) – Matches if the field contains the specified text anywhere
startsWith – Matches if the field starts with the specified text
endsWith – Matches if the field ends with the specified text
equals – Matches only if the field exactly matches the specified text
Matching is case-insensitive.
Wildcards and regular expressions are not supported.
A comma-separated list of response fields to include. Defaults to all fields if not specified.
Use this parameter to reduce the response size by retrieving only the fields you need.
Possible values:
projectIds – Projects where the user holds this role
name – Role name
status – Role status (active or inactive)
key – Internal key used to translate the role name
isImmutable – Indicates whether the role is immutable
createdAt – Timestamp when the role was created
updatedAt – Timestamp when the role was last updated
Sorts the results by one or more fields.
Each field can be followed by a direction modifier:
asc – Ascending order (default)
desc – Descending order
Possible values: name, createdAt, updatedAt.
Default sort: name asc
Example: sort=name,updatedAt desc
The maximum number of records to return in the response.
Default: 20
Minimum: 1
Maximum: 200 (If a larger value is provided, only 200 records are returned)
The index of the first record to return.
Used for pagination in combination with the limit parameter.
Example: limit=20 and offset=40 returns records 41–60.
Response headers
The number of requests remaining in the current rate-limit window.