Skip to main content
Version: Latest (4.0.2)

Check User Group Restriction

POST 
/groups-srv/verifications

This API call checks if a user meets specified user group restriction.

Purpose:

  • Real-time verification of user access permissions based on group memberships and roles
  • Authorization checks before granting access to protected resources
  • Validation of user eligibility for specific operations or features

Authentication Requirements:

  • This endpoint requires authentication via Bearer token
  • For anonymous tokens, the cidaas:users_read scope is required
  • Any authenticated caller may verify any valid sub in the request body (no self-only restriction on POST)

Request Structure:

  • sub: Required, the user ID to verify
  • matchCondition: Required, determines how multiple filters are combined ("and" or "or")
  • filters: Required array, must contain at least one filter
  • hints: Optional, controls which fields appear in the response (groupIds, rolesOfGroup, allowedGroups)

Filter Rules:

  • Each filter must specify exactly one of groupId or groupType (not both, not neither)
  • roleFilter is optional and can be used with either groupId or groupType

Validation Rules:

  • sub: Required, must be a valid user ID (UUID format), user must exist
  • matchCondition: Required, must be either "and" or "or"
  • filters: Required, must be a non-empty array
  • If groupId is specified, the group must exist
  • If groupType is specified, the group type must exist
  • If roleFilter is provided:
    • matchCondition: Required, must be "and" or "or"
    • roles: Required array, must contain at least one role name
    • All roles must exist in the system

Business Rules:

  • When matchCondition is "or", the user needs to meet at least one filter condition.
  • When matchCondition is "and", the user must meet all filter conditions.
  • Role filters are evaluated within the context of the group(s) specified in the filter.
  • If a user is a member of multiple groups that match, all matching groups are returned in allowedGroups.
  • Response fields beyond verified depend on the hints provided in the request.

Request​

Responses​

OK