Groups

Overview

A FusionAuth Group is a named object that optionally contains one to many Application Roles.

When a Group does not contain any Application Roles it can still be utilized to logically associate users. Assigning Application Roles to a group allow it to be used to dynamically manage Role assignment to registered Users. In this second scenario as long as a User is registered to an Application the Group membership will allow them to inherit the corresponding Roles from the Group.

The following APIs are provided to manage Groups and Group Membership.

Create a Group

This API is used to create a new Group.

Request

API Key Authentication
Create a Group with a randomly generated Id
POST /api/group

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

When only a single tenant is configured the tenant Id can be assumed and this additional header is optional. Once more than one tenant has been configured in FusionAuth the tenant Id is required for this request. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.


API Key Authentication
Create a Group with the provided unique Id
POST /api/group/{groupId}

Request Parameters

groupIdUUIDDefaults to secure random UUID

The Id to use for the new Group. If not specified a secure random UUID will be generated.

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

When only a single tenant is configured the tenant Id can be assumed and this additional header is optional. Once more than one tenant has been configured in FusionAuth the tenant Id is required for this request. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Request Body

group.dataObject

An object that can hold any information about the Group that should be persisted.

group.nameStringrequired

The name of the Group.

roleIdsArray<UUID>

The Application Roles to assign to this group.

Example Request JSON
{
  "group": {
    "data": {
      "description": "This group assigns members admin access to all applications.",
      "external": {
        "createdAt": 1503000771468
      }
    },
    "name": "Company Admins"
  },
  "roleIds": [
    "68259c40-0b4e-4245-8956-7e5af0959c2b",
    "00f24e72-52e2-4f55-8ea1-6a06bfe10df5",
    "11a5b1b8-7ef5-476f-af7d-69e19796fa8b"
  ]
}

Response

The response for this API contains the Group that was created.

Response Codes
Code Description
200 The request was successful. The response will contain a JSON body.
400 The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401 You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
500 There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body

group.dataObject

An object that can hold any information about the Group that should be persisted.

group.idUUID

The unique Id of the Group.

group.insertInstantLong

The instant that the Group was added to the FusionAuth database.

group.lastUpdateInstantLong

The instant that the Group was updated in the FusionAuth database.

group.nameString

The name of the Group.

group.rolesMap<UUID, List<Object>

The roles assigned to this Group. The map key is the Application Id, the value is an array of Application Roles.

group.roles[applicationId][x].descriptionString

The description of the role.

group.roles[applicationId][x].idUUID

The Application Role Unique Id

group.roles[applicationId][x].nameString

The name of the Group.

group.roles[applicationId][x].isDefaultBoolean

Whether or not the Role is a default role. A default role is automatically assigned to a user during registration if no roles are provided.

group.roles[applicationId][x].isSuperRoleBoolean

Whether or not the Role is a considered to be a super user role. This is a marker to indicate that it supersedes all other roles. FusionAuth will attempt to enforce this contract when using the web UI, it is not enforced programmatically when using the API.

group.tenantIdUUID

The unique Id of the Tenant.

Example Response JSON
{
  "group": {
    "data": {
      "description": "This group assigns members admin access to all applications.",
      "external": {
        "createdAt": 1503000771468
      }
    },
    "id": "1188edfc-cef3-4555-910e-181ddf6153c0",
    "insertInstant": 1595361142909,
    "lastUpdateInstant": 1595361143101,
    "name": "Company Admins",
    "roles": {
      "931fded0-f917-439d-b447-d7f21b37a134": [
        {
          "id": "68259c40-0b4e-4245-8956-7e5af0959c2b",
          "isDefault": false,
          "isSuperRole": true,
          "name": "admin"
        }
      ],
      "07d1efe7-9a14-433d-8247-2235e67736f0": [
        {
          "id": "00f24e72-52e2-4f55-8ea1-6a06bfe10df5",
          "isDefault": false,
          "isSuperRole": true,
          "name": "ADMIN"
        }
      ],
      "d23e9a51-2b20-4384-9c74-432e12219aad": [
        {
          "id": "11a5b1b8-7ef5-476f-af7d-69e19796fa8b",
          "isDefault": false,
          "isSuperRole": true,
          "name": "Administrator"
        }
      ]
    },
    "tenantId": "30663132-6464-6665-3032-326466613934"
  }
}

Retrieve a Group

This API is used to retrieve a single Group by unique Id or all of the configured Groups.

Request

API Key Authentication
Retrieve all of the Groups
GET /api/group

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.


API Key Authentication
Retrieve a Group by Id
GET /api/group/{groupId}

Request Parameters

groupIdUUIDrequired

The unique Id of the Group to retrieve.

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Response

The response for this API contains either a single Group or all of the Groups. When you call this API with an Id the response will contain a single Group. When you call this API without an Id the response will contain all of the Groups. Both response types are defined below along with an example JSON response.

Response Codes
Code Description
200 The request was successful. The response will contain a JSON body.
400 The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401 You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404 The object you requested doesn't exist. The response will be empty.
500 There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body

group.dataObject

An object that can hold any information about the Group that should be persisted.

group.idUUID

The unique Id of the Group.

group.insertInstantLong

The instant that the Group was added to the FusionAuth database.

group.lastUpdateInstantLong

The instant that the Group was updated in the FusionAuth database.

group.nameString

The name of the Group.

group.rolesMap<UUID, List<Object>

The roles assigned to this Group. The map key is the Application Id, the value is an array of Application Roles.

group.roles[applicationId][x].descriptionString

The description of the role.

group.roles[applicationId][x].idUUID

The Application Role Unique Id

group.roles[applicationId][x].nameString

The name of the Group.

group.roles[applicationId][x].isDefaultBoolean

Whether or not the Role is a default role. A default role is automatically assigned to a user during registration if no roles are provided.

group.roles[applicationId][x].isSuperRoleBoolean

Whether or not the Role is a considered to be a super user role. This is a marker to indicate that it supersedes all other roles. FusionAuth will attempt to enforce this contract when using the web UI, it is not enforced programmatically when using the API.

group.tenantIdUUID

The unique Id of the Tenant.

Example Response JSON
{
  "group": {
    "data": {
      "description": "This group assigns members admin access to all applications.",
      "external": {
        "createdAt": 1503000771468
      }
    },
    "id": "1188edfc-cef3-4555-910e-181ddf6153c0",
    "insertInstant": 1595361142909,
    "lastUpdateInstant": 1595361143101,
    "name": "Company Admins",
    "roles": {
      "931fded0-f917-439d-b447-d7f21b37a134": [
        {
          "id": "68259c40-0b4e-4245-8956-7e5af0959c2b",
          "isDefault": false,
          "isSuperRole": true,
          "name": "admin"
        }
      ],
      "07d1efe7-9a14-433d-8247-2235e67736f0": [
        {
          "id": "00f24e72-52e2-4f55-8ea1-6a06bfe10df5",
          "isDefault": false,
          "isSuperRole": true,
          "name": "ADMIN"
        }
      ],
      "d23e9a51-2b20-4384-9c74-432e12219aad": [
        {
          "id": "11a5b1b8-7ef5-476f-af7d-69e19796fa8b",
          "isDefault": false,
          "isSuperRole": true,
          "name": "Administrator"
        }
      ]
    },
    "tenantId": "30663132-6464-6665-3032-326466613934"
  }
}

Response Body

groupsArray

The list of Group objects.

groups[x].dataObject

An object that can hold any information about the Group that should be persisted.

groups[x].idUUID

The name of the Group.

group[x].insertInstantLong

The instant that the Group was added to the FusionAuth database.

group[x].lastUpdateInstantLong

The instant that the Group was updated in the FusionAuth database.

groups[x].nameString

The name of the Group.

groups[x].rolesMap<UUID, List<Object>

The roles assigned to this Group. The map key is the Application Id, the value is an array of Application Roles.

groups[x].roles[applicationId][x].descriptionString

The description of the role.

groups[x].roles[applicationId][x].idUUID

The Application Role Unique Id

groups[x].roles[applicationId][x].nameString

The name of the Group.

groups[x].roles[applicationId][x].isDefaultBoolean

Whether or not the Role is a default role. A default role is automatically assigned to a user during registration if no roles are provided.

groups[x].roles[applicationId][x].isSuperRoleBoolean

Whether or not the Role is a considered to be a super user role. This is a marker to indicate that it supersedes all other roles. FusionAuth will attempt to enforce this contract when using the web UI, it is not enforced programmatically when using the API.

groups[x].tenantIdUUID

The unique Id of the Tenant.

Example Response JSON
{
  "groups": [
    {
      "data": {
        "description": "This group assigns members admin access to all applications.",
        "external": {
          "createdAt": 1503000771468
        }
      },
      "id": "1188edfc-cef3-4555-910e-181ddf6153c0",
      "insertInstant": 1595361142909,
      "lastUpdateInstant": 1595361143101,
      "name": "Company Admins",
      "roles": {
        "931fded0-f917-439d-b447-d7f21b37a134": [
          {
            "id": "68259c40-0b4e-4245-8956-7e5af0959c2b",
            "isDefault": false,
            "isSuperRole": true,
            "name": "admin"
          }
        ],
        "07d1efe7-9a14-433d-8247-2235e67736f0": [
          {
            "id": "00f24e72-52e2-4f55-8ea1-6a06bfe10df5",
            "isDefault": false,
            "isSuperRole": true,
            "name": "ADMIN"
          }
        ],
        "d23e9a51-2b20-4384-9c74-432e12219aad": [
          {
            "id": "11a5b1b8-7ef5-476f-af7d-69e19796fa8b",
            "isDefault": false,
            "isSuperRole": true,
            "name": "Administrator"
          }
        ]
      },
      "tenantId": "30663132-6464-6665-3032-326466613934"
    }
  ]
}

Update a Group

This API is used to update an existing Group.

You must specify all of the properties of the Group when calling this API with the PUT HTTP method. When used with PUT, this API doesn’t merge the existing Group and your new data. It replaces the existing Group with your new data.

Utilize the PATCH HTTP method to send specific changes to merge into an existing Group.

Request

API Key Authentication
Update the Group with the given Id
PUT /api/group/{groupId}

Request Parameters

groupIdUUIDrequired

The Id of the Group to update.

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Request Body

group.dataObject

An object that can hold any information about the Group that should be persisted.

group.nameStringrequired

The name of the Group.

roleIdsArray<UUID>

The Application Roles to assign to this group.

Example Request JSON
{
  "group": {
    "data": {
      "description": "This group assigns members admin access to all applications.",
      "external": {
        "createdAt": 1503000771468
      }
    },
    "name": "Company Admins"
  },
  "roleIds": [
    "68259c40-0b4e-4245-8956-7e5af0959c2b",
    "00f24e72-52e2-4f55-8ea1-6a06bfe10df5",
    "11a5b1b8-7ef5-476f-af7d-69e19796fa8b"
  ]
}

Response

The response for this API contains the Group that was updated.

Response Codes
Code Description
200 The request was successful. The response will contain a JSON body.
400 The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401 You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404 The object you are trying to update doesn't exist. The response will be empty.
500 There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body

group.dataObject

An object that can hold any information about the Group that should be persisted.

group.idUUID

The unique Id of the Group.

group.insertInstantLong

The instant that the Group was added to the FusionAuth database.

group.lastUpdateInstantLong

The instant that the Group was updated in the FusionAuth database.

group.nameString

The name of the Group.

group.rolesMap<UUID, List<Object>

The roles assigned to this Group. The map key is the Application Id, the value is an array of Application Roles.

group.roles[applicationId][x].descriptionString

The description of the role.

group.roles[applicationId][x].idUUID

The Application Role Unique Id

group.roles[applicationId][x].nameString

The name of the Group.

group.roles[applicationId][x].isDefaultBoolean

Whether or not the Role is a default role. A default role is automatically assigned to a user during registration if no roles are provided.

group.roles[applicationId][x].isSuperRoleBoolean

Whether or not the Role is a considered to be a super user role. This is a marker to indicate that it supersedes all other roles. FusionAuth will attempt to enforce this contract when using the web UI, it is not enforced programmatically when using the API.

group.tenantIdUUID

The unique Id of the Tenant.

Example Response JSON
{
  "group": {
    "data": {
      "description": "This group assigns members admin access to all applications.",
      "external": {
        "createdAt": 1503000771468
      }
    },
    "id": "1188edfc-cef3-4555-910e-181ddf6153c0",
    "insertInstant": 1595361142909,
    "lastUpdateInstant": 1595361143101,
    "name": "Company Admins",
    "roles": {
      "931fded0-f917-439d-b447-d7f21b37a134": [
        {
          "id": "68259c40-0b4e-4245-8956-7e5af0959c2b",
          "isDefault": false,
          "isSuperRole": true,
          "name": "admin"
        }
      ],
      "07d1efe7-9a14-433d-8247-2235e67736f0": [
        {
          "id": "00f24e72-52e2-4f55-8ea1-6a06bfe10df5",
          "isDefault": false,
          "isSuperRole": true,
          "name": "ADMIN"
        }
      ],
      "d23e9a51-2b20-4384-9c74-432e12219aad": [
        {
          "id": "11a5b1b8-7ef5-476f-af7d-69e19796fa8b",
          "isDefault": false,
          "isSuperRole": true,
          "name": "Administrator"
        }
      ]
    },
    "tenantId": "30663132-6464-6665-3032-326466613934"
  }
}

Delete a Group

This API is used to permanently delete a Group. Deleting a Group that has Application Roles will effectively modify User Registrations by removing these Roles from Group members.

Request

API Key Authentication
Delete a Group by Id
DELETE /api/group/{groupId}

Request Parameters

groupIdUUIDrequired

The unique Id of the Group to delete.

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Response

This API does not return a JSON response body.

Response Codes
Code Description
200 The request was successful. The response will contain a JSON body.
400 The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401 You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404 The object you requested doesn't exist. The response will be empty.
500 There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Search for Groups

This API has been available since 1.45.0

This API is used to search for Groups and may be called using the GET or POST HTTP methods. Examples of each are provided below. The POST method is provided to allow for a richer request object without worrying about exceeding the maximum length of a URL. Calling this API with either the GET or POST HTTP method will provide the same search results given the same query parameters.

Request

API Key Authentication
Search for Groups
GET /api/group/search ?name={name}&tenantId={tenantId}

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Request Parameters

nameString

The case-insensitive string to search for in the Group name. This can contain wildcards using the asterisk character (*). If no wildcards are present, the search criteria will be interpreted as *value*.

numberOfResultsIntegerDefaults to 25

The number of results to return from the search.

orderByStringDefaults to name ASC

The database field to order the search results as well as an order direction.

The possible values are:

  • id - the unique Id of the Group
  • insertInstant - the instant when the Group was created
  • name - the Group name
  • tenant - the name of the Tenant in which the Group belongs

The order direction is optional. Possible values of the order direction are ASC or DESC. If omitted, the default sort order is ASC.

For example, to order the results by the insert instant in a descending order, use insertInstant DESC.

startRowIntegerDefaults to 0

The offset into the total results. In order to paginate the results, increment this value by the numberOfResults for subsequent requests.

For example, if the total search results are greater than the page size designated by numberOfResults , set this value to 25 to retrieve results 26-50, assuming the default page size.

tenantIdUUID

Restricts the results to Groups belonging to the given Tenant. This parameter will be overridden if the request contains an X-FusionAuth-TenantId header, or if the supplied API key is scoped to a specific Tenant.

API Key Authentication
Search for Groups
POST /api/group/search

When calling the API using a POST request you will send the search criteria in a JSON request body.

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Request Body

search.nameString

The case-insensitive string to search for in the Group name. This can contain wildcards using the asterisk character (*). If no wildcards are present, the search criteria will be interpreted as *value*.

search.numberOfResultsIntegerDefaults to 25

The number of results to return from the search.

search.orderByStringDefaults to name ASC

The database field to order the search results as well as an order direction.

The possible values are:

  • id - the unique Id of the Group
  • insertInstant - the instant when the Group was created
  • name - the Group name
  • tenant - the name of the Tenant in which the Group belongs

The order direction is optional. Possible values of the order direction are ASC or DESC. If omitted, the default sort order is ASC.

For example, to order the results by the insert instant in a descending order, use insertInstant DESC.

search.startRowIntegerDefaults to 0

The offset into the total results. In order to paginate the results, increment this value by the numberOfResults for subsequent requests.

For example, if the total search results are greater than the page size designated by numberOfResults , set this value to 25 to retrieve results 26-50, assuming the default page size.

search.tenantIdUUID

Restricts the results to Groups belonging to the given Tenant. This parameter will be overridden if the request contains an X-FusionAuth-TenantId header, or if the supplied API key is scoped to a specific Tenant.

Example JSON Request
{
  "search": {
    "name": "Admins",
    "tenantId": "50435e55-6e95-4d54-96d0-9c953dd53eeb",
    "numberOfResults": 25,
    "orderBy": "insertInstant",
    "startRow": 0
  }
}

Response

The response for this API contains the Groups matching the search criteria in paginated format.

Response Codes
Code Description
200 The request was successful. The response will contain a JSON body.
400 The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401 You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
500 There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body

Response Body

groupsArray

The list of Group objects.

groups[x].dataObject

An object that can hold any information about the Group that should be persisted.

groups[x].idUUID

The name of the Group.

group[x].insertInstantLong

The instant that the Group was added to the FusionAuth database.

group[x].lastUpdateInstantLong

The instant that the Group was updated in the FusionAuth database.

groups[x].nameString

The name of the Group.

groups[x].rolesMap<UUID, List<Object>

The roles assigned to this Group. The map key is the Application Id, the value is an array of Application Roles.

groups[x].roles[applicationId][x].descriptionString

The description of the role.

groups[x].roles[applicationId][x].idUUID

The Application Role Unique Id

groups[x].roles[applicationId][x].nameString

The name of the Group.

groups[x].roles[applicationId][x].isDefaultBoolean

Whether or not the Role is a default role. A default role is automatically assigned to a user during registration if no roles are provided.

groups[x].roles[applicationId][x].isSuperRoleBoolean

Whether or not the Role is a considered to be a super user role. This is a marker to indicate that it supersedes all other roles. FusionAuth will attempt to enforce this contract when using the web UI, it is not enforced programmatically when using the API.

groups[x].tenantIdUUID

The unique Id of the Tenant.

totalInteger

The total number of Groups matching the search criteria. Use this value along with the numberOfResults and startRow in the Search request to perform pagination.

Example Response JSON
{
  "groups": [
    {
      "data": {
        "description": "This group assigns members admin access to all applications.",
        "external": {
          "createdAt": 1503000771468
        }
      },
      "id": "1188edfc-cef3-4555-910e-181ddf6153c0",
      "insertInstant": 1595361142909,
      "lastUpdateInstant": 1595361143101,
      "name": "Company Admins",
      "roles": {
        "931fded0-f917-439d-b447-d7f21b37a134": [
          {
            "id": "68259c40-0b4e-4245-8956-7e5af0959c2b",
            "isDefault": false,
            "isSuperRole": true,
            "name": "admin"
          }
        ],
        "07d1efe7-9a14-433d-8247-2235e67736f0": [
          {
            "id": "00f24e72-52e2-4f55-8ea1-6a06bfe10df5",
            "isDefault": false,
            "isSuperRole": true,
            "name": "ADMIN"
          }
        ],
        "d23e9a51-2b20-4384-9c74-432e12219aad": [
          {
            "id": "11a5b1b8-7ef5-476f-af7d-69e19796fa8b",
            "isDefault": false,
            "isSuperRole": true,
            "name": "Administrator"
          }
        ]
      },
      "tenantId": "30663132-6464-6665-3032-326466613934"
    }
  ],
  "total": 1
}

Add Users to a Group

This API is used to add Users to a Group. A User that is added to a Group is called a member, a user can belong to one to many Groups.

Adding a User to a Group can be used to logically group users, Group members can be returned by the Search API by searching by the Group Id. Application Roles may also be managed by a Group membership. When a User becomes a member of a Group they will inherit the Application Roles assigned to the Group for their registered Applications. If a User is not registered for an Application the Application Roles for that Application will not be applied to the User.

Request

API Key Authentication
Add Users to Group
POST /api/group/member

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Request Body

members[groupId]Arrayrequired

The key is the Id of the Group to which to add Users. The value is an array of objects which specify the Members to be added.

members[groupId][x].dataObject

An object that can hold any information about the Group Member that should be persisted.

members[groupId][x].idUUID

The unique Id of this Group Member. If not specified a secure random UUID will be generated.

members[groupId][x].userIdUUIDrequired

The User Id to add as a Member of this Group.

Example Request JSON
{
  "members": {
    "1188edfc-cef3-4555-910e-181ddf6153c0": [
      {
        "data": {
          "fruit": "orange"
        },
        "userId": "00000000-0000-0001-0000-000000000000"
      }
    ]
  }
}

Response

Response Codes
Code Description
200 The request was successful. The response will contain a JSON body.
400 The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401 You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
500 There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body

members[groupId][x].dataObject

An object that can hold any information about the Group Member that should be persisted.

members[groupId][x].idUUID

The unique Id of this Group Member. This is not the User Id, but a unique Id for the membership.

members[groupId][x].insertInstantLong

The instant that this membership was created.

members[groupId][x].userIdUUID

The User Id of the Group Member.

Example Response JSON
{
  "members": {
    "1188edfc-cef3-4555-910e-181ddf6153c0": [
      {
        "data": {
          "fruit": "orange"
        },
        "id": "47ffe8c2-920a-49cc-bfa8-b84889db615e",
        "insertInstant": 1503513015493,
        "userId": "00000000-0000-0001-0000-000000000000"
      }
    ]
  }
}

Update Users in a Group

This API has been available since 1.36.0

This API is used to completely replace the existing membership of a Group. Calling this API is equivalent to removing all Users from a Group and then making a POST request to the /api/group/member to add Users to the Group. Use this API with caution.

Request

API Key Authentication
Update Users in a Group
PUT /api/group/member

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Request Body

members[groupId]Arrayrequired

The key is the Id of the Group to which to add Users. The value is an array of objects which specify the Members to be added.

members[groupId][x].dataObject

An object that can hold any information about the Group Member that should be persisted.

members[groupId][x].idUUID

The unique Id of this Group Member. If not specified a secure random UUID will be generated.

members[groupId][x].userIdUUIDrequired

The User Id to add as a Member of this Group.

Example Request JSON
{
  "members": {
    "1188edfc-cef3-4555-910e-181ddf6153c0": [
      {
        "data": {
          "fruit": "orange"
        },
        "userId": "00000000-0000-0001-0000-000000000000"
      }
    ]
  }
}

Response

Response Codes
Code Description
200 The request was successful. The response will contain a JSON body.
400 The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401 You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
500 There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body

members[groupId][x].dataObject

An object that can hold any information about the Group Member that should be persisted.

members[groupId][x].idUUID

The unique Id of this Group Member. This is not the User Id, but a unique Id for the membership.

members[groupId][x].insertInstantLong

The instant that this membership was created.

members[groupId][x].userIdUUID

The User Id of the Group Member.

Example Response JSON
{
  "members": {
    "1188edfc-cef3-4555-910e-181ddf6153c0": [
      {
        "data": {
          "fruit": "orange"
        },
        "id": "47ffe8c2-920a-49cc-bfa8-b84889db615e",
        "insertInstant": 1503513015493,
        "userId": "00000000-0000-0001-0000-000000000000"
      }
    ]
  }
}

Remove Users from a Group

This API is used to remove Users from a Group. Removing a User from a Group removes their Group membership. Removing a User from a Group effectively modifies their assigned Roles if Application Roles are being managed through the Group membership.

Request

API Key Authentication
Remove a single User from a Group by Member Id
DELETE /api/group/member/{memberId}

Request Parameters

memberIdUUIDrequired

The unique Id of the Group Member to delete.

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.


API Key Authentication
Remove a single User from a Group by User Id and Group Id
DELETE /api/group/member ?groupId={groupId}&userId={userId}

Request Parameters

groupIdUUIDrequired

The unique Id of the Group to remove the User from.

userIdUUIDrequired

The unique Id of the User to remove from the Group.

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.


API Key Authentication
Remove all Users from a Group
DELETE /api/group/member ?groupId={groupId}

Note, in version 1.36.0 the Member API supports the PUT method allowing you to replace all members in the Group.

As of version 1.36.0 this API is deprecated, in favor of using the PUT method. Prefer the use of PUT /api/group/member with an empty array of members to effectively remove all members from the group.

Request Parameters

groupIdUUIDrequired

The unique Id of the Group.

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

API Key Authentication
Remove Users from a Group by Member Id
DELETE /api/group/member

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Request Body

memberIdsArrayrequired

An array of member Ids to delete.

Example Request JSON
{
  "memberIds": [
    "222b884b-a0a1-4563-a957-89c7c0513e6e",
    "80d474bf-0dee-4009-b793-ec1255693fa3",
    "16d98a8b-4205-4441-8831-7e3f73154134"
  ]
}
API Key Authentication
Remove specified Users from a Group by Group Id
DELETE /api/group/member

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Request Body

members[groupId][x]Arrayrequired

An array of User Ids to remove from the Group specified by Group Id.

Example Request JSON
{
  "members": {
    "1188edfc-cef3-4555-910e-181ddf6153c0": [
      "578e52df-83e8-48ca-899b-3aefd56e7fc5",
      "0928cf95-34d1-44cc-9114-da68a07e5ff8"
    ]
  }
}

Response

This API does not return a JSON response body.

Response Codes
Code Description
200 The request was successful. The response will contain a JSON body.
400 The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401 You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404 The object you requested doesn't exist. The response will be empty.
500 There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Search for Group Members

This API has been available since 1.36.0

The Group Member Search API allows you to search for Group Members with a paginated response.

Request

API Key Authentication
Search for all Group Members by Group Id
GET /api/group/member/search ?groupId={groupId}

When calling the API using a GET request you will send the search criteria on the URL using request parameters. In order to simplify the example URL above, only the groupId parameter is shown, however you may add any of the documented request parameters to the URL.

Request Parameters

groupIdUUID

The unique Id of the Group used to search for Group Members.

numberOfResultsIntegerDefaults to 25

The number of results to return from the search.

orderByStringDefaults to name ASC

The database column to order the search results on plus the order direction.

The possible values are:

  • groupId - the unique Id of the Group
  • id - the id of the Group Member
  • insertInstant - the instant when the Group Member was created
  • userId - the unique Id of the User

For example, to order the results by the insert instant in descending order, the value would be provided as insertInstant DESC. The final string is optional, can be set to ASC or DESC, or omitted and will default to ASC.

startRowIntegerDefaults to 0

The offset row to return results from. If the search has 200 records in it and this is 50, it starts with row 50.

userIdUUID

The unique Id of the User to search for Group Members. A single user may belong to one or more Groups, so searching on this field may still produce multiple results.


API Key Authentication
Search Group Members using the given search criteria
POST /api/group/member/search

When calling the API using a POST request you will send the search criteria in a JSON request body.

Request Body

search.groupIdUUID

The unique Id of the Group used to search for Group Members.

search.numberOfResultsIntegerDefaults to 25

The number of results to return from the search.

search.orderByStringDefaults to name ASC

The database column to order the search results on plus the order direction.

The possible values are:

  • groupId - the unique Id of the Group
  • id - the id of the Group Member
  • insertInstant - the instant when the Group Member was created
  • userId - the unique Id of the User

For example, to order the results by the insert instant in descending order, the value would be provided as insertInstant DESC. The final string is optional, can be set to ASC or DESC, or omitted and will default to ASC.

search.startRowIntegerDefaults to 0

The offset row to return results from. If the search has 200 records in it and this is 50, it starts with row 50.

search.userIdUUID

The unique Id of the User to search for Group Members. A single user may belong to one or more Groups, so searching on this field may still produce multiple results.

Response

Response Codes
Code Description
200 The request was successful. The response will contain a JSON body.
400 The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401 You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
500 There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Response Body

membersArray

A list of the Group Members that matched the search criteria.

members[x].dataObject

An object that can hold any information about the Group Member that should be persisted.

members[x].groupIdUUID

The unique Group Id that indicates the Group this membership represents.

members[x].idUUID

The unique Id of this Group Member.

members[x].insertInstantLong

The instant that this membership was created.

members[x].userIdUUID

The unique User Id that represents the User this membership represents.

totalInteger

The total number of Group Members matching the search criteria. Use this value along with the numberOfResults and startRow in the Search request to perform pagination.

Example Response JSON
{
  "members": [
    {
      "id": "47ffe8c2-920a-49cc-bfa8-b84889db615e",
      "groupId": "1188edfc-cef3-4555-910e-181ddf6153c0",
      "insertInstant": 1503513015493,
      "userId": "00000000-0000-0001-0000-000000000000"
    }
  ],
  "total": 1
}