Group APIs

1. Overview

A FusionAuth Group is a named object that optionally contains one to many Application Roles.

When a Group does not contain any Application Roles it can still be utilized to logically associate users. Assigning Application Roles to a group allow it to be used to dynamically manage Role assignment to registered Users. In this second scenario as long as a User is registered to an Application the Group membership will allow them to inherit the corresponding Roles from the Group.

The following APIs are provided to manage Groups and Group Membership.

2. Create a Group

This API is used to create a new Group.

2.1. Request

Create a Group with a randomly generated Id

URI

POST /api/group

Create a Group with the provided unique Id

URI

POST /api/group/{groupId}

Table 1. Request Parameters

groupId [UUID] Optional defaults to secure random UUID

The Id to use for the new Group. If not specified a secure random UUID will be generated.

Table 2. Request Body

group.data [Object] Optional

An object that can hold any information about the Group that should be persisted.

gropup.name [String] Required

The name of the Group.

roleIds [Array<UUID>] Optional

The Application Roles to assign to this group.

Example Request JSON
{
  "group": {
    "data": {
      "description": "This group assigns members admin access to all applications.",
      "external": {
        "createdAt": 1503000771468
      }
    },
    "name": "Company Admins"
  },
  "roleIds": [
    "68259c40-0b4e-4245-8956-7e5af0959c2b",
    "00f24e72-52e2-4f55-8ea1-6a06bfe10df5",
    "11a5b1b8-7ef5-476f-af7d-69e19796fa8b"
  ]
}

2.2. Response

The response for this API contains the Group that was created.

Table 3. Response Codes
Code Description

200

The request was successful. The response will contain a JSON body.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

503

The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Table 4. Response Body for a single Group

group.data [Object]

An object that can hold any information about the Group that should be persisted.

group.id [UUID]

The unique Id of the Group.

group.name [String]

The name of the Group.

group.roles [Map<UUID, List<Object>]

The roles assigned to this Group. The map key is the Application Id, the value is an array of Application Roles.

group.roles[applicationId][x].description [String]

The description of the role.

group.roles[applicationId][x].id [UUID]

The Application Role Unique Id

group.roles[applicationId][x].name [String]

The name of the Group.

group.roles[applicationId][x].isDefault [Boolean]

Whether or not the Role is a default role. A default role is automatically assigned to a user during registration if no roles are provided.

group.roles[applicationId][x].isSuperRole [Boolean]

Whether or not the Role is a considered to be a super user role. This is a marker to indicate that it supersedes all other roles. FusionAuth will attempt to enforce this contract when using the web UI, it is not enforced programmatically when using the API.

Example Response JSON
{
  "group": {
    "data": {
      "description": "This group assigns members admin access to all applications.",
      "external": {
        "createdAt": 1503000771468
      }
    },
    "id": "1188edfc-cef3-4555-910e-181ddf6153c0",
    "name": "Company Admins",
    "roles": {
      "931fded0-f917-439d-b447-d7f21b37a134": [
        {
          "id": "68259c40-0b4e-4245-8956-7e5af0959c2b",
          "isDefault": false,
          "isSuperRole": true,
          "name": "admin"
        }
      ],
      "07d1efe7-9a14-433d-8247-2235e67736f0": [
        {
          "id": "00f24e72-52e2-4f55-8ea1-6a06bfe10df5",
          "isDefault": false,
          "isSuperRole": true,
          "name": "ADMIN"
        }
      ],
      "d23e9a51-2b20-4384-9c74-432e12219aad": [
        {
          "id": "11a5b1b8-7ef5-476f-af7d-69e19796fa8b",
          "isDefault": false,
          "isSuperRole": true,
          "name": "Administrator"
        }
      ]
    }
  }
}

3. Retrieve a Group

This API is used to retrieve a single Group by unique Id or all of the configured Groups.

3.1. Request

Retrieve all of the Groups

URI

GET /api/group

Retrieve a Group by Id

URI

GET /api/group/{groupId}

Table 5. Request Parameters

groupId [UUID] Required

The unique Id of the Group to retrieve.

3.2. Response

The response for this API contains either a single Group or all of the Groups. When you call this API with an Id the response will contain a single Group. When you call this API without an Id the response will contain all of the Groups. Both response types are defined below along with an example JSON response.

Table 6. Response Codes
Code Description

200

The request was successful. The response will contain a JSON body.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

404

The object you requested doesn’t exist. The response will be empty.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

503

The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Table 7. Response Body for a single Group

group.data [Object]

An object that can hold any information about the Group that should be persisted.

group.id [UUID]

The unique Id of the Group.

group.name [String]

The name of the Group.

group.roles [Map<UUID, List<Object>]

The roles assigned to this Group. The map key is the Application Id, the value is an array of Application Roles.

group.roles[applicationId][x].description [String]

The description of the role.

group.roles[applicationId][x].id [UUID]

The Application Role Unique Id

group.roles[applicationId][x].name [String]

The name of the Group.

group.roles[applicationId][x].isDefault [Boolean]

Whether or not the Role is a default role. A default role is automatically assigned to a user during registration if no roles are provided.

group.roles[applicationId][x].isSuperRole [Boolean]

Whether or not the Role is a considered to be a super user role. This is a marker to indicate that it supersedes all other roles. FusionAuth will attempt to enforce this contract when using the web UI, it is not enforced programmatically when using the API.

Example Response JSON
{
  "group": {
    "data": {
      "description": "This group assigns members admin access to all applications.",
      "external": {
        "createdAt": 1503000771468
      }
    },
    "id": "1188edfc-cef3-4555-910e-181ddf6153c0",
    "name": "Company Admins",
    "roles": {
      "931fded0-f917-439d-b447-d7f21b37a134": [
        {
          "id": "68259c40-0b4e-4245-8956-7e5af0959c2b",
          "isDefault": false,
          "isSuperRole": true,
          "name": "admin"
        }
      ],
      "07d1efe7-9a14-433d-8247-2235e67736f0": [
        {
          "id": "00f24e72-52e2-4f55-8ea1-6a06bfe10df5",
          "isDefault": false,
          "isSuperRole": true,
          "name": "ADMIN"
        }
      ],
      "d23e9a51-2b20-4384-9c74-432e12219aad": [
        {
          "id": "11a5b1b8-7ef5-476f-af7d-69e19796fa8b",
          "isDefault": false,
          "isSuperRole": true,
          "name": "Administrator"
        }
      ]
    }
  }
}
Table 8. Response Body for all Groups

groups [Array]

The list of Group objects.

groups[x].data [Object]

An object that can hold any information about the Group that should be persisted.

groups[x].id [UUID]

The name of the Group.

groups[x].name [String]

The name of the Group.

groups[x].roles [Map<UUID, List<Object>]

The roles assigned to this Group. The map key is the Application Id, the value is an array of Application Roles.

groups[x].roles[applicationId][x].description [String]

The description of the role.

groups[x].roles[applicationId][x].id [UUID]

The Application Role Unique Id

groups[x].roles[applicationId][x].name [String]

The name of the Group.

groups[x].roles[applicationId][x].isDefault [Boolean]

Whether or not the Role is a default role. A default role is automatically assigned to a user during registration if no roles are provided.

groups[x].roles[applicationId][x].isSuperRole [Boolean]

Whether or not the Role is a considered to be a super user role. This is a marker to indicate that it supersedes all other roles. FusionAuth will attempt to enforce this contract when using the web UI, it is not enforced programmatically when using the API.

Example Response JSON
{
  "groups": [
    {
      "data": {
        "description": "This group assigns members admin access to all applications.",
        "external": {
          "createdAt": 1503000771468
        }
      },
      "id": "1188edfc-cef3-4555-910e-181ddf6153c0",
      "name": "Company Admins",
      "roles": {
        "931fded0-f917-439d-b447-d7f21b37a134": [
          {
            "id": "68259c40-0b4e-4245-8956-7e5af0959c2b",
            "isDefault": false,
            "isSuperRole": true,
            "name": "admin"
          }
        ],
        "07d1efe7-9a14-433d-8247-2235e67736f0": [
          {
            "id": "00f24e72-52e2-4f55-8ea1-6a06bfe10df5",
            "isDefault": false,
            "isSuperRole": true,
            "name": "ADMIN"
          }
        ],
        "d23e9a51-2b20-4384-9c74-432e12219aad": [
          {
            "id": "11a5b1b8-7ef5-476f-af7d-69e19796fa8b",
            "isDefault": false,
            "isSuperRole": true,
            "name": "Administrator"
          }
        ]
      }
    }
  ]
}

4. Update a Group

This API is used to update an existing Group. You must specify the Id of the Group you are updating on the URI. You must specify all of the properties of the Group when calling this API. This API does not merge the existing Group and your new data. It replaces the existing Group with your new data.

4.1. Request

Update the Group with the given Id

URI

PUT /api/group/{groupId}

Table 9. Request Parameters

groupId [UUID] Required

The Id of the Group to update.

Table 10. Request Body

group.data [Object] Optional

An object that can hold any information about the Group that should be persisted.

gropup.name [String] Required

The name of the Group.

roleIds [Array<UUID>] Optional

The Application Roles to assign to this group.

Example Request JSON
{
  "group": {
    "data": {
      "description": "This group assigns members admin access to all applications.",
      "external": {
        "createdAt": 1503000771468
      }
    },
    "name": "Company Admins"
  },
  "roleIds": [
    "68259c40-0b4e-4245-8956-7e5af0959c2b",
    "00f24e72-52e2-4f55-8ea1-6a06bfe10df5",
    "11a5b1b8-7ef5-476f-af7d-69e19796fa8b"
  ]
}

4.2. Response

The response for this API contains the Group that was updated.

Table 11. Response Codes
Code Description

200

The request was successful. The response will contain a JSON body.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

404

The object you are trying to updated doesn’t exist. The response will be empty.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

503

The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Table 12. Response Body

group.data [Object]

An object that can hold any information about the Group that should be persisted.

group.id [UUID]

The unique Id of the Group.

group.name [String]

The name of the Group.

group.roles [Map<UUID, List<Object>]

The roles assigned to this Group. The map key is the Application Id, the value is an array of Application Roles.

group.roles[applicationId][x].description [String]

The description of the role.

group.roles[applicationId][x].id [UUID]

The Application Role Unique Id

group.roles[applicationId][x].name [String]

The name of the Group.

group.roles[applicationId][x].isDefault [Boolean]

Whether or not the Role is a default role. A default role is automatically assigned to a user during registration if no roles are provided.

group.roles[applicationId][x].isSuperRole [Boolean]

Whether or not the Role is a considered to be a super user role. This is a marker to indicate that it supersedes all other roles. FusionAuth will attempt to enforce this contract when using the web UI, it is not enforced programmatically when using the API.

Example Response JSON
{
  "group": {
    "data": {
      "description": "This group assigns members admin access to all applications.",
      "external": {
        "createdAt": 1503000771468
      }
    },
    "id": "1188edfc-cef3-4555-910e-181ddf6153c0",
    "name": "Company Admins",
    "roles": {
      "931fded0-f917-439d-b447-d7f21b37a134": [
        {
          "id": "68259c40-0b4e-4245-8956-7e5af0959c2b",
          "isDefault": false,
          "isSuperRole": true,
          "name": "admin"
        }
      ],
      "07d1efe7-9a14-433d-8247-2235e67736f0": [
        {
          "id": "00f24e72-52e2-4f55-8ea1-6a06bfe10df5",
          "isDefault": false,
          "isSuperRole": true,
          "name": "ADMIN"
        }
      ],
      "d23e9a51-2b20-4384-9c74-432e12219aad": [
        {
          "id": "11a5b1b8-7ef5-476f-af7d-69e19796fa8b",
          "isDefault": false,
          "isSuperRole": true,
          "name": "Administrator"
        }
      ]
    }
  }
}

5. Delete a Group

This API is used to permanently delete a Group. Deleting a Group that has Application Roles will effectively modify User Registrations by removing these Roles from Group members.

5.1. Request

Delete a Group by Id

URI

DELETE /api/group/{groupId}

Table 13. Request Parameters

groupId [UUID] Required

The unique Id of the Group to delete.

5.2. Response

This API does not return a JSON response body.

Table 14. Response Codes
Code Description

200

The request was successful. The response will be empty.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

404

The object you are trying to delete doesn’t exist. The response will be empty.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

503

The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

6. Add Users to a Group

This API is used to add Users to a Group. A User that is added to a Group is called a member, a user can belong to one to many Groups.

Adding a User to a Group can be used to logically group users, Group members can be returned by the Search API by searching by the Group Id. Application Roles may also be managed by a Group membership. When a User becomes a member of a Group they will inherit the Application Roles assigned to the Group for their registered Applications. If a User is not registered for an Application the Application Roles for that Application will not be applied to the User.

6.1. Request

Add Users to Group

URI

POST /api/group/member

Table 15. Request Body

members[groupId][x].data [Object] Optional

An object that can hold any information about the Group Member that should be persisted.

members[groupId][x].id [UUID] Optional

The unique Id of this Group Member. If not specified a secure random UUID will be generated.

members[groupId][x].userId [UUID] Required

The User Id to add as a Member of this Group.

Example Request JSON
{
  "members": {
    "1188edfc-cef3-4555-910e-181ddf6153c0": [
      {
        "data": {
          "fruit": "orange"
        },
        "userId": "00000000-0000-0001-0000-000000000000"
      }
    ]
  }
}

6.2. Response

Table 16. Response Codes
Code Description

200

The request was successful. The response will contain a JSON body.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

503

The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Table 17. Response Body

members[groupId][x].data [Object]

An object that can hold any information about the Group Member that should be persisted.

members[groupId][x].id [UUID]

The unique Id of this Group Member. If not specified a secure random UUID will be generated.

members[groupId][x].insertInstant [Long]

The instant that this membership was created.

members[groupId][x].userId [UUID]

The User Id to add as a Member of this Group.

Example Response JSON
{
  "members": {
    "1188edfc-cef3-4555-910e-181ddf6153c0": [
      {
        "data": {
          "fruit": "orange"
        },
        "id": "47ffe8c2-920a-49cc-bfa8-b84889db615e",
        "insertInstant": 1503513015493,
        "userId": "00000000-0000-0001-0000-000000000000"
      }
    ]
  }
}

7. Remove Users from a Group

This API is used to remove Users from a Group. Removing a User from a Group removes their Group membership. Removing a User from a Group effectively modifies their assigned Roles if Application Roles are being managed through the Group membership.

7.1. Request

Remove a single User from a Group by Member Id

URI

DELETE /api/group/member/{memberId}

Table 18. Request Parameters

memberId [UUID] Required

The unique Id of the Group Member to delete.

Remove a single User from a Group by User Id and Group Id

URI

DELETE /api/group/member?groupId={groupId}&userId={userId}

Table 19. Request Parameters

groupId [UUID] Required

The unique Id of the Group to remove the User from.

userId [UUID] Required

The unique Id of the User to remove from the Group.

Remove all Users from a Group

URI

DELETE /api/group/member?groupId={groupId}

Table 20. Request Parameters

groupId [UUID] Required

The unique Id of the Group.

Remove Users from a Group by Member Id

URI

DELETE /api/group/member

Table 21. Request Body

memberIds [Array] Required

An array of member Ids to delete.

Example Request JSON
{
  "memberIds": [
    "222b884b-a0a1-4563-a957-89c7c0513e6e",
    "80d474bf-0dee-4009-b793-ec1255693fa3",
    "16d98a8b-4205-4441-8831-7e3f73154134"
  ]
}

Remove specified Users from a Group by Group Id

URI

DELETE /api/group/member

Table 22. Request Body

members[groupId][x] [Array] Required

An array of User Ids to remove from the Group specified by Group Id.

Example Request JSON
{
  "members": {
    "1188edfc-cef3-4555-910e-181ddf6153c0": [
      [
        "578e52df-83e8-48ca-899b-3aefd56e7fc5",
        "0928cf95-34d1-44cc-9114-da68a07e5ff8"
      ]
    ]
  }
}

7.2. Response

This API does not return a JSON response body.

Table 23. Response Codes
Code Description

200

The request was successful. The response will be empty.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

404

The object you are trying to delete doesn’t exist. The response will be empty.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

503

The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.