Skip to content
/
User Management
Last updated

User Management

This guide walks through managing users in Aritma IAM — inviting users, listing them, and viewing their permissions and group memberships.

Prerequisites

  • An access token with IAM admin permissions
  • A configured tenant

List users

Retrieve a paginated list of all user subjects in your tenant. You can filter by a search query.

Cannot find OpenAPI operation by operationId or pointer

Get a user

Retrieve a single user by their subject ID.

curl -i -X GET \
  'https://developer.aritma.com/_mock/apis/platform/iam/openapi/iam-openapi/v1/users/{userId}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Invite a user

Send an invitation email to a user. The recipient will receive a link to complete registration in Aritma ID. Once they register, they become an active subject in your tenant.

curl -i -X POST \
  https://developer.aritma.com/_mock/apis/platform/iam/openapi/iam-openapi/v1/invitations \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "jane.doe@example.com",
    "permissions": [
      {
        "action": "string",
        "scope": "string"
      }
    ],
    "ttlDays": 0,
    "redirectUri": "string"
  }'
ParameterDescription
emailThe email address to send the invitation to
permissionsThe IAM permissions to grant when the invitation is accepted, as a list of action and scope pairs. You need iam.policy.write on each scope you grant. See Invite a User and Assign Permissions
ttlDaysNumber of days until the invitation expires. Defaults to 7
redirectUriOptional. The URI the user is redirected to after completing registration. Useful for sending users to your own application
Note

The user will appear in your tenant after they accept the invitation and complete registration. Until then, they are not listed as an active subject.

Create a user directly

If your organization has verified domain ownership in Aritma IAM (see Domains), you can create users directly within your tenant without sending an invitation email.

curl -i -X POST \
  https://developer.aritma.com/_mock/apis/platform/iam/openapi/iam-openapi/v1/users/users \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "jane.doe@example.com",
    "fullName": "Jane Doe",
    "phoneNumber": "+4712345678"
  }'
ParameterDescription
emailThe email address for the new user. Must belong to a verified domain
fullNameThe full name of the new user
phoneNumberThe phone number of the new user

View a user's permissions

To see the effective permissions for a user subject, use the subject permissions endpoint:

Cannot find OpenAPI operation by operationId or pointer

View a user's group memberships

To see which groups a user belongs to:

Cannot find OpenAPI operation by operationId or pointer

Check your own permissions

Any authenticated subject can check their own permissions using the /v1/me endpoints - no admin rights required:

curl -i -X GET \
  https://developer.aritma.com/_mock/apis/platform/iam/openapi/iam-openapi/v1/me \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'
Cannot find OpenAPI operation by operationId or pointer
curl -i -X GET \
  https://developer.aritma.com/_mock/apis/platform/iam/openapi/iam-openapi/v1/me/claims \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

GetUserClaims returns the OIDC claims assigned to your subject. Claims are key-value pairs included in your access token and are used by Aritma services and your own applications for authorization decisions.

Previous page
Next page