Is there an API to update a user's authorization?

Avlambertucci · 2025-11-27T20:55:17.190Z

Hi There! I am having trouble trying to give an user from an Org access to a project that only the other Org have it. That's me Scenario Org A -> All users can read project A, a few can read project B Org B -> All can read project B, a few can project B That's why I am giving each project access too all Orgs, but not everyuser can access. My solution so far (unfortunatly not I was expecting) is updating each users with authorizations to correct projects, but that implies lots of requests and I don't know if there is a REST API for that update on user's authorization

A

Ask Inkeep•11/27/25, 8:55 PM

Hi @Avlambertucci, I'm an AI assistant for ZITADEL. While a team member reviews this question, I'll see if I can find relevant sources for your question.

A

Ask Inkeep•11/27/25, 8:55 PM

Answer

Yes, there is a REST API to manage user authorizations in ZITADEL.

To add project roles to a user authorization, you can use the Management API endpoint

/management/v1/users/:userid/grants

/management/v1/users/:userid/grants

/management/v1/users/:userid/grants

/management/v1/users/:userid/grants (1) . When creating the user grant, make sure to use

roleKeys

roleKeys

roleKeys

roleKeys (not

roles

roles

) in the request body to specify the project roles .

Here's the correct format :

curl --location '<http://localhost:8080/management/v1/users/01HZAVZSYJQ9SPVYDGZ2E8PWAB/grants'> \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
    "projectId": "269294608926638083",
    "roleKeys": [
        "protected:root:99999999"
    ]
}'

curl --location '<http://localhost:8080/management/v1/users/01HZAVZSYJQ9SPVYDGZ2E8PWAB/grants'> \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
    "projectId": "269294608926638083",
    "roleKeys": [
        "protected:root:99999999"
    ]
}'

curl --location '<http://localhost:8080/management/v1/users/01HZAVZSYJQ9SPVYDGZ2E8PWAB/grants'> \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
    "projectId": "269294608926638083",
    "roleKeys": [
        "protected:root:99999999"
    ]
}'

curl --location '<http://localhost:8080/management/v1/users/01HZAVZSYJQ9SPVYDGZ2E8PWAB/grants'> \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
    "projectId": "269294608926638083",
    "roleKeys": [
        "protected:root:99999999"
    ]
}'

The key detail is using

roleKeys

roleKeys

roleKeys

roleKeys instead of

roles

roles

in the body - this was clarified in the API documentation at https://zitadel.com/docs/apis/resources/mgmt/management-service-add-user-grant .

For your cross-organization scenario, you can add memberships for users at the organization level using the Management API (2) . If users need permission to create and manage projects, you can use the

ORG_PROJECT_CREATOR

ORG_PROJECT_CREATOR

ORG_PROJECT_CREATOR

ORG_PROJECT_CREATOR role, which allows users to create new projects and automatically become project owners .

You can also list existing authorizations using the Authorization Service V2 API at

/zitadel.authorization.v2.AuthorizationService/ListAuthorizations

/zitadel.authorization.v2.AuthorizationService/ListAuthorizations

/zitadel.authorization.v2.AuthorizationService/ListAuthorizations

/zitadel.authorization.v2.AuthorizationService/ListAuthorizations (3) (4) .

A

Ask Inkeep•11/27/25, 8:55 PM

To learn more, see the sources I considered:

[1] Assign project role to user authorization via API
[2] User authorization using Zitadel API
[3] ListAuthorizations
[4] authorizations api

A

Ask Inkeep•11/27/25, 8:55 PM

Feel free to tag @Ask Inkeep with additional questions.

AAsk Inkeep To learn more, see the sources I considered: [[1] Assign project role to user...

A

Ask InkeepAPP•11/27/25, 9:08 PM

Got it. Tagging @Rajat for additional help.

AAsk Inkeep To learn more, see the sources I considered: [[1] Assign project role to user...

A

Ask InkeepAPP•11/27/25, 9:09 PM

Glad I could be helpful. Feel free to create a new thread with any new questions you may have.

A

AvlambertucciOP•11/28/25, 5:05 PM

@Ask Inkeep is there any api to fetch all projects? because I will need a project id dynamically

A

Ask Inkeep•11/28/25, 5:05 PM

Thanks for the follow-up, @Avlambertucci. I'll get back to you soon.

A

Ask Inkeep•11/28/25, 5:05 PM

Answer

Yes, you can use the Management API to list all projects in an organization questions-help-bugsAPI List Project in ORG .

The endpoint is:

POST <https://$CUSTOM-DOMAIN/management/v1/projects/_search>

POST <https://$CUSTOM-DOMAIN/management/v1/projects/_search>

POST <https://$CUSTOM-DOMAIN/management/v1/projects/_search>

POST <https://$CUSTOM-DOMAIN/management/v1/projects/_search>

When using this endpoint, structure your request body carefully. Based on community discussions, if you're using multiple query filters, you need to separate them into individual query objects rather than combining them in a single object .

Here's the correct approach for searching projects:

{
  "query": {
    "offset": "0",
    "limit": 100,
    "asc": true
  },
  "queries": [
    {
      "nameQuery": {
        "name": "projectname",
        "method": "TEXT_QUERY_METHOD_EQUALS"
      }
    }
  ]
}

{
  "query": {
    "offset": "0",
    "limit": 100,
    "asc": true
  },
  "queries": [
    {
      "nameQuery": {
        "name": "projectname",
        "method": "TEXT_QUERY_METHOD_EQUALS"
      }
    }
  ]
}

{
  "query": {
    "offset": "0",
    "limit": 100,
    "asc": true
  },
  "queries": [
    {
      "nameQuery": {
        "name": "projectname",
        "method": "TEXT_QUERY_METHOD_EQUALS"
      }
    }
  ]
}

{
  "query": {
    "offset": "0",
    "limit": 100,
    "asc": true
  },
  "queries": [
    {
      "nameQuery": {
        "name": "projectname",
        "method": "TEXT_QUERY_METHOD_EQUALS"
      }
    }
  ]
}

The Management API provides access to manage IAM objects like organizations, projects, clients, and users (2) . You can use the

x-zitadel-orgid

x-zitadel-orgid

x-zitadel-orgid

x-zitadel-orgid header to specify which organization's projects you want to list (3) .

A

Ask Inkeep•11/28/25, 5:06 PM

To learn more, see the sources I considered:

questions-help-bugsAPI List Project in ORG
[2] Management API
[3] Get Project By ID

A

Ask Inkeep•11/28/25, 5:06 PM

Feel free to tag @Ask Inkeep with additional questions.

A

AvlambertucciOP•11/28/25, 6:09 PM

@Ask Inkeep I am using a token from a service_user in org A, when I search all the projects it only retrieves the projects on his Org, I need to fetch all projects, and I don't want to create a service_user per org to fetch projects, is there a way of use one service_user and get all projects?

A

Ask Inkeep•11/28/25, 6:09 PM

Thanks for the follow-up, @Avlambertucci. I'll get back to you soon.

A

Ask Inkeep•11/28/25, 6:09 PM

Answer

I wasn't able to find a direct answer, here are some relevant sources:

How to manage organizations from service user using API ? (1) : This discussion shows that to manage organizations across an instance using a service user, you need to add the service user as an IAM Owner by clicking "Default settings" at the top right and selecting "Add a Manager" .
Service user calling
ListMyProjectOrgs
ListMyProjectOrgs
ListMyProjectOrgs
ListMyProjectOrgs returns nothing (2) : This discussion indicates that when using a service user token, you may need to request the audience scope
```
urn:zitadel:iam:org:project🆔zitadel:aud
```
```
urn:zitadel:iam:org:project🆔zitadel:aud
```
to access projects across organizations .

**

A

Ask Inkeep•11/28/25, 6:15 PM

To learn more, see the sources I considered:

[1] How to manage organizations from service user using API ?
[2] Service user calling

ListMyProjectOrgs

ListMyProjectOrgs

ListMyProjectOrgs

ListMyProjectOrgs returns nothing

A

Ask Inkeep•11/28/25, 6:15 PM

Feel free to tag @Ask Inkeep with additional questions.

A

AvlambertucciOP•12/1/25, 8:12 PM

@Ask Inkeep Is there an enpoint to list all roles of a project that us used to grant a project an access?

A

Ask Inkeep•12/1/25, 8:12 PM

Thanks for the follow-up, @Avlambertucci. I'll get back to you soon.

A

Ask Inkeep•12/1/25, 8:12 PM

Answer

I wasn't able to find a direct answer about listing all roles of a project specifically for granting access. Here are some potentially relevant sources:

Retrieve User Roles in ZITADEL : This guide explains how to retrieve user roles across different organizations and projects, including how to add application roles via the ZITADEL Management API (1) .
Search User Grants : This endpoint allows you to search for user grants, which are the roles users have for specific projects and organizations (2) .

If you'd like, I can try to provide a general answer based on my knowledge. Would that be helpful?

A

Ask Inkeep•12/1/25, 8:12 PM

To learn more, see the sources I considered:

[1] Retrieve User Roles in ZITADEL
[2] Search User Grants

A

Ask Inkeep•12/1/25, 8:12 PM

Feel free to tag @Ask Inkeep with additional questions.