Skip to content
Authrim

List committed members with freshness and membership sources

GET
/api/admin/service-groups/{id}/members
Code sample: Shell / cURL 
curl --request GET \
  --url https://auth.example.com/api/admin/service-groups/example/members \
  --header 'Authorization: Bearer <token>'

Service-user membership only; this operation does not grant authorization or emit token claims. Tenant scope is required. Reads require admin:users:read; mutations and previews require admin:users:write. Rule changes use ifMatch optimistic concurrency; a stale version returns 409. Missing or disabled group references, cycles and invalid typed comparisons are rejected. Malformed, empty or non-object JSON request bodies return 400 with group_request_invalid. Only complete per-user snapshots are published. During reconciliation, old snapshots remain readable with stale status; pending or failed results must not be treated as current membership. Pagination scans evaluated subjects, so a page may contain no members and still return a nextCursor. Unevaluated subjects are not included; check reconciliation progress for coverage. If an evaluated member cannot be routed, its last committed membership remains visible with failed freshness; other members in the page are still returned.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
id
required
string
<= 128 characters

Header Parameters

Section titled “Header Parameters ”
X-Tenant-Id
string

Tenant selector for multi-tenant admin requests.

Query Parameters

Section titled “Query Parameters ”
after
string

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Successful operation.

Media type application/json

Catalog operations return revision and groups. Catalog reads additionally return fields, dependencies and scans. Validation returns valid, dependencies, order and optional evaluation. Member listing returns members, nextCursor and coverage. Reconciliation requests return status.

object
revision
integer
groups
Array
object
key
required
string
/^[a-z][a-z0-9_-]{0,63}$/
displayName
required
string
>= 1 characters <= 200 characters
description
string
<= 2000 characters
enabled
boolean
default: true
condition

Null or omitted disables the dynamic contribution; other sources are preserved.

object
One of:
object
op
required
string
Allowed values: all any
args
required
Array
>= 1 items <= 128 items
One of:
object recursive
scimRoleId

Optional explicit link to a tenant-local legacy SCIM role. No existing role data is rewritten.

string
id
string
tenantId
string
fields
object
key
additional properties
object
dependencies
object
key
additional properties
Array<string>
scans
Array<object>
object
binding_ref
string
rule_version
integer
cursor_id
string
processed
integer
failures
integer
status
string
Allowed values: pending processing completed failed
updated_at
integer
valid
boolean
order
Array<string>
evaluation
object
members
Array<object>
object
userId
string
freshness
string
ruleVersion
integer
reason
object
nextCursor
string
nullable
coverage
string
Allowed values: evaluated_subjects
status
string
Allowed values: pending
Example 
{
  "groups": [
    {
      "enabled": true,
      "condition": {
        "op": "all"
      }
    }
  ],
  "scans": [
    {
      "status": "pending"
    }
  ],
  "coverage": "evaluated_subjects",
  "status": "pending"
}

400

Section titled “400 ”

Invalid condition, reference, subject, or unavailable stable input.

Media type application/json
object
error
required
string
Example generated
{
  "error": "example"
}

401

Section titled “401 ”

Authentication required.

Media type application/json
object
error
required
string
Example generated
{
  "error": "example"
}

403

Section titled “403 ”

Insufficient tenant-scoped permissions.

Media type application/json
object
error
required
string
Example generated
{
  "error": "example"
}

404

Section titled “404 ”

Group not found.

Media type application/json
object
error
required
string
Example generated
{
  "error": "example"
}

409

Section titled “409 ”

Rule version conflict or concurrent evaluation.

Media type application/json
object
error
required
string
Example generated
{
  "error": "example"
}

503

Section titled “503 ”

Input storage unavailable. No partial result was published.

Media type application/json
object
error
required
string
Example generated
{
  "error": "example"
}