Get groups that users belong to efficiently via the Okta API Skip to main content
https://support.okta.com/help/answers?id=9062a000000xzq8qag&refurl=http%3a%2f%2fsupport.okta.com%2fhelp%2fanswers
How satisfied are you with the Okta Help Center?
Thank you for your feedback!
How satisfied are you with the Okta Help Center?
1
2
3
4
5
Very Dissatisfied
Very satisfied
Enter content less than 200 characters.
Ask Search:
Chico CharlesworthChico Charlesworth 

Get groups that users belong to efficiently via the Okta API

Hi,

I am using the Okta API to list all users and groups, including what users belong to what group.

At the moment, I am doing the following:
 * Call List Users API to get all users
 * Call List Groups API to get all groups
 * Call List Group Members API for EACH group (as many API calls as there are groups!)

The issue with the above is that if there are many groups (e.g. 100 or more) then I would need to call the Okta API many times (e.g 100 times), which is not ideal! :(

Is there a more efficient way of getting the groups that a user belongs to?
If not, then I would like to suggest either adding the groupIds for each user in the List Users API response, or adding the userIds for each group in the List Groups API response, or both.

Cheers,
Chico
Cosmin OlteanuCosmin Olteanu (Okta, Inc.)
Please utilize the following API calls to obtain your desired results:

GET subdomain.domain.com/api/v1/users
GET subdomain.domain.com/api/v1/groups
GET subdomain.domain.com/api/v1/groups/{{groupIs}}/users

Note that these endpoints are rate limited and you will need to use pagination, grabbing the Link provided in the Headers response if you have too many results. Groups for instance has 10,000 results before pagination. The limit will be presented in the Link.

Thank you for choosing Okta.
Chico CharlesworthChico Charlesworth
Hi,

Yes, I understand what API calls to make but I would have to call the last API many times (i.e. as many as there groups). For example, if there are 100 groups then I would have to call subdomain.domain.com/api/v1/groups/{{groupIs}}/users 100 times!

Would it not be possible to include userIds for each group in the List Groups API response?
Maybe it is best if I open a support case for this request.

Chico
Steve DoggettSteve Doggett
I'm trying to do the same thing and really don't want to have to test every group in my application for a user. I'm developing a multi-tenant system and wanted to use groups for the roles within each tenant and assign users to the groups they have access too... For example:

tenant1.admin, tenant1.editor, tenant1.content

There are potentially 1000+ tenants in our system with 3 or 4 roles in each tenant. Making 3000-4000 calls to find out that a user is in 2 groups seems ridiculous. There must be a way to query the groups a user belongs to!
Chico CharlesworthChico Charlesworth
I've posted up an idea to address this issue:
https://support.okta.com/help/ideas/viewIdea.apexp?id=0872A000000bpM4QAI

Please upvote :)