Skip to main content

Display or Export of Statically configured user Roles for Auditing.

Feature RequestsAccess ControlUI/UXSpacesPoliciesDashboardOIDC

Being able to audit or display what roles with the space assigned for a user would be helpful in auditing permissions. I am looking to use it for moving to IDP group/role mapping to manage the roles and space permissions via Okta.

Workaround
API Query
Problem
Status: ⬆️ Gathering votes3 comments

Log in to comment and vote

Comments3

  • Amber Beach

    •

    Oct 12

    I’ll give this a shot. It looks promising.

  • Ovidiu Moise

    Team•

    Oct 12

    @Greg Pangrazio following up here, see below my reply.

  • Ovidiu Moise

    Team•

    May 15

    @Greg Pangrazio thanks for your request. Just to make sure I understand your usecase, have you considered the GraphQL API approach? This gives you quite a lot of advantages:

    Complete data access: The API gives you access to all role binding data across spaces, including inherited permissions and policy-driven assignments that a static UI view might miss.

    Automation-friendly: You can script the data extraction and transformation needed for your Okta migration, rather than manually exporting and processing UI data.

    Real-time accuracy: API queries give you current state, while exported snapshots can become stale quickly during a migration.

    Here's a GraphQL query to get you started:

    <pre><code>query {
     spaces {
       id
       name
       roles {
         id
         slug
         name
       }
     }
     apiKeys {
       id
       name
       admin
       roles {
         id
         slug
       }
       spaces {
         id
         name
       }
     }
    }</code></pre>

    You can also use spacectl to export tokens and query this data programmatically. The Audit Trail will show you historical role changes if you need to understand how permissions evolved.

    Since you're moving to IDP-based access management, investing in API-based tooling will serve you better long-term than a UI feature that would only be useful during this transition period.

    Would this approach work for your migration needs? I'm happy to help you refine the queries if you need specific data points.