---
title: "Which group gives which role in which workspace."
method: GET
path: "/v1/organizations/current/scim/mappings"
tags: ["organizations"]
---

# Which group gives which role in which workspace.

`GET /v1/organizations/current/scim/mappings`

## Request

- Base URL: `https://api.50heads.com`
- URL: `https://api.50heads.com/v1/organizations/current/scim/mappings`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://auth.50heads.com/authorize`, token URL `https://auth.50heads.com/token`; client credentials, token URL `https://auth.50heads.com/token`, scopes: `organization:read`)

Organization admins only. A person in several mapped groups gets the highest role in each workspace (admin, member, billing, viewer); a person in no mapped group gets the default role in the default workspace. Behind the `scim` sub-flag: 404 `not_found` while it is off. The SCIM protocol itself is at `/scim/v2` for the identity provider (Okta, Microsoft Entra ID), with the token as its bearer; see the SCIM setup guide.

## Response `200`

OK

- OrganizationScimMappingsResponse
  - `mappings` object[], required
    - `id` string, required
    - `groupId` string, required
    - `groupName` string, required
    - `workspaceId` string, required
    - `workspaceName` string, required
    - `role` 'admin' | 'member' | 'viewer' | 'billing', required
    - `createdAt` string, required
    - `updatedAt` string, required

## Other responses

- `401`: No key or token, or it expired or was revoked.
- `403`: The key or token lacks the scope (`insufficient_scope`), or the action is not allowed.
- `429`: Too many requests; wait for Retry-After.

---

[API](https://skmtc.dev/50heads/apis/50heads-api.md) · [All operations](https://skmtc.dev/50heads/apis/50heads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/50heads/apis/50heads-api/revisions/edbfecb1e360?raw)