---
title: "GET /v2/users/:user-id/rights"
method: GET
path: "/v2/users/{user-id}/rights"
---

# GET /v2/users/:user-id/rights

`GET /v2/users/{user-id}/rights`

List the set of all rights granted to a user.

## Path parameters

- `user-id` string, required

## Response `200`

- ListUserRightsResponse
  - `rights` Right[] — All rights of the user. Optional: can be empty
    - `kind` union — Required
      - object
        - `CanActAs` CanActAs, required
          - `value` CanActAs1, required
            - `party` string, required — The right to authorize commands for this party. Required
      - object
        - `CanExecuteAs` CanExecuteAs, required
          - `value` CanExecuteAs1, required
            - `party` string, required — The right to prepare and execute submissions as this party. This right does not entitle the user to perform any reads. If reading is required, a separate ReadAs right must be added. Right to execute as a party is also implicitly contained in the CanActAs right. Required
      - object
        - `CanExecuteAsAnyParty` CanExecuteAsAnyParty, required — The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
          - `value` CanExecuteAsAnyParty1, required — The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
      - object
        - `CanReadAs` CanReadAs, required
          - `value` CanReadAs1, required
            - `party` string, required — The right to read ledger data visible to this party. Required
      - object
        - `CanReadAsAnyParty` CanReadAsAnyParty, required — The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
          - `value` CanReadAsAnyParty1, required — The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
      - object
        - `Empty` Empty8, required
      - object
        - `IdentityProviderAdmin` IdentityProviderAdmin, required — The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
          - `value` IdentityProviderAdmin1, required — The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
      - object
        - `ParticipantAdmin` ParticipantAdmin, required — The right to administer the participant node.
          - `value` ParticipantAdmin1, required — The right to administer the participant node.

## Other responses

- `400` — Invalid value
- `default`

---

[API](https://skmtc.dev/canton/apis/json-ledger-api-http-endpoints.md) · [All operations](https://skmtc.dev/canton/apis/json-ledger-api-http-endpoints/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/canton/json-ledger-api-http-endpoints/revisions/296292e8b8f1/schema)