User roles and permissions

  • 1
  • Question
  • Updated 2 years ago
  • Answered
RingCentral has introduced multiple user roles and permission levels beyond admin and non-admin. I am looking for an API method of interrogating the system to determine whether a particular user is *the* Super Admin or not.
Is there a way to discover this information via the API?
Photo of Automation USA

Automation USA

  • 1,040 Points 1k badge 2x thumb

Posted 2 years ago

  • 1
Photo of Benjamin Dean

Benjamin Dean, Alum

  • 8,642 Points 5k badge 2x thumb
While authenticated as an admin, you can call the Extension List resource to fetch a list of all extensions, or you can call the Extension by ID resource to get a particular Extension, both of these provide details about the extensions which contain a "permissions" object. If the user is an admin, the "admin.enabled" property will be "true".

Get Extension List: https://platform.devtest.ringcentral.com/restapi/v1.0/account/~/extension/
Get Extension by ID: https://platform.devtest.ringcentral.com/restapi/v1.0/account/~/extension/{{ID}}
Photo of Automation USA

Automation USA

  • 1,040 Points 1k badge 2x thumb
Hi Benjamin,

My issue is a RingCentral account can can now have many Super Admins. Therefore the extension's "permissions" object returns 'true' for any number of users who have been assigned 'Super Admin' role.

Unfortunately certain API functions such as the ability to SMS using the main company number as caller ID can still only be performed by *the* Super Admin and no one else.

I am looking for a way to identify that one, *true*, original Super Admin from all the other possible Super Admins.
(Edited)
Photo of Anton Nikitin

Anton Nikitin, Official Rep

  • 2,904 Points 2k badge 2x thumb
"permissions" object inside extension info is deprecated now after introducing roles and permissions functionality. It may not reflect roles assignments properly and should not be used to build any logic on it.

In the majority of cases, if an app requires to identify if certain operation is allowed to logged in user it should call a dedicated API which returns current authorization profile with a list of all granted user permissions. It is very unlikely that app really need to know role assignments to determine user entitlements.

But in the case described above it is even not a matter of permission check. Sending SMS from company numbers is allowed for company operator user (yes, it is main System Admin by default but this setting can be easily changed by end user). Learn more about this feature here: https://devcommunity.ringcentral.com/ringcentraldev/topics/how-to-send-sms-from-the-main-company-num...

If there are any other scenarios where you believe you need to know if a user is "true original System Admin", let us know. I am pretty sure there is a better and more reliable way to achieve your goal.
Photo of Automation USA

Automation USA

  • 1,040 Points 1k badge 2x thumb
Hi Anton,

Thanks for clarifying that it is really the 'Operator' and not necessarily the 'Super Admin' who has the rights to send SMS under the main company caller ID.

That serves my immediate purposes, but as you mentioned, it would be nice to know which authenticated user has which rights, such as the ability to pull down reports.
Photo of Benjamin Dean

Benjamin Dean, Alum

  • 8,642 Points 5k badge 2x thumb
Hey Anton,

You commented the following...
dedicated API which returns current authorization profile with a list of all granted user permissions
To which API resource are you referring please sir? I do not see any new API resource documented in the API Reference or API Explorer?

Are you referring to the Authentication getToken API resource sir? If yes, that makes sense for making determinations in regards to what features an application/integration presents to an agent/operator post-authentication, but it does not address the inquiry which I believe is being made by the developer initially.
I am looking for an API method of interrogating the system to determine whether a particular user is *the* Super Admin or not.
A service which provides context about one or more users would be a property of an Extension, would it not?
(Edited)
Photo of Automation USA

Automation USA

  • 1,040 Points 1k badge 2x thumb
Hi Benjamin,

I believe Anton may have been referring to some future dedicated API to replace the current "permissions" object.
Photo of Benjamin Dean

Benjamin Dean, Alum

  • 8,642 Points 5k badge 2x thumb
Perhaps, but I'm not certain after his opening sentence
"permissions" object inside extension info is deprecated now after introducing roles and permissions functionality.
Photo of Anton Nikitin

Anton Nikitin, Official Rep

  • 2,894 Points 2k badge 2x thumb
I meant that "permissions" attribute from GET /restapi/v1.0/account/~/extension/~/ should not be used. Instead of it one should use GET /restapi/v1.0/account/~/extension/~/authz-profile . Since Roles & Permissions feature is a new one, this API probably was not covered in our public API documentation.
Photo of Automation USA

Automation USA

  • 1,040 Points 1k badge 2x thumb
Thanks Anton. That's 2 for 2 ( and I only asked one question )