Skip to content

Get permission sets

GET/roles/permission-sets

Common API · Tenant role management

Get permission set details.

Required permissionpermission-set:list

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
fields query array of string No The fields to return in a partial response.
type query string (enum) No Permission set type.
Must be one of: base, product, setting.
product query string (enum) No Filter permission sets associated with given product name.
Must be one of: endpoint, server, mobile, encryption, emailGateway, webGateway, phishThreat, wireless, firewall, optix, ztna.
access query string (enum) No Access level of permission set.
Must be one of: admin, helpdesk, readOnly.
allowedInCustomRole query boolean No Filter permissions sets allowed in custom roles.
principalType query string (enum) No Principal type of role.
Must be one of: user, service.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/common/v1/roles/permission-sets" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/common/v1/roles/permission-sets",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/common/v1/roles/permission-sets" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/common/v1/roles/permission-sets", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/common/v1/roles/permission-sets", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — List of permission sets.

Response fields

itemsarray of objectrequired
List of permission sets.
A permission set.
Show child attributesHide child attributes
idstringrequired
Permission set identifier.
namestringrequired
Permission set name.
descriptionstring
Permission set description.
typestring (enum)required
Type of permission set.
Must be one of: base, product, setting.
accessstring (enum)
Access level of a permission set.
Must be one of: admin, helpdesk, readOnly.
principalTypesarray of string (enum)required
Principal types for which permission set is allowed.
Each item must be one of: user, service.
productsarray of string (enum)
List of products associated to a permission set of type product.
Items must be unique. Each item must be one of: endpoint, server, mobile, encryption, emailGateway, webGateway, phishThreat, wireless, firewall, optix, ztna.
allowedInCustomRolesbooleanrequired
Signifies if permission set is allowed in a custom role.

Errors

Status Meaning
500 Internal server error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "items": [
    {
      "id": "string",
      "name": "string",
      "description": "string",
      "type": "base",
      "access": "admin",
      "principalTypes": [
        "user"
      ],
      "products": [
        "endpoint"
      ],
      "allowedInCustomRoles": true
    }
  ]
}