Which API to use to list groups in which a given user is a member

[rpl]

Is there an API that can be used to list groups in which a given user is a member? Specifically, I’d be interested in account (not workspace) groups.

It seems there used to be a workspace-level list-parents API referred to in the answers to this question. The current documentation, however, does not seem to mention list-parents – has it been deprecated?

I know I can get the required info by listing each group's users and parsing the response, but that’s rather tedious. Is there an API for this I haven’t found?

[Alberto_Umana]

Hello @rpl,

You can explore this API: https://docs.databricks.com/api/workspace/users/get which would return an attribute (“groups”) showing the groups a user belongs to at the account level

[rpl]

Thanks! But this doesn’t do what I need. It is a workspace-level API that AFAIU returns info on groups that grant the user privileges to the workspace itself, probably also workspace-specific objects like secret scopes, folders etc. If the (account-level) user does not have privileges to he workspace in question, the API returns 404.

What i'm looking for is listing all account-level groups the user is a member in, including groups used to grant privileges to Unity Catalog securable objects. I also don’t necessarily know what workspaces (if any) the user has privileges to when i'm making the query.

[rpl]

@Alberto_Umana, do i understand correctly that there isn’t currently an endpoint that returns the info I need? May I request this feature be added on the roadmap? 🙂

A bit of context: we have tens of catalogs in Unity Catalog and several workspaces in our account. I’d like a convenient way of querying what groups a user belongs to (our groups are named according to the objects they give privileges to). This would help a lot with troubleshooting when a user reports they don't have access to something they think they should.

I guess for the time being, I need to code a function that uses the python SDK and does some joining.

[szymon_dybczak · Accepted solution]

Hi @rpl ,

Maybe you're looking for following endpoint. This endpoint will return in its payload all groups along with membership info. Then you can easily find where user you're interested in belongs to.

List group details | Account Groups API | REST API reference | Databricks on AWS

[rpl]

That API returns the members of a group. I'm looking for the converse: i know the user and i'd like to know what groups they are a member of.

[szymon_dybczak]

This API will return all groups that belong to your account. Also, in the json payload you have members attribute that you can leverge to filter out payload by a member to whom you want to find group names he belongs to.
If you perform that filtration, you'll end up with all the groups this user belongs to.

[rpl]

Brilliant, thank you! I tried out that one via databricks CLI, but the CLI doesn’t return members. Using the API directly fixed that.

[szymon_dybczak]

Hi,

Cool, I'm happy that it worked for you 🙂