Give access to APIs and create roles
2 min

Before implementing team management features, we need to configure the necessary API resources and roles in Asgardeo. This ensures that Teamspace has the required permissions to manage organizations, users, and their roles.

App Permissions

Let's give the application access to the required API resources.

  1. Navigate to the application in the Asgardeo console.
  2. Click on "API Authorization" tab

  3. Give access to the following APIs.

    API Path Scopes
    Application Management API /api/server/v1/applications view
    Application Management Api /o/api/server/v1/applications view
    Organization Management API /api/server/v1/organizations view, create
    SCIM2 Users API /scim2/Users view, create, list
    SCIM2 Users API /o/scim2/Users view, create, delete, list
    SCIM2 Roles API /scim2/Roles view, update
    SCIM2 Roles API /o/scim2/Roles view, update
    Guest Invitation Management API /o/api/server/v1/guests/invitation create

    App APIs

Note

copy the scopes to be added to your app’s .env file once it is set up in the next steps.

Once access to the APIs is given, create the necessary roles in the application.

  1. Navigate to the “Roles” tab of your application.
  2. Keep the role audience as "Application"
  3. Create roles and assign permissions.

For Teamspace, we can create two roles as follows:

  • TEAM_ADMIN - can manage teams and users
  • This role is assigned to anyone signing up to the app as well. Therefore, the permissions required to add teams and users must be there.
  • Roles API is required to assign the added users to roles.
  • Application API is required to get the app ID.
  • TEAM_MEMBER - can view users in the team

For the TEAM_ADMIN role, give the all permissions in the following paths.

API Path
Application Management Api /o/api/server/v1/applications
Organization Management API /api/server/v1/organizations
SCIM2 Users API /scim2/Users
SCIM2 Users API /o/scim2/Users
SCIM2 Roles API /scim2/Roles
SCIM2 Roles API /o/scim2/Roles
Guest Invitation Management API /o/api/server/v1/guests/invitation

App Roles

For the TEAM_MEMBER role, give the following permissions.

API Path Permissions
SCIM2 Users API /scim2/Users list
SCIM2 Users API /o/scim2/Users list

Info