Users and Roles Management on the Anomali Platform

The endpoints described below can be used to establish and manage role-based access control on the Anomali platform.

Role Management

Use this endpoint to view, create, assign, update, and delete roles.

Request

/api/v1/user_role/

HTTP Methods: GET/PATCH/POST/DELETE

Payload
{
    "name": "test",
    "permissions": ["can_approve_intel", "is_org_admin"]
}

Payload
{
"users": [39], 
"roles": [3009, 3012]
}

Payload
{
    "name": "new_role_name",
    "permissions": ["can_approve_intel"]
}

Response

A response for the GET /api/v1/user_role/ request includes the objects properties that provide details about roles. The response sample below displays information about the rule_intel_creator role.

    "objects": [
        {
            "created_ts": "2024-12-12T21:07:51.909567",
            "id": 3011,
            "match_filter": null,
            "max_search_back": null,
            "modified_ts": "2024-12-12T21:15:49.207885",
            "name": "rule_intel_creator",
            "permissions": [
                "can_approve_intel",
                "can_change_rules"
            ],
            "resource_uri": "/api/v1/user_role/3011/",
            "type": "user"
        },
.    ...
.   ]

User Management

Use this endpoint to view a list of users and their roles, add users to your organization and assign roles to them. For any other actions that you can take with this endpoint such as unlock a user account or delete a user, refer to User Administration.

Request

/api/v1/orgadmin/

HTTP Methods: GET/POST

Payload
{
    "email": "user@example.com",
    "roles": [3012,9,4]
}

Response

A response for the GET /api/v1/orgadmin/ request includes the objects properties that provide details about users and their roles.

The response sample below displays the details for the test@example.com user.

{
  "objects": [
    {
      "avatar_s3_url": "",
      "date_joined": "2020-10-27T21:03:25",
      "date_password_changed": null
    },
    {
      "avatar_s3_url": "",
      "date_joined": "2025-05-22T19:23:50",
      "date_password_changed": null,
      "email": "test@example.com",
      "is_active": true,
      "is_locked": false,
      "last_access_ts": "2025-06-25T05:57:31.215305",
      "last_login": "2025-06-25T05:55:06.287563",
      "must_change_password": false,
      "name": "Test",
      "next_password_change_ts": null,
      "nickname": "",
      "resource_uri": "/api/v1/orgadmin/999/",
      "roles": [
        { "id": 12, "name": "Organization Administrator", "type": "legacy" },
        { "id": 7, "name": "API User", "type": "legacy" },
        { "id": 3155, "name": "test role again 2", "type": "user" },
        { "id": 3223, "name": "TopLogSources", "type": "user" },
        { "id": 14, "name": "MFA Exempt", "type": "legacy" }
      ],
      "user_id": "725"
    }
  ]
}

Managing SSO Security Group Mappings

Use this endpoint to view, create, update, and delete SSO security group mappings.

Request

/api/v1/ssopermission/

HTTP Methods: GET/POST/PATCH/DELETE

Payload
{
    "group": "SecAdminGroup",
    "idp_id": 9,
    "roles": [7]
}

Payload
{
  "idp_id": 9,
  "roles": [7, 3001]
}

Response

A response for the GET /api/v1/ssopermission/?identity_provider_id=<id> request includes the objects properties that provide details about SSO security groups and roles to which they are mapped.

The example below displays details for the 8x9x9f9t9w9sdf9pspdfg SSO security group and the roles mapped to it.

{
  "objects": [
    {
      "group": "8x9x9f9t9w9sdf9pspdfg"
      "id": 1692,
      "identity_provider": "/api/v1/identity-provider/112/",
      "idp_id": 159,
      "resource_uri": "/api/v1/ssopermission/1692/",
      "roles": [
        {
          "id": 4567,
          "name": "Test",
          "type": "user"
        },
        {
          "id": 3238,
          "name": "AnomaliRole_azure",
          "type": "user"
        }
      ]
    }
  ]
}

Anomali Permissions

Below is the list of permissions that can be added to a role. Permissions such as is_readonly, can_use_chat, can_see_api_key cannot be added to a role. To grant these permissions to users, the corresponding system roles must be assigned. To learn how to view the list of system roles, refer to Using System Roles.

Examples

1. To get a list of users and roles assigned to them:

   Copy

   curl 'https://api.threatstream.com/api/v1/orgadmin/' -H 'Authorization: apikey <username>:<api_key>'

2. To get a list of roles:

   Copy

   curl 'https://api.threatstream.com/api/v1/user_role/' -H 'Authorization: apikey <username>:<api_key>'

3. To delete the role whose ID is 4:

   Copy

   curl --request DELETE 'https://api.threatstream.com/api/v1/user_role/4/' -H 'Authorization: apikey <username>:<api_key>' -v

4. Add a new user with the email johnhopkins@anomali.com and assign them the roles whose IDs are 7 and 9:

   Copy

   curl --request POST --data '{"email": "johnhopkins@anomali.com", "roles": [7, 9]}' 'https://api.threatstream.com/api/v1/orgadmin/' -H 'Authorization: apikey <username>:<api_key>' -H 'Content-Type: application/json' -v

5. Create the PlatformOrgAdmin role that includes the following permissions: is_org_admin, is_tfa_exempt, and can_use_match:

   Copy

   curl --request POST --data '{"name": "PlatformOrgAdmin", "permissions": ["is_org_admin", "is_tfa_exempt", "can_use_match"]}' 'https://api.threatstream.com/api/v1/orgadmin/' -H 'Authorization: apikey <username>:<api_key>' -H 'Content-Type: application/json' -v

6. Map the SecAdminGroup SSO security group to the role whose ID is 6 and ID of the identity provider is 7:

   Copy

   curl --request PATCH --data '{"group": "SecAdminGroup", "idp_id": 7, "roles": [6]}' 'https://api.threatstream.com/api/v1/orgadmin/' -H 'Authorization: apikey <username>:<api_key>' -H 'Content-Type: application/json' -v