---
title: "List unassigned space permission combinations"
method: GET
path: "/space-permissions/transition/combinations"
tags: ["Space Permission Transition"]
---

# List unassigned space permission combinations

`GET /space-permissions/transition/combinations`

Lists the unique unassigned space permission combinations currently present on the tenant.
Combinations that already map to a space role are filtered out server-side. Each row carries
the decoded set of space permissions and the principal types that currently hold the
combination — these inform which `principalType` values are valid to include in the matching
bulk role-assignments request.

Results are always sorted by `principalCount` descending. Sort field and sort order are not
configurable; page size is controlled by the `limit` query parameter (default 25, min 1,
max 250). Use the `cursor` field to page through additional results. The `generatedAt` field
reflects the last audit run that populated the combinations table — call the
generate-combinations endpoint to refresh stale data.

**[Permissions](https://confluence.atlassian.com/x/_AozKw) required**:
User must be a Confluence administrator.

## Query parameters

- `cursor` string
- `limit` integer

## Response `200`

Returned with the page of unassigned combinations (possibly an empty `results` array if
no combinations exist or if combinations have not yet been generated for this tenant).

- ListSpacePermissionCombinationsResponse
  - `results` BulkTransitionCombinationEntry[], required — One page of unassigned permission combinations, sorted by principalCount descending.
    - `combinationId` string, required — The opaque id identifying this unique combination of space permissions. Pass directly to the bulk role-assignments or access-removals endpoints.
    - `spaceCount` integer, required — Number of spaces that currently have this combination.
    - `principalCount` integer, required — Number of principals (users / groups / etc.) that currently have this combination.
    - `permissions` BulkTransitionDecodedPermission[], required — The decoded space permissions that make up this combination.
      - `id` string, required — The platform id of the permission (e.g. `VIEW_CONTENT`).
      - `displayName` string, required — Human-readable name of the permission.
    - `principalTypes` string[], required — The principal types that currently hold this combination and can be reassigned via the bulk role-assignments endpoint. Use this to know which `principalType` entries are valid to include in the bulk-assign request for this combination.
  - `generatedAt` string, nullable — ISO-8601 timestamp of the last audit run that populated the combinations table. Absent if the audit task has never run on this tenant.
  - `cursor` string, nullable — Opaque cursor for the next page. Absent when no further results exist.

## Other responses

- `400` — Returned if the `cursor` query parameter is malformed, or if `limit` is not an integer in the range `1`–`250`.
- `401` — Returned if the authentication credentials are incorrect or missing from the request.
- `404` — Returned if the calling user does not have permission or the resource is not found.

---

[API](https://skmtc.net/atlassian/apis/the-confluence-cloud-rest-api-v2.md) · [All operations](https://skmtc.net/atlassian/apis/the-confluence-cloud-rest-api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/atlassian/the-confluence-cloud-rest-api-v2/revisions/c4bd1ed570f2/schema)