---
title: "Inspect a user's effective access on every environment"
method: GET
path: "/users/{id}/effective-access"
tags: ["users"]
---

# Inspect a user's effective access on every environment

`GET /users/{id}/effective-access`

Returns the resolved role for each environment the user can access,
following the policy precedence used by the access viewer
(user-endpoint, user-group, team-endpoint, team-group).
Environments where the user has no role are omitted.
**Access policy**: restricted

## Path parameters

- `id` integer, required

## Response `200`

Success

- UsersEffectiveAccessEntry[]
  - `accessLocation` 'environment' | 'environmentGroup'
  - `endpointId` integer
  - `endpointName` string
  - `groupId` integer
  - `groupName` string
  - `roleId` integer
  - `roleName` string
  - `rolePriority` integer
  - `teamId` integer
  - `teamName` string

## Other responses

- `400` — Invalid request
- `403` — Permission denied
- `404` — User not found
- `500` — Server error

---

[API](https://skmtc.net/portainer/apis/portainerce-api.md) · [All operations](https://skmtc.net/portainer/apis/portainerce-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/portainer/portainerce-api/versions/ec51a8194ac0/schema)