[ DOC ] entitiesRolesV1 usage question #1349

angelamatta12 · 2025-05-28T13:51:17Z

angelamatta12
May 28, 2025

Documentation page topic
Viewing the roles that a user has using entitiesrolesv1

Describe the error or typo
The documentation seems to be missing some information. I tried running this API call and it gave me an error stating that an invalid UUID was provided. The documentation does not state that a UUID needs to be provided, only to provide a CID and the list of role IDs.

Documentation repository:

entitiesRolesV1
Source code - docstring

Additional context
'errors': [{'code': 400, 'message': "invalid user uuid='' specified"}]}}

Answered by jshcodes

May 28, 2025

Which sample? The combinedUserRolesV1 operation is a different endpoint than entitiesRolesV1. (We're still trying to recreate the scenario you are describing.)

Here is an example of using entitiesRolesV1:

Python 3.13.3 (main, Apr  8 2025, 13:54:08) [Clang 16.0.0 (clang-1600.0.26.6)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import logging
>>> from falconpy import UserManagement
>>> logging.basicConfig(level=logging.DEBUG)
>>> um = UserManagement(debug=True)
DEBUG:falconpy._auth_object._falcon_interface:CREATED: OAuth2 interface class
DEBUG:falconpy._auth_object._falcon_interface:AUTH: Configured for Environment Authentication
DEBUG:falconpy._auth…

View full answer

jshcodes · 2025-05-28T14:48:35Z

jshcodes
May 28, 2025
Maintainer

Hi @angelamatta12 -

We've confirmed the parameters listed in the documentation align to what is published to the API specification for this operation. Can you provide us an example of the code you are executing so we can try to recreate this issue?

0 replies

angelamatta12 · 2025-05-28T15:28:30Z

angelamatta12
May 28, 2025
Author

I am using the sample that is provided in falconpy with hardcoded parameters and it did work when I provided the UUID in the format specified in the swagger API which includes more parameter information than in the falconpy

https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/combinedUserRolesV1

0 replies

jshcodes · 2025-05-28T15:46:40Z

jshcodes
May 28, 2025
Maintainer

Which sample? The combinedUserRolesV1 operation is a different endpoint than entitiesRolesV1. (We're still trying to recreate the scenario you are describing.)

Here is an example of using entitiesRolesV1:

Python 3.13.3 (main, Apr  8 2025, 13:54:08) [Clang 16.0.0 (clang-1600.0.26.6)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import logging
>>> from falconpy import UserManagement
>>> logging.basicConfig(level=logging.DEBUG)
>>> um = UserManagement(debug=True)
DEBUG:falconpy._auth_object._falcon_interface:CREATED: OAuth2 interface class
DEBUG:falconpy._auth_object._falcon_interface:AUTH: Configured for Environment Authentication
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: Base URL set to https://api.crowdstrike.com
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: SSL verification is set to True
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: Timeout set to None seconds
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: Proxy dictionary: None
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: User-Agent string set to: None
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: Token renewal window set to 120 seconds
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: Maximum number of records to log: 100
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: Log sanitization is enabled
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: Pythonic responses are disabled
DEBUG:falconpy._auth_object._falcon_interface:VERSION: Currently running FalconPy v1.5.3
DEBUG:falconpy._auth_object._falcon_interface:OPERATION: oauth2AccessToken
DEBUG:falconpy._auth_object._falcon_interface:ENDPOINT: https://api.crowdstrike.com/oauth2/token (POST)
DEBUG:falconpy._auth_object._falcon_interface:HEADERS: {'User-Agent': 'crowdstrike-falconpy/1.5.3', 'CrowdStrike-SDK': 'crowdstrike-falconpy/1.5.3'}
DEBUG:falconpy._auth_object._falcon_interface:PARAMETERS: None
DEBUG:falconpy._auth_object._falcon_interface:BODY: None
DEBUG:falconpy._auth_object._falcon_interface:DATA: {'client_id': 'REDACTED', 'client_secret': 'REDACTED'}
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): api.crowdstrike.com:443
DEBUG:urllib3.connectionpool:https://api.crowdstrike.com:443 "POST /oauth2/token HTTP/11" 201 1244
DEBUG:falconpy._auth_object._falcon_interface:RECEIVED: Content returned in application/json format
DEBUG:falconpy._auth_object._falcon_interface:STATUS CODE: 201
DEBUG:falconpy._auth_object._falcon_interface:RESULT: {'status_code': 201, 'headers': {'Server': 'nginx', 'Date': 'Wed, 28 May 2025 15:40:54 GMT', 'Content-Type': 'application/json', 'Content-Length': '1244', 'Connection': 'keep-alive', 'X-Cs-Region': 'us-1', 'X-Cs-Traceid': '1cb38bc0-c094-4e30-b484-519ee1b23f2f', 'X-Ratelimit-Limit': '300', 'X-Ratelimit-Remaining': '298', 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'}, 'body': {'access_token': 'REDACTED', 'expires_in': 1799, 'token_type': 'bearer'}}
DEBUG:falconpy._service_class._base_service_class:CREATED: UserManagement interface class
DEBUG:falconpy._service_class._base_service_class:AUTH: Configured for Environment Authentication
DEBUG:falconpy._service_class._base_service_class:CONFIG: Base URL set to https://api.crowdstrike.com
DEBUG:falconpy._service_class._base_service_class:CONFIG: SSL verification is set to True
DEBUG:falconpy._service_class._base_service_class:CONFIG: Timeout set to None seconds
DEBUG:falconpy._service_class._base_service_class:CONFIG: Proxy dictionary: None
DEBUG:falconpy._service_class._base_service_class:CONFIG: User-Agent string set to: None
DEBUG:falconpy._service_class._base_service_class:CONFIG: Token renewal window set to 120 seconds
DEBUG:falconpy._service_class._base_service_class:CONFIG: Maximum number of records to log: 100
DEBUG:falconpy._service_class._base_service_class:CONFIG: Log sanitization is enabled
DEBUG:falconpy._service_class._base_service_class:CONFIG: Pythonic responses are disabled
DEBUG:falconpy._service_class._base_service_class:VERSION: Currently running FalconPy v1.5.3
>>> um.get_roles_mssp("response_workflow_author")
DEBUG:falconpy._service_class._base_service_class:OPERATION: entitiesRolesV1
DEBUG:falconpy._service_class._base_service_class:ENDPOINT: https://api.crowdstrike.com/user-management/entities/roles/v1 (GET)
DEBUG:falconpy._service_class._base_service_class:HEADERS: {'Authorization': 'Bearer REDACTED', 'User-Agent': 'crowdstrike-falconpy/1.5.3', 'CrowdStrike-SDK': 'crowdstrike-falconpy/1.5.3'}
DEBUG:falconpy._service_class._base_service_class:PARAMETERS: {'ids': 'response_workflow_author'}
DEBUG:falconpy._service_class._base_service_class:BODY: None
DEBUG:falconpy._service_class._base_service_class:DATA: None
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): api.crowdstrike.com:443
DEBUG:urllib3.connectionpool:https://api.crowdstrike.com:443 "GET /user-management/entities/roles/v1?ids=response_workflow_author HTTP/11" 200 435
DEBUG:falconpy._service_class._base_service_class:RECEIVED: Content returned in application/json format
DEBUG:falconpy._service_class._base_service_class:STATUS CODE: 200
DEBUG:falconpy._service_class._base_service_class:RESULT: {'status_code': 200, 'headers': {'Server': 'nginx', 'Date': 'Wed, 28 May 2025 15:41:01 GMT', 'Content-Type': 'application/json', 'Content-Length': '435', 'Connection': 'keep-alive', 'Content-Encoding': 'gzip', 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains', 'X-Cs-Region': 'us-1', 'X-Cs-Traceid': 'f6e98a53-36d9-4e78-ba3d-af287879612e', 'X-Ratelimit-Limit': '6000', 'X-Ratelimit-Remaining': '5999'}, 'body': {'meta': {'query_time': 0.016929977, 'powered_by': 'cs.flightcontrolapi', 'trace_id': 'f6e98a53-36d9-4e78-ba3d-af287879612e'}, 'resources': [{'id': 'response_workflow_author', 'display_name': 'Workflow Author', 'description': "Create and edit workflows. Re-execute a failed workflow execution. This role doesn't grant basic Falcon console access. Users assigned this role must have at least one other role assigned to access the Falcon console. Users assigned this role can't include RTR actions in workflows or re-execute a failed workflow that contains RTR actions unless they are also assigned the Real Time Responder - Administrator role.", 'is_global': True, 'type': 'default'}], 'errors': []}}

Here is an example of combinedUserRolesV2 (combinedUserRolesV1 has been deprecated):

Python 3.13.3 (main, Apr  8 2025, 13:54:08) [Clang 16.0.0 (clang-1600.0.26.6)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import logging
>>> from falconpy import UserManagement
>>> logging.basicConfig(level=logging.DEBUG)
>>> um = UserManagement(debug=True)
DEBUG:falconpy._auth_object._falcon_interface:CREATED: OAuth2 interface class
DEBUG:falconpy._auth_object._falcon_interface:AUTH: Configured for Environment Authentication
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: Base URL set to https://api.crowdstrike.com
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: SSL verification is set to True
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: Timeout set to None seconds
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: Proxy dictionary: None
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: User-Agent string set to: None
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: Token renewal window set to 120 seconds
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: Maximum number of records to log: 100
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: Log sanitization is enabled
DEBUG:falconpy._auth_object._falcon_interface:CONFIG: Pythonic responses are disabled
DEBUG:falconpy._auth_object._falcon_interface:VERSION: Currently running FalconPy v1.5.3
DEBUG:falconpy._auth_object._falcon_interface:OPERATION: oauth2AccessToken
DEBUG:falconpy._auth_object._falcon_interface:ENDPOINT: https://api.crowdstrike.com/oauth2/token (POST)
DEBUG:falconpy._auth_object._falcon_interface:HEADERS: {'User-Agent': 'crowdstrike-falconpy/1.5.3', 'CrowdStrike-SDK': 'crowdstrike-falconpy/1.5.3'}
DEBUG:falconpy._auth_object._falcon_interface:PARAMETERS: None
DEBUG:falconpy._auth_object._falcon_interface:BODY: None
DEBUG:falconpy._auth_object._falcon_interface:DATA: {'client_id': 'REDACTED', 'client_secret': 'REDACTED'}
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): api.crowdstrike.com:443
DEBUG:urllib3.connectionpool:https://api.crowdstrike.com:443 "POST /oauth2/token HTTP/11" 201 1244
DEBUG:falconpy._auth_object._falcon_interface:RECEIVED: Content returned in application/json format
DEBUG:falconpy._auth_object._falcon_interface:STATUS CODE: 201
DEBUG:falconpy._auth_object._falcon_interface:RESULT: {'status_code': 201, 'headers': {'Server': 'nginx', 'Date': 'Wed, 28 May 2025 16:01:04 GMT', 'Content-Type': 'application/json', 'Content-Length': '1244', 'Connection': 'keep-alive', 'X-Cs-Region': 'us-1', 'X-Cs-Traceid': 'b77f2db8-5633-4118-b107-b0432f9b85e3', 'X-Ratelimit-Limit': '300', 'X-Ratelimit-Remaining': '299', 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'}, 'body': {'access_token': 'REDACTED', 'expires_in': 1799, 'token_type': 'bearer'}}
DEBUG:falconpy._service_class._base_service_class:CREATED: UserManagement interface class
DEBUG:falconpy._service_class._base_service_class:AUTH: Configured for Environment Authentication
DEBUG:falconpy._service_class._base_service_class:CONFIG: Base URL set to https://api.crowdstrike.com
DEBUG:falconpy._service_class._base_service_class:CONFIG: SSL verification is set to True
DEBUG:falconpy._service_class._base_service_class:CONFIG: Timeout set to None seconds
DEBUG:falconpy._service_class._base_service_class:CONFIG: Proxy dictionary: None
DEBUG:falconpy._service_class._base_service_class:CONFIG: User-Agent string set to: None
DEBUG:falconpy._service_class._base_service_class:CONFIG: Token renewal window set to 120 seconds
DEBUG:falconpy._service_class._base_service_class:CONFIG: Maximum number of records to log: 100
DEBUG:falconpy._service_class._base_service_class:CONFIG: Log sanitization is enabled
DEBUG:falconpy._service_class._base_service_class:CONFIG: Pythonic responses are disabled
DEBUG:falconpy._service_class._base_service_class:VERSION: Currently running FalconPy v1.5.3
>>> um.get_user_grants("USER_UUID_GOES_HERE")
DEBUG:falconpy._service_class._base_service_class:OPERATION: CombinedUserRolesV2
DEBUG:falconpy._service_class._base_service_class:ENDPOINT: https://api.crowdstrike.com/user-management/combined/user-roles/v2 (GET)
DEBUG:falconpy._service_class._base_service_class:HEADERS: {'Authorization': 'Bearer REDACTED', 'User-Agent': 'crowdstrike-falconpy/1.5.3', 'CrowdStrike-SDK': 'crowdstrike-falconpy/1.5.3'}
DEBUG:falconpy._service_class._base_service_class:PARAMETERS: {'user_uuid': 'REDACTED'}
DEBUG:falconpy._service_class._base_service_class:BODY: None
DEBUG:falconpy._service_class._base_service_class:DATA: None
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): api.crowdstrike.com:443
DEBUG:urllib3.connectionpool:https://api.crowdstrike.com:443 "GET /user-management/combined/user-roles/v2?user_uuid=f05fb0cb-9fbc-4a58-b0c3-9fb9188a7530 HTTP/11" 200 302
DEBUG:falconpy._service_class._base_service_class:RECEIVED: Content returned in application/json format
DEBUG:falconpy._service_class._base_service_class:STATUS CODE: 200
DEBUG:falconpy._service_class._base_service_class:RESULT: {'status_code': 200, 'headers': {'Server': 'nginx', 'Date': 'Wed, 28 May 2025 16:01:10 GMT', 'Content-Type': 'application/json', 'Content-Length': '302', 'Connection': 'keep-alive', 'Content-Encoding': 'gzip', 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains', 'X-Cs-Region': 'us-1', 'X-Cs-Traceid': '310602b0-f0f9-419c-b111-2050b908203a', 'X-Ratelimit-Limit': '6000', 'X-Ratelimit-Remaining': '5997'}, 'body': {'meta': {'query_time': 0.05788926, 'pagination': {'offset': 0, 'limit': 100, 'total': 1}, 'powered_by': 'cs.flightcontrolapi', 'trace_id': '310602b0-f0f9-419c-b111-2050b908203a'}, 'resources': [{'uuid': 'REDACTED', 'cid': 'REDACTED', 'role_id': 'app_developer', 'role_name': 'App Developer', 'grant_type': 'direct'}], 'errors': []}}

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[ DOC ] entitiesRolesV1 usage question #1349

Uh oh!

{{title}}

Uh oh!

Replies: 3 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

[ DOC ] entitiesRolesV1 usage question #1349

Uh oh!

angelamatta12 May 28, 2025

Replies: 3 comments

Uh oh!

jshcodes May 28, 2025 Maintainer

Uh oh!

angelamatta12 May 28, 2025 Author

Uh oh!

Uh oh!

jshcodes May 28, 2025 Maintainer

angelamatta12
May 28, 2025

jshcodes
May 28, 2025
Maintainer

angelamatta12
May 28, 2025
Author

jshcodes
May 28, 2025
Maintainer