# API Security - machine-to-machine Application groups **URL:** \ **Category:** Questions\ **Created:** [March 11, 2020, 2:23am UTC](https://devforum.okta.com/t/api-security-machine-to-machine-application-groups/8427 "2020-03-11T02:23:46Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![jziegler](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@jziegler](https://devforum.okta.com/u/jziegler)\ **Post date:** [March 11, 2020, 2:23am UTC](https://devforum.okta.com/t/api-security-machine-to-machine-application-groups/8427/1 "2020-03-11T02:23:46Z")
We are trying to protect a [ASP.Net](http://ASP.Net) Core web api using Okta. The front end will only be our customers api’s, no user UI front-end. Using the machine-to-machine account work for me but I am unable to get the groups that the Application is in? As there can be 100’s of them, we don’t want to hard code all allowed client id’s or use a customer DB. Is there a supported way to get the Application groups? ---
**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\ **Post date:** [March 11, 2020, 2:57am UTC](https://devforum.okta.com/t/api-security-machine-to-machine-application-groups/8427/2 "2020-03-11T02:57:33Z")
сan you clarify what you call “application groups” and what is “groups application is in”? ---
**Author:** ![jziegler](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@jziegler](https://devforum.okta.com/u/jziegler)\ **Post date:** [March 11, 2020, 11:11am UTC](https://devforum.okta.com/t/api-security-machine-to-machine-application-groups/8427/3 "2020-03-11T11:11:17Z")
In the Okta UI you can add a User to a group or an Application? ---
**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\ **Post date:** [March 11, 2020, 1:31pm UTC](https://devforum.okta.com/t/api-security-machine-to-machine-application-groups/8427/4 "2020-03-11T13:31:22Z")
So do you want to receive list of groups which user belongs to? or the list of users assigned to the application? ---
**Author:** ![jziegler](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@jziegler](https://devforum.okta.com/u/jziegler)\ **Post date:** [March 11, 2020, 1:50pm UTC](https://devforum.okta.com/t/api-security-machine-to-machine-application-groups/8427/5 "2020-03-11T13:50:23Z")
Neather, using the machine-to-machine(Client Credentials flow), the user == Application (not a user) & Applications can be added to groups? I was able to code a C# unit test using [Unit Testing and Implicit Flow](https://devforum.okta.com/t/unit-testing-and-implicit-flow/1210/4) to logon a normal user and pass the accessToken to the api. But still not sure on the api side how to tell what groups the user is in? I was able to add an access claim to the dev auth server, group1 = isMemberOfGroupName(“group1”), but this seems dump to have to add a access claim per group? ---
**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\ **Post date:** [March 11, 2020, 2:21pm UTC](https://devforum.okta.com/t/api-security-machine-to-machine-application-groups/8427/6 "2020-03-11T14:21:36Z")
Oh, I see now, what you are saying. I don’t think you can get this information unfortunately, as Okta’s claim evaluation doesn’t have this functionality in the Expression Language. It’s available through Okta APIs though. ---
**Author:** ![jziegler](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@jziegler](https://devforum.okta.com/u/jziegler)\ **Post date:** [March 11, 2020, 3:06pm UTC](https://devforum.okta.com/t/api-security-machine-to-machine-application-groups/8427/7 "2020-03-11T15:06:38Z")
Thanks. I see NuGet has a Okta.SDK but that doesn’t support .Net core or are you talking something else? I have tried to call to [https://dev-534507.okta.com/api/v1/users/me/groups](https://dev-534507.okta.com/api/v1/users/me/groups) using the users access\_token & id\_token as a Bearer but the request fail with a 403 Forbidden - [https://developer.okta.com/docs/reference/api/users/](https://developer.okta.com/docs/reference/api/users/). If I call [https://dev-534507.okta.com/api/v1/users/{id}/groups](https://dev-534507.okta.com/api/v1/users/%7Bid%7D/groups) as SSWS I get a responce. Is this the correct way? ---
**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\ **Post date:** [March 11, 2020, 3:31pm UTC](https://devforum.okta.com/t/api-security-machine-to-machine-application-groups/8427/8 "2020-03-11T15:31:55Z")
I think that last one URL you mentioned is a standard one to obtain user groups, I never tried to apply it to oidc\_client honestly. You can check what is in the response, but I think it’s something different from what you expect, as your id represents an application in your m-2-m communication, not a user. The other ones you mentioned in the beginning are just not valid url’s ---
**Author:** ![jziegler](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@jziegler](https://devforum.okta.com/u/jziegler)\ **Post date:** [March 11, 2020, 4:19pm UTC](https://devforum.okta.com/t/api-security-machine-to-machine-application-groups/8427/9 "2020-03-11T16:19:45Z")
I found this link - [No 'groups' scope in the console for the default Authorisation Server](https://devforum.okta.com/t/no-groups-scope-in-the-console-for-the-default-authorisation-server/5573). This does work for a User but not the Machine-To-Machine id. ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [January 24, 2024, 6:54pm UTC](https://devforum.okta.com/t/api-security-machine-to-machine-application-groups/8427/10 "2024-01-24T18:54:35Z")