# Cannot get a user's groups after authenticating with OpenID

**URL:** <https://devforum.okta.com/t/cannot-get-a-users-groups-after-authenticating-with-openid/20936>\
**Category:** OAuth/OIDC\
**Created:** [June 10, 2022, 2:28am UTC](https://devforum.okta.com/t/cannot-get-a-users-groups-after-authenticating-with-openid/20936 "2022-06-10T02:28:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![amacrobert](https://avatars.discourse-cdn.com/v4/letter/a/8edcca/32.png) [@amacrobert](https://devforum.okta.com/u/amacrobert)\
**Post date:** [June 10, 2022, 2:28am UTC](https://devforum.okta.com/t/cannot-get-a-users-groups-after-authenticating-with-openid/20936/1 "2022-06-10T02:28:12Z")

</div>

I am successfully authenticating with OpenID, then making an API call to `/api/v1/users/me` to get the user’s profile.

Then I try to make a second API call, this time to `/api/users/{userId}/groups` to get the user’s groups. That returns a 403 (Forbidden).

The scopes I attached to the auth code url and subsequent access token are:

```auto
        - openid
        - email
        - profile
        - okta.users.read.self
        - okta.groups.read

```

In summary:

Getting the user data and profile works just fine:

```auto
        $response = $http_client->request(
            'GET',
            'api/v1/users/me',
            [
                'headers' => [
                    'Accept' => 'application/json',
                    'Authorization' => sprintf('Bearer %s', $access_token),
                ]
            ]
        );

```

But this returns a 403:

```auto
        $response = $http_client->request(
            'GET',
            sprintf('api/v1/users/%s/groups', $user->getId()),
            [
                'headers' => [
                    'Accept' => 'application/json',
                    'Authorization' => sprintf('Bearer %s', $access_token),
                ]
            ]
        );

```

What am I missing?

---

<div class="post-metadata">

**Author:** ![erik](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@erik](https://devforum.okta.com/u/erik)\
**Post date:** [June 10, 2022, 6:11am UTC](https://devforum.okta.com/t/cannot-get-a-users-groups-after-authenticating-with-openid/20936/2 "2022-06-10T06:11:06Z")

</div>

Hello,  
The scope you will need for `/api/v1/users/<id>/groups` is `okta.users.read`.  
Also it is not enough for the application to just grant this scope, the user will also need to be part of an Okta Administrator group that has enough permissions to view groups for a user.

With OAuth for Okta, users that are granted tokens with Okta scopes also need to be part of appropriate administrator groups that have enough permissions to cover the scopes, or else a 403 will be returned.  
`/api/v1/users/me` is a special case where the user does not need to be part of any administrator group.

---

<div class="post-metadata">

**Author:** ![amacrobert](https://avatars.discourse-cdn.com/v4/letter/a/8edcca/32.png) [@amacrobert](https://devforum.okta.com/u/amacrobert)\
**Post date:** [June 10, 2022, 12:59pm UTC](https://devforum.okta.com/t/cannot-get-a-users-groups-after-authenticating-with-openid/20936/3 "2022-06-10T12:59:12Z")

</div>

Thanks, that makes sense.

So it looks like the best solution is to make an API token that has access to groups, and use that to query for the user’s groups after they authenticate. Does that sound right?

---

<div class="post-metadata">

**Author:** ![abole](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/abole/32/3030_2.png) [@abole](https://devforum.okta.com/u/abole)\
**Post date:** [June 12, 2022, 11:56am UTC](https://devforum.okta.com/t/cannot-get-a-users-groups-after-authenticating-with-openid/20936/4 "2022-06-12T11:56:22Z")

</div>

Another idea is to add groups as a claim(s) to the token, if you don’t have too many.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 12, 2024, 7:55pm UTC](https://devforum.okta.com/t/cannot-get-a-users-groups-after-authenticating-with-openid/20936/5 "2024-02-12T19:55:18Z")

</div>