# REST API: Getting SAML user role ARNs from AWS app

**URL:** <https://devforum.okta.com/t/rest-api-getting-saml-user-role-arns-from-aws-app/11413>\
**Category:** SAML\
**Created:** [October 19, 2020, 5:32pm UTC](https://devforum.okta.com/t/rest-api-getting-saml-user-role-arns-from-aws-app/11413 "2020-10-19T17:32:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![wolfwin](https://avatars.discourse-cdn.com/v4/letter/w/cab0a1/32.png) [@wolfwin](https://devforum.okta.com/u/wolfwin)\
**Post date:** [October 19, 2020, 5:32pm UTC](https://devforum.okta.com/t/rest-api-getting-saml-user-role-arns-from-aws-app/11413/1 "2020-10-19T17:32:38Z")

</div>

Hello,  
I would like to use the rest api to get the list of AWS IAM role ARNs assigned to a particular application user. I am able to do this in the somewhat piecemeal way below – but is there is a better way of doing this?

1. Get the app:  
`GET /api/v1/apps/<my app id>`
2. Locate and extract the aws account id from the identity provider arn in the response to 1:  
`“settings” -> “app” -> “identityProviderArn”`
3. Get the app user:  
`GET /api/v1/apps/<my app id>/users`
4. Locate the SAML roles from the user profile in the response from 3.  
`"profile" -> "samlRoles"`
5. Construct the aws role arns from 2. and 4.

---

<div class="post-metadata">

**Author:** ![Lijia](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/lijia/32/2295_2.png) [@Lijia](https://devforum.okta.com/u/Lijia)\
**Post date:** [October 21, 2020, 4:31pm UTC](https://devforum.okta.com/t/rest-api-getting-saml-user-role-arns-from-aws-app/11413/2 "2020-10-21T16:31:02Z")

</div>

@wolfwin Can you please open a support ticket through an email to [support@okta.com](mailto:support@okta.com) with this issue? One of our Technical Support Engineers will take the case and assist you in narrowing down the cause of the issue.

---

<div class="post-metadata">

**Author:** ![bruno.souza](https://avatars.discourse-cdn.com/v4/letter/b/9e8a1a/32.png) [@bruno.souza](https://devforum.okta.com/u/bruno.souza)\
**Post date:** [January 19, 2022, 9:23pm UTC](https://devforum.okta.com/t/rest-api-getting-saml-user-role-arns-from-aws-app/11413/3 "2022-01-19T21:23:26Z")

</div>

https://{url}/api/v1/apps?filter=user.id+eq+"{userid}"&expand=user/{userid}

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 8, 2024, 9:19pm UTC](https://devforum.okta.com/t/rest-api-getting-saml-user-role-arns-from-aws-app/11413/4 "2024-02-08T21:19:54Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.