Skip to main content
POST
Add user to group
Adds a user to a Syteca user group. Group memberships drive access scoping — when a user joins a group, the user inherits the group’s Client access, User-to-User access, and assigned roles on PAM secrets/folders.
For ACB deployments updated from a version prior to 1.2, switch to the https://{hostname}/EkranACB server in the Playground.

Permissions required

The Access Token must be issued to a user with the administrative User Management permission.

Common use cases

  • AD group sync — Mirror AD group memberships into Syteca user groups on a nightly schedule.
  • Onboarding workflow — When a new user joins a team, automatically add them to the corresponding Syteca user group.
  • IdP-driven membership — Okta / Azure AD group changes webhook to this endpoint for real-time sync.

Permission inheritance is immediate

Permissions cascade through group membership — the moment a user is added, they have the group’s permissions on all secrets, folders, and Clients the group has access to. No separate “apply” step.

Errors

See Status codes. Common errors:
  • 400 Bad Request — invalid user or group identifier.
  • 403 Forbidden — caller lacks User Management permission.
  • 404 Not Found — user or group doesn’t exist.
  • 409 Conflict — user is already a member of the group.

Remove from group

The complementary removal endpoint.

Get user details

Verify current group memberships.

Update client access

Set individual Client access if group inheritance isn’t enough.

Secret permissions

How groups inherit PAM role permissions.

Authorizations

Authorization
string
header
required

Access token for authentication

Path Parameters

groupId
integer<int32>
required

ID of the target user group (internal Syteca user group)

Body

application/json
user_id
integer<int32>

ID of an internal or domain user that should become a member of the group

Response

User added to group successfully