Manage Access Controls for your iTwin member using iTwin roles and permissions.

access-control-v2

This information is included in every event the webhook will receive.

base-event

content

object

eventType

string

enqueuedDateTime

iTwinId

messageId

webhookId

Base Event

Event that gets triggered when a member is added to an iTwin.

accessControl.memberAdded.v1-event

Globally Unique Identifier of the member.

memberId

Globally Unique Identifier of the user added the member.

eventCreatedBy

memberType

Globally Unique Identifier of the role the member was assigned.

roleId

Name of the role the member was assigned.

roleName

accessControl.memberAdded.v1

Event that gets triggered when a member is removed from an iTwin.

accessControl.memberRemoved.v1-event

Globally Unique Identifier of the user who removed the member.

accessControl.memberRemoved.v1

Event that gets triggered when a role is assigned to a member.

accessControl.roleAssigned.v1-event

Globally Unique Identifier of the user who assigned the role.

accessControl.roleAssigned.v1

Event that gets triggered when a role is unassigned to a member.

accessControl.roleUnassigned.v1-event

Globally Unique Identifier of the user who unassigned the role.

accessControl.roleUnassigned.v1

access-control

---

Create a new iTwin group.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:modify`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

A user can create a Group by being assigned the `administration_manage_groups` on the iTwin level. A user also can create a Group on an iTwin by either being an Organization Administrator for the Organization that owns the given iTwin, or an owner of the iTwin.

For creation of Groups on the Account iTwin, the user must be an Organization Administrator for the Organization.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


create-itwin-group

OAuth access token with scope `itwins:modify`

Authorization

Setting to `application/vnd.bentley.itwin-platform.v2+json` is recommended.

Accept

default

This response indicates that request lacks valid authentication credentials. Access token might not been provided, issued by the wrong issuer, does not have required scopes or request headers were malformed.

HeaderNotFound

application/json;InvalidAuthorizationScheme

InvalidAuthorizationScheme

InvalidHeaderValue

RequiredScopeMissing

Unauthorized

The user has insufficient permissions for the requested operation.

This response indicates the iTwin was not found.

Invalid request to create new iTwin group. Make sure request had required properties and does not pass in readonly properties.

application/json;InvalidiTwinsGroupRequest

InvalidiTwinsGroupRequest

This response indicates that the user has sent too many requests in a given amount of time.

The number of requests exceeds the rate-limit for the client subscription.

retry-after

---

Delete the specified iTwin group.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:modify`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

A user can delete a Group by being assigned the `administration_manage_groups` on the iTwin level. A user also can delete a Group on an iTwin by either being an Organization Administrator for the Organization that owns the given iTwin, or an owner of the iTwin.

For deletion of Groups on the Account iTwin, the user must be an Organization Administrator for the Organization.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


delete-itwin-group

groupId

This response indicates iTwin or group was not found.

ItwinNotFound

GroupNotFound

---

Retrieves the specified group for the specified iTwin. The `members` and `imsGroups` properties are both capped at 50 each.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:read`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

User must be an Organization Administrator for the Organization that owns the given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


get-itwin-group

OAuth access token with scope `itwins:read`

This response indicates that iTwin or group with specified ID was not found.

---

Retrieves a list of all groups that are defined for a specified iTwin. The `members` and `imsGroups` properties are both capped at 50 each.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:read`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

User must be an Organization Administrator for the Organization that owns the given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


get-itwin-groups

This response indicates that iTwin with specified ID was not found.

---

Update the specified iTwin group. The `members` and `imsGroups` properties are both capped at 50 each.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:modify`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

A user can update a Group by being assigned the `administration_manage_groups` on the iTwin level. If the user is adding members or IMS groups they must also have the `administration_invite_member` permission assigned at the iTwin level. If the user is removing members or IMS groups they must also have the `administration_remove_member` permission assigned at the iTwin level.

A user also can update a Group on an iTwin by either being an Organization Administrator for the Organization that owns the given iTwin, or an owner of the iTwin.

To update a Group on the Account iTwin, the user must be an Organization Administrator for the Organization.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page

---


update-itwin-group

A new group name

This response indicates that iTwin, group, member, or IMS group with specified ID was not found.

TeamMemberNotFound

ImsGroupNotFound

Invalid request to update iTwin group. User or IMS Group already exists in iTwin group.

UserExists

ImsGroupExists

Invalid request to update iTwin group. Make sure request had required properties, does not pass in readonly properties, and does not exceed maximum size

---

Retrieves a list of iTwin member invitations. By default, users will receive the invitations they have sent. If the user is an iTwin Owner, they will receive all invitations for the iTwin.

Invitations have an expiration of 7 days after their creation. Once that expiration passes, the invitation will not be returned.

### Authorization

The calling user must be a member of the iTwin. Organization Administrator can also retrieve iTwin member invitations for any iTwin in their Organization.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


get-itwin-member-invitations

Invalid request to get iTwin member invitations.

---

Add new iTwin group members

The total number of roles assigned in this request must not exceed 50. This can be achieved with many different configurations. For example, 1 role can be assigned to 50 groups, or 5 roles can be assigned to 10 groups, both resulting in 50 role assignments. 

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:modify`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

User must have the `administration_invite_member` permission assigned at the iTwin level or be an Organization Administrator for the Organization that owns a given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


add-itwin-group-members

iTwin group members was successfully added.

This response indicates that iTwin, group, or roles with specified ID were not found.

RoleNotFound

Invalid request to add new iTwin member. Member already exists in iTwin.

Invalid request to add new iTwin member. Request payload might be missing some of the required properties.

---

Add new iTwin owner members. iTwin Owners are users which have full control over the iTwin. Each owner is granted all permissions on the iTwin, allowing them to perform any action on the iTwin they own.

Users which are external (i.e. not in the same organization as the iTwin) are not automatically added to the iTwin. Instead, they're invited. Users which are not external, are immediately added as members on the iTwin.

Invited individuals will recieve an invitation via Email, where they'll be prompted to accept the invitation. Upon accepting, they'll then become a member of the iTwin.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:modify`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

You must be an owner to add other owners.

### Authorization

User must have the `administration_invite_member` permission assigned at the iTwin level or be an Organization Administrator for the Organization that owns a given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


add-itwin-owner-member

Invalid request to add new iTwin user member. A conflict occurred during this request.

OwnerAlreadyExists

application/json;MaxPendingInvitationsExists

MaxPendingInvitationsExists

Invalid request to add new iTwin owner member. Request payload might be missing some of the required properties.

---

Add or Invite new iTwin user members. Users which are external (i.e. not in the same organization as the iTwin) are not automatically added to the iTwin. Instead, they're invited. Users which are not external, are immediately added as members on the iTwin.

Invited individuals will recieve an invitation via Email, where they'll be prompted to accept the invitation. Upon accepting, they'll then become a member of the iTwin.

The total number of roles assigned in this request must not exceed 50. This can be achieved with many different configurations. For example, 1 role can be assigned to 50 users, or 5 roles can be assigned to 10 users, both resulting in 50 role assignments. 

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:modify`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

User must have the `administration_invite_member` permission assigned at the iTwin level or be an Organization Administrator for the Organization that owns a given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


add-itwin-user-members

iTwin user member was successfully added.

This response indicates that iTwin, user member, or roles with specified ID were not found.

Invalid request to add new iTwin user member. User Member already exists in iTwin.

TeamMemberExists

Invalid request to add new iTwin user member. Request payload might be missing some of the required properties.

---

Retrieves a specific group member for a specified iTwin.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:read`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

The calling user must be a member of the iTwin. Organization Administrator can also retrieve an iTwin member for any iTwin in their Organization.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


get-itwin-group-member

This response indicates that iTwin or group with the specified ID was not found.

---

Retrieves a list of iTwin group members and their roles assignments.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:read`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

The calling user must be a member of the iTwin. Organization Administrator can also retrieve iTwin members for any iTwin in their Organization.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


get-itwin-group-members

---

Retrieves a list of iTwin owner members. iTwin Owners are users which have full control over the iTwin. Each owner is granted all permissions on the iTwin, allowing them to perform any action on the iTwin they own.

### Missing Users

When members are removed from the Bentley Identity Management System, they are not automatically removed from the iTwin. Therefore, it is possible to have a situation where the user is no longer valid, yet they are still a member of the iTwin. When this happens, the user member will be returned from this API endpoint with the follow values:
```
{
    "id": <memberId>,
    "email": null,
    "givenName": null,
    "surname": null,
    "organization": null,
    ...
}
```
You should account for this in your software if you do not want to show these users.

#### Cleanup

The Access Control API will perform a once-a-week cleanup to remove these "Missing Users". You can rely on this automated clean-up if this timeline is sufficient.

If not, you can use the [Remove iTwin Owner Member](https://developer.bentley.com/apis/access-control/operations/remove-iTwin-owner-member/) API (use the memberId) to remove the owner member from the iTwin.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:read`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

The calling user must be a member of the iTwin. Organization Administrator can also retrieve iTwin owner members for any iTwin in their Organization.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


get-itwin-owner-members

Invalid request to get iTwin user members.

---

Retrieves a specific user member for a specified iTwin.

### Missing Users

When users are removed from the Bentley Identity Management System, they are not automatically removed from the iTwin. Therefore, it is possible to have a situation where the user is no longer valid, yet they are still a user member of the iTwin. When this happens, the user member will be returned from this API endpoint with the follow values:
```
{
    "id": <memberId>,
    "email": null,
    "givenName": null,
    "surname": null,
    "organization": null,
    ...
}
```
You should account for this in your software if you do not want to show these users.

#### Cleanup

The Access Control API will perform a once-a-week cleanup to remove these "Missing Users". You can rely on this automated clean-up if this timeline is sufficient.

If not, you can use the [Remove iTwin User Member](https://developer.bentley.com/apis/access-control/operations/remove-iTwin-user-member/) API (use the memberId) to remove the user member from the iTwin.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:read`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

The calling user must be a member of the iTwin. Organization Administrator can also retrieve an iTwin user member for any iTwin in their Organization.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


get-itwin-user-member

This response indicates that iTwin or user member with specified ID was not found.

---

Retrieves a list of iTwin user members and their roles assignments.

### Missing Users

When members are removed from the Bentley Identity Management System, they are not automatically removed from the iTwin. Therefore, it is possible to have a situation where the user is no longer valid, yet they are still a member of the iTwin. When this happens, the user member will be returned from this API endpoint with the follow values:
```
{
    "id": <memberId>,
    "email": null,
    "givenName": null,
    "surname": null,
    "organization": null,
    ...
}
```
You should account for this in your software if you do not want to show these users.

#### Cleanup

The Access Control API will perform a once-a-week cleanup to remove these "Missing Users". You can rely on this automated clean-up if this timeline is sufficient.

If not, you can use the [Remove iTwin User Member](https://developer.bentley.com/apis/access-control/operations/remove-iTwin-user-member/) API (use the memberId) to remove the user member from the iTwin.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:read`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

The calling user must be a member of the iTwin. Organization Administrator can also retrieve iTwin user members for any iTwin in their Organization.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


get-itwin-user-members

---

Remove the specified group member from the iTwin.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:modify`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

User must have the `administration_remove_member` permission assigned at the iTwin level or be an Organization Administrator for the Organization that owns a given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


remove-itwin-group-member

Specified iTwin group member was successfully removed.

---

Remove the specified owner from the iTwin.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:modify`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

You must be an owner to remove other owners.

### Authorization

User must have the `administration_remove_member` permission assigned at the iTwin level or be an Organization Administrator for the Organization that owns a given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


remove-itwin-owner-member

Specified iTwin owner member was successfully removed.

OwnerNotFound

---

Remove the specified user member from the iTwin.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:modify`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

User must have the `administration_remove_member` permission assigned at the iTwin level or be an Organization Administrator for the Organization that owns a given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


remove-itwin-user-member

Specified iTwin user member was successfully removed.

---

Update an iTwin group member's role assignments

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:modify`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

User must have the `administration_invite_member` permission assigned at the iTwin level or be an Organization Administrator for the Organization that owns a given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


update-itwin-group-member

Invalid request to update member roles. Request payload might be missing some of the required properties.

---

Update an iTwin user member's role assignments

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:modify`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

User must have the `administration_invite_member` permission assigned at the iTwin level or be an Organization Administrator for the Organization that owns a given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


update-itwin-user-member

Invalid request to update user member roles. Request payload might be missing some of the required properties.

---

Retrieves the list of all available permissions

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:read`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

No Authorization is required for this API call.

---


get-all-permissions

---

Retrieves a list of permissions the calling user has on a specified iTwin.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:read`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

No Authorization is required for this API call.

---

get-iTwin-permissions

---

Create a new iTwin role.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:modify`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

User must have the `administration_manage_roles` permission assigned at the iTwin level or be an Organization Administrator for the Organization that owns a given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


create-iTwin-role

Invalid request to create new iTwin role. Make sure request had required properties and does not pass in readonly properties.

application/json;InvalidiTwinsRoleRequest

InvalidiTwinsRoleRequest

---

Delete the specified iTwin role.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:modify`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

User must have the `administration_manage_roles` permission assigned at the iTwin level or be an Organization Administrator for the Organization that owns a given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


delete-iTwin-role

This response indicates iTwin or role was not found.

---

Retrieves the specified role for the specified iTwin.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:read`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

User must have the `administration_manage_roles` permission assigned at the iTwin level or be an Organization Administrator for the Organization that owns a given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


get-itwin-role

---

Retrieves a list of available user roles that are defined for a specified iTwin.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:read`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

User must have the `administration_manage_roles` permission assigned at the iTwin level or be an Organization Administrator for the Organization that owns a given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


get-iTwin-roles

---

Update the specified iTwin role.

### Authentication

Requires `Authorization` header with valid Bearer token for scope `itwins:modify`.

For more documentation on authorization and how to get access token visit [OAUTH2 Authorization](https://developer.bentley.com/apis/overview/authorization/) page.

### Authorization

User must have the `administration_manage_roles` permission assigned at the iTwin level or be an Organization Administrator for the Organization that owns a given iTwin.

An Organization Administrator must have at least one of the following roles assigned in User Management: Account Administrator, Co-Administrator, or CONNECT Services Administrator. For more information about User Management please visit our Bentley Communities [Licensing, Cloud, and Web Services](https://communities.bentley.com/communities/other_communities/licensing_cloud_and_web_services/w/wiki/50711/user-management-2-0) wiki page.

---


update-iTwin-role

A iTwin role instance with the fields that should be updated.

PermissionNotFound

Invalid request to update iTwin role. Make sure request had required properties and does not pass in readonly properties.

Samples - Access Control | iTwin Platform

This tutorial will guide you through the process of adding and removing owners on an iTwin

Manage iTwin Owners

This tutorial will guide you through the process of creating and querying roles on an iTwin

Create and Query iTwin Roles

This tutorial will guide you through the process of creating and querying groups on an iTwin

Create and Query iTwin Groups

This tutorial will guide you through the process of managing iTwin user members

Manage User Members on iTwins

This tutorial will guide you through the process of managing iTwin group members