How to check an ArcGIS Online user's privileges programatically?

Question

Using a stand-alone app built with the ArcGIS Server JavaScript API v4, I'm trying to determine whether the current ArcGIS Online user has permission to access certain functionality, such as the ArcGIS Spatial Analysis tools, which require a license:

To use the analysis tasks, the administrator of your organization needs to grant you certain privileges. To use any of the analysis tools, you will need the Spatial Analysis privilege

I can determine the user's ArcGIS Online userId. From this, how can I determine whether they have the Spatial Analysis privilege?
The help file at https://developers.arcgis.com/rest/enterprise-administration/server/permissions.htm looks promising, but I can't determine what the URL should be for ArcGIS Online. The help file lists this example, but I don't know how to adapt this for ArcGIS Online:
https://machine.domain.com/webadaptor/admin/services/Maps/Test.MapServer/permissions?f=json
Given an ArcGIS Online user ID, how can I determine that user's permissions to create data, or to consume ArcGIS Online credits?

Stephen Lead · Answer

In the absence of a better idea, I'm using this workaround.
Using the IdentityManager, create a token for the user, then submit an empty request to the Estimate endpoint for one of the Spatial Analysis tasks, eg:
https://analysis3.arcgis.com/arcgis/rest/services/Estimate/GPServer/EstimateCredits/execute?taskName=DeriveNewLocations&token=append-token-here
If the user has access to this task, the response is:

"error": {
"code": 400,
"details": [
"Error executing tool. EstimateCredits : ERROR 000735: taskParameters: Value is required"
]
}

If this user's token does not allow access, a different error message is shown:

{
"error": {
"code": 498,
"message": "Invalid token. (code = 498). []."
}
}

Berend · Answer

If you do a POST request to https://www.arcgis.com/sharing/rest/community/self with token=blahblah&f=json you will get an extensive list of privileges for the user that created the token.
I'm not sure how to translate this list to what you ask for ('Creating data' and 'Consuming credits'), but I see for instance "features:user:edit" and "features:user:fullEdit" which would be creating data.
I not sure if there's a separate privilege for 'Consuming credits', but I do see "premium:user:spatialanalysis".

How to check an ArcGIS Online user's privileges programatically?

2 Answers

Add your own answers!

Ask a Question