ARTIFACTORY: How to Retrieve Users and Groups with DELETE Permissions in Artifactory

Use case 1:

How to Retrieve Users with DELETE Permissions for a Repository?

Learn how to identify users with DELETE permissions and handle null API responses that may cause iteration errors during permission retrieval.

The list of users with DELETE permissions for a repository is causing an error: "Cannot iterate over null."

curl -s -u admin:password \  'https://<artifcatory-url>/artifactory/api/artifactpermissions?repoKey=docker-local' \  | jq '.userEffectivePermissions[] | select(.permissions[] | contains("DELETE"))'


This returned the following error:

jq: error (at <stdin>:0): Cannot iterate over null (null)


The issue occurs because the userEffectivePermissions field is null in the API response. To address this, kindly use the following command, which safely handles null values by defaulting to an empty array and returns the list of users with DELETE permission for the specified repository.

Solution:

curl -s -u admin:password  'https://<artifcatory-url>/artifactory/api/artifactpermissions?repoKey=docker-local' | jq '(.userEffectivePermissions // [])[] | select(.permission.delete == true) | .principal'
Output:
"venki"
"gani"
"testuser"


This command returns the list of users who have DELETE permission for the specific repository.

Use case 2:

Retrieve a List of Groups with DELETE Permissions for a Repository

Learn how to quickly retrieve a list of groups with DELETE permissions for a repository, useful for access validation and permission audits.

curl -s -u <username>:<password> \ 'https://<ARTIFACTORY_URL>/artifactory/api/artifactpermissions?repoKey=<REPOSITORY_NAME>' \
  | jq '[.groupEffectivePermissions[] | select(.permission.delete == true) | .principal]'

Output:

[
  "group2",
  "group1"
]


It will display the names of all groups with delete permissions, as mentioned.

Use case 3:

Retrieve Groups with DELETE Permissions for a Repository (Including Permission Details)

Learn how to identify groups with effective DELETE permissions and view the permission targets through which access is granted.

curl -s -u <username>:<password>\
"https://<ARTIFACTORY_URL>/artifactory/api/artifactpermissions?repoKey=<REPOSITORY_NAME>" \
| jq '(.groupEffectivePermissions // [])[] | select(.permission.delete == true) | {group: .principal, delete: .permission.delete, permissionTargets}'

This returns the effective groups that have DELETE permission on the specified repository. For example:

{
  "group": "group1",
  "delete": true,
  "permissionTargets": [
    "ldap"
  ]
}


Output includes:

Group name (principal) that has effective DELETE permission.

```
 DELETE permission status.
```

 The permission target(s) through which the permission is granted.

Please note that this API returns the effective group permissions for the repository. It does not provide the list of users belonging to the group, nor does it explicitly indicate whether the group is sourced from LDAP or is an internal Artifactory group