# Group Privilege to REST API not working

**URL:** <https://forum.flowable.org/t/group-privilege-to-rest-api-not-working/6710>\
**Category:** Flowable Engine\
**Created:** [September 12, 2020, 10:49am UTC](https://forum.flowable.org/t/group-privilege-to-rest-api-not-working/6710 "2020-09-12T10:49:14Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![krish](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/krish/32/1957_2.png) [@krish](https://forum.flowable.org/u/krish)\
**Post date:** [September 12, 2020, 10:49am UTC](https://forum.flowable.org/t/group-privilege-to-rest-api-not-working/6710/1 "2020-09-12T10:49:14Z")

</div>

In Flowable IDM, I have 10 users added to a group, say Manager\_Group. In privileges tab, I allow access to the REST Api for the Manager\_Group. When I try to access the REST API using one of the users from Manager\_Group, I get Forbidden error. Can’t the users of a group access the REST API if privilege is given to at group level ?

---

<div class="post-metadata">

**Author:** ![joram](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/joram/32/26_2.png) [@joram](https://forum.flowable.org/u/joram)\
**Post date:** [September 13, 2020, 9:24pm UTC](https://forum.flowable.org/t/group-privilege-to-rest-api-not-working/6710/2 "2020-09-13T21:24:10Z")

</div>

Yes, that sounds like it should (but haven’t tested it). And it works when you give the privilege to a user directly?

---

<div class="post-metadata">

**Author:** ![krish](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/krish/32/1957_2.png) [@krish](https://forum.flowable.org/u/krish)\
**Post date:** [September 14, 2020, 2:51am UTC](https://forum.flowable.org/t/group-privilege-to-rest-api-not-working/6710/3 "2020-09-14T02:51:46Z")

</div>

Yes. It works perfectly fine when assigned to a user directly.  
One more observation I found was, group privileges work for other applications(Modeler, Task). It doesn’t work for REST API alone.

---

<div class="post-metadata">

**Author:** ![osbornk](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/osbornk/32/2581_2.png) [@osbornk](https://forum.flowable.org/u/osbornk)\
**Post date:** [September 22, 2021, 9:27pm UTC](https://forum.flowable.org/t/group-privilege-to-rest-api-not-working/6710/4 "2021-09-22T21:27:10Z")

</div>

I can verify that I am seeing this exact same thing.

---

<div class="post-metadata">

**Author:** ![Mahesh155](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@Mahesh155](https://forum.flowable.org/u/Mahesh155)\
**Post date:** [August 16, 2023, 8:24am UTC](https://forum.flowable.org/t/group-privilege-to-rest-api-not-working/6710/5 "2023-08-16T08:24:24Z")

</div>

Hi @krish , Did you got the solution?

---

<div class="post-metadata">

**Author:** ![hello](https://avatars.discourse-cdn.com/v4/letter/h/7993a0/32.png) [@hello](https://forum.flowable.org/u/hello)\
**Post date:** [November 28, 2024, 2:11am UTC](https://forum.flowable.org/t/group-privilege-to-rest-api-not-working/6710/6 "2024-11-28T02:11:17Z")

</div>

exactly same situation as @krish.  
Flowable6.8.0, no solution so far.