# Can't assign iam:groups:read policy to oauth2 client **URL:** \ **Category:** Dynatrace API\ **Tags:** dynatrace-api, tokens\ **Created:** [September 12, 2024, 10:28am UTC](https://community.dynatrace.com/t/cant-assign-iamread-policy-to-oauth2-client/47617 "2024-09-12T10:28:17Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![DaveOps](https://avatars.discourse-cdn.com/v4/letter/d/fbc32d/32.png) [@DaveOps](https://community.dynatrace.com/u/DaveOps)\ **Post date:** [September 12, 2024, 10:28am UTC](https://community.dynatrace.com/t/cant-assign-iamread-policy-to-oauth2-client/47617/1 "2024-09-12T10:28:17Z")
Can’t assign `iam:groups:read` policy to oauth2 client to be able to get a bearer token via sso which allows me to interact with the `/platform/iam/v1` api. Received the following response: ```javascript { "error": { "code": 403, "message": "User not authorized." } } ``` Please advise. ---
**Author:** ![patryk\_ozimek2](https://avatars.discourse-cdn.com/v4/letter/p/bbce88/32.png) [@patryk\_ozimek2](https://community.dynatrace.com/u/patryk_ozimek2)\ **Post date:** [September 12, 2024, 1:01pm UTC](https://community.dynatrace.com/t/cant-assign-iamread-policy-to-oauth2-client/47617/2 "2024-09-12T13:01:06Z")
Hi, Could you please provide the request that you executed? Best Regards Patryk ---
**Author:** ![DaveOps](https://avatars.discourse-cdn.com/v4/letter/d/fbc32d/32.png) [@DaveOps](https://community.dynatrace.com/u/DaveOps)\ **Post date:** [September 12, 2024, 1:41pm UTC](https://community.dynatrace.com/t/cant-assign-iamread-policy-to-oauth2-client/47617/3 "2024-09-12T13:41:55Z")
```markup GET https://{environmentid}.apps.dynatrace.com/platform/iam/v1/organizational-levels/environment/tkx85859/groups?partialGroupName=poc&pageSize=1000403 290 ms GET /platform/iam/v1/organizational-levels/environment/tkx85859/groups?partialGroupName=poc&pageSize=1000 HTTP/1.1 Authorization: Bearer eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEifQ.eyJzdWIiOiIyOTQxMDc1Yi1lYjM0LTQwZmYtYTE3MC01M2M1NjIyYWVjNDciLCJyZXMiOiJ1cm46ZHRhY2NvdW50OmNmYmU0ZGRmLWZkOTktNDU4ZS1iMmE2LWJkNDQ5OTRlZmQxMSIsIl9jbGFpbV9uYW1lcyI6eyJncm91cHMiOiIwIn0sInByZWZlcnJlZF91c2VybmFtZSI6IjI5NDEwNzViLWViMzQtNDBmZi1hMTcwLTUzYzU2MjJhZWM0N0BzZXJ2aWNlLnNzby5keW5hdHJhY2UuY29tIiwiZ3QiOiJjYyIsImludCI6ZmFsc2UsImF1ZCI6ImR0MHMwMi5ZTllLRlI1SCIsInNjb3BlIjoiYWNjb3VudC1lbnYtcmVhZCBhY2NvdW50LWlkbS1yZWFkIiwiX2NsYWltX3NvdXJjZXMiOnsiMCI6eyJlbmRwb2ludCI6bnVsbH19LCJleHAiOjE3MjYxNDg5NjQsImlhdCI6MTcyNjE0ODY2NCwianRpIjoiNjZkMWMzMmItZTBkYS00ZDg1LWE4MWItNmZiMTFhNDY3NzNlIiwiZW1haWwiOiIyOTQxMDc1Yi1lYjM0LTQwZmYtYTE3MC01M2M1NjIyYWVjNDdAc2VydmljZS5zc28uZHluYXRyYWNlLmNvbSJ9._obETzSjgLjpCivGhSeA4GO2Rb1UH9tXlovKyqUB7GCpwmTieVILER1TpqykMwh_Dr44XcP1exDXGEiPb7_PKw User-Agent: PostmanRuntime/7.41.2 Accept: */* Cache-Control: no-cache Postman-Token: 4c14a859-de4a-4bb2-9db2-515a08350d6b Host: tkx85859.apps.dynatrace.com Accept-Encoding: gzip, deflate, br Connection: keep-alive Cookie: AWSALB=HsIT5W022Crk334QBTqgjGr1P1C1OWh8AHF1cJMEYjlhljzpzLS2MVsH+JrjPGRVtithHfwKELtbFLjDWGW+pKBlEu659oqIGMrqm6vSMOzBu9p5HswhqF1PCjDe; AWSALBCORS=HsIT5W022Crk334QBTqgjGr1P1C1OWh8AHF1cJMEYjlhljzpzLS2MVsH+JrjPGRVtithHfwKELtbFLjDWGW+pKBlEu659oqIGMrqm6vSMOzBu9p5HswhqF1PCjDe HTTP/1.1 403 Forbidden vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Accept-Encoding date: Thu, 12 Sep 2024 13:44:50 GMT content-type: application/json content-length: 55 set-cookie: AWSALB=LZuDggOsubvZC5njtw6JCIpkchUnewTFivwz1lPERu4pNHdTT/TVuGqDPjizUY8LI0vMxBrvh6JDt1y3/zm3O8zP6lKmO8bJhOf9jdoSmDaXddsqgC2y7pLWnfdN; Expires=Thu, 19 Sep 2024 13:44:50 GMT; Path=/ set-cookie: AWSALBCORS=LZuDggOsubvZC5njtw6JCIpkchUnewTFivwz1lPERu4pNHdTT/TVuGqDPjizUY8LI0vMxBrvh6JDt1y3/zm3O8zP6lKmO8bJhOf9jdoSmDaXddsqgC2y7pLWnfdN; Expires=Thu, 19 Sep 2024 13:44:50 GMT; Path=/; SameSite=None; Secure strict-transport-security: max-age=31536000 cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 dynatrace-response-source: Service x-content-type-options: nosniff x-xss-protection: 0 referrer-policy: strict-origin-when-cross-origin traceresponse: 00-0f2113aef68326bccb3bc02310b4e92b-443eccf561ea5e80-01 x-dt-tracestate: 67e0a59d-8e83bf33@dt {"error":{"code":403,"message":"User not authorized."}} ``` ---
**Author:** ![Peter\_Youssef](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/peter_youssef/32/14668_2.png) [@Peter\_Youssef](https://community.dynatrace.com/u/Peter_Youssef)\ **Post date:** [September 25, 2024, 7:18pm UTC](https://community.dynatrace.com/t/cant-assign-iamread-policy-to-oauth2-client/47617/4 "2024-09-25T19:18:08Z")
Hi [@DaveOps](https://community.dynatrace.com/user/78577) You can validate the current configuration with IAM team against the provided documentation URL for step-by-step instructions: - [access-tokens-and-oauth-clients](https://docs.dynatrace.com/managed/manage/identity-access-management/access-tokens-and-oauth-clients/oauth-clients) - [access-tokens](https://docs.dynatrace.com/managed/manage/identity-access-management/access-tokens-and-oauth-clients/access-tokens) Regards, Peter. ---
**Author:** ![Gosia\_Murawska](https://avatars.discourse-cdn.com/v4/letter/g/2bfe46/32.png) [@Gosia\_Murawska](https://community.dynatrace.com/u/Gosia_Murawska)\ **Post date:** [January 2, 2025, 3:40pm UTC](https://community.dynatrace.com/t/cant-assign-iamread-policy-to-oauth2-client/47617/5 "2025-01-02T15:40:11Z")
Hi, [@DaveOps](https://community.dynatrace.com/user/78577)! Have you managed to find the answer to your question? It would be great if you share it with the Community 🙂 ---
**Author:** ![erh\_inetum](https://avatars.discourse-cdn.com/v4/letter/e/48db29/32.png) [@erh\_inetum](https://community.dynatrace.com/u/erh_inetum)\ **Post date:** [February 11, 2025, 6:12am UTC](https://community.dynatrace.com/t/cant-assign-iamread-policy-to-oauth2-client/47617/6 "2025-02-11T06:12:26Z")
Hi [@DaveOps](https://community.dynatrace.com/user/78577) , You have to send a curl like this: $ curl --request POST ‘[https://sso.dynatrace.com/sso/oauth2/token](https://sso.dynatrace.com/sso/oauth2/token)’ \ --header ‘Content-Type: application/x-www-form-urlencoded’ \ --data-urlencode ‘grant\_type=client\_credentials’ \ --data-urlencode ‘client\_id=XXXXXXX’ \ --data-urlencode ‘client\_secret=XXXXXXXXXXXXXXXXXXXXXXXXXX’ \ --data-urlencode ‘resource=urn:dtaccount:XXXXXXX’ \ --data-urlencode ‘scope=iam:users:read iam:groups:read’ But first, you have to create an [OAuth client](https://docs.dynatrace.com/managed/shortlink/oauth#create-an-oauth2-client) selecting the scopes you need. Hope it helps. Regards, Elena.