# Manage groups

:::callout{intent="info" title="Added in `v1.33`"}
:::

When using [OIDC](deploy-configuration-oidc.md) for authentication, you can leverage user groups defined in your identity provider (like Keycloak, Okta, or Auth0) to manage permissions in Weaviate. The user's group memberships are passed to Weaviate in the OIDC token.

You can then assign Weaviate roles directly to these **OIDC groups**. Any user who is a member of that group will automatically inherit the permissions of the assigned roles. This is a powerful way to manage access for large teams without assigning roles to each user individually.

On this page, you will find examples of how to programmatically **manage OIDC groups** and their associated roles.

## Group management

### Assign roles to an OIDC group

You can assign one or more Weaviate roles to an OIDC group. Any user belonging to this group will inherit the roles' permissions.

This example assigns the `testRole` and `viewer` roles to the `/admin-group`.

:::code-group{sync="languages"}
```python title="Python"
admin_client.groups.oidc.assign_roles(
    group_id="/admin-group", role_names=["testRole", "viewer"]
)
```

```typescript title="JavaScript/TypeScript"
await adminClient.groups.oidc.assignRoles(
    "/admin-group", ["testRole", "viewer"]
);
```

```go title="Go"
// Go support coming soon
```

```java title="Java"
client.groups.assignRoles(testGroup, testRole, "viewer");
```

```csharp title="C#"
await client.Groups.Oidc.AssignRoles(testGroup, new[] { testRole, "viewer" });
```
:::

### Revoke roles from an OIDC group

You can revoke one or more roles from a specific OIDC group.

This example removes the `testRole` and `viewer` roles from the `/admin-group`.

:::code-group{sync="languages"}
```python title="Python"
admin_client.groups.oidc.revoke_roles(
    group_id="/admin-group", role_names=["testRole", "viewer"]
)
```

```typescript title="JavaScript/TypeScript"
await adminClient.groups.oidc.revokeRoles(
    "/admin-group", ["testRole", "viewer"]
);
```

```go title="Go"
// Go support coming soon
```

```java title="Java"
client.groups.revokeRoles(testGroup, testRole, "viewer");
```

```csharp title="C#"
await client.Groups.Oidc.RevokeRoles(testGroup, new[] { testRole, "viewer" });
```
:::

### List roles assigned to an OIDC group

Retrieve a list of all roles that have been assigned to a specific OIDC group.

:::code-group{sync="languages"}
```python title="Python"
group_roles = oidc_admin_client.groups.oidc.get_assigned_roles(
    group_id="/admin-group", include_permissions=True
)
print(f"Roles assigned to '/admin-group': {list(group_roles.keys())}")
```

```typescript title="JavaScript/TypeScript"
const groupRoles = await oidcAdminClient.groups.oidc.getAssignedRoles(
    "/admin-group", true
);
console.log(`Roles assigned to '/admin-group': ${Object.keys(groupRoles)}`);
```

```go title="Go"
// Go support coming soon
```

```java title="Java"
List<Role> groupRoles = client.groups.assignedRoles(testGroup,
    g -> g.includePermissions(true));
for (Role role : groupRoles) {
  System.out.println(role.name());
}
```

```csharp title="C#"
var groupRoles = await client.Groups.Oidc.GetRoles(testGroup, includeFullRoles: true);
foreach (var role in groupRoles)
{
    Console.WriteLine(role.Name);
}
```
:::

:::accordion{title="Example results"}
```text
Roles assigned to '/admin-group': ['testRole', 'viewer']
```
:::

### List all known OIDC groups

This example shows how to get a list of all OIDC groups that Weaviate is aware of. Weaviate learns about a group when a role is first assigned to it.

:::code-group{sync="languages"}
```python title="Python"
known_groups = admin_client.groups.oidc.get_known_group_names()
print(f"Known OIDC groups ({len(known_groups)}): {known_groups}")
```

```typescript title="JavaScript/TypeScript"
const knownGroups = await adminClient.groups.oidc.getKnownGroupNames();
console.log(`Known OIDC groups (${knownGroups.length}): ${knownGroups}`);
```

```go title="Go"
// Go support coming soon
```

```java title="Java"
List<String> knownGroups = client.groups.knownGroupNames();
System.out.println("Known OIDC groups (" + knownGroups.size() + "): " + knownGroups);
```

```csharp title="C#"
var knownGroups = await client.Groups.Oidc.GetKnownGroupNames();
Console.WriteLine($"Known OIDC groups ({knownGroups.Count()}): {string.Join(", ", knownGroups)}");
```
:::

:::accordion{title="Example results"}
```text
Known OIDC groups (3): ['/viewer-group', '/admin-group', '/my-test-group']
```
:::

### List groups assigned to a role

Retrieve a list of all groups that have been assigned a specific role.

This example shows which groups have the `testRole` assigned to them.

:::code-group{sync="languages"}
```python title="Python"
group_assignments = admin_client.roles.get_group_assignments(role_name="testRole")
print(f"Groups assigned to role 'testRole':")
for group in group_assignments:
    print(f"  - Group ID: {group.group_id}, Type: {group.group_type}")
```

```typescript title="JavaScript/TypeScript"
const groupAssignments = await adminClient.roles.getGroupAssignments("testRole");
console.log("Groups assigned to role 'testRole':");
for (const group of groupAssignments) {
    console.log(`  - Group ID: ${group.groupID}, Type: ${group.groupType}`);
}
```

```go title="Go"
// Go support coming soon
```

```java title="Java"
List<GroupAssignment> groupAssignments = client.roles.groupAssignments(testRole);
System.out.println("Groups assigned to role '" + testRole + "':");
for (GroupAssignment assignment : groupAssignments) {
  System.out.println("  - Group ID: " + assignment.groupId() + ", Type: "
      + assignment.groupType());
}
```

```csharp title="C#"
var groupAssignments = await client.Roles.GetGroupAssignments(testRole);
Console.WriteLine($"Groups assigned to role '{testRole}':");
foreach (var assignment in groupAssignments)
{
    Console.WriteLine($"  - Group ID: {assignment.GroupId}, Type: {assignment.GroupType}");
}
```
:::

:::accordion{title="Example results"}
```text
Groups assigned to role 'testRole':
  - Group ID: /admin-group, Type: oidc
```
:::

## Further resources

- [RBAC: Overview](weaviate-configuration-rbac.md)
- [RBAC: Configuration](deploy-configuration-configuring-rbac.md)
- [RBAC: Manage roles](weaviate-configuration-rbac-manage-roles.md)
- [RBAC: Manage users](weaviate-configuration-rbac-manage-users.md)

## Questions and feedback

Have a question or feedback? Here's how to reach us.

::::card-grid
:::card{title="Community Forum" href="https://forum.weaviate.io/c/support" icon="messages-square"}
Ask questions and connect with other developers on our **Community forum**.
:::

:::card{title="Support" href="/guides/support-overview" icon="life-buoy"}
Weaviate Cloud user or customer? Find the right channel on the **Support page**.
:::
::::

## Related pages

- [Agents](./agents-index.md)
- [AI-assisted Weaviate code generation](./ai-assisted-vibe-coding-index.md)
- [APIs](./apis-index.md)
- [Authorization and authentication](./authorization-and-authentication-index.md)
- [Benchmarks](./benchmarks-index.md)
- [Best practices](./best-practices-index.md)
- [Client libraries](./clients-index.md)
- [Client Libraries / SDKs](./client-libraries-index.md)
- [Cloud](./cloud-index.md)
- [Cloud account management](./cloud-account-management-index.md)

# Agent Instructions

This portal answers questions programmatically. To receive a synthesized,
source-cited answer instead of crawling page by page, append the `?ask=`
query parameter to any page URL on this site:

    /guides/quickstart?ask=how+do+I+authenticate

Optional parameters:

- `&goal=<what-you-are-trying-to-do>` steers the answer toward your
  objective (e.g. `&goal=write+a+python+client`).
- `&version=<label>` scopes the answer to a mounted version when the
  portal publishes more than one.

The response is `text/markdown`: the answer followed by a `# Sources` list
of the portal pages it was grounded in. Status codes are the contract:

- `200` — the answer; `402` — the portal owner’s plan or answer credits are
  exhausted (surface this to your operator; do NOT retry); `429` — you are
  rate-limited; back off for the `Retry-After` seconds; `503` — the answer
  lane is temporarily unavailable; fall back to crawling the `.md` pages.

For the full corpus map read `llms.txt` at the site root; for the tool
surface (search + page fetch as MCP tools) see `/mcp`.