> ## Documentation Index
> Fetch the complete documentation index at: https://docs.activeviam.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List book access for a user.

> Use this read-only operation to inspect the book permissions assigned to an active user in the caller's
organisation. The caller must be an administrator, including Derivitec, organisation, executive, or view
administrator user types; self-targeting does not bypass that requirement. Matching ignores surrounding
whitespace and letter case. The response is returned after the lookup completes.



## OpenAPI

````yaml /risk-and-pricing/atoti-risk-services/apis-endpoints/openapi/openapi.mintlify.json get /api/BookAccess
openapi: 3.0.4
info:
  title: Derivitec Api 1.0
  version: '1.0'
servers:
  - url: https://api.riskportal.activeviam.com
security:
  - oauth2: []
  - apikey: []
tags:
  - name: AdminUser
  - name: AtotiReport
  - name: AtotiSession
  - name: BloombergOAuth
  - name: Bond
  - name: BondYieldCurvePage
  - name: BookAccess
  - name: Books
  - name: Commodity
  - name: Counterparties
  - name: Currencies
  - name: Equity
  - name: EquityDividend
  - name: EquityPage
  - name: FeatureFlag
  - name: Fx
  - name: FxPage
  - name: GroupAccess
  - name: Home
  - name: LegacyPosition
  - name: MarketData
  - name: MarketDataProvider
  - name: MarketDataProviderAccess
  - name: Meta
  - name: Notification
  - name: Organisation
  - name: PnLReport
  - name: PortfolioAccess
  - name: Portfolios
  - name: Position
  - name: PositionFilter
  - name: PricingEnvironment
  - name: PricingEnvironmentAccess
  - name: RateAsset
  - name: RateAssetPage
  - name: Report
  - name: ReportDefinition
  - name: ReportHistoryLauncherQuery
  - name: ReportLauncher
  - name: ReportQuery
  - name: ReportQueryViewUser
  - name: ReportRestriction
  - name: ReportView
  - name: RiskReport
  - name: Tradable
  - name: TradeBooking
  - name: User
  - name: VarReport
  - name: VarReportQuery
  - name: YieldCurvePage
paths:
  /api/BookAccess:
    get:
      tags:
        - BookAccess
      summary: List book access for a user.
      description: >-
        Use this read-only operation to inspect the book permissions assigned to
        an active user in the caller's

        organisation. The caller must be an administrator, including Derivitec,
        organisation, executive, or view

        administrator user types; self-targeting does not bypass that
        requirement. Matching ignores surrounding

        whitespace and letter case. The response is returned after the lookup
        completes.
      operationId: Get
      parameters:
        - name: organisationUserEmail
          in: query
          description: >-
            The required email address of an active Risk Portal user in the
            caller's organisation; for example, `analyst@example.test`.
          schema:
            type: string
      responses:
        '200':
          description: >-
            Returns the user's accessible Derivitec books and access levels, or
            an unsuccessful envelope for administrator, membership, or
            target-user failures.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiProxyUserBookAccessGetResponse'
        '400':
          description: BadRequest
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
      security:
        - oauth2: []
        - apikey: []
components:
  schemas:
    ApiProxyUserBookAccessGetResponse:
      required:
        - $type
      type: object
      properties:
        is_success:
          type: boolean
          description: >-
            Whether the operation completed successfully. The default is `true`;
            error outcomes set it to `false`.
          example: true
        error_messages:
          type: array
          items:
            type: string
          description: >-
            Messages explaining operation-level failures. The collection is
            empty by default.
          nullable: true
        book_accesses:
          type: array
          items:
            $ref: '#/components/schemas/BookAccess'
          description: >-
            Books explicitly assigned to the selected user, with source and
            assigned level.
          nullable: true
        $type:
          type: string
          enum:
            - >-
              Derivitec.Web.Core.BookAccess.ApiProxyUserBookAccessGetResponse,
              Derivitec.Web.Core
      additionalProperties: false
      description: Books explicitly assigned to the selected organisation user.
    BookAccess:
      required:
        - $type
      type: object
      properties:
        book_name:
          type: string
          description: Client-visible name of the assigned book.
          nullable: true
          example: Example book
        portfolio_type:
          enum:
            - derivitec
            - enfusion
            - orchestrade
            - liquidity_book
            - maia
            - fund_studio
            - not_set
          type: string
          description: >-
            Portfolio source containing the assigned book; book-access records
            use the Derivitec source.
          readOnly: true
        access_type:
          enum:
            - view
            - edit
            - full
            - owner
          type: string
          description: Access level assigned to the user for this book.
        $type:
          type: string
          enum:
            - Derivitec.Web.Core.BookAccess.BookAccess, Derivitec.Web.Core
      additionalProperties: false
      description: Accessible book name, source, and assigned access level for a user.
  securitySchemes:
    oauth2:
      type: oauth2
      description: >-
        OAuth2 access-token requested from AWS Cognito and provided as a Auth
        Bearer header
      flows:
        implicit:
          authorizationUrl: https://auth.riskportal.derivitec.com/oauth2/authorize
          scopes: {}
    apikey:
      type: apiKey
      description: API-Key requested via the site and provided as a header
      name: x-api-key
      in: header

````