# How to retrieve permission with vuejs?

**URL:** <https://community.auth0.com/t/how-to-retrieve-permission-with-vuejs/49141>\
**Category:** Get Help\
**Tags:** permissions\
**Created:** [September 3, 2020, 5:52am UTC](https://community.auth0.com/t/how-to-retrieve-permission-with-vuejs/49141 "2020-09-03T05:52:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![janetsmith2000](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/janetsmith2000/32/23053_2.png) [@janetsmith2000](https://community.auth0.com/u/janetsmith2000)\
**Post date:** [September 3, 2020, 5:52am UTC](https://community.auth0.com/t/how-to-retrieve-permission-with-vuejs/49141/1 "2020-09-03T05:52:11Z")

</div>

I am following the getting started tutorial (vuejs)

> **[Add Login to Your Vue Application - Auth0 Docs](https://auth0.com/docs/quickstart/spa/vuejs)**
>
> This guide demonstrates how to integrate Auth0, add authentication, and display user profile information in any Vue application using the Auth0 Vue SDK.

But I have no idea how to retrieve permission for a particular user. Please show me how to do that. Thanks.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [September 3, 2020, 11:01am UTC](https://community.auth0.com/t/how-to-retrieve-permission-with-vuejs/49141/2 "2020-09-03T11:01:37Z")

</div>

Hey there!

The quickstart doesn’t involve such information but you can use the Management API and make the request to one endpoint to retrieve such data. Here’s how:

> **[View User Permissions](https://auth0.com/docs/manage-users/access-control/configure-core-rbac/rbac-users/view-user-permissions)**
>
> Learn how to view permissions assigned to a user using the Auth0 Dashboard and Management API.

---

<div class="post-metadata">

**Author:** ![janetsmith2000](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/janetsmith2000/32/23053_2.png) [@janetsmith2000](https://community.auth0.com/u/janetsmith2000)\
**Post date:** [September 4, 2020, 1:19am UTC](https://community.auth0.com/t/how-to-retrieve-permission-with-vuejs/49141/4 "2020-09-04T01:19:44Z")

</div>

It seems like there is a 9 (or 10) endpoints limit.

---

<div class="post-metadata">

**Author:** ![janetsmith2000](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/janetsmith2000/32/23053_2.png) [@janetsmith2000](https://community.auth0.com/u/janetsmith2000)\
**Post date:** [September 4, 2020, 1:24am UTC](https://community.auth0.com/t/how-to-retrieve-permission-with-vuejs/49141/5 "2020-09-04T01:24:23Z")

</div>

When I was working on the backend code (spring boot), I can retrieve the permissions from the jwt.

How come in frontend, I need to call another endpoint to get the permissions? Can I just get them from jwt (“permissions” field)?

I pasted jwt passed from auth0 ([http://jwt.io](http://jwt.io)) , I can see clearly there’s a “permissions” field that has what I needed.

```
{
  "iss": "https://xxxx/",
  "sub": "auth0|xxxxx",
  "aud": [
    "http://localhost:8080/api",
    "https://xxxx"
  ],
  "iat": 1599183033,
  "exp": 1599269331,
  "azp": "xxx",
  "scope": "openid profile email",
  "permissions": [
    "create:content",
    "view:content"
  ]
}

```

---

<div class="post-metadata">

**Author:** ![janetsmith2000](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/janetsmith2000/32/23053_2.png) [@janetsmith2000](https://community.auth0.com/u/janetsmith2000)\
**Post date:** [September 4, 2020, 3:55pm UTC](https://community.auth0.com/t/how-to-retrieve-permission-with-vuejs/49141/6 "2020-09-04T15:55:57Z")

</div>

According to document, management api needs “client\_secret” ([Overview of Auth0's Management API v2 to update client settings](https://auth0.com/blog/update-auth0-applications-using-the-management-api/?_ga=2.256773131.1208290864.1599064910-1840061431.1584311408))

Don’t you think putting client secret in javascript file is unsafe?

Btw, I tried it with curl, and I get “{“statusCode”:403,“error”:“Forbidden”,“message”:“Insufficient scope, expected any of: read:users”,“errorCode”:“insufficient\_scope”}”

I have added “read:users” in my user. Not sure what goes wrong.