# How to use user security levels in a module?

**URL:** <https://forum.inductiveautomation.com/t/how-to-use-user-security-levels-in-a-module/109356>\
**Category:** Module Development\
**Tags:** ignition81\
**Created:** [August 4, 2025, 10:07pm UTC](https://forum.inductiveautomation.com/t/how-to-use-user-security-levels-in-a-module/109356 "2025-08-04T22:07:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tyler\_Dolan](https://avatars.discourse-cdn.com/v4/letter/t/b5ac83/32.png) [@Tyler\_Dolan](https://forum.inductiveautomation.com/u/Tyler_Dolan)\
**Post date:** [August 4, 2025, 10:07pm UTC](https://forum.inductiveautomation.com/t/how-to-use-user-security-levels-in-a-module/109356/1 "2025-08-04T22:07:02Z")

</div>

I am trying to use security levels to control who as access to the methods of the module's script API. I am able to get a user's security level configs through the following code

```java
ClientReqSession session = ClientReqSession.get();
ClientReqSession.User sessionUser = (ClientReqSession.User) session.getAttribute(ClientReqSession.SESSION_USER);
SecurityContext securityContext = SecurityContext.fromAuthenticatedUser(sessionUser.getUser().get());
List<SecurityLevelConfig> securityLevelConfigs = securityContext.getSecurityLevels();

```

My problem is that security levels share names and SecurityLevelConfigs don't have a means of accessing their path or parent, so how do I check if a user has a specific security level?

If I had the following security levels, how would I tell if a user had access to Test/Default but not Test2/Default?

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/f/0/f0b9baa019fc2394ba324324e3dbaa56899b9db0.png)

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [August 4, 2025, 10:19pm UTC](https://forum.inductiveautomation.com/t/how-to-use-user-security-levels-in-a-module/109356/2 "2025-08-04T22:19:18Z")

</div>

I _think_ you want to create a [`PermissionsConfig`](https://files.inductiveautomation.com/sdk/javadoc/ignition81/8.1.48/com/inductiveautomation/ignition/common/auth/permissions/PermissionsConfig.html) (ideally, only once), something like:

```java
var permissions = PermissionsConfig.builder(Type.AnyOf).addSecurityLevel("Test", "Default").build();
var isAuthorized = permissions.isAuthorized(securityContext.getSecurityLevels());

```

---

<div class="post-metadata">

**Author:** ![Tyler\_Dolan](https://avatars.discourse-cdn.com/v4/letter/t/b5ac83/32.png) [@Tyler\_Dolan](https://forum.inductiveautomation.com/u/Tyler_Dolan)\
**Post date:** [August 22, 2025, 7:38pm UTC](https://forum.inductiveautomation.com/t/how-to-use-user-security-levels-in-a-module/109356/3 "2025-08-22T19:38:21Z")

</div>

I discovered what my initial problem was. I thought securityContext.getSecurityLevels() would return a list (i.e. Authenticated, Roles, SecurityZones, Default…) but it’s actually a tree where each entry can have children. (i.e. Authenticated/Roles, SecurityZones/Default…)