---
title: "Setting up a schedule, subscription or other activity on behalf of a service user"
slug: "setting-up-a-schedule-subscription-or-other-activity-on-behalf-of-a-service-user"
updated: 2025-08-01T14:09:28Z
published: 2025-08-01T14:09:28Z
canonical: "support.lusid.com/setting-up-a-schedule-subscription-or-other-activity-on-behalf-of-a-service-user"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.lusid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up a schedule, subscription or other activity on behalf of a service user

Some applications in LUSID, such as the [Workflow Service](/v1/docs/workflow-service) and [Notification Service](/v1/docs/notification-service), allow you (as a *personal user*) to specify the ID of a *service user* when setting up an automated activity to run on behalf of that service user on a day-to-day basis. [More information about personal and service users](/v1/docs/what-are-a-personal-user-and-a-service-user).

> **Note**: If you are the LUSID domain owner, you are automatically assigned the built-in `lusid-administrator` role, which has all the permissions necessary to set up automated activities on behalf of service users. [See how to get the necessary permissions as a standard LUSID user](/v1/docs/setting-up-a-schedule-subscription-or-other-activity-on-behalf-of-a-service-user#setting-up-permissions-for-standard-lusid-users).

We recommend creating schedules, subscriptions, actions in workflows and other automated activity as service users for the following reasons:

- It allows a personal user to set up activities on behalf of a service user without needing to gain access to that service user account to do so.
- It prevents any need to migrate the schedule, subscription, task or other activity in the event the personal user account is deleted, for example if that person leaves the company.

Automatable activities have a `useAsAuth` (or `runAsUserId` in the Workflow Service) field in their API request that, when omitted, defaults to the [user ID](/v1/docs/what-is-a-user-id-and-how-do-i-discover-one) of the personal user making that request. This field can accept the ID of a valid service user instead.

For example, to use the Notification Service to subscribe to all portfolio creation events emitted by LUSID, call the `CreateSubscription` API with the ID of a service user in the `useAsAuth` field:

```json
curl -X POST "https://<your-domain>.lusid.com/notification/api/subscriptions" 
  -H "Authorization: Bearer <your-api-access-token>"
  -d '{
  "id": {
    "scope": "PortfolioEvents",
    "code": "PortfolioCreatedEvent"
  },
  "displayName": "PortfolioCreatedInScope",
  "description": "Subscribe to the event fired when a portfolio is created in the Finbourne-Examples scope",
  "status": "Active",
  "matchingPattern": {
    "eventType": "PortfolioCreated",
    "filter": "Body.portfolioScope eq 'Finbourne-Examples'"
  },
  "useAsAuth": "00uji4ve5haBc1Hlf2p7"
}'
```

> **Note**: You can use the [ListRunnableUsers](https://www.lusid.com/docs/api/identity/endpoints/users/ListRunnableUsers) API to retrieve the IDs of valid service users in your domain.

The `useAsAuth`/`runAsUserId` field is currently available for the following APIs:

| **Application** | **Field** | **API** | **Explanation** |
| --- | --- | --- | --- |
| [Scheduler](https://www.lusid.com/docs/api/scheduler/intro) | `useAsAuth` | `CreateSchedule` `UpdateSchedule` `RunJob` | The service user is used to run the job. |
| [Notification Service](https://www.lusid.com/docs/api/notification/intro) | `CreateSubscription` `UpdateSubscription` | The service user is used to evaluate read permissions for the event subscription before sending any notifications. |
| [Workflow Service](https://www.lusid.com/docs/api/workflow/intro) | `runAsUserId` | `CreateTaskDefinition` `UpdateTaskDefinition` `CreateEventHandler` `UpdateEventHandler` | The service user is used to perform the action, for example running a worker. |

## Setting up permissions for standard LUSID users

Non-LUSID administrator users must be given the relevant permissions in order to specify a value for the `useAsAuth`/`runAsUserId` field. To do this:

1. Follow the steps to create a data policy via the [LUSID web app](https://www.lusid.com/app) as usual. [See how to create a data policy.](/v1/docs/how-do-i-create-a-data-policy)
2. Under **Data Resources**, navigate to **Identity > User** and select the **UseAsAuth** checkbox. Note this action controls access to both the `useAsAuth` and `runAsUserId` fields. ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(207).png)
3. Under **Selector**, choose **Identifier** and provide the ID of the service user you want an activity to run on behalf of. You can enter `*` to provide `useAsAuth`/`runAsUserId` access to all service users.

> [!NOTE]
> Note
> 
> Providing you have sufficient privileges, you can call the [ListRunnableUsers](https://www.lusid.com/docs/api/identity/endpoints/users/ListRunnableUsers) API to retrieve the IDs of valid service users in your domain.

![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(208).png)
4. Once you have created your policy, [assign it to a role as usual](/v1/docs/how-do-i-create-a-role).
5. [Assign the role](/v1/docs/how-do-i-assign-policies-roles-and-users-to-each-other-using-the-api) to the personal user making the API call containing the `useAsAuth`/`runAsUserId` field.