SAP Authorization and Trust Management Service - Authorization API: Role Collections all subaccount

[Cristian]

Good morning,

We have a requirement to list the role collections of our subaccounts and their assigned IAS groups.

I am looking into the Authorization API:

https://api.sap.com/api/AuthorizationAPI/overview

This works fine. I create an XSUAA instance in a subaccount with plan api-access and I can get the role collections without any problem. The challenge comes when we want to achieve that for several subaccounts. Does this mean that we neeed to create an XSUAA instance in each subaccount and that we would need to call N times the API, each for each subaccount? Is it possible at all to achieve that at account level preventing us to create as many XSUAA instances as subaccounts?

Many thanks!

C.

[Sycntegral]

I think Best Practice Architecture mentioned that XSUAA instance should be just one and this should be a shared service. I asked SAP expert yesterday at Global call the same question, but I have not yet received an answer. I will follow up