How can we get a list of all users that have no access to a certain Workspace, or alternatively have no access to a certain Project?
Can we use WSAPI for that?
Such lists can not be constructed with a direct query. You will need to do some manipulation to get a list of users without access to a specific Workspace or Project.
The reason is that Rally stores permission information associating users with Workspaces or Projects. It doesn't store who does not have access. So, if User A has access to Workspace W1 then this piece of information is stored. But if User A does not have access to Workspace W2 then this information is not stored. If User A will try to access Workspace W2 they will not be able to access considering there is nothing explicit that grants them access.
What this means is that in order to compile a list of users who do not have access to a given Workspace or Project then you will need to subtract the users who do have access from the entire list of users of your subscription. This will leave you with the users without access to the Workspace/Project you need.
Here is how you get it all done:
Get a list of all users that do have access (of any kind) to the Workspace or Project you're interested with.
See these two articles on how to use WSAPI to get this information.
For Workspace Permissions -> see this doc.
For Project Permissions -> see this doc.
Subtract the list of "users with access" from list of "total users", this will leave you with a list of "users without access":
Once you have both CSV files then you will need subtracts the list of step 2 from the list of step 1. The easiest way will be to use Excel , use a Pivot table and then find and exclude the "list 2 users" from "list 1 users".
See this video on how to use Excel's pivot table to find and exclude items of one sheet from another.