aherman
/
boundary
mirror of https://github.com/hashicorp/boundary
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Auto generate the permissions pages. (#4786)

Browse Source 
* Auto generate the permissions pages.

* Add add- set- remove- auto descriptions. Hide scope line when no scope provided

* Document the resource info struct
pull/4797/head
Todd 2 years ago committed by GitHub
parent c3f9fde5d7
commit 5a06e4fe66
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 326 additions and 734 deletions
Show Stats Download Patch File Download Diff File

20
internal/types/action/registrar.go
Unescape View File

@ -71,3 +71,23 @@ func ActionSetForResource(r resource.Type) (ActionSet, error) {
}
return a.valid, nil
}
// CollectionActionSetForResource returns the collection ActionSet registered
// for r or an error if r has not been registered.
func CollectionActionSetForResource(r resource.Type) (ActionSet, error) {
a, err := byResourceRegistrar.get(r)
if err != nil {
return nil, err
}
return a.collection, nil
}
// IdActionSetForResource returns the individual ActionSet registered
// for r or an error if r has not been registered.
func IdActionSetForResource(r resource.Type) (ActionSet, error) {
a, err := byResourceRegistrar.get(r)
if err != nil {
return nil, err
}
return a.individual, nil
}

957
internal/website/permstable/permstable.go
View File

File diff suppressed because it is too large Load Diff

83
website/content/docs/concepts/security/permissions/resource-table.mdx
Unescape View File

@ -19,13 +19,19 @@ Refer to the tables for more information about the following resource types:
<!-- BEGIN TABLE -->
- [Account](#account)
- [Alias](#alias)
- [Auth method](#auth-method)
- [Auth token](#auth-token)
- [Billing](#billing)
- [Credential](#credential)
- [Credential library](#credential-library)
- [Credential store](#credential-store)
- [Group](#group)
- [Host](#host)
- [Host catalog](#host-catalog)
- [Host set](#host-set)
- [Managed group](#managed-group)
- [Policy](#policy)
- [Role](#role)
- [Scope](#scope)
- [Session](#session)
@ -42,7 +48,16 @@ The **Account** resource type supports the following scopes: **Global**, **Org**
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/accounts</code> | <ul><li>Type</li><ul><li><code>account</code></li></ul></ul> | <ul><li><code>create</code>: Create an account</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>list</code>: List accounts</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/accounts/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Pin</li><ul><li><code>&lt;auth-method-id&gt;</code></li></ul><li>Type</li><ul><li><code>account</code></li></ul></ul> | <ul><li><code>read</code>: Read an account</li><ul><li>`ids=<id>;actions=read`</li><li>`ids=<pin>;type=<type>;actions=read`</li></ul><li><code>update</code>: Update an account</li><ul><li>`ids=<id>;actions=update`</li><li>`ids=<pin>;type=<type>;actions=update`</li></ul><li><code>delete</code>: Delete an account</li><ul><li>`ids=<id>;actions=delete`</li><li>`ids=<pin>;type=<type>;actions=delete`</li></ul><li><code>set-password</code>: Set a password on an account, without requiring the current password</li><ul><li>`ids=<id>;actions=set-password`</li><li>`ids=<pin>;type=<type>;actions=set-password`</li></ul><li><code>change-password</code>: Change a password on an account given the current password</li><ul><li>`ids=<id>;actions=change-password`</li><li>`ids=<pin>;type=<type>;actions=change-password`</li></ul></ul> |
| <code>/accounts/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Pin</li><ul><li><code>&lt;auth-method-id&gt;</code></li></ul><li>Type</li><ul><li><code>account</code></li></ul></ul> | <ul><li><code>read</code>: Read an account</li><ul><li>`ids=<id>;actions=read`</li><li>`ids=<pin>;type=<type>;actions=read`</li></ul><li><code>update</code>: Update an account</li><ul><li>`ids=<id>;actions=update`</li><li>`ids=<pin>;type=<type>;actions=update`</li></ul><li><code>delete</code>: Delete an account</li><ul><li>`ids=<id>;actions=delete`</li><li>`ids=<pin>;type=<type>;actions=delete`</li></ul><li><code>change-password</code>: Change a password on an account given the current password</li><ul><li>`ids=<id>;actions=change-password`</li><li>`ids=<pin>;type=<type>;actions=change-password`</li></ul><li><code>set-password</code>: Set a password on an account, without requiring the current password</li><ul><li>`ids=<id>;actions=set-password`</li><li>`ids=<pin>;type=<type>;actions=set-password`</li></ul></ul> |
## Alias
The **Alias** resource type supports the following scopes: **Global**, **Org**, **Project**
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/aliases</code> | <ul><li>Type</li><ul><li><code>alias</code></li></ul></ul> | <ul><li><code>create</code>: Create an alias</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>list</code>: List aliass</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/aliases/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>alias</code></li></ul></ul> | <ul><li><code>read</code>: Read an alias</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update an alias</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete an alias</li><ul><li>`ids=<id>;actions=delete`</li></ul></ul> |
## Auth method
@ -51,7 +66,7 @@ The **Auth method** resource type supports the following scopes: **Global**, **O
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/auth-methods</code> | <ul><li>Type</li><ul><li><code>auth-method</code></li></ul></ul> | <ul><li><code>create</code>: Create an auth method</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>list</code>: List auth methods</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/auth-methods/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>auth-method</code></li></ul></ul> | <ul><li><code>read</code>: Read an auth method</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update an auth method</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete an auth method</li><ul><li>`ids=<id>;actions=delete`</li></ul><li><code>authenticate</code>: Authenticate to an auth method</li><ul><li>`ids=<id>;actions=authenticate`</li></ul></ul> |
| <code>/auth-methods/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>auth-method</code></li></ul></ul> | <ul><li><code>read</code>: Read an auth method</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update an auth method</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete an auth method</li><ul><li>`ids=<id>;actions=delete`</li></ul><li><code>authenticate</code>: Authenticate to an auth method</li><ul><li>`ids=<id>;actions=authenticate`</li></ul><li><code>change-state</code>: </li><ul><li>`ids=<id>;actions=change-state`</li></ul></ul> |
## Auth token
@ -60,7 +75,40 @@ The **Auth token** resource type supports the following scopes: **Global**, **Or
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/auth-tokens</code> | <ul><li>Type</li><ul><li><code>auth-token</code></li></ul></ul> | <ul><li><code>list</code>: List auth tokens</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/auth-tokens/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>auth-token</code></li></ul></ul> | <ul><li><code>read</code>: Read an auth token</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>delete</code>: Delete an auth token</li><ul><li>`ids=<id>;actions=delete`</li></ul></ul> |
| <code>/auth-tokens/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>auth-token</code></li></ul></ul> | <ul><li><code>read</code>: Read an auth token</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>delete</code>: Delete an auth token</li><ul><li>`ids=<id>;actions=delete`</li></ul><li><code>delete:self</code>: </li><ul><li>`ids=<id>;actions=delete:self`</li></ul><li><code>read:self</code>: </li><ul><li>`ids=<id>;actions=read:self`</li></ul></ul> |
## Billing
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/billing</code> | <ul><li>Type</li><ul><li><code>billing</code></li></ul></ul> | <ul><li><code>monthly-active-users</code>: </li><ul><li>`type=<type>;actions=monthly-active-users`</li></ul></ul> |
## Credential
The **Credential** resource type supports the following scopes: **Project**
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/credentials</code> | <ul><li>Type</li><ul><li><code>credential</code></li></ul></ul> | <ul><li><code>create</code>: Create a credential</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>list</code>: List credentials</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/credentials/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Pin</li><ul><li><code>&lt;credential-store-id&gt;</code></li></ul><li>Type</li><ul><li><code>credential</code></li></ul></ul> | <ul><li><code>read</code>: Read a credential</li><ul><li>`ids=<id>;actions=read`</li><li>`ids=<pin>;type=<type>;actions=read`</li></ul><li><code>update</code>: Update a credential</li><ul><li>`ids=<id>;actions=update`</li><li>`ids=<pin>;type=<type>;actions=update`</li></ul><li><code>delete</code>: Delete a credential</li><ul><li>`ids=<id>;actions=delete`</li><li>`ids=<pin>;type=<type>;actions=delete`</li></ul></ul> |
## Credential library
The **Credential library** resource type supports the following scopes: **Project**
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/credential-libraries</code> | <ul><li>Type</li><ul><li><code>credential-library</code></li></ul></ul> | <ul><li><code>create</code>: Create a credential library</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>list</code>: List credential librarys</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/credential-libraries/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Pin</li><ul><li><code>&lt;credential-store-id&gt;</code></li></ul><li>Type</li><ul><li><code>credential-library</code></li></ul></ul> | <ul><li><code>read</code>: Read a credential library</li><ul><li>`ids=<id>;actions=read`</li><li>`ids=<pin>;type=<type>;actions=read`</li></ul><li><code>update</code>: Update a credential library</li><ul><li>`ids=<id>;actions=update`</li><li>`ids=<pin>;type=<type>;actions=update`</li></ul><li><code>delete</code>: Delete a credential library</li><ul><li>`ids=<id>;actions=delete`</li><li>`ids=<pin>;type=<type>;actions=delete`</li></ul></ul> |
## Credential store
The **Credential store** resource type supports the following scopes: **Project**
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/credential-stores</code> | <ul><li>Type</li><ul><li><code>credential-store</code></li></ul></ul> | <ul><li><code>create</code>: Create a credential store</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>list</code>: List credential stores</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/credential-stores/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>credential-store</code></li></ul></ul> | <ul><li><code>read</code>: Read a credential store</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update a credential store</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete a credential store</li><ul><li>`ids=<id>;actions=delete`</li></ul></ul> |
## Group
@ -69,7 +117,7 @@ The **Group** resource type supports the following scopes: **Global**, **Org**,
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/groups</code> | <ul><li>Type</li><ul><li><code>group</code></li></ul></ul> | <ul><li><code>create</code>: Create a group</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>list</code>: List groups</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/groups/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>group</code></li></ul></ul> | <ul><li><code>read</code>: Read a group</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update a group</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete a group</li><ul><li>`ids=<id>;actions=delete`</li></ul><li><code>add-members</code>: Add members to a group</li><ul><li>`ids=<id>;actions=add-members`</li></ul><li><code>set-members</code>: Set the full set of members on a group</li><ul><li>`ids=<id>;actions=set-members`</li></ul><li><code>remove-members</code>: Remove members from a group</li><ul><li>`ids=<id>;actions=remove-members`</li></ul></ul> |
| <code>/groups/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>group</code></li></ul></ul> | <ul><li><code>read</code>: Read a group</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update a group</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete a group</li><ul><li>`ids=<id>;actions=delete`</li></ul><li><code>add-members</code>: Add members to a group</li><ul><li>`ids=<id>;actions=add-members`</li></ul><li><code>remove-members</code>: Remove members from a group</li><ul><li>`ids=<id>;actions=remove-members`</li></ul><li><code>set-members</code>: Set the full set of members on a group</li><ul><li>`ids=<id>;actions=set-members`</li></ul></ul> |
## Host
@ -96,7 +144,7 @@ The **Host set** resource type supports the following scopes: **Project**
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/host-sets</code> | <ul><li>Type</li><ul><li><code>host-set</code></li></ul></ul> | <ul><li><code>create</code>: Create a host set</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>list</code>: List host sets</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/host-sets/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Pin</li><ul><li><code>&lt;host-catalog-id&gt;</code></li></ul><li>Type</li><ul><li><code>host-set</code></li></ul></ul> | <ul><li><code>read</code>: Read a host set</li><ul><li>`ids=<id>;actions=read`</li><li>`ids=<pin>;type=<type>;actions=read`</li></ul><li><code>update</code>: Update a host set</li><ul><li>`ids=<id>;actions=update`</li><li>`ids=<pin>;type=<type>;actions=update`</li></ul><li><code>delete</code>: Delete a host set</li><ul><li>`ids=<id>;actions=delete`</li><li>`ids=<pin>;type=<type>;actions=delete`</li></ul><li><code>add-hosts</code>: Add hosts to a host-set</li><ul><li>`ids=<id>;actions=add-hosts`</li><li>`ids=<pin>;type=<type>;actions=add-hosts`</li></ul><li><code>set-hosts</code>: Set the full set of hosts on a host set</li><ul><li>`ids=<id>;actions=set-hosts`</li><li>`ids=<pin>;type=<type>;actions=set-hosts`</li></ul><li><code>remove-hosts</code>: Remove hosts from a host set</li><ul><li>`ids=<id>;actions=remove-hosts`</li><li>`ids=<pin>;type=<type>;actions=remove-hosts`</li></ul></ul> |
| <code>/host-sets/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Pin</li><ul><li><code>&lt;host-catalog-id&gt;</code></li></ul><li>Type</li><ul><li><code>host-set</code></li></ul></ul> | <ul><li><code>read</code>: Read a host set</li><ul><li>`ids=<id>;actions=read`</li><li>`ids=<pin>;type=<type>;actions=read`</li></ul><li><code>update</code>: Update a host set</li><ul><li>`ids=<id>;actions=update`</li><li>`ids=<pin>;type=<type>;actions=update`</li></ul><li><code>delete</code>: Delete a host set</li><ul><li>`ids=<id>;actions=delete`</li><li>`ids=<pin>;type=<type>;actions=delete`</li></ul><li><code>add-hosts</code>: Add hosts to a host set</li><ul><li>`ids=<id>;actions=add-hosts`</li><li>`ids=<pin>;type=<type>;actions=add-hosts`</li></ul><li><code>remove-hosts</code>: Remove hosts from a host set</li><ul><li>`ids=<id>;actions=remove-hosts`</li><li>`ids=<pin>;type=<type>;actions=remove-hosts`</li></ul><li><code>set-hosts</code>: Set the full set of hosts on a host set</li><ul><li>`ids=<id>;actions=set-hosts`</li><li>`ids=<pin>;type=<type>;actions=set-hosts`</li></ul></ul> |
## Managed group
@ -107,6 +155,13 @@ The **Managed group** resource type supports the following scopes: **Global**, *
| <code>/managed-groups</code> | <ul><li>Type</li><ul><li><code>managed-group</code></li></ul></ul> | <ul><li><code>create</code>: Create a managed group</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>list</code>: List managed groups</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/managed-groups/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Pin</li><ul><li><code>&lt;auth-method-id&gt;</code></li></ul><li>Type</li><ul><li><code>managed-group</code></li></ul></ul> | <ul><li><code>read</code>: Read a managed group</li><ul><li>`ids=<id>;actions=read`</li><li>`ids=<pin>;type=<type>;actions=read`</li></ul><li><code>update</code>: Update a managed group</li><ul><li>`ids=<id>;actions=update`</li><li>`ids=<pin>;type=<type>;actions=update`</li></ul><li><code>delete</code>: Delete a managed group</li><ul><li>`ids=<id>;actions=delete`</li><li>`ids=<pin>;type=<type>;actions=delete`</li></ul></ul> |
## Policy
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/policies</code> | <ul><li>Type</li><ul><li><code>policy</code></li></ul></ul> | <ul><li><code>create</code>: Create a policy</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>list</code>: List policys</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/policies/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>policy</code></li></ul></ul> | <ul><li><code>read</code>: Read a policy</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update a policy</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete a policy</li><ul><li>`ids=<id>;actions=delete`</li></ul></ul> |
## Role
The **Role** resource type supports the following scopes: **Global**, **Org**, **Project**
@ -114,7 +169,7 @@ The **Role** resource type supports the following scopes: **Global**, **Org**, *
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/roles</code> | <ul><li>Type</li><ul><li><code>role</code></li></ul></ul> | <ul><li><code>create</code>: Create a role</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>list</code>: List roles</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/roles/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>role</code></li></ul></ul> | <ul><li><code>read</code>: Read a role</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update a role</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete a role</li><ul><li>`ids=<id>;actions=delete`</li></ul><li><code>add-principals</code>: Add principals to a role</li><ul><li>`ids=<id>;actions=add-principals`</li></ul><li><code>set-principals</code>: Set the full set of principals on a role</li><ul><li>`ids=<id>;actions=set-principals`</li></ul><li><code>remove-principals</code>: Remove principals from a role</li><ul><li>`ids=<id>;actions=remove-principals`</li></ul><li><code>add-grants</code>: Add grants to a role</li><ul><li>`ids=<id>;actions=add-grants`</li></ul><li><code>set-grants</code>: Set the full set of grants on a role</li><ul><li>`ids=<id>;actions=set-grants`</li></ul><li><code>remove-grants</code>: Remove grants from a role</li><ul><li>`ids=<id>;actions=remove-grants`</li></ul></ul> |
| <code>/roles/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>role</code></li></ul></ul> | <ul><li><code>read</code>: Read a role</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update a role</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete a role</li><ul><li>`ids=<id>;actions=delete`</li></ul><li><code>add-grant-scopes</code>: Add grant scopes to a role</li><ul><li>`ids=<id>;actions=add-grant-scopes`</li></ul><li><code>add-grants</code>: Add grants to a role</li><ul><li>`ids=<id>;actions=add-grants`</li></ul><li><code>add-principals</code>: Add principals to a role</li><ul><li>`ids=<id>;actions=add-principals`</li></ul><li><code>remove-grant-scopes</code>: Remove grant scopes from a role</li><ul><li>`ids=<id>;actions=remove-grant-scopes`</li></ul><li><code>remove-grants</code>: Remove grants from a role</li><ul><li>`ids=<id>;actions=remove-grants`</li></ul><li><code>remove-principals</code>: Remove principals from a role</li><ul><li>`ids=<id>;actions=remove-principals`</li></ul><li><code>set-grant-scopes</code>: Set the full set of grant scopes on a role</li><ul><li>`ids=<id>;actions=set-grant-scopes`</li></ul><li><code>set-grants</code>: Set the full set of grants on a role</li><ul><li>`ids=<id>;actions=set-grants`</li></ul><li><code>set-principals</code>: Set the full set of principals on a role</li><ul><li>`ids=<id>;actions=set-principals`</li></ul></ul> |
## Scope
@ -122,8 +177,8 @@ The **Scope** resource type supports the following scopes: **Global**, **Org**
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/scopes</code> | <ul><li>Type</li><ul><li><code>scope</code></li></ul></ul> | <ul><li><code>create</code>: Create a scope</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>list</code>: List scopes</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/scopes/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>scope</code></li></ul></ul> | <ul><li><code>read</code>: Read a scope</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update a scope</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete a scope</li><ul><li>`ids=<id>;actions=delete`</li></ul></ul> |
| <code>/scopes</code> | <ul><li>Type</li><ul><li><code>scope</code></li></ul></ul> | <ul><li><code>create</code>: Create a scope</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>destroy-key-version</code>: </li><ul><li>`type=<type>;actions=destroy-key-version`</li></ul><li><code>list</code>: List scopes</li><ul><li>`type=<type>;actions=list`</li></ul><li><code>list-key-version-destruction-jobs</code>: </li><ul><li>`type=<type>;actions=list-key-version-destruction-jobs`</li></ul><li><code>list-keys</code>: </li><ul><li>`type=<type>;actions=list-keys`</li></ul><li><code>rotate-keys</code>: </li><ul><li>`type=<type>;actions=rotate-keys`</li></ul></ul> |
| <code>/scopes/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>scope</code></li></ul></ul> | <ul><li><code>read</code>: Read a scope</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update a scope</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete a scope</li><ul><li>`ids=<id>;actions=delete`</li></ul><li><code>attach-storage-policy</code>: </li><ul><li>`ids=<id>;actions=attach-storage-policy`</li></ul><li><code>detach-storage-policy</code>: </li><ul><li>`ids=<id>;actions=detach-storage-policy`</li></ul></ul> |
## Session
@ -132,7 +187,7 @@ The **Session** resource type supports the following scopes: **Project**
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/sessions</code> | <ul><li>Type</li><ul><li><code>session</code></li></ul></ul> | <ul><li><code>list</code>: List sessions</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/session/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>session</code></li></ul></ul> | <ul><li><code>read</code>: Read a session</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>cancel</code>: Cancel a session</li><ul><li>`ids=<id>;actions=cancel`</li></ul><li><code>read:self</code>: Read a session, which must be associated with the calling user</li><ul><li>`ids=*;type=session;actions=read:self`</li></ul><li><code>cancel:self</code>: Cancel a session, which must be associated with the calling user</li><ul><li>`ids=*;type=session;actions=cancel:self`</li></ul></ul> |
| <code>/sessions/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>session</code></li></ul></ul> | <ul><li><code>read</code>: Read a session</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>cancel</code>: Cancel a session</li><ul><li>`ids=<id>;actions=cancel`</li></ul><li><code>cancel:self</code>: Cancel a session, which must be associated with the calling user</li><ul><li>`ids=<id>;actions=cancel:self`</li></ul><li><code>read:self</code>: Read a session, which must be associated with the calling user</li><ul><li>`ids=<id>;actions=read:self`</li></ul></ul> |
## Session recording
@ -141,7 +196,7 @@ The **Session recording** resource type supports the following scopes: **Global*
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/session-recordings</code> | <ul><li>Type</li><ul><li><code>session-recording</code></li></ul></ul> | <ul><li><code>list</code>: List session recordings</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/session-recordings/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>session-recording</code></li></ul></ul> | <ul><li><code>read</code>: Read a session recording</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>download</code>: Download a session recording</li><ul><li>`ids=<id>;actions=download`</li></ul><li><code>reapply-storage-policy</code>: Reapply the storage policy to a session recording</li><ul><li>`ids=<id>;actions=reapply-storage-policy`</li></ul><li><code>delete</code>: Delete a session recording</li><ul><li>`ids=<id>;actions=delete`</li></ul></ul> |
| <code>/session-recordings/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>session-recording</code></li></ul></ul> | <ul><li><code>read</code>: Read a session recording</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>delete</code>: Delete a session recording</li><ul><li>`ids=<id>;actions=delete`</li></ul><li><code>download</code>: Download a session recording</li><ul><li>`ids=<id>;actions=download`</li></ul><li><code>reapply-storage-policy</code>: Reapply the storage policy to a session recording</li><ul><li>`ids=<id>;actions=reapply-storage-policy`</li></ul></ul> |
## Storage bucket
@ -159,7 +214,7 @@ The **Target** resource type supports the following scopes: **Project**
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/targets</code> | <ul><li>Type</li><ul><li><code>target</code></li></ul></ul> | <ul><li><code>create</code>: Create a target</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>list</code>: List targets</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/targets/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>target</code></li></ul></ul> | <ul><li><code>read</code>: Read a target</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update a target</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete a target</li><ul><li>`ids=<id>;actions=delete`</li></ul><li><code>add-host-sources</code>: Add host sources to a target</li><ul><li>`ids=<id>;actions=add-host-sources`</li></ul><li><code>set-host-sources</code>: Set the full set of host sources on a target</li><ul><li>`ids=<id>;actions=set-host-sources`</li></ul><li><code>remove-host-sources</code>: Remove host sources from a target</li><ul><li>`ids=<id>;actions=remove-host-sources`</li></ul><li><code>add-credential-sources</code>: Add credential sources to a target</li><ul><li>`ids=<id>;actions=add-credential-sources`</li></ul><li><code>set-credential-sources</code>: Set the full set of credential sources on a target</li><ul><li>`ids=<id>;actions=set-credential-sources`</li></ul><li><code>remove-credential-sources</code>: Remove credential sources from a target</li><ul><li>`ids=<id>;actions=remove-credential-sources`</li></ul><li><code>authorize-session</code>: Authorize a session via the target</li><ul><li>`ids=<id>;actions=authorize-session`</li></ul></ul> |
| <code>/targets/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>target</code></li></ul></ul> | <ul><li><code>read</code>: Read a target</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update a target</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete a target</li><ul><li>`ids=<id>;actions=delete`</li></ul><li><code>add-credential-sources</code>: Add credential sources to a target</li><ul><li>`ids=<id>;actions=add-credential-sources`</li></ul><li><code>add-host-sources</code>: Add host sources to a target</li><ul><li>`ids=<id>;actions=add-host-sources`</li></ul><li><code>authorize-session</code>: Authorize a session via the target</li><ul><li>`ids=<id>;actions=authorize-session`</li></ul><li><code>remove-credential-sources</code>: Remove credential sources from a target</li><ul><li>`ids=<id>;actions=remove-credential-sources`</li></ul><li><code>remove-host-sources</code>: Remove host sources from a target</li><ul><li>`ids=<id>;actions=remove-host-sources`</li></ul><li><code>set-credential-sources</code>: Set the full set of credential sources on a target</li><ul><li>`ids=<id>;actions=set-credential-sources`</li></ul><li><code>set-host-sources</code>: Set the full set of host sources on a target</li><ul><li>`ids=<id>;actions=set-host-sources`</li></ul></ul> |
## User
@ -168,7 +223,7 @@ The **User** resource type supports the following scopes: **Global**, **Org**
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/users</code> | <ul><li>Type</li><ul><li><code>user</code></li></ul></ul> | <ul><li><code>create</code>: Create a user</li><ul><li>`type=<type>;actions=create`</li></ul><li><code>list</code>: List users</li><ul><li>`type=<type>;actions=list`</li></ul></ul> |
| <code>/users/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>user</code></li></ul></ul> | <ul><li><code>read</code>: Read a user</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update a user</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete a user</li><ul><li>`ids=<id>;actions=delete`</li></ul><li><code>add-accounts</code>: Add accounts to a user</li><ul><li>`ids=<id>;actions=add-accounts`</li></ul><li><code>set-accounts</code>: Set the full set of accounts on a user</li><ul><li>`ids=<id>;actions=set-accounts`</li></ul><li><code>remove-accounts</code>: Remove accounts from a user</li><ul><li>`ids=<id>;actions=remove-accounts`</li></ul></ul> |
| <code>/users/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>user</code></li></ul></ul> | <ul><li><code>read</code>: Read a user</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update a user</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete a user</li><ul><li>`ids=<id>;actions=delete`</li></ul><li><code>add-accounts</code>: Add accounts to a user</li><ul><li>`ids=<id>;actions=add-accounts`</li></ul><li><code>list-resolvable-aliases</code>: </li><ul><li>`ids=<id>;actions=list-resolvable-aliases`</li></ul><li><code>remove-accounts</code>: Remove accounts from a user</li><ul><li>`ids=<id>;actions=remove-accounts`</li></ul><li><code>set-accounts</code>: Set the full set of accounts on a user</li><ul><li>`ids=<id>;actions=set-accounts`</li></ul></ul> |
## Worker
@ -176,8 +231,8 @@ The **Worker** resource type supports the following scopes: **Global**
| API endpoint | Parameters into permissions engine | Available actions / examples |
| ------------ | ---------------------------------- | ---------------------------- |
| <code>/workers</code> | <ul><li>Type</li><ul><li><code>worker</code></li></ul></ul> | <ul><li><code>list</code>: List workers</li><ul><li>`type=<type>;actions=list`</li></ul><li><code>create:controller-led</code>: Create a worker using the controller-led workflow</li><ul><li>`type=<type>;actions=create`</li><li>`type=<type>;actions=create:controller-led`</li></ul><li><code>create:worker-led</code>: Create a worker using the worker-led workflow</li><ul><li>`type=<type>;actions=create`</li><li>`type=<type>;actions=create:worker-led`</li></ul></ul> |
| <code>/workers/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>worker</code></li></ul></ul> | <ul><li><code>read</code>: Read a worker</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update a worker</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete a worker</li><ul><li>`ids=<id>;actions=delete`</li></ul></ul> |
| <code>/workers</code> | <ul><li>Type</li><ul><li><code>worker</code></li></ul></ul> | <ul><li><code>create:controller-led</code>: Create a worker using the controller-led workflow</li><ul><li>`type=<type>;actions=create:controller-led`</li><li>`type=<type>;actions=create:controller-led`</li></ul><li><code>create:worker-led</code>: Create a worker using the worker-led workflow</li><ul><li>`type=<type>;actions=create:worker-led`</li><li>`type=<type>;actions=create:worker-led`</li></ul><li><code>list</code>: List workers</li><ul><li>`type=<type>;actions=list`</li></ul><li><code>read-certificate-authority</code>: </li><ul><li>`type=<type>;actions=read-certificate-authority`</li></ul><li><code>reinitialize-certificate-authority</code>: </li><ul><li>`type=<type>;actions=reinitialize-certificate-authority`</li></ul></ul> |
| <code>/workers/&lt;id&gt;</code> | <ul><li>ID</li><ul><li><code>&lt;id&gt;</code></li></ul><li>Type</li><ul><li><code>worker</code></li></ul></ul> | <ul><li><code>read</code>: Read a worker</li><ul><li>`ids=<id>;actions=read`</li></ul><li><code>update</code>: Update a worker</li><ul><li>`ids=<id>;actions=update`</li></ul><li><code>delete</code>: Delete a worker</li><ul><li>`ids=<id>;actions=delete`</li></ul><li><code>add-worker-tags</code>: Add worker tags to a worker</li><ul><li>`ids=<id>;actions=add-worker-tags`</li></ul><li><code>remove-worker-tags</code>: Remove worker tags from a worker</li><ul><li>`ids=<id>;actions=remove-worker-tags`</li></ul><li><code>set-worker-tags</code>: Set the full set of worker tags on a worker</li><ul><li>`ids=<id>;actions=set-worker-tags`</li></ul></ul> |
<!-- END TABLE -->

Write Preview
Loading…
Cancel
Save