diff --git a/internal/types/action/registrar.go b/internal/types/action/registrar.go index 310079f4eb..8e2cd291a3 100644 --- a/internal/types/action/registrar.go +++ b/internal/types/action/registrar.go @@ -71,3 +71,23 @@ func ActionSetForResource(r resource.Type) (ActionSet, error) { } return a.valid, nil } + +// CollectionActionSetForResource returns the collection ActionSet registered +// for r or an error if r has not been registered. +func CollectionActionSetForResource(r resource.Type) (ActionSet, error) { + a, err := byResourceRegistrar.get(r) + if err != nil { + return nil, err + } + return a.collection, nil +} + +// IdActionSetForResource returns the individual ActionSet registered +// for r or an error if r has not been registered. +func IdActionSetForResource(r resource.Type) (ActionSet, error) { + a, err := byResourceRegistrar.get(r) + if err != nil { + return nil, err + } + return a.individual, nil +} diff --git a/internal/website/permstable/permstable.go b/internal/website/permstable/permstable.go index 65ea67181f..bfd2dbaf09 100644 --- a/internal/website/permstable/permstable.go +++ b/internal/website/permstable/permstable.go @@ -6,8 +6,15 @@ package main import ( "fmt" "os" + "slices" "sort" "strings" + + // Import the ratelimiter logic for the side effect of getting all service + // handlers imported and their resources and actions registered. + _ "github.com/hashicorp/boundary/internal/ratelimit" + "github.com/hashicorp/boundary/internal/types/action" + "github.com/hashicorp/boundary/internal/types/resource" ) const permsFile = "website/content/docs/concepts/security/permissions/resource-table.mdx" @@ -49,24 +56,128 @@ var page = &Page{ } func main() { - page.Resources = append(page.Resources, - account, - authMethod, - authToken, - group, - host, - hostCatalog, - hostSet, - managedGroup, - role, - scope, - session, - sessionRecording, - storageBucket, - target, - user, - worker, - ) + var orderedResources []resource.Type + for _, res := range resource.Map { + orderedResources = append(orderedResources, res) + } + slices.SortFunc(orderedResources, func(a, b resource.Type) int { + return strings.Compare(a.String(), b.String()) + }) + + for _, res := range orderedResources { + switch res { + case resource.Unknown, resource.All, resource.Controller: + continue + } + info := resources[res] + + name := strings.Replace(res.String(), "-", " ", 1) + singularName := name + switch []rune(strings.ToLower(singularName))[0] { + case 'a', 'e', 'i', 'o': + // 'u' is not included since our only u word is 'user' which + // should use an 'a'. + singularName = "an " + singularName + default: + singularName = "a " + singularName + } + + var pin string + if parent := resource.Parent(res); parent != res { + pin = parent.String() + } + collectionEndpoints := &Endpoint{ + Path: fmt.Sprintf("/%s", res.PluralString()), + Params: map[string]string{ + "Type": res.String(), + }, + } + colActions, err := action.CollectionActionSetForResource(res) + if err != nil { + panic("This shouldn't happen!") + } + for a := range colActions { + actionName := a.String() + examples := []string{ + fmt.Sprintf("type=;actions=%s", actionName), + } + if strings.Contains(actionName, ":") { + parentActionName := strings.SplitN(actionName, ":", 1)[0] + examples = append([]string{fmt.Sprintf("type=;actions=%s", parentActionName)}, examples...) + } + collectionEndpoints.Actions = append(collectionEndpoints.Actions, &Action{ + Name: a.String(), + Examples: examples, + Description: info.description(a, singularName), + }) + } + slices.SortFunc(collectionEndpoints.Actions, func(a, b *Action) int { + return strings.Compare(a.Name, b.Name) + }) + + idEndpoints := &Endpoint{ + Path: fmt.Sprintf("/%s/", res.PluralString()), + Params: map[string]string{ + "ID": "", + "Type": res.String(), + }, + } + if pin != "" { + idEndpoints.Params["Pin"] = fmt.Sprintf("<%s-id>", pin) + } + idActionSet, err := action.IdActionSetForResource(res) + if err != nil { + panic("This shouldn't happen!") + } + var idActions []action.Type + for a := range idActionSet { + idActions = append(idActions, a) + } + + // Always put the first actions as Read, Update, Delete in that order + weighted := map[action.Type]int{ + action.Read: 100, + action.Update: 90, + action.Delete: 80, + } + slices.SortFunc(idActions, func(a, b action.Type) int { + aWeight := weighted[a] + bWeight := weighted[b] + return strings.Compare(a.String(), b.String()) - aWeight + bWeight + }) + + for _, a := range idActions { + if a == action.NoOp { + continue + } + examples := []string{ + fmt.Sprintf("ids=;actions=%s", a.String()), + } + if pin != "" { + examples = append(examples, fmt.Sprintf("ids=;type=;actions=%s", a.String())) + } + idEndpoints.Actions = append(idEndpoints.Actions, &Action{ + Name: a.String(), + Examples: examples, + Description: info.description(a, singularName), + }) + } + + endpoints := make([]*Endpoint, 0, 2) + if len(collectionEndpoints.Actions) > 0 { + endpoints = append(endpoints, collectionEndpoints) + } + if len(idEndpoints.Actions) > 0 { + endpoints = append(endpoints, idEndpoints) + } + pr := &Resource{ + Type: name, + Scopes: info.scopes, + Endpoints: endpoints, + } + + page.Resources = append(page.Resources, pr) + } fileContents, err := os.ReadFile(permsFile) if err != nil { @@ -141,11 +252,13 @@ func (r *Resource) Marshal() (ret []string) { for _, s := range r.Scopes { scopes = append(scopes, fmt.Sprintf("**%s**", s)) } - ret = append(ret, fmt.Sprintf( - "The **%s** resource type supports the following scopes: %s\n", - toSentenceCase(r.Type), - strings.TrimSpace(strings.Join(scopes, ", ")), - )) + if len(scopes) > 0 { + ret = append(ret, fmt.Sprintf( + "The **%s** resource type supports the following scopes: %s\n", + toSentenceCase(r.Type), + strings.TrimSpace(strings.Join(scopes, ", ")), + )) + } // Table Header ret = append(ret, fmt.Sprintf("| %s |", strings.Join(tableHeaders, " | "))) @@ -217,10 +330,6 @@ func escape(s string) string { return strings.Replace(ret, ">", ">", -1) } -func indent(num int) string { - return strings.Repeat(" ", num) -} - func sortedKeys(in map[string]string) []string { out := make([]string, 0, len(in)) for k := range in { @@ -230,725 +339,133 @@ func sortedKeys(in map[string]string) []string { return out } -func lActions(typ string) []*Action { - listVersion := strings.TrimPrefix(strings.TrimPrefix(typ, "an "), "a ") - return []*Action{ - { - Name: "list", - Description: fmt.Sprintf("List %ss", listVersion), - Examples: []string{ - "type=;actions=list", - }, - }, - } -} - -func clActions(typ string) []*Action { - return append([]*Action{ - { - Name: "create", - Description: fmt.Sprintf("Create %s", typ), - Examples: []string{ - "type=;actions=create", - }, - }, - }, lActions(typ)...) +// info holds information for a specific resource +type info struct { + // The scopes this resource can be in + scopes []string + // If the auto generated descriptions do not correctly cover these actions + // for this resource, including the action and a description here will + // cause this to be used instead of the auto generated one. + actionDescOverrides map[action.Type]string } -func rudActions(typ string, pin bool) []*Action { - ret := []*Action{ - { - Name: "read", - Description: fmt.Sprintf("Read %s", typ), - Examples: []string{ - "ids=;actions=read", - }, - }, - { - Name: "update", - Description: fmt.Sprintf("Update %s", typ), - Examples: []string{ - "ids=;actions=update", - }, - }, - { - Name: "delete", - Description: fmt.Sprintf("Delete %s", typ), - Examples: []string{ - "ids=;actions=delete", - }, - }, +// get the description for a resource. +func (i info) description(t action.Type, singleResourceName string) string { + if s, ok := i.actionDescOverrides[t]; ok { + return s } - if pin { - ret[0].Examples = append(ret[0].Examples, "ids=;type=;actions=read") - ret[1].Examples = append(ret[1].Examples, "ids=;type=;actions=update") - ret[2].Examples = append(ret[2].Examples, "ids=;type=;actions=delete") + switch t { + case action.List: + singleResourceName := strings.TrimPrefix(strings.TrimPrefix(singleResourceName, "an "), "a ") + return fmt.Sprintf("List %ss", singleResourceName) + case action.Read: + return fmt.Sprintf("Read %s", singleResourceName) + case action.Update: + return fmt.Sprintf("Update %s", singleResourceName) + case action.Delete: + return fmt.Sprintf("Delete %s", singleResourceName) + case action.Create: + return fmt.Sprintf("Create %s", singleResourceName) } - - return ret + switch { + case strings.HasPrefix(t.String(), "add-"): + thing := strings.SplitN(t.String(), "-", 2)[1] + thing = strings.ReplaceAll(thing, "-", " ") + return fmt.Sprintf("Add %s to %s", thing, singleResourceName) + case strings.HasPrefix(t.String(), "set-"): + thing := strings.SplitN(t.String(), "-", 2)[1] + thing = strings.ReplaceAll(thing, "-", " ") + return fmt.Sprintf("Set the full set of %s on %s", thing, singleResourceName) + case strings.HasPrefix(t.String(), "remove-"): + thing := strings.SplitN(t.String(), "-", 2)[1] + thing = strings.ReplaceAll(thing, "-", " ") + return fmt.Sprintf("Remove %s from %s", thing, singleResourceName) + } + return "" } -var account = &Resource{ - Type: "Account", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/accounts", - Params: map[string]string{ - "Type": "account", - }, - Actions: clActions("an account"), - }, - { - Path: "/accounts/", - Params: map[string]string{ - "ID": "", - "Type": "account", - "Pin": "", - }, - Actions: append( - rudActions("an account", true), - &Action{ - Name: "set-password", - Description: "Set a password on an account, without requiring the current password", - Examples: []string{ - "ids=;actions=set-password", - "ids=;type=;actions=set-password", - }, - }, - &Action{ - Name: "change-password", - Description: "Change a password on an account given the current password", - Examples: []string{ - "ids=;actions=change-password", - "ids=;type=;actions=change-password", - }, - }, - ), +var resources = map[resource.Type]info{ + resource.Account: { + scopes: iamScopes, + actionDescOverrides: map[action.Type]string{ + action.SetPassword: "Set a password on an account, without requiring the current password", + action.ChangePassword: "Change a password on an account given the current password", }, }, -} - -var authMethod = &Resource{ - Type: "Auth Method", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/auth-methods", - Params: map[string]string{ - "Type": "auth-method", - }, - Actions: clActions("an auth method"), - }, - { - Path: "/auth-methods/", - Params: map[string]string{ - "ID": "", - "Type": "auth-method", - }, - Actions: append( - rudActions("an auth method", false), - &Action{ - Name: "authenticate", - Description: "Authenticate to an auth method", - Examples: []string{ - "ids=;actions=authenticate", - }, - }, - ), - }, + resource.Alias: { + scopes: append(iamScopes, infraScope...), }, -} - -var authToken = &Resource{ - Type: "Auth Token", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/auth-tokens", - Params: map[string]string{ - "Type": "auth-token", - }, - Actions: []*Action{ - { - Name: "list", - Description: "List auth tokens", - Examples: []string{ - "type=;actions=list", - }, - }, - }, - }, - { - Path: "/auth-tokens/", - Params: map[string]string{ - "ID": "", - "Type": "auth-token", - }, - Actions: []*Action{ - { - Name: "read", - Description: "Read an auth token", - Examples: []string{ - "ids=;actions=read", - }, - }, - { - Name: "delete", - Description: "Delete an auth token", - Examples: []string{ - "ids=;actions=delete", - }, - }, - }, + resource.AuthMethod: { + scopes: iamScopes, + actionDescOverrides: map[action.Type]string{ + action.Authenticate: "Authenticate to an auth method", }, }, -} - -var group = &Resource{ - Type: "Group", - Scopes: append(iamScopes, infraScope...), - Endpoints: []*Endpoint{ - { - Path: "/groups", - Params: map[string]string{ - "Type": "group", - }, - Actions: clActions("a group"), - }, - { - Path: "/groups/", - Params: map[string]string{ - "ID": "", - "Type": "group", - }, - Actions: append( - rudActions("a group", false), - &Action{ - Name: "add-members", - Description: "Add members to a group", - Examples: []string{ - "ids=;actions=add-members", - }, - }, - &Action{ - Name: "set-members", - Description: "Set the full set of members on a group", - Examples: []string{ - "ids=;actions=set-members", - }, - }, - &Action{ - Name: "remove-members", - Description: "Remove members from a group", - Examples: []string{ - "ids=;actions=remove-members", - }, - }, - ), - }, + resource.AuthToken: { + scopes: iamScopes, }, -} - -var host = &Resource{ - Type: "Host", - Scopes: infraScope, - Endpoints: []*Endpoint{ - { - Path: "/hosts", - Params: map[string]string{ - "Type": "host", - }, - Actions: clActions("a host"), - }, - { - Path: "/hosts/", - Params: map[string]string{ - "ID": "", - "Type": "host", - "Pin": "", - }, - Actions: rudActions("a host", true), - }, + resource.Credential: { + scopes: infraScope, }, -} - -var hostCatalog = &Resource{ - Type: "Host Catalog", - Scopes: infraScope, - Endpoints: []*Endpoint{ - { - Path: "/host-catalogs", - Params: map[string]string{ - "Type": "host-catalog", - }, - Actions: clActions("a host catalog"), - }, - { - Path: "/host-catalogs/", - Params: map[string]string{ - "ID": "", - "Type": "host-catalog", - }, - Actions: rudActions("a host catalog", false), - }, + resource.CredentialLibrary: { + scopes: infraScope, }, -} - -var hostSet = &Resource{ - Type: "Host Set", - Scopes: infraScope, - Endpoints: []*Endpoint{ - { - Path: "/host-sets", - Params: map[string]string{ - "Type": "host-set", - }, - Actions: clActions("a host set"), - }, - { - Path: "/host-sets/", - Params: map[string]string{ - "ID": "", - "Type": "host-set", - "Pin": "", - }, - Actions: append( - rudActions("a host set", true), - &Action{ - Name: "add-hosts", - Description: "Add hosts to a host-set", - Examples: []string{ - "ids=;actions=add-hosts", - "ids=;type=;actions=add-hosts", - }, - }, - &Action{ - Name: "set-hosts", - Description: "Set the full set of hosts on a host set", - Examples: []string{ - "ids=;actions=set-hosts", - "ids=;type=;actions=set-hosts", - }, - }, - &Action{ - Name: "remove-hosts", - Description: "Remove hosts from a host set", - Examples: []string{ - "ids=;actions=remove-hosts", - "ids=;type=;actions=remove-hosts", - }, - }, - ), - }, + resource.CredentialStore: { + scopes: infraScope, }, -} - -var managedGroup = &Resource{ - Type: "Managed Group", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/managed-groups", - Params: map[string]string{ - "Type": "managed-group", - }, - Actions: clActions("a managed group"), - }, - { - Path: "/managed-groups/", - Params: map[string]string{ - "ID": "", - "Type": "managed-group", - "Pin": "", - }, - Actions: rudActions("a managed group", true), - }, + resource.Group: { + scopes: append(iamScopes, infraScope...), }, -} - -var role = &Resource{ - Type: "Role", - Scopes: append(iamScopes, infraScope...), - Endpoints: []*Endpoint{ - { - Path: "/roles", - Params: map[string]string{ - "Type": "role", - }, - Actions: clActions("a role"), - }, - { - Path: "/roles/", - Params: map[string]string{ - "ID": "", - "Type": "role", - }, - Actions: append( - rudActions("a role", false), - &Action{ - Name: "add-principals", - Description: "Add principals to a role", - Examples: []string{ - "ids=;actions=add-principals", - }, - }, - &Action{ - Name: "set-principals", - Description: "Set the full set of principals on a role", - Examples: []string{ - "ids=;actions=set-principals", - }, - }, - &Action{ - Name: "remove-principals", - Description: "Remove principals from a role", - Examples: []string{ - "ids=;actions=remove-principals", - }, - }, - &Action{ - Name: "add-grants", - Description: "Add grants to a role", - Examples: []string{ - "ids=;actions=add-grants", - }, - }, - &Action{ - Name: "set-grants", - Description: "Set the full set of grants on a role", - Examples: []string{ - "ids=;actions=set-grants", - }, - }, - &Action{ - Name: "remove-grants", - Description: "Remove grants from a role", - Examples: []string{ - "ids=;actions=remove-grants", - }, - }, - ), - }, + resource.Host: { + scopes: infraScope, }, -} - -var scope = &Resource{ - Type: "Scope", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/scopes", - Params: map[string]string{ - "Type": "scope", - }, - Actions: clActions("a scope"), - }, - { - Path: "/scopes/", - Params: map[string]string{ - "ID": "", - "Type": "scope", - }, - Actions: rudActions("a scope", false), - }, + resource.HostCatalog: { + scopes: infraScope, }, -} - -var session = &Resource{ - Type: "Session", - Scopes: infraScope, - Endpoints: []*Endpoint{ - { - Path: "/sessions", - Params: map[string]string{ - "Type": "session", - }, - Actions: []*Action{ - { - Name: "list", - Description: "List sessions", - Examples: []string{ - "type=;actions=list", - }, - }, - }, - }, - { - Path: "/session/", - Params: map[string]string{ - "ID": "", - "Type": "session", - }, - Actions: []*Action{ - { - Name: "read", - Description: "Read a session", - Examples: []string{ - "ids=;actions=read", - }, - }, - { - Name: "cancel", - Description: "Cancel a session", - Examples: []string{ - "ids=;actions=cancel", - }, - }, - { - Name: "read:self", - Description: "Read a session, which must be associated with the calling user", - Examples: []string{ - "ids=*;type=session;actions=read:self", - }, - }, - { - Name: "cancel:self", - Description: "Cancel a session, which must be associated with the calling user", - Examples: []string{ - "ids=*;type=session;actions=cancel:self", - }, - }, - }, - }, + resource.HostSet: { + scopes: infraScope, }, -} - -var sessionRecording = &Resource{ - Type: "Session Recording", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/session-recordings", - Params: map[string]string{ - "Type": "session-recording", - }, - Actions: []*Action{ - { - Name: "list", - Description: "List session recordings", - Examples: []string{ - "type=;actions=list", - }, - }, - }, - }, - { - Path: "/session-recordings/", - Params: map[string]string{ - "ID": "", - "Type": "session-recording", - }, - Actions: []*Action{ - { - Name: "read", - Description: "Read a session recording", - Examples: []string{ - "ids=;actions=read", - }, - }, - { - Name: "download", - Description: "Download a session recording", - Examples: []string{ - "ids=;actions=download", - }, - }, - { - Name: "reapply-storage-policy", - Description: "Reapply the storage policy to a session recording", - Examples: []string{ - "ids=;actions=reapply-storage-policy", - }, - }, - { - Name: "delete", - Description: "Delete a session recording", - Examples: []string{ - "ids=;actions=delete", - }, - }, - }, - }, + resource.ManagedGroup: { + scopes: iamScopes, }, -} - -var storageBucket = &Resource{ - Type: "Storage Bucket", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/storage-buckets", - Params: map[string]string{ - "Type": "storage-bucket", - }, - Actions: clActions("a storage bucket"), - }, - { - Path: "/storage-buckets/", - Params: map[string]string{ - "ID": "", - "Type": "storage-bucket", - }, - Actions: rudActions("a storage bucket", false), - }, + resource.Role: { + scopes: append(iamScopes, infraScope...), }, -} - -var target = &Resource{ - Type: "Target", - Scopes: infraScope, - Endpoints: []*Endpoint{ - { - Path: "/targets", - Params: map[string]string{ - "Type": "target", - }, - Actions: clActions("a target"), - }, - { - Path: "/targets/", - Params: map[string]string{ - "ID": "", - "Type": "target", - }, - Actions: append( - rudActions("a target", false), - &Action{ - Name: "add-host-sources", - Description: "Add host sources to a target", - Examples: []string{ - "ids=;actions=add-host-sources", - }, - }, - &Action{ - Name: "set-host-sources", - Description: "Set the full set of host sources on a target", - Examples: []string{ - "ids=;actions=set-host-sources", - }, - }, - &Action{ - Name: "remove-host-sources", - Description: "Remove host sources from a target", - Examples: []string{ - "ids=;actions=remove-host-sources", - }, - }, - &Action{ - Name: "add-credential-sources", - Description: "Add credential sources to a target", - Examples: []string{ - "ids=;actions=add-credential-sources", - }, - }, - &Action{ - Name: "set-credential-sources", - Description: "Set the full set of credential sources on a target", - Examples: []string{ - "ids=;actions=set-credential-sources", - }, - }, - &Action{ - Name: "remove-credential-sources", - Description: "Remove credential sources from a target", - Examples: []string{ - "ids=;actions=remove-credential-sources", - }, - }, - &Action{ - Name: "authorize-session", - Description: "Authorize a session via the target", - Examples: []string{ - "ids=;actions=authorize-session", - }, - }, - ), - }, + resource.Scope: { + scopes: iamScopes, }, -} - -var user = &Resource{ - Type: "User", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/users", - Params: map[string]string{ - "Type": "user", - }, - Actions: clActions("a user"), + resource.Session: { + scopes: infraScope, + actionDescOverrides: map[action.Type]string{ + action.Cancel: "Cancel a session", + action.CancelSelf: "Cancel a session, which must be associated with the calling user", + action.ReadSelf: "Read a session, which must be associated with the calling user", }, - { - Path: "/users/", - Params: map[string]string{ - "ID": "", - "Type": "user", - }, - Actions: append( - rudActions("a user", false), - &Action{ - Name: "add-accounts", - Description: "Add accounts to a user", - Examples: []string{ - "ids=;actions=add-accounts", - }, - }, - &Action{ - Name: "set-accounts", - Description: "Set the full set of accounts on a user", - Examples: []string{ - "ids=;actions=set-accounts", - }, - }, - &Action{ - Name: "remove-accounts", - Description: "Remove accounts from a user", - Examples: []string{ - "ids=;actions=remove-accounts", - }, - }, - ), + }, + resource.SessionRecording: { + scopes: iamScopes, + actionDescOverrides: map[action.Type]string{ + action.Download: "Download a session recording", + action.ReApplyStoragePolicy: "Reapply the storage policy to a session recording", }, }, -} - -var worker = &Resource{ - Type: "Worker", - Scopes: []string{"Global"}, - Endpoints: []*Endpoint{ - { - Path: "/workers", - Params: map[string]string{ - "Type": "worker", - }, - Actions: append( - lActions("a worker"), - &Action{ - Name: "create:controller-led", - Description: "Create a worker using the controller-led workflow", - Examples: []string{ - "type=;actions=create", - "type=;actions=create:controller-led", - }, - }, - &Action{ - Name: "create:worker-led", - Description: "Create a worker using the worker-led workflow", - Examples: []string{ - "type=;actions=create", - "type=;actions=create:worker-led", - }, - }, - ), + resource.StorageBucket: { + scopes: iamScopes, + }, + resource.Target: { + scopes: infraScope, + actionDescOverrides: map[action.Type]string{ + action.AuthorizeSession: "Authorize a session via the target", }, - { - Path: "/workers/", - Params: map[string]string{ - "ID": "", - "Type": "worker", - }, - Actions: rudActions("a worker", false), + }, + resource.User: { + scopes: iamScopes, + }, + resource.Worker: { + scopes: []string{"Global"}, + actionDescOverrides: map[action.Type]string{ + action.CreateControllerLed: "Create a worker using the controller-led workflow", + action.CreateWorkerLed: "Create a worker using the worker-led workflow", }, }, } diff --git a/website/content/docs/concepts/security/permissions/resource-table.mdx b/website/content/docs/concepts/security/permissions/resource-table.mdx index eb11fe416a..629c374931 100644 --- a/website/content/docs/concepts/security/permissions/resource-table.mdx +++ b/website/content/docs/concepts/security/permissions/resource-table.mdx @@ -19,13 +19,19 @@ Refer to the tables for more information about the following resource types: - [Account](#account) +- [Alias](#alias) - [Auth method](#auth-method) - [Auth token](#auth-token) +- [Billing](#billing) +- [Credential](#credential) +- [Credential library](#credential-library) +- [Credential store](#credential-store) - [Group](#group) - [Host](#host) - [Host catalog](#host-catalog) - [Host set](#host-set) - [Managed group](#managed-group) +- [Policy](#policy) - [Role](#role) - [Scope](#scope) - [Session](#session) @@ -42,7 +48,16 @@ The **Account** resource type supports the following scopes: **Global**, **Org** | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /accounts |
  • Type
    • account
|
  • create: Create an account
    • `type=;actions=create`
  • list: List accounts
    • `type=;actions=list`
| -| /accounts/<id> |
  • ID
    • <id>
  • Pin
    • <auth-method-id>
  • Type
    • account
|
  • read: Read an account
    • `ids=;actions=read`
    • `ids=;type=;actions=read`
  • update: Update an account
    • `ids=;actions=update`
    • `ids=;type=;actions=update`
  • delete: Delete an account
    • `ids=;actions=delete`
    • `ids=;type=;actions=delete`
  • set-password: Set a password on an account, without requiring the current password
    • `ids=;actions=set-password`
    • `ids=;type=;actions=set-password`
  • change-password: Change a password on an account given the current password
    • `ids=;actions=change-password`
    • `ids=;type=;actions=change-password`
| +| /accounts/<id> |
  • ID
    • <id>
  • Pin
    • <auth-method-id>
  • Type
    • account
|
  • read: Read an account
    • `ids=;actions=read`
    • `ids=;type=;actions=read`
  • update: Update an account
    • `ids=;actions=update`
    • `ids=;type=;actions=update`
  • delete: Delete an account
    • `ids=;actions=delete`
    • `ids=;type=;actions=delete`
  • change-password: Change a password on an account given the current password
    • `ids=;actions=change-password`
    • `ids=;type=;actions=change-password`
  • set-password: Set a password on an account, without requiring the current password
    • `ids=;actions=set-password`
    • `ids=;type=;actions=set-password`
| + +## Alias + +The **Alias** resource type supports the following scopes: **Global**, **Org**, **Project** + +| API endpoint | Parameters into permissions engine | Available actions / examples | +| ------------ | ---------------------------------- | ---------------------------- | +| /aliases |
  • Type
    • alias
|
  • create: Create an alias
    • `type=;actions=create`
  • list: List aliass
    • `type=;actions=list`
| +| /aliases/<id> |
  • ID
    • <id>
  • Type
    • alias
|
  • read: Read an alias
    • `ids=;actions=read`
  • update: Update an alias
    • `ids=;actions=update`
  • delete: Delete an alias
    • `ids=;actions=delete`
| ## Auth method @@ -51,7 +66,7 @@ The **Auth method** resource type supports the following scopes: **Global**, **O | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /auth-methods |
  • Type
    • auth-method
|
  • create: Create an auth method
    • `type=;actions=create`
  • list: List auth methods
    • `type=;actions=list`
| -| /auth-methods/<id> |
  • ID
    • <id>
  • Type
    • auth-method
|
  • read: Read an auth method
    • `ids=;actions=read`
  • update: Update an auth method
    • `ids=;actions=update`
  • delete: Delete an auth method
    • `ids=;actions=delete`
  • authenticate: Authenticate to an auth method
    • `ids=;actions=authenticate`
| +| /auth-methods/<id> |
  • ID
    • <id>
  • Type
    • auth-method
|
  • read: Read an auth method
    • `ids=;actions=read`
  • update: Update an auth method
    • `ids=;actions=update`
  • delete: Delete an auth method
    • `ids=;actions=delete`
  • authenticate: Authenticate to an auth method
    • `ids=;actions=authenticate`
  • change-state:
    • `ids=;actions=change-state`
| ## Auth token @@ -60,7 +75,40 @@ The **Auth token** resource type supports the following scopes: **Global**, **Or | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /auth-tokens |
  • Type
    • auth-token
|
  • list: List auth tokens
    • `type=;actions=list`
| -| /auth-tokens/<id> |
  • ID
    • <id>
  • Type
    • auth-token
|
  • read: Read an auth token
    • `ids=;actions=read`
  • delete: Delete an auth token
    • `ids=;actions=delete`
| +| /auth-tokens/<id> |
  • ID
    • <id>
  • Type
    • auth-token
|
  • read: Read an auth token
    • `ids=;actions=read`
  • delete: Delete an auth token
    • `ids=;actions=delete`
  • delete:self:
    • `ids=;actions=delete:self`
  • read:self:
    • `ids=;actions=read:self`
| + +## Billing + +| API endpoint | Parameters into permissions engine | Available actions / examples | +| ------------ | ---------------------------------- | ---------------------------- | +| /billing |
  • Type
    • billing
|
  • monthly-active-users:
    • `type=;actions=monthly-active-users`
| + +## Credential + +The **Credential** resource type supports the following scopes: **Project** + +| API endpoint | Parameters into permissions engine | Available actions / examples | +| ------------ | ---------------------------------- | ---------------------------- | +| /credentials |
  • Type
    • credential
|
  • create: Create a credential
    • `type=;actions=create`
  • list: List credentials
    • `type=;actions=list`
| +| /credentials/<id> |
  • ID
    • <id>
  • Pin
    • <credential-store-id>
  • Type
    • credential
|
  • read: Read a credential
    • `ids=;actions=read`
    • `ids=;type=;actions=read`
  • update: Update a credential
    • `ids=;actions=update`
    • `ids=;type=;actions=update`
  • delete: Delete a credential
    • `ids=;actions=delete`
    • `ids=;type=;actions=delete`
| + +## Credential library + +The **Credential library** resource type supports the following scopes: **Project** + +| API endpoint | Parameters into permissions engine | Available actions / examples | +| ------------ | ---------------------------------- | ---------------------------- | +| /credential-libraries |
  • Type
    • credential-library
|
  • create: Create a credential library
    • `type=;actions=create`
  • list: List credential librarys
    • `type=;actions=list`
| +| /credential-libraries/<id> |
  • ID
    • <id>
  • Pin
    • <credential-store-id>
  • Type
    • credential-library
|
  • read: Read a credential library
    • `ids=;actions=read`
    • `ids=;type=;actions=read`
  • update: Update a credential library
    • `ids=;actions=update`
    • `ids=;type=;actions=update`
  • delete: Delete a credential library
    • `ids=;actions=delete`
    • `ids=;type=;actions=delete`
| + +## Credential store + +The **Credential store** resource type supports the following scopes: **Project** + +| API endpoint | Parameters into permissions engine | Available actions / examples | +| ------------ | ---------------------------------- | ---------------------------- | +| /credential-stores |
  • Type
    • credential-store
|
  • create: Create a credential store
    • `type=;actions=create`
  • list: List credential stores
    • `type=;actions=list`
| +| /credential-stores/<id> |
  • ID
    • <id>
  • Type
    • credential-store
|
  • read: Read a credential store
    • `ids=;actions=read`
  • update: Update a credential store
    • `ids=;actions=update`
  • delete: Delete a credential store
    • `ids=;actions=delete`
| ## Group @@ -69,7 +117,7 @@ The **Group** resource type supports the following scopes: **Global**, **Org**, | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /groups |
  • Type
    • group
|
  • create: Create a group
    • `type=;actions=create`
  • list: List groups
    • `type=;actions=list`
| -| /groups/<id> |
  • ID
    • <id>
  • Type
    • group
|
  • read: Read a group
    • `ids=;actions=read`
  • update: Update a group
    • `ids=;actions=update`
  • delete: Delete a group
    • `ids=;actions=delete`
  • add-members: Add members to a group
    • `ids=;actions=add-members`
  • set-members: Set the full set of members on a group
    • `ids=;actions=set-members`
  • remove-members: Remove members from a group
    • `ids=;actions=remove-members`
| +| /groups/<id> |
  • ID
    • <id>
  • Type
    • group
|
  • read: Read a group
    • `ids=;actions=read`
  • update: Update a group
    • `ids=;actions=update`
  • delete: Delete a group
    • `ids=;actions=delete`
  • add-members: Add members to a group
    • `ids=;actions=add-members`
  • remove-members: Remove members from a group
    • `ids=;actions=remove-members`
  • set-members: Set the full set of members on a group
    • `ids=;actions=set-members`
| ## Host @@ -96,7 +144,7 @@ The **Host set** resource type supports the following scopes: **Project** | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /host-sets |
  • Type
    • host-set
|
  • create: Create a host set
    • `type=;actions=create`
  • list: List host sets
    • `type=;actions=list`
| -| /host-sets/<id> |
  • ID
    • <id>
  • Pin
    • <host-catalog-id>
  • Type
    • host-set
|
  • read: Read a host set
    • `ids=;actions=read`
    • `ids=;type=;actions=read`
  • update: Update a host set
    • `ids=;actions=update`
    • `ids=;type=;actions=update`
  • delete: Delete a host set
    • `ids=;actions=delete`
    • `ids=;type=;actions=delete`
  • add-hosts: Add hosts to a host-set
    • `ids=;actions=add-hosts`
    • `ids=;type=;actions=add-hosts`
  • set-hosts: Set the full set of hosts on a host set
    • `ids=;actions=set-hosts`
    • `ids=;type=;actions=set-hosts`
  • remove-hosts: Remove hosts from a host set
    • `ids=;actions=remove-hosts`
    • `ids=;type=;actions=remove-hosts`
| +| /host-sets/<id> |
  • ID
    • <id>
  • Pin
    • <host-catalog-id>
  • Type
    • host-set
|
  • read: Read a host set
    • `ids=;actions=read`
    • `ids=;type=;actions=read`
  • update: Update a host set
    • `ids=;actions=update`
    • `ids=;type=;actions=update`
  • delete: Delete a host set
    • `ids=;actions=delete`
    • `ids=;type=;actions=delete`
  • add-hosts: Add hosts to a host set
    • `ids=;actions=add-hosts`
    • `ids=;type=;actions=add-hosts`
  • remove-hosts: Remove hosts from a host set
    • `ids=;actions=remove-hosts`
    • `ids=;type=;actions=remove-hosts`
  • set-hosts: Set the full set of hosts on a host set
    • `ids=;actions=set-hosts`
    • `ids=;type=;actions=set-hosts`
| ## Managed group @@ -107,6 +155,13 @@ The **Managed group** resource type supports the following scopes: **Global**, * | /managed-groups |
  • Type
    • managed-group
|
  • create: Create a managed group
    • `type=;actions=create`
  • list: List managed groups
    • `type=;actions=list`
| | /managed-groups/<id> |
  • ID
    • <id>
  • Pin
    • <auth-method-id>
  • Type
    • managed-group
|
  • read: Read a managed group
    • `ids=;actions=read`
    • `ids=;type=;actions=read`
  • update: Update a managed group
    • `ids=;actions=update`
    • `ids=;type=;actions=update`
  • delete: Delete a managed group
    • `ids=;actions=delete`
    • `ids=;type=;actions=delete`
| +## Policy + +| API endpoint | Parameters into permissions engine | Available actions / examples | +| ------------ | ---------------------------------- | ---------------------------- | +| /policies |
  • Type
    • policy
|
  • create: Create a policy
    • `type=;actions=create`
  • list: List policys
    • `type=;actions=list`
| +| /policies/<id> |
  • ID
    • <id>
  • Type
    • policy
|
  • read: Read a policy
    • `ids=;actions=read`
  • update: Update a policy
    • `ids=;actions=update`
  • delete: Delete a policy
    • `ids=;actions=delete`
| + ## Role The **Role** resource type supports the following scopes: **Global**, **Org**, **Project** @@ -114,7 +169,7 @@ The **Role** resource type supports the following scopes: **Global**, **Org**, * | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /roles |
  • Type
    • role
|
  • create: Create a role
    • `type=;actions=create`
  • list: List roles
    • `type=;actions=list`
| -| /roles/<id> |
  • ID
    • <id>
  • Type
    • role
|
  • read: Read a role
    • `ids=;actions=read`
  • update: Update a role
    • `ids=;actions=update`
  • delete: Delete a role
    • `ids=;actions=delete`
  • add-principals: Add principals to a role
    • `ids=;actions=add-principals`
  • set-principals: Set the full set of principals on a role
    • `ids=;actions=set-principals`
  • remove-principals: Remove principals from a role
    • `ids=;actions=remove-principals`
  • add-grants: Add grants to a role
    • `ids=;actions=add-grants`
  • set-grants: Set the full set of grants on a role
    • `ids=;actions=set-grants`
  • remove-grants: Remove grants from a role
    • `ids=;actions=remove-grants`
| +| /roles/<id> |
  • ID
    • <id>
  • Type
    • role
|
  • read: Read a role
    • `ids=;actions=read`
  • update: Update a role
    • `ids=;actions=update`
  • delete: Delete a role
    • `ids=;actions=delete`
  • add-grant-scopes: Add grant scopes to a role
    • `ids=;actions=add-grant-scopes`
  • add-grants: Add grants to a role
    • `ids=;actions=add-grants`
  • add-principals: Add principals to a role
    • `ids=;actions=add-principals`
  • remove-grant-scopes: Remove grant scopes from a role
    • `ids=;actions=remove-grant-scopes`
  • remove-grants: Remove grants from a role
    • `ids=;actions=remove-grants`
  • remove-principals: Remove principals from a role
    • `ids=;actions=remove-principals`
  • set-grant-scopes: Set the full set of grant scopes on a role
    • `ids=;actions=set-grant-scopes`
  • set-grants: Set the full set of grants on a role
    • `ids=;actions=set-grants`
  • set-principals: Set the full set of principals on a role
    • `ids=;actions=set-principals`
| ## Scope @@ -122,8 +177,8 @@ The **Scope** resource type supports the following scopes: **Global**, **Org** | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | -| /scopes |
  • Type
    • scope
|
  • create: Create a scope
    • `type=;actions=create`
  • list: List scopes
    • `type=;actions=list`
| -| /scopes/<id> |
  • ID
    • <id>
  • Type
    • scope
|
  • read: Read a scope
    • `ids=;actions=read`
  • update: Update a scope
    • `ids=;actions=update`
  • delete: Delete a scope
    • `ids=;actions=delete`
| +| /scopes |
  • Type
    • scope
|
  • create: Create a scope
    • `type=;actions=create`
  • destroy-key-version:
    • `type=;actions=destroy-key-version`
  • list: List scopes
    • `type=;actions=list`
  • list-key-version-destruction-jobs:
    • `type=;actions=list-key-version-destruction-jobs`
  • list-keys:
    • `type=;actions=list-keys`
  • rotate-keys:
    • `type=;actions=rotate-keys`
| +| /scopes/<id> |
  • ID
    • <id>
  • Type
    • scope
|
  • read: Read a scope
    • `ids=;actions=read`
  • update: Update a scope
    • `ids=;actions=update`
  • delete: Delete a scope
    • `ids=;actions=delete`
  • attach-storage-policy:
    • `ids=;actions=attach-storage-policy`
  • detach-storage-policy:
    • `ids=;actions=detach-storage-policy`
| ## Session @@ -132,7 +187,7 @@ The **Session** resource type supports the following scopes: **Project** | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /sessions |
  • Type
    • session
|
  • list: List sessions
    • `type=;actions=list`
| -| /session/<id> |
  • ID
    • <id>
  • Type
    • session
|
  • read: Read a session
    • `ids=;actions=read`
  • cancel: Cancel a session
    • `ids=;actions=cancel`
  • read:self: Read a session, which must be associated with the calling user
    • `ids=*;type=session;actions=read:self`
  • cancel:self: Cancel a session, which must be associated with the calling user
    • `ids=*;type=session;actions=cancel:self`
| +| /sessions/<id> |
  • ID
    • <id>
  • Type
    • session
|
  • read: Read a session
    • `ids=;actions=read`
  • cancel: Cancel a session
    • `ids=;actions=cancel`
  • cancel:self: Cancel a session, which must be associated with the calling user
    • `ids=;actions=cancel:self`
  • read:self: Read a session, which must be associated with the calling user
    • `ids=;actions=read:self`
| ## Session recording @@ -141,7 +196,7 @@ The **Session recording** resource type supports the following scopes: **Global* | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /session-recordings |
  • Type
    • session-recording
|
  • list: List session recordings
    • `type=;actions=list`
| -| /session-recordings/<id> |
  • ID
    • <id>
  • Type
    • session-recording
|
  • read: Read a session recording
    • `ids=;actions=read`
  • download: Download a session recording
    • `ids=;actions=download`
  • reapply-storage-policy: Reapply the storage policy to a session recording
    • `ids=;actions=reapply-storage-policy`
  • delete: Delete a session recording
    • `ids=;actions=delete`
| +| /session-recordings/<id> |
  • ID
    • <id>
  • Type
    • session-recording
|
  • read: Read a session recording
    • `ids=;actions=read`
  • delete: Delete a session recording
    • `ids=;actions=delete`
  • download: Download a session recording
    • `ids=;actions=download`
  • reapply-storage-policy: Reapply the storage policy to a session recording
    • `ids=;actions=reapply-storage-policy`
| ## Storage bucket @@ -159,7 +214,7 @@ The **Target** resource type supports the following scopes: **Project** | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /targets |
  • Type
    • target
|
  • create: Create a target
    • `type=;actions=create`
  • list: List targets
    • `type=;actions=list`
| -| /targets/<id> |
  • ID
    • <id>
  • Type
    • target
|
  • read: Read a target
    • `ids=;actions=read`
  • update: Update a target
    • `ids=;actions=update`
  • delete: Delete a target
    • `ids=;actions=delete`
  • add-host-sources: Add host sources to a target
    • `ids=;actions=add-host-sources`
  • set-host-sources: Set the full set of host sources on a target
    • `ids=;actions=set-host-sources`
  • remove-host-sources: Remove host sources from a target
    • `ids=;actions=remove-host-sources`
  • add-credential-sources: Add credential sources to a target
    • `ids=;actions=add-credential-sources`
  • set-credential-sources: Set the full set of credential sources on a target
    • `ids=;actions=set-credential-sources`
  • remove-credential-sources: Remove credential sources from a target
    • `ids=;actions=remove-credential-sources`
  • authorize-session: Authorize a session via the target
    • `ids=;actions=authorize-session`
| +| /targets/<id> |
  • ID
    • <id>
  • Type
    • target
|
  • read: Read a target
    • `ids=;actions=read`
  • update: Update a target
    • `ids=;actions=update`
  • delete: Delete a target
    • `ids=;actions=delete`
  • add-credential-sources: Add credential sources to a target
    • `ids=;actions=add-credential-sources`
  • add-host-sources: Add host sources to a target
    • `ids=;actions=add-host-sources`
  • authorize-session: Authorize a session via the target
    • `ids=;actions=authorize-session`
  • remove-credential-sources: Remove credential sources from a target
    • `ids=;actions=remove-credential-sources`
  • remove-host-sources: Remove host sources from a target
    • `ids=;actions=remove-host-sources`
  • set-credential-sources: Set the full set of credential sources on a target
    • `ids=;actions=set-credential-sources`
  • set-host-sources: Set the full set of host sources on a target
    • `ids=;actions=set-host-sources`
| ## User @@ -168,7 +223,7 @@ The **User** resource type supports the following scopes: **Global**, **Org** | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /users |
  • Type
    • user
|
  • create: Create a user
    • `type=;actions=create`
  • list: List users
    • `type=;actions=list`
| -| /users/<id> |
  • ID
    • <id>
  • Type
    • user
|
  • read: Read a user
    • `ids=;actions=read`
  • update: Update a user
    • `ids=;actions=update`
  • delete: Delete a user
    • `ids=;actions=delete`
  • add-accounts: Add accounts to a user
    • `ids=;actions=add-accounts`
  • set-accounts: Set the full set of accounts on a user
    • `ids=;actions=set-accounts`
  • remove-accounts: Remove accounts from a user
    • `ids=;actions=remove-accounts`
| +| /users/<id> |
  • ID
    • <id>
  • Type
    • user
|
  • read: Read a user
    • `ids=;actions=read`
  • update: Update a user
    • `ids=;actions=update`
  • delete: Delete a user
    • `ids=;actions=delete`
  • add-accounts: Add accounts to a user
    • `ids=;actions=add-accounts`
  • list-resolvable-aliases:
    • `ids=;actions=list-resolvable-aliases`
  • remove-accounts: Remove accounts from a user
    • `ids=;actions=remove-accounts`
  • set-accounts: Set the full set of accounts on a user
    • `ids=;actions=set-accounts`
| ## Worker @@ -176,8 +231,8 @@ The **Worker** resource type supports the following scopes: **Global** | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | -| /workers |
  • Type
    • worker
|
  • list: List workers
    • `type=;actions=list`
  • create:controller-led: Create a worker using the controller-led workflow
    • `type=;actions=create`
    • `type=;actions=create:controller-led`
  • create:worker-led: Create a worker using the worker-led workflow
    • `type=;actions=create`
    • `type=;actions=create:worker-led`
| -| /workers/<id> |
  • ID
    • <id>
  • Type
    • worker
|
  • read: Read a worker
    • `ids=;actions=read`
  • update: Update a worker
    • `ids=;actions=update`
  • delete: Delete a worker
    • `ids=;actions=delete`
| +| /workers |
  • Type
    • worker
|
  • create:controller-led: Create a worker using the controller-led workflow
    • `type=;actions=create:controller-led`
    • `type=;actions=create:controller-led`
  • create:worker-led: Create a worker using the worker-led workflow
    • `type=;actions=create:worker-led`
    • `type=;actions=create:worker-led`
  • list: List workers
    • `type=;actions=list`
  • read-certificate-authority:
    • `type=;actions=read-certificate-authority`
  • reinitialize-certificate-authority:
    • `type=;actions=reinitialize-certificate-authority`
| +| /workers/<id> |
  • ID
    • <id>
  • Type
    • worker
|
  • read: Read a worker
    • `ids=;actions=read`
  • update: Update a worker
    • `ids=;actions=update`
  • delete: Delete a worker
    • `ids=;actions=delete`
  • add-worker-tags: Add worker tags to a worker
    • `ids=;actions=add-worker-tags`
  • remove-worker-tags: Remove worker tags from a worker
    • `ids=;actions=remove-worker-tags`
  • set-worker-tags: Set the full set of worker tags on a worker
    • `ids=;actions=set-worker-tags`
|