• Identity and Access Management

iam
  1. Help Center
  2. Identity and Access Management
  3. API Reference
  4. Custom Role Management
  5. Modifying Custom Roles

Modifying Custom Roles

Function Description

This interface is used to modify a custom role.

URI

  • URI format

    PATCH /v3.0/OS-ROLE/roles/{role_id}

  • URI parameter description

    Parameter

    Mandatory

    Type

    Description

    role_id

    Yes

    String

    ID of a role.

Request

  • Request header parameter description

    Parameter

    Mandatory

    Type

    Description

    Content-Type

    Yes

    String

    Fill application/json;charset=utf8 in this field.

    X-Auth-Token

    Yes

    String

    Authenticated token with the Security Administrator permission.

  • Request body parameter description

    Parameter

    Mandatory

    Type

    Description

    role

    Yes

    JSONObject

    Request body of a user group.

    display_name

    Yes

    String

    Displayed name of a role. The value cannot exceed 64 characters.

    type

    Yes

    String

    Display mode of a role.

    • AX: A role is displayed at the domain layer.
    • XA: A role is displayed at the project layer.
      NOTE:

      The display mode of a role can only be AX or XA. A role cannot be displayed at both the domain and project layers or neither of the two layers. That is, neither AA nor XX is allowed.

    description

    Yes

    String

    Description of a role. The value cannot exceed 256 characters.

    policy

    Yes

    JSONObject

    Permission policy of a role.

  • Description for the policy format

    Parameter

    Mandatory

    Type

    Description

    Version

    Yes

    String

    Version of a policy. The value must be 1.1.

    Statement

    Yes

    JSONArray

    Statement for using the policy to grant permissions. A policy consists of a maximum of eight statements. A Statement field contains the Effect and Action elements.

  • Description for the statement format

    Parameter

    Mandatory

    Type

    Description

    Effect

    Yes

    String

    The value can be Allow and Deny. If both Allow and Deny are found in statements, the policy evaluation starts with Deny.

    Action

    Yes

    StringArray

    Permission set, which specifies the operation permissions on resources. The number of permission sets cannot exceed 100.

    Format:

    The value format is Service name:Resource type:Action, for example, vpc:ports:create.

    Service name: indicates the product name, such as ecs, evs, or vpc. Only lowercase letters are allowed.

    Resource type and Action: The values are case-insensitive, and the wildcard (*) is allowed. A wildcard (*) can represent all or part of information about resource types and actions for the specific service.

  • Sample request
    curl -i -k -H 'Accept:application/json' -H 'Content-Type:application/json;charset=utf8' -H "X-Auth-Token:$token" -X PATCH -d'{"role":{"display_name":"Customed ECS Viewer","policy":{"Version":"1.1","Statement":[{"Action":["ecs:*:get*","ecs:*:list*","ecs:blockDevice:use","ecs:serverGroups:manage","ecs:serverVolumes:use","evs:*:get*","evs:*:list*","vpc:*:get*","vpc:*:list*","ims:*:get*","ims:*:list*"],"Effect":"Allow"}]},"type":"XA","description":"The read-only permissions to all ECS resources,which can be used for statistics ands urvey."}}' https://172.30.48.86:31943/v3.0/OS-ROLE/roles/9698542758bc422088c0c3eabfc30d12

Response

  • Response body parameter description

    Parameter

    Mandatory

    Type

    Description

    role

    Yes

    Dict

    Details of the role.

  • Description for the role format

    Parameter

    Mandatory

    Type

    Description

    domain_id

    Yes

    String

    ID of the domain to which a role belongs.

    id

    Yes

    String

    ID of a role.

    links

    Yes

    Dict

    Resource links of a role.

    name

    Yes

    String

    Name of a role.

    type

    Yes

    String

    Display mode of a role.

    • AX: A role is displayed at the domain layer.
    • XA: A role is displayed at the project layer.

    display_name

    No

    String

    Displayed name of a role.

    catalog

    No

    String

    Directory where a role locates.

    policy

    No

    Dict

    Policy of a role.

    description

    No

    String

    Description of a role.

  • Sample response (successful response)
    {
      "role": {
          "domain_id": "9698542758bc422088c0c3eabfc30d12",
          "id": "24e7a89bffe443979760c4e9715c13a5",
          "links": {
            "self": "www.example.com/v3/roles/9698542758bc422088c0c3eabfc30d12"
          },
          "name": "custom_9698542758bc422088c0c3eabfc30d12_0",
          "type": "XA",
          "display_name": "Customed ECS Viewer",
          "catalog": "CUSTOMED",
          "policy": {
            "Version": "1.1",
            "Statement": [
              {
                "Action": [
                  "ecs:*:get*",
                  "ecs:*:list*",
                  "ecs:blockDevice:use",
                  "ecs:serverGroups:manage",
                  "ecs:serverVolumes:use",
                  "evs:*:get*",
                  "evs:*:list*",
                  "vpc:*:get*",
                  "vpc:*:list*",
                  "ims:*:get*",
                  "ims:*:list*"
                ],
                "Effect": "Allow"
              }
            ]
          },
          "description": "The read-only permissions to all ECS resources, which can be used for statistics and survey."
        }
    }
  • Error response body parameter description

    Parameter

    Mandatory

    Type

    Description

    error

    Yes

    Dict

    Response error

    message

    Yes

    String

    Error details

    code

    Yes

    Int

    Status code

    title

    Yes

    String

    Error type

  • Sample response (failed response)
{
    "error": {
        "message": "The request you have made requires authentication.",
        "code": 401,
        "title": "Unauthorized"
    }
}

Status Codes

Status Code

Description

200

The request is successful.

400

The server failed to process the request.

401

You must enter a username and password to access the requested page.

403

You are forbidden to access the requested page.

500

Failed to complete the request because of an internal service error.