• Native OpenStack API

noa
  1. Help Center
  2. Native OpenStack API
  3. API Reference
  4. Keystone
  5. Custom Role Management
  6. Querying a Custom Role List

Querying a Custom Role List

Function Description

This interface is used to query a custom role list, including the permission policies of a role.

URI

URI format

GET /v3.0/OS-ROLE/roles

NOTE:

You can also use GET /v3/roles?domain_id={domain_id} to query the custom role list. For details, see Querying a Role List.

Request

  • Request header parameter description

    Parameter

    Mandatory

    Type

    Description

    X-Auth-Token

    Yes

    String

    Authenticated token with the Security Administrator permission.

  • Sample request
    curl -i -k -H "X-Auth-Token:$token" -H 'Content-Type:application/json;charset=utf8' -X GET https://10.22.44.158:31943/v3.0/OS-ROLE/roles

Response

  • Response body parameter description

    Parameter

    Mandatory

    Type

    Description

    links

    Yes

    Dict

    Resource links of a role.

    roles

    Yes

    Array

    List of roles.

  • Description for the role format

    Parameter

    Mandatory

    Type

    Description

    id

    Yes

    String

    ID of a role.

    links

    Yes

    Dict

    Resource links of a role.

    display_name

    No

    String

    Displayed name of a role.

    name

    Yes

    String

    Name of a role.

    domain_id

    Yes

    String

    ID of the domain to which a role belongs.

    type

    Yes

    String

    Display mode of a role.

    • AX: A role is displayed at the domain layer.
    • XA: A role is displayed at the project layer.
      NOTE:

      The display mode of a role can only be AX or XA. A role cannot be displayed at both the domain and project layers or neither of the two layers. That is, neither AA nor XX is allowed.

    catalog

    No

    String

    Directory where a role locates.

    policy

    No

    Dict

    Policy of a role.

    description

    No

    String

    Description of a role.

  • Description for the policy format

    Parameter

    Mandatory

    Type

    Description

    Version

    Yes

    String

    Version of a policy. The value must be 1.1.

    Statement

    Yes

    JSONArray

    Statement for using the policy to grant permissions. A policy consists of a maximum of eight statements. A Statement field contains the Effect and Action elements.

  • Description for the statement format

    Parameter

    Mandatory

    Type

    Description

    Effect

    Yes

    String

    The value can be Allow and Deny. If both Allow and Deny are found in statements, the policy evaluation starts with Deny.

    Action

    Yes

    StringArray

    Permission set, which specifies the operation permissions on resources. The number of permission sets cannot exceed 100.

    Format:

    The value format is Service name:Resource type:Action, for example, vpc:ports:create.

    Service name: indicates the product name, such as ecs, evs, or vpc. Only lowercase letters are allowed.

    Resource type and Action: The values are case-insensitive, and the wildcard (*) is allowed. A wildcard (*) can represent all or part of information about resource types and actions for the specific service.

  • Sample response (successful response)
    { 
       "links": { 
         "self": "www.example.com/v3/roles?domain_id=9698542758bc422088c0c3eabfc30d12", 
         "previous": null, 
         "next": null 
       }, 
       "roles": [ 
         { 
           "display_name": "Customed ECS Viewer", 
           "description": "The read-only permissions to all ECS resources, which can be used for statistics and survey.", 
           "links": { 
             "self": "www.example.com/v3/roles/9698542758bc422088c0c3eabfc30d12" 
           }, 
           "domain_id": "9698542758bc422088c0c3eabfc30d12", 
           "catalog": "CUSTOMED", 
           "policy": { 
             "Version": "1.1", 
             "Statement": [ 
               { 
                 "Action": [ 
                   "ecs:*:get*", 
                   "ecs:*:list*", 
                   "ecs:blockDevice:use", 
                   "ecs:serverGroups:manage", 
                   "ecs:serverVolumes:use", 
                   "evs:*:get*", 
                   "evs:*:list*", 
                   "vpc:*:get*", 
                   "vpc:*:list*", 
                   "ims:*:get*", 
                   "ims:*:list*" 
                 ], 
                 "Effect": "Allow" 
               } 
             ] 
           }, 
           "id": "24e7a89bffe443979760c4e9715c13a5", 
           "type": "XA", 
           "name": "custom_9698542758bc422088c0c3eabfc30d12_0" 
         } 
       ] 
     }
  • Error response body parameter description

    Parameter

    Mandatory

    Type

    Description

    error

    Yes

    Dict

    Response error

    message

    Yes

    String

    Error details

    code

    Yes

    Int

    Status code

    title

    Yes

    String

    Error type

  • Sample response (failed response)
    {
        "error": {
            "message": "The request you have made requires authentication.",
            "code": 401,
            "title": "Unauthorized"
        }
    }

Status Codes

Status Code

Description

200

The request is successful.

400

The server failed to process the request.

401

You must enter a username and password to access the requested page.

403

You are forbidden to access the requested page.

500

Failed to complete the request because of an internal service error.