Create and manage user accounts, user groups, roles, events, vaults, cards, and volumes on IBM® Cloud Pak for Data by using the Cloud Pak for Data REST API. Introduction As an administrator, you are responsible for determining and implementing the best approach for authenticating and managing the Cloud Pak for Data platform. You can perform the following tasks by using the Cloud Pak for Data REST API: Manage user and user group permissions : A Cloud Pak for Data administrator can create and manage roles, which grant permissions to users and groups on the platform. : A user can have multiple roles. The roles can be assigned directly to a user or can be assigned to the user through a user group. If a user has multiple roles, the user has all of the permissions from all of the roles that are assigned to them. : User groups make it easier to manage many users with similar access requirements. For example, if you know that 20 different users are going to collaborate on a project and they all need the Data steward role, you can add them to a group that is assigned the Data steward role. If a member of the group leaves the company, you can remove the user from the group, rather than look for and update all of the assets that the user has access to. Create and manage user profiles : Authenticated users can perform tasks such as updating their own user-profile information, generating an API key, or changing their password. : A Cloud Pak for Data administrator with the administrator or manageusers permissions can also create, update, or delete user-profiles. Manage service instances : A Cloud Pak for Data administrator with the Create service instances permission can create, retrieve, and delete service instances. Configure monitors and alerts : A Cloud Pak for Data administrator can browse generated events and configure monitors and alerts. Create custom cards for the home page : Administrators can create custom cards to display key performance indicators on the Cloud Pak® for Data home page. Manage secrets and vaults : Authenticated users can safeguard credentials and secrets with access control and audit logging by using vaults. Manage persistent volume instances : Administrators with the Create service instances permission can create and manage persistent volume instances on your existing Cloud Pak® for Data storage devices. Authentication <-- -- To authenticate to the API, pass an access token or platform API key token in an Authorization header. Using Authorization: ZenApiKey token With a platform API key, you can access everything that you would typically be able to access when you log in to the Cloud Pak for Data web client. To generate a platform API key through the user experience: 1. Log in to the web client. 2. From the toolbar, click your avatar. 3. Click Profile and settings. 4. Click API key Generate new key. 5. Click Generate. 6. Click Copy and save your key somewhere safe. You cannot recover this key if you lose it. Alternatively, you can call the Generate API keyhttps://cloud.ibm.com/apidocs/cloud-pak-data/cloud-pak-data-5.0.0getapikey method. Note: this method must be called with bearer access token authorization. When you get the API Key from the user experience or from the generate API Key method, you must Base64 encode Method Path Summary POST /icp4d-api/v1/authorize Get authorization token GET /usermgmt/v1/usermgmt/config Get configuration info PUT /usermgmt/v1/usermgmt/config Update configuration POST /usermgmt/v1/preauth/validateConfig Test LDAP configuration GET /usermgmt/v1/usermgmt/users Get users GET /usermgmt/v1/usermgmt/user/{uid} Get user by ID POST /usermgmt/v1/user Grant access to user GET /usermgmt/v1/users Get users by ID POST /usermgmt/v1/user/bulk Grant access to multiple users GET /usermgmt/v1/user/currentUserInfo Get current user info GET /usermgmt/v1/user/tokenExpiry Get current user's token expiry GET /usermgmt/v1/user/{username} Get user by name PUT /usermgmt/v1/user/{username} Update user DELETE /usermgmt/v1/user/{username} Delete user POST /usermgmt/v1/user/renewToken Renew token GET /usermgmt/v1/user/apiKey Generate API key DELETE /usermgmt/v1/user/apiKey Revoke API key GET /usermgmt/v1/usermgmt/logout Log out POST /usermgmt/v1/user/changemypassword Change logged in user's password POST /usermgmt/v1/user/changeuserpassword Change a user's password PUT /usermgmt/v2/own_profile Update current user profile GET /usermgmt/v2/groups Get user groups POST /usermgmt/v2/groups Create user group PATCH /usermgmt/v2/groups/{group_id} Update user group DELETE /usermgmt/v2/groups/{group_id} Delete user group GET /usermgmt/v2/groups/{group_id}/members Get group members POST /usermgmt/v2/groups/{group_id}/members Add members to a group DELETE /usermgmt/v2/groups/{group_id}/members/{uid} Delete group member GET /usermgmt/v2/groups/{group_id}/membership_rules Get group membership rules PUT /usermgmt/v2/groups/membership_rules/{rule_id} Update membership rule DELETE /usermgmt/v2/groups/membership_rules/{rule_id} Delete membership rule POST /usermgmt/v2/ldap/users Get LDAP users POST /usermgmt/v2/ldap/groups Get LDAP groups GET /usermgmt/v1/roles Get all roles POST /usermgmt/v1/role Add new role PUT /usermgmt/v1/role/{id} Update role record DELETE /usermgmt/v1/role/{id} Delete role record GET /usermgmt/v2/attributes Get attributes POST /zen-data/v2/serviceInstance/token Generate a token POST /zen-data/v2/serviceInstance/users Give access to an instance for one or more users DELETE /zen-data/v2/serviceInstance/users Revoke access to an instance GET /zen-data/v2/serviceInstance/users Get a list of users with access to an instance PATCH /zen-data/v2/serviceInstance/users/role Change a user's role on an instance POST /zen-data/v3/service_instances Create a service instance GET /zen-data/v3/service_instances Get a service instance collection GET /zen-data/v3/service_instances/{instance_id} Get service instance details DELETE /zen-data/v3/service_instances/{instance_id} Delete a service instance GET /zen-data/v3/service_instances/statuses Get the status of service instances PUT /zen-data/v3/service_instances/upgrade Upgrade a service instance GET /zen-watchdog/v1/monitoring/events View all events POST /zen-watchdog/v1/monitoring/events/prune Delete monitoring events POST /zen-watchdog/v3/metrics/prune Delete metrics records PATCH /zen-watchdog/v1/monitoring/config/smtp Configure email recipients GET /zen-watchdog/v1/monitoring/getAlertedEvents View alerted events PATCH /zen-watchdog/v1/monitoring/config/eventType Configure event type PATCH /zen-watchdog/v1/monitoring/config/alertType Configure alert rules GET /zen-watchdog/v1/monitoring/config/snmp Get SNMP configuration POST /zen-watchdog/v1/monitoring/config/snmp Configure SNMP GET /zen-watchdog/v1/monitoring/config/slack Get Slack configuration POST /zen-watchdog/v1/monitoring/config/slack Configure Slack GET /zen-data/v1/extensions Get a list of monitors, profiles, or alert types GET /zen-data/v1/custom_cards Get a list of custom cards PUT /zen-data/v1/custom_cards/{key} Create or replace a custom card PATCH /zen-data/v1/custom_cards/{key} Update an existing card DELETE /zen-data/v1/custom_cards/{key} Delete a custom card POST /zen-data/v2/vaults Store an external vault configuration GET /zen-data/v2/vaults Retrieve details about external vault integrations GET /zen-data/v2/vaults/{vault_urn} Retrieve a vault PATCH /zen-data/v2/vaults/{vault_urn} Update external vault configuration DELETE /zen-data/v2/vaults/{vault_urn} Delete external vault integration POST /zen-data/v2/vaults/{vault_urn}/transfers Initiate the transfer of ownership of a vault PATCH /zen-data/v2/vaults/{vault_urn}/transfers Transfer vault to user POST /zen-data/v2/secrets Store secret or reference GET /zen-data/v2/secrets Get a list of all secrets GET /zen-data/v2/secrets/{secret_urn} Retrieve the details for a secret PATCH /zen-data/v2/secrets/{secret_urn} Update or refresh stored secret DELETE /zen-data/v2/secrets/{secret_urn} Delete a secret from vault POST /zen-data/v2/secrets/{secret_urn}/members Share a secret GET /zen-data/v2/secrets/{secret_urn}/members Get secret members PUT /zen-data/v2/secrets/{secret_urn}/members Share or unshare a secret DELETE /zen-data/v2/secrets/{secret_urn}/members Unshare secret GET /zen-data/v2/secrets/bulk Retrieve all my secrets POST /zen-data/v1/volumes Create a volume GET /zen-data/v1/volumes Get a list of volume instances GET /zen-data/v2/persistentvolumeclaims/{namespace} Get a list of persistent volume claims by namespace cluster PATCH /zen-data/v1/volumes/{display_name} Update a volume GET /zen-data/v2/namespaces Get all namespaces POST /zen-data/v2/serviceInstance/users Give access to an instance for one or more users DELETE /zen-data/v2/serviceInstance/users Revoke access to an instance GET /zen-data/v2/serviceInstance/users Get a list of users with access to an instance PATCH /zen-data/v2/serviceInstance/users/role Change a user's role on an instance POST /zen-data/v1/volumes/volume_services/{display_name} Start a file server with a persistent volume DELETE /zen-data/v1/volumes/volume_services/{display_name} Stop a file server on a volume GET /zen-volumes/v1/monitor Monitor a file server PUT /zen-volumes/v1/volumes/files/{file_path} Upload file to the volume GET /zen-volumes/v1/volumes/files/{file_path} Download a file from a volume DELETE /zen-volumes/v1/volumes/files/{file_path} Delete a directory or file on a volume PUT /zen-volumes/v1/volumes/objects/copy Copy, move, or rename a file or directory in a volume GET /zen-volumes/v1/volumes/directories/{directory_path} Get a list of the directories and files on a volume