{ "openapi": "3.0.0", "info": { "title": "IAM Access Groups", "description": "## Introduction\n\nAccess groups allow for the assignment of many policies to many members in one place. Users, service IDs and trusted profiles can be added to an access group. Each access group is bound to a specific IBM Cloud® account (as are users, service IDs and trusted profiles).\n\nNo longer do policies need to be created on a per user, service ID or trusted profile basis. Instead, a policy can be created for an access group, and that common policy is shared for all of the group's members. This makes it much easier for administrators to manage access control. It is an analogous concept to access control groups that are used to manage users in the Linux® operating system. For more information, see [Setting up access groups](https://cloud.ibm.com/docs/account?topic=account-groups).\n\nWith access group templates and assignments you can centrally manage access for child accounts in your organization from the root enterprise account. For more information, see [Working with template versions](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-working-with-versions&interface=ui) and [Best practices for assigning access in an enterprise](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-access-enterprises).\n\nSDKs for Java, Node, Python, and Go are available to make it easier to programmatically access the API from your code. The client libraries that are provided by the SDKs implement best practices for using the API and reduce the amount of code that you need to write. The tab for each language includes code examples that demonstrate how to use the client libraries. For more information about using the SDKs, see the [IBM Cloud SDK Common project](https://github.com/IBM/ibm-cloud-sdk-common) on GitHub.\n\nInstalling the Go SDK\n\nGo modules (recommended): Add the following import in your code, and then run `go build` or `go mod tidy`\n\n```go\nimport (\n\t\"github.com/IBM/platform-services-go-sdk/iamaccessgroupsv2\"\n)\n```\n\nGo get\n\n```bash\ngo get -u github.com/IBM/platform-services-go-sdk/iamaccessgroupsv2\n```\n\nView on GitHub\n\n[https://github.com/IBM/platform-services-go-sdk](https://github.com/IBM/platform-services-go-sdk)\n\nInstalling the Java SDK\n\nMaven\n\n```xml\n\n\tcom.ibm.cloud\n\tiam-access-groups\n\t{version}\n\n```\n\nGradle\n\n```bash\ncompile 'com.ibm.cloud:iam-access-groups:{version}'\n```\n\nReplace `{version}` in these examples with the release version.\n\nView on GitHub\n\n[https://github.com/IBM/platform-services-java-sdk](https://github.com/IBM/platform-services-java-sdk)\n\nInstalling the Node SDK\n\n```bash\nnpm install @ibm-cloud/platform-services\n```\n\nView on GitHub\n\n[https://github.com/IBM/platform-services-node-sdk](https://github.com/IBM/platform-services-node-sdk)\n\nInstalling the Python SDK\n\n```bash\npip install --upgrade \"ibm-platform-services\"\n```\n\nView on GitHub\n\n[https://github.com/IBM/platform-services-python-sdk](https://github.com/IBM/platform-services-python-sdk)\n\n## Endpoint URLs\n\nThe IAM Access Groups API uses the following public global endpoint URL. When you call the API, add the path for each method to form the complete API endpoint for your requests.\n\n```bash \nhttps://iam.cloud.ibm.com\n```\n\nIf you enabled service endpoints in your account, you can send API requests over the IBM Cloud private network at the following base endpoint URLs. For more information, see [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint).\n\n* Private endpoint URL for VPC infrastructure: `https://private.iam.cloud.ibm.com`\n* Private endpoint URLs for classic infrastructure:\n * Sydney: `https://private.au-syd.iam.cloud.ibm.com`\n * Sao Paulo: `https://private.br-sao.iam.cloud.ibm.com`\n * Montreal: `https://private.ca-mon.iam.cloud.ibm.com`\n * Toronto: `https://private.ca-tor.iam.cloud.ibm.com`\n * Frankfurt DC: `https://private.eu-de.iam.cloud.ibm.com`\n * London: `https://private.eu-gb.iam.cloud.ibm.com`\n * Madrid: `https://private.eu-es.iam.cloud.ibm.com`\n * Tokyo: `https://private.jp-tok.iam.cloud.ibm.com`\n * Osaka: `https://private.jp-osa.iam.cloud.ibm.com`\n * Washington DC: `https://private.us-east.iam.cloud.ibm.com`\n * Dallas: `https://private.us-south.iam.cloud.ibm.com`\n\nExample API request\n\n```bash\ncurl -X {request_method} \"https://private.iam.cloud.ibm.com/v2/{method_endpoint}\"\n```\n\nReplace `{request_method}` and `{method_endpoint}` in the example with the values for your particular API call. \n\n## Authentication\n\nAuthorization to the Access Groups REST API is enforced by using an IBM Cloud Identity and Access Management (IAM) access token. The token is used to determine the actions that a user or service ID has access to when they use the API. \n\nObtaining an IAM token for an authenticated user or service ID is described in the [IAM Identity Services API](https://cloud.ibm.com/apidocs/iam-identity-token-api) documentation. \n\nTo use the API, add a valid IAM token to the HTTP Authorization request header, for example, `-H 'Authorization: Bearer '`.\n\nWhen you use the SDK, configure an IAM authenticator with the IAM API key. The authenticator automatically obtains the IAM access token for the API key and includes it with each request. You can construct an authenticator in either of two ways:\n- Programmatically by constructing an IAM authenticator instance and supplying your IAM API key \n- By defining the API key in external configuration properties and then using the SDK authenticator factory to construct an IAM authenticator that uses the configured IAM API key\n\nIn this example of using external configuration properties, an IAM authenticator instance is created with the configured API key, and then the service client is constructed with this authenticator instance and the configured service URL.\n\nFor more information, see the Authentication section of the [IBM Cloud SDK Common](https://github.com/IBM/ibm-cloud-sdk-common/blob/main/README.md) documentation.\n\nAn IAM Administrator or Editor role on the Access Groups account management service is required to create groups. However, when a group is created, an IAM Administrator or Editor role on the group can be assigned by using an [access policy](https://cloud.ibm.com/apidocs/iam-policy-management) that targets the specific group. An Administrator or Editor of the group can update and delete the group, and add, update, and delete members or rules for the group. A user with Viewer role on the Access Groups service can retrieve and list groups, members, and rules.\n\nTo call each method, you'll need to be assigned a role that includes the required IAM actions. Each method lists the associated action. For more information about IAM actions and how they map to roles, see [Assigning access to account management services](https://cloud.ibm.com/docs/account?topic=account-account-services).\n\nTo retrieve your access token:\n\n```bash\ncurl -X POST \\\n \"https://iam.cloud.ibm.com/identity/token\" \\\n --header 'Content-Type: application/x-www-form-urlencoded' \\\n --header 'Accept: application/json' \\\n --data-urlencode 'grant_type=urn:ibm:params:oauth:grant-type:apikey' \\\n --data-urlencode 'apikey='\n```\n\nReplace `` with your IAM API key.\n\nSetting client options through external configuration\n\nExample environment variables, where `` is your IAM API key\n```sh\nexport IAM_ACCESS_GROUPS_APIKEY=\n```\n\nExample of constructing the service client\n```go\nimport {\n \"github.com/IBM/platform-services-go-sdk/iamaccessgroupsv2\"\n}\n...\niamAccessGroupsServiceOptions := &iamaccessgroupsv2.IamAccessGroupsV2Options{}\n\niamAccessGroupsService, err := iamaccessgroupsv2.NewIamAccessGroupsV2UsingExternalConfig(iamAccessGroupsServiceOptions)\n```\n\nSetting client options through external configuration\n\nExample environment variables, where `` is your IAM API key\n```sh\nexport IAM_ACCESS_GROUPS_APIKEY=\n```\n\nExample of constructing the service client\n```java\nimport com.ibm.cloud.platform_services.iam_access_groups.v2.IamAccessGroups;\n...\nIamAccessGroups iamAccessGroupsService = IamAccessGroups.newInstance();\n```\n\nSetting client options through external configuration\n\nExample environment variables, where `` is your IAM API key\n```sh\nexport IAM_ACCESS_GROUPS_APIKEY=\n```\n\nExample of constructing the service client\n```javascript\nconst IamAccessGroupsV2 = require('@ibm-cloud/platform-services/iam-access-groups/v2');\n...\nconst iamAccessGroupsService = IamAccessGroupsV2.newInstance({});\n```\n\nSetting client options through external configuration\n\nExample environment variables, where `` is your IAM API key\n```sh\nexport IAM_ACCESS_GROUPS_APIKEY=\n```\n\nExample of constructing the service client\n```python\nfrom ibm_platform_services import IamAccessGroupsV2\n...\niam_access_groups_service = IamAccessGroupsV2.new_instance()\n```\n\n## Auditing\n\nYou can monitor API activity within your account by using the IBM Cloud Logs service. Whenever an API method is called, an event is generated that you can then track and audit from within IBM Cloud Logs. The specific event type is listed for each individual method.\n\nFor more information about how to track Identity and Access Management activity, see [Activity tracking events for IAM](https://cloud.ibm.com/docs/account?topic=account-at_events_iam).\n\n## Error handling\n\nThe Access Groups REST APIs return standard HTTP status codes to indicate the success or failure of a request. The format of the response is represented in JSON as follows:\n```json\n{\n \"trace\": \"9daee671-916a-4678-850b-10b911f0236d\",\n \"errors\": [\n {\n \"code\": \"invalid_access_token\",\n \"message\": \"The provided access token provided is invalid.\"\n }\n ]\n \"status_code\": 401\n}\n```\nIf an operation cannot be fulfilled, an appropriate 400 or 500 series HTTP response is returned from the server. The operations that are defined in the `Reference` section describe example errors that might be returned from a failed request. All responses from the Access Groups REST API are in JSON format.\n\nThe following table described the potential error codes the API might return.\n\n| HTTP Error Code | Description | Recovery |\n|-----------------|-------------|----------|\n| `200` | Success | The request was successful. |\n| `201` | Created | The resource was successfully created. |\n| `204` | No Content | The request was successful. No response body is provided. |\n| `207` | Multi-Status | See the response body to determine the outcome of each request. |\n| `400` | Bad Request | The input parameters in the request body are either incomplete or in the wrong format. Be sure to include all required parameters in your request. |\n| `401` | Unauthorized | You are not authorized to make this request. The token is either missing or expired. Get a new valid token and try again. |\n| `403` | Forbidden | The supplied authentication is not authorized to perform the operation. If this error persists, contact the account owner to check your permissions. |\n| `404` | Not Found | The requested resource can't not be found. |\n| `405` | Method Not Allowed | Access Groups does not support the operation on the target resource. Some operations are not supported on particular groups such as the Public Access group. |\n| `409` | Conflict | The entity is already in the requested state. |\n| `429` | Too Many Requests | Too many requests have been made within a time window. Wait before calling the API again. |\n| `500` | Internal Server Error | Access Groups had an internal server error and could not process the request. |\n| `503` | Service Temporarily Unavailable | Access Groups or one of its internal dependent services is currently unavailable. Your request can't be processed. Wait a few minutes and try again. |\n\n## Additional headers\n\nSome additional headers might be required to make successful requests to the API.\nThose additional headers are:\n\nAn optional transaction ID can be passed to your request, which can be useful for tracking calls through multiple services using one identifier. The header key must be set to `Transaction-Id` and the value is anything that you choose.\n\nIf there is not a transaction ID that is passed in, then one is generated randomly.\n\n## Pagination\n\nSome API requests might return many results. To avoid performance issues, these results are returned one page at a time, with a limited number of results on each page. `GET` requests for the following resources use pagination:\n\n * /v2/groups\n * /v2/groups/{access_group_id}/members\n\nThe fields `first`, `previous`, `next`, and `last` are included in the collection response as needed, depending on the size of the result. For example, `previous` and `next` are not included on a page size of 1. The `href` value for these fields contains a URL reference to the appropriate collection resource.\n\nThe default page size is 50 items, and the max size is 100 items. To use a different page size, use the `limit` query parameter.\n\nThe field `offset` can be used to traverse the pages. The `offset` field specifies the number of resources to skip over given an ordered collection. If an offset is not specified, then the default behavior is to skip over 0 resources.\n\nA `total_count` field can also be included in the response, indicating how many results exist.\n\n## Sorting\n\nSorting is available on the previously mentioned paginated APIs. Using a `sort` query parameter set to the field name you want the results sorted by.\n\nTo reverse sort, add a `-` prefix to the field name.\n\nFor example, for the GET /v2/groups endpoint, a query parameter of `sort=name` sorts the returned groups in ascending alphabetical order by name. Meanwhile a query parameter of `sort=-name` returns the groups in descending alphabetical order by name.\n\n## Rate limiting\n\nRate limits for API requests are enforced on a per-caller basis. If the number of requests for a particular method and endpoint reaches the request limit within the specified time window, no further requests are accepted until the timer expires. After the timer expires, a new time window begins with the next accepted request.\n\nThe response to each HTTP request includes headers you can use to determine whether you are close to the rate limit:\n\n * `X-RateLimit-Reset`: the time the current timer expires (in UNIX® epoch time)\n * `X-RateLimit-Remaining`: the number of requests that remain in the current time window\n * `X-RateLimit-Limit`: the total number of requests allowed within the time window\n\nAn HTTP status code of `429` indicates that the rate limit has been exceeded.\n\nThe number of allowed requests, and the length of the time window, might vary by method and endpoint.\n\n## Related APIs\n\nWhen working with the Access Groups endpoints, it might be helpful to be aware of other IAM services. See Access Management to learn about policy creation and service registration. See Identity Services to learn about API keys, service IDs, and token creation.\n\n* [IAM Access Management](https://cloud.ibm.com/apidocs/iam-policy-management)\n* [IAM Identity Services](https://cloud.ibm.com/apidocs/iam-identity-token-api)", "version": "2.0", "x-alternate-name": "iam-access-groups", "x-codegen-config": { "improvedNameFormattingV2": true, "go": { "apiPackage": "github.com/IBM/platform-services-go-sdk" }, "java": { "apiPackage": "com.ibm.cloud.platform_services" }, "python": { "apiPackage": "ibm_platform_services" } }, "x-sdk-supported-languages": [ "go", "java", "node", "python" ], "x-github": "https://github.ibm.com/cloud-api-docs/iam-access-groups", "x-github-issues": "https://github.ibm.com/cloud-api-docs/iam-access-groups/issues/new", "x-last-updated": "2025-05-23" }, "tags": [ { "name": "Access group operations", "description": "Operations related to access groups." }, { "name": "Membership operations", "description": "Operations related to access group membership." }, { "name": "Rule operations", "description": "Operations related to access group rules." }, { "name": "Account settings", "description": "Operations related to account settings." }, { "name": "Template operations", "description": "Operations related to enterprise-managed access group templates." }, { "name": "Template assignment operations", "description": "Operations related to enterprise-managed access group template assignments." } ], "paths": { "/v2/groups": { "post": { "operationId": "create_access_group", "summary": "Create an access group", "description": "Create a new access group to assign multiple users and service ids to multiple policies. The group will be created in the account specified by the `account_id` parameter. The group name is a required field, but a description is optional. Because the group's name does not have to be unique, it is possible to create multiple groups with the same name.", "tags": [ "Access group operations" ], "parameters": [ { "$ref": "#/components/parameters/AccountIdParam" }, { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateGroupRequest" }, "example": { "name": "Managers", "description": "Group for managers" } } }, "description": "The access group to create.", "required": true }, "x-codegen-request-body-name": "group", "x-ibm-permissions": { "actions": [ { "name": "iam-groups.groups.create" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group.create" } ] }, "responses": { "201": { "description": "Group Created.", "headers": { "Location": { "description": "Path to the created group resource", "schema": { "type": "string" } }, "ETag": { "description": "The revision number of the group", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Group" }, "examples": { "response": { "value": { "id": "AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2", "name": "Awesome Developers", "description": "Group for awesome developers", "account_id": "c56eec94cb5793b8da0eb7790759aaf0", "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS" } } } } }, "links": { "AccessGroupId": { "$ref": "#/components/links/AccessGroupId" } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "invalid_payload", "message": "Payload contains invalid/missing data." } ], "status_code": 400 } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "409": { "description": "Group Name Conflicted.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "group_conflict_error", "message": "An access group with the name already exists. Enter a different name." } ], "status_code": 409 } } } } } }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X POST --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " --header \"Content-Type: application/json\" \\\n", " --data '{ \"name\": \"Managers\", \"description\": \"Group for managers\" }' \\\n", " \"{base_url}/v2/groups?account_id={account_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "createAccessGroupOptions := iamAccessGroupsService.NewCreateAccessGroupOptions(\n", " testAccountID,\n", " \"Managers\",\n", ")\n", "createAccessGroupOptions.SetDescription(\"Group for managers\")\n", "\n", "group, response, err := iamAccessGroupsService.CreateAccessGroup(createAccessGroupOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(group, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "CreateAccessGroupOptions createAccessGroupOptions = new CreateAccessGroupOptions.Builder()\n", " .accountId(testAccountId)\n", " .name(\"Managers\")\n", " .description(\"Group for managers\")\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.createAccessGroup(createAccessGroupOptions).execute();\n", "Group group = response.getResult();\n", "\n", "System.out.println(group);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accountId: testAccountId,\n", " name: 'Managers',\n", " description: 'Group for managers'\n", "};\n", "\n", "try {\n", " const res = await iamAccessGroupsService.createAccessGroup(params);\n", " testGroupId = res.result.id;\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.create_access_group(\n", " account_id=test_account_id,\n", " name='Managers',\n", " description='Group for managers',\n", ")\n", "group = response.get_result()\n", "\n", "print(json.dumps(group, indent=2))" ] } ] } ] } } }, "get": { "operationId": "list_access_groups", "summary": "List access groups", "description": "This API lists access groups within an account. Parameters for pagination and sorting can be used to filter the results. The `account_id` query parameter determines which account to retrieve groups from. Only the groups you have access to are returned (either because of a policy on a specific group or account level access (admin, editor, or viewer)). There may be more groups in the account that aren't shown if you lack the aforementioned permissions.", "tags": [ "Access group operations" ], "parameters": [ { "$ref": "#/components/parameters/AccountIdParam" }, { "$ref": "#/components/parameters/TransactionIdHeaderParam" }, { "description": "Return groups for member ID (IBMid, service ID or trusted profile ID).", "name": "iam_id", "in": "query", "schema": { "type": "string" } }, { "description": "Use search to filter access groups list by id, name or description.\n* `search=id:` - To list access groups by id\n* `search=name:` - To list access groups by name\n* `search=description:` - To list access groups by description", "in": "query", "name": "search", "schema": { "type": "string" } }, { "description": "Membership type need to be specified along with iam_id and must be either `static`, `dynamic` or `all`. If membership type is `static`, members explicitly added to the group will be shown. If membership type is `dynamic`, members accessing the access group at the moment via dynamic rules will be shown. If membership type is `all`, both static and dynamic members will be shown.", "name": "membership_type", "in": "query", "schema": { "type": "string", "default": "static" } }, { "description": "Return up to this limit of results where limit is between 0 and 100.", "name": "limit", "in": "query", "schema": { "type": "integer", "default": 50, "maximum": 100 } }, { "description": "The offset of the first result item to be returned.", "name": "offset", "in": "query", "schema": { "type": "integer", "default": 0 } }, { "description": "Sort the results by id, name, description, or is_federated flag.", "name": "sort", "in": "query", "schema": { "type": "string", "default": "name" } }, { "name": "show_federated", "in": "query", "description": "If show_federated is true, each group listed will return an is_federated value that is set to true if rules exist for the group.", "schema": { "type": "boolean", "default": false } }, { "name": "hide_public_access", "in": "query", "description": "If hide_public_access is true, do not include the Public Access Group in the results.", "schema": { "type": "boolean", "default": false } }, { "name": "show_crn", "in": "query", "description": "If show_crn is true, group CRN will be included in the response.", "schema": { "type": "boolean", "default": false } } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.groups.list" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.groups.list" } ] }, "responses": { "200": { "description": "Success.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GroupsList" }, "examples": { "response": { "value": { "limit": 5, "offset": 0, "total_count": 20, "first": { "href": "https://iam.cloud.ibm.com/v2/groups?limit=5&account_id=c56eec94cb5793b8da0eb7790759aaf0&show_federated=true" }, "next": { "href": "https://iam.cloud.ibm.com/v2/groups?offset=5&limit=5&account_id=c56eec94cb5793b8da0eb7790759aaf0&show_federated=true" }, "last": { "href": "https://iam.cloud.ibm.com/v2/groups?offset=15&limit=5&account_id=c56eec94cb5793b8da0eb7790759aaf0&show_federated=true" }, "groups": [ { "id": "AccessGroupId-PublicAccess", "name": "Public Access", "description": "This group includes all users and service IDs by default. All group members, including unauthenticated users, are given public access to any resources that are defined in the policies for the group.", "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS", "href": "https://iam.cloud.ibm.com/v2/groups/AccessGroupId-PublicAccess", "is_federated": false }, { "id": "AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2", "name": "Group 1", "description": "Group description", "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS", "href": "https://iam.cloud.ibm.com/v2/groups/AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2", "is_federated": true }, { "id": "AccessGroupId-9c6dd943-f12e-49ed-8235-5064e6aa1bf1", "name": "Group 2", "description": "Group description", "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS", "href": "https://iam.cloud.ibm.com/v2/groups/AccessGroupId-9c6dd943-f12e-49ed-8235-5064e6aa1bf1", "is_federated": true }, { "id": "AccessGroupId-f1d04900-0afd-4989-bb8d-4b58cf454f42", "name": "Group 3", "description": "Group description", "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS", "href": "https://iam.cloud.ibm.com/v2/groups/AccessGroupId-f1d04900-0afd-4989-bb8d-4b58cf454f42", "is_federated": false }, { "id": "AccessGroupId-e3051dc7-fd2a-49d5-bad7-cc7c3f815993", "name": "Group 4", "description": "Group description", "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS", "href": "https://iam.cloud.ibm.com/v2/groups/AccessGroupId-e3051dc7-fd2a-49d5-bad7-cc7c3f815993", "is_federated": false }, { "id": "AccessGroupId-3a8bd26a-c7cf-4756-90ba-85f185406bdb", "name": "Group 5", "description": "Group description", "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS", "href": "https://iam.cloud.ibm.com/v2/groups/AccessGroupId-3a8bd26a-c7cf-4756-90ba-85f185406bdb", "is_federated": false } ] } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X GET --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " \"{base_url}/v2/groups?account_id={account_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "listAccessGroupsOptions := &iamaccessgroupsv2.ListAccessGroupsOptions{\n", " AccountID: &testAccountID,\n", "}\n", "\n", "pager, err := iamAccessGroupsService.NewAccessGroupsPager(listAccessGroupsOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "\n", "var allResults []iamaccessgroupsv2.Group\n", "for pager.HasNext() {\n", " nextPage, err := pager.GetNext()\n", " if err != nil {\n", " panic(err)\n", " }\n", " allResults = append(allResults, nextPage...)\n", "}\n", "b, _ := json.MarshalIndent(allResults, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "ListAccessGroupsOptions listAccessGroupsOptions = new ListAccessGroupsOptions.Builder()\n", " .accountId(testAccountId)\n", " .build();\n", "\n", "AccessGroupsPager pager = new AccessGroupsPager(iamAccessGroupsService, listAccessGroupsOptions);\n", "List allResults = new ArrayList<>();\n", "while (pager.hasNext()) {\n", " List nextPage = pager.getNext();\n", " allResults.addAll(nextPage);\n", "}\n", "\n", "System.out.println(GsonSingleton.getGson().toJson(allResults));" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accountId: testAccountId,\n", "};\n", "\n", "const allResults = [];\n", "try {\n", " const pager = new IamAccessGroupsV2.AccessGroupsPager(iamAccessGroupsService, params);\n", " while (pager.hasNext()) {\n", " const nextPage = await pager.getNext();\n", " expect(nextPage).not.toBeNull();\n", " allResults.push(...nextPage);\n", " }\n", " console.log(JSON.stringify(allResults, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "all_results = []\n", "pager = AccessGroupsPager(\n", " client=iam_access_groups_service,\n", " account_id=test_account_id,\n", ")\n", "while pager.has_next():\n", " next_page = pager.get_next()\n", " assert next_page is not None\n", " all_results.extend(next_page)\n", "\n", "print(json.dumps(all_results, indent=2))" ] } ] } ] } } } }, "/v2/groups/{access_group_id}": { "parameters": [ { "$ref": "#/components/parameters/AccessGroupIdParam" } ], "get": { "summary": "Get an access group", "description": "Retrieve an access group by its `access_group_id`. Only the groups data is returned (group name, description, account_id, ...), not membership or rule information. A revision number is returned in the `ETag` header, which is needed when updating the access group.", "tags": [ "Access group operations" ], "operationId": "get_access_group", "parameters": [ { "$ref": "#/components/parameters/TransactionIdHeaderParam" }, { "name": "show_federated", "in": "query", "description": "If show_federated is true, the group will return an is_federated value that is set to true if rules exist for the group.", "schema": { "type": "boolean", "default": false } }, { "name": "show_crn", "in": "query", "description": "If show_crn is true, group CRN will be included in the response.", "schema": { "type": "boolean", "default": false } } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.groups.read" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group.read" } ] }, "responses": { "200": { "description": "Get Successful.", "headers": { "ETag": { "description": "The revision number needed to update the group.", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Group" }, "examples": { "response": { "value": { "id": "AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2", "name": "Awesome Developers", "description": "Group for awesome developers", "account_id": "c56eec94cb5793b8da0eb7790759aaf0", "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS", "is_federated": true } } } } }, "links": { "AccessGroupETag": { "$ref": "#/components/links/AccessGroupETag" } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/GroupNotFound" }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X GET --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " \"{base_url}/v2/groups/{access_group_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "getAccessGroupOptions := iamAccessGroupsService.NewGetAccessGroupOptions(\n", " accessGroupIDLink,\n", ")\n", "\n", "group, response, err := iamAccessGroupsService.GetAccessGroup(getAccessGroupOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(group, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "GetAccessGroupOptions getAccessGroupOptions = new GetAccessGroupOptions.Builder()\n", " .accessGroupId(testGroupId)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.getAccessGroup(getAccessGroupOptions).execute();\n", "Group group = response.getResult();\n", "\n", "System.out.println(group);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accessGroupId: testGroupId,\n", "};\n", "\n", "try {\n", " const res = await iamAccessGroupsService.getAccessGroup(params);\n", " testGroupETag = res.headers['etag'];\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.get_access_group(\n", " access_group_id=test_group_id,\n", ")\n", "group = response.get_result()\n", "\n", "print(json.dumps(group, indent=2))" ] } ] } ] } } }, "patch": { "summary": "Update an access group", "description": "Update the group name or description of an existing access group using this API. An `If-Match` header must be populated with the group's most recent revision number (which can be acquired in the `Get an access group` API).", "tags": [ "Access group operations" ], "operationId": "update_access_group", "parameters": [ { "description": "The current revision number of the group being updated. This can be found in the Create/Get access group response ETag header.", "name": "If-Match", "in": "header", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateGroupRequest" }, "example": { "name": "Awesome Managers", "description": "Group for awesome managers." } } }, "description": "The access group to update.", "required": true }, "x-codegen-request-body-name": "group", "x-ibm-permissions": { "actions": [ { "name": "iam-groups.groups.update" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group.update" } ] }, "responses": { "200": { "description": "Group Updated.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Group" }, "examples": { "response": { "value": { "id": "AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2", "name": "SUPER Awesome Developers", "description": "Group for SUPER awesome developers.", "account_id": "c56eec94cb5793b8da0eb7790759aaf0", "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS" } } } } } }, "400": { "description": "Bad Request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "invalid_payload", "message": "Payload contains invalid/missing data." } ], "status_code": 400 } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/GroupNotFound" }, "405": { "description": "Method Not Allowed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "method_not_allowed_for_group", "message": "Cannot update group for: AccessGroupId-PublicAccess" } ], "status_code": 405 } } } } } }, "409": { "description": "Group Name Conflicted.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "group_conflict_error", "message": "An access group with the name already exists. Enter a different name." } ], "status_code": 409 } } } } } }, "412": { "description": "Precondition Failed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "incorrect_etag", "message": "If-Match header contains incorrect/invalid etag." } ], "status_code": 412 } } } } } }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X PATCH --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " --header \"If-Match: accessGroupETagLink\" \\\n", " --header \"Content-Type: application/json\" \\\n", " --data '{ \"name\": \"Awesome Managers\", \"description\": \"Group for awesome managers.\" }' \\\n", " \"{base_url}/v2/groups/{access_group_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "updateAccessGroupOptions := iamAccessGroupsService.NewUpdateAccessGroupOptions(\n", " accessGroupIDLink,\n", " accessGroupETagLink,\n", ")\n", "updateAccessGroupOptions.SetName(\"Awesome Managers\")\n", "updateAccessGroupOptions.SetDescription(\"Group for awesome managers.\")\n", "\n", "group, response, err := iamAccessGroupsService.UpdateAccessGroup(updateAccessGroupOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(group, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "UpdateAccessGroupOptions updateAccessGroupOptions = new UpdateAccessGroupOptions.Builder()\n", " .accessGroupId(testGroupId)\n", " .ifMatch(testGroupETag)\n", " .name(\"Awesome Managers\")\n", " .description(\"Group for awesome managers\")\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.updateAccessGroup(updateAccessGroupOptions).execute();\n", "Group group = response.getResult();\n", "\n", "System.out.println(group);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accessGroupId: testGroupId,\n", " ifMatch: testGroupETag,\n", " name: 'Awesome Managers',\n", " description: 'Group for awesome managers'\n", "};\n", "\n", "try {\n", " const res = await iamAccessGroupsService.updateAccessGroup(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.update_access_group(\n", " access_group_id=test_group_id,\n", " if_match=access_group_e_tag_link,\n", " name='Awesome Managers',\n", " description='Group for awesome managers.',\n", ")\n", "group = response.get_result()\n", "\n", "print(json.dumps(group, indent=2))" ] } ] } ] } } }, "delete": { "summary": "Delete an access group", "description": "This API is used for deleting an access group. If the access group has no members or rules associated with it, the group and its policies will be deleted. However, if rules or members do exist, set the `force` parameter to true to delete the group as well as its associated members, rules, and policies.", "tags": [ "Access group operations" ], "operationId": "delete_access_group", "parameters": [ { "$ref": "#/components/parameters/TransactionIdHeaderParam" }, { "description": "If force is true, delete the group as well as its associated members and rules.", "name": "force", "in": "query", "schema": { "type": "boolean", "default": false } } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.groups.delete" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group.delete" } ] }, "responses": { "204": { "description": "Delete Successful." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/GroupNotFound" }, "405": { "description": "Method Not Allowed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "method_not_allowed_for_group", "message": "Cannot delete group for: AccessGroupId-PublicAccess" } ], "status_code": 405 } } } } } }, "409": { "description": "Group Not Empty.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "group_not_empty", "message": "Access group is not empty: " } ], "status_code": 409 } } } } } }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X DELETE --location --header \"Authorization: Bearer {iam_token}\" \\\n", " \"{base_url}/v2/groups/{access_group_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "deleteAccessGroupOptions := iamAccessGroupsService.NewDeleteAccessGroupOptions(\n", " accessGroupIDLink,\n", ")\n", "\n", "response, err := iamAccessGroupsService.DeleteAccessGroup(deleteAccessGroupOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "if response.StatusCode != 204 {\n", " fmt.Printf(\"\\nUnexpected response status code received from DeleteAccessGroup(): %d\\n\", response.StatusCode)\n", "}" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "DeleteAccessGroupOptions deleteAccessGroupOptions = new DeleteAccessGroupOptions.Builder()\n", " .accessGroupId(testGroupId)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.deleteAccessGroup(deleteAccessGroupOptions).execute();" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accessGroupId: testGroupId,\n", "};\n", "\n", "try {\n", " await iamAccessGroupsService.deleteAccessGroup(params);\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.delete_access_group(\n", " access_group_id=test_group_id,\n", ")" ] } ] } ] } } } }, "/v2/groups/{access_group_id}/members": { "parameters": [ { "$ref": "#/components/parameters/AccessGroupIdParam" } ], "put": { "summary": "Add members to an access group", "description": "Use this API to add users (`IBMid-...`), service IDs (`iam-ServiceId-...`) or trusted profiles (`iam-Profile-...`) to an access group. Any member added gains access to resources defined in the group's policies. To revoke a given members's access, simply remove them from the group. There is no limit to the number of members one group can have, but each `iam_id` can only be added to 50 groups. Additionally, this API request payload can add up to 50 members per call.", "tags": [ "Membership operations" ], "operationId": "add_members_to_access_group", "parameters": [ { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AddGroupMembersRequest" }, "example": { "members": [ { "iam_id": "IBMid-user1", "type": "user" }, { "iam_id": "iam-ServiceId-123", "type": "service" }, { "iam_id": "iam-Profile-123", "type": "profile" } ] } } }, "description": "List of members to add to the group. This field has a limit of 50 members.", "required": true }, "x-ibm-permissions": { "actions": [ { "name": "iam-groups.members.add" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.member.add" } ] }, "x-codegen-request-body-name": "Members", "responses": { "207": { "description": "There is a multiple status response. Please check the response body.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AddGroupMembersResponse" }, "examples": { "response": { "value": { "members": [ { "iam_id": "IBMid-06000260JS", "type": "user", "created_at": "2022-01-28T13:34:36Z", "created_by_id": "IBMid-06000260JS", "status_code": 200 }, { "iam_id": "iam-ServiceId-d5bae925-f73b-4142-8d84-a1fa3e0c7ed5", "status_code": 400, "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "error_occurred", "message": "The service id is missing or incorrect" } ] }, { "iam_id": "iam-Profile-fcb31839-9ece-4837-b5e8-c2850a35e1fa", "type": "profile", "created_at": "2022-01-28T13:34:36Z", "created_by_id": "IBMid-06000260JS", "status_code": 200 } ] } } } } } }, "400": { "description": "Bad Input (Including duplicate members in request).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "invalid_payload", "message": "Payload contains invalid/missing data." } ], "status_code": 400 } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "Not Found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "membership_not_found", "message": "Failed to find the membership" } ], "status_code": 404 } } } } } }, "405": { "description": "Method Not Allowed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "method_not_allowed_for_group", "message": "Cannot add members for: AccessGroupId-PublicAccess" } ], "status_code": 405 } } } } } }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X PUT --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " --header \"Content-Type: application/json\" \\\n", " --data '{ \"members\": [ { \"iam_id\": \"IBMid-user1\", \"type\": \"user\" }, { \"iam_id\": \"iam-ServiceId-123\", \"type\": \"service\" }, { \"iam_id\": \"iam-Profile-123\", \"type\": \"profile\" } ] }' \\\n", " \"{base_url}/v2/groups/{access_group_id}/members\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "groupMembers := []iamaccessgroupsv2.AddGroupMembersRequestMembersItem{\n", " iamaccessgroupsv2.AddGroupMembersRequestMembersItem{\n", " IamID: core.StringPtr(\"IBMid-user1\"),\n", " Type: core.StringPtr(\"user\"),\n", " },\n", " iamaccessgroupsv2.AddGroupMembersRequestMembersItem{\n", " IamID: core.StringPtr(\"iam-ServiceId-123\"),\n", " Type: core.StringPtr(\"service\"),\n", " },\n", " iamaccessgroupsv2.AddGroupMembersRequestMembersItem{\n", " IamID: core.StringPtr(testProfileID),\n", " Type: core.StringPtr(\"profile\"),\n", " },\n", "}\n", "\n", "addMembersToAccessGroupOptions := iamAccessGroupsService.NewAddMembersToAccessGroupOptions(\n", " accessGroupIDLink,\n", ")\n", "addMembersToAccessGroupOptions.SetMembers(groupMembers)\n", "\n", "addGroupMembersResponse, response, err := iamAccessGroupsService.AddMembersToAccessGroup(addMembersToAccessGroupOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(addGroupMembersResponse, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "AddGroupMembersRequestMembersItem member1 = new AddGroupMembersRequestMembersItem.Builder()\n", " .iamId(\"IBMid-user1\")\n", " .type(\"user\")\n", " .build();\n", "AddGroupMembersRequestMembersItem member2 = new AddGroupMembersRequestMembersItem.Builder()\n", " .iamId(\"iam-ServiceId-123\")\n", " .type(\"service\")\n", " .build();\n", " AddGroupMembersRequestMembersItem member3 = new AddGroupMembersRequestMembersItem.Builder()\n", " .iamId(testProfileId)\n", " .type(\"profile\")\n", " .build();\n", "AddMembersToAccessGroupOptions addMembersToAccessGroupOptions = new AddMembersToAccessGroupOptions.Builder()\n", " .accessGroupId(testGroupId)\n", " .addMembers(member1)\n", " .addMembers(member2)\n", " .addMembers(member3)\n", " .build();\n", "Response response = iamAccessGroupsService.addMembersToAccessGroup(addMembersToAccessGroupOptions).execute();\n", "AddGroupMembersResponse addGroupMembersResponse = response.getResult();\n", "\n", "System.out.println(addGroupMembersResponse);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const groupMember1 = {\n", " iam_id: 'IBMid-user1',\n", " type: 'user',\n", "};\n", "const groupMember2 = {\n", " iam_id: 'iam-ServiceId-123',\n", " type: 'service',\n", "};\n", "var groupMember3 = {\n", " iam_id: profileId,\n", " type: 'profile',\n", "}\n", "\n", "const params = {\n", " accessGroupId: testGroupId,\n", " members: [groupMember1, groupMember2, groupMember3],\n", "};\n", "\n", "try {\n", " const res = await iamAccessGroupsService.addMembersToAccessGroup(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "member1 = AddGroupMembersRequestMembersItem(iam_id='IBMid-user1', type='user')\n", "member2 = AddGroupMembersRequestMembersItem(iam_id='iam-ServiceId-123', type='service')\n", "member3 = AddGroupMembersRequestMembersItem(iam_id=test_profile_id, type='profile')\n", "members = [member1, member2, member3]\n", "\n", "response = iam_access_groups_service.add_members_to_access_group(\n", " access_group_id=test_group_id,\n", " members=members,\n", ")\n", "add_group_members_response = response.get_result()\n", "\n", "print(json.dumps(add_group_members_response, indent=2))" ] } ] } ] } } }, "get": { "summary": "List access group members", "description": "List all members of a given group using this API. Parameters for pagination and sorting can be used to filter the results. The most useful query parameter may be the `verbose` flag. If `verbose=true`, user, service ID and trusted profile names will be retrieved for each `iam_id`. If performance is a concern, leave the `verbose` parameter off so that name information does not get retrieved.", "tags": [ "Membership operations" ], "operationId": "list_access_group_members", "parameters": [ { "$ref": "#/components/parameters/TransactionIdHeaderParam" }, { "name": "membership_type", "in": "query", "description": "Filters members by membership type. Filter by `static`, `dynamic` or `all`. `static` lists the members explicitly added to the access group, and `dynamic` lists the members that are part of the access group at that time via dynamic rules. `all` lists both static and dynamic members.", "schema": { "type": "string", "default": "static" } }, { "description": "Return up to this limit of results where limit is between 0 and 100.", "name": "limit", "in": "query", "schema": { "type": "integer", "default": 50, "maximum": 100 } }, { "description": "The offset of the first result item to be returned.", "name": "offset", "in": "query", "schema": { "type": "integer", "default": 0 } }, { "description": "Filter the results by member type.", "name": "type", "in": "query", "schema": { "type": "string" } }, { "description": "Return user's email and name for each user ID or the name for each service ID or trusted profile.", "name": "verbose", "in": "query", "schema": { "type": "boolean", "default": false } }, { "description": "If verbose is true, sort the results by id, name, or email.", "name": "sort", "in": "query", "schema": { "type": "string" } } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.members.list" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.members.list" } ] }, "responses": { "200": { "description": "Success.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GroupMembersList" }, "examples": { "response": { "value": { "limit": 50, "offset": 0, "total_count": 2, "first": { "href": "https://iam.cloud.ibm.com/v2/groups/AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2/members?limit=50&verbose=true&membership_type=all" }, "last": { "href": "https://iam.cloud.ibm.com/v2/groups/AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2/members?offset=0&limit=50&verbose=true&membership_type=all" }, "members": [ { "iam_id": "IBMid-06000260JS", "type": "user", "membership_type": "static", "href": "https://iam.cloud.ibm.com/v2/groups/AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2/members/IBMid-06000260JS", "name": "John Doe", "email": "john.doe@ibm.com", "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS" }, { "iam_id": "IBMid-06000260JT", "type": "user", "membership_type": "dynamic", "href": "https://iam.cloud.ibm.com/v2/groups/AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2/members/IBMid-06000260JT", "name": "John Doe", "email": "john.doe@ibm.com", "created_at": "2019-01-01T01:01:00Z", "expires_at": "2019-01-01T02:01:00Z", "created_by_id": "IBMid-06000260JS" }, { "iam_id": "iam-ServiceId-d5bae925-f73b-4142-8d84-a1fa3e0c7ed5", "type": "service", "membership_type": "static", "href": "https://iam.cloud.ibm.com/v2/groups/AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2/members/iam-ServiceId-d5bae925-f73b-4142-8d84-a1fa3e0c7ed5", "name": "Service ID 1", "description": "This is the description of the service id.", "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS" }, { "iam_id": "iam-Profile-fcb31839-9ece-4837-b5e8-c2850a35e1fa", "type": "profile", "membership_type": "static", "href": "https://iam.cloud.ibm.com/v2/groups/AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2/members/iam-Profile-fcb31839-9ece-4837-b5e8-c2850a35e1fa", "name": "Trusted Profile 1", "description": "This is the description of the trusted profile.", "created_at": "2022-01-27T09:18:52Z", "created_by_id": "IBMid-06000260JS" } ] } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/GroupNotFound" }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X GET --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " \"{base_url}/v2/groups/{access_group_id}/members\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "listAccessGroupMembersOptions := &iamaccessgroupsv2.ListAccessGroupMembersOptions{\n", " AccessGroupID: &accessGroupIDLink,\n", "}\n", "\n", "pager, err := iamAccessGroupsService.NewAccessGroupMembersPager(listAccessGroupMembersOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "\n", "var allResults []iamaccessgroupsv2.ListGroupMembersResponseMember\n", "for pager.HasNext() {\n", " nextPage, err := pager.GetNext()\n", " if err != nil {\n", " panic(err)\n", " }\n", " allResults = append(allResults, nextPage...)\n", "}\n", "b, _ := json.MarshalIndent(allResults, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "ListAccessGroupMembersOptions listAccessGroupMembersOptions = new ListAccessGroupMembersOptions.Builder()\n", " .accessGroupId(testGroupId).build();\n", "\n", "AccessGroupMembersPager pager = new AccessGroupMembersPager(iamAccessGroupsService,\n", " listAccessGroupMembersOptions);\n", "List allResults = new ArrayList<>();\n", "while (pager.hasNext()) {\n", " List nextPage = pager.getNext();\n", " allResults.addAll(nextPage);\n", "}\n", "\n", "System.out.println(GsonSingleton.getGson().toJson(allResults));" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accessGroupId: testGroupId,\n", "};\n", "\n", "const allResults = [];\n", "try {\n", " const pager = new IamAccessGroupsV2.AccessGroupMembersPager(iamAccessGroupsService, params);\n", " while (pager.hasNext()) {\n", " const nextPage = await pager.getNext();\n", " expect(nextPage).not.toBeNull();\n", " allResults.push(...nextPage);\n", " }\n", " console.log(JSON.stringify(allResults, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "all_results = []\n", "pager = AccessGroupMembersPager(\n", " client=iam_access_groups_service,\n", " access_group_id=test_group_id,\n", ")\n", "while pager.has_next():\n", " next_page = pager.get_next()\n", " assert next_page is not None\n", " all_results.extend(next_page)\n", "\n", "print(json.dumps(all_results, indent=2))" ] } ] } ] } } } }, "/v2/groups/{access_group_id}/members/{iam_id}": { "parameters": [ { "$ref": "#/components/parameters/AccessGroupIdParam" }, { "$ref": "#/components/parameters/IAMIdParam" } ], "head": { "summary": "Check membership in an access group", "description": "This HEAD operation determines if a given `iam_id` is present in a group either explicitly or via dynamic rules. No response body is returned with this request. If the membership exists, a `204 - No Content` status code is returned. If the membership or the group does not exist, a `404 - Not Found` status code is returned.", "tags": [ "Membership operations" ], "operationId": "is_member_of_access_group", "parameters": [ { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.members.read" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.member.read" } ] }, "responses": { "204": { "description": "Membership exists." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "Membership not found." }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X HEAD --location --header \"Authorization: Bearer {iam_token}\" \\\n", " \"{base_url}/v2/groups/{access_group_id}/members/{iam_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "isMemberOfAccessGroupOptions := iamAccessGroupsService.NewIsMemberOfAccessGroupOptions(\n", " accessGroupIDLink,\n", " \"IBMid-user1\",\n", ")\n", "\n", "response, err := iamAccessGroupsService.IsMemberOfAccessGroup(isMemberOfAccessGroupOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "if response.StatusCode != 204 {\n", " fmt.Printf(\"\\nUnexpected response status code received from IsMemberOfAccessGroup(): %d\\n\", response.StatusCode)\n", "}" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "IsMemberOfAccessGroupOptions isMemberOfAccessGroupOptions = new IsMemberOfAccessGroupOptions.Builder()\n", " .accessGroupId(testGroupId)\n", " .iamId(\"IBMid-user1\")\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.isMemberOfAccessGroup(isMemberOfAccessGroupOptions).execute();" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accessGroupId: testGroupId,\n", " iamId: 'IBMid-user1',\n", "};\n", "\n", "try {\n", " await iamAccessGroupsService.isMemberOfAccessGroup(params);\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.is_member_of_access_group(\n", " access_group_id=test_group_id, iam_id='IBMid-user1'\n", ")" ] } ] } ] } } }, "delete": { "summary": "Delete member from an access group", "description": "Remove one member from a group using this API. If the operation is successful, only a `204 - No Content` response with no body is returned. However, if any error occurs, the standard error format will be returned. Dynamic member cannot be deleted using this API. Dynamic rules needs to be adjusted to delete dynamic members.", "tags": [ "Membership operations" ], "operationId": "remove_member_from_access_group", "parameters": [ { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.members.delete" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.member.delete" } ] }, "responses": { "204": { "description": "Membership deleted." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "Membership not found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "group_not_found", "message": "Failed to find the specified access group: " } ], "status_code": 404 } } } } } }, "405": { "description": "Method Not Allowed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "method_not_allowed_for_group", "message": "Cannot delete group membership for: AccessGroupId-PublicAccess" } ], "status_code": 405 } } } } } }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X DELETE --location --header \"Authorization: Bearer {iam_token}\" \\\n", " \"{base_url}/v2/groups/{access_group_id}/members/{iam_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "removeMemberFromAccessGroupOptions := iamAccessGroupsService.NewRemoveMemberFromAccessGroupOptions(\n", " accessGroupIDLink,\n", " \"IBMid-user1\",\n", ")\n", "\n", "response, err := iamAccessGroupsService.RemoveMemberFromAccessGroup(removeMemberFromAccessGroupOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "if response.StatusCode != 204 {\n", " fmt.Printf(\"\\nUnexpected response status code received from RemoveMemberFromAccessGroup(): %d\\n\", response.StatusCode)\n", "}\n", "\n", "\n", "removeMemberFromAccessGroupOptions := iamAccessGroupsService.NewRemoveMemberFromAccessGroupOptions(\n", " accessGroupIDLink,\n", " \"iam-ServiceId-123\",\n", ")\n", "\n", "response, err := iamAccessGroupsService.RemoveMemberFromAccessGroup(removeMemberFromAccessGroupOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "if response.StatusCode != 204 {\n", " fmt.Printf(\"\\nUnexpected response status code received from RemoveMemberFromAccessGroup(): %d\\n\", response.StatusCode)\n", "}\n", "\n", "\n", "removeMemberFromAccessGroupOptions := iamAccessGroupsService.NewRemoveMemberFromAccessGroupOptions(\n", " accessGroupIDLink,\n", " testProfileID,\n", ")\n", "\n", "response, err := iamAccessGroupsService.RemoveMemberFromAccessGroup(removeMemberFromAccessGroupOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "if response.StatusCode != 204 {\n", " fmt.Printf(\"\\nUnexpected response status code received from RemoveMemberFromAccessGroup(): %d\\n\", response.StatusCode)\n", "}" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "RemoveMemberFromAccessGroupOptions removeMemberFromAccessGroupOptions = new RemoveMemberFromAccessGroupOptions.Builder()\n", " .accessGroupId(testGroupId)\n", " .iamId(\"IBMid-user1\")\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.removeMemberFromAccessGroup(removeMemberFromAccessGroupOptions).execute();" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accessGroupId: testGroupId,\n", " iamId: 'IBMid-user1',\n", "};\n", "\n", "try {\n", " await iamAccessGroupsService.removeMemberFromAccessGroup(params);\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.remove_member_from_access_group(\n", " access_group_id=test_group_id,\n", " iam_id='IBMid-user1',\n", ")" ] } ] } ] } } } }, "/v2/groups/{access_group_id}/members/delete": { "parameters": [ { "$ref": "#/components/parameters/AccessGroupIdParam" } ], "post": { "summary": "Delete members from an access group", "description": "Remove multiple members from a group using this API. On a successful call, this API will always return 207. It is the caller's responsibility to iterate across the body to determine successful deletion of each member. This API request payload can delete up to 50 members per call. This API doesnt delete dynamic members accessing the access group via dynamic rules.", "tags": [ "Membership operations" ], "operationId": "remove_members_from_access_group", "parameters": [ { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteGroupBulkMembersRequest" }, "example": { "members": [ "IBMId-user1", "iam-ServiceId-123", "iam-Profile-123" ] } } }, "required": true }, "x-ibm-permissions": { "actions": [ { "name": "iam-groups.members.delete" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.member.delete" } ] }, "x-codegen-request-body-name": "members", "responses": { "207": { "description": "There is a multiple status response. Please check the response body.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteGroupBulkMembersResponse" }, "examples": { "response": { "value": { "access_group_id": "AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2", "members": [ { "iam_id": "IBMid-06000260JS", "status_code": 204 }, { "iam_id": "iam-ServiceId-d5bae925-f73b-4142-8d84-a1fa3e0c7ed5", "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "error_occurred", "message": "Failed to find the membership" } ], "status_code": 404 } ] } } } } } }, "400": { "description": "Bad Input (Including duplicate members in request).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "invalid_payload", "message": "Payload contains invalid/missing data." } ], "status_code": 400 } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X POST --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " --header \"Content-Type: application/json\" \\\n", " --data '{ \"members\": [ \"IBMId-user1\", \"iam-ServiceId-123\", \"iam-Profile-123\" ] }' \\\n", " \"{base_url}/v2/groups/{access_group_id}/members/delete\"" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "RemoveMembersFromAccessGroupOptions removeMembersFromAccessGroupOptions = new RemoveMembersFromAccessGroupOptions.Builder()\n", " .accessGroupId(testGroupId)\n", " .addMembers(\"iam-ServiceId-123\")\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.removeMembersFromAccessGroup(removeMembersFromAccessGroupOptions).execute();\n", "DeleteGroupBulkMembersResponse deleteGroupBulkMembersResponse = response.getResult();\n", "\n", "System.out.println(deleteGroupBulkMembersResponse);\n", "\n", "\n", "RemoveMembersFromAccessGroupOptions removeMembersFromAccessGroupOptions = new RemoveMembersFromAccessGroupOptions.Builder()\n", " .accessGroupId(testGroupId)\n", " .addMembers(testProfileId)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.removeMembersFromAccessGroup(removeMembersFromAccessGroupOptions).execute();\n", "DeleteGroupBulkMembersResponse deleteGroupBulkMembersResponse = response.getResult();\n", "\n", "System.out.println(deleteGroupBulkMembersResponse);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accessGroupId: testGroupId,\n", " members: ['iam-ServiceId-123']\n", "};\n", "\n", "try {\n", " const res = await iamAccessGroupsService.removeMembersFromAccessGroup(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}\n", "\n", "\n", "const params = {\n", " accessGroupId: testGroupId,\n", " members: [profileId]\n", "};\n", "\n", "try {\n", " const res = await iamAccessGroupsService.removeMembersFromAccessGroup(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.remove_members_from_access_group(\n", " access_group_id=test_group_id,\n", " members=['IBMId-user1', 'iam-ServiceId-123', test_profile_id],\n", ")\n", "delete_group_bulk_members_response = response.get_result()\n", "\n", "print(json.dumps(delete_group_bulk_members_response, indent=2))" ] } ] } ] } } } }, "/v2/groups/_allgroups/members/{iam_id}": { "delete": { "summary": "Delete member from all access groups", "description": "This API removes a given member from every group they are a member of within the specified account. By using one operation, you can revoke one member's access to all access groups in the account. If a partial failure occurs on deletion, the response will be shown in the body.", "tags": [ "Membership operations" ], "operationId": "remove_member_from_all_access_groups", "parameters": [ { "$ref": "#/components/parameters/AccountIdParam" }, { "$ref": "#/components/parameters/IAMIdParam" }, { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.members.delete" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.member.delete" } ] }, "responses": { "207": { "description": "There is a multiple status response. Please check the response body.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteFromAllGroupsResponse" }, "examples": { "response": { "value": { "iam_id": "some-member-id1", "groups": [ { "access_group_id": "AccessGroupId-4e415880-3159-4f2b-b2c3-32a53ddcbd61", "status_code": 204 }, { "access_group_id": "AccessGroupId-b0d32f56-f85c-4bf1-af37-7bbd92b1b2b3", "status_code": 409, "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "error_occurred", "message": "Cloudant document update conflict occurred" } ] } ] } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NoGroupsFound" }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X DELETE --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " \"{base_url}/v2/groups/_allgroups/members/{iam_id}?account_id={account_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "removeMemberFromAllAccessGroupsOptions := iamAccessGroupsService.NewRemoveMemberFromAllAccessGroupsOptions(\n", " testAccountID,\n", " \"IBMid-user1\",\n", ")\n", "\n", "deleteFromAllGroupsResponse, response, err := iamAccessGroupsService.RemoveMemberFromAllAccessGroups(removeMemberFromAllAccessGroupsOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(deleteFromAllGroupsResponse, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "RemoveMemberFromAllAccessGroupsOptions removeMemberFromAllAccessGroupsOptions = new RemoveMemberFromAllAccessGroupsOptions.Builder()\n", " .accountId(testAccountId)\n", " .iamId(\"IBMid-user1\")\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.removeMemberFromAllAccessGroups(removeMemberFromAllAccessGroupsOptions).execute();\n", "DeleteFromAllGroupsResponse deleteFromAllGroupsResponse = response.getResult();\n", "\n", "System.out.println(deleteFromAllGroupsResponse);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accountId: testAccountId,\n", " iamId: 'IBMid-user1',\n", "};\n", "\n", "try {\n", " const res = await iamAccessGroupsService.removeMemberFromAllAccessGroups(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.remove_member_from_all_access_groups(\n", " account_id=test_account_id, iam_id='IBMid-user1'\n", ")\n", "delete_from_all_groups_response = response.get_result()\n", "\n", "print(json.dumps(delete_from_all_groups_response, indent=2))" ] } ] } ] } } }, "put": { "summary": "Add member to multiple access groups", "description": "This API will add a member to multiple access groups in an account. The limit of how many groups that can be in the request is 50. The response is a list of results that show if adding the member to each group was successful or not.", "tags": [ "Membership operations" ], "operationId": "add_member_to_multiple_access_groups", "parameters": [ { "$ref": "#/components/parameters/AccountIdParam" }, { "$ref": "#/components/parameters/IAMIdParam" }, { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AddMembershipMultipleGroupsRequest" }, "example": { "type": "user", "groups": [ "AccessGroupId-b0d32f56-f85c-4bf1-af37-7bbd92b1b2b3" ] } } }, "description": "List of groups in the account the member should be added to.", "required": true }, "x-ibm-permissions": { "actions": [ { "name": "iam-groups.members.add" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.member.add" } ] }, "x-codegen-request-body-name": "Groups", "responses": { "207": { "description": "There is a multiple status response. Please check the response body.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AddMembershipMultipleGroupsResponse" }, "examples": { "response": { "value": { "groups": [ { "access_group_id": "AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2", "status_code": 200 }, { "access_group_id": "AccessGroupId-9c6dd943-f12e-49ed-8235-5064e6aa1bf1", "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "error_occurred", "message": "Group not found in account" } ], "status_code": 404 }, { "access_group_id": "AccessGroupId-f1d04900-0afd-4989-bb8d-4b58cf454f42", "trace": "12345678-abcd-1a2b-a1b2-1234567890ac", "errors": [ { "code": "error_occurred", "message": "Forbidden: You don't have the required access to complete this action. Contact your account owner for access" } ], "status_code": 403 } ] } } } } } }, "400": { "description": "Bad Input (Including duplicate groups in request).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "duplicate_groupid_error", "message": "A duplicate groupId entry was found for AccessGroupId-f1d04900-0afd-4989-bb8d-4b58cf454f42. Please remove any duplicate entries." } ], "status_code": 400 } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X PUT --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " --header \"Content-Type: application/json\" \\\n", " --data '{ \"type\": \"user\", \"groups\": [ \"AccessGroupId-b0d32f56-f85c-4bf1-af37-7bbd92b1b2b3\" ] }' \\\n", " \"{base_url}/v2/groups/_allgroups/members/{iam_id}?account_id={account_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "addMemberToMultipleAccessGroupsOptions := iamAccessGroupsService.NewAddMemberToMultipleAccessGroupsOptions(\n", " testAccountID,\n", " \"IBMid-user1\",\n", ")\n", "\n", "addMemberToMultipleAccessGroupsOptions.SetType(\"user\")\n", "addMemberToMultipleAccessGroupsOptions.SetGroups([]string{accessGroupIDLink})\n", "\n", "addMembershipMultipleGroupsResponse, response, err := iamAccessGroupsService.AddMemberToMultipleAccessGroups(addMemberToMultipleAccessGroupsOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(addMembershipMultipleGroupsResponse, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "AddMemberToMultipleAccessGroupsOptions addMemberToMultipleAccessGroupsOptions = new AddMemberToMultipleAccessGroupsOptions.Builder()\n", " .accountId(testAccountId)\n", " .iamId(\"IBMid-user1\")\n", " .type(\"user\")\n", " .addGroups(testGroupId)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.addMemberToMultipleAccessGroups(addMemberToMultipleAccessGroupsOptions).execute();\n", "AddMembershipMultipleGroupsResponse addMembershipMultipleGroupsResponse = response.getResult();\n", "\n", "System.out.println(addMembershipMultipleGroupsResponse);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accountId: testAccountId,\n", " iamId: 'IBMid-user1',\n", " type: 'user',\n", " groups: [testGroupId]\n", "};\n", "\n", "try {\n", " const res = await iamAccessGroupsService.addMemberToMultipleAccessGroups(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.add_member_to_multiple_access_groups(\n", " account_id=test_account_id,\n", " iam_id='IBMid-user1',\n", " type='user',\n", " groups=[test_group_id],\n", ")\n", "add_membership_multiple_groups_response = response.get_result()\n", "\n", "print(json.dumps(add_membership_multiple_groups_response, indent=2))" ] } ] } ] } } } }, "/v2/groups/{access_group_id}/rules": { "parameters": [ { "$ref": "#/components/parameters/AccessGroupIdParam" } ], "post": { "operationId": "add_access_group_rule", "summary": "Create rule for an access group", "description": "Rules can be used to dynamically add users to an access group. If a user's SAML assertions match the rule's conditions during login, the user will be dynamically added to the group. The duration of the user's access to the group is determined by the `expiration` field. After access expires, the user will need to log in again to regain access. Note that the condition's value field must be a stringified JSON value. [Consult this documentation for further explanation of dynamic rules.](/docs/account?topic=account-rules)", "tags": [ "Rule operations" ], "parameters": [ { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "requestBody": { "$ref": "#/components/requestBodies/RuleRequest" }, "x-ibm-permissions": { "actions": [ { "name": "iam-groups.rules.create" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.rule.create" } ] }, "x-codegen-request-body-name": "Rule", "responses": { "201": { "description": "Rule Created.", "headers": { "Location": { "description": "Path to the created rule resource.", "schema": { "type": "string" } }, "ETag": { "description": "The revision number of the group.", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rule" }, "examples": { "response": { "value": { "id": "ClaimRule-1396773d-366b-487d-b44e-be92238e2bb3", "name": "test rule name", "expiration": 24, "realm_name": "test-idp.com", "access_group_id": "AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2", "account_id": "c56eec94cb5793b8da0eb7790759aaf0", "conditions": [ { "claim": "cn", "operator": "EQUALS", "value": "\"Some Name\"" } ], "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS" } } } } } }, "400": { "description": "Bad Request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "BXNIM0109E", "message": "Property missing or empty" } ], "status_code": 400 } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/GroupNotFound" }, "405": { "description": "Method Not Allowed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "method_not_allowed_for_group", "message": "Cannot create rule for: AccessGroupId-PublicAccess" } ], "status_code": 405 } } } } } }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X POST --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " --header \"Content-Type: application/json\" \\\n", " --data '{ \"name\": \"Manager group rule\", \"expiration\": 12, \"realm_name\": \"https://idp.example.org/SAML2\", \"conditions\": [ { \"claim\": \"isManager\", \"operator\": \"EQUALS\", \"value\": \"true\" } ] }' \\\n", " \"{base_url}/v2/groups/{access_group_id}/rules\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "ruleConditionsModel := &iamaccessgroupsv2.RuleConditions{\n", " Claim: core.StringPtr(\"isManager\"),\n", " Operator: core.StringPtr(\"EQUALS\"),\n", " Value: core.StringPtr(\"true\"),\n", "}\n", "\n", "addAccessGroupRuleOptions := iamAccessGroupsService.NewAddAccessGroupRuleOptions(\n", " accessGroupIDLink,\n", " int64(12),\n", " \"https://idp.example.org/SAML2a\",\n", " []iamaccessgroupsv2.RuleConditions{*ruleConditionsModel},\n", ")\n", "addAccessGroupRuleOptions.SetName(\"Manager group rule\")\n", "\n", "rule, response, err := iamAccessGroupsService.AddAccessGroupRule(addAccessGroupRuleOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(rule, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "RuleConditions ruleConditionsModel = new RuleConditions.Builder()\n", " .claim(\"isManager\")\n", " .operator(\"EQUALS\")\n", " .value(\"true\")\n", " .build();\n", "AddAccessGroupRuleOptions addAccessGroupRuleOptions = new AddAccessGroupRuleOptions.Builder()\n", " .accessGroupId(testGroupId)\n", " .name(\"Manager group rule\")\n", " .expiration(12)\n", " .realmName(\"https://idp.example.org/SAML2a\")\n", " .addConditions(ruleConditionsModel)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.addAccessGroupRule(addAccessGroupRuleOptions).execute();\n", "Rule rule = response.getResult();\n", "\n", "System.out.println(rule);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accessGroupId: testGroupId,\n", " name: 'Manager group rule',\n", " expiration: 12,\n", " realmName: 'https://idp.example.org/SAML2a',\n", " conditions: [\n", " {\n", " claim: 'isManager',\n", " operator: 'EQUALS',\n", " value: 'true',\n", " },\n", " ],\n", "};\n", "\n", "try {\n", " const res = await iamAccessGroupsService.addAccessGroupRule(params);\n", " testClaimRuleId = res.result.id;\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "rule_conditions_model = {\n", " 'claim': 'isManager',\n", " 'operator': 'EQUALS',\n", " 'value': 'true',\n", "}\n", "\n", "response = iam_access_groups_service.add_access_group_rule(\n", " access_group_id=test_group_id,\n", " expiration=12,\n", " realm_name='https://idp.example.org/SAML3',\n", " conditions=[rule_conditions_model],\n", " name='Manager group rule',\n", ")\n", "rule = response.get_result()" ] } ] } ] } } }, "get": { "operationId": "list_access_group_rules", "summary": "List access group rules", "description": "This API lists all rules in a given access group. Because only a few rules are created on each group, there is no pagination or sorting support on this API.", "tags": [ "Rule operations" ], "parameters": [ { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.rules.list" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.rules.list" } ] }, "responses": { "200": { "description": "List all rules in the given access group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RulesList" }, "examples": { "response": { "value": { "rules": [ { "id": "ClaimRule-ad9aac71-49bc-457c-9588-23b60e442d23", "name": "test rule name", "expiration": 24, "realm_name": "test-idp.com", "access_group_id": "AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2", "account_id": "c56eec94cb5793b8da0eb7790759aaf0", "conditions": [ { "claim": "blueGroups", "operator": "CONTAINS", "value": "\"test-bluegroup-saml\"" } ], "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS" }, { "id": "ClaimRule-8e8e3255-c928-47d1-85e7-195b5d6a0e55", "name": "test rule name 2", "expiration": 24, "realm_name": "test-idp.com", "access_group_id": "AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2", "account_id": "c56eec94cb5793b8da0eb7790759aaf0", "conditions": [ { "claim": "blueGroups", "operator": "CONTAINS", "value": "\"test-bluegroup-saml2\"" } ], "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS" } ] } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/GroupNotFound" }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X GET --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " \"{base_url}/v2/groups/{access_group_id}/rules\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "listAccessGroupRulesOptions := iamAccessGroupsService.NewListAccessGroupRulesOptions(\n", " accessGroupIDLink,\n", ")\n", "\n", "rulesList, response, err := iamAccessGroupsService.ListAccessGroupRules(listAccessGroupRulesOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(rulesList, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "ListAccessGroupRulesOptions listAccessGroupRulesOptions = new ListAccessGroupRulesOptions.Builder()\n", " .accessGroupId(testGroupId)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.listAccessGroupRules(listAccessGroupRulesOptions).execute();\n", "RulesList rulesList = response.getResult();\n", "\n", "System.out.println(rulesList);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accessGroupId: testGroupId,\n", "};\n", "\n", "try {\n", " const res = await iamAccessGroupsService.listAccessGroupRules(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.list_access_group_rules(\n", " access_group_id=test_group_id,\n", ")\n", "rules_list = response.get_result()\n", "\n", "print(json.dumps(rules_list, indent=2))" ] } ] } ] } } } }, "/v2/groups/{access_group_id}/rules/{rule_id}": { "parameters": [ { "$ref": "#/components/parameters/AccessGroupIdParam" }, { "name": "rule_id", "in": "path", "required": true, "description": "The rule to get.", "schema": { "type": "string" } } ], "get": { "operationId": "get_access_group_rule", "summary": "Get an access group rule", "description": "Retrieve a rule from an access group. A revision number is returned in the `ETag` header, which is needed when updating the rule.", "tags": [ "Rule operations" ], "parameters": [ { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.rules.read" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.rule.read" } ] }, "responses": { "200": { "description": "Get Rule Successful.", "headers": { "ETag": { "description": "The revision number needed to update the rule.", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rule" }, "examples": { "response": { "value": { "id": "ClaimRule-8e8e3255-c928-47d1-85e7-195b5d6a0e55", "name": "test rule name", "expiration": 24, "realm_name": "test-idp.com", "access_group_id": "AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2", "account_id": "c56eec94cb5793b8da0eb7790759aaf0", "conditions": [ { "claim": "blueGroups", "operator": "CONTAINS", "value": "\"test-bluegroup-saml\"" } ], "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS" } } } } } }, "400": { "description": "Bad Request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "StatusCode": 400, "code": "BXNIM0109E", "message": "Property missing or empty" } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/RuleNotFound" }, "405": { "description": "Method Not Allowed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "method_not_allowed_for_group", "message": "Cannot get rule for: AccessGroupId-PublicAccess" } ], "status_code": 405 } } } } } }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X GET --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " \"{base_url}/v2/groups/{access_group_id}/rules/{rule_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "getAccessGroupRuleOptions := iamAccessGroupsService.NewGetAccessGroupRuleOptions(\n", " accessGroupIDLink,\n", " testClaimRuleID,\n", ")\n", "\n", "rule, response, err := iamAccessGroupsService.GetAccessGroupRule(getAccessGroupRuleOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(rule, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "GetAccessGroupRuleOptions getAccessGroupRuleOptions = new GetAccessGroupRuleOptions.Builder()\n", " .accessGroupId(testGroupId)\n", " .ruleId(testClaimRuleId)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.getAccessGroupRule(getAccessGroupRuleOptions).execute();\n", "Rule rule = response.getResult();\n", "\n", "System.out.println(rule);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accessGroupId: testGroupId,\n", " ruleId: testClaimRuleId,\n", "};\n", "\n", "try {\n", " const res = await iamAccessGroupsService.getAccessGroupRule(params);\n", " testClaimRuleETag = res.headers['etag'];\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.get_access_group_rule(\n", " access_group_id=test_group_id,\n", " rule_id=test_claim_rule_id,\n", ")\n", "rule = response.get_result()\n", "\n", "print(json.dumps(rule, indent=2))" ] } ] } ] } } }, "put": { "operationId": "replace_access_group_rule", "summary": "Replace an access group rule", "description": "Update the body of an existing rule using this API. An `If-Match` header must be populated with the rule's most recent revision number (which can be acquired in the `Get an access group rule` API).", "tags": [ "Rule operations" ], "parameters": [ { "name": "If-Match", "in": "header", "required": true, "description": "The current revision number of the rule being updated. This can be found in the Get Rule response ETag header.", "schema": { "type": "string" } }, { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "requestBody": { "$ref": "#/components/requestBodies/RuleRequest" }, "x-ibm-permissions": { "actions": [ { "name": "iam-groups.rules.update" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.rule.update" } ] }, "x-codegen-request-body-name": "Rule", "responses": { "200": { "description": "Rule Updated.", "headers": { "ETag": { "description": "The revision number of the updated rule.", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rule" }, "examples": { "response": { "value": { "id": "ClaimRule-8e8e3255-c928-47d1-85e7-195b5d6a0e55", "name": "test rule name", "expiration": 1, "realm_name": "test-idp.com", "access_group_id": "AccessGroupId-f13ac227-b856-4268-bf03-69ad24284bf2", "account_id": "c56eec94cb5793b8da0eb7790759aaf0", "conditions": [ { "claim": "blueGroups", "operator": "CONTAINS", "value": "\"test-bluegroup-saml\"" } ], "created_at": "2019-01-01T01:01:00Z", "created_by_id": "IBMid-06000260JS", "last_modified_at": "2019-06-11T13:16:00Z", "last_modified_by_id": "IBMid-06000260JS" } } } } } }, "400": { "description": "Bad Request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "BXNIM0109E", "message": "Property missing or empty" } ], "status_code": 400 } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/RuleNotFound" }, "405": { "description": "Method Not Allowed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "method_not_allowed_for_group", "message": "Cannot update rule for: AccessGroupId-PublicAccess" } ], "status_code": 405 } } } } } }, "412": { "description": "Precondition Failed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "incorrect_etag", "message": "If-Match header contains incorrect/invalid etag." } ], "status_code": 412 } } } } } }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X PUT --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " --header \"If-Match: {if_match}\" \\\n", " --header \"Content-Type: application/json\" \\\n", " --data '{ \"name\": \"Manager group rule\", \"expiration\": 12, \"realm_name\": \"https://idp.example.org/SAML2\", \"conditions\": [ { \"claim\": \"isManager\", \"operator\": \"EQUALS\", \"value\": \"true\" } ] }' \\\n", " \"{base_url}/v2/groups/{access_group_id}/rules/{rule_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "ruleConditionsModel := &iamaccessgroupsv2.RuleConditions{\n", " Claim: core.StringPtr(\"isManager\"),\n", " Operator: core.StringPtr(\"EQUALS\"),\n", " Value: core.StringPtr(\"true\"),\n", "}\n", "\n", "replaceAccessGroupRuleOptions := iamAccessGroupsService.NewReplaceAccessGroupRuleOptions(\n", " accessGroupIDLink,\n", " testClaimRuleID,\n", " testClaimRuleEtag,\n", " int64(12),\n", " \"https://idp.example.org/SAML2\",\n", " []iamaccessgroupsv2.RuleConditions{*ruleConditionsModel},\n", ")\n", "replaceAccessGroupRuleOptions.SetName(\"Manager group rule\")\n", "\n", "rule, response, err := iamAccessGroupsService.ReplaceAccessGroupRule(replaceAccessGroupRuleOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(rule, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "RuleConditions ruleConditionsModel = new RuleConditions.Builder()\n", " .claim(\"isManager\")\n", " .operator(\"EQUALS\")\n", " .value(\"true\")\n", " .build();\n", "ReplaceAccessGroupRuleOptions replaceAccessGroupRuleOptions = new ReplaceAccessGroupRuleOptions.Builder()\n", " .accessGroupId(testGroupId)\n", " .ruleId(testClaimRuleId)\n", " .ifMatch(testClaimRuleETag)\n", " .name(\"Manager group rule\")\n", " .expiration(24)\n", " .realmName(\"https://idp.example.org/SAML2\\\"\")\n", " .addConditions(ruleConditionsModel)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.replaceAccessGroupRule(replaceAccessGroupRuleOptions).execute();\n", "Rule rule = response.getResult();\n", "\n", "System.out.println(rule);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accessGroupId: testGroupId,\n", " ruleId: testClaimRuleId,\n", " ifMatch: testClaimRuleETag,\n", " name: 'Manager group rule',\n", " expiration: 24,\n", " realmName: 'https://idp.example.org/SAML2',\n", " conditions: [\n", " {\n", " claim: 'isManager',\n", " operator: 'EQUALS',\n", " value: 'true',\n", " },\n", " ]\n", "};\n", "\n", "try {\n", " const res = await iamAccessGroupsService.replaceAccessGroupRule(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "rule_conditions_model = {\n", " 'claim': 'isManager',\n", " 'operator': 'EQUALS',\n", " 'value': 'true',\n", "}\n", "\n", "response = iam_access_groups_service.replace_access_group_rule(\n", " access_group_id=test_group_id,\n", " rule_id=test_claim_rule_id,\n", " if_match=test_claim_rule_etag,\n", " expiration=12,\n", " realm_name='https://idp.example.org/SAML3',\n", " conditions=[rule_conditions_model],\n", " name='Manager group rule',\n", ")\n", "rule = response.get_result()\n", "\n", "print(json.dumps(rule, indent=2))" ] } ] } ] } } }, "delete": { "operationId": "remove_access_group_rule", "summary": "Delete an access group rule", "description": "Remove one rule from a group using this API. If the operation is successful, only a `204 - No Content` response with no body is returned. However, if any error occurs, the standard error format will be returned.", "tags": [ "Rule operations" ], "parameters": [ { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.rules.delete" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.rule.delete" } ] }, "responses": { "204": { "description": "Delete Successful." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/RuleNotFound" }, "405": { "description": "Method Not Allowed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "method_not_allowed_for_group", "message": "Cannot delete rule for: AccessGroupId-PublicAccess" } ], "status_code": 405 } } } } } }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X DELETE --location --header \"Authorization: Bearer {iam_token}\" \\\n", " \"{base_url}/v2/groups/{access_group_id}/rules/{rule_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "removeAccessGroupRuleOptions := iamAccessGroupsService.NewRemoveAccessGroupRuleOptions(\n", " accessGroupIDLink,\n", " testClaimRuleID,\n", ")\n", "\n", "response, err := iamAccessGroupsService.RemoveAccessGroupRule(removeAccessGroupRuleOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "if response.StatusCode != 204 {\n", " fmt.Printf(\"\\nUnexpected response status code received from RemoveAccessGroupRule(): %d\\n\", response.StatusCode)\n", "}" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "RemoveAccessGroupRuleOptions removeAccessGroupRuleOptions = new RemoveAccessGroupRuleOptions.Builder()\n", " .accessGroupId(testGroupId)\n", " .ruleId(testClaimRuleId)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.removeAccessGroupRule(removeAccessGroupRuleOptions).execute();" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accessGroupId: testGroupId,\n", " ruleId: testClaimRuleId,\n", "};\n", "\n", "try {\n", " await iamAccessGroupsService.removeAccessGroupRule(params);\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.remove_access_group_rule(\n", " access_group_id=test_group_id,\n", " rule_id=test_claim_rule_id,\n", ")" ] } ] } ] } } } }, "/v2/groups/settings": { "get": { "summary": "Get account settings", "description": "Retrieve the access groups settings for a specific account.", "tags": [ "Account settings" ], "operationId": "get_account_settings", "parameters": [ { "$ref": "#/components/parameters/AccountIdParam" }, { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.account-settings.read" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.account-settings.read" } ] }, "responses": { "200": { "description": "Get Successful.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountSettings" }, "examples": { "response": { "value": { "account_id": "c56eec94cb5793b8da0eb7790759aaf0", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS", "public_access_enabled": true } } } } } }, "400": { "description": "Invalid Account ID.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "invalid_account_id", "message": "The account id, c56eec94cb5793b8da0eb7790759aaf0, is invalid" } ], "status_code": 400 } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X GET --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " \"{base_url}/v2/groups/settings?account_id={account_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "getAccountSettingsOptions := iamAccessGroupsService.NewGetAccountSettingsOptions(\n", " testAccountID,\n", ")\n", "\n", "accountSettings, response, err := iamAccessGroupsService.GetAccountSettings(getAccountSettingsOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(accountSettings, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ " GetAccountSettingsOptions getAccountSettingsOptions = new GetAccountSettingsOptions.Builder()\n", " .accountId(accountID)\n", " .build();\n", "\n", " Response response = contextBasedRestrictionsService.getAccountSettings(getAccountSettingsOptions).execute();\n", " AccountSettings accountSettings = response.getResult();\n", "\n", " System.out.println(accountSettings);\n", "GetAccountSettingsOptions getAccountSettingsOptions = new GetAccountSettingsOptions.Builder()\n", " .accountId(accountId)\n", " .build();\n", "\n", "Response response = ibmCloudShellService.getAccountSettings(getAccountSettingsOptions).execute();\n", "AccountSettings accountSettings = response.getResult();\n", "\n", "System.out.println(accountSettings);\n", "\n", "GetAccountSettingsOptions getAccountSettingsOptions = new GetAccountSettingsOptions.Builder()\n", " .accountId(testAccountId)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.getAccountSettings(getAccountSettingsOptions).execute();\n", "AccountSettings accountSettings = response.getResult();\n", "\n", "System.out.println(accountSettings);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accountId: testAccountId,\n", "};\n", "\n", "try {\n", " const res = await iamAccessGroupsService.getAccountSettings(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}\n", "\n", "\n", "const params = {\n", " accountId: accountId,\n", "};\n", "\n", "try {\n", " const res = await ibmCloudShellService.getAccountSettings(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err)\n", "}\n", "\n", "\n", "const params = {\n", " accountId,\n", "};\n", "\n", "try {\n", " const res = await contextBasedRestrictionsService.getAccountSettings(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.get_account_settings(\n", " account_id=test_account_id,\n", ")\n", "account_settings = response.get_result()\n", "\n", "print(json.dumps(account_settings, indent=2))\n", "\n", "\n", "response = context_based_restrictions_service.get_account_settings(\n", " account_id=account_id,\n", ")\n", "account_settings = response.get_result()\n", "\n", "print(json.dumps(account_settings, indent=2))\n", "\n", "\n", "account_settings = ibm_cloud_shell_service.get_account_settings(account_id=account_id).get_result()\n", "\n", "print(json.dumps(account_settings, indent=2))" ] } ] } ] } } }, "patch": { "summary": "Update account settings", "description": "Update the access groups settings for a specific account. Note: When the `public_access_enabled` setting is set to false, all policies within the account attached to the Public Access group will be deleted. Only set `public_access_enabled` to false if you are sure that you want those policies to be removed.", "tags": [ "Account settings" ], "operationId": "update_account_settings", "parameters": [ { "$ref": "#/components/parameters/AccountIdParam" }, { "$ref": "#/components/parameters/TransactionIdHeaderParam" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountSettingsRequest" }, "example": { "public_access_enabled": true } } }, "description": "The account settings to update.", "required": true }, "x-ibm-permissions": { "actions": [ { "name": "iam-groups.account-settings.update" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.account-settings.update" } ] }, "responses": { "200": { "description": "Settings Updated.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountSettings" }, "examples": { "response": { "value": { "account_id": "c56eec94cb5793b8da0eb7790759aaf0", "last_modified_at": "2019-01-01T01:01:00Z", "last_modified_by_id": "IBMid-06000260JS", "public_access_enabled": true } } } } } }, "400": { "description": "Bad Request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "invalid_payload", "message": "Payload contains invalid/missing data. Reason: `Unexpected fields are present in the request body.`" } ], "status_code": 400 } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalServerError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X PATCH --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " --header \"Content-Type: application/json\" \\\n", " --data '{ \"public_access_enabled\": true }' \\\n", " \"{base_url}/v2/groups/settings?account_id={account_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "updateAccountSettingsOptions := iamAccessGroupsService.NewUpdateAccountSettingsOptions(\n", " testAccountID,\n", ")\n", "updateAccountSettingsOptions.SetPublicAccessEnabled(true)\n", "\n", "accountSettings, response, err := iamAccessGroupsService.UpdateAccountSettings(updateAccountSettingsOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(accountSettings, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "Feature fileManagerFeatureModel = new Feature.Builder()\n", " .enabled(false)\n", " .key(\"server.file_manager\")\n", " .build();\n", "Feature webPreviewFeatureModel = new Feature.Builder()\n", " .enabled(true)\n", " .key(\"server.web_preview\")\n", " .build();\n", "\n", "RegionSetting euRegionSettingModel = new RegionSetting.Builder()\n", " .enabled(true)\n", " .key(\"eu-de\")\n", " .build();\n", "RegionSetting jpRegionSettingModel = new RegionSetting.Builder()\n", " .enabled(false)\n", " .key(\"jp-tok\")\n", " .build();\n", "RegionSetting usRegionSettingModel = new RegionSetting.Builder()\n", " .enabled(false)\n", " .key(\"us-south\")\n", " .build();\n", "\n", "UpdateAccountSettingsOptions updateAccountSettingsOptions = new UpdateAccountSettingsOptions.Builder()\n", " .accountId(accountId)\n", " .rev(String.format(\"130-%s\", accountId))\n", " .defaultEnableNewFeatures(false)\n", " .defaultEnableNewRegions(true)\n", " .enabled(true)\n", " .features(new java.util.ArrayList(java.util.Arrays.asList(fileManagerFeatureModel, webPreviewFeatureModel)))\n", " .regions(new java.util.ArrayList(java.util.Arrays.asList(euRegionSettingModel, jpRegionSettingModel, usRegionSettingModel)))\n", " .build();\n", "\n", "Response response = ibmCloudShellService.updateAccountSettings(updateAccountSettingsOptions).execute();\n", "AccountSettings accountSettings = response.getResult();\n", "\n", "System.out.println(accountSettings);\n", "\n", "UpdateAccountSettingsOptions updateAccountSettingsOptions = new UpdateAccountSettingsOptions.Builder()\n", " .accountId(testAccountId)\n", " .publicAccessEnabled(true)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.updateAccountSettings(updateAccountSettingsOptions).execute();\n", "AccountSettings accountSettings = response.getResult();\n", "\n", "System.out.println(accountSettings);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accountId: testAccountId,\n", " publicAccessEnabled: true,\n", "};\n", "\n", "try {\n", " const res = await iamAccessGroupsService.updateAccountSettings(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}\n", "\n", "\n", "// Feature\n", "const featureModel = [\n", " {\n", " enabled: true,\n", " key: 'server.file_manager',\n", " },\n", " {\n", " enabled: true,\n", " key: 'server.web_preview',\n", " },\n", "];\n", "\n", "// RegionSetting\n", "const regionSettingModel = [\n", " {\n", " enabled: true,\n", " key: 'eu-de',\n", " },\n", " {\n", " enabled: true,\n", " key: 'jp-tok',\n", " },\n", " {\n", " enabled: true,\n", " key: 'us-south',\n", " },\n", "];\n", "\n", "const params = {\n", " accountId: accountId,\n", " rev: '130-{accountId}',\n", " defaultEnableNewFeatures: true,\n", " defaultEnableNewRegions: true,\n", " enabled: true,\n", " features: featureModel,\n", " regions: regionSettingModel,\n", "};\n", "\n", "\n", "try {\n", " const res = await ibmCloudShellService.updateAccountSettings(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err)\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.update_account_settings(\n", " account_id=test_account_id,\n", " public_access_enabled=True,\n", ")\n", "account_settings = response.get_result()\n", "\n", "print(json.dumps(account_settings, indent=2))\n", "\n", "\n", "feature_model = [\n", " {\n", " 'enabled': True,\n", " 'key': 'server.file_manager',\n", " },\n", " {\n", " 'enabled': True,\n", " 'key': 'server.web_preview',\n", " },\n", "]\n", "\n", "region_setting_model = [\n", " {\n", " 'enabled': True,\n", " 'key': 'eu-de',\n", " },\n", " {\n", " 'enabled': True,\n", " 'key': 'jp-tok',\n", " },\n", " {\n", " 'enabled': True,\n", " 'key': 'us-south',\n", " },\n", "]\n", "\n", "account_settings = ibm_cloud_shell_service.update_account_settings(\n", " account_id=account_id,\n", " rev='130-12345678-abcd-1a2b-a1b2-1234567890ab',\n", " default_enable_new_features=False,\n", " default_enable_new_regions=True,\n", " enabled=True,\n", " features=feature_model,\n", " regions=region_setting_model,\n", ").get_result()\n", "\n", "print(json.dumps(account_settings, indent=2))" ] } ] } ] } } } }, "/v1/group_templates": { "post": { "operationId": "create_template", "tags": [ "Template operations" ], "description": "Create an access group template. Make sure that the template is generic enough to apply to multiple different child accounts. Before you can assign an access group template to child accounts, you must commit it so that no further changes can be made to the version.", "summary": "Create template", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateRequest" }, "example": { "name": "IAM Admin Group template", "description": "This access group template allows admin access to all IAM platform services in the account.", "account_id": "accountID-123", "commit": false, "group": { "name": "IAM Admin Group", "description": "This access group template allows admin access to all IAM platform services in the account.", "members": { "users": [ "IBMid-50PJGPKYJJ", "IBMid-665000T8WY" ], "services": [ "iam-ServiceId-345", "iam-ServiceId-456" ], "action_controls": { "add": true, "remove": false } }, "assertions": { "rules": [ { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "blueGroup", "operator": "CONTAINS", "value": "test-bluegroup-saml" } ], "action_controls": { "remove": false } }, { "name": "Developer group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "yellowGroup", "operator": "CONTAINS", "value": "test-yellowGroup-saml" } ] } ], "action_controls": { "add": false, "remove": true } }, "action_controls": { "access": { "add": false } } }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1" }, { "id": "policyTemplateId-234", "version": "1" } ] } } } }, "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-template.create" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-template.create" } ] }, "parameters": [ { "name": "Transaction-Id", "description": "An optional transaction id for the request", "in": "header", "schema": { "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } ], "responses": { "201": { "description": "Successful response", "headers": { "ETag": { "description": "Entity tag for the response", "schema": { "description": "etag schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } }, "Transaction-Id": { "description": "An optional transaction id for the request", "schema": { "description": "transaction id schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateResponse" }, "example": { "id": "AccessGroupTemplateId-93ac0a21-d130-490f-8e32-4615e242a161", "name": "IAM Admin Group template", "description": "This template allows admin access to all IAM platform service.", "account_id": "accountID-123", "version": "1", "committed": false, "group": { "name": "IAM Admin Group", "description": "This AG allows admin access to all IAM platform services.", "members": { "users": [ "IBMid-123", "IBMid-234" ], "services": [ "iam-ServiceId-345", "iam-ServiceId-456" ], "action_controls": { "add": true, "remove": false } }, "assertions": { "rules": [ { "name": "Developer group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "yellowGroup", "operator": "CONTAINS", "value": "test-yellowGroup-saml" } ], "action_controls": { "remove": true } }, { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "blueGroup", "operator": "CONTAINS", "value": "test-bluegroup-saml" } ], "action_controls": { "remove": false } } ], "action_controls": { "add": false, "remove": true } }, "action_controls": { "access": { "add": false } } }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1" }, { "id": "policyTemplateId-234", "version": "1" } ], "href": "\"https://iam.cloud.ibm.com/v1/group_templates/AccessGroupTemplateId-93ac0a21-d130-490f-8e32-4615e242a161\"", "created_at": "2023-02-13T14:28:18.000Z", "created_by_id": "IBMid-1234", "last_modified_at": "2023-02-13T14:28:18.000Z", "last_modified_by_id": "IBMid-1234" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Access denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessDenied" } } } }, "409": { "description": "Template Conflict Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateConflictError" } } } }, "429": { "description": "Templates per account limit reached", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TooManyRequests" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X POST --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " --header \"Content-Type: application/json\" \\\n", " --data '{ \"name\": \"IAM Admin Group template\", \"description\": \"This access group template allows admin access to all IAM platform services in the account.\", \"account_id\": \"accountID-123\", \"group\": { \"name\": \"IAM Admin Group\", \"description\": \"This access group template allows admin access to all IAM platform services in the account.\", \"members\": { \"users\": [ \"IBMid-50PJGPKYJJ\", \"IBMid-665000T8WY\" ], \"services\": [ \"iam-ServiceId-345\", \"iam-ServiceId-456\" ], \"action_controls\": { \"add\": true, \"remove\": false } }, \"assertions\": { \"rules\": [ { \"name\": \"Manager group rule\", \"expiration\": 12, \"realm_name\": \"https://idp.example.org/SAML2\", \"conditions\": [ { \"claim\": \"blueGroup\", \"operator\": \"CONTAINS\", \"value\": \"test-bluegroup-saml\" } ], \"action_controls\": { \"remove\": false } }, { \"name\": \"Developer group rule\", \"expiration\": 12, \"realm_name\": \"https://idp.example.org/SAML2\", \"conditions\": [ { \"claim\": \"yellowGroup\", \"operator\": \"CONTAINS\", \"value\": \"test-yellowGroup-saml\" } ] } ], \"action_controls\": { \"add\": false, \"remove\": true } }, \"action_controls\": { \"access\": { \"add\": false } } }, \"policy_template_references\": [ { \"id\": \"policyTemplateId-123\", \"version\": \"1\" }, { \"id\": \"policyTemplateId-234\", \"version\": \"1\" } ] }' \\\n", " \"{base_url}/v1/group_templates\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "membersActionControlsModel := &iamaccessgroupsv2.MembersActionControls{\n", " Add: core.BoolPtr(true),\n", " Remove: core.BoolPtr(false),\n", "}\n", "\n", "membersInputModel := &iamaccessgroupsv2.Members{\n", " Users: []string{\"IBMid-50PJGPKYJJ\", \"IBMid-665000T8WY\"},\n", " ActionControls: membersActionControlsModel,\n", "}\n", "\n", "conditionInputModel := &iamaccessgroupsv2.Conditions{\n", " Claim: core.StringPtr(\"blueGroup\"),\n", " Operator: core.StringPtr(\"CONTAINS\"),\n", " Value: core.StringPtr(`\"test-bluegroup-saml\"`),\n", "}\n", "\n", "rulesActionControlsModel := &iamaccessgroupsv2.RuleActionControls{\n", " Remove: core.BoolPtr(false),\n", "}\n", "\n", "ruleInputModel := &iamaccessgroupsv2.AssertionsRule{\n", " Name: core.StringPtr(\"Manager group rule\"),\n", " Expiration: core.Int64Ptr(int64(12)),\n", " RealmName: core.StringPtr(\"https://idp.example.org/SAML2\"),\n", " Conditions: []iamaccessgroupsv2.Conditions{*conditionInputModel},\n", " ActionControls: rulesActionControlsModel,\n", "}\n", "\n", "assertionsActionControlsModel := &iamaccessgroupsv2.AssertionsActionControls{\n", " Add: core.BoolPtr(false),\n", " Remove: core.BoolPtr(true),\n", "}\n", "\n", "assertionsInputModel := &iamaccessgroupsv2.Assertions{\n", " Rules: []iamaccessgroupsv2.AssertionsRule{*ruleInputModel},\n", " ActionControls: assertionsActionControlsModel,\n", "}\n", "\n", "accessActionControlsModel := &iamaccessgroupsv2.AccessActionControls{\n", " Add: core.BoolPtr(false),\n", "}\n", "\n", "groupActionControlsModel := &iamaccessgroupsv2.GroupActionControls{\n", " Access: accessActionControlsModel,\n", "}\n", "\n", "accessGroupInputModel := &iamaccessgroupsv2.AccessGroupRequest{\n", " Name: core.StringPtr(\"IAM Admin Group\"),\n", " Description: core.StringPtr(\"This access group template allows admin access to all IAM platform services in the account.\"),\n", " Members: membersInputModel,\n", " Assertions: assertionsInputModel,\n", " ActionControls: groupActionControlsModel,\n", "}\n", "\n", "policyTemplatesInputModel := &iamaccessgroupsv2.PolicyTemplates{\n", " ID: &testPolicyTemplateID,\n", " Version: core.StringPtr(\"1\"),\n", "}\n", "\n", "createTemplateOptions := iamAccessGroupsService.NewCreateTemplateOptions(\n", " \"IAM Admin Group template\",\n", " testAccountID,\n", ")\n", "createTemplateOptions.SetDescription(\"This access group template allows admin access to all IAM platform services in the account.\")\n", "createTemplateOptions.SetGroup(accessGroupInputModel)\n", "createTemplateOptions.SetPolicyTemplateReferences([]iamaccessgroupsv2.PolicyTemplates{*policyTemplatesInputModel})\n", "\n", "createTemplateResponse, response, err := iamAccessGroupsService.CreateTemplate(createTemplateOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(createTemplateResponse, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "MembersActionControls membersActionControlsModel = new MembersActionControls.Builder()\n", " .add(true)\n", " .remove(false)\n", " .build();\n", "Members membersModel = new Members.Builder()\n", " .users(java.util.Arrays.asList(\"IBMid-50PJGPKYJJ\", \"IBMid-665000T8WY\"))\n", " .actionControls(membersActionControlsModel)\n", " .build();\n", "Conditions conditionsModel = new Conditions.Builder()\n", " .claim(\"blueGroup\")\n", " .operator(\"CONTAINS\")\n", " .value(\"\\\"test-bluegroup-saml\\\"\")\n", " .build();\n", "RuleActionControls ruleActionControlsModel = new RuleActionControls.Builder()\n", " .remove(false)\n", " .build();\n", "AssertionsRule assertionsRuleModel = new AssertionsRule.Builder()\n", " .name(\"Manager group rule\")\n", " .expiration(Long.valueOf(\"12\"))\n", " .realmName(\"https://idp.example.org/SAML2\")\n", " .conditions(java.util.Arrays.asList(conditionsModel))\n", " .actionControls(ruleActionControlsModel)\n", " .build();\n", "AssertionsActionControls assertionsActionControlsModel = new AssertionsActionControls.Builder()\n", " .add(false)\n", " .remove(true)\n", " .build();\n", "Assertions assertionsModel = new Assertions.Builder()\n", " .rules(java.util.Arrays.asList(assertionsRuleModel))\n", " .actionControls(assertionsActionControlsModel)\n", " .build();\n", "AccessActionControls accessActionControlsModel = new AccessActionControls.Builder()\n", " .add(false)\n", " .build();\n", "GroupActionControls groupActionControlsModel = new GroupActionControls.Builder()\n", " .access(accessActionControlsModel)\n", " .build();\n", "AccessGroupRequest accessGroupRequestModel = new AccessGroupRequest.Builder()\n", " .name(\"IAM Admin Group\")\n", " .description(\"This access group template allows admin access to all IAM platform services in the account.\")\n", " .members(membersModel)\n", " .assertions(assertionsModel)\n", " .actionControls(groupActionControlsModel)\n", " .build();\n", "PolicyTemplates policyTemplatesModel = new PolicyTemplates.Builder()\n", " .id(testPolicyTemplateId)\n", " .version(\"1\")\n", " .build();\n", "CreateTemplateOptions createTemplateOptions = new CreateTemplateOptions.Builder()\n", " .name(\"IAM Admin Group template\")\n", " .accountId(testAccountId)\n", " .description(\"This access group template allows admin access to all IAM platform services in the account.\")\n", " .group(accessGroupRequestModel)\n", " .policyTemplateReferences(java.util.Arrays.asList(policyTemplatesModel))\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.createTemplate(createTemplateOptions).execute();\n", "TemplateResponse templateResponse = response.getResult();\n", "\n", "System.out.println(templateResponse);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "// Request models needed by this operation.\n", "\n", "// MembersActionControls\n", "const membersActionControlsModel = {\n", " add: true,\n", " remove: false,\n", "};\n", "\n", "// MembersInput\n", "const membersInputModel = {\n", " users: ['IBMid-50PJGPKYJJ', 'IBMid-665000T8WY'],\n", " action_controls: membersActionControlsModel,\n", "};\n", "\n", "// ConditionInput\n", "const conditionInputModel = {\n", " claim: 'blueGroup',\n", " operator: 'CONTAINS',\n", " value: '\\\"test-bluegroup-saml\\\"',\n", "};\n", "\n", "// RulesActionControls\n", "const rulesActionControlsModel = {\n", " remove: false,\n", "};\n", "\n", "// RuleInput\n", "const ruleInputModel = {\n", " name: 'Manager group rule',\n", " expiration: 12,\n", " realm_name: 'https://idp.example.org/SAML2',\n", " conditions: [conditionInputModel],\n", " action_controls: rulesActionControlsModel,\n", "};\n", "\n", "// AssertionsActionControls\n", "const assertionsActionControlsModel = {\n", " add: false,\n", " remove: true,\n", "};\n", "\n", "// AssertionsInput\n", "const assertionsInputModel = {\n", " rules: [ruleInputModel],\n", " action_controls: assertionsActionControlsModel,\n", "};\n", "\n", "// AccessActionControls\n", "const accessActionControlsModel = {\n", " add: false,\n", "};\n", "\n", "// GroupActionControls\n", "const groupActionControlsModel = {\n", " access: accessActionControlsModel,\n", "};\n", "\n", "// AccessGroupInput\n", "const accessGroupInputModel = {\n", " name: 'IAM Admin Group',\n", " description: 'This access group template allows admin access to all IAM platform services in the account.',\n", " members: membersInputModel,\n", " assertions: assertionsInputModel,\n", " action_controls: groupActionControlsModel,\n", "};\n", "\n", "// PolicyTemplatesInput\n", "const policyTemplatesInputModel = {\n", " id: testPolicyTemplateId,\n", " version: '1',\n", "};\n", "\n", "const params = {\n", " name: 'IAM Admin Group template',\n", " accountId: testAccountId,\n", " description: 'This access group template allows admin access to all IAM platform services in the account.',\n", " group: accessGroupInputModel,\n", " policyTemplateReferences: [policyTemplatesInputModel],\n", "};\n", "\n", "let res;\n", "try {\n", " res = await iamAccessGroupsService.createTemplate(params);\n", " testTemplateId = res.result.id;\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "members_action_controls_model = {\n", " 'add': True,\n", " 'remove': False,\n", "}\n", "\n", "members_input_model = {\n", " 'users': ['IBMid-50PJGPKYJJ', 'IBMid-665000T8WY'],\n", " 'action_controls': members_action_controls_model,\n", "}\n", "\n", "condition_input_model = {\n", " 'claim': 'blueGroup',\n", " 'operator': 'CONTAINS',\n", " 'value': '\\\"test-bluegroup-saml\\\"',\n", "}\n", "\n", "rules_action_controls_model = {\n", " 'remove': False,\n", "}\n", "\n", "rule_input_model = {\n", " 'name': 'Manager group rule',\n", " 'expiration': 12,\n", " 'realm_name': 'https://idp.example.org/SAML2',\n", " 'conditions': [condition_input_model],\n", " 'action_controls': rules_action_controls_model,\n", "}\n", "\n", "assertions_action_controls_model = {\n", " 'add': False,\n", " 'remove': True,\n", "}\n", "\n", "assertions_input_model = {\n", " 'rules': [rule_input_model],\n", " 'action_controls': assertions_action_controls_model,\n", "}\n", "\n", "access_action_controls_model = {\n", " 'add': False,\n", "}\n", "\n", "group_action_controls_model = {\n", " 'access': access_action_controls_model,\n", "}\n", "\n", "access_group_input_model = {\n", " 'name': 'IAM Admin Group',\n", " 'description': 'This access group template allows admin access to all IAM platform services in the account.',\n", " 'members': members_input_model,\n", " 'assertions': assertions_input_model,\n", " 'action_controls': group_action_controls_model,\n", "}\n", "\n", "policy_templates_input_model = {\n", " 'id': test_policy_template_id,\n", " 'version': '1',\n", "}\n", "\n", "response = iam_access_groups_service.create_template(\n", " name='IAM Admin Group template',\n", " account_id=test_account_id,\n", " description='This access group template allows admin access to all IAM platform services in the account.',\n", " group=access_group_input_model,\n", " policy_template_references=[policy_templates_input_model],\n", ")\n", "create_template_response = response.get_result()\n", "\n", "print(json.dumps(create_template_response, indent=2))" ] } ] } ] } } }, "get": { "operationId": "list_templates", "tags": [ "Template operations" ], "description": "List the access group templates in an enterprise account.", "summary": "List templates", "parameters": [ { "name": "account_id", "description": "Enterprise account ID", "in": "query", "schema": { "type": "string", "description": "account id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 }, "required": true, "example": "accountID-123" }, { "name": "Transaction-Id", "description": "An optional transaction id for the request", "in": "header", "schema": { "type": "string", "description": "Transaction id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } }, { "name": "limit", "description": "Return up to this limit of results where limit is between 0 and 100.", "in": "query", "schema": { "type": "integer", "description": "limit schema", "default": 50, "maximum": 100 }, "example": 50 }, { "name": "offset", "description": "The offset of the first result item to be returned.", "in": "query", "schema": { "type": "integer", "description": "offset schema" }, "example": 0 }, { "name": "verbose", "description": "If `verbose=true`, IAM resource details are returned. If performance is a concern, leave the `verbose` parameter off so that details are not retrieved.", "in": "query", "schema": { "type": "boolean", "description": "verbose schema" }, "example": true } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-template.read" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-template.read" } ] }, "responses": { "200": { "description": "Successful response", "headers": { "Transaction-Id": { "description": "An optional transaction id for the request", "schema": { "description": "transaction id schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListTemplatesResponse" }, "example": { "limit": 100, "offset": 0, "total_count": 3, "first": { "href": "\"https://iam.cloud.ibm.com/v1/group_templates?limit=100&account_id=accountID-123&verbose=true\"" }, "last": { "href": "\"https://iam.cloud.ibm.com/v1/group_templates?offset=0&limit=100&account_id=accountID-123&verbose=true\"" }, "group_templates": [ { "id": "AccessGroupTemplateId-f5c3b076-334a-48c6-906f-8120de1b4321", "name": "IAM Admin developers template", "description": "This access group template allows developers access to all IAM platform services in the account.", "version": "1", "committed": false, "group": { "name": "IAM developers Group", "description": "This access group template allows developers access to all IAM platform services in the account.", "members": { "users": [ "IBMid-123", "IBMid-234" ], "services": [ "iam-ServiceId-345", "iam-ServiceId-456" ], "action_controls": { "add": true, "remove": false } }, "assertions": { "rules": [ { "name": "Developer group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "yellowGroup", "operator": "CONTAINS", "value": "test-yellowGroup-saml" } ], "action_controls": { "remove": false } }, { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "blueGroup", "operator": "CONTAINS", "value": "test-bluegroup-saml" } ], "action_controls": { "remove": false } } ], "action_controls": { "add": false, "remove": true } }, "action_controls": { "access": { "add": false } } }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1" }, { "id": "policyTemplateId-234", "version": "1" } ], "href": "\"https://iam.cloud.ibm.com/v1/group_templates/AccessGroupTemplateId-f5c3b076-334a-48c6-906f-8120de1b4321/1\"", "created_at": "2023-02-13T10:44:15.000Z", "created_by_id": "IBMid-1234", "last_modified_at": "2023-02-13T10:44:15.000Z", "last_modified_by_id": "IBMid-1234" }, { "id": "AccessGroupTemplateId-93ac0a21-d130-490f-8e32-4615e242a161", "name": "IAM Admin Group template 3", "description": "This access group template allows admin access to all IAM platform services in the account.", "version": "1", "committed": false, "group": { "name": "IAM Admin Group 3", "description": "This access group template allows admin access to all IAM platform services in the account.", "members": { "users": [ "IBMid-123", "IBMid-234" ], "services": [ "iam-ServiceId-345", "iam-ServiceId-456" ], "action_controls": { "add": true, "remove": false } }, "assertions": { "rules": [ { "name": "Developer group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "yellowGroup", "operator": "CONTAINS", "value": "test-yellowGroup-saml" } ], "action_controls": { "remove": true } }, { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "blueGroup", "operator": "CONTAINS", "value": "test-bluegroup-saml" } ], "action_controls": { "remove": false } } ], "action_controls": { "add": false, "remove": true } }, "action_controls": { "access": { "add": false } } }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1" }, { "id": "policyTemplateId-234", "version": "1" } ], "href": "\"https://iam.cloud.ibm.com/v1/group_templates/AccessGroupTemplateId-93ac0a21-d130-490f-8e32-4615e242a161/1\"", "created_at": "2023-02-13T14:28:18.000Z", "created_by_id": "IBMid-12345", "last_modified_at": "2023-02-13T14:28:18.000Z", "last_modified_by_id": "IBMid-12345" }, { "id": "AccessGroupTemplateId-255cf72c-0425-4e10-8721-b0dcbe1f1a8e", "name": "IAM Admin Group template for deployment version 1", "description": "This access group template allows admin access to all IAM platform services in the account ID.", "version": "8", "committed": false, "group": { "name": "IAM Admin Group for deployment version 1", "description": "This access group template allows admin access to all IAM platform services in the account.", "members": { "users": [ "IBMid-123", "IBMid-234" ], "services": [ "iam-ServiceId-345", "iam-ServiceId-456" ], "action_controls": { "add": true, "remove": true } }, "assertions": { "rules": [ { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "blueGroup", "operator": "CONTAINS", "value": "test-bluegroup-saml" } ], "action_controls": { "remove": true } } ], "action_controls": { "add": true, "remove": true } }, "action_controls": { "access": { "add": true } } }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1" }, { "id": "policyTemplateId-234", "version": "1" } ], "href": "\"https://iam.cloud.ibm.com/v1/group_templates/AccessGroupTemplateId-255cf72c-0425-4e10-8721-b0dcbe1f1a8e/8\"", "created_at": "2023-02-10T11:49:17.000Z", "created_by_id": "IBMid-12345", "last_modified_at": "2023-02-10T11:49:17.000Z", "last_modified_by_id": "IBMid-12345" } ] } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Access denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Forbidden" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X GET --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " \"{base_url}/v1/group_templates?account_id=accountID-123&limit=50&offset=0&verbose=true\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "listTemplatesOptions := &iamaccessgroupsv2.ListTemplatesOptions{\n", " AccountID: &testAccountID,\n", " TransactionID: core.StringPtr(\"testString\"),\n", " Limit: core.Int64Ptr(int64(50)),\n", " Verbose: core.BoolPtr(true),\n", "}\n", "\n", "pager, err := iamAccessGroupsService.NewTemplatesPager(listTemplatesOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "\n", "var allResults []iamaccessgroupsv2.GroupTemplate\n", "for pager.HasNext() {\n", " nextPage, err := pager.GetNext()\n", " if err != nil {\n", " panic(err)\n", " }\n", " allResults = append(allResults, nextPage...)\n", "}\n", "b, _ := json.MarshalIndent(allResults, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "ListTemplatesOptions listTemplatesOptions = new ListTemplatesOptions.Builder()\n", " .accountId(testAccountId)\n", " .transactionId(\"testString\")\n", " .limit(Long.valueOf(\"50\"))\n", " .verbose(true)\n", " .build();\n", "\n", "TemplatesPager pager = new TemplatesPager(iamAccessGroupsService, listTemplatesOptions);\n", "List allResults = new ArrayList<>();\n", "while (pager.hasNext()) {\n", " List nextPage = pager.getNext();\n", " allResults.addAll(nextPage);\n", "}\n", "\n", "System.out.println(GsonSingleton.getGson().toJson(allResults));" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accountId: testAccountId,\n", " transactionId: 'testString',\n", " limit: 50,\n", "};\n", "\n", "const allResults = [];\n", "try {\n", " const pager = new IamAccessGroupsV2.TemplatesPager(iamAccessGroupsService, params);\n", " while (pager.hasNext()) {\n", " const nextPage = await pager.getNext();\n", " expect(nextPage).not.toBeNull();\n", " allResults.push(...nextPage);\n", " }\n", " console.log(JSON.stringify(allResults, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "all_results = []\n", "pager = TemplatesPager(\n", " client=iam_access_groups_service,\n", " account_id=test_account_id,\n", " transaction_id='testString',\n", " limit=50,\n", " verbose=True,\n", ")\n", "while pager.has_next():\n", " next_page = pager.get_next()\n", " assert next_page is not None\n", " all_results.extend(next_page)\n", "\n", "print(json.dumps(all_results, indent=2))" ] } ] } ] } } } }, "/v1/group_templates/{template_id}/versions": { "post": { "operationId": "create_template_version", "tags": [ "Template operations" ], "summary": "Create template version", "description": "Create a new version of an access group template.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateVersionRequest" }, "example": { "name": "IAM Admin Group template 2", "description": "This access group template allows admin access to all IAM platform services in the account.", "commit": false, "group": { "name": "IAM Admin Group 8", "description": "This access group template allows admin access to all IAM platform services in the account.", "members": { "users": [ "IBMid-50PJGPKYJJ", "IBMid-665000T8WY" ], "services": [ "iam-ServiceId-345" ], "action_controls": { "add": true, "remove": false } }, "assertions": { "rules": [ { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "blueGroup", "operator": "CONTAINS", "value": "test-bluegroup-saml" } ], "action_controls": { "remove": false } } ], "action_controls": { "add": false } }, "action_controls": { "access": { "add": false } } }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1" }, { "id": "policyTemplateId-234", "version": "1" } ] } } } }, "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-template.create" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-template.create" } ] }, "parameters": [ { "name": "template_id", "description": "ID of the template that you want to create a new version of", "in": "path", "schema": { "type": "string", "description": "template id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 100 }, "required": true }, { "name": "Transaction-Id", "description": "An optional transaction id for the request", "in": "header", "schema": { "type": "string", "description": "transaction id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } ], "responses": { "201": { "description": "Successful response", "headers": { "Transaction-Id": { "description": "An optional transaction id for the request", "schema": { "description": "transaction id schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateVersionResponse" }, "example": { "id": "AccessGroupTemplateId-93ac0a21-d130-490f-8e32-4615e242a161", "name": "IAM Admin Group template 2", "description": "This access group template allows admin access to all IAM platform services in the account.", "account_id": "3a04385ee30a49378d84f397ca6765b7", "version": "3", "committed": false, "group": { "name": "IAM Admin Group 8", "description": "This access group template allows admin access to all IAM platform services in the account.", "members": { "users": [ "IBMid-5500085Q21", "IBMid-55000A7EA9" ], "services": [ "iam-ServiceId-e371b0e5-1c80-48e3-bf12-c6a8ef2b1a11" ], "action_controls": { "add": true, "remove": true } }, "assertions": { "rules": [ { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "blueGroup", "operator": "CONTAINS", "value": "test-bluegroup-saml" } ], "action_controls": { "remove": true } } ], "action_controls": { "add": true, "remove": true } }, "action_controls": { "access": { "add": true } } }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1" }, { "id": "policyTemplateId-234", "version": "1" } ], "href": "\"https://iam.cloud.ibm.com/v1/group_templates/AccessGroupTemplateId-93ac0a21-d130-490f-8e32-4615e242a161/versions/3\"", "created_at": "2023-02-13T14:28:18.000Z", "created_by_id": "IBMid-6610040RHW", "last_modified_at": "2023-02-13T16:17:33.000Z", "last_modified_by_id": "IBMid-6610040RHW" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Template version limit reached", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateVersionLimitReached" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X POST --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " --header \"Content-Type: application/json\" \\\n", " --data '{ \"name\": \"IAM Admin Group template 2\", \"description\": \"This access group template allows admin access to all IAM platform services in the account.\", \"group\": { \"name\": \"IAM Admin Group 8\", \"description\": \"This access group template allows admin access to all IAM platform services in the account.\", \"members\": { \"users\": [ \"IBMid-50PJGPKYJJ\", \"IBMid-665000T8WY\" ], \"services\": [ \"iam-ServiceId-345\" ], \"action_controls\": { \"add\": true, \"remove\": false } }, \"assertions\": { \"rules\": [ { \"name\": \"Manager group rule\", \"expiration\": 12, \"realm_name\": \"https://idp.example.org/SAML2\", \"conditions\": [ { \"claim\": \"blueGroup\", \"operator\": \"CONTAINS\", \"value\": \"test-bluegroup-saml\" } ], \"action_controls\": { \"remove\": false } } ], \"action_controls\": { \"add\": false } }, \"action_controls\": { \"access\": { \"add\": false } } }, \"policy_template_references\": [ { \"id\": \"policyTemplateId-123\", \"version\": \"1\" }, { \"id\": \"policyTemplateId-234\", \"version\": \"1\" } ] }' \\\n", " \"{base_url}/v1/group_templates/{template_id}/versions\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "membersActionControlsModel := &iamaccessgroupsv2.MembersActionControls{\n", " Add: core.BoolPtr(true),\n", " Remove: core.BoolPtr(false),\n", "}\n", "\n", "membersInputModel := &iamaccessgroupsv2.Members{\n", " Users: []string{\"IBMid-50PJGPKYJJ\", \"IBMid-665000T8WY\"},\n", " ActionControls: membersActionControlsModel,\n", "}\n", "\n", "conditionInputModel := &iamaccessgroupsv2.Conditions{\n", " Claim: core.StringPtr(\"blueGroup\"),\n", " Operator: core.StringPtr(\"CONTAINS\"),\n", " Value: core.StringPtr(`\"test-bluegroup-saml\"`),\n", "}\n", "\n", "ruleInputModel := &iamaccessgroupsv2.AssertionsRule{\n", " Name: core.StringPtr(\"Manager group rule\"),\n", " Expiration: core.Int64Ptr(int64(12)),\n", " RealmName: core.StringPtr(\"https://idp.example.org/SAML2\"),\n", " Conditions: []iamaccessgroupsv2.Conditions{*conditionInputModel},\n", "}\n", "\n", "assertionsActionControlsModel := &iamaccessgroupsv2.AssertionsActionControls{\n", " Add: core.BoolPtr(false),\n", "}\n", "\n", "assertionsInputModel := &iamaccessgroupsv2.Assertions{\n", " Rules: []iamaccessgroupsv2.AssertionsRule{*ruleInputModel},\n", " ActionControls: assertionsActionControlsModel,\n", "}\n", "\n", "accessActionControlsModel := &iamaccessgroupsv2.AccessActionControls{\n", " Add: core.BoolPtr(false),\n", "}\n", "\n", "groupActionControlsModel := &iamaccessgroupsv2.GroupActionControls{\n", " Access: accessActionControlsModel,\n", "}\n", "\n", "accessGroupInputModel := &iamaccessgroupsv2.AccessGroupRequest{\n", " Name: core.StringPtr(\"IAM Admin Group 8\"),\n", " Description: core.StringPtr(\"This access group template allows admin access to all IAM platform services in the account.\"),\n", " Members: membersInputModel,\n", " Assertions: assertionsInputModel,\n", " ActionControls: groupActionControlsModel,\n", "}\n", "\n", "policyTemplatesInputModel := &iamaccessgroupsv2.PolicyTemplates{\n", " ID: &testPolicyTemplateID,\n", " Version: core.StringPtr(\"1\"),\n", "}\n", "\n", "createTemplateVersionOptions := iamAccessGroupsService.NewCreateTemplateVersionOptions(\n", " testTemplateId,\n", ")\n", "createTemplateVersionOptions.SetName(\"IAM Admin Group template 2\")\n", "createTemplateVersionOptions.SetDescription(\"This access group template allows admin access to all IAM platform services in the account.\")\n", "createTemplateVersionOptions.SetGroup(accessGroupInputModel)\n", "createTemplateVersionOptions.SetPolicyTemplateReferences([]iamaccessgroupsv2.PolicyTemplates{*policyTemplatesInputModel})\n", "\n", "createTemplateResponse, response, err := iamAccessGroupsService.CreateTemplateVersion(createTemplateVersionOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(createTemplateResponse, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "MembersActionControls membersActionControlsModel = new MembersActionControls.Builder()\n", " .add(true)\n", " .remove(false)\n", " .build();\n", "Members membersModel = new Members.Builder()\n", " .users(java.util.Arrays.asList(\"IBMid-50PJGPKYJJ\", \"IBMid-665000T8WY\"))\n", " .actionControls(membersActionControlsModel)\n", " .build();\n", "Conditions conditionsModel = new Conditions.Builder()\n", " .claim(\"blueGroup\")\n", " .operator(\"CONTAINS\")\n", " .value(\"\\\"test-bluegroup-saml\\\"\")\n", " .build();\n", "AssertionsRule assertionsRuleModel = new AssertionsRule.Builder()\n", " .name(\"Manager group rule\")\n", " .expiration(Long.valueOf(\"12\"))\n", " .realmName(\"https://idp.example.org/SAML2\")\n", " .conditions(java.util.Arrays.asList(conditionsModel))\n", " .build();\n", "AssertionsActionControls assertionsActionControlsModel = new AssertionsActionControls.Builder()\n", " .add(false)\n", " .build();\n", "Assertions assertionsModel = new Assertions.Builder()\n", " .rules(java.util.Arrays.asList(assertionsRuleModel))\n", " .actionControls(assertionsActionControlsModel)\n", " .build();\n", "AccessActionControls accessActionControlsModel = new AccessActionControls.Builder()\n", " .add(false)\n", " .build();\n", "GroupActionControls groupActionControlsModel = new GroupActionControls.Builder()\n", " .access(accessActionControlsModel)\n", " .build();\n", "AccessGroupRequest accessGroupRequestModel = new AccessGroupRequest.Builder()\n", " .name(\"IAM Admin Group 8\")\n", " .description(\"This access group template allows admin access to all IAM platform services in the account.\")\n", " .members(membersModel)\n", " .assertions(assertionsModel)\n", " .actionControls(groupActionControlsModel)\n", " .build();\n", "PolicyTemplates policyTemplatesModel = new PolicyTemplates.Builder()\n", " .id(testPolicyTemplateId)\n", " .version(\"1\")\n", " .build();\n", "CreateTemplateVersionOptions createTemplateVersionOptions = new CreateTemplateVersionOptions.Builder()\n", " .templateId(testTemplateId)\n", " .name(\"IAM Admin Group template 2\")\n", " .description(\"This access group template allows admin access to all IAM platform services in the account.\")\n", " .group(accessGroupRequestModel)\n", " .policyTemplateReferences(java.util.Arrays.asList(policyTemplatesModel))\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.createTemplateVersion(createTemplateVersionOptions).execute();\n", "TemplateVersionResponse templateVersionResponse = response.getResult();\n", "\n", "System.out.println(templateVersionResponse);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "// Request models needed by this operation.\n", "\n", "// MembersActionControls\n", "const membersActionControlsModel = {\n", " add: true,\n", " remove: false,\n", "};\n", "\n", "// MembersInput\n", "const membersInputModel = {\n", " users: ['IBMid-50PJGPKYJJ', 'IBMid-665000T8WY'],\n", " action_controls: membersActionControlsModel,\n", "};\n", "\n", "// ConditionInput\n", "const conditionInputModel = {\n", " claim: 'blueGroup',\n", " operator: 'CONTAINS',\n", " value: '\\\"test-bluegroup-saml\\\"',\n", "};\n", "\n", "// RuleInput\n", "const ruleInputModel = {\n", " name: 'Manager group rule',\n", " expiration: 12,\n", " realm_name: 'https://idp.example.org/SAML2',\n", " conditions: [conditionInputModel],\n", "};\n", "\n", "// AssertionsActionControls\n", "const assertionsActionControlsModel = {\n", " add: false,\n", "};\n", "\n", "// AssertionsInput\n", "const assertionsInputModel = {\n", " rules: [ruleInputModel],\n", " action_controls: assertionsActionControlsModel,\n", "};\n", "\n", "// AccessActionControls\n", "const accessActionControlsModel = {\n", " add: false,\n", "};\n", "\n", "// GroupActionControls\n", "const groupActionControlsModel = {\n", " access: accessActionControlsModel,\n", "};\n", "\n", "// AccessGroupInput\n", "const accessGroupInputModel = {\n", " name: 'IAM Admin Group 8',\n", " description: 'This access group template allows admin access to all IAM platform services in the account.',\n", " members: membersInputModel,\n", " assertions: assertionsInputModel,\n", " action_controls: groupActionControlsModel,\n", "};\n", "\n", "// PolicyTemplatesInput\n", "const policyTemplatesInputModel = {\n", " id: testPolicyTemplateId,\n", " version: '1',\n", "};\n", "\n", "const params = {\n", " templateId: testTemplateId,\n", " name: 'IAM Admin Group template 2',\n", " description: 'This access group template allows admin access to all IAM platform services in the account.',\n", " group: accessGroupInputModel,\n", " policyTemplateReferences: [policyTemplatesInputModel],\n", "};\n", "\n", "let res;\n", "try {\n", " res = await iamAccessGroupsService.createTemplateVersion(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "members_action_controls_model = {\n", " 'add': True,\n", " 'remove': False,\n", "}\n", "\n", "members_input_model = {\n", " 'users': ['IBMid-50PJGPKYJJ', 'IBMid-665000T8WY'],\n", " 'action_controls': members_action_controls_model,\n", "}\n", "\n", "condition_input_model = {\n", " 'claim': 'blueGroup',\n", " 'operator': 'CONTAINS',\n", " 'value': '\\\"test-bluegroup-saml\\\"',\n", "}\n", "\n", "rule_input_model = {\n", " 'name': 'Manager group rule',\n", " 'expiration': 12,\n", " 'realm_name': 'https://idp.example.org/SAML2',\n", " 'conditions': [condition_input_model],\n", "}\n", "\n", "assertions_action_controls_model = {\n", " 'add': False,\n", "}\n", "\n", "assertions_input_model = {\n", " 'rules': [rule_input_model],\n", " 'action_controls': assertions_action_controls_model,\n", "}\n", "\n", "access_action_controls_model = {\n", " 'add': False,\n", "}\n", "\n", "group_action_controls_model = {\n", " 'access': access_action_controls_model,\n", "}\n", "\n", "access_group_input_model = {\n", " 'name': 'IAM Admin Group 8',\n", " 'description': 'This access group template allows admin access to all IAM platform services in the account.',\n", " 'members': members_input_model,\n", " 'assertions': assertions_input_model,\n", " 'action_controls': group_action_controls_model,\n", "}\n", "\n", "policy_templates_input_model = {\n", " 'id': test_policy_template_id,\n", " 'version': '1',\n", "}\n", "\n", "response = iam_access_groups_service.create_template_version(\n", " template_id=test_template_id,\n", " name='IAM Admin Group template 2',\n", " description='This access group template allows admin access to all IAM platform services in the account.',\n", " group=access_group_input_model,\n", " policy_template_references=[policy_templates_input_model],\n", ")\n", "create_template_version_response = response.get_result()\n", "\n", "print(json.dumps(create_template_version_response, indent=2))" ] } ] } ] } } }, "get": { "operationId": "list_template_versions", "tags": [ "Template operations" ], "summary": "List template versions", "description": "List all the versions of an access group template.", "parameters": [ { "name": "template_id", "description": "ID of the template that you want to list all versions of", "in": "path", "schema": { "type": "string", "description": "template id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 }, "required": true }, { "name": "limit", "description": "Return up to this limit of results where limit is between 0 and 100.", "in": "query", "schema": { "type": "integer", "description": "limit schema", "maximum": 100, "default": 50 }, "example": 100 }, { "name": "offset", "description": "The offset of the first result item to be returned.", "in": "query", "schema": { "type": "integer", "description": "query schema" }, "example": 0 } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-template.read" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-template.read" } ] }, "responses": { "200": { "description": "Successful response", "headers": { "Transaction-Id": { "description": "An optional transaction id for the request", "schema": { "description": "transaction id schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListTemplateVersionsResponse" }, "example": { "limit": 100, "offset": 0, "total_count": 3, "first": { "href": "https://iam.cloud.ibm.com/v1/group_templates/AccessGroupTemplateId-93ac0a21-d130-490f-8e32-4615e242a161/versions?limit=100" }, "last": { "href": "https://iam.cloud.ibm.com/v1/group_templates/AccessGroupTemplateId-93ac0a21-d130-490f-8e32-4615e242a161/versions?offset=0&limit=100" }, "group_template_versions": [ { "name": "IAM Admin Group template", "description": "This access group template allows admin access to all IAM platform services in the account.", "account_id": "accountID-123", "version": "1", "committed": false, "group": { "name": "IAM Admin Group", "description": "This access group template allows admin access to all IAM platform services in the account.", "members": { "users": [ "IBMid-123", "IBMid-234" ], "services": [ "iam-ServiceId-345", "iam-ServiceId-456" ], "action_controls": { "add": true, "remove": false } }, "assertions": { "rules": [ { "name": "Developer group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "yellowGroup", "operator": "CONTAINS", "value": "test-yellowGroup-saml" } ], "action_controls": { "remove": true } }, { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "blueGroup", "operator": "CONTAINS", "value": "test-bluegroup-saml" } ], "action_controls": { "remove": false } } ], "action_controls": { "add": false, "remove": true } }, "action_controls": { "access": { "add": false } } }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1" }, { "id": "policyTemplateId-234", "version": "1" } ], "href": "https://iam.cloud.ibm.com/v1/group_templates/AccessGroupTemplateId-93ac0a21-d130-490f-8e32-4615e242a161/versions/1", "created_at": "2023-02-13T14:28:18Z", "created_by_id": "IBMid-1234", "last_modified_at": "2023-02-13T14:28:18Z", "last_modified_by_id": "IBMid-1234" }, { "name": "IAM Admin Group template 2", "description": "This access group template allows admin access to all IAM platform services in the account.", "account_id": "accountID-123", "version": "2", "committed": false, "group": { "name": "IAM Admin Group 2", "description": "This access group template allows admin access to all IAM platform services in the account.", "members": { "users": [ "IBMid-123", "IBMid-234" ], "services": [ "iam-ServiceId-345" ], "action_controls": { "add": true, "remove": true } }, "assertions": { "rules": [ { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "blueGroup", "operator": "CONTAINS", "value": "test-bluegroup-saml" } ], "action_controls": { "remove": true } } ], "action_controls": { "add": true, "remove": true } }, "action_controls": { "access": { "add": true } } }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1" }, { "id": "policyTemplateId-234", "version": "1" } ], "href": "https://iam.cloud.ibm.com/v1/group_templates/AccessGroupTemplateId-93ac0a21-d130-490f-8e32-4615e242a161/versions/2", "created_at": "2023-02-13T16:05:20Z", "created_by_id": "IBMid-1234", "last_modified_at": "2023-02-13T16:05:20Z", "last_modified_by_id": "IBMid-1234" }, { "name": "IAM Admin Group template 3", "description": "This access group template allows admin access to all IAM platform services in the account.", "account_id": "accountID-123", "version": "3", "committed": false, "group": { "name": "IAM Admin Group 3", "description": "This access group template allows admin access to all IAM platform services in the account.", "members": { "users": [ "IBMid-123" ], "services": [ "iam-ServiceId-345" ], "action_controls": { "add": true, "remove": true } }, "assertions": { "rules": [ { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "blueGroup", "operator": "CONTAINS", "value": "test-bluegroup-saml" } ], "action_controls": { "remove": true } } ], "action_controls": { "add": true, "remove": true } }, "action_controls": { "access": { "add": true } } }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1" }, { "id": "policyTemplateId-234", "version": "1" } ], "href": "https://iam.cloud.ibm.com/v1/group_templates/AccessGroupTemplateId-93ac0a21-d130-490f-8e32-4615e242a161/versions/3", "created_at": "2023-02-13T14:28:18Z", "created_by_id": "IBMid-1234", "last_modified_at": "2023-02-13T16:18:47Z", "last_modified_by_id": "IBMid-1234" } ] } } } }, "400": { "description": "Invalid payload", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidPayload" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Access denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessDenied" } } } }, "404": { "description": "Template not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateVersionNotFound" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X GET --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " \"{base_url}/v1/group_templates/{template_id}/versions?limit=100&offset=0\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "listTemplateVersionsOptions := &iamaccessgroupsv2.ListTemplateVersionsOptions{\n", " TemplateID: &testTemplateId,\n", " Limit: core.Int64Ptr(int64(100)),\n", "}\n", "\n", "pager, err := iamAccessGroupsService.NewTemplateVersionsPager(listTemplateVersionsOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "\n", "var allResults []iamaccessgroupsv2.ListTemplateVersionResponse\n", "for pager.HasNext() {\n", " nextPage, err := pager.GetNext()\n", " if err != nil {\n", " panic(err)\n", " }\n", " allResults = append(allResults, nextPage...)\n", "}\n", "b, _ := json.MarshalIndent(allResults, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "ListTemplateVersionsOptions listTemplateVersionsOptions = new ListTemplateVersionsOptions.Builder()\n", " .templateId(testTemplateId)\n", " .limit(Long.valueOf(\"100\"))\n", " .build();\n", "\n", "TemplateVersionsPager pager = new TemplateVersionsPager(iamAccessGroupsService, listTemplateVersionsOptions);\n", "List allResults = new ArrayList<>();\n", "while (pager.hasNext()) {\n", " List nextPage = pager.getNext();\n", " allResults.addAll(nextPage);\n", "}\n", "\n", "System.out.println(GsonSingleton.getGson().toJson(allResults));" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " templateId: testTemplateId,\n", " limit: 100,\n", "};\n", "\n", "const allResults = [];\n", "try {\n", " const pager = new IamAccessGroupsV2.TemplateVersionsPager(iamAccessGroupsService, params);\n", " while (pager.hasNext()) {\n", " const nextPage = await pager.getNext();\n", " expect(nextPage).not.toBeNull();\n", " allResults.push(...nextPage);\n", " }\n", " console.log(JSON.stringify(allResults, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "all_results = []\n", "pager = TemplateVersionsPager(\n", " client=iam_access_groups_service,\n", " template_id=test_template_id,\n", " limit=100,\n", ")\n", "while pager.has_next():\n", " next_page = pager.get_next()\n", " assert next_page is not None\n", " all_results.extend(next_page)\n", "\n", "print(json.dumps(all_results, indent=2))" ] } ] } ] } } } }, "/v1/group_templates/{template_id}/versions/{version_num}": { "get": { "operationId": "get_template_version", "tags": [ "Template operations" ], "summary": "Get template version", "description": "Get a specific version of a template.", "parameters": [ { "name": "template_id", "description": "ID of the template to get a specific version of", "in": "path", "schema": { "type": "string", "description": "template id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 }, "required": true }, { "name": "version_num", "description": "Version number", "in": "path", "schema": { "type": "string", "description": "version number schema", "pattern": "^[0-9]+$", "minLength": 1, "maxLength": 50 }, "required": true }, { "name": "verbose", "description": "If `verbose=true`, IAM resource details are returned. If performance is a concern, leave the `verbose` parameter off so that details are not retrieved.", "in": "query", "schema": { "type": "boolean", "description": "verbose schema" }, "example": true }, { "name": "Transaction-Id", "description": "An optional transaction id for the request", "in": "header", "schema": { "type": "string", "description": "transaction id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-template.read" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-template.read" } ] }, "responses": { "200": { "description": "Successful response", "headers": { "ETag": { "description": "Entity tag for the response", "schema": { "description": "etag schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } }, "Transaction-Id": { "description": "An optional transaction id for the request", "schema": { "description": "transaction id schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateVersionResponse" }, "example": { "id": "AccessGroupTemplateId-4be4", "name": "IAM Admin Group template 2", "description": "This access group template allows admin access to all IAM platform services in the account.", "account_id": "accountID-123", "version": "1", "committed": false, "group": { "name": "IAM Admin Group 3", "description": "This access group template allows admin access to all IAM platform services in the account.", "members": { "users": [ "IBMid-123", "IBMid-234" ], "services": [ "iam-ServiceId-345", "iam-ServiceId-456" ], "action_controls": { "add": true, "remove": false } }, "assertions": { "rules": [ { "name": "Developer group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "yellowGroup", "operator": "CONTAINS", "value": "test-yellowGroup-saml" } ], "action_controls": { "remove": true } }, { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "blueGroup", "operator": "CONTAINS", "value": "test-bluegroup-saml" } ], "action_controls": { "remove": false } } ], "action_controls": { "add": false, "remove": true } }, "action_controls": { "access": { "add": false } } }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1" }, { "id": "policyTemplateId-234", "version": "1" } ], "href": "https://iam.cloud.ibm.com/v1/group_templates/AccessGroupTemplateId-608eb2c6-4361-4a47-9cae-d0e1f5824be4/versions/1", "created_at": "2023-02-13T18:51:25Z", "created_by_id": "IBMid-1234", "last_modified_at": "2023-02-13T18:51:25Z", "last_modified_by_id": "IBMid-1234" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Access denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Forbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateVersionNotFound" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X GET --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " \"{base_url}/v1/group_templates/{template_id}/versions/{version_num}?verbose=true\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "getTemplateVersionOptions := iamAccessGroupsService.NewGetTemplateVersionOptions(\n", " testTemplateId,\n", " \"2\",\n", ")\n", "\n", "createTemplateResponse, response, err := iamAccessGroupsService.GetTemplateVersion(getTemplateVersionOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(createTemplateResponse, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "GetTemplateVersionOptions getTemplateVersionOptions = new GetTemplateVersionOptions.Builder()\n", " .templateId(testTemplateId)\n", " .versionNum(\"1\")\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.getTemplateVersion(getTemplateVersionOptions).execute();\n", "TemplateVersionResponse templateVersionResponse = response.getResult();\n", "\n", "System.out.println(templateVersionResponse);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " templateId: testTemplateId,\n", " versionNum: '1',\n", "};\n", "\n", "let res;\n", "try {\n", " res = await iamAccessGroupsService.getTemplateVersion(params);\n", " testTemplateEtag = res.headers['etag'];\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.get_template_version(\n", " template_id=test_template_id,\n", " version_num='1',\n", ")\n", "get_template_version_response = response.get_result()\n", "\n", "print(json.dumps(get_template_version_response, indent=2))" ] } ] } ] } } }, "put": { "operationId": "update_template_version", "tags": [ "Template operations" ], "summary": "Update template version", "description": "Update a template version. You can only update a version that isn't committed. Create a new version if you need to update a committed version.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateVersionRequest" }, "example": { "name": "IAM Admin Group template 2", "description": "This access group template allows admin access to all IAM platform services in the account.", "commit": false, "group": { "name": "IAM Admin Group 8", "description": "This access group template allows admin access to all IAM platform services in the account.", "members": { "users": [ "IBMid-665000T8WY" ], "services": [ "iam-ServiceId-e371b0e5-1c80-48e3-bf12-c6a8ef2b1a11" ], "action_controls": { "add": true, "remove": false } }, "assertions": { "rules": [ { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "blueGroup", "operator": "CONTAINS", "value": "test-bluegroup-saml" } ], "action_controls": { "remove": false } } ], "action_controls": { "add": false } }, "action_controls": { "access": { "add": false } } }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1" }, { "id": "policyTemplateId-234", "version": "1" } ] } } } }, "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-template.update" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-template.update" } ] }, "parameters": [ { "in": "path", "name": "template_id", "description": "ID of the template", "required": true, "schema": { "type": "string", "description": "template id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } }, { "in": "path", "name": "version_num", "description": "Version number of the template", "required": true, "schema": { "type": "string", "description": "version number schema", "pattern": "^[0-9]+$", "minLength": 1, "maxLength": 50 } }, { "in": "header", "name": "If-Match", "description": "ETag value of the template version document", "required": true, "schema": { "type": "string", "description": "etag schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 0, "maxLength": 100 } }, { "name": "Transaction-Id", "description": "transaction id in header", "in": "header", "schema": { "type": "string", "description": "transaction id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 }, "example": "83adf5bd-de790caa3" } ], "responses": { "201": { "description": "Successful response", "headers": { "Transaction-Id": { "description": "An optional transaction id for the request", "schema": { "description": "transaction id schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateVersionResponse" }, "example": { "id": "AccessGroupTemplateId-93ac0a21-d130-490f-8e32-4615e242a161", "name": "IAM Admin Group template 2", "description": "This access group template allows admin access to all IAM platform services in the account.", "account_id": "accountID-123", "version": "2", "committed": false, "group": { "name": "IAM Admin Group 2", "description": "This access group template allows admin access to all IAM platform services in the account.", "members": { "users": [ "IBMid-123" ], "services": [ "iam-ServiceId-345" ], "action_controls": { "add": true, "remove": true } }, "assertions": { "rules": [ { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "blueGroup", "operator": "CONTAINS", "value": "test-bluegroup-saml" } ], "action_controls": { "remove": true } } ], "action_controls": { "add": true, "remove": true } }, "action_controls": { "access": { "add": true } } }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1" }, { "id": "policyTemplateId-234", "version": "1" } ], "href": "\"https://iam.cloud.ibm.com/v1/group_templates/AccessGroupTemplateId-93ac0a21-d130-490f-8e32-4615e242a161/versions/2\"", "created_at": "2023-02-13T14:28:18.000Z", "created_by_id": "IBMid-1234", "last_modified_at": "2023-02-13T16:18:47.000Z", "last_modified_by_id": "IBMid-1234" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdatingCommittedTemplateError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Access denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Forbidden" } } } }, "404": { "description": "Template not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateVersionNotFound" } } } }, "409": { "description": "Status Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateConflictError" } } } }, "412": { "description": "Pre-condition check Fail", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PreConditionFail" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X PUT --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " --header \"If-Match: {if_match}\" \\\n", " --header \"Content-Type: application/json\" \\\n", " --data '{ \"name\": \"IAM Admin Group template 2\", \"description\": \"This access group template allows admin access to all IAM platform services in the account.\", \"group\": { \"name\": \"IAM Admin Group 8\", \"description\": \"This access group template allows admin access to all IAM platform services in the account.\", \"members\": { \"users\": [ \"IBMid-665000T8WY\" ], \"services\": [ \"iam-ServiceId-e371b0e5-1c80-48e3-bf12-c6a8ef2b1a11\" ], \"action_controls\": { \"add\": true, \"remove\": false } }, \"assertions\": { \"rules\": [ { \"name\": \"Manager group rule\", \"expiration\": 12, \"realm_name\": \"https://idp.example.org/SAML2\", \"conditions\": [ { \"claim\": \"blueGroup\", \"operator\": \"CONTAINS\", \"value\": \"test-bluegroup-saml\" } ], \"action_controls\": { \"remove\": false } } ], \"action_controls\": { \"add\": false } }, \"action_controls\": { \"access\": { \"add\": false } } }, \"policy_template_references\": [ { \"id\": \"policyTemplateId-123\", \"version\": \"1\" }, { \"id\": \"policyTemplateId-234\", \"version\": \"1\" } ] }' \\\n", " \"{base_url}/v1/group_templates/{template_id}/versions/{version_num}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "membersActionControlsModel := &iamaccessgroupsv2.MembersActionControls{\n", " Add: core.BoolPtr(true),\n", " Remove: core.BoolPtr(false),\n", "}\n", "\n", "membersInputModel := &iamaccessgroupsv2.Members{\n", " Users: []string{\"IBMid-665000T8WY\"},\n", " ActionControls: membersActionControlsModel,\n", "}\n", "\n", "conditionInputModel := &iamaccessgroupsv2.Conditions{\n", " Claim: core.StringPtr(\"blueGroup\"),\n", " Operator: core.StringPtr(\"CONTAINS\"),\n", " Value: core.StringPtr(`\"test-bluegroup-saml\"`),\n", "}\n", "\n", "rulesActionControlsModel := &iamaccessgroupsv2.RuleActionControls{\n", " Remove: core.BoolPtr(false),\n", "}\n", "\n", "ruleInputModel := &iamaccessgroupsv2.AssertionsRule{\n", " Name: core.StringPtr(\"Manager group rule\"),\n", " Expiration: core.Int64Ptr(int64(12)),\n", " RealmName: core.StringPtr(\"https://idp.example.org/SAML2\"),\n", " Conditions: []iamaccessgroupsv2.Conditions{*conditionInputModel},\n", " ActionControls: rulesActionControlsModel,\n", "}\n", "\n", "assertionsActionControlsModel := &iamaccessgroupsv2.AssertionsActionControls{\n", " Add: core.BoolPtr(false),\n", "}\n", "\n", "assertionsInputModel := &iamaccessgroupsv2.Assertions{\n", " Rules: []iamaccessgroupsv2.AssertionsRule{*ruleInputModel},\n", " ActionControls: assertionsActionControlsModel,\n", "}\n", "\n", "accessActionControlsModel := &iamaccessgroupsv2.AccessActionControls{\n", " Add: core.BoolPtr(false),\n", "}\n", "\n", "groupActionControlsModel := &iamaccessgroupsv2.GroupActionControls{\n", " Access: accessActionControlsModel,\n", "}\n", "\n", "accessGroupInputModel := &iamaccessgroupsv2.AccessGroupRequest{\n", " Name: core.StringPtr(\"IAM Admin Group 8\"),\n", " Description: core.StringPtr(\"This access group template allows admin access to all IAM platform services in the account.\"),\n", " Members: membersInputModel,\n", " Assertions: assertionsInputModel,\n", " ActionControls: groupActionControlsModel,\n", "}\n", "\n", "policyTemplatesInputModel := &iamaccessgroupsv2.PolicyTemplates{\n", " ID: &testPolicyTemplateID,\n", " Version: core.StringPtr(\"1\"),\n", "}\n", "\n", "updateTemplateVersionOptions := iamAccessGroupsService.NewUpdateTemplateVersionOptions(\n", " testTemplateId,\n", " \"2\",\n", " testTemplateVersionEtag,\n", ")\n", "updateTemplateVersionOptions.SetName(\"IAM Admin Group template 2\")\n", "updateTemplateVersionOptions.SetDescription(\"This access group template allows admin access to all IAM platform services in the account.\")\n", "updateTemplateVersionOptions.SetGroup(accessGroupInputModel)\n", "updateTemplateVersionOptions.SetPolicyTemplateReferences([]iamaccessgroupsv2.PolicyTemplates{*policyTemplatesInputModel})\n", "updateTemplateVersionOptions.SetTransactionID(\"83adf5bd-de790caa3\")\n", "\n", "createTemplateResponse, response, err := iamAccessGroupsService.UpdateTemplateVersion(updateTemplateVersionOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(createTemplateResponse, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "MembersActionControls membersActionControlsModel = new MembersActionControls.Builder()\n", " .add(true)\n", " .remove(false)\n", " .build();\n", "Members membersModel = new Members.Builder()\n", " .users(java.util.Arrays.asList(\"IBMid-665000T8WY\"))\n", " .actionControls(membersActionControlsModel)\n", " .build();\n", "Conditions conditionsModel = new Conditions.Builder()\n", " .claim(\"blueGroup\")\n", " .operator(\"CONTAINS\")\n", " .value(\"\\\"test-bluegroup-saml\\\"\")\n", " .build();\n", "RuleActionControls ruleActionControlsModel = new RuleActionControls.Builder()\n", " .remove(false)\n", " .build();\n", "AssertionsRule assertionsRuleModel = new AssertionsRule.Builder()\n", " .name(\"Manager group rule\")\n", " .expiration(Long.valueOf(\"12\"))\n", " .realmName(\"https://idp.example.org/SAML2\")\n", " .conditions(java.util.Arrays.asList(conditionsModel))\n", " .actionControls(ruleActionControlsModel)\n", " .build();\n", "AssertionsActionControls assertionsActionControlsModel = new AssertionsActionControls.Builder()\n", " .add(false)\n", " .build();\n", "Assertions assertionsModel = new Assertions.Builder()\n", " .rules(java.util.Arrays.asList(assertionsRuleModel))\n", " .actionControls(assertionsActionControlsModel)\n", " .build();\n", "AccessActionControls accessActionControlsModel = new AccessActionControls.Builder()\n", " .add(false)\n", " .build();\n", "GroupActionControls groupActionControlsModel = new GroupActionControls.Builder()\n", " .access(accessActionControlsModel)\n", " .build();\n", "AccessGroupRequest accessGroupRequestModel = new AccessGroupRequest.Builder()\n", " .name(\"IAM Admin Group 8\")\n", " .description(\"This access group template allows admin access to all IAM platform services in the account.\")\n", " .members(membersModel)\n", " .assertions(assertionsModel)\n", " .actionControls(groupActionControlsModel)\n", " .build();\n", "PolicyTemplates policyTemplatesModel = new PolicyTemplates.Builder()\n", " .id(testPolicyTemplateId)\n", " .version(\"1\")\n", " .build();\n", "UpdateTemplateVersionOptions updateTemplateVersionOptions = new UpdateTemplateVersionOptions.Builder()\n", " .templateId(testTemplateId)\n", " .versionNum(\"1\")\n", " .ifMatch(testTemplateETag)\n", " .name(\"IAM Admin Group template 2\")\n", " .description(\"This access group template allows admin access to all IAM platform services in the account.\")\n", " .group(accessGroupRequestModel)\n", " .policyTemplateReferences(java.util.Arrays.asList(policyTemplatesModel))\n", " .transactionId(\"83adf5bd-de790caa3\")\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.updateTemplateVersion(updateTemplateVersionOptions).execute();\n", "TemplateVersionResponse templateVersionResponse = response.getResult();\n", "\n", "System.out.println(templateVersionResponse);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "// Request models needed by this operation.\n", "\n", "// MembersActionControls\n", "const membersActionControlsModel = {\n", " add: true,\n", " remove: false,\n", "};\n", "\n", "// MembersInput\n", "const membersInputModel = {\n", " users: ['IBMid-665000T8WY'],\n", " action_controls: membersActionControlsModel,\n", "};\n", "\n", "// ConditionInput\n", "const conditionInputModel = {\n", " claim: 'blueGroup',\n", " operator: 'CONTAINS',\n", " value: '\\\"test-bluegroup-saml\\\"',\n", "};\n", "\n", "// RulesActionControls\n", "const rulesActionControlsModel = {\n", " remove: false,\n", "};\n", "\n", "// RuleInput\n", "const ruleInputModel = {\n", " name: 'Manager group rule',\n", " expiration: 12,\n", " realm_name: 'https://idp.example.org/SAML2',\n", " conditions: [conditionInputModel],\n", " action_controls: rulesActionControlsModel,\n", "};\n", "\n", "// AssertionsActionControls\n", "const assertionsActionControlsModel = {\n", " add: false,\n", "};\n", "\n", "// AssertionsInput\n", "const assertionsInputModel = {\n", " rules: [ruleInputModel],\n", " action_controls: assertionsActionControlsModel,\n", "};\n", "\n", "// AccessActionControls\n", "const accessActionControlsModel = {\n", " add: false,\n", "};\n", "\n", "// GroupActionControls\n", "const groupActionControlsModel = {\n", " access: accessActionControlsModel,\n", "};\n", "\n", "// AccessGroupInput\n", "const accessGroupInputModel = {\n", " name: 'IAM Admin Group 8',\n", " description: 'This access group template allows admin access to all IAM platform services in the account.',\n", " members: membersInputModel,\n", " assertions: assertionsInputModel,\n", " action_controls: groupActionControlsModel,\n", "};\n", "\n", "// PolicyTemplatesInput\n", "const policyTemplatesInputModel = {\n", " id: testPolicyTemplateId,\n", " version: '1',\n", "};\n", "\n", "const params = {\n", " templateId: testTemplateId,\n", " versionNum: '1',\n", " ifMatch: testTemplateEtag,\n", " name: 'IAM Admin Group template 2',\n", " description: 'This access group template allows admin access to all IAM platform services in the account.',\n", " group: accessGroupInputModel,\n", " policyTemplateReferences: [policyTemplatesInputModel],\n", " transactionId: '83adf5bd-de790caa3',\n", "};\n", "\n", "let res;\n", "try {\n", " res = await iamAccessGroupsService.updateTemplateVersion(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "members_action_controls_model = {\n", " 'add': True,\n", " 'remove': False,\n", "}\n", "\n", "members_input_model = {\n", " 'users': ['IBMid-665000T8WY'],\n", " 'action_controls': members_action_controls_model,\n", "}\n", "\n", "condition_input_model = {\n", " 'claim': 'blueGroup',\n", " 'operator': 'CONTAINS',\n", " 'value': '\\\"test-bluegroup-saml\\\"',\n", "}\n", "\n", "rules_action_controls_model = {\n", " 'remove': False,\n", "}\n", "\n", "rule_input_model = {\n", " 'name': 'Manager group rule',\n", " 'expiration': 12,\n", " 'realm_name': 'https://idp.example.org/SAML2',\n", " 'conditions': [condition_input_model],\n", " 'action_controls': rules_action_controls_model,\n", "}\n", "\n", "assertions_action_controls_model = {\n", " 'add': False,\n", "}\n", "\n", "assertions_input_model = {\n", " 'rules': [rule_input_model],\n", " 'action_controls': assertions_action_controls_model,\n", "}\n", "\n", "access_action_controls_model = {\n", " 'add': False,\n", "}\n", "\n", "group_action_controls_model = {\n", " 'access': access_action_controls_model,\n", "}\n", "\n", "access_group_input_model = {\n", " 'name': 'IAM Admin Group 8',\n", " 'description': 'This access group template allows admin access to all IAM platform services in the account.',\n", " 'members': members_input_model,\n", " 'assertions': assertions_input_model,\n", " 'action_controls': group_action_controls_model,\n", "}\n", "\n", "policy_templates_input_model = {\n", " 'id': test_policy_template_id,\n", " 'version': '1',\n", "}\n", "\n", "response = iam_access_groups_service.update_template_version(\n", " template_id=test_template_id,\n", " version_num='1',\n", " if_match=test_template_etag,\n", " name='IAM Admin Group template 2',\n", " description='This access group template allows admin access to all IAM platform services in the account.',\n", " group=access_group_input_model,\n", " policy_template_references=[policy_templates_input_model],\n", " transaction_id='83adf5bd-de790caa3',\n", ")\n", "update_template_version_response = response.get_result()\n", "\n", "print(json.dumps(update_template_version_response, indent=2))" ] } ] } ] } } }, "delete": { "operationId": "delete_template_version", "tags": [ "Template operations" ], "summary": "Delete template version", "description": "Delete a template version. You must remove all assignments for a template version before you can delete it.", "parameters": [ { "name": "template_id", "description": "ID of the template to delete", "in": "path", "schema": { "type": "string", "description": "template id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 }, "required": true }, { "name": "version_num", "description": "version number in path", "in": "path", "schema": { "type": "string", "description": "version number schema", "pattern": "^[0-9]+$", "minLength": 1, "maxLength": 50 }, "required": true }, { "name": "Transaction-Id", "description": "An optional transaction id for the request", "in": "header", "schema": { "type": "string", "description": "transaction id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-template.delete" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-template.delete" } ] }, "responses": { "204": { "description": "Successful response", "headers": { "Transaction-Id": { "description": "An optional transaction id for the request", "schema": { "description": "transaction id schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Access denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Forbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateVersionNotFound" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X DELETE --location --header \"Authorization: Bearer {iam_token}\" \\\n", " \"{base_url}/v1/group_templates/{template_id}/versions/{version_num}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "deleteTemplateVersionOptions := iamAccessGroupsService.NewDeleteTemplateVersionOptions(\n", " testTemplateId,\n", " \"1\",\n", ")\n", "\n", "response, err := iamAccessGroupsService.DeleteTemplateVersion(deleteTemplateVersionOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "if response.StatusCode != 204 {\n", " fmt.Printf(\"\\nUnexpected response status code received from DeleteTemplateVersion(): %d\\n\", response.StatusCode)\n", "}" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "DeleteTemplateVersionOptions deleteTemplateVersionOptions = new DeleteTemplateVersionOptions.Builder()\n", " .templateId(testTemplateId)\n", " .versionNum(\"1\")\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.deleteTemplateVersion(deleteTemplateVersionOptions).execute();" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " templateId: testTemplateId,\n", " versionNum: '1',\n", "};\n", "\n", "try {\n", " await iamAccessGroupsService.deleteTemplateVersion(params);\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.delete_template_version(\n", " template_id=test_template_id,\n", " version_num='2',\n", " transaction_id='testString',\n", ")" ] } ] } ] } } } }, "/v1/group_templates/{template_id}/versions/{version_num}/commit": { "post": { "operationId": "commit_template", "tags": [ "Template operations" ], "summary": "Commit a template", "description": "Commit a template version. You must do this before you can assign a template version to child accounts. After you commit the template version, you can't make any further changes.", "parameters": [ { "name": "template_id", "description": "ID of the template to commit", "in": "path", "schema": { "type": "string", "description": "template id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 }, "required": true }, { "name": "version_num", "description": "version number in path", "in": "path", "schema": { "type": "string", "description": "version number schema", "pattern": "^[0-9]+$", "minLength": 1, "maxLength": 50 }, "required": true }, { "in": "header", "name": "If-Match", "description": "ETag value of the template version document", "required": true, "schema": { "type": "string", "description": "etag schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } }, { "name": "Transaction-Id", "description": "An optional transaction id for the request", "in": "header", "schema": { "type": "string", "description": "transaction id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-template.update" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-template.update" } ] }, "responses": { "204": { "description": "Successful response" }, "400": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateTemplateFailed" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Access denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Forbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateNotFound" } } } }, "412": { "description": "Pre-condition Fail", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PreConditionFail" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X POST --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"If-Match: {if_match}\" \\\n", " \"{base_url}/v1/group_templates/{template_id}/versions/{version_num}/commit\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "commitTemplateOptions := iamAccessGroupsService.NewCommitTemplateOptions(\n", " testTemplateId,\n", " \"2\",\n", " testTemplateLatestVersionEtag,\n", ")\n", "\n", "response, err := iamAccessGroupsService.CommitTemplate(commitTemplateOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "if response.StatusCode != 204 {\n", " fmt.Printf(\"\\nUnexpected response status code received from CommitTemplate(): %d\\n\", response.StatusCode)\n", "}" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "CommitTemplateOptions commitTemplateOptions = new CommitTemplateOptions.Builder()\n", " .templateId(testTemplateId)\n", " .versionNum(\"2\")\n", " .ifMatch(testLatestVersionETag)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.commitTemplate(commitTemplateOptions).execute();" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " templateId: testTemplateId,\n", " versionNum: '2',\n", " ifMatch: testTemplateEtag,\n", "};\n", "\n", "try {\n", " await iamAccessGroupsService.commitTemplate(params);\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.commit_template(\n", " template_id=test_template_id,\n", " version_num='2',\n", " if_match=test_template_latest_etag,\n", ")\n", "commit_template_response = response.get_result()\n", "\n", "print(json.dumps(commit_template_response, indent=2))" ] } ] } ] } } } }, "/v1/group_templates/{template_id}": { "parameters": [ { "name": "template_id", "description": "template id parameter", "in": "path", "schema": { "type": "string", "description": "template id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 }, "required": true }, { "name": "Transaction-Id", "description": "An optional transaction id for the request", "in": "header", "schema": { "type": "string", "description": "transaction id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } ], "get": { "operationId": "get_latest_template_version", "tags": [ "Template operations" ], "description": "Get the latest version of a template.", "parameters": [ { "name": "template_id", "description": "ID of the template to get a specific version of", "in": "path", "schema": { "type": "string", "description": "template id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 }, "required": true }, { "name": "verbose", "description": "If `verbose=true`, IAM resource details are returned. If performance is a concern, leave the `verbose` parameter off so that details are not retrieved.", "in": "query", "schema": { "type": "boolean", "description": "verbose schema" }, "example": true }, { "name": "Transaction-Id", "description": "An optional transaction id for the request", "in": "header", "schema": { "type": "string", "description": "transaction id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } ], "summary": "Get latest template version", "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-template.read" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-template.read" } ] }, "responses": { "200": { "description": "Successful response", "headers": { "Transaction-Id": { "description": "An optional transaction id for the request", "schema": { "description": "transaction id schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateVersionResponse" }, "example": { "id": "AccessGroupTemplateId-4be4", "name": "IAM Admin Group template 2", "description": "This access group template allows admin access to all IAM platform services in the account.", "account_id": "accountID-123", "version": "2", "committed": true, "group": { "name": "IAM Admin Group 8", "description": "This access group template allows admin access to all IAM platform services in the account.", "members": { "users": [ "IBMid-123", "IBMid-234" ], "services": [ "iam-ServiceId-345" ], "action_controls": { "add": true, "remove": true } }, "assertions": { "rules": [ { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "blueGroup", "operator": "CONTAINS", "value": "test-bluegroup-saml" } ], "action_controls": { "remove": true } } ], "action_controls": { "add": true, "remove": true } }, "action_controls": { "access": { "add": true } } }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1" }, { "id": "policyTemplateId-234", "version": "1" } ], "href": "https://iam.cloud.ibm.com/v1/group_templates/AccessGroupTemplateId-608eb2c6-4361-4a47-9cae-d0e1f5824be4/versions/2", "created_at": "2023-02-13T18:51:31Z", "created_by_id": "IBMid-1234", "last_modified_at": "2023-02-13T18:51:31Z", "last_modified_by_id": "IBMid-1234" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Access denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Forbidden" } } } }, "404": { "description": "Template Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateNotFound" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X GET --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " \"{base_url}/v1/group_templates/{template_id}?verbose=true\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "getLatestTemplateVersionOptions := iamAccessGroupsService.NewGetLatestTemplateVersionOptions(\n", " testTemplateId,\n", ")\n", "\n", "createTemplateResponse, response, err := iamAccessGroupsService.GetLatestTemplateVersion(getLatestTemplateVersionOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(createTemplateResponse, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "GetLatestTemplateVersionOptions getLatestTemplateVersionOptions = new GetLatestTemplateVersionOptions.Builder()\n", " .templateId(testTemplateId)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.getLatestTemplateVersion(getLatestTemplateVersionOptions).execute();\n", "TemplateVersionResponse templateVersionResponse = response.getResult();\n", "\n", "System.out.println(templateVersionResponse);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " templateId: testTemplateId,\n", "};\n", "\n", "let res;\n", "try {\n", " res = await iamAccessGroupsService.getLatestTemplateVersion(params);\n", " testTemplateEtag = res.headers['etag'];\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.get_latest_template_version(\n", " template_id=test_template_id,\n", ")\n", "get_latest_template_response = response.get_result()\n", "\n", "print(json.dumps(get_latest_template_response, indent=2))" ] } ] } ] } } }, "delete": { "operationId": "delete_template", "tags": [ "Template operations" ], "summary": "Delete template", "description": "Endpoint to delete a template. All access assigned by that template is deleted from all of the accounts where the template was assigned.", "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-template.delete" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-template.delete" } ] }, "responses": { "204": { "description": "Successful response", "headers": { "Transaction-Id": { "description": "An optional transaction id for the request", "schema": { "description": "transaction id schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Forbidden" } } } }, "404": { "description": "Template Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateNotFound" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X DELETE --location --header \"Authorization: Bearer {iam_token}\" \\\n", " \"{base_url}/v1/group_templates/{template_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "deleteTemplateOptions := iamAccessGroupsService.NewDeleteTemplateOptions(\n", " testTemplateId,\n", ")\n", "\n", "response, err := iamAccessGroupsService.DeleteTemplate(deleteTemplateOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "if response.StatusCode != 204 {\n", " fmt.Printf(\"\\nUnexpected response status code received from DeleteTemplate(): %d\\n\", response.StatusCode)\n", "}" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "DeleteTemplateOptions deleteTemplateOptions = new DeleteTemplateOptions.Builder()\n", " .templateId(testTemplateId)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.deleteTemplate(deleteTemplateOptions).execute();" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " templateId: testTemplateId,\n", "};\n", "\n", "try {\n", " await iamAccessGroupsService.deleteTemplate(params);\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.delete_template(\n", " template_id=test_template_id,\n", " transaction_id='testString',\n", ")" ] } ] } ] } } } }, "/v1/group_assignments": { "post": { "operationId": "create_assignment", "tags": [ "Template assignment operations" ], "summary": "Create assignment", "description": "Assign a template version to accounts that have enabled enterprise-managed IAM. You can specify individual accounts, or an entire account group to assign the template to all current and future child accounts of that account group.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateAssignmentRequest" }, "example": { "template_id": "AccessGroupTemplateId-4be4", "template_version": "1", "target_type": "AccountGroup", "target": "0a45594d0f-123" } } } }, "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-assignment.create" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-assignment.create" } ] }, "parameters": [ { "name": "Transaction-Id", "description": "An optional transaction id for the request", "in": "header", "schema": { "type": "string", "description": "Transaction Id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } ], "responses": { "202": { "description": "Successful response", "headers": { "Transaction-Id": { "description": "An optional transaction id for the request", "schema": { "description": "transaction id schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateAssignmentResponse" }, "example": { "id": "AccessGroupAssignmentId-75bb", "account_id": "account-id-123", "template_id": "AccessGroupTemplateId-4be4", "template_version": "2", "target_type": "AccountGroup", "target": "0a45594d0f-123", "operation": "assign", "status": "in_progress", "href": "https://iam.cloud.ibm.com/v1/group_assignments/AccessGroupAssignmentId-75bb", "created_at": "2023-02-14T10:16:46Z", "created_by_id": "IBMid-1234", "last_modified_at": "2023-02-14T10:16:46Z", "last_modified_by_id": "IBMid-1234" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateAssignmentError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateAssignmentLimitReached" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X POST --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " --header \"Content-Type: application/json\" \\\n", " --data '{ \"template_id\": \"AccessGroupTemplateId-4be4\", \"template_version\": \"1\", \"target_type\": \"AccountGroup\", \"target\": \"0a45594d0f-123\" }' \\\n", " \"{base_url}/v1/group_assignments\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "createAssignmentOptions := iamAccessGroupsService.NewCreateAssignmentOptions(\n", " testTemplateId,\n", " \"2\",\n", " \"AccountGroup\",\n", " testAccountGroupID,\n", ")\n", "\n", "templateCreateAssignmentResponse, response, err := iamAccessGroupsService.CreateAssignment(createAssignmentOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(templateCreateAssignmentResponse, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "CreateAssignmentOptions createAssignmentOptions = new CreateAssignmentOptions.Builder()\n", " .templateId(testTemplateId)\n", " .templateVersion(\"2\")\n", " .targetType(\"AccountGroup\")\n", " .target(testAccountGroupId)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.createAssignment(createAssignmentOptions).execute();\n", "TemplateAssignmentResponse templateAssignmentResponse = response.getResult();\n", "\n", "System.out.println(templateAssignmentResponse);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " templateId: testTemplateId,\n", " templateVersion: '2',\n", " targetType: 'AccountGroup',\n", " target: testAccountGroupId,\n", "};\n", "\n", "let res;\n", "try {\n", " res = await iamAccessGroupsService.createAssignment(params);\n", " testAssignmentId = res.result.id;\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.create_assignment(\n", " template_id=test_template_id,\n", " template_version='2',\n", " target_type='AccountGroup',\n", " target=test_account_group_id,\n", ")\n", "create_assignment_response = response.get_result()\n", "\n", "print(json.dumps(create_assignment_response, indent=2))" ] } ] } ] } } }, "get": { "operationId": "list_assignments", "tags": [ "Template assignment operations" ], "summary": "List assignments", "description": "List template assignments from an enterprise account.", "parameters": [ { "name": "account_id", "description": "Enterprise account ID", "in": "query", "required": true, "schema": { "type": "string", "description": "account id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 }, "example": "accountID-123" }, { "name": "template_id", "in": "query", "description": "Filter results by Template Id", "schema": { "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } }, { "name": "template_version", "in": "query", "description": "Filter results by Template Version", "schema": { "type": "string", "pattern": "^[0-9]+$", "minLength": 1, "maxLength": 2 } }, { "name": "target", "in": "query", "description": "Filter results by the assignment target", "schema": { "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } }, { "name": "status", "in": "query", "description": "Filter results by the assignment status", "schema": { "type": "string", "enum": [ "accepted", "in_progress", "succeeded", "failed" ] } }, { "name": "Transaction-Id", "description": "An optional transaction id for the request", "in": "header", "schema": { "type": "string", "description": "Transaction id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } }, { "name": "limit", "description": "Return up to this limit of results where limit is between 0 and 100.", "in": "query", "schema": { "type": "integer", "description": "limit schema", "default": 50, "maximum": 100 }, "example": 50 }, { "name": "offset", "description": "The offset of the first result item to be returned.", "in": "query", "schema": { "type": "integer", "description": "offset schema" }, "example": 0 } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-assignment.read" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-assignment.read" } ] }, "responses": { "200": { "description": "Successful response", "headers": { "Transaction-Id": { "description": "An optional transaction id for the request", "schema": { "description": "transaction id schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListTemplateAssignmentResponse" }, "example": { "limit": 50, "offset": 0, "total_count": 2, "first": { "href": "https://iam.cloud.ibm.com/v1/group_assignments?limit=50&account_id=accountID-123" }, "last": { "href": "https://iam.cloud.ibm.com/v1/group_assignments?offset=0&limit=50&account_id=accountID-123" }, "assignments": [ { "id": "AccessGroupAssignmentId-4a15", "account_id": "accountID-123", "template_id": "AccessGroupTemplateId-1a8e", "template_version": "2", "target_type": "AccountGroup", "target": "0a45594d0f-123", "operation": "assign", "status": "in_progress", "href": "https://iam.cloud.ibm.com/v1/group_assignments/AccessGroupAssignmentId-4a15", "created_at": "2023-02-06T15:35:22Z", "created_by_id": "IBMid-1234", "last_modified_at": "2023-02-06T15:35:22Z", "last_modified_by_id": "IBMid-1234" }, { "id": "AccessGroupAssignmentId-75bb", "account_id": "accountID-123", "template_id": "AccessGroupTemplateId-4be4", "template_version": "2", "target_type": "AccountGroup", "target": "0a45594d0f-123", "operation": "assign", "status": "in_progress", "href": "https://iam.cloud.ibm.com/v1/group_assignments/AccessGroupAssignmentId-75bb", "created_at": "2023-02-14T10:16:46Z", "created_by_id": "IBMid-1234", "last_modified_at": "2023-02-14T10:16:46Z", "last_modified_by_id": "IBMid-1234" } ] } } } }, "400": { "description": "Invalid Account Id", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidAccountId" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Access denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Forbidden" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X GET --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " \"{base_url}/v1/group_assignments?account_id=accountID-123&limit=50&offset=0\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "listAssignmentsOptions := iamAccessGroupsService.NewListAssignmentsOptions(\n", " testAccountID,\n", ")\n", "\n", "templatesListAssignmentResponse, response, err := iamAccessGroupsService.ListAssignments(listAssignmentsOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(templatesListAssignmentResponse, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "ListAssignmentsOptions listAssignmentsOptions = new ListAssignmentsOptions.Builder()\n", " .accountId(testAccountId)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.listAssignments(listAssignmentsOptions).execute();\n", "ListTemplateAssignmentResponse listTemplateAssignmentResponse = response.getResult();\n", "\n", "System.out.println(listTemplateAssignmentResponse);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " accountId: testAccountId,\n", "};\n", "\n", "let res;\n", "try {\n", " res = await iamAccessGroupsService.listAssignments(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.list_assignments(\n", " account_id=test_account_id,\n", ")\n", "list_assignment_response = response.get_result()\n", "\n", "print(json.dumps(list_assignment_response, indent=2))" ] } ] } ] } } } }, "/v1/group_assignments/{assignment_id}": { "get": { "operationId": "get_assignment", "tags": [ "Template assignment operations" ], "summary": "Get assignment", "description": "Get a specific template assignment.", "parameters": [ { "name": "assignment_id", "description": "Assignment ID", "in": "path", "schema": { "type": "string", "description": "assignment id", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 100 }, "required": true }, { "name": "Transaction-Id", "description": "An optional transaction id for the request", "in": "header", "schema": { "type": "string", "description": "Transaction id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 0, "maxLength": 100 } }, { "description": "Returns resources access group template assigned, possible values `true` or `false`", "name": "verbose", "in": "query", "schema": { "type": "boolean", "default": false } } ], "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-assignment.read" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-assignment.read" } ] }, "responses": { "200": { "description": "Successful response", "headers": { "Transaction-Id": { "description": "An optional transaction id for the request", "schema": { "description": "transaction id schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } }, "ETag": { "description": "Entity tag for the response", "schema": { "description": "etag schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateAssignmentVerboseResponse" }, "example": { "id": "AccessGroupAssignmentId-15", "account_id": "accountID-123", "template_id": "AccessGroupTemplateId-15", "template_version": "2", "target_type": "AccountGroup", "target": "0a45594d0-123", "operation": "create", "status": "in_progress", "resources": [ { "target": "fa9df03b8-123", "access_group": { "group": { "id": "IAM Admin Group for deployment version 1", "resource": "", "error": "", "status": "not_started" }, "members": [ { "id": "IBMid-123", "resource": "", "error": "", "status": "not_started" }, { "id": "IBMid-234", "resource": "", "error": "", "status": "not_started" }, { "id": "iam-ServiceId-345", "resource": "", "error": "", "status": "not_started" }, { "id": "iam-ServiceId-456", "resource": "", "error": "", "status": "not_started" } ], "rules": [ { "id": "0", "name": "Manager group rule", "resource": "", "error": "", "status": "not_started" } ] }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1", "resource": "", "error": "", "status": "not_started" }, { "id": "policyTemplateId-234", "version": "1", "resource": "", "error": "", "status": "not_started" } ] }, { "target": "2351c46371-123", "access_group": { "group": { "id": "IAM Admin Group for deployment version 1", "resource": "", "error": "", "status": "not_started" }, "members": [ { "id": "IBMid-123", "resource": "", "error": "", "status": "not_started" }, { "id": "IBMid-234", "resource": "", "error": "", "status": "not_started" }, { "id": "iam-ServiceId-345", "resource": "", "error": "", "status": "not_started" }, { "id": "iam-ServiceId-456", "resource": "", "error": "", "status": "not_started" } ], "rules": [ { "id": "0", "name": "Manager group rule", "resource": "", "error": "", "status": "not_started" } ] }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1", "resource": "", "error": "", "status": "not_started" }, { "id": "policyTemplateId-234", "version": "1", "resource": "", "error": "", "status": "not_started" } ] } ], "href": "https://iam.cloud.ibm.com/v1/group_assignments/AccessGroupAssignmentId-15", "created_at": "2023-02-06T15:35:22Z", "created_by_id": "IBMid-1234", "last_modified_at": "2023-02-06T15:35:22Z", "last_modified_by_id": "IBMid-1234" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateAssignmentError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Access denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Forbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateAssignmentNotFound" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X GET --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " \"{base_url}/v1/group_assignments/{assignment_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "getAssignmentOptions := iamAccessGroupsService.NewGetAssignmentOptions(\n", " testAssignmentID,\n", ")\n", "\n", "getTemplateAssignmentResponse, response, err := iamAccessGroupsService.GetAssignment(getAssignmentOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(getTemplateAssignmentResponse, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "GetAssignmentOptions getAssignmentOptions = new GetAssignmentOptions.Builder()\n", " .assignmentId(testAssignmentId)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.getAssignment(getAssignmentOptions).execute();\n", "TemplateAssignmentVerboseResponse templateAssignmentVerboseResponse = response.getResult();\n", "\n", "System.out.println(templateAssignmentVerboseResponse);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " assignmentId: testAssignmentId,\n", "};\n", "\n", "let res;\n", "try {\n", " res = await iamAccessGroupsService.getAssignment(params);\n", " testAssignmentEtag = res.headers['etag'];\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.get_assignment(\n", " assignment_id=test_assignment_id,\n", ")\n", "get_assignment_response = response.get_result()\n", "\n", "print(json.dumps(get_assignment_response, indent=2))" ] } ] } ] } } }, "patch": { "operationId": "update_assignment", "tags": [ "Template assignment operations" ], "summary": "Update Assignment", "description": "Endpoint to update template assignment", "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-assignment.update" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-assignment.update" } ] }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateTemplateAssignmentRequest" }, "example": { "template_version": "1" } } } }, "parameters": [ { "name": "assignment_id", "in": "path", "description": "ID of the Assignment Record", "required": true, "schema": { "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 0, "maxLength": 100 } }, { "name": "If-Match", "in": "header", "description": "Version of the Assignment to be updated. Specify the version that you retrieved when reading the Assignment. This value helps identifying parallel usage of this API. Pass * to indicate to update any version available. This might result in stale updates.\n", "required": true, "schema": { "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 0, "maxLength": 100 } } ], "responses": { "202": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateAssignmentVerboseResponse" }, "example": { "id": "AccessGroupAssignmentId-15", "account_id": "accountID-123", "template_id": "AccessGroupTemplateId-15", "template_version": "2", "target_type": "AccountGroup", "target": "0a45594d0-123", "operation": "create", "status": "in_progress", "resources": [ { "target": "fa9df03b8-123", "access_group": { "group": { "id": "IAM Admin Group for deployment version 1", "resource": "", "error": "", "status": "not_started" }, "members": [ { "id": "IBMid-123", "resource": "", "error": "", "status": "not_started" }, { "id": "IBMid-234", "resource": "", "error": "", "status": "not_started" }, { "id": "iam-ServiceId-345", "resource": "", "error": "", "status": "not_started" }, { "id": "iam-ServiceId-456", "resource": "", "error": "", "status": "not_started" } ], "rules": [ { "id": "0", "name": "Manager group rule", "resource": "", "error": "", "status": "not_started" } ] }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1", "resource": "", "error": "", "status": "not_started" }, { "id": "policyTemplateId-234", "version": "1", "resource": "", "error": "", "status": "not_started" } ] }, { "target": "2351c46371-123", "access_group": { "group": { "id": "IAM Admin Group for deployment version 1", "resource": "", "error": "", "status": "not_started" }, "members": [ { "id": "IBMid-123", "resource": "", "error": "", "status": "not_started" }, { "id": "IBMid-234", "resource": "", "error": "", "status": "not_started" }, { "id": "iam-ServiceId-345", "resource": "", "error": "", "status": "not_started" }, { "id": "iam-ServiceId-456", "resource": "", "error": "", "status": "not_started" } ], "rules": [ { "id": "0", "name": "Manager group rule", "resource": "", "error": "", "status": "not_started" } ] }, "policy_template_references": [ { "id": "policyTemplateId-123", "version": "1", "resource": "", "error": "", "status": "not_started" }, { "id": "policyTemplateId-234", "version": "1", "resource": "", "error": "", "status": "not_started" } ] } ], "href": "https://iam.cloud.ibm.com/v1/group_assignments/AccessGroupAssignmentId-15", "created_at": "2023-02-06T15:35:22Z", "created_by_id": "IBMid-1234", "last_modified_at": "2023-02-06T15:35:22Z", "last_modified_by_id": "IBMid-1234" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateAssignmentError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateAssignmentLimitReached" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X PATCH --location --header \"Authorization: Bearer {iam_token}\" \\\n", " --header \"Accept: application/json\" \\\n", " --header \"If-Match: {if_match}\" \\\n", " --header \"Content-Type: application/json\" \\\n", " --data '{ \"template_version\": \"1\" }' \\\n", " \"{base_url}/v1/group_assignments/{assignment_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "updateAssignmentOptions := iamAccessGroupsService.NewUpdateAssignmentOptions(\n", " testAssignmentID,\n", " testAssignmentEtag,\n", " \"2\",\n", ")\n", "\n", "getTemplateAssignmentResponse, response, err := iamAccessGroupsService.UpdateAssignment(updateAssignmentOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "b, _ := json.MarshalIndent(getTemplateAssignmentResponse, \"\", \" \")\n", "fmt.Println(string(b))" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "UpdateAssignmentOptions updateAssignmentOptions = new UpdateAssignmentOptions.Builder()\n", " .assignmentId(testAssignmentId)\n", " .ifMatch(testAssignmentETag)\n", " .templateVersion(\"2\")\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.updateAssignment(updateAssignmentOptions).execute();\n", "TemplateAssignmentVerboseResponse templateAssignmentVerboseResponse = response.getResult();\n", "\n", "System.out.println(templateAssignmentVerboseResponse);" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " assignmentId: testAssignmentId,\n", " ifMatch: testAssignmentEtag,\n", " templateVersion: \"2\",\n", "};\n", "\n", "let res;\n", "try {\n", " res = await iamAccessGroupsService.updateAssignment(params);\n", " console.log(JSON.stringify(res.result, null, 2));\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.update_assignment(\n", " assignment_id=test_assignment_id,\n", " template_version=\"2\",\n", " if_match=test_assignment_etag,\n", ")\n", "update_assignment_response = response.get_result()\n", "\n", "print(json.dumps(update_assignment_response, indent=2))" ] } ] } ] } } }, "delete": { "operationId": "delete_assignment", "tags": [ "Template assignment operations" ], "summary": "Delete assignment", "description": "Delete an access group template assignment.", "x-ibm-permissions": { "actions": [ { "name": "iam-groups.group-assignment.delete" } ] }, "x-ibm-events": { "events": [ { "name": "iam-groups.group-assignment.delete" } ] }, "parameters": [ { "name": "assignment_id", "description": "assignment id path parameter", "in": "path", "schema": { "type": "string", "description": "Assignment Id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 0, "maxLength": 100 }, "required": true }, { "name": "Transaction-Id", "description": "An optional transaction id for the request", "in": "header", "schema": { "type": "string", "description": "Transaction Id schema", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 0, "maxLength": 100 } } ], "responses": { "202": { "description": "Successful response", "headers": { "Transaction-Id": { "description": "An optional transaction id for the request", "schema": { "description": "transaction id schema", "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } } }, "400": { "description": "Invalid Assignment", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidAssignment" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Unauthorized" } } } }, "403": { "description": "Access denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Forbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TemplateAssignmentNotFound" } } } }, "409": { "description": "Template assignment in progress error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AssignmentInProgress" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalServerError" } } } } }, "x-sdk-operations": { "request-examples": { "curl": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "curl -X DELETE --location --header \"Authorization: Bearer {iam_token}\" \\\n", " \"{base_url}/v1/group_assignments/{assignment_id}\"" ] } ] } ], "go": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "deleteAssignmentOptions := iamAccessGroupsService.NewDeleteAssignmentOptions(\n", " testAssignmentID,\n", ")\n", "\n", "response, err := iamAccessGroupsService.DeleteAssignment(deleteAssignmentOptions)\n", "if err != nil {\n", " panic(err)\n", "}\n", "if response.StatusCode != 202 {\n", " fmt.Printf(\"\\nUnexpected response status code received from DeleteAssignment(): %d\\n\", response.StatusCode)\n", "}" ] } ] } ], "java": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "DeleteAssignmentOptions deleteAssignmentOptions = new DeleteAssignmentOptions.Builder()\n", " .assignmentId(testAssignmentId)\n", " .build();\n", "\n", "Response response = iamAccessGroupsService.deleteAssignment(deleteAssignmentOptions).execute();" ] } ] } ], "node": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "const params = {\n", " assignmentId: testAssignmentId,\n", "};\n", "\n", "try {\n", " await iamAccessGroupsService.deleteAssignment(params);\n", "} catch (err) {\n", " console.warn(err);\n", "}" ] } ] } ], "python": [ { "name": "Example request", "example": [ { "type": "code", "source": [ "response = iam_access_groups_service.delete_assignment(\n", " assignment_id=test_assignment_id,\n", ")\n", "delete_assignment_response = response.get_result()\n", "\n", "print(json.dumps(delete_assignment_response, indent=2))" ] } ] } ] } } } } }, "servers": [ { "url": "https://iam.cloud.ibm.com" } ], "components": { "links": { "AccessGroupId": { "description": "Link to access_group_id parameter.", "operationId": "get_access_group", "parameters": { "access_group_id": "$response.body#/id" } }, "AccessGroupETag": { "description": "Link to If-Match parameter", "operationId": "update_access_group", "parameters": { "if-match": "$response.header#/ETag" } } }, "parameters": { "AccessGroupIdParam": { "in": "path", "name": "access_group_id", "description": "The access group identifier.", "required": true, "schema": { "type": "string" }, "x-linkback": "#/components/links/AccessGroupId" }, "AccountIdParam": { "name": "account_id", "description": "Account ID of the API keys(s) to query. If a service IAM ID is specified in iam_id then account_id must match the account of the IAM ID. If a user IAM ID is specified in iam_id then then account_id must match the account of the Authorization token.", "in": "query", "required": true, "schema": { "type": "string" } }, "IAMIdParam": { "in": "path", "name": "iam_id", "description": "The IAM identifier.", "required": true, "schema": { "type": "string" } }, "TransactionIdHeaderParam": { "in": "header", "name": "Transaction-Id", "required": false, "description": "An optional transaction ID can be passed to your request, which can be useful for tracking calls through multiple services by using one identifier. The header key must be set to Transaction-Id and the value is anything that you choose. If no transaction ID is passed in, then a random ID is generated.", "schema": { "type": "string" } } }, "requestBodies": { "RuleRequest": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleRequest" }, "example": { "name": "Manager group rule", "expiration": 12, "realm_name": "https://idp.example.org/SAML2", "conditions": [ { "claim": "isManager", "operator": "EQUALS", "value": "true" } ] } } }, "required": true } }, "schemas": { "ErrorContainer": { "description": "ErrorContainer contains the Transaction-Id, status code, and an array of errors that are being returned to the user.", "type": "object", "properties": { "status_code": { "type": "integer", "description": "The HTTP status code of the response." }, "trace": { "type": "string", "description": "The request's Transaction-Id." }, "errors": { "type": "array", "description": "List of errors encountered in the service request.", "items": { "$ref": "#/components/schemas/Error" } } } }, "Error": { "type": "object", "description": "Error contains the code and message for an error returned to the user code is a string identifying the problem, examples \"missing_field\", \"reserved_value\" message is a string explaining the solution to the problem that was encountered.", "properties": { "code": { "type": "string", "description": "A human-readable error code represented by a snake case string." }, "message": { "type": "string", "description": "A specific error message that details the issue or an action to take." } } }, "HrefStruct": { "type": "object", "description": "A link object.", "properties": { "href": { "type": "string", "description": "A string containing the link’s URL." } } }, "CreateGroupRequest": { "type": "object", "description": "Name of the access to group to be created and a description.", "required": [ "name" ], "properties": { "name": { "description": "Give the access group a unique name that doesn't conflict with an existing access group in the account. This field is case-insensitive and has a limit of 100 characters.", "type": "string" }, "description": { "description": "Assign an optional description for the access group. This field has a limit of 250 characters.", "type": "string" } } }, "UpdateGroupRequest": { "type": "object", "description": "The new name and description of the access group.", "properties": { "name": { "description": "Give the access group a unique name that doesn't conflict with an existing access group in the account. This field is case-insensitive and has a limit of 100 characters.", "type": "string" }, "description": { "description": "Assign an optional description for the access group. This field has a limit of 250 characters.", "type": "string" } } }, "Group": { "type": "object", "description": "An IAM access group.", "properties": { "id": { "type": "string", "description": "The group's access group ID." }, "name": { "type": "string", "description": "The group's name." }, "description": { "type": "string", "description": "The group's description - if defined." }, "account_id": { "type": "string", "description": "The account id where the group was created." }, "created_at": { "type": "string", "format": "date-time", "description": "The timestamp of when the group was created.", "readOnly": true }, "created_by_id": { "type": "string", "description": "The `iam_id` of the entity that created the group.", "readOnly": true }, "last_modified_at": { "type": "string", "format": "date-time", "description": "The timestamp of when the group was last edited.", "readOnly": true }, "last_modified_by_id": { "type": "string", "description": "The `iam_id` of the entity that last modified the group name or description.", "readOnly": true }, "href": { "type": "string", "description": "A url to the given group resource." }, "is_federated": { "type": "boolean", "description": "This is set to true if rules exist for the group." }, "crn": { "type": "string", "description": "CRN of the access group" } } }, "GroupsList": { "type": "object", "description": "The list of access groups returned as part of a response.", "required": [ "limit", "offset", "total_count" ], "properties": { "limit": { "type": "integer", "description": "Limit on how many items can be returned." }, "offset": { "type": "integer", "description": "The offset of the first item returned in the result set." }, "total_count": { "type": "integer", "description": "The total number of items that match the query." }, "first": { "$ref": "#/components/schemas/HrefStruct" }, "previous": { "$ref": "#/components/schemas/HrefStruct" }, "next": { "$ref": "#/components/schemas/HrefStruct" }, "last": { "$ref": "#/components/schemas/HrefStruct" }, "groups": { "type": "array", "description": "An array of access groups.", "items": { "$ref": "#/components/schemas/Group" } } } }, "AddGroupMembersRequest": { "type": "object", "description": "An array of member objects to add to an access group.", "properties": { "members": { "description": "An array of member objects to add to an access group.", "type": "array", "items": { "type": "object", "required": [ "iam_id", "type" ], "properties": { "iam_id": { "description": "The IBMid, service ID or trusted profile ID of the member.", "type": "string" }, "type": { "description": "The type of the member, must be either \"user\", \"service\" or \"profile\".", "type": "string" } } } } } }, "AddMembershipMultipleGroupsRequest": { "type": "object", "description": "A list of different access groups to add a given member, and the given member's type.", "properties": { "type": { "type": "string", "description": "The type of the member, must be either \"user\", \"service\" or \"profile\"." }, "groups": { "type": "array", "description": "The ids of the access groups a given member is to be added to.", "items": { "type": "string", "description": "Access group id." } } } }, "AddMembershipMultipleGroupsResponse": { "type": "object", "description": "The response from the add member to multiple access groups request.", "properties": { "iam_id": { "type": "string", "description": "The iam_id of a member." }, "groups": { "type": "array", "description": "The list of access groups a member was added to.", "items": { "type": "object", "properties": { "access_group_id": { "type": "string", "description": "The access group that the member is to be added to." }, "status_code": { "type": "integer", "description": "The outcome of the add membership operation on this `access_group_id`." }, "trace": { "type": "string", "description": "A transaction-id that can be used for debugging purposes." }, "errors": { "type": "array", "description": "List of errors encountered when adding member to access group.", "items": { "$ref": "#/components/schemas/Error" } } } } } } }, "AddGroupMembersResponse": { "type": "object", "description": "The members added to an access group.", "properties": { "members": { "type": "array", "description": "The members added to an access group.", "items": { "type": "object", "properties": { "iam_id": { "type": "string", "description": "The IBMid or Service Id of the member." }, "type": { "type": "string", "description": "The member type - either `user`, `service` or `profile`." }, "created_at": { "type": "string", "format": "date-time", "description": "The timestamp of when the membership was created." }, "created_by_id": { "type": "string", "description": "The `iam_id` of the entity that created the membership." }, "status_code": { "type": "integer", "description": "The outcome of the operation on this `iam_id`." }, "trace": { "type": "string", "description": "A transaction-id that can be used for debugging purposes." }, "errors": { "type": "array", "description": "A list of errors that occurred when trying to add members to a group.", "items": { "$ref": "#/components/schemas/Error" } } } } } } }, "DeleteFromAllGroupsResponse": { "type": "object", "description": "The response from the delete member from access groups request.", "properties": { "iam_id": { "type": "string", "description": "The `iam_id` of the member to removed from groups." }, "groups": { "type": "array", "description": "The groups the member was removed from.", "items": { "type": "object", "properties": { "access_group_id": { "type": "string", "description": "The access group that the member is to be deleted from." }, "status_code": { "type": "integer", "description": "The outcome of the delete operation on this `access_group_id`." }, "trace": { "type": "string", "description": "A transaction-id that can be used for debugging purposes." }, "errors": { "type": "array", "description": "A list of errors that occurred when trying to remove a member from groups.", "items": { "$ref": "#/components/schemas/Error" } } } } } } }, "DeleteGroupBulkMembersRequest": { "type": "object", "description": "The members to remove from an access group.", "properties": { "members": { "type": "array", "description": "The `iam_id`s to remove from the access group. This field has a limit of 50 `iam_id`s.", "items": { "type": "string", "description": "An `iam_id` to remove from the access group." } } } }, "DeleteGroupBulkMembersResponse": { "type": "object", "description": "The access group id and the members removed from it.", "properties": { "access_group_id": { "type": "string", "description": "The access group id." }, "members": { "type": "array", "description": "The `iam_id`s removed from the access group.", "items": { "type": "object", "properties": { "iam_id": { "type": "string", "description": "The `iam_id` to be deleted." }, "trace": { "type": "string", "description": "A transaction-id that can be used for debugging purposes." }, "status_code": { "type": "integer", "description": "The outcome of the delete membership operation on this `access_group_id`." }, "errors": { "type": "array", "description": "A list of errors that occurred when trying to remove a member from groups.", "items": { "$ref": "#/components/schemas/Error" } } } } } } }, "GroupMembersList": { "type": "object", "description": "The members of a group.", "required": [ "limit", "offset", "total_count" ], "properties": { "limit": { "type": "integer", "description": "Limit on how many items can be returned." }, "offset": { "type": "integer", "description": "The offset of the first item returned in the result set." }, "total_count": { "type": "integer", "description": "The total number of items that match the query." }, "first": { "$ref": "#/components/schemas/HrefStruct" }, "previous": { "$ref": "#/components/schemas/HrefStruct" }, "next": { "$ref": "#/components/schemas/HrefStruct" }, "last": { "$ref": "#/components/schemas/HrefStruct" }, "members": { "type": "array", "description": "The members of an access group.", "items": { "$ref": "#/components/schemas/ListGroupMembersResponseMember" } } } }, "ListGroupMembersResponseMember": { "type": "object", "description": "A single member of an access group in a list.", "properties": { "iam_id": { "type": "string", "description": "The IBMid or Service Id of the member." }, "type": { "type": "string", "description": "The member type - either `user`, `service` or `profile`." }, "membership_type": { "type": "string", "description": "The membership type - either `static` or `dynamic`." }, "name": { "type": "string", "description": "The user's or service id's name." }, "email": { "type": "string", "description": "If the member type is user, this is the user's email." }, "description": { "type": "string", "description": "If the member type is service, this is the service id's description." }, "href": { "type": "string", "description": "A url to the given member resource." }, "created_at": { "type": "string", "format": "date-time", "description": "The timestamp the membership was created at." }, "created_by_id": { "type": "string", "description": "The `iam_id` of the entity that created the membership." } } }, "RuleRequest": { "type": "object", "description": "A new dynamic rule to add to an access group.", "required": [ "expiration", "realm_name", "conditions" ], "properties": { "name": { "type": "string", "description": "The name of the dynaimic rule." }, "expiration": { "type": "integer", "description": "Session duration in hours. Access group membership is revoked after this time period expires. Users must log back in to refresh their access group membership.", "minimum": 1 }, "realm_name": { "type": "string", "description": "The URL of the identity provider (IdP)." }, "conditions": { "type": "array", "description": "A list of conditions that identities must satisfy to gain access group membership.", "items": { "$ref": "#/components/schemas/RuleConditions" } } } }, "Rule": { "type": "object", "description": "A dynamic rule of an access group.", "properties": { "id": { "type": "string", "description": "The rule id." }, "name": { "type": "string", "description": "The name of the rule." }, "expiration": { "type": "integer", "description": "Session duration in hours. Access group membership is revoked after this time period expires. Users must log back in to refresh their access group membership. Must be ≥ 1." }, "realm_name": { "type": "string", "description": "The URL of the identity provider." }, "access_group_id": { "type": "string", "description": "The group id that the dynamic rule is assigned to." }, "account_id": { "type": "string", "description": "The account id that the group is in." }, "conditions": { "type": "array", "description": "A list of conditions that identities must satisfy to gain access group membership.", "items": { "$ref": "#/components/schemas/RuleConditions" } }, "created_at": { "type": "string", "format": "date-time", "description": "The timestamp for when the rule was created." }, "created_by_id": { "type": "string", "description": "The `iam_id` of the entity that created the dynamic rule." }, "last_modified_at": { "type": "string", "format": "date-time", "description": "The timestamp for when the dynamic rule was last edited." }, "last_modified_by_id": { "type": "string", "description": "The IAM id that last modified the rule." } } }, "RuleConditions": { "type": "object", "description": "The conditions of a dynamic rule.", "required": [ "claim", "operator", "value" ], "properties": { "claim": { "type": "string", "description": "The claim to evaluate against. This will be found in the `ext` claims of a user's login request." }, "operator": { "type": "string", "description": "The operation to perform on the claim.", "enum": [ "EQUALS", "EQUALS_IGNORE_CASE", "IN", "NOT_EQUALS_IGNORE_CASE", "NOT_EQUALS", "CONTAINS" ] }, "value": { "type": "string", "description": "The stringified JSON value that the claim is compared to using the operator." } } }, "RulesList": { "type": "object", "description": "A list of dynamic rules attached to the access group.", "properties": { "rules": { "type": "array", "description": "A list of dynamic rules.", "items": { "$ref": "#/components/schemas/Rule" } } } }, "AccountSettingsRequest": { "type": "object", "description": "The access groups settings for a specific account.", "properties": { "public_access_enabled": { "type": "boolean", "description": "This flag controls the public access feature within the account. It is set to true by default. Note: When this flag is set to false, all policies within the account attached to the Public Access group will be deleted." } } }, "AccountSettings": { "type": "object", "description": "The access groups settings for a specific account.", "properties": { "account_id": { "type": "string", "description": "The account id of the settings being shown." }, "last_modified_at": { "type": "string", "format": "date-time", "description": "The timestamp the settings were last edited at." }, "last_modified_by_id": { "type": "string", "description": "The `iam_id` of the entity that last modified the settings." }, "public_access_enabled": { "type": "boolean", "description": "This flag controls the public access feature within the account. It is set to true by default. Note: When this flag is set to false, all policies within the account attached to the Public Access group will be deleted." } } }, "MembersActionControls": { "type": "object", "description": "Control whether or not access group administrators in child accounts can add and remove members from the enterprise-managed access group in their account.", "properties": { "add": { "type": "boolean", "description": "Action control for adding child account members to an enterprise-managed access group. If an access group administrator in a child account adds a member, they can always remove them.\nNote that if conflicts arise between an update to this control in a new version and members added by an administrator in the child account, you must resolve those conflicts in the child account. This prevents breaking access in the child account. For more information, see [Working with versions] (https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-working-with-versions#new-version-scenarios).\n" }, "remove": { "type": "boolean", "description": "Action control for removing enterprise-managed members from an enterprise-managed access group.\nNote that if an enterprise member is removed from an enterprise-managed access group in a child account and you reassign the template, the membership is reinstated.\n" } } }, "RuleActionControls": { "type": "object", "description": "Control whether or not access group administrators in child accounts can update and remove this dynamic rule in the enterprise-managed access group in their account.This overrides outer level AssertionsActionControls.", "properties": { "remove": { "type": "boolean", "description": "Action control for removing this enterprise-managed dynamic rule" } } }, "AssertionsActionControls": { "type": "object", "description": "Control whether or not access group administrators in child accounts can add, remove, and update dynamic rules for the enterprise-managed access group in their account. The inner level RuleActionControls override these `remove` and `update` action controls.", "properties": { "add": { "type": "boolean", "description": "Action control for adding dynamic rules to an enterprise-managed access group. If an access group administrator in a child account adds a dynamic rule, they can always update or remove it.\nNote that if conflicts arise between an update to this control and rules added or updated by an administrator in the child account, you must resolve those conflicts in the child account. This prevents breaking access that the rules might grant in the child account. For more information, see [Working with versions].\n" }, "remove": { "type": "boolean", "description": "Action control for removing enterprise-managed dynamic rules in an enterprise-managed access group.\nNote that if a rule is removed from an enterprise-managed access group by an administrator in a child account and and you reassign the template, the rule is reinstated.\n" } } }, "AccessActionControls": { "type": "object", "description": "Control whether or not access group administrators in child accounts can add access policies to the enterprise-managed access group in their account.", "properties": { "add": { "type": "boolean", "description": "Action control for adding access policies to an enterprise-managed access group in a child account. If an access group administrator in a child account adds a policy, they can always update or remove it.\nNote that if conflicts arise between an update to this control in a new version and polices added to the access group by an administrator in a child account, you must resolve those conflicts in the child account. This prevents breaking access in the child account. For more information, see [Working with versions](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-working-with-versions#new-version-scenarios).\n" } } }, "GroupActionControls": { "type": "object", "description": "Access group action controls component", "properties": { "access": { "$ref": "#/components/schemas/AccessActionControls" } } }, "Members": { "type": "object", "description": "Array of enterprise users to add to the template. All enterprise users that you add to the template must be invited to the child accounts where the template is assigned.", "properties": { "users": { "type": "array", "description": "Array of enterprise users to add to the template. All enterprise users that you add to the template must be invited to the child accounts where the template is assigned.", "minItems": 0, "maxItems": 50, "items": { "type": "string", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 1, "maxLength": 100 } }, "services": { "type": "array", "description": "Array of service IDs to add to the template", "minItems": 0, "maxItems": 50, "items": { "type": "string", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 100 } }, "action_controls": { "$ref": "#/components/schemas/MembersActionControls" } } }, "Conditions": { "type": "object", "description": "Condition Input component", "properties": { "claim": { "type": "string", "description": "The key in the key:value pair", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 100 }, "operator": { "type": "string", "description": "Compares the claim and the value", "pattern": "^[a-zA-Z-]+$", "minLength": 1, "maxLength": 10 }, "value": { "type": "string", "description": "The value in the key:value pair", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 100 } } }, "AssertionsRule": { "type": "object", "description": "Rule Input component", "properties": { "name": { "type": "string", "description": "Dynamic rule name", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 1, "maxLength": 100 }, "expiration": { "type": "integer", "description": "Session duration in hours. Access group membership is revoked after this time period expires. Users must log back in to refresh their access group membership." }, "realm_name": { "type": "string", "description": "The identity provider (IdP) URL", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 1, "maxLength": 100 }, "conditions": { "type": "array", "description": "Conditions of membership. You can think of this as a key:value pair.", "minItems": 0, "maxItems": 50, "items": { "$ref": "#/components/schemas/Conditions" } }, "action_controls": { "$ref": "#/components/schemas/RuleActionControls" } } }, "Assertions": { "type": "object", "description": "Assertions Input Component", "properties": { "rules": { "type": "array", "description": "Dynamic rules to automatically add federated users to access groups based on specific identity attributes.", "minItems": 0, "maxItems": 50, "items": { "$ref": "#/components/schemas/AssertionsRule" } }, "action_controls": { "$ref": "#/components/schemas/AssertionsActionControls" } } }, "AccessGroupRequest": { "type": "object", "description": "Access Group Component", "required": [ "name" ], "properties": { "name": { "type": "string", "description": "Give the access group a unique name that doesn't conflict with other templates access group name in the given account. This is shown in child accounts.", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 1, "maxLength": 100 }, "description": { "type": "string", "description": "Access group description. This is shown in child accounts.", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 0, "maxLength": 250 }, "members": { "$ref": "#/components/schemas/Members" }, "assertions": { "$ref": "#/components/schemas/Assertions" }, "action_controls": { "$ref": "#/components/schemas/GroupActionControls" } } }, "AccessGroupResponse": { "type": "object", "description": "Access Group Component", "required": [ "name" ], "properties": { "name": { "type": "string", "description": "Give the access group a unique name that doesn't conflict with other templates access group name in the given account. This is shown in child accounts.", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 1, "maxLength": 100 }, "description": { "type": "string", "description": "Access group description. This is shown in child accounts.", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 0, "maxLength": 250 }, "members": { "$ref": "#/components/schemas/Members" }, "assertions": { "$ref": "#/components/schemas/Assertions" }, "action_controls": { "$ref": "#/components/schemas/GroupActionControls" } } }, "PolicyTemplates": { "type": "object", "description": "Policy Templates Input component", "properties": { "id": { "type": "string", "description": "Policy template ID", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 100 }, "version": { "type": "string", "description": "Policy template version", "pattern": "^[0-9]+$", "minLength": 1, "maxLength": 2 } } }, "TemplateRequest": { "type": "object", "description": "Create Template Input Component", "required": [ "name", "account_id" ], "properties": { "name": { "type": "string", "description": "Give the access group template a unique name that doesn't conflict with an existing access group templates in the account.", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 1, "maxLength": 100 }, "description": { "type": "string", "description": "Assign an optional description for the access group template.", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 0, "maxLength": 250 }, "account_id": { "type": "string", "description": "Enterprise account id in which the template will be created.", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 }, "commit": { "type": "boolean", "description": "A boolean parameter that specifies whether to commit the access group template at the time of creation. Templates must be committed before they can be assigned to child accounts." }, "group": { "$ref": "#/components/schemas/AccessGroupRequest" }, "policy_template_references": { "type": "array", "description": "Existing policy templates that you can reference to assign access in the Access group input component", "minItems": 0, "maxItems": 50, "items": { "$ref": "#/components/schemas/PolicyTemplates" } } } }, "TemplateVersionRequest": { "type": "object", "description": "Create Template Version Input component", "properties": { "name": { "type": "string", "description": "This is an optional field. If the field is included it will change the name value for all existing versions of the template..", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 1, "maxLength": 100 }, "description": { "type": "string", "description": "Assign an optional description for the access group template version.", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 0, "maxLength": 250 }, "commit": { "type": "boolean", "description": "A boolean parameter that specifies whether to commit the access group template at the time of updation/Create Template Version. Templates must be committed before they can be assigned to child accounts." }, "group": { "$ref": "#/components/schemas/AccessGroupRequest" }, "policy_template_references": { "type": "array", "minItems": 0, "maxItems": 50, "items": { "$ref": "#/components/schemas/PolicyTemplates" }, "description": "The policy templates associated with the template version." } } }, "TemplateAssignmentRequest": { "type": "object", "description": "Create Template Assignment Input component", "required": [ "template_id", "template_version", "target_type", "target" ], "properties": { "template_id": { "type": "string", "description": "The unique identifier of the template to be assigned.", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 100 }, "template_version": { "type": "string", "description": "The version number of the template to be assigned.", "pattern": "^[0-9]+$", "minLength": 1, "maxLength": 2 }, "target_type": { "type": "string", "description": "The type of the entity to which the template should be assigned, e.g. 'Account', 'AccountGroup', etc.", "pattern": "^[a-zA-Z-]+$", "minLength": 7, "maxLength": 12, "enum": [ "Account", "AccountGroup" ] }, "target": { "type": "string", "description": "The unique identifier of the entity to which the template should be assigned.", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 50 } } }, "TemplateResponse": { "type": "object", "x-resource-name": "iam_access_group_template", "required": [ "id", "name", "description", "account_id", "version", "committed", "group", "policy_template_references", "href", "created_at", "created_by_id", "last_modified_at", "last_modified_by_id" ], "description": "Response output for template", "properties": { "id": { "type": "string", "description": "The ID of the access group template", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 100 }, "name": { "type": "string", "description": "The name of the access group template", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 1, "maxLength": 100 }, "description": { "type": "string", "description": "The description of the access group template", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 0, "maxLength": 250 }, "account_id": { "type": "string", "description": "The ID of the account to which the access group template is assigned", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 100 }, "version": { "type": "string", "description": "The version of the access group template", "pattern": "^[0-9]+$", "minLength": 1, "maxLength": 2 }, "committed": { "type": "boolean", "description": "A boolean indicating whether the access group template is committed. You must commit a template before you can assign it to child accounts." }, "group": { "$ref": "#/components/schemas/AccessGroupResponse" }, "policy_template_references": { "type": "array", "minItems": 0, "maxItems": 100, "items": { "$ref": "#/components/schemas/PolicyTemplates" }, "description": "References to policy templates assigned to the access group template" }, "href": { "type": "string", "description": "The URL of the access group template resource", "minLength": 1, "maxLength": 1000, "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$" }, "created_at": { "type": "string", "format": "date-time", "description": "The date and time when the access group template was created", "minLength": 1, "maxLength": 100 }, "created_by_id": { "type": "string", "description": "The ID of the user who created the access group template", "minLength": 1, "maxLength": 100, "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$" }, "last_modified_at": { "type": "string", "format": "date-time", "description": "The date and time when the access group template was last modified", "minLength": 1, "maxLength": 100 }, "last_modified_by_id": { "type": "string", "description": "The ID of the user who last modified the access group template", "minLength": 1, "maxLength": 100, "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$" } } }, "TemplateVersionResponse": { "type": "object", "x-resource-name": "iam_access_group_template_version", "required": [ "id", "name", "description", "account_id", "version", "committed", "group", "policy_template_references", "href", "created_at", "created_by_id", "last_modified_at", "last_modified_by_id" ], "description": "Response output for template", "properties": { "id": { "type": "string", "description": "The ID of the access group template", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 100 }, "name": { "type": "string", "description": "The name of the access group template", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 1, "maxLength": 100 }, "description": { "type": "string", "description": "The description of the access group template", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 0, "maxLength": 250 }, "account_id": { "type": "string", "description": "The ID of the account to which the access group template is assigned", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 100 }, "version": { "type": "string", "description": "The version of the access group template", "pattern": "^[0-9]+$", "minLength": 1, "maxLength": 2 }, "committed": { "type": "boolean", "description": "A boolean indicating whether the access group template is committed. You must commit a template before you can assign it to child accounts." }, "group": { "$ref": "#/components/schemas/AccessGroupResponse" }, "policy_template_references": { "type": "array", "minItems": 0, "maxItems": 100, "items": { "$ref": "#/components/schemas/PolicyTemplates" }, "description": "References to policy templates assigned to the access group template" }, "href": { "type": "string", "description": "The URL of the access group template resource", "minLength": 1, "maxLength": 1000, "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$" }, "created_at": { "type": "string", "format": "date-time", "description": "The date and time when the access group template was created", "minLength": 1, "maxLength": 100 }, "created_by_id": { "type": "string", "description": "The ID of the user who created the access group template", "minLength": 1, "maxLength": 100, "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$" }, "last_modified_at": { "type": "string", "format": "date-time", "description": "The date and time when the access group template was last modified", "minLength": 1, "maxLength": 100 }, "last_modified_by_id": { "type": "string", "description": "The ID of the user who last modified the access group template", "minLength": 1, "maxLength": 100, "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$" } } }, "GroupTemplate": { "type": "object", "required": [ "id", "name", "description", "version", "committed", "group", "policy_template_references", "href", "created_at", "created_by_id", "last_modified_at", "last_modified_by_id" ], "description": "Response output for template", "properties": { "id": { "type": "string", "description": "The ID of the access group template", "pattern": "^[a-zA-Z0-9_-]+$", "minLength": 1, "maxLength": 100 }, "name": { "type": "string", "description": "The name of the access group template", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 1, "maxLength": 100 }, "description": { "type": "string", "description": "The description of the access group template", "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$", "minLength": 0, "maxLength": 250 }, "version": { "type": "string", "description": "The version of the access group template", "pattern": "^[0-9]+$", "minLength": 1, "maxLength": 2 }, "committed": { "type": "boolean", "description": "A boolean indicating whether the access group template is committed. You must commit a template before you can assign it to child accounts." }, "group": { "$ref": "#/components/schemas/AccessGroupResponse" }, "policy_template_references": { "type": "array", "minItems": 0, "maxItems": 100, "items": { "$ref": "#/components/schemas/PolicyTemplates" }, "description": "References to policy templates assigned to the access group template" }, "href": { "type": "string", "description": "The URL of the access group template resource", "minLength": 1, "maxLength": 1000, "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$" }, "created_at": { "type": "string", "format": "date-time", "description": "The date and time when the access group template was created", "minLength": 1, "maxLength": 100 }, "created_by_id": { "type": "string", "description": "The ID of the user who created the access group template", "minLength": 1, "maxLength": 100, "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$" }, "last_modified_at": { "type": "string", "format": "date-time", "description": "The date and time when the access group template was last modified", "minLength": 1, "maxLength": 100 }, "last_modified_by_id": { "type": "string", "description": "The ID of the user who last modified the access group template", "minLength": 1, "maxLength": 100, "pattern": "^[a-zA-Z0-9!@#$%^&*()_+{}:;\"'<>,.?/|\\-\\s]+$" } } }, "ListTemplatesResponse": { "type": "object", "description": "Response object for listing templates", "properties": { "limit": { "type": "integer", "description": "The maximum number of IAM resources to return" }, "offset": { "type": "integer", "description": "The offset of the first IAM resource in the list" }, "total_count": { "type": "integer", "description": "The total number of IAM resources in the list" }, "first": { "$ref": "#/components/schemas/HrefStruct" }, "previous": { "$ref": "#/components/schemas/HrefStruct" }, "next": { "$ref": "#/components/schemas/HrefStruct" }, "last": { "$ref": "#/components/schemas/HrefStruct" }, "group_templates": { "type": "array", "minItems": 0, "maxItems": 50, "items": { "$ref": "#/components/schemas/GroupTemplate" }, "description": "A list of access group templates" } }, "required": [ "limit", "offset", "total_count", "first", "last", "group_templates" ] }, "ListTemplateVersionsResponse": { "type": "object", "description": "Response object for listing template versions", "properties": { "limit": { "type": "integer", "description": "The maximum number of IAM resources to return" }, "offset": { "type": "integer", "description": "The offset of the first IAM resource in the list" }, "total_count": { "type": "integer", "description": "The total number of IAM resources in the list" }, "first": { "$ref": "#/components/schemas/HrefStruct" }, "previous": { "$ref": "#/components/schemas/HrefStruct" }, "next": { "$ref": "#/components/schemas/HrefStruct" }, "last": { "$ref": "#/components/schemas/HrefStruct" }, "group_template_versions": { "type": "array", "minItems": 0, "maxItems": 50, "items": { "$ref": "#/components/schemas/ListTemplateVersionResponse" }, "description": "A list of access group template versions" } }, "required": [ "limit", "offset", "total_count", "first", "last", "group_template_versions" ] }, "ListTemplateVersionResponse": { "type": "object", "required": [ "name", "description", "account_id", "version", "committed", "group", "policy_template_references", "href", "created_at", "created_by_id", "last_modified_at", "last_modified_by_id" ], "description": "Response object for a single access group template version", "properties": { "name": { "type": "string", "description": "The name of the template" }, "description": { "type": "string", "description": "The description of the template" }, "account_id": { "type": "string", "description": "The ID of the account associated with the template" }, "version": { "type": "string", "description": "The version number of the template" }, "committed": { "type": "boolean", "description": "A boolean indicating whether the template is committed or not" }, "group": { "$ref": "#/components/schemas/AccessGroupResponse" }, "policy_template_references": { "type": "array", "minItems": 0, "maxItems": 50, "items": { "$ref": "#/components/schemas/PolicyTemplates" }, "description": "A list of policy templates associated with the template" }, "href": { "type": "string", "description": "The URL to the template resource" }, "created_at": { "type": "string", "description": "The date and time the template was created" }, "created_by_id": { "type": "string", "description": "The ID of the user who created the template" }, "last_modified_at": { "type": "string", "description": "The date and time the template was last modified" }, "last_modified_by_id": { "type": "string", "description": "The ID of the user who last modified the template" } } }, "ListTemplateAssignmentResponse": { "description": "Response object containing a list of template assignments", "type": "object", "required": [ "limit", "offset", "total_count", "first", "last", "assignments" ], "properties": { "limit": { "type": "integer", "format": "int64", "description": "Maximum number of items returned in the response" }, "offset": { "type": "integer", "format": "int64", "description": "Index of the first item returned in the response" }, "total_count": { "type": "integer", "format": "int64", "description": "Total number of items matching the query" }, "first": { "$ref": "#/components/schemas/HrefStruct" }, "last": { "$ref": "#/components/schemas/HrefStruct" }, "assignments": { "type": "array", "minItems": 0, "maxItems": 100, "items": { "$ref": "#/components/schemas/TemplateAssignmentResponse" }, "description": "List of template assignments" } } }, "TemplateAssignmentResponse": { "description": "Response object containing the details of a template assignment", "x-resource-name": "iam_access_group_template_assignment", "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the assignment" }, "account_id": { "type": "string", "description": "The ID of the account that the assignment belongs to" }, "template_id": { "type": "string", "description": "The ID of the template that the assignment is based on" }, "template_version": { "type": "string", "description": "The version of the template that the assignment is based on" }, "target_type": { "type": "string", "description": "The type of the entity that the assignment applies to", "enum": [ "Account", "AccountGroup" ] }, "target": { "type": "string", "description": "The ID of the entity that the assignment applies to" }, "operation": { "type": "string", "description": "The operation that the assignment applies to (e.g. 'assign', 'update', 'remove')", "enum": [ "assign", "update", "remove" ] }, "status": { "type": "string", "description": "The status of the assignment (e.g. 'accepted', 'in_progress', 'succeeded', 'failed', 'superseded')", "enum": [ "accepted", "in_progress", "succeeded", "failed", "superseded" ] }, "href": { "type": "string", "description": "The URL of the assignment resource" }, "created_at": { "type": "string", "format": "date-time", "description": "The date and time when the assignment was created" }, "created_by_id": { "type": "string", "description": "The user or system that created the assignment" }, "last_modified_at": { "type": "string", "format": "date-time", "description": "The date and time when the assignment was last updated" }, "last_modified_by_id": { "type": "string", "description": "The user or system that last updated the assignment" } }, "required": [ "id", "account_id", "template_id", "template_version", "target_type", "target", "operation", "status", "href", "created_at", "created_by_id", "last_modified_at", "last_modified_by_id" ] }, "ResourceListWithTargetAccountID": { "type": "object", "description": "Object containing details of a resource list with target account ID", "properties": { "target": { "type": "string", "description": "The ID of the entity that the resource list applies to" }, "group": { "$ref": "#/components/schemas/AssignmentResourceAccessGroup" }, "policy_template_references": { "type": "array", "minItems": 0, "maxItems": 100, "items": { "$ref": "#/components/schemas/AssignmentResourceEntry" }, "description": "List of policy template references for the resource list" } } }, "TemplateAssignmentVerboseResponse": { "type": "object", "description": "Response object containing the details of a template assignment", "properties": { "id": { "type": "string", "description": "The ID of the assignment" }, "account_id": { "type": "string", "description": "The ID of the account that the assignment belongs to" }, "template_id": { "type": "string", "description": "The ID of the template that the assignment is based on" }, "template_version": { "type": "string", "description": "The version of the template that the assignment is based on" }, "target_type": { "type": "string", "description": "The type of the entity that the assignment applies to" }, "target": { "type": "string", "description": "The ID of the entity that the assignment applies to" }, "operation": { "type": "string", "description": "The operation that the assignment applies to (e.g. 'create', 'update', 'delete')" }, "status": { "type": "string", "description": "The status of the assignment (e.g. 'pending', 'success', 'failure')" }, "resources": { "type": "array", "minItems": 0, "maxItems": 100, "items": { "$ref": "#/components/schemas/ResourceListWithTargetAccountID" }, "description": "List of resources for the assignment" }, "href": { "type": "string", "description": "The URL of the assignment resource" }, "created_at": { "type": "string", "format": "date-time", "description": "The date and time when the assignment was created" }, "created_by_id": { "type": "string", "description": "The user or system that created the assignment" }, "last_modified_at": { "type": "string", "format": "date-time", "description": "The date and time when the assignment was last updated" }, "last_modified_by_id": { "type": "string", "description": "The user or system that last updated the assignment" } }, "required": [ "id", "account_id", "template_id", "template_version", "target_type", "target", "operation", "status", "href", "created_at", "created_by_id", "last_modified_at", "last_modified_by_id" ] }, "AssignmentResourceEntry": { "type": "object", "description": "Assignment resource entry", "properties": { "id": { "type": "string", "description": "Assignment Resource Entry Id." }, "name": { "type": "string", "description": "Optional name of the resource." }, "version": { "type": "string", "description": "Optional version of the resource." }, "resource": { "type": "string", "description": "Resource in assignment resource entry." }, "error": { "type": "string", "description": "Error in assignment resource entry." }, "operation": { "type": "string", "description": "Optional operation on the resource." }, "status": { "type": "string", "description": "Status of assignment resource entry." } }, "required": [ "id", "resource", "error", "status" ] }, "AssignmentResourceAccessGroup": { "type": "object", "description": "Assignment Resource Access Group", "properties": { "group": { "$ref": "#/components/schemas/AssignmentResourceEntry" }, "members": { "type": "array", "minItems": 0, "maxItems": 100, "items": { "$ref": "#/components/schemas/AssignmentResourceEntry" }, "description": "List of member resources of the group." }, "rules": { "type": "array", "minItems": 0, "maxItems": 100, "items": { "$ref": "#/components/schemas/AssignmentResourceEntry" }, "description": "List of rules associated with the group." } }, "required": [ "group", "members", "rules" ] }, "BadRequest": { "type": "object", "description": "Bad request schema", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 400 }, "code": { "type": "string", "description": "Error code for the response", "example": "template_not_valid" }, "message": { "type": "string", "description": "Error message for the response", "example": "The template is not valid" }, "trace": { "type": "string", "description": "Additional information about the error", "example": "An error occurred while processing the template" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message", "errors" ] }, "Unauthorized": { "type": "object", "description": "Unauthorized schema", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 401 }, "code": { "type": "string", "description": "Error code for the response", "example": "invalid_token" }, "message": { "type": "string", "description": "Error message for the response", "example": "The token is either missing or invalid" }, "trace": { "type": "string", "description": "Additional information about the error", "example": "An error occurred while authorizing the call" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "AccessDenied": { "type": "object", "description": "Access denied response", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 403 }, "code": { "type": "string", "description": "Error code for the response", "example": "templates_per_account_limit_reached" }, "message": { "type": "string", "description": "Error message for the response", "example": "The limit of 50 templates has been reached on this account." }, "trace": { "type": "string", "description": "Additional information about the error", "example": "This limit is enforced to prevent issues and ensure fair usage for all customers." }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "Forbidden": { "type": "object", "description": "Forbidden", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 403 }, "code": { "type": "string", "description": "Error code for the response", "example": "forbidden" }, "message": { "type": "string", "description": "Error message for the response", "example": "Forbidden: You don't have the required access to complete this action. Contact your account owner for access" }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "TemplateAssignmentNotFound": { "type": "object", "description": "Template Assignment not found", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 404 }, "code": { "type": "string", "description": "Error code for the response", "example": "template_assignment_not_found" }, "message": { "type": "string", "description": "Error message for the response", "example": "Failed to find the specified access group template assignment: AccessGroupAssignmentId-15" }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "TemplateNotFound": { "type": "object", "description": "Template Not Found Error", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 404 }, "code": { "type": "string", "description": "Error code for the response", "example": "template_not_found" }, "message": { "type": "string", "description": "Error message for the response", "example": "Failed to find the specified access group template: AccessGroup-123" }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "TemplateVersionNotFound": { "type": "object", "description": "Template Version Not Found Error", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 404 }, "code": { "type": "string", "description": "Error code for the response", "example": "template_not_found" }, "message": { "type": "string", "description": "Error message for the response", "example": "Failed to find the specified access group template version." }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "InternalServerError": { "type": "object", "description": "Internal server error", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 500 }, "code": { "type": "string", "description": "Error code for the response", "example": "service_unavailable" }, "message": { "type": "string", "description": "Error message for the response", "example": "Service is unavailable." }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "TooManyRequests": { "type": "object", "description": "Template Conflict too many requests", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 429 }, "code": { "type": "string", "description": "Error code for the response", "example": "too_many_requests" }, "message": { "type": "string", "description": "Error message for the response", "example": "The user has sent too many requests in a given amount of time." }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "TemplateVersionLimitReached": { "type": "object", "description": "Template Version per template limit reached", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 403 }, "code": { "type": "string", "description": "Error code for the response", "example": "template_versions_per_template_limit_reached" }, "message": { "type": "string", "description": "Error message for the response", "example": "The limit of %10 template versions has been reached on this template." }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "InvalidPayload": { "type": "object", "description": "Invalid Payload", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 403 }, "code": { "type": "string", "description": "Error code for the response", "example": "invalid_payload" }, "message": { "type": "string", "description": "Error message for the response", "example": "Payload contains invalid/missing data. Reason: invalid limit query" }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "UpdatingCommittedTemplateError": { "type": "object", "description": "Updating committed template error", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 400 }, "code": { "type": "string", "description": "Error code for the response", "example": "updating_committed_template" }, "message": { "type": "string", "description": "Error message for the response", "example": "Error updating committed template version." }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "TemplateConflictError": { "type": "object", "description": "Template Conflict Error", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 409 }, "code": { "type": "string", "description": "Error code for the response", "example": "template_conflict_error" }, "message": { "type": "string", "description": "Error message for the response", "example": "An access group template with the access group name 'Access group Admin' already exists. Enter a different access group name." }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "PreConditionFail": { "type": "object", "description": "Pre-condition check Fail", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 412 }, "code": { "type": "string", "description": "Error code for the response", "example": "incorrect_etag" }, "message": { "type": "string", "description": "Error message for the response", "example": "If-Match header contains incorrect/invalid etag." }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "TemplateAssignmentError": { "type": "object", "description": "Template Assignment Error", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 400 }, "code": { "type": "string", "description": "Error code for the response", "example": "template_assignment_error" }, "message": { "type": "string", "description": "Error message for the response", "example": "Error assigning uncommitted template." }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "InvalidAccountId": { "type": "object", "description": "Invalid Account Id Error", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 400 }, "code": { "type": "string", "description": "Error code for the response", "example": "account_id_validation_failed" }, "message": { "type": "string", "description": "Error message for the response", "example": "An error occurred when validating the account id, accountID-123" }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "UpdateTemplateFailed": { "type": "object", "description": "Template Not Updated Failure", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 400 }, "code": { "type": "string", "description": "Error code for the response", "example": "template_not_updated" }, "message": { "type": "string", "description": "Error message for the response", "example": "Failed to update the specified access group template: AccessGroupTemp-123" }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "TemplateAssignmentLimitReached": { "type": "object", "description": "Template Assignment Limit Reached", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 403 }, "code": { "type": "string", "description": "Error code for the response", "example": "template_assignments_per_template_limit_reached" }, "message": { "type": "string", "description": "Error message for the response", "example": "The limit of 1 template assignment has been reached on this template." }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "InvalidAssignment": { "type": "object", "description": "Invalid Template Assignment", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 400 }, "code": { "type": "string", "description": "Error code for the response", "example": "template_assignment_not_valid" }, "message": { "type": "string", "description": "Error message for the response", "example": "Template assignment is not valid. Reason: Template-assignment-123" }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "AssignmentInProgress": { "type": "object", "description": "Template Assignment in progress error", "properties": { "status_code": { "type": "integer", "format": "int32", "description": "HTTP status code of the response", "example": 409 }, "code": { "type": "string", "description": "Error code for the response", "example": "template_assignment_in_progress" }, "message": { "type": "string", "description": "Error message for the response", "example": "Template assignment is in progress" }, "trace": { "type": "string", "description": "Additional information about the error" }, "errors": { "type": "array", "description": "An array of error models", "minItems": 1, "maxItems": 10, "items": { "$ref": "#/components/schemas/ErrorModel" } } }, "required": [ "status_code", "code", "message" ] }, "ErrorModel": { "type": "object", "description": "Error model schema", "properties": { "code": { "type": "string", "description": "Error code for the response", "example": "template_not_found", "enum": [ "template_not_found", "templates_per_account_limit_reached", "template_assignment_in_progress", "template_assignment_not_found", "too_many_requests", "invalid_request", "server_error", "template_versions_per_template_limit_reached", "invalid_payload", "updating_committed_template", "template_conflict_error", "incorrect_etag", "template_assignment_error", "account_id_validation_failed", "template_not_updated", "template_assignment_not_valid", "template_assignments_per_template_limit_reached" ] }, "message": { "type": "string", "description": "Error message for the response", "example": "The specified template could not be found" }, "details": { "$ref": "#/components/schemas/ErrorDetails" }, "more_info": { "type": "string", "description": "Additional information or a URL for more information about the error" } }, "required": [ "code", "message" ] }, "ErrorDetails": { "type": "object", "description": "Additional details about the error", "properties": { "reason": { "type": "string", "description": "Detailed reason for the error", "example": "The template was deleted or moved" }, "suggested_action": { "type": "string", "description": "Suggested action to resolve the error", "example": "Please specify a valid template ID" } }, "required": [ "reason" ] }, "UpdateTemplateAssignmentRequest": { "required": [ "template_version" ], "type": "object", "properties": { "template_version": { "type": "string", "description": "Template version which shall be applied to the assignment.", "pattern": "^[0-9]+$", "minLength": 1, "maxLength": 50 } }, "description": "Input body parameters for the Assignment update" } }, "responses": { "Unauthorized": { "description": "Invalid Access Token.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "invalid_token", "message": "The token is either missing or invalid" } ], "status_code": 401 } } } } } }, "Forbidden": { "description": "Access Denied.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "forbidden", "message": "Forbidden: You don't have the required access to complete this action. Contact your account owner for access" } ], "status_code": 403 } } } } } }, "InternalServerError": { "description": "Internal Server Error.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "internal_server_error", "message": "Internal Server Error" } ], "status_code": 500 } } } } } }, "ServiceUnavailable": { "description": "Service Unavailable.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "service_unavailable", "message": "Service Temporarily Unavailable" } ], "status_code": 503 } } } } } }, "GroupNotFound": { "description": "Not Found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "group_not_found", "message": "Failed to find the specified access group: " } ], "status_code": 404 } } } } } }, "NoGroupsFound": { "description": "Not Found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "no_groups_found", "message": "No groups found for member: " } ], "status_code": 404 } } } } } }, "RuleNotFound": { "description": "Rule not found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorContainer" }, "examples": { "response": { "value": { "trace": "12345678-abcd-1a2b-a1b2-1234567890ab", "errors": [ { "code": "BXNIM0102E", "message": "Object type ClaimRule with ID not found" } ], "status_code": 404 } } } } } } } } }