Users

User defines a subject entitled to connect to servers within monitored IT infrastructure. Detailed object definition (i.e. unique login and domain combination, full name, email address etc.) enables precise accountability of user actions when login and password are substituted with a shared account login credentials.

Data Structures: UserModel

UserModel

Attribute	Type	Required	Description
id	string	yes	Read-only object identifier. Requires read, modify, or delete right on object type user, depending on the HTTP method used (GET, PATCH, or DELETE respectively).
name	string	yes	Unique user’s name
blocked	boolean; default value false	yes
reason	string
domain	string		User’s domain
privileges	string-array		Read-only
full_name	string		User’s full name
email	string		User’s email address
organization	string		User’s organization name
phone	string		User’s phone number
ad_domain	string		User’s AD domain. Also used as the UPN suffix when the user is identified during an OpenID Connect sign-in.
ldap_base	string		User’s LDAP base
language	string; default value en	yes	Interface language
previous_success	datetime		Read-only
previous_success_location	string		Read-only
last_success	datetime		Read-only
last_success_location	string		Read-only
last_failure	datetime		Read-only
last_failure_location	string		Read-only
failures	number; default value 0	yes	Number of authentication failures
password_complexity	boolean; default value false	yes	Enable password complexity settings
external_sync	boolean; default value false	yes
scim_managed	boolean; default value false	yes
fudo_blocked	boolean		Read-only
scim_blocked	boolean		Read-only
external_id	string		Unique external identifier
scim_username	string		Unique SCIM username (case-insensitive)
scim_email_type	string		Type of the email address provisioned over SCIM, for example work.
scim_phone_type	string		Type of the phone number provisioned over SCIM, for example work.
first_name	string	`
last_name	string	`
valid_since	datetime (h:m:s); default value -infinity	yes	Beginning access time
valid_to	datetime (h:m:s); default value infinity	yes	Ending access time
user_directory_id	string		Id of the user’s LDAP server
source_ip	string	`
fido2_user_handle	string		Read-only
fudo_network_status	string {disabled, invited, untrusted, trusted}		Read-only. Fudo ShareAccess membership state, derived from the user’s fnet authentication method. Value disabled means the user has no such method.
fudo_network_username	string		Read-only. Fudo ShareAccess user name (the X-Signed-By value) taken from the user’s fnet authentication method. null when the user has no such method.
fudo_network_method_id	string		Read-only. Id of the fnet authentication method carrying the user’s Fudo ShareAccess identity. Use it to address the method on the /user/<user_id>/authentication/<id> endpoint. null when the user has no such method.
fudo_network_pubkey_fingerprint	string		Read-only; expensive to use. SHA256 fingerprint of the user’s Fudo ShareAccess key pair. null when the user has no fnet authentication method or has not uploaded their keys yet.
oidc_subs	object-array		OpenID Connect sub claims. Read-only; expensive to use.
roles	object-array		Read-only; expensive to use.
role_names	string-array		Read-only; hidden; expensive to use.
role_ids	string-array		Read-only; hidden; expensive to use.
safes	object-array		Read-only; expensive to use; JSON object array containing id, name, and position of assigned safes.
safe_ids	string-array		Read-only; hidden; expensive to use
safe_names	string-array		Read-only; hidden; expensive to use
group_ids	string-array		IDs of the groups the user belongs to. Read-only; hidden; expensive to use.
authentication_methods	object-array		Read-only; expensive to use; JSON object array containing id, type, and position of configured authentication methods.
authentication_method_types	string-array		Types of authentication methods used by this user. Read-only; hidden; expensive to use.
external_authentication_ids	string-array		IDs of external authentications used by this user. Read-only; hidden; expensive to use.
analysis_context	string		AI analysis context. Given to the AI that analyzes this user’s sessions. Describe what is normal here so expected activity is not flagged as a risk.
rights	string-array		Read-only; list of rights the subject has to this object.
module_psm_enabled	boolean; default value true	yes	If the user is enabled in the PSM module. Value false disables licence auto-activation.
module_psm_last_activity	datetime		Timestamp of the last activity of the user in the PSM module. Last established session or secret checkout via account. Read-only.
module_psm_status	string {active, inactive, disabled}	yes	User activation status in the PSM module. Read-only; expensive to use.
module_vault_enabled	boolean; default value true	yes	If the user is enabled in the Vault module. Value false disables licence auto-activation.
module_vault_last_activity	datetime		Timestamp of the last activity of the user in the Vault module. Last secret checkout in password vault. Read-only.
module_vault_status	string {active, inactive, disabled}	yes	User activation status in the Vault module. Read-only; expensive to use.
created_at	datetime		Read-only. Timestamp of creation.
modified_at	datetime		Read-only. Timestamp of modification.
removed	boolean		Read-only
builtin	boolean		Read-only; expensive to use; if true, the object is not editable.
hidden	boolean		Read-only; expensive to use; if true, the object is hidden in UI.

Get Available Attributes of the UserModel

Request

Method	GET
Path	/api/v2/objspec/user

Data Structures: UserSafeAssignmentModel

UserSafeAssignmentModel

Attribute	Type	Required	Description
id	string	yes	Read-only object Identifier.
user_id	string	yes	Immutable. Uniqueness is required in the combination of attribute user_id with attribute safe_id. Requires read right on object type user for GET, POST, PATCH, and DELETE requests.
roles	object-array		Read-only; expensive to use.
role_names	string-array		Read-only; hidden; expensive to use.
role_ids	string-array		Read-only; hidden; expensive to use.
safe_id	string	yes	Immutable. Uniqueness is required in the combination of attribute safe_id with attribute user_id. Requires read right on object type safe for GET requests, user-add right for POST and PATCH, and user-remove right for DELETE requests.
blocked	boolean; default value false	yes	Access to this safe is disabled for the user.
position	number
password_visible	boolean; default value false	yes	Allow a user to use Secret Checkout feature and view passwords in the User Access Gateway.
time_policy_checksum	string		Read-only; expensive to use. Checksum computed from time policies used for this user-safe connection.
use_time_policy	boolean; default value false	yes	Enables the daily access policy for this user-safe connection. On a Safe with jit_mode set to time_policy it also decides when an access request is required - see Safes.
valid_since	datetime (h:m:s); default value -infinity	yes	Beginning access time.
valid_to	datetime (h:m:s); default value infinity	yes	Ending access time.
user_name	string		Read-only; expensive to use.
user_domain	string		Read-only; expensive to use.
user_email	string		Read-only; expensive to use.
user_organization	string		Read-only; expensive to use.
safe_name	string		Read-only; expensive to use.
user_blocked	boolean		Read-only; expensive to use; blocked state of the assigned user.
safe_blocked	boolean		Read-only; expensive to use; blocked state of the assigned safe.
created_at	datetime		Read-only.
modified_at	datetime		Read-only.
removed	boolean		Read-only.
builtin	boolean		Read-only; expensive to use; if true, the object is not editable.
hidden	boolean		Read-only; expensive to use; if true, the object is hidden in UI.

Retrieve Available Attributes of the UserSafeAssignmentModel

Request

Method	GET
Path	/api/v2/objspec/user_safe

Data Structures: UserSafeTimePolicyAssignmentModel

UserSafeTimePolicyAssignmentModel

Attribute	Type	Required	Description
id	string	yes	Read-only object Identifier.
user_safe_id	string		Read-only object Identifier.
user_id	string	yes	Immutable. Requires read right on object type user for GET requests, and modify right for POST, PATCH, and DELETE requests.
safe_id	string	yes	Immutable. Requires read right on object type safe for GET, POST, and PATCH requests.
user_name	string		Read-only; expensive to use.
user_role	string		Read-only; expensive to use.
safe_name	string		Read-only; expensive to use.
day_of_week	number	yes	Value range from 1 to 7.
valid_from	datetime (h:m:s)	yes	Beginning access time.
valid_to	datetime (h:m:s)	yes	Ending access time.
created_at	datetime		Read-only.
modified_at	datetime		Read-only.
removed	boolean		Read-only.

Retrieve Available Attributes of the UserSafeTimePolicy - AssignmentModel

Request

Method	GET
Path	/api/v2/objspec/user_safe_time_policy

To check allowed methods, available URL parameters and possible responses please refer to the API Overview section.

Refer to the Batch operations topic to create nested requests for operating on the User objects.

Create a User

Request

Method	POST
Path	/api/v2/user
Headers	Content-Type: Application/json
Body	UserModel

Example Request

POST /api/v2/user

{
"role": "user",
"name": "test-user",
"language":"en"
 }

Response

    {
"result": "success",
"user": {
    "id": "12345678901234567890"
}}

Get Users List

Request

Method	GET
Path	/api/v2/user

Example Request

GET /api/v2/user

Response

    {
"result": "success",
"user": [
    {
        "id": "1234567891012345",
        "name": "tet",
        "blocked": false,
        "role": "user",
        "full_name": "",
        "email": "",
        "phone": "",
        "ad_domain": "",
        "ldap_base": "",
        "language": "en",
        "failures": 0,
        "password_complexity": false,
        "external_sync": false,
        "valid_since": "-infinity",
        "valid_to": "infinity",
        "created_at": "2022-10-20 02:09:49.818029-07",
        "modified_at": "2022-10-20 02:09:49.818029-07"
    },
    {
        "id": "12345678910123456",
        "name": "admin",
        "blocked": false,
        "role": "superadmin",
        "language": "en",
        "previous_success": "2022-10-25 05:33:19.377878-07",
        "last_success": "2022-10-25 06:03:39.084783-07",
        "last_failure": "2022-10-24 04:19:35.204557-07",
        "failures": -1,
        "password_complexity": false,
        "external_sync": false,
        "valid_since": "-infinity",
        "valid_to": "infinity",
        "created_at": "2022-10-20 02:01:32.093269-07",
        "modified_at": "2022-10-25 06:03:39.085472-07"
    }
]}

Get a User

Request

Method	GET
Path	/api/v2/user/<id>

Modify a User

Request

Method	PATCH
Path	/api/v2/user/<id>
Headers	Content-Type: Application/json
Body	UserModel

Example Request: Changing User Login

PATCH /api/v2/user/<id>

{
"name": "new-user"
}

Response

{ "result": "success"}

Example Request: Blocking a User

PATCH /api/v2/user/<id>

{"blocked": true,
 "reason": "lost rights"}

Response

{ "result": "success" }

Get User-Safe Assignments List

Request

Method	GET
Path	/api/v2/user/safe

Create a User-Safe Assignment

Request

Method	POST
Path	/api/v2/user/safe
Body	UserSafeAssignment

Example Request

POST /api/v2/user/safe

{ "user_id": "1232678819172646915",
        "safe_id": "1232678819172646913" }

Response

    { "result": "success",
"user_safe": {} }

Get Users’ Time Policy Settings Within Safes

Request

Method	GET
Path	/api/v2/user/safe/time_policy

Example Request

GET /api/v2/user/safe/time_policy

Response (User’s time policy is declared separately for each day)

    {
"result": "success",
"user_safe_time_policy": [
    {
        "id": "4602678819172646913",
        "safe_id": "4602678819172646913",
        "user_id": "4602678819172646914",
        "day_of_week": 2, <--- A user has access to the safe on Tuesday
        "valid_from": "09:00:00", <--- User's access starts at 9:00
        "valid_to": "14:00:00", <--- and ends at 14:00
        "created_at": "2022-10-26 02:25:19.155648-07",
        "modified_at": "2022-10-26 02:30:40.677788-07"
    },
    {
        "id": "4602678819172646914",
        "safe_id": "4602678819172646913",
        "user_id": "4602678819172646914",
        "day_of_week": 3, <--- A user has access to the safe on Wednesday
        "valid_from": "09:15:00", <--- User's access starts at 9:15
        "valid_to": "14:15:00", <--- and ends at 14:15
        "created_at": "2022-10-26 02:32:11.781045-07",
        "modified_at": "2022-10-26 02:32:11.781045-07"
    }]}

Get Users’ Time Policy Settings Within Safes by ID

Request

Method	GET
Path	/api/v2/user/safe/time_policy/<id>

Example Request

GET /api/v2/user/safe/time_policy/<id>

Response (User’s time policy is declared separately for each day)

    {
"result": "success",
"user_safe_time_policy": [
    {
        "id": "4602678819172646914",
        "safe_id": "4602678819172646913",
        "user_id": "4602678819172646914",
        "day_of_week": 3, <--- A user has access to the safe on Wednesday
        "valid_from": "09:15:00", <--- User's access starts at 9:15
        "valid_to": "14:15:00", <--- and ends at 14:15
        "created_at": "2022-10-26 02:32:11.781045-07",
        "modified_at": "2022-10-26 02:32:11.781045-07"
    }]}

Modify User’s Time Policy Settings Within a Safe

Request

Method	PATCH
Path	/api/v2/user/safe/time_policy/<id>
Body	UserSafeTimePolicyAssignment

Example Request: Changing the day of user’s access to Monday

PATCH /api/v2/user/safe/time_policy/<id>

{ "day_of_week": 1}

Response

{ "result": "success" }

Create User’s Time Policy Settings Within a Safe

Request

Method	POST
Path	/api/v2/user/safe/time_policy
Body	UserSafeTimePolicyAssignment

Example Request: Creating User’s Access to the the Safe for Thursday From 16:00 Till 23:00

POST /api/v2/user/safe/time_policy

{ "user_id": "1232678819172646915",
"safe_id": "1232678819172646913",
"day_of_week": 4,
"valid_from": "16:00:00",
"valid_to": "23:00:00"
}

Response

    { "result": "success",
"user_safe_time_policy": {
    "id": "1232678819172646915" }}

Delete User’s Time Policy Settings Within a Safe

Request

Method	DELETE
Path	/api/v2/user/safe/time_policy/<id>

Delete User-Safe Assignment

Request

Method	DELETE
Path	/api/v2/user/<user_id>/safe/<safe_id>

Delete User

Request

Method	DELETE
Path	/api/v2/user/<id>