User-Based Capabilities

Data Structures

UserCapabilityModels

Attribute	Type	Required	Description
id	string		Read-only, unique policy identifier. Protected.
subject_id	string	yes	Read-only; Immutable; Uniqueness is required in the combination of attribute subject_id with attribute object_id.
object_id	string	yes	Read-only; Immutable; Uniqueness is required in the combination of attribute object_id with attribute subject_id.
rights	string-array; readwrite; default value read	yes	Expensive to use.
object_name	string	yes	Expensive to use.
subject_name	string	yes	Expensive to use.
created_at	datetime		Read-only. Timestamp of creation.
modified_at	datetime		Read-only. Timestamp of modification.
removed	boolean		Read-only.
builtin	boolean		Read-only; expensive to use. Is object built-in? Built-in objects shouldn’t be editable.
hidden	boolean		Read-only; expensive to use. Shall the object be hidden in UI?

Retrieve Available Attributes of the UserCapabilityModels

Request

Method	GET
Paths	/api/v2/objspec/user_account_capability /api/v2/objspec/user_collection_capability /api/v2/objspec/user_group_capability /api/v2/objspec/user_pool_capability /api/v2/objspec/user_safe_capability /api/v2/objspec/user_server_capability /api/v2/objspec/user_user_capability

To check allowed methods, available URL parameters and possible responses please refer to the API Overview section.

Get User-Based Capabilities for Objects

Request

Method	GET
Paths	/api/v2/capability/user/account /api/v2/capability/user/collection /api/v2/capability/user/group /api/v2/capability/user/pool /api/v2/capability/user/safe /api/v2/capability/user/server /api/v2/capability/user/use

Example Request

GET /api/v2/capability/user/account

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.31.135.179/api/v2/capability/user/account'

Response

{
    "result": "success",
    "user_account_capability": [
        {
            "subject_id": "9115285645797883905",
            "object_id": "9115285645797883907",
            "rights": [
                "read",
                "modify",
                "delete",
                "block"
            ],
            "object_name": "ad-user1-windows",
            "subject_name": "admin",
            "created_at": "2025-04-25 01:40:45.013273-07",
            "modified_at": "2025-04-25 01:40:45.013273-07"
        },
        {
            "subject_id": "9115285645797883905",
            "object_id": "9115285645797883908",
            "rights": [
                "read",
                "modify",
                "delete",
                "block"
            ],
            "object_name": "jools-Linux",
            "subject_name": "admin",
            "created_at": "2025-04-25 01:40:45.965614-07",
            "modified_at": "2025-04-25 01:40:45.965614-07"
        }
    ]
}

Add User-Based Capabilities for Objects

Request

Method	POST
Paths	/api/v2/capability/user/account /api/v2/capability/user/collection /api/v2/capability/user/group /api/v2/capability/user/pool /api/v2/capability/user/safe /api/v2/capability/user/server /api/v2/capability/user/user
Headers	Content-Type: Application/json
Body	UserCapabilityModels

Example Request

POST /api/v2/capability/user/account

curl -s -k -X POST -H \
  'Authorization:<token>' \
  -H 'Content-Type: application/json' \
  'https://10.31.135.179/api/v2/capability/user/account' \
  -d'{"subject_id":9115285645797883906,"object_id":9115285645797883907}'

Response

{
    "result": "success"
}

Get Rights Assigned to a User (Subject) for an Object by Their IDs

Request

Method	GET
Paths	/api/v2/capability/user/<subject_id>/account/<object_id> /api/v2/capability/user/<subject_id>/collection/<object_id> /api/v2/capability/user/<subject_id>/group/<object_id> /api/v2/capability/user/<subject_id>/pool/<object_id> /api/v2/capability/user/<subject_id>/safe/<object_id> /api/v2/capability/user/<subject_id>/server/<object_id> /api/v2/capability/user/<subject_id>/user/<object_id>

Example Request

GET /api/v2/capability/user/<subject_id>/account/<object_id>

curl -s -k -X GET \
  -H 'Authorization:<token>' \
  'https://10.31.135.179/api/v2/capability/user/9115285645797883906/account/9115285645797883907'

Response

{
    "result": "success",
    "user_account_capability": {
        "subject_id": "9115285645797883906",
        "object_id": "9115285645797883907",
        "rights": [
            "read"
        ],
        "object_name": "ad-user1-windows",
        "subject_name": "User_1",
        "created_at": "2025-04-30 05:50:08.533293-07",
        "modified_at": "2025-04-30 05:50:08.533293-07"
    }
}

Modify Rights Assigned to a User (Subject) for an Object by Their IDs

Request

Method	PATCH
Paths	/api/v2/capability/user/<subject_id>/account/<object_id> /api/v2/capability/user/<subject_id>/collection/<object_id> /api/v2/capability/user/<subject_id>/group/<object_id> /api/v2/capability/user/<subject_id>/pool/<object_id> /api/v2/capability/user/<subject_id>/safe/<object_id> /api/v2/capability/user/<subject_id>/server/<object_id> /api/v2/capability/user/<subject_id>/user/<object_id>
Headers	Content-Type: Application/json
Body	UserCapabilityModels

Example Request

PATCH /api/v2/capability/user/<subject_id>/account/<object_id>

curl -s -k -X PATCH \
  -H 'Authorization:<token>' \
  -H 'Content-Type: application/json' \
  'https://10.31.135.179/api/v2/capability/user/9115285645797883906/account/9115285645797883907' \
  -d'{"rights":["read","modify","delete"]}'

Note

The read right is mandatory and must always be included.

Response

{
    "result": "success"
}

Grant Specific Rights to a User (Subject) for an Object by Their IDs

Request

Method	PATCH
Paths	/api/v2/capability/user/<subject_id>/account/<object_id>/grant /api/v2/capability/user/<subject_id>/collection/<object_id>/grant /api/v2/capability/user/<subject_id>/group/<object_id>/grant /api/v2/capability/user/<subject_id>/pool/<object_id>/grant /api/v2/capability/user/<subject_id>/safe/<object_id>/grant /api/v2/capability/user/<subject_id>/server/<object_id>/grant /api/v2/capability/user/<subject_id>/user/<object_id>/grant
Headers	Content-Type: Application/json
Body	UserCapabilityModels

Example Request

PATCH /api/v2/capability/user/<subject_id>/account/<object_id>/grant

curl -s -k -X PATCH \
  -H 'Authorization:<token>' \
  -H 'Content-Type: application/json' \
  'https://10.31.135.179/api/v2/capability/user/9115285645797883906/account/9115285645797883907/grant' \
  -d'{"rights":["modify","delete"]}'

Response

{
    "result": "success"
}

Revoke Specific Rights to a User (Subject) for an Object by Their IDs

Request

Method	PATCH
Paths	/api/v2/capability/user/<subject_id>/account/<object_id>/revoke /api/v2/capability/user/<subject_id>/collection/<object_id>/revoke /api/v2/capability/user/<subject_id>/group/<object_id>/revoke /api/v2/capability/user/<subject_id>/pool/<object_id>/revoke /api/v2/capability/user/<subject_id>/safe/<object_id>/revoke /api/v2/capability/user/<subject_id>/server/<object_id>/revoke /api/v2/capability/user/<subject_id>/user/<object_id>/revoke
Headers	Content-Type: Application/json
Body	UserCapabilityModels

Example Request

PATCH /api/v2/capability/user/<subject_id>/account/<object_id>/revoke

curl -s -k -X PATCH \
  -H 'Authorization:<token>' \
  -H 'Content-Type: application/json' \
  'https://10.31.135.179/api/v2/capability/user/9115285645797883906/account/9115285645797883907/revoke' \
  -d'{"rights":["modify","delete"]}'

Response

{
    "result": "success"
}

Delete User-Based Capability Assigned to a ser (Subject) for an Object by Their IDs

Request

Method	DELETE
Paths	/api/v2/capability/user/<subject_id>/account/<object_id> /api/v2/capability/user/<subject_id>/collection/<object_id> /api/v2/capability/user/<subject_id>/group/<object_id> /api/v2/capability/user/<subject_id>/pool/<object_id> /api/v2/capability/user/<subject_id>/safe/<object_id> /api/v2/capability/user/<subject_id>/server/<object_id> /api/v2/capability/user/<subject_id>/user/<object_id>

Example Request

DELETE /api/v2/capability/user/<subject_id>/account/<object_id>

curl -s -k -X DELETE \
  -H 'Authorization:<token>' \
  'https://10.31.135.179/api/v2/capability/user/9115285645797883906/account/9115285645797883907'

Response

{
    "result": "success"
}