Group-Derived Safe Access Policies¶

A user can reach a safe directly or through a group. This resource holds a per-user override for access a user has through a group: it narrows the group’s grant for that one user without touching the group itself or the other members.

The override can only be created for a user who already reaches the safe through a group. Creating it for a user with no such path fails with {"result": "failure", "message": "User does not reach the safe through any group."}.

Note

The override lives only as long as the group path does. When the last group granting the user access to the safe is removed, the override is removed with it.

Data Structures¶

`UserGroupSafePolicyModel`¶
Attribute	Type	Required	Description
`id`	string		Read-only; protected.
`user_id`	string	yes	Immutable. Uniqueness is required in the combination of attribute `user_id` with attribute `safe_id`. Requires `read` right on object type `user` for all methods.
`safe_id`	string	yes	Immutable. Uniqueness is required in the combination of attribute `safe_id` with attribute `user_id`. Requires `read` right on object type `safe` for `GET`, `user-add` for `POST` and `PATCH`, and `user-remove` for `DELETE`.
`blocked`	boolean; default value `false`	yes	Access to this safe is disabled for the user.
`use_time_policy`	boolean; default value `false`	yes	Restrict the user’s access to the hours defined by the time policy entries.
`valid_since`	datetime (h:m:s); default value `-infinity`	yes	Beginning access time.
`valid_to`	datetime (h:m:s); default value `infinity`	yes	Ending access time.
`user_name`	string		Read-only; expensive to use.
`safe_name`	string		Read-only; expensive to use.
`created_at`	datetime		Read-only. Timestamp of creation.
`modified_at`	datetime		Read-only. Timestamp of modification.
`removed`	boolean		Read-only.

`UserGroupSafePolicyTimePolicyModel`¶
Attribute	Type	Required	Description
`id`	string		Read-only. Uniqueness is required.
`user_group_safe_policy_id`	string		Read-only; protected. Owning override.
`user_id`	string	yes	Immutable. Requires `read` right on object type `user` for `GET`, and `modify` for the other methods.
`safe_id`	string	yes	Immutable. Requires `read` right on object type `safe`.
`user_name`	string		Read-only; expensive to use.
`safe_name`	string		Read-only; expensive to use.
`day_of_week`	number	yes	Day the entry applies to. Value range from `1` to `7`.
`valid_from`	datetime (h:m:s)	yes	Beginning access time on that day.
`valid_to`	datetime (h:m:s)	yes	Ending access time on that day.
`created_at`	datetime		Read-only. Timestamp of creation.
`modified_at`	datetime		Read-only. Timestamp of modification.
`removed`	boolean		Read-only.

Retrieve Available Attributes¶

Request

Method	`GET`
Path	`/api/v2/objspec/user_group_safe_policy`, `/api/v2/objspec/user_group_safe_policy_time_policy`

GET /api/v2/objspec/user_group_safe_policy

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.3.191/api/v2/objspec/user_group_safe_policy'

List Overrides¶

Request

Method	`GET`
Path	`/api/v2/user/group/safe/policy`

GET /api/v2/user/group/safe/policy

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.3.191/api/v2/user/group/safe/policy'

Response

{
    "result": "success",
    "user_group_safe_policy": [
        {
            "user_id": "4638707616191610882",
            "safe_id": "4638707616191610881",
            "blocked": false,
            "use_time_policy": true,
            "valid_since": "-infinity",
            "valid_to": "infinity",
            "user_name": "user_1",
            "safe_name": "main",
            "created_at": "2026-08-18 02:19:48.717365-07",
            "modified_at": "2026-08-18 02:19:48.717365-07"
        }
    ]
}

Get the Override for a User and Safe¶

Request

Method	`GET`
Path	`/api/v2/user/<user_id>/group/safe/<safe_id>/policy`

GET /api/v2/user/<user_id>/group/safe/<safe_id>/policy

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.3.191/api/v2/user/4638707616191610882/group/safe/4638707616191610881/policy'

Response

{
    "result": "success",
    "user_group_safe_policy": [
        {
            "user_id": "4638707616191610882",
            "safe_id": "4638707616191610881",
            "blocked": true,
            "use_time_policy": true,
            "valid_since": "-infinity",
            "valid_to": "infinity",
            "user_name": "user_1",
            "safe_name": "main",
            "created_at": "2026-08-18 02:19:48.717365-07",
            "modified_at": "2026-08-18 02:25:55.003527-07"
        }
    ]
}

Note

This endpoint returns an array, not a single object, and an empty array when the user has no override for that safe.

Create an Override¶

Request

Method	`POST`
Path	`/api/v2/user/group/safe/policy`
Body	`UserGroupSafePolicyModel`

POST /api/v2/user/group/safe/policy

Example Request

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  -H 'Content-Type: application/json' \
  -d '{"user_id":"4638707616191610882","safe_id":"4638707616191610881","use_time_policy":true,"blocked":false}' \
  'https://10.33.3.191/api/v2/user/group/safe/policy'

Response

{
    "result": "success"
}

Modify an Override¶

Request

Method	`PATCH`
Path	`/api/v2/user/<user_id>/group/safe/<safe_id>/policy`
Body	`UserGroupSafePolicyModel`

PATCH /api/v2/user/<user_id>/group/safe/<safe_id>/policy

Example Request

curl -s -k -X PATCH \
  -H 'Authorization: <token>' \
  -H 'Content-Type: application/json' \
  -d '{"blocked":true}' \
  'https://10.33.3.191/api/v2/user/4638707616191610882/group/safe/4638707616191610881/policy'

Response

{
    "result": "success"
}

Delete an Override¶

Request

Method	`DELETE`
Path	`/api/v2/user/<user_id>/group/safe/<safe_id>/policy`

DELETE /api/v2/user/<user_id>/group/safe/<safe_id>/policy

Example Request

curl -s -k -X DELETE \
  -H 'Authorization: <token>' \
  'https://10.33.3.191/api/v2/user/4638707616191610882/group/safe/4638707616191610881/policy'

Response

{
    "result": "success"
}

List Time Policy Entries¶

Request

Method	`GET`
Path	`/api/v2/user/group/safe/policy/time_policy`

GET /api/v2/user/group/safe/policy/time_policy

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.3.191/api/v2/user/group/safe/policy/time_policy'

Response

{
    "result": "success",
    "user_group_safe_policy_time_policy": [
        {
            "id": "4638707616191610881",
            "user_id": "4638707616191610882",
            "safe_id": "4638707616191610881",
            "user_name": "user_1",
            "safe_name": "main",
            "day_of_week": 1,
            "valid_from": "08:00:00",
            "valid_to": "16:00:00",
            "created_at": "2026-08-18 02:19:56.790642-07",
            "modified_at": "2026-08-18 02:19:56.790642-07"
        }
    ]
}

Get a Time Policy Entry¶

Request

Method	`GET`
Path	`/api/v2/user/group/safe/policy/time_policy/<id>`

GET /api/v2/user/group/safe/policy/time_policy/<id>

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.3.191/api/v2/user/group/safe/policy/time_policy/4638707616191610881'

Response

{
    "result": "success",
    "user_group_safe_policy_time_policy": {
        "id": "4638707616191610881",
        "user_id": "4638707616191610882",
        "safe_id": "4638707616191610881",
        "user_name": "user_1",
        "safe_name": "main",
        "day_of_week": 1,
        "valid_from": "08:00:00",
        "valid_to": "16:00:00",
        "created_at": "2026-08-18 02:19:56.790642-07",
        "modified_at": "2026-08-18 02:19:56.790642-07"
    }
}

Create a Time Policy Entry¶

Request

Method	`POST`
Path	`/api/v2/user/group/safe/policy/time_policy`
Body	`UserGroupSafePolicyTimePolicyModel`

POST /api/v2/user/group/safe/policy/time_policy

Example Request

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  -H 'Content-Type: application/json' \
  -d '{"user_id":"4638707616191610882","safe_id":"4638707616191610881","day_of_week":1,"valid_from":"08:00:00","valid_to":"16:00:00"}' \
  'https://10.33.3.191/api/v2/user/group/safe/policy/time_policy'

Response

{
    "result": "success",
    "user_group_safe_policy_time_policy": {
        "id": "4638707616191610881"
    }
}

Modify a Time Policy Entry¶

Request

Method	`PATCH`
Path	`/api/v2/user/group/safe/policy/time_policy/<id>`
Body	`UserGroupSafePolicyTimePolicyModel`

PATCH /api/v2/user/group/safe/policy/time_policy/<id>

Example Request

curl -s -k -X PATCH \
  -H 'Authorization: <token>' \
  -H 'Content-Type: application/json' \
  -d '{"valid_to":"18:00:00"}' \
  'https://10.33.3.191/api/v2/user/group/safe/policy/time_policy/4638707616191610881'

Response

{
    "result": "success"
}

Delete a Time Policy Entry¶

Request

Method	`DELETE`
Path	`/api/v2/user/group/safe/policy/time_policy/<id>`

DELETE /api/v2/user/group/safe/policy/time_policy/<id>

Example Request

curl -s -k -X DELETE \
  -H 'Authorization: <token>' \
  'https://10.33.3.191/api/v2/user/group/safe/policy/time_policy/4638707616191610881'

Response

{
    "result": "success"
}