From 0f7444a690dd74012823349016f63a1a49a37942 Mon Sep 17 00:00:00 2001 From: Jeff Mitchell Date: Sun, 4 Oct 2020 21:41:21 -0400 Subject: [PATCH] Create the perms table and a program to keep it up-to-date (#529) --- Makefile | 3 + internal/website/permstable/permstable.go | 790 ++++++++++ website/content/docs/concepts/permissions.mdx | 1279 +++++++++++++++-- 3 files changed, 1966 insertions(+), 106 deletions(-) create mode 100644 internal/website/permstable/permstable.go diff --git a/Makefile b/Makefile index ae490317e..d708b753e 100644 --- a/Makefile +++ b/Makefile @@ -46,6 +46,9 @@ else @echo "==> UI assets found, use build-ui target to update" endif +perms-table: + @go run internal/website/permstable/permstable.go + gen: cleangen proto api migrations migrations: diff --git a/internal/website/permstable/permstable.go b/internal/website/permstable/permstable.go new file mode 100644 index 000000000..15d0d9987 --- /dev/null +++ b/internal/website/permstable/permstable.go @@ -0,0 +1,790 @@ +package main + +import ( + "fmt" + "io/ioutil" + "os" + "sort" + "strings" +) + +const permsFile = "website/content/docs/concepts/permissions.mdx" + +var ( + iamScopes = []string{"Global", "Org"} + infraScope = []string{"Project"} +) + +type Table struct { + Header *Header + Body *Body +} + +type Header struct { + Titles []string +} + +type Body struct { + Resources []*Resource +} + +type Resource struct { + Type string + Scopes []string + Endpoints []*Endpoint +} + +type Endpoint struct { + Path string + Params map[string]string + Actions []*Action +} + +type Action struct { + Name string + Description string + Examples []string +} + +var table = &Table{ + Header: &Header{ + Titles: []string{ + "Resource Type", + "Applicable Scopes", + "API Endpoint", + "Parameters into Permissions Engine", + "Available Actions / Examples", + }, + }, + Body: &Body{ + Resources: make([]*Resource, 0, 12), + }, +} + +func main() { + table.Body.Resources = append(table.Body.Resources, + account, + authMethod, + authToken, + group, + host, + hostCatalog, + hostSet, + role, + scope, + session, + target, + user, + ) + + fileContents, err := ioutil.ReadFile(permsFile) + if err != nil { + fmt.Println(err) + os.Exit(1) + } + + lines := strings.Split(string(fileContents), "\n") + var pre, post []string + var marker int + for i, line := range lines { + if strings.Contains(line, "BEGIN TABLE") { + marker = i + } + pre = append(pre, line) + if marker != 0 { + break + } + } + + for i := marker + 1; i < len(lines); i++ { + if !strings.Contains(lines[i], "END TABLE") { + continue + } + marker = i + break + } + + for i := marker; i < len(lines); i++ { + post = append(post, lines[i]) + } + + final := fmt.Sprintf("%s\n\n%s\n\n%s", + strings.Join(pre, "\n"), + strings.Join(table.Marshal(), "\n"), + strings.Join(post, "\n")) + + if err := ioutil.WriteFile(permsFile, []byte(final), 0644); err != nil { + fmt.Println(err) + os.Exit(1) + } +} + +func (t *Table) Marshal() (ret []string) { + ret = append(ret, "") + ret = append(ret, " ") + ret = append(ret, t.Header.Marshal()...) + ret = append(ret, " ") + ret = append(ret, " ") + ret = append(ret, t.Body.Marshal()...) + ret = append(ret, " ") + ret = append(ret, "
") + + return +} + +func (h *Header) Marshal() (ret []string) { + ret = append(ret, fmt.Sprintf(`%s`, indent(4))) + for _, v := range h.Titles { + ret = append(ret, + fmt.Sprintf("%s%s", indent(6), v), + ) + } + ret = append(ret, fmt.Sprintf(`%s`, indent(4))) + + return +} + +func (b *Body) Marshal() (ret []string) { + for _, v := range b.Resources { + ret = append(ret, v.Marshal()...) + } + + return +} + +func (r *Resource) Marshal() (ret []string) { + for i, v := range r.Endpoints { + ret = append(ret, fmt.Sprintf(`%s`, indent(4))) + if i == 0 { + ret = append(ret, + fmt.Sprintf(`%s%s`, indent(6), len(r.Endpoints), r.Type), + fmt.Sprintf(`%s`, indent(6), len(r.Endpoints)), + fmt.Sprintf(`%s`, indent(8)), + fmt.Sprintf(`%s`, indent(6)), + ) + } + ret = append(ret, v.Marshal()...) + ret = append(ret, fmt.Sprintf(`%s`, indent(4))) + } + + return +} + +func (e *Endpoint) Marshal() (ret []string) { + ret = append(ret, + fmt.Sprintf(`%s`, indent(6)), + fmt.Sprintf(`%s%s`, indent(8), escape(e.Path)), + fmt.Sprintf(`%s`, indent(6)), + fmt.Sprintf(`%s`, indent(6)), + fmt.Sprintf(`%s`, indent(8)), + fmt.Sprintf(`%s`, indent(6)), + fmt.Sprintf(`%s`, indent(6)), + fmt.Sprintf(`%s`, indent(8)), + fmt.Sprintf(`%s`, indent(6)), + ) + + return +} + +func escape(s string) string { + ret := strings.Replace(s, "<", "<", -1) + return strings.Replace(ret, ">", ">", -1) +} + +func indent(num int) string { + return strings.Repeat(" ", num) +} + +func sortedKeys(in map[string]string) []string { + out := make([]string, 0, len(in)) + for k := range in { + out = append(out, k) + } + sort.Strings(out) + return out +} + +func clActions(typ string) []*Action { + listVersion := strings.TrimPrefix(strings.TrimPrefix(typ, "an "), "a ") + return []*Action{ + { + Name: "create", + Description: fmt.Sprintf("Create %s", typ), + Examples: []string{ + "type=;actions=create", + }, + }, + { + Name: "list", + Description: fmt.Sprintf("List %ss", listVersion), + Examples: []string{ + "type=;actions=list", + }, + }, + } +} + +func rudActions(typ string, pin bool) []*Action { + ret := []*Action{ + { + Name: "read", + Description: fmt.Sprintf("Read %s", typ), + Examples: []string{ + "id=;actions=read", + }, + }, + { + Name: "update", + Description: fmt.Sprintf("Update %s", typ), + Examples: []string{ + "id=;actions=update", + }, + }, + { + Name: "delete", + Description: fmt.Sprintf("Delete %s", typ), + Examples: []string{ + "id=;actions=delete", + }, + }, + } + if pin { + ret[0].Examples = append(ret[0].Examples, "id=;type=;actions=read") + ret[1].Examples = append(ret[1].Examples, "id=;type=;actions=update") + ret[2].Examples = append(ret[2].Examples, "id=;type=;actions=delete") + } + + return ret +} + +var account = &Resource{ + Type: "Account", + Scopes: iamScopes, + Endpoints: []*Endpoint{ + { + Path: "/accounts", + Params: map[string]string{ + "Type": "accounts", + }, + Actions: clActions("an account"), + }, + { + Path: "/accounts/", + Params: map[string]string{ + "ID": "", + "Type": "account", + "Pin": "", + }, + Actions: append( + rudActions("an account", true), + &Action{ + Name: "set-password", + Description: "Set a password on an account, without requring the current password", + Examples: []string{ + "id=;actions=set-password", + "id=;type=;actions=set-password", + }, + }, + &Action{ + Name: "change-password", + Description: "Change a password on an account given the current password", + Examples: []string{ + "id=;actions=change-password", + "id=;type=;actions=change-password", + }, + }, + ), + }, + }, +} + +var authMethod = &Resource{ + Type: "Auth Method", + Scopes: iamScopes, + Endpoints: []*Endpoint{ + { + Path: "/auth-methods", + Params: map[string]string{ + "Type": "auth-method", + }, + Actions: clActions("an auth method"), + }, + { + Path: "/auth-methods/", + Params: map[string]string{ + "ID": "", + "Type": "auth-method", + }, + Actions: append( + rudActions("an auth method", false), + &Action{ + Name: "authenticate", + Description: "Authenticate to an auth method", + Examples: []string{ + "id=;actions=authenticate", + }, + }, + ), + }, + }, +} + +var authToken = &Resource{ + Type: "Auth Token", + Scopes: iamScopes, + Endpoints: []*Endpoint{ + { + Path: "/auth-tokens", + Params: map[string]string{ + "Type": "auth-token", + }, + Actions: []*Action{ + { + Name: "list", + Description: "List auth tokens", + Examples: []string{ + "type=;actions=list", + }, + }, + }, + }, + { + Path: "/auth-tokens/", + Params: map[string]string{ + "ID": "", + "Type": "auth-token", + }, + Actions: []*Action{ + { + Name: "read", + Description: "Read an auth token", + Examples: []string{ + "id=;actions=read", + }, + }, + { + Name: "delete", + Description: "Delete an auth token", + Examples: []string{ + "id=;actions=delete", + }, + }, + }, + }, + }, +} + +var group = &Resource{ + Type: "Group", + Scopes: append(iamScopes, infraScope...), + Endpoints: []*Endpoint{ + { + Path: "/groups", + Params: map[string]string{ + "Type": "group", + }, + Actions: clActions("a group"), + }, + { + Path: "/groups/", + Params: map[string]string{ + "ID": "", + "Type": "group", + }, + Actions: append( + rudActions("a group", false), + &Action{ + Name: "add-members", + Description: "Add members to a group", + Examples: []string{ + "id=;actions=add-members", + }, + }, + &Action{ + Name: "set-members", + Description: "Set the full set of members on a group", + Examples: []string{ + "id=;actions=set-members", + }, + }, + &Action{ + Name: "remove-members", + Description: "Remove members from a group", + Examples: []string{ + "id=;actions=remove-members", + }, + }, + ), + }, + }, +} + +var host = &Resource{ + Type: "Host", + Scopes: infraScope, + Endpoints: []*Endpoint{ + { + Path: "/hosts", + Params: map[string]string{ + "Type": "host", + }, + Actions: clActions("a host"), + }, + { + Path: "/hosts/", + Params: map[string]string{ + "ID": "", + "Type": "host", + "Pin": "", + }, + Actions: rudActions("a host", true), + }, + }, +} + +var hostCatalog = &Resource{ + Type: "Host Catalog", + Scopes: infraScope, + Endpoints: []*Endpoint{ + { + Path: "/host-catalogs", + Params: map[string]string{ + "Type": "host-catalog", + }, + Actions: clActions("a host catalog"), + }, + { + Path: "/host-catalogs/", + Params: map[string]string{ + "ID": "", + "Type": "host-catalog", + }, + Actions: rudActions("a host catalog", false), + }, + }, +} + +var hostSet = &Resource{ + Type: "Host Set", + Scopes: infraScope, + Endpoints: []*Endpoint{ + { + Path: "/host-sets", + Params: map[string]string{ + "Type": "host-set", + }, + Actions: clActions("a host set"), + }, + { + Path: "/targets/", + Params: map[string]string{ + "ID": "", + "Type": "host-set", + "Pin": "", + }, + Actions: append( + rudActions("a host set", true), + &Action{ + Name: "add-hosts", + Description: "Add hosts to a host-set", + Examples: []string{ + "id=;actions=add-hosts", + "id=;type=;actions=add-hosts", + }, + }, + &Action{ + Name: "set-hosts", + Description: "Set the full set of hosts on a host set", + Examples: []string{ + "id=;actions=set-hosts", + "id=;type=;actions=set-hosts", + }, + }, + &Action{ + Name: "remove-hosts", + Description: "Remove hosts from a host set", + Examples: []string{ + "id=;actions=remove-hosts", + "id=;type=;actions=remove-hosts", + }, + }, + ), + }, + }, +} + +var role = &Resource{ + Type: "Role", + Scopes: append(iamScopes, infraScope...), + Endpoints: []*Endpoint{ + { + Path: "/roles", + Params: map[string]string{ + "Type": "role", + }, + Actions: clActions("a role"), + }, + { + Path: "/roles/", + Params: map[string]string{ + "ID": "", + "Type": "role", + }, + Actions: append( + rudActions("a role", false), + &Action{ + Name: "add-principals", + Description: "Add principals to a role", + Examples: []string{ + "id=;actions=add-principals", + }, + }, + &Action{ + Name: "set-principals", + Description: "Set the full set of principals on a role", + Examples: []string{ + "id=;actions=set-principals", + }, + }, + &Action{ + Name: "remove-principals", + Description: "Remove principals from a role", + Examples: []string{ + "id=;actions=remove-principals", + }, + }, + &Action{ + Name: "add-grants", + Description: "Add grants to a role", + Examples: []string{ + "id=;actions=add-grants", + }, + }, + &Action{ + Name: "set-grants", + Description: "Set the full set of grants on a role", + Examples: []string{ + "id=;actions=set-grants", + }, + }, + &Action{ + Name: "remove-grants", + Description: "Remove grants from a role", + Examples: []string{ + "id=;actions=remove-grants", + }, + }, + ), + }, + }, +} + +var scope = &Resource{ + Type: "Scope", + Scopes: iamScopes, + Endpoints: []*Endpoint{ + { + Path: "/scopes", + Params: map[string]string{ + "Type": "scope", + }, + Actions: clActions("a scope"), + }, + { + Path: "/scopes/", + Params: map[string]string{ + "ID": "", + "Type": "scope", + }, + Actions: rudActions("a scope", false), + }, + }, +} + +var session = &Resource{ + Type: "Session", + Scopes: infraScope, + Endpoints: []*Endpoint{ + { + Path: "/sessions", + Params: map[string]string{ + "Type": "session", + }, + Actions: []*Action{ + { + Name: "list", + Description: "List sessions", + Examples: []string{ + "type=;actions=list", + }, + }, + }, + }, + { + Path: "/session/", + Params: map[string]string{ + "ID": "", + "Type": "session", + }, + Actions: []*Action{ + { + Name: "read", + Description: "Read a session", + Examples: []string{ + "id=;actions=read", + }, + }, + { + Name: "cancel", + Description: "Cancel a session", + Examples: []string{ + "id=;actions=cancel", + }, + }, + }, + }, + }, +} + +var target = &Resource{ + Type: "Target", + Scopes: infraScope, + Endpoints: []*Endpoint{ + { + Path: "/targets", + Params: map[string]string{ + "Type": "target", + }, + Actions: clActions("a target"), + }, + { + Path: "/targets/", + Params: map[string]string{ + "ID": "", + "Type": "target", + }, + Actions: append( + rudActions("a target", false), + &Action{ + Name: "add-host-sets", + Description: "Add host sets to a target", + Examples: []string{ + "id=;actions=add-host-sets", + }, + }, + &Action{ + Name: "set-host-sets", + Description: "Set the full set of host sets on a target", + Examples: []string{ + "id=;actions=set-host-sets", + }, + }, + &Action{ + Name: "remove-host-sets", + Description: "Remove host sets from a target", + Examples: []string{ + "id=;actions=remove-host-sets", + }, + }, + &Action{ + Name: "authorize", + Description: "Authorize a session via the target", + Examples: []string{ + "id=;actions=authorize", + }, + }, + ), + }, + }, +} + +var user = &Resource{ + Type: "User", + Scopes: iamScopes, + Endpoints: []*Endpoint{ + { + Path: "/users", + Params: map[string]string{ + "Type": "user", + }, + Actions: clActions("a user"), + }, + { + Path: "/users/", + Params: map[string]string{ + "ID": "", + "Type": "user", + }, + Actions: append( + rudActions("a user", false), + &Action{ + Name: "add-accounts", + Description: "Add accounts to a user", + Examples: []string{ + "id=;actions=add-accounts", + }, + }, + &Action{ + Name: "set-accounts", + Description: "Set the full set of accounts on a user", + Examples: []string{ + "id=;actions=set-accounts", + }, + }, + &Action{ + Name: "remove-accounts", + Description: "Remove accounts from a user", + Examples: []string{ + "id=;actions=remove-accounts", + }, + }, + ), + }, + }, +} diff --git a/website/content/docs/concepts/permissions.mdx b/website/content/docs/concepts/permissions.mdx index 5d099000b..5b0f086be 100644 --- a/website/content/docs/concepts/permissions.mdx +++ b/website/content/docs/concepts/permissions.mdx @@ -103,37 +103,11 @@ The reason for this is that other types of resources are contained within one of these resource types; for instance, accounts are instantiated within an auth method. To specify actions against those, you must also specify to which specific containing resource you want the grants to apply. This can be done with -one of the formats shown below. - -### Wildcard ID - -In this form, the ID of the grant string is a wildcard `*` character. Depending on `type` and `actions` this results in one of a few behaviors. - -#### Wildcard ID - -When just the ID is `*`, it matches all IDs of the given type. This can be used -with both top-level resource types and not. Example: - -`id=*;type=host-set;actions=create,read,update,set-hosts` - -#### Wildcard ID and Type - -`type` can also be a wildcard, which essentially turns it into a catch-all that -will match any resource of any type within the scope: - -`id=*;type=*;actions=read,list` - -#### Wildcard ID, Type, and Actions - -`actions` can also be a wildcard: - -`id=*;type=*;actions=*` - -Such a grant is essentially a full administrator grant for a scope. +the pinned format shown below. ### Pinned ID -The final form "pins" actions to a non-top-level type within a specific ID. It's +This form "pins" actions to a non-top-level type within a specific ID. It's easiest to explain with an example: `id=hcst_1234567890;type=host-set;actions=create,read,update` @@ -143,7 +117,34 @@ the scope, but *only the host sets belonging to host catalog hcst_1234567890*. Pinning is essentially a way to use top-level resources to create mini permission boundaries for their subordinate resources. -In this format, `type` can be a wildcard: +### Templates + +A few template possibilities exist, which will at grant evaluation time +subsitute the given value into the ID field of the grant string: + +* `{{account.id}}`: The substituted value is the account ID associated with the +token used to perform the action. As an example, +`id={{account.id}};actions=read,change-password"` is one of Boundary's default +grants to allow users that have authenticated with the Password auth method to +change their own password. + +* `{{user.id}}`: The substituted value is the user ID associated with the token +used to perform the action. + +### Wildcard ID + +Various wildcard possibilities are allowed: + +#### Wildcard ID + +When just the ID is `*`, it matches all IDs of the given type. This can be used +with both top-level resource types and not. Example: + +`id=*;type=host-set;actions=create,read,update,set-hosts` + +#### Wildcard Type + +For non-top-level resources with pinned IDs, the `type` can be a wildcard: `id=hcst_1234567890;type=*;actions=create,read,update` @@ -151,85 +152,1151 @@ This would allow `create`, `read`, and `update` actions for all types of subordinate resources (in this case host sets and hosts) underneath the host catalog with ID `hcst_1234567890`. +#### Wildcard ID and Type + +If ID and type are both a wildcard, the grant is essentially a catch-all that +will match any resource of any type within the scope and allow the given +actions. + +`id=*;type=*;actions=read,list` + +#### Wildcard ID, Type, and Actions + +Finally, ID, type, and actions can all be wildcards: + +`id=*;type=*;actions=*` + +Such a grant is essentially a full administrator grant for a scope. + ## Resource Table The following table works as a quick cheat-sheet to help you manage your -permissions. Note that it's not exhaustive; wildcards can provide additional -ways to specify grants. Instead this table indicates the most scoped-down ways -that access to an action can be granted, while helping to portray the concepts -around ID, type, and pin. +permissions. Note that it's not exhaustive; for brevity it does _not_ show +wildcard or templated grant strings. + + - - - - - - - - - - - - - - - - - - - - - - - -
Resource TypeAvailable ScopesAPI EndpointParameters into Permissions EngineAvailable Actions/Grant Examples
Auth Method -
    -
  • Global
    • -
  • Organization
    • -
- 		/auth-methods -
    -
  • Type
    • -
      -
    • auth-method
      • -
    -
- 		-
    -
  • create: Create an auth method
    • -
      -
    • type=auth-method;actions=create
      • -
    -
  • list: List auth methods
    • -
      -
    • type=auth-method;actions=list
      • -
    -
-
/auth-methods/[id] -
    -
  • ID
    • -
      -
    • [id]
      • -
    -
  • Type
    • -
      -
    • auth-method
      • -
    -
- 		-
    -
  • read: Read an auth method's configuration
    • -
      -
    • id=[id];actions=read
      • -
    -
  • update: Update an auth method's configuration
    • -
      -
    • id=[id];actions=update
      • -
    -
  • delete: Delete an auth method
    • -
      -
    • id=[id];actions=delete
      • -
    -
-
\ No newline at end of file + + + Resource Type + Applicable Scopes + API Endpoint + Parameters into Permissions Engine + Available Actions / Examples + + + + + Account + +
    +
  • Global
    • +
  • Org
    • +
+ + + /accounts + + +
    +
  • Type
    • +
      +
    • + accounts +
      • +
    +
+ + +
    +
  • + create: Create an account +
    • +
      +
    • type=<type>;actions=create
      • +
    +
  • + list: List accounts +
    • +
      +
    • type=<type>;actions=list
      • +
    +
+ + + + + /accounts/<id> + + +
    +
  • ID
    • +
      +
    • + <id> +
      • +
    +
  • Pin
    • +
      +
    • + <auth-method-id> +
      • +
    +
  • Type
    • +
      +
    • + account +
      • +
    +
+ + +
    +
  • + read: Read an account +
    • +
      +
    • id=<id>;actions=read
      • +
    • id=<pin>;type=<type>;actions=read
      • +
    +
  • + update: Update an account +
    • +
      +
    • id=<id>;actions=update
      • +
    • id=<pin>;type=<type>;actions=update
      • +
    +
  • + delete: Delete an account +
    • +
      +
    • id=<id>;actions=delete
      • +
    • id=<pin>;type=<type>;actions=delete
      • +
    +
  • + set-password: Set a password on an account, without requring the current password +
    • +
      +
    • id=<id>;actions=set-password
      • +
    • id=<pin>;type=<type>;actions=set-password
      • +
    +
  • + change-password: Change a password on an account given the current password +
    • +
      +
    • id=<id>;actions=change-password
      • +
    • id=<pin>;type=<type>;actions=change-password
      • +
    +
+ + + + Auth Method + +
    +
  • Global
    • +
  • Org
    • +
+ + + /auth-methods + + +
    +
  • Type
    • +
      +
    • + auth-method +
      • +
    +
+ + +
    +
  • + create: Create an auth method +
    • +
      +
    • type=<type>;actions=create
      • +
    +
  • + list: List auth methods +
    • +
      +
    • type=<type>;actions=list
      • +
    +
+ + + + + /auth-methods/<id> + + +
    +
  • ID
    • +
      +
    • + <id> +
      • +
    +
  • Type
    • +
      +
    • + auth-method +
      • +
    +
+ + +
    +
  • + read: Read an auth method +
    • +
      +
    • id=<id>;actions=read
      • +
    +
  • + update: Update an auth method +
    • +
      +
    • id=<id>;actions=update
      • +
    +
  • + delete: Delete an auth method +
    • +
      +
    • id=<id>;actions=delete
      • +
    +
  • + authenticate: Authenticate to an auth method +
    • +
      +
    • id=<id>;actions=authenticate
      • +
    +
+ + + + Auth Token + +
    +
  • Global
    • +
  • Org
    • +
+ + + /auth-tokens + + +
    +
  • Type
    • +
      +
    • + auth-token +
      • +
    +
+ + +
    +
  • + list: List auth tokens +
    • +
      +
    • type=<type>;actions=list
      • +
    +
+ + + + + /auth-tokens/<id> + + +
    +
  • ID
    • +
      +
    • + <id> +
      • +
    +
  • Type
    • +
      +
    • + auth-token +
      • +
    +
+ + +
    +
  • + read: Read an auth token +
    • +
      +
    • id=<id>;actions=read
      • +
    +
  • + delete: Delete an auth token +
    • +
      +
    • id=<id>;actions=delete
      • +
    +
+ + + + Group + +
    +
  • Global
    • +
  • Org
    • +
  • Project
    • +
+ + + /groups + + +
    +
  • Type
    • +
      +
    • + group +
      • +
    +
+ + +
    +
  • + create: Create a group +
    • +
      +
    • type=<type>;actions=create
      • +
    +
  • + list: List groups +
    • +
      +
    • type=<type>;actions=list
      • +
    +
+ + + + + /groups/<id> + + +
    +
  • ID
    • +
      +
    • + <id> +
      • +
    +
  • Type
    • +
      +
    • + group +
      • +
    +
+ + +
    +
  • + read: Read a group +
    • +
      +
    • id=<id>;actions=read
      • +
    +
  • + update: Update a group +
    • +
      +
    • id=<id>;actions=update
      • +
    +
  • + delete: Delete a group +
    • +
      +
    • id=<id>;actions=delete
      • +
    +
  • + add-members: Add members to a group +
    • +
      +
    • id=<id>;actions=add-members
      • +
    +
  • + set-members: Set the full set of members on a group +
    • +
      +
    • id=<id>;actions=set-members
      • +
    +
  • + remove-members: Remove members from a group +
    • +
      +
    • id=<id>;actions=remove-members
      • +
    +
+ + + + Host + +
    +
  • Project
    • +
+ + + /hosts + + +
    +
  • Type
    • +
      +
    • + host +
      • +
    +
+ + +
    +
  • + create: Create a host +
    • +
      +
    • type=<type>;actions=create
      • +
    +
  • + list: List hosts +
    • +
      +
    • type=<type>;actions=list
      • +
    +
+ + + + + /hosts/<id> + + +
    +
  • ID
    • +
      +
    • + <id> +
      • +
    +
  • Pin
    • +
      +
    • + <host-catalog-id> +
      • +
    +
  • Type
    • +
      +
    • + host +
      • +
    +
+ + +
    +
  • + read: Read a host +
    • +
      +
    • id=<id>;actions=read
      • +
    • id=<pin>;type=<type>;actions=read
      • +
    +
  • + update: Update a host +
    • +
      +
    • id=<id>;actions=update
      • +
    • id=<pin>;type=<type>;actions=update
      • +
    +
  • + delete: Delete a host +
    • +
      +
    • id=<id>;actions=delete
      • +
    • id=<pin>;type=<type>;actions=delete
      • +
    +
+ + + + Host Catalog + +
    +
  • Project
    • +
+ + + /host-catalogs + + +
    +
  • Type
    • +
      +
    • + host-catalog +
      • +
    +
+ + +
    +
  • + create: Create a host catalog +
    • +
      +
    • type=<type>;actions=create
      • +
    +
  • + list: List host catalogs +
    • +
      +
    • type=<type>;actions=list
      • +
    +
+ + + + + /host-catalogs/<id> + + +
    +
  • ID
    • +
      +
    • + <id> +
      • +
    +
  • Type
    • +
      +
    • + host-catalog +
      • +
    +
+ + +
    +
  • + read: Read a host catalog +
    • +
      +
    • id=<id>;actions=read
      • +
    +
  • + update: Update a host catalog +
    • +
      +
    • id=<id>;actions=update
      • +
    +
  • + delete: Delete a host catalog +
    • +
      +
    • id=<id>;actions=delete
      • +
    +
+ + + + Host Set + +
    +
  • Project
    • +
+ + + /host-sets + + +
    +
  • Type
    • +
      +
    • + host-set +
      • +
    +
+ + +
    +
  • + create: Create a host set +
    • +
      +
    • type=<type>;actions=create
      • +
    +
  • + list: List host sets +
    • +
      +
    • type=<type>;actions=list
      • +
    +
+ + + + + /targets/<id> + + +
    +
  • ID
    • +
      +
    • + <id> +
      • +
    +
  • Pin
    • +
      +
    • + <host-catalog-id> +
      • +
    +
  • Type
    • +
      +
    • + host-set +
      • +
    +
+ + +
    +
  • + read: Read a host set +
    • +
      +
    • id=<id>;actions=read
      • +
    • id=<pin>;type=<type>;actions=read
      • +
    +
  • + update: Update a host set +
    • +
      +
    • id=<id>;actions=update
      • +
    • id=<pin>;type=<type>;actions=update
      • +
    +
  • + delete: Delete a host set +
    • +
      +
    • id=<id>;actions=delete
      • +
    • id=<pin>;type=<type>;actions=delete
      • +
    +
  • + add-hosts: Add hosts to a host-set +
    • +
      +
    • id=<id>;actions=add-hosts
      • +
    • id=<pin>;type=<type>;actions=add-hosts
      • +
    +
  • + set-hosts: Set the full set of hosts on a host set +
    • +
      +
    • id=<id>;actions=set-hosts
      • +
    • id=<pin>;type=<type>;actions=set-hosts
      • +
    +
  • + remove-hosts: Remove hosts from a host set +
    • +
      +
    • id=<id>;actions=remove-hosts
      • +
    • id=<pin>;type=<type>;actions=remove-hosts
      • +
    +
+ + + + Role + +
    +
  • Global
    • +
  • Org
    • +
  • Project
    • +
+ + + /roles + + +
    +
  • Type
    • +
      +
    • + role +
      • +
    +
+ + +
    +
  • + create: Create a role +
    • +
      +
    • type=<type>;actions=create
      • +
    +
  • + list: List roles +
    • +
      +
    • type=<type>;actions=list
      • +
    +
+ + + + + /roles/<id> + + +
    +
  • ID
    • +
      +
    • + <id> +
      • +
    +
  • Type
    • +
      +
    • + role +
      • +
    +
+ + +
    +
  • + read: Read a role +
    • +
      +
    • id=<id>;actions=read
      • +
    +
  • + update: Update a role +
    • +
      +
    • id=<id>;actions=update
      • +
    +
  • + delete: Delete a role +
    • +
      +
    • id=<id>;actions=delete
      • +
    +
  • + add-principals: Add principals to a role +
    • +
      +
    • id=<id>;actions=add-principals
      • +
    +
  • + set-principals: Set the full set of principals on a role +
    • +
      +
    • id=<id>;actions=set-principals
      • +
    +
  • + remove-principals: Remove principals from a role +
    • +
      +
    • id=<id>;actions=remove-principals
      • +
    +
  • + add-grants: Add grants to a role +
    • +
      +
    • id=<id>;actions=add-grants
      • +
    +
  • + set-grants: Set the full set of grants on a role +
    • +
      +
    • id=<id>;actions=set-grants
      • +
    +
  • + remove-grants: Remove grants from a role +
    • +
      +
    • id=<id>;actions=remove-grants
      • +
    +
+ + + + Scope + +
    +
  • Global
    • +
  • Org
    • +
+ + + /scopes + + +
    +
  • Type
    • +
      +
    • + scope +
      • +
    +
+ + +
    +
  • + create: Create a scope +
    • +
      +
    • type=<type>;actions=create
      • +
    +
  • + list: List scopes +
    • +
      +
    • type=<type>;actions=list
      • +
    +
+ + + + + /scopes/<id> + + +
    +
  • ID
    • +
      +
    • + <id> +
      • +
    +
  • Type
    • +
      +
    • + scope +
      • +
    +
+ + +
    +
  • + read: Read a scope +
    • +
      +
    • id=<id>;actions=read
      • +
    +
  • + update: Update a scope +
    • +
      +
    • id=<id>;actions=update
      • +
    +
  • + delete: Delete a scope +
    • +
      +
    • id=<id>;actions=delete
      • +
    +
+ + + + Session + +
    +
  • Project
    • +
+ + + /sessions + + +
    +
  • Type
    • +
      +
    • + session +
      • +
    +
+ + +
    +
  • + list: List sessions +
    • +
      +
    • type=<type>;actions=list
      • +
    +
+ + + + + /session/<id> + + +
    +
  • ID
    • +
      +
    • + <id> +
      • +
    +
  • Type
    • +
      +
    • + session +
      • +
    +
+ + +
    +
  • + read: Read a session +
    • +
      +
    • id=<id>;actions=read
      • +
    +
  • + cancel: Cancel a session +
    • +
      +
    • id=<id>;actions=cancel
      • +
    +
+ + + + Target + +
    +
  • Project
    • +
+ + + /targets + + +
    +
  • Type
    • +
      +
    • + target +
      • +
    +
+ + +
    +
  • + create: Create a target +
    • +
      +
    • type=<type>;actions=create
      • +
    +
  • + list: List targets +
    • +
      +
    • type=<type>;actions=list
      • +
    +
+ + + + + /targets/<id> + + +
    +
  • ID
    • +
      +
    • + <id> +
      • +
    +
  • Type
    • +
      +
    • + target +
      • +
    +
+ + +
    +
  • + read: Read a target +
    • +
      +
    • id=<id>;actions=read
      • +
    +
  • + update: Update a target +
    • +
      +
    • id=<id>;actions=update
      • +
    +
  • + delete: Delete a target +
    • +
      +
    • id=<id>;actions=delete
      • +
    +
  • + add-host-sets: Add host sets to a target +
    • +
      +
    • id=<id>;actions=add-host-sets
      • +
    +
  • + set-host-sets: Set the full set of host sets on a target +
    • +
      +
    • id=<id>;actions=set-host-sets
      • +
    +
  • + remove-host-sets: Remove host sets from a target +
    • +
      +
    • id=<id>;actions=remove-host-sets
      • +
    +
  • + authorize: Authorize a session via the target +
    • +
      +
    • id=<id>;actions=authorize
      • +
    +
+ + + + User + +
    +
  • Global
    • +
  • Org
    • +
+ + + /users + + +
    +
  • Type
    • +
      +
    • + user +
      • +
    +
+ + +
    +
  • + create: Create a user +
    • +
      +
    • type=<type>;actions=create
      • +
    +
  • + list: List users +
    • +
      +
    • type=<type>;actions=list
      • +
    +
+ + + + + /users/<id> + + +
    +
  • ID
    • +
      +
    • + <id> +
      • +
    +
  • Type
    • +
      +
    • + user +
      • +
    +
+ + +
    +
  • + read: Read a user +
    • +
      +
    • id=<id>;actions=read
      • +
    +
  • + update: Update a user +
    • +
      +
    • id=<id>;actions=update
      • +
    +
  • + delete: Delete a user +
    • +
      +
    • id=<id>;actions=delete
      • +
    +
  • + add-accounts: Add accounts to a user +
    • +
      +
    • id=<id>;actions=add-accounts
      • +
    +
  • + set-accounts: Set the full set of accounts on a user +
    • +
      +
    • id=<id>;actions=set-accounts
      • +
    +
  • + remove-accounts: Remove accounts from a user +
    • +
      +
    • id=<id>;actions=remove-accounts
      • +
    +
+ + + + + + \ No newline at end of file