Org Role Management

Organization management functions.

Create a new role within the organization

post

This endpoint allows users to create a new role in the specified organization. It is intended for administrators managing roles and permissions. Ensure that the role definition aligns with organizational policies and requirements.

👤 User Credential: You must login and authenticate a user and use their access token to invoke this service. This will operate the action under the specified user.

🔒 Permission: org.roles.create is required in order for the call to succeed. You must configure permissions for the person or service calling this endpoint and add this permission to their identity.

Authorizations

authorizationCode

OAuth2clientCredentialsRequired

An OIDC service account that was authenticated.

Authorization URL: Token URL:

Path parameters

organizationIdstringRequired

Body

application/json

idstringOptional

namestringOptional

namespacestringOptional

descriptionstringOptional

stagestring · enumOptionalPossible values:

Responses

200

OK

*/*

401

Unauthorized

*/*

post

/directory/orgs/{organizationId}/roles

HTTPcURLJavaScriptPython

POST /directory/orgs/{organizationId}/roles HTTP/1.1
Host: gateway.dev.klustr.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 116

{
  "id": "text",
  "name": "text",
  "namespace": "text",
  "description": "text",
  "stage": "alpha",
  "permissions": [
    {
      "scope": "text"
    }
  ]
}

{
  "id": "text",
  "name": "text",
  "namespace": "text",
  "description": "text",
  "stage": "alpha",
  "permissions": [
    {
      "scope": "text"
    }
  ]
}

Delete all roles for the specified organization

delete

This endpoint allows the deletion of all roles associated with a specific organization. It is intended for use by authorized personnel to manage role permissions effectively. Ensure that you have the necessary permissions before executing this action.

👤 User Credential: You must login and authenticate a user and use their access token to invoke this service. This will operate the action under the specified user.

🔒 Permission: org.roles.delete is required in order for the call to succeed. You must configure permissions for the person or service calling this endpoint and add this permission to their identity.

Authorizations

authorizationCode

OAuth2clientCredentialsRequired

An OIDC service account that was authenticated.

Authorization URL: Token URL:

Path parameters

organizationIdstringRequired

Responses

200

OK

401

Unauthorized

*/*

delete

/directory/orgs/{organizationId}/roles

HTTPcURLJavaScriptPython

DELETE /directory/orgs/{organizationId}/roles HTTP/1.1
Host: gateway.dev.klustr.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

No content

Generate roles and permissions for an organization

post

This endpoint generates a default set of roles and permissions for the specified organization. It ensures standard compliance in role management, facilitating easier maintenance and generation of roles based on the provided namespace and noun.

👤 User Credential: You must login and authenticate a user and use their access token to invoke this service. This will operate the action under the specified user.

🔒 Permission: org.roles.create is required in order for the call to succeed. You must configure permissions for the person or service calling this endpoint and add this permission to their identity.

Authorizations

authorizationCode

OAuth2clientCredentialsRequired

An OIDC service account that was authenticated.

Authorization URL: Token URL:

Path parameters

organizationIdstringRequired

Body

application/json

Responses

200

The generated roles and permissions.

application/json

401

Unauthorized

*/*

post

/directory/orgs/{organizationId}/roles/generate

HTTPcURLJavaScriptPython

POST /directory/orgs/{organizationId}/roles/generate HTTP/1.1
Host: gateway.dev.klustr.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 36

{
  "resources": [
    {
      "namespace": "text"
    }
  ]
}

[
  {
    "id": "user.consent.admin.role",
    "name": "user.consent - Admin",
    "namespace": "User Consent API",
    "description": "Default admin role for User Consent",
    "stage": "alpha",
    "permissions": [
      {
        "scope": "user.consent.create"
      },
      {
        "scope": "user.consent.delete"
      },
      {
        "scope": "user.consent.update"
      },
      {
        "scope": "user.consent.get"
      },
      {
        "scope": "user.consent.list"
      },
      {
        "scope": "user.consent.lookup"
      }
    ]
  },
  {
    "id": "user.consent.readonly.role",
    "name": "user.consent - Read Only",
    "namespace": "User Consent API",
    "description": "Default reader role for User.consent",
    "stage": "alpha",
    "permissions": [
      {
        "scope": "user.consent.get"
      },
      {
        "scope": "user.consent.list"
      }
    ]
  }
]

List all permissions for the organization

get

Retrieve a comprehensive list of permissions configured for the organization. This includes permissions associated with all roles and groups, providing a clear overview of access rights. Useful for understanding and managing organizational permissions effectively.

👤 User Credential: You must login and authenticate a user and use their access token to invoke this service. This will operate the action under the specified user.

Authorizations

authorizationCode

OAuth2clientCredentialsRequired

An OIDC service account that was authenticated.

Authorization URL: Token URL:

Path parameters

organizationIdstringRequired

Responses

200

OK

*/*

401

Unauthorized

*/*

get

/directory/orgs/{organizationId}/roles/permissions

HTTPcURLJavaScriptPython

GET /directory/orgs/{organizationId}/roles/permissions HTTP/1.1
Host: gateway.dev.klustr.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

[
  {
    "scope": "text"
  }
]

Retrieve a specific role within an organization

get

Fetches details of a role identified by its ID within the specified organization. This endpoint ensures that only existing roles are returned, providing clarity on role permissions and attributes. It is essential for managing user roles effectively within the organization.

👤 User Credential: You must login and authenticate a user and use their access token to invoke this service. This will operate the action under the specified user.

🔒 Permission: org.roles.get is required in order for the call to succeed. You must configure permissions for the person or service calling this endpoint and add this permission to their identity.

Authorizations

authorizationCode

OAuth2clientCredentialsRequired

An OIDC service account that was authenticated.

Authorization URL: Token URL:

Path parameters

organizationIdstringRequired

roleIdstringRequired

Responses

200

OK

*/*

401

Unauthorized

*/*

get

/directory/orgs/{organizationId}/roles/{roleId}

HTTPcURLJavaScriptPython

GET /directory/orgs/{organizationId}/roles/{roleId} HTTP/1.1
Host: gateway.dev.klustr.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

{
  "id": "text",
  "name": "text",
  "namespace": "text",
  "description": "text",
  "stage": "alpha",
  "permissions": [
    {
      "scope": "text"
    }
  ]
}

Update an existing role within an organization

put

This endpoint allows for the modification of a specific role in the organization. It requires the organization ID and role ID to identify the role being updated. Proper authentication is necessary to ensure that only authorized users can make changes to roles.

👤 User Credential: You must login and authenticate a user and use their access token to invoke this service. This will operate the action under the specified user.

🔒 Permission: org.roles.update is required in order for the call to succeed. You must configure permissions for the person or service calling this endpoint and add this permission to their identity.

Authorizations

authorizationCode

OAuth2clientCredentialsRequired

An OIDC service account that was authenticated.

Authorization URL: Token URL:

Path parameters

organizationIdstringRequired

roleIdstringRequired

Body

application/json

idstringOptional

namestringOptional

namespacestringOptional

descriptionstringOptional

stagestring · enumOptionalPossible values:

Responses

200

OK

*/*

401

Unauthorized

*/*

put

/directory/orgs/{organizationId}/roles/{roleId}

HTTPcURLJavaScriptPython

PUT /directory/orgs/{organizationId}/roles/{roleId} HTTP/1.1
Host: gateway.dev.klustr.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 116

{
  "id": "text",
  "name": "text",
  "namespace": "text",
  "description": "text",
  "stage": "alpha",
  "permissions": [
    {
      "scope": "text"
    }
  ]
}

{
  "id": "text",
  "name": "text",
  "namespace": "text",
  "description": "text",
  "stage": "alpha",
  "permissions": [
    {
      "scope": "text"
    }
  ]
}

Delete a specific role in the organization

delete

This endpoint allows for the removal of a designated role within a specified organization. It is crucial for maintaining accurate role management and permissions. Ensure that the role being deleted is no longer needed, as this action is irreversible.

👤 User Credential: You must login and authenticate a user and use their access token to invoke this service. This will operate the action under the specified user.

🔒 Permission: org.roles.delete is required in order for the call to succeed. You must configure permissions for the person or service calling this endpoint and add this permission to their identity.

Authorizations

authorizationCode

OAuth2clientCredentialsRequired

An OIDC service account that was authenticated.

Authorization URL: Token URL:

Path parameters

organizationIdstringRequired

roleIdstringRequired

Responses

200

OK

401

Unauthorized

*/*

delete

/directory/orgs/{organizationId}/roles/{roleId}

HTTPcURLJavaScriptPython

DELETE /directory/orgs/{organizationId}/roles/{roleId} HTTP/1.1
Host: gateway.dev.klustr.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

No content

Retrieve role assignments for the specified organization role.

get

This endpoint returns all role assignments associated with a specific role in the organization. It provides visibility into the users assigned to the role, helping manage permissions effectively. Use this to ensure appropriate access levels within your organization.

👤 User Credential: You must login and authenticate a user and use their access token to invoke this service. This will operate the action under the specified user.

🔒 Permission: org.roles.list is required in order for the call to succeed. You must configure permissions for the person or service calling this endpoint and add this permission to their identity.

Authorizations

authorizationCode

OAuth2clientCredentialsRequired

An OIDC service account that was authenticated.

Authorization URL: Token URL:

Path parameters

organizationIdstringRequired

roleIdstringRequired

Query parameters

limitinteger · int32OptionalDefault: 100

startinteger · int32OptionalDefault: 0

Responses

200

OK

*/*

401

Unauthorized

*/*

get

/directory/orgs/{organizationId}/roles/{roleId}/assignments

HTTPcURLJavaScriptPython

GET /directory/orgs/{organizationId}/roles/{roleId}/assignments HTTP/1.1
Host: gateway.dev.klustr.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

{
  "count": 1,
  "limit": 1,
  "skip": 1,
  "docs": [
    {
      "id": "text",
      "role_id": "text",
      "assigned_to": "text",
      "assignee_type": "user",
      "org_id": "text"
    }
  ]
}

Retrieve roles for a specified user in the organization

get

This endpoint returns all roles associated with the specified user within the organization. It is intended for use by authorized personnel to manage user permissions effectively. Ensure that you have the necessary security credentials to access this information.

👤 User Credential: You must login and authenticate a user and use their access token to invoke this service. This will operate the action under the specified user.

Authorizations

authorizationCode

OAuth2clientCredentialsRequired

An OIDC service account that was authenticated.

Authorization URL: Token URL:

Path parameters

organizationIdstringRequired

Responses

200

OK

*/*

401

Unauthorized

*/*

get

/directory/orgs/{organizationId}/user/roles

HTTPcURLJavaScriptPython

GET /directory/orgs/{organizationId}/user/roles HTTP/1.1
Host: gateway.dev.klustr.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

{
  "user_id": "text",
  "org_id": "text",
  "roles": [
    {
      "id": "text",
      "name": "text",
      "namespace": "text",
      "description": "text",
      "stage": "alpha",
      "permissions": [
        {
          "scope": "text"
        }
      ]
    }
  ]
}

Retrieve roles for a specific user in the organization.

get

This endpoint returns all roles associated with the specified user within the given organization. It provides insights into the user's permissions and access levels. This information is crucial for managing user entitlements effectively.

👤 User Credential: You must login and authenticate a user and use their access token to invoke this service. This will operate the action under the specified user.

🔒 Permission: org.user.permissions.list is required in order for the call to succeed. You must configure permissions for the person or service calling this endpoint and add this permission to their identity.

Authorizations

authorizationCode

OAuth2clientCredentialsRequired

An OIDC service account that was authenticated.

Authorization URL: Token URL:

Path parameters

organizationIdstringRequired

userIdstringRequired

Responses

200

OK

*/*

401

Unauthorized

*/*

get

/directory/orgs/{organizationId}/users/{userId}/roles

HTTPcURLJavaScriptPython

GET /directory/orgs/{organizationId}/users/{userId}/roles HTTP/1.1
Host: gateway.dev.klustr.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

{
  "user_id": "text",
  "org_id": "text",
  "roles": [
    {
      "id": "text",
      "name": "text",
      "namespace": "text",
      "description": "text",
      "stage": "alpha",
      "permissions": [
        {
          "scope": "text"
        }
      ]
    }
  ]
}

Assign roles to a user in the organization

post

This endpoint allows the addition of specified roles to a user within a particular organization. It ensures that role management is handled securely and effectively. Use this operation to enhance user permissions and access based on organizational needs.

👤 User Credential: You must login and authenticate a user and use their access token to invoke this service. This will operate the action under the specified user.

🔒 Permission: org.user.roles.update is required in order for the call to succeed. You must configure permissions for the person or service calling this endpoint and add this permission to their identity.

Authorizations

authorizationCode

OAuth2clientCredentialsRequired

An OIDC service account that was authenticated.

Authorization URL: Token URL:

Path parameters

organizationIdstringRequired

userIdstringRequired

Bodystring[]

application/json

string[]Optional

Responses

200

OK

*/*

401

Unauthorized

*/*

post

/directory/orgs/{organizationId}/users/{userId}/roles

HTTPcURLJavaScriptPython

POST /directory/orgs/{organizationId}/users/{userId}/roles HTTP/1.1
Host: gateway.dev.klustr.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 8

[
  "text"
]

[
  {
    "id": "text",
    "role_id": "text",
    "assigned_to": "text",
    "assignee_type": "user",
    "org_id": "text"
  }
]

Assign a role to a user in the organization

post

This endpoint allows you to add a specified role to a user within the organization. It is essential for managing user permissions effectively. Ensure that you have the necessary authorization to perform this action.

👤 User Credential: You must login and authenticate a user and use their access token to invoke this service. This will operate the action under the specified user.

Authorizations

authorizationCode

OAuth2clientCredentialsRequired

An OIDC service account that was authenticated.

Authorization URL: Token URL:

Path parameters

organizationIdstringRequired

roleIdstringRequired

userIdstringRequired

Responses

200

OK

*/*

401

Unauthorized

*/*

post

/directory/orgs/{organizationId}/users/{userId}/roles/{roleId}

HTTPcURLJavaScriptPython

POST /directory/orgs/{organizationId}/users/{userId}/roles/{roleId} HTTP/1.1
Host: gateway.dev.klustr.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

{
  "id": "text",
  "role_id": "text",
  "assigned_to": "text",
  "assignee_type": "user",
  "org_id": "text"
}

Remove a role from a user in the organization

get

This endpoint allows the removal of a specified role from a user within the organization. It ensures that the role is only removed if it currently exists for the user. This operation is crucial for maintaining accurate role assignments and permissions.

👤 User Credential: You must login and authenticate a user and use their access token to invoke this service. This will operate the action under the specified user.

Authorizations

authorizationCode

OAuth2clientCredentialsRequired

An OIDC service account that was authenticated.

Authorization URL: Token URL:

Path parameters

organizationIdstringRequired

roleIdstringRequired

userIdstringRequired

Responses

200

OK

401

Unauthorized

*/*

get

/directory/orgs/{organizationId}/users/{userId}/roles/{roleId}/delete

HTTPcURLJavaScriptPython

GET /directory/orgs/{organizationId}/users/{userId}/roles/{roleId}/delete HTTP/1.1
Host: gateway.dev.klustr.io
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

No content