> This page is for Multi-Tenant, version v3.0 (default). > For other versions, use one of these documentation indexes: > - v3.0 (default): https://docs.nvidia.com/run-ai/multi-tenant/v3.0/llms.txt > - v2.26: https://docs.nvidia.com/run-ai/multi-tenant/v2.26/llms.txt > - v2.25: https://docs.nvidia.com/run-ai/multi-tenant/v2.25/llms.txt > - v2.24: https://docs.nvidia.com/run-ai/multi-tenant/v2.24/llms.txt > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/run-ai/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/run-ai/_mcp/server. # Create Multiple Access Rules POST http://localhost:8080/api/v1/authorization/access-rules/batch-create Content-Type: application/json Creates a batch of access rules in a single operation. Requires a list of access rule objects, each specifying the subject, role, and scope. Returns the result of the operation, including which rules were successfully created and any that failed, along with error messages if applicable. Reference: https://docs.nvidia.com/run-ai/multi-tenant/reference/rest-api/endpoints/authentication-and-authorization/access-rules/batch-create ## Authentication - `Authorization` header (bearer token, required) — Bearer authentication ## Request ### Body (application/json) This endpoint expects an AccessRulesBatchCreateFields. - `payload` (AccessRulesBatchCreateFieldsPayload, required) — An array of access rule objects, each containing the role, subject, cluster, and scope to apply. ## Response ### 200 Request completed successfully. - `succeeded` (list of AccessRule, optional) - `failed` (list of AccessRulesBatchCreateResponseFailedItems, optional) ## Errors ### 400 Bad Request Error Bad request. - `code` (integer, required) - `message` (string, required) - `details` (string, optional) ### 401 Unauthorized Error Unauthorized - `code` (integer, required) - `message` (string, required) - `details` (string, optional) ### 403 Forbidden Error Forbidden - `code` (integer, required) - `message` (string, required) - `details` (string, optional) ### 500 Internal Server Error unexpected error - `code` (integer, required) - `message` (string, required) - `details` (string, optional) ### 503 Service Unavailable Error unexpected error - `code` (integer, required) - `message` (string, required) - `details` (string, optional) ## Types ### AccessRulesBatchCreateFieldsPayload An array of access rule objects, each containing the role, subject, cluster, and scope to apply. - `roleId` (integer, required) — The numeric ID of the role to assign (e.g., admin, viewer). - `subjects` (list of AccessRuleSubjectsItems, required) — subjects for the access rules. must have at least one value - `scopes` (list of AccessRuleScopesItems, required) — scopes for the access rules. must have at least one value - `clusterId` (string, optional) — The id of the cluster. ### AccessRule - `subjectId` (string, required) — The unique identifier of the subject (e.g., user, group, or app). - `roleId` (integer, required) — The numeric ID of the assigned role. - `scopeId` (string, required) — The unique identifier of the scope. - `scopeType` (enum, required) - Allowed values: `system`, `tenant`, `cluster`, `department`, `project` - `subjectType` (enum, required) — Subject type enum for access rule responses. Extends SubjectType with the built-in all-authenticated-users subject, which applies to every authenticated user and service account. Note: The 'app' subject type is DEPRECATED. Please use 'service-account' instead for service accounts. - Allowed values: `user`, `app`, `service-account`, `group`, `all-authenticated-users` - `roleName` (string, required) — The name of the assigned role (e.g., admin, viewer). - `scopeName` (string, required) — Human-readable name of the scope (e.g., tenant-x). - `id` (integer, required) — The ID of the access rule entry. - `createdAt` (datetime, required) — The timestamp for when the access rule was created. - `updatedAt` (datetime, required) — The timestamp for the last time the access rule was updated. - `tenantId` (integer, required) — The id of the tenant. - `createdBy` (string, required) — Identifier of the user who created the access rule. - `clusterId` (string, optional) — The id of the cluster. - `deletedAt` (datetime, optional, nullable) — The timestamp indicating when the access rule was deleted. - `status` (AccessRuleStatusResponse, optional) — Status of the Access Rule in the cluster. Available only for clusters of version 2.22.0 or above. ### AccessRulesBatchCreateResponseFailedItems - `payload` (AccessRuleCreationFields, optional) - `code` (integer, optional) — A numeric code representing the error type. - `message` (string, optional) — A human-readable message describing the access rule IDs that failed to create. ### AccessRuleSubjectsItems - `subjectId` (string, required) — The unique identifier of the subject e.g., user, group, or app). - `subjectType` (enum, required) — Subject type enum for access rules. Note: The 'app' subject type is DEPRECATED. Please use 'service-account' instead for service accounts. - Allowed values: `user`, `app`, `service-account`, `group` ### AccessRuleScopesItems - `scopeId` (string, required) — The id of the cluster, department or project, depending on the scope type. - `scopeType` (enum, required) - Allowed values: `system`, `tenant`, `cluster`, `department`, `project` ### AccessRuleStatusResponse Status of the Access Rule in the cluster. Available only for clusters of version 2.22.0 or above. - `phase` (enum, optional) — Phase of the Access Rule in the cluster. - Allowed values: `Creating`, `Ready`, `NotReady`, `Deleting` - `message` (string, optional) — Message for status of Access Rule in the cluster - `details` (string, optional) — Details for status of Access Rule in the clusters ### AccessRuleCreationFields - `subjectId` (string, required) — The unique identifier of the subject (e.g., user, group, or app). - `roleId` (integer, required) — The numeric ID of the assigned role. - `scopeId` (string, required) — The unique identifier of the scope. - `scopeType` (enum, required) - Allowed values: `system`, `tenant`, `cluster`, `department`, `project` - `subjectType` (enum, required) — Subject type enum for access rules. Note: The 'app' subject type is DEPRECATED. Please use 'service-account' instead for service accounts. - Allowed values: `user`, `app`, `service-account`, `group` - `clusterId` (string, optional) — The id of the cluster. ## Examples **Request** ```json { "payload": { "roleId": 53142648, "subjects": [ { "subjectId": "user@run.ai", "subjectType": "user" } ], "scopes": [ { "scopeId": "string", "scopeType": "system" } ] } } ``` **Response** ```json { "succeeded": [ { "subjectId": "user@run.ai", "roleId": 53142648, "scopeId": "a418ed33-9399-48c0-a890-122cadd13bfd", "scopeType": "system", "subjectType": "user", "roleName": "admin", "scopeName": "tenant-x", "id": 32, "createdAt": "2024-01-15T09:30:00Z", "updatedAt": "2024-01-15T09:30:00Z", "tenantId": 1001, "createdBy": "user@run.ai", "clusterId": "71f69d83-ba66-4822-adf5-55ce55efd210", "deletedAt": "2024-01-15T09:30:00Z", "status": { "phase": "Ready", "message": "Failed to enforce department 'department-a'", "details": "NotReady: [cluster1-uuid]; Ready: [cluster2-uuid, cluster3-uuid]" } } ], "failed": [ { "payload": { "subjectId": "user@run.ai", "roleId": 53142648, "scopeId": "a418ed33-9399-48c0-a890-122cadd13bfd", "scopeType": "system", "subjectType": "user", "clusterId": "71f69d83-ba66-4822-adf5-55ce55efd210" }, "code": 1, "message": "string" } ] } ``` **SDK Code** ```python import requests url = "http://localhost:8080/api/v1/authorization/access-rules/batch-create" payload = { "payload": { "roleId": 53142648, "subjects": [ { "subjectId": "user@run.ai", "subjectType": "user" } ], "scopes": [ { "scopeId": "string", "scopeType": "system" } ] } } headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers) print(response.json()) ``` ```javascript const url = 'http://localhost:8080/api/v1/authorization/access-rules/batch-create'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"payload":{"roleId":53142648,"subjects":[{"subjectId":"user@run.ai","subjectType":"user"}],"scopes":[{"scopeId":"string","scopeType":"system"}]}}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "http://localhost:8080/api/v1/authorization/access-rules/batch-create" payload := strings.NewReader("{\n \"payload\": {\n \"roleId\": 53142648,\n \"subjects\": [\n {\n \"subjectId\": \"user@run.ai\",\n \"subjectType\": \"user\"\n }\n ],\n \"scopes\": [\n {\n \"scopeId\": \"string\",\n \"scopeType\": \"system\"\n }\n ]\n }\n}") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("Authorization", "Bearer ") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("http://localhost:8080/api/v1/authorization/access-rules/batch-create") http = Net::HTTP.new(url.host, url.port) request = Net::HTTP::Post.new(url) request["Authorization"] = 'Bearer ' request["Content-Type"] = 'application/json' request.body = "{\n \"payload\": {\n \"roleId\": 53142648,\n \"subjects\": [\n {\n \"subjectId\": \"user@run.ai\",\n \"subjectType\": \"user\"\n }\n ],\n \"scopes\": [\n {\n \"scopeId\": \"string\",\n \"scopeType\": \"system\"\n }\n ]\n }\n}" response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("http://localhost:8080/api/v1/authorization/access-rules/batch-create") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"payload\": {\n \"roleId\": 53142648,\n \"subjects\": [\n {\n \"subjectId\": \"user@run.ai\",\n \"subjectType\": \"user\"\n }\n ],\n \"scopes\": [\n {\n \"scopeId\": \"string\",\n \"scopeType\": \"system\"\n }\n ]\n }\n}") .asString(); ``` ```php request('POST', 'http://localhost:8080/api/v1/authorization/access-rules/batch-create', [ 'body' => '{ "payload": { "roleId": 53142648, "subjects": [ { "subjectId": "user@run.ai", "subjectType": "user" } ], "scopes": [ { "scopeId": "string", "scopeType": "system" } ] } }', 'headers' => [ 'Authorization' => 'Bearer ', 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("http://localhost:8080/api/v1/authorization/access-rules/batch-create"); var request = new RestRequest(Method.POST); request.AddHeader("Authorization", "Bearer "); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{\n \"payload\": {\n \"roleId\": 53142648,\n \"subjects\": [\n {\n \"subjectId\": \"user@run.ai\",\n \"subjectType\": \"user\"\n }\n ],\n \"scopes\": [\n {\n \"scopeId\": \"string\",\n \"scopeType\": \"system\"\n }\n ]\n }\n}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = [ "Authorization": "Bearer ", "Content-Type": "application/json" ] let parameters = ["payload": [ "roleId": 53142648, "subjects": [ [ "subjectId": "user@run.ai", "subjectType": "user" ] ], "scopes": [ [ "scopeId": "string", "scopeType": "system" ] ] ]] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "http://localhost:8080/api/v1/authorization/access-rules/batch-create")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```