Create an access rule for authenticated users/service accounts

curl -X POST http://localhost:8080/api/v1/authorization/access-rules/authenticated-users \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "roleId": 53142648,
  "scopeId": "a418ed33-9399-48c0-a890-122cadd13bfd",
  "scopeType": "tenant"
}'

{
  "subjectId": "user@run.ai",
  "roleId": 53142648,
  "scopeId": "a418ed33-9399-48c0-a890-122cadd13bfd",
  "scopeType": "system",
  "subjectType": "user",
  "roleName": "admin",
  "scopeName": "tenant-x",
  "id": 32,
  "createdAt": "2024-01-15T09:30:00Z",
  "updatedAt": "2024-01-15T09:30:00Z",
  "tenantId": 1001,
  "createdBy": "user@run.ai",
  "clusterId": "71f69d83-ba66-4822-adf5-55ce55efd210",
  "deletedAt": "2024-01-15T09:30:00Z",
  "status": {
    "phase": "Ready",
    "message": "Failed to enforce department 'department-a'",
    "details": "NotReady: [cluster1-uuid]; Ready: [cluster2-uuid, cluster3-uuid]"
  }
}

Creates an access rule bound to every authenticated user and service account for the given role and scope.

Authentication

AuthorizationBearer

Bearer authentication

Request

This endpoint expects an object.

roleIdintegerRequired

The ID of the role to assign.

scopeIdstringRequired

The unique identifier of the scope.

scopeTypeenumRequired

The type of scope the access rule applies to.

Allowed values:

clusterIdstringOptionalformat: "uuid"

The id of the cluster.

Response

Created

subjectIdstring

The unique identifier of the subject (e.g., user, group, or app).

roleIdinteger

The numeric ID of the assigned role.

scopeIdstring

The unique identifier of the scope.

scopeTypeenum

Allowed values:

subjectTypeenum

Subject type enum for access rule responses. Extends SubjectType with the built-in all-authenticated-users subject, which applies to every authenticated user and service account.

Note: The ‘app’ subject type is DEPRECATED. Please use ‘service-account’ instead for service accounts.

Allowed values:

roleNamestring

The name of the assigned role (e.g., admin, viewer).

scopeNamestring

Human-readable name of the scope (e.g., tenant-x).

idinteger

The ID of the access rule entry.

createdAtdatetime

The timestamp for when the access rule was created.

updatedAtdatetime

The timestamp for the last time the access rule was updated.

tenantIdinteger

The id of the tenant.

createdBystring

Identifier of the user who created the access rule.

clusterIdstringOptionalformat: "uuid"

The id of the cluster.

deletedAtdatetime or nullOptional

The timestamp indicating when the access rule was deleted.

statusobjectOptional

Status of the Access Rule in the cluster. Available only for clusters of version 2.22.0 or above.

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

404

Not Found Error

500

Internal Server Error

503

Service Unavailable Error