Create an access rule. | NVIDIA Run:ai Documentation

curl -X POST http://localhost:8080/api/v1/authorization/access-rules \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "subjectId": "user@run.ai",
  "roleId": 53142648,
  "scopeId": "a418ed33-9399-48c0-a890-122cadd13bfd",
  "scopeType": "system",
  "subjectType": "user"
}'

{
  "subjectId": "user@run.ai",
  "roleId": 53142648,
  "scopeId": "a418ed33-9399-48c0-a890-122cadd13bfd",
  "scopeType": "system",
  "subjectType": "user",
  "roleName": "admin",
  "scopeName": "tenant-x",
  "id": 32,
  "createdAt": "2024-01-15T09:30:00Z",
  "updatedAt": "2024-01-15T09:30:00Z",
  "tenantId": 1001,
  "createdBy": "user@run.ai",
  "clusterId": "71f69d83-ba66-4822-adf5-55ce55efd210",
  "deletedAt": "2024-01-15T09:30:00Z",
  "status": {
    "phase": "Ready",
    "message": "Failed to enforce department 'department-a'",
    "details": "NotReady: [cluster1-uuid]; Ready: [cluster2-uuid, cluster3-uuid]"
  }
}

Use to bind a predefined role to a subject (user, group or application) in a scope.

Authentication

AuthorizationBearer

Bearer authentication

Request

The access rule to create.

subjectIdstringRequired

The unique identifier of the subject (e.g., user, group, or app).

roleIdintegerRequired

The numeric ID of the assigned role.

scopeIdstringRequired

The unique identifier of the scope.

scopeTypeenumRequired

Allowed values:

subjectTypeenumRequired

Subject type enum for access rules.

Note: The ‘app’ subject type is DEPRECATED. Please use ‘service-account’ instead for service accounts.

Allowed values:

clusterIdstringOptionalformat: "uuid"

The id of the cluster.

Response

Created

subjectIdstring

The unique identifier of the subject (e.g., user, group, or app).

roleIdinteger

The numeric ID of the assigned role.

scopeIdstring

The unique identifier of the scope.

scopeTypeenum

Allowed values:

subjectTypeenum

Subject type enum for access rule responses. Extends SubjectType with the built-in all-authenticated-users subject, which applies to every authenticated user and service account.

Note: The ‘app’ subject type is DEPRECATED. Please use ‘service-account’ instead for service accounts.

Allowed values:

roleNamestring

The name of the assigned role (e.g., admin, viewer).

scopeNamestring

Human-readable name of the scope (e.g., tenant-x).

idinteger

The ID of the access rule entry.

createdAtdatetime

The timestamp for when the access rule was created.

updatedAtdatetime

The timestamp for the last time the access rule was updated.

tenantIdinteger

The id of the tenant.

createdBystring

Identifier of the user who created the access rule.

clusterIdstringOptionalformat: "uuid"

The id of the cluster.

deletedAtdatetime or nullOptional

The timestamp indicating when the access rule was deleted.

statusobjectOptional

Status of the Access Rule in the cluster. Available only for clusters of version 2.22.0 or above.

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

404

Not Found Error

500

Internal Server Error

503

Service Unavailable Error