Warning
JSON formatted policy file is deprecated since Keystone 19.0.0 (Wallaby). This oslopolicy-convert-json-to-yaml tool will migrate your existing JSON-formatted policy file to YAML in a backward-compatible way.
The following is an overview of all available policies in Keystone.
For a sample configuration file, refer to policy.yaml.
admin_required
role:admin or is_admin:1
(no description provided)
service_role
role:service
(no description provided)
service_or_admin
rule:admin_required or rule:service_role
(no description provided)
owner
user_id:%(user_id)s
(no description provided)
admin_or_owner
rule:admin_required or rule:owner
(no description provided)
token_subject
user_id:%(target.token.user_id)s
(no description provided)
admin_or_token_subject
rule:admin_required or rule:token_subject
(no description provided)
service_admin_or_token_subject
rule:service_or_admin or rule:token_subject
(no description provided)
identity:get_access_rule
(role:reader and system_scope:all) or user_id:%(target.user.id)s
GET /v3/users/{user_id}/access_rules/{access_rule_id}
HEAD /v3/users/{user_id}/access_rules/{access_rule_id}
system
project
Show access rule details.
identity:list_access_rules
(role:reader and system_scope:all) or user_id:%(target.user.id)s
GET /v3/users/{user_id}/access_rules
HEAD /v3/users/{user_id}/access_rules
system
project
List access rules for a user.
identity:delete_access_rule
(role:admin and system_scope:all) or user_id:%(target.user.id)s
DELETE /v3/users/{user_id}/access_rules/{access_rule_id}
system
project
Delete an access_rule.
identity:authorize_request_token
rule:admin_required
PUT /v3/OS-OAUTH1/authorize/{request_token_id}
project
Authorize OAUTH1 request token.
identity:get_access_token
rule:admin_required
GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}
project
Get OAUTH1 access token for user by access token ID.
identity:get_access_token_role
rule:admin_required
GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles/{role_id}
project
Get role for user OAUTH1 access token.
identity:list_access_tokens
rule:admin_required
GET /v3/users/{user_id}/OS-OAUTH1/access_tokens
project
List OAUTH1 access tokens for user.
identity:list_access_token_roles
rule:admin_required
GET /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles
project
List OAUTH1 access token roles.
identity:delete_access_token
rule:admin_required
DELETE /v3/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}
project
Delete OAUTH1 access token.
identity:get_application_credential
(rule:admin_required) or (role:reader and system_scope:all) or rule:owner
GET /v3/users/{user_id}/application_credentials/{application_credential_id}
HEAD /v3/users/{user_id}/application_credentials/{application_credential_id}
system
project
Show application credential details.
identity:list_application_credentials
(rule:admin_required) or (role:reader and system_scope:all) or rule:owner
GET /v3/users/{user_id}/application_credentials
HEAD /v3/users/{user_id}/application_credentials
system
project
List application credentials for a user.
identity:create_application_credential
user_id:%(user_id)s
POST /v3/users/{user_id}/application_credentials
project
Create an application credential.
identity:delete_application_credential
rule:admin_or_owner
DELETE /v3/users/{user_id}/application_credentials/{application_credential_id}
system
project
Delete an application credential.
identity:get_auth_catalog
<empty string>
GET /v3/auth/catalog
HEAD /v3/auth/catalog
Get service catalog.
identity:get_auth_projects
<empty string>
GET /v3/auth/projects
HEAD /v3/auth/projects
List all projects a user has access to via role assignments.
identity:get_auth_domains
<empty string>
GET /v3/auth/domains
HEAD /v3/auth/domains
List all domains a user has access to via role assignments.
identity:get_auth_system
<empty string>
GET /v3/auth/system
HEAD /v3/auth/system
List systems a user has access to via role assignments.
identity:get_consumer
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-OAUTH1/consumers/{consumer_id}
system
project
Show OAUTH1 consumer details.
identity:list_consumers
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-OAUTH1/consumers
system
project
List OAUTH1 consumers.
identity:create_consumer
rule:admin_required
POST /v3/OS-OAUTH1/consumers
system
project
Create OAUTH1 consumer.
identity:update_consumer
rule:admin_required
PATCH /v3/OS-OAUTH1/consumers/{consumer_id}
system
project
Update OAUTH1 consumer.
identity:delete_consumer
rule:admin_required
DELETE /v3/OS-OAUTH1/consumers/{consumer_id}
system
project
Delete OAUTH1 consumer.
identity:get_credential
(rule:admin_required) or (role:reader and system_scope:all) or user_id:%(target.credential.user_id)s
GET /v3/credentials/{credential_id}
system
domain
project
Show credentials details.
identity:list_credentials
(rule:admin_required) or (role:reader and system_scope:all) or user_id:%(target.credential.user_id)s
GET /v3/credentials
system
domain
project
List credentials.
identity:create_credential
(rule:admin_required) or user_id:%(target.credential.user_id)s
POST /v3/credentials
system
domain
project
Create credential.
identity:update_credential
(rule:admin_required) or user_id:%(target.credential.user_id)s
PATCH /v3/credentials/{credential_id}
system
domain
project
Update credential.
identity:delete_credential
(rule:admin_required) or user_id:%(target.credential.user_id)s
DELETE /v3/credentials/{credential_id}
system
domain
project
Delete credential.
identity:get_domain
rule:admin_required or (role:reader and system_scope:all) or token.domain.id:%(target.domain.id)s or token.project.domain.id:%(target.domain.id)s
GET /v3/domains/{domain_id}
system
domain
project
Show domain details.
identity:list_domains
rule:admin_required or (role:reader and system_scope:all) or (role:reader and domain_id:%(target.domain.id)s)
GET /v3/domains
system
domain
project
List domains.
identity:create_domain
rule:admin_required
POST /v3/domains
system
project
Create domain.
identity:update_domain
rule:admin_required
PATCH /v3/domains/{domain_id}
system
project
Update domain.
identity:delete_domain
rule:admin_required
DELETE /v3/domains/{domain_id}
system
project
Delete domain.
identity:create_domain_config
rule:admin_required
PUT /v3/domains/{domain_id}/config
system
project
Create domain configuration.
identity:get_domain_config
rule:admin_required or (role:reader and system_scope:all)
GET /v3/domains/{domain_id}/config
HEAD /v3/domains/{domain_id}/config
GET /v3/domains/{domain_id}/config/{group}
HEAD /v3/domains/{domain_id}/config/{group}
GET /v3/domains/{domain_id}/config/{group}/{option}
HEAD /v3/domains/{domain_id}/config/{group}/{option}
system
project
Get the entire domain configuration for a domain, an option group within a domain, or a specific configuration option within a group for a domain.
identity:get_security_compliance_domain_config
<empty string>
GET /v3/domains/{domain_id}/config/security_compliance
HEAD /v3/domains/{domain_id}/config/security_compliance
GET /v3/domains/{domain_id}/config/security_compliance/{option}
HEAD /v3/domains/{domain_id}/config/security_compliance/{option}
system
domain
project
Get security compliance domain configuration for either a domain or a specific option in a domain.
identity:update_domain_config
rule:admin_required
PATCH /v3/domains/{domain_id}/config
PATCH /v3/domains/{domain_id}/config/{group}
PATCH /v3/domains/{domain_id}/config/{group}/{option}
system
project
Update domain configuration for either a domain, specific group or a specific option in a group.
identity:delete_domain_config
rule:admin_required
DELETE /v3/domains/{domain_id}/config
DELETE /v3/domains/{domain_id}/config/{group}
DELETE /v3/domains/{domain_id}/config/{group}/{option}
system
project
Delete domain configuration for either a domain, specific group or a specific option in a group.
identity:get_domain_config_default
rule:admin_required or (role:reader and system_scope:all)
GET /v3/domains/config/default
HEAD /v3/domains/config/default
GET /v3/domains/config/{group}/default
HEAD /v3/domains/config/{group}/default
GET /v3/domains/config/{group}/{option}/default
HEAD /v3/domains/config/{group}/{option}/default
system
project
Get domain configuration default for either a domain, specific group or a specific option in a group.
identity:ec2_get_credential
(rule:admin_required) or (role:reader and system_scope:all) or user_id:%(target.credential.user_id)s
GET /v3/users/{user_id}/credentials/OS-EC2/{credential_id}
system
project
Show ec2 credential details.
identity:ec2_list_credentials
(rule:admin_required) or (role:reader and system_scope:all) or rule:owner
GET /v3/users/{user_id}/credentials/OS-EC2
system
project
List ec2 credentials.
identity:ec2_create_credential
rule:admin_or_owner
POST /v3/users/{user_id}/credentials/OS-EC2
system
project
Create ec2 credential.
identity:ec2_delete_credential
(rule:admin_required) or user_id:%(target.credential.user_id)s
DELETE /v3/users/{user_id}/credentials/OS-EC2/{credential_id}
system
project
Delete ec2 credential.
identity:get_endpoint
rule:admin_required or (role:reader and system_scope:all)
GET /v3/endpoints/{endpoint_id}
system
project
Show endpoint details.
identity:list_endpoints
rule:admin_required or (role:reader and system_scope:all)
GET /v3/endpoints
system
project
List endpoints.
identity:create_endpoint
rule:admin_required
POST /v3/endpoints
system
project
Create endpoint.
identity:update_endpoint
rule:admin_required
PATCH /v3/endpoints/{endpoint_id}
system
project
Update endpoint.
identity:delete_endpoint
rule:admin_required
DELETE /v3/endpoints/{endpoint_id}
system
project
Delete endpoint.
identity:create_endpoint_group
rule:admin_required
POST /v3/OS-EP-FILTER/endpoint_groups
system
project
Create endpoint group.
identity:list_endpoint_groups
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-EP-FILTER/endpoint_groups
system
project
List endpoint groups.
identity:get_endpoint_group
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}
HEAD /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}
system
project
Get endpoint group.
identity:update_endpoint_group
rule:admin_required
PATCH /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}
system
project
Update endpoint group.
identity:delete_endpoint_group
rule:admin_required
DELETE /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}
system
project
Delete endpoint group.
identity:list_projects_associated_with_endpoint_group
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects
system
project
List all projects associated with a specific endpoint group.
identity:list_endpoints_associated_with_endpoint_group
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/endpoints
system
project
List all endpoints associated with an endpoint group.
identity:get_endpoint_group_in_project
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id}
HEAD /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id}
system
project
Check if an endpoint group is associated with a project.
identity:list_endpoint_groups_for_project
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-EP-FILTER/projects/{project_id}/endpoint_groups
system
project
List endpoint groups associated with a specific project.
identity:add_endpoint_group_to_project
rule:admin_required
PUT /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id}
system
project
Allow a project to access an endpoint group.
identity:remove_endpoint_group_from_project
rule:admin_required
DELETE /v3/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id}
system
project
Remove endpoint group from project.
identity:check_grant
(rule:admin_required) or ((role:reader and system_scope:all) or ((role:reader and domain_id:%(target.user.domain_id)s and domain_id:%(target.project.domain_id)s) or (role:reader and domain_id:%(target.user.domain_id)s and domain_id:%(target.domain.id)s) or (role:reader and domain_id:%(target.group.domain_id)s and domain_id:%(target.project.domain_id)s) or (role:reader and domain_id:%(target.group.domain_id)s and domain_id:%(target.domain.id)s)) and (domain_id:%(target.role.domain_id)s or None:%(target.role.domain_id)s))
HEAD /v3/projects/{project_id}/users/{user_id}/roles/{role_id}
GET /v3/projects/{project_id}/users/{user_id}/roles/{role_id}
HEAD /v3/projects/{project_id}/groups/{group_id}/roles/{role_id}
GET /v3/projects/{project_id}/groups/{group_id}/roles/{role_id}
HEAD /v3/domains/{domain_id}/users/{user_id}/roles/{role_id}
GET /v3/domains/{domain_id}/users/{user_id}/roles/{role_id}
HEAD /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id}
GET /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id}
HEAD /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects
GET /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects
HEAD /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects
GET /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects
HEAD /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects
GET /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects
HEAD /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects
GET /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects
system
domain
project
Check a role grant between a target and an actor. A target can be either a domain or a project. An actor can be either a user or a group. These terms also apply to the OS-INHERIT APIs, where grants on the target are inherited to all projects in the subtree, if applicable.
identity:list_grants
(rule:admin_required) or ((role:reader and system_scope:all) or (role:reader and domain_id:%(target.user.domain_id)s and domain_id:%(target.project.domain_id)s) or (role:reader and domain_id:%(target.user.domain_id)s and domain_id:%(target.domain.id)s) or (role:reader and domain_id:%(target.group.domain_id)s and domain_id:%(target.project.domain_id)s) or (role:reader and domain_id:%(target.group.domain_id)s and domain_id:%(target.domain.id)s))
GET /v3/projects/{project_id}/users/{user_id}/roles
HEAD /v3/projects/{project_id}/users/{user_id}/roles
GET /v3/projects/{project_id}/groups/{group_id}/roles
HEAD /v3/projects/{project_id}/groups/{group_id}/roles
GET /v3/domains/{domain_id}/users/{user_id}/roles
HEAD /v3/domains/{domain_id}/users/{user_id}/roles
GET /v3/domains/{domain_id}/groups/{group_id}/roles
HEAD /v3/domains/{domain_id}/groups/{group_id}/roles
GET /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/inherited_to_projects
GET /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/inherited_to_projects
system
domain
project
List roles granted to an actor on a target. A target can be either a domain or a project. An actor can be either a user or a group. For the OS-INHERIT APIs, it is possible to list inherited role grants for actors on domains, where grants are inherited to all projects in the specified domain.
identity:create_grant
(rule:admin_required) or ((role:admin and domain_id:%(target.user.domain_id)s and domain_id:%(target.project.domain_id)s) or (role:admin and domain_id:%(target.user.domain_id)s and domain_id:%(target.domain.id)s) or (role:admin and domain_id:%(target.group.domain_id)s and domain_id:%(target.project.domain_id)s) or (role:admin and domain_id:%(target.group.domain_id)s and domain_id:%(target.domain.id)s)) and (domain_id:%(target.role.domain_id)s or None:%(target.role.domain_id)s)
PUT /v3/projects/{project_id}/users/{user_id}/roles/{role_id}
PUT /v3/projects/{project_id}/groups/{group_id}/roles/{role_id}
PUT /v3/domains/{domain_id}/users/{user_id}/roles/{role_id}
PUT /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id}
PUT /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects
PUT /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects
PUT /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects
PUT /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects
system
domain
project
Create a role grant between a target and an actor. A target can be either a domain or a project. An actor can be either a user or a group. These terms also apply to the OS-INHERIT APIs, where grants on the target are inherited to all projects in the subtree, if applicable.
identity:revoke_grant
(rule:admin_required) or ((role:admin and domain_id:%(target.user.domain_id)s and domain_id:%(target.project.domain_id)s) or (role:admin and domain_id:%(target.user.domain_id)s and domain_id:%(target.domain.id)s) or (role:admin and domain_id:%(target.group.domain_id)s and domain_id:%(target.project.domain_id)s) or (role:admin and domain_id:%(target.group.domain_id)s and domain_id:%(target.domain.id)s)) and (domain_id:%(target.role.domain_id)s or None:%(target.role.domain_id)s)
DELETE /v3/projects/{project_id}/users/{user_id}/roles/{role_id}
DELETE /v3/projects/{project_id}/groups/{group_id}/roles/{role_id}
DELETE /v3/domains/{domain_id}/users/{user_id}/roles/{role_id}
DELETE /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id}
DELETE /v3/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/{role_id}/inherited_to_projects
DELETE /v3/OS-INHERIT/projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects
DELETE /v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects
DELETE /v3/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/{role_id}/inherited_to_projects
system
domain
project
Revoke a role grant between a target and an actor. A target can be either a domain or a project. An actor can be either a user or a group. These terms also apply to the OS-INHERIT APIs, where grants on the target are inherited to all projects in the subtree, if applicable. In that case, revoking the role grant in the target would remove the logical effect of inheriting it to the target’s projects subtree.
identity:list_system_grants_for_user
rule:admin_required or (role:reader and system_scope:all)
[‘HEAD’, ‘GET’] /v3/system/users/{user_id}/roles
system
project
List all grants a specific user has on the system.
identity:check_system_grant_for_user
rule:admin_required or (role:reader and system_scope:all)
[‘HEAD’, ‘GET’] /v3/system/users/{user_id}/roles/{role_id}
system
project
Check if a user has a role on the system.
identity:create_system_grant_for_user
rule:admin_required
[‘PUT’] /v3/system/users/{user_id}/roles/{role_id}
system
project
Grant a user a role on the system.
identity:revoke_system_grant_for_user
rule:admin_required
[‘DELETE’] /v3/system/users/{user_id}/roles/{role_id}
system
project
Remove a role from a user on the system.
identity:list_system_grants_for_group
rule:admin_required or (role:reader and system_scope:all)
[‘HEAD’, ‘GET’] /v3/system/groups/{group_id}/roles
system
project
List all grants a specific group has on the system.
identity:check_system_grant_for_group
rule:admin_required or (role:reader and system_scope:all)
[‘HEAD’, ‘GET’] /v3/system/groups/{group_id}/roles/{role_id}
system
project
Check if a group has a role on the system.
identity:create_system_grant_for_group
rule:admin_required
[‘PUT’] /v3/system/groups/{group_id}/roles/{role_id}
system
project
Grant a group a role on the system.
identity:revoke_system_grant_for_group
rule:admin_required
[‘DELETE’] /v3/system/groups/{group_id}/roles/{role_id}
system
project
Remove a role from a group on the system.
identity:get_group
(rule:admin_required) or (role:reader and system_scope:all) or (role:reader and domain_id:%(target.group.domain_id)s)
GET /v3/groups/{group_id}
HEAD /v3/groups/{group_id}
system
domain
project
Show group details.
identity:list_groups
(rule:admin_required) or (role:reader and system_scope:all) or (role:reader and domain_id:%(target.group.domain_id)s)
GET /v3/groups
HEAD /v3/groups
system
domain
project
List groups.
identity:list_groups_for_user
(rule:admin_required) or (role:reader and system_scope:all) or (role:reader and domain_id:%(target.user.domain_id)s) or user_id:%(user_id)s
GET /v3/users/{user_id}/groups
HEAD /v3/users/{user_id}/groups
system
domain
project
List groups to which a user belongs.
identity:create_group
rule:admin_required
POST /v3/groups
system
domain
project
Create group.
identity:update_group
rule:admin_required
PATCH /v3/groups/{group_id}
system
domain
project
Update group.
identity:delete_group
rule:admin_required
DELETE /v3/groups/{group_id}
system
domain
project
Delete group.
identity:list_users_in_group
(rule:admin_required) or (role:reader and system_scope:all) or (role:reader and domain_id:%(target.group.domain_id)s)
GET /v3/groups/{group_id}/users
HEAD /v3/groups/{group_id}/users
system
domain
project
List members of a specific group.
identity:remove_user_from_group
rule:admin_required
DELETE /v3/groups/{group_id}/users/{user_id}
system
domain
project
Remove user from group.
identity:check_user_in_group
(rule:admin_required) or (role:reader and system_scope:all) or (role:reader and domain_id:%(target.group.domain_id)s and domain_id:%(target.user.domain_id)s)
HEAD /v3/groups/{group_id}/users/{user_id}
GET /v3/groups/{group_id}/users/{user_id}
system
domain
project
Check whether a user is a member of a group.
identity:add_user_to_group
rule:admin_required
PUT /v3/groups/{group_id}/users/{user_id}
system
domain
project
Add user to group.
identity:create_identity_provider
rule:admin_required
PUT /v3/OS-FEDERATION/identity_providers/{idp_id}
system
project
Create identity provider.
identity:list_identity_providers
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-FEDERATION/identity_providers
HEAD /v3/OS-FEDERATION/identity_providers
system
project
List identity providers.
identity:get_identity_provider
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-FEDERATION/identity_providers/{idp_id}
HEAD /v3/OS-FEDERATION/identity_providers/{idp_id}
system
project
Get identity provider.
identity:update_identity_provider
rule:admin_required
PATCH /v3/OS-FEDERATION/identity_providers/{idp_id}
system
project
Update identity provider.
identity:delete_identity_provider
rule:admin_required
DELETE /v3/OS-FEDERATION/identity_providers/{idp_id}
system
project
Delete identity provider.
identity:get_implied_role
rule:admin_required or (role:reader and system_scope:all)
GET /v3/roles/{prior_role_id}/implies/{implied_role_id}
system
project
Get information about an association between two roles. When a relationship exists between a prior role and an implied role and the prior role is assigned to a user, the user also assumes the implied role.
identity:list_implied_roles
rule:admin_required or (role:reader and system_scope:all)
GET /v3/roles/{prior_role_id}/implies
HEAD /v3/roles/{prior_role_id}/implies
system
project
List associations between two roles. When a relationship exists between a prior role and an implied role and the prior role is assigned to a user, the user also assumes the implied role. This will return all the implied roles that would be assumed by the user who gets the specified prior role.
identity:create_implied_role
rule:admin_required
PUT /v3/roles/{prior_role_id}/implies/{implied_role_id}
system
project
Create an association between two roles. When a relationship exists between a prior role and an implied role and the prior role is assigned to a user, the user also assumes the implied role.
identity:delete_implied_role
rule:admin_required
DELETE /v3/roles/{prior_role_id}/implies/{implied_role_id}
system
project
Delete the association between two roles. When a relationship exists between a prior role and an implied role and the prior role is assigned to a user, the user also assumes the implied role. Removing the association will cause that effect to be eliminated.
identity:list_role_inference_rules
rule:admin_required or (role:reader and system_scope:all)
GET /v3/role_inferences
HEAD /v3/role_inferences
system
project
List all associations between two roles in the system. When a relationship exists between a prior role and an implied role and the prior role is assigned to a user, the user also assumes the implied role.
identity:check_implied_role
rule:admin_required or (role:reader and system_scope:all)
HEAD /v3/roles/{prior_role_id}/implies/{implied_role_id}
system
project
Check an association between two roles. When a relationship exists between a prior role and an implied role and the prior role is assigned to a user, the user also assumes the implied role.
identity:get_limit_model
<empty string>
GET /v3/limits/model
HEAD /v3/limits/model
system
domain
project
Get limit enforcement model.
identity:get_limit
rule:admin_required or (role:reader and system_scope:all) or (domain_id:%(target.limit.domain.id)s or domain_id:%(target.limit.project.domain_id)s) or (project_id:%(target.limit.project_id)s and not None:%(target.limit.project_id)s)
GET /v3/limits/{limit_id}
HEAD /v3/limits/{limit_id}
system
domain
project
Show limit details.
identity:list_limits
<empty string>
GET /v3/limits
HEAD /v3/limits
system
domain
project
List limits.
identity:create_limits
rule:admin_required
POST /v3/limits
system
project
Create limits.
identity:update_limit
rule:admin_required
PATCH /v3/limits/{limit_id}
system
project
Update limit.
identity:delete_limit
rule:admin_required
DELETE /v3/limits/{limit_id}
system
project
Delete limit.
identity:create_mapping
rule:admin_required
PUT /v3/OS-FEDERATION/mappings/{mapping_id}
system
project
Create a new federated mapping containing one or more sets of rules.
identity:get_mapping
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-FEDERATION/mappings/{mapping_id}
HEAD /v3/OS-FEDERATION/mappings/{mapping_id}
system
project
Get a federated mapping.
identity:list_mappings
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-FEDERATION/mappings
HEAD /v3/OS-FEDERATION/mappings
system
project
List federated mappings.
identity:delete_mapping
rule:admin_required
DELETE /v3/OS-FEDERATION/mappings/{mapping_id}
system
project
Delete a federated mapping.
identity:update_mapping
rule:admin_required
PATCH /v3/OS-FEDERATION/mappings/{mapping_id}
system
project
Update a federated mapping.
identity:get_policy
rule:admin_required or (role:reader and system_scope:all)
GET /v3/policies/{policy_id}
system
project
Show policy details.
identity:list_policies
rule:admin_required or (role:reader and system_scope:all)
GET /v3/policies
system
project
List policies.
identity:create_policy
rule:admin_required
POST /v3/policies
system
project
Create policy.
identity:update_policy
rule:admin_required
PATCH /v3/policies/{policy_id}
system
project
Update policy.
identity:delete_policy
rule:admin_required
DELETE /v3/policies/{policy_id}
system
project
Delete policy.
identity:create_policy_association_for_endpoint
rule:admin_required
PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id}
system
project
Associate a policy to a specific endpoint.
identity:check_policy_association_for_endpoint
rule:admin_required or (role:reader and system_scope:all)
GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id}
HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id}
system
project
Check policy association for endpoint.
identity:delete_policy_association_for_endpoint
rule:admin_required
DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id}
system
project
Delete policy association for endpoint.
identity:create_policy_association_for_service
rule:admin_required
PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}
system
project
Associate a policy to a specific service.
identity:check_policy_association_for_service
rule:admin_required or (role:reader and system_scope:all)
GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}
HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}
system
project
Check policy association for service.
identity:delete_policy_association_for_service
rule:admin_required
DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}
system
project
Delete policy association for service.
identity:create_policy_association_for_region_and_service
rule:admin_required
PUT /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id}
system
project
Associate a policy to a specific region and service combination.
identity:check_policy_association_for_region_and_service
rule:admin_required or (role:reader and system_scope:all)
GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id}
HEAD /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id}
system
project
Check policy association for region and service.
identity:delete_policy_association_for_region_and_service
rule:admin_required
DELETE /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id}
system
project
Delete policy association for region and service.
identity:get_policy_for_endpoint
rule:admin_required or (role:reader and system_scope:all)
GET /v3/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/policy
HEAD /v3/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/policy
system
project
Get policy for endpoint.
identity:list_endpoints_for_policy
rule:admin_required or (role:reader and system_scope:all)
GET /v3/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints
system
project
List endpoints for policy.
identity:get_project
(rule:admin_required) or (role:reader and system_scope:all) or (role:reader and domain_id:%(target.project.domain_id)s) or project_id:%(target.project.id)s
GET /v3/projects/{project_id}
system
domain
project
Show project details.
identity:list_projects
(rule:admin_required) or (role:reader and system_scope:all) or (role:reader and domain_id:%(target.domain_id)s)
GET /v3/projects
system
domain
project
List projects.
identity:list_user_projects
(rule:admin_required) or (role:reader and system_scope:all) or (role:reader and domain_id:%(target.user.domain_id)s) or user_id:%(target.user.id)s
GET /v3/users/{user_id}/projects
system
domain
project
List projects for user.
identity:create_project
rule:admin_required
POST /v3/projects
system
domain
project
Create project.
identity:update_project
rule:admin_required
PATCH /v3/projects/{project_id}
system
domain
project
Update project.
identity:delete_project
rule:admin_required
DELETE /v3/projects/{project_id}
system
domain
project
Delete project.
identity:list_project_tags
(rule:admin_required) or (role:reader and system_scope:all) or (role:reader and domain_id:%(target.project.domain_id)s) or project_id:%(target.project.id)s
GET /v3/projects/{project_id}/tags
HEAD /v3/projects/{project_id}/tags
system
domain
project
List tags for a project.
identity:get_project_tag
(rule:admin_required) or (role:reader and system_scope:all) or (role:reader and domain_id:%(target.project.domain_id)s) or project_id:%(target.project.id)s
GET /v3/projects/{project_id}/tags/{value}
HEAD /v3/projects/{project_id}/tags/{value}
system
domain
project
Check if project contains a tag.
identity:update_project_tags
rule:admin_required
PUT /v3/projects/{project_id}/tags
system
domain
project
Replace all tags on a project with the new set of tags.
identity:create_project_tag
rule:admin_required
PUT /v3/projects/{project_id}/tags/{value}
system
domain
project
Add a single tag to a project.
identity:delete_project_tags
rule:admin_required
DELETE /v3/projects/{project_id}/tags
system
domain
project
Remove all tags from a project.
identity:delete_project_tag
rule:admin_required
DELETE /v3/projects/{project_id}/tags/{value}
system
domain
project
Delete a specified tag from project.
identity:list_projects_for_endpoint
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-EP-FILTER/endpoints/{endpoint_id}/projects
system
project
List projects allowed to access an endpoint.
identity:add_endpoint_to_project
rule:admin_required
PUT /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}
system
project
Allow project to access an endpoint.
identity:check_endpoint_in_project
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}
HEAD /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}
system
project
Check if a project is allowed to access an endpoint.
identity:list_endpoints_for_project
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-EP-FILTER/projects/{project_id}/endpoints
system
project
List the endpoints a project is allowed to access.
identity:remove_endpoint_from_project
rule:admin_required
DELETE /v3/OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}
system
project
Remove access to an endpoint from a project that has previously been given explicit access.
identity:create_protocol
rule:admin_required
PUT /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}
system
project
Create federated protocol.
identity:update_protocol
rule:admin_required
PATCH /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}
system
project
Update federated protocol.
identity:get_protocol
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}
system
project
Get federated protocol.
identity:list_protocols
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols
system
project
List federated protocols.
identity:delete_protocol
rule:admin_required
DELETE /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}
system
project
Delete federated protocol.
identity:get_region
<empty string>
GET /v3/regions/{region_id}
HEAD /v3/regions/{region_id}
system
domain
project
Show region details.
identity:list_regions
<empty string>
GET /v3/regions
HEAD /v3/regions
system
domain
project
List regions.
identity:create_region
rule:admin_required
POST /v3/regions
PUT /v3/regions/{region_id}
system
project
Create region.
identity:update_region
rule:admin_required
PATCH /v3/regions/{region_id}
system
project
Update region.
identity:delete_region
rule:admin_required
DELETE /v3/regions/{region_id}
system
project
Delete region.
identity:get_registered_limit
<empty string>
GET /v3/registered_limits/{registered_limit_id}
HEAD /v3/registered_limits/{registered_limit_id}
system
domain
project
Show registered limit details.
identity:list_registered_limits
<empty string>
GET /v3/registered_limits
HEAD /v3/registered_limits
system
domain
project
List registered limits.
identity:create_registered_limits
rule:admin_required
POST /v3/registered_limits
system
project
Create registered limits.
identity:update_registered_limit
rule:admin_required
PATCH /v3/registered_limits/{registered_limit_id}
system
project
Update registered limit.
identity:delete_registered_limit
rule:admin_required
DELETE /v3/registered_limits/{registered_limit_id}
system
project
Delete registered limit.
identity:list_revoke_events
rule:service_or_admin
GET /v3/OS-REVOKE/events
system
project
List revocation events.
identity:get_role
rule:admin_required or (role:reader and system_scope:all)
GET /v3/roles/{role_id}
HEAD /v3/roles/{role_id}
system
domain
project
Show role details.
identity:list_roles
rule:admin_required or (role:reader and system_scope:all)
GET /v3/roles
HEAD /v3/roles
system
domain
project
List roles.
identity:create_role
rule:admin_required
POST /v3/roles
system
project
Create role.
identity:update_role
rule:admin_required
PATCH /v3/roles/{role_id}
system
project
Update role.
identity:delete_role
rule:admin_required
DELETE /v3/roles/{role_id}
system
project
Delete role.
identity:get_domain_role
rule:admin_required or (role:reader and system_scope:all)
GET /v3/roles/{role_id}
HEAD /v3/roles/{role_id}
system
project
Show domain role.
identity:list_domain_roles
rule:admin_required or (role:reader and system_scope:all)
GET /v3/roles?domain_id={domain_id}
HEAD /v3/roles?domain_id={domain_id}
system
project
List domain roles.
identity:create_domain_role
rule:admin_required
POST /v3/roles
system
project
Create domain role.
identity:update_domain_role
rule:admin_required
PATCH /v3/roles/{role_id}
system
project
Update domain role.
identity:delete_domain_role
rule:admin_required
DELETE /v3/roles/{role_id}
system
project
Delete domain role.
identity:list_role_assignments
(rule:admin_required) or (role:reader and system_scope:all) or (role:reader and domain_id:%(target.domain_id)s)
GET /v3/role_assignments
HEAD /v3/role_assignments
system
domain
project
List role assignments.
identity:list_role_assignments_for_tree
(rule:admin_required) or (role:reader and system_scope:all) or (role:reader and domain_id:%(target.domain_id)s)
GET /v3/role_assignments?include_subtree
HEAD /v3/role_assignments?include_subtree
system
domain
project
List all role assignments for a given tree of hierarchical projects.
identity:get_service
rule:admin_required or (role:reader and system_scope:all)
GET /v3/services/{service_id}
system
project
Show service details.
identity:list_services
rule:admin_required or (role:reader and system_scope:all)
GET /v3/services
system
project
List services.
identity:create_service
rule:admin_required
POST /v3/services
system
project
Create service.
identity:update_service
rule:admin_required
PATCH /v3/services/{service_id}
system
project
Update service.
identity:delete_service
rule:admin_required
DELETE /v3/services/{service_id}
system
project
Delete service.
identity:create_service_provider
rule:admin_required
PUT /v3/OS-FEDERATION/service_providers/{service_provider_id}
system
project
Create federated service provider.
identity:list_service_providers
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-FEDERATION/service_providers
HEAD /v3/OS-FEDERATION/service_providers
system
project
List federated service providers.
identity:get_service_provider
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-FEDERATION/service_providers/{service_provider_id}
HEAD /v3/OS-FEDERATION/service_providers/{service_provider_id}
system
project
Get federated service provider.
identity:update_service_provider
rule:admin_required
PATCH /v3/OS-FEDERATION/service_providers/{service_provider_id}
system
project
Update federated service provider.
identity:delete_service_provider
rule:admin_required
DELETE /v3/OS-FEDERATION/service_providers/{service_provider_id}
system
project
Delete federated service provider.
identity:revocation_list
rule:service_or_admin
GET /v3/auth/tokens/OS-PKI/revoked
system
project
List revoked PKI tokens.
identity:check_token
rule:admin_required or (role:reader and system_scope:all) or rule:token_subject
HEAD /v3/auth/tokens
system
domain
project
Check a token.
identity:validate_token
rule:admin_required or (role:reader and system_scope:all) or rule:service_role or rule:token_subject
GET /v3/auth/tokens
system
domain
project
Validate a token.
identity:revoke_token
rule:admin_required or rule:token_subject
DELETE /v3/auth/tokens
system
domain
project
Revoke a token.
identity:create_trust
user_id:%(trust.trustor_user_id)s
POST /v3/OS-TRUST/trusts
project
Create trust.
identity:list_trusts
rule:admin_required or (role:reader and system_scope:all)
GET /v3/OS-TRUST/trusts
HEAD /v3/OS-TRUST/trusts
system
project
List trusts.
identity:list_trusts_for_trustor
(rule:admin_required) or (role:reader and system_scope:all or user_id:%(target.trust.trustor_user_id)s)
GET /v3/OS-TRUST/trusts?trustor_user_id={trustor_user_id}
HEAD /v3/OS-TRUST/trusts?trustor_user_id={trustor_user_id}
system
project
List trusts for trustor.
identity:list_trusts_for_trustee
(rule:admin_required) or (role:reader and system_scope:all or user_id:%(target.trust.trustee_user_id)s)
GET /v3/OS-TRUST/trusts?trustee_user_id={trustee_user_id}
HEAD /v3/OS-TRUST/trusts?trustee_user_id={trustee_user_id}
system
project
List trusts for trustee.
identity:list_roles_for_trust
(rule:admin_required) or (role:reader and system_scope:all or user_id:%(target.trust.trustor_user_id)s or user_id:%(target.trust.trustee_user_id)s)
GET /v3/OS-TRUST/trusts/{trust_id}/roles
HEAD /v3/OS-TRUST/trusts/{trust_id}/roles
system
project
List roles delegated by a trust.
identity:get_role_for_trust
(rule:admin_required) or (role:reader and system_scope:all or user_id:%(target.trust.trustor_user_id)s or user_id:%(target.trust.trustee_user_id)s)
GET /v3/OS-TRUST/trusts/{trust_id}/roles/{role_id}
HEAD /v3/OS-TRUST/trusts/{trust_id}/roles/{role_id}
system
project
Check if trust delegates a particular role.
identity:delete_trust
rule:admin_required or user_id:%(target.trust.trustor_user_id)s
DELETE /v3/OS-TRUST/trusts/{trust_id}
system
project
Revoke trust.
identity:get_trust
(rule:admin_required) or (role:reader and system_scope:all or user_id:%(target.trust.trustor_user_id)s or user_id:%(target.trust.trustee_user_id)s)
GET /v3/OS-TRUST/trusts/{trust_id}
HEAD /v3/OS-TRUST/trusts/{trust_id}
system
project
Get trust.
identity:get_user
(rule:admin_required) or (role:reader and system_scope:all) or (role:reader and token.domain.id:%(target.user.domain_id)s) or user_id:%(target.user.id)s
GET /v3/users/{user_id}
HEAD /v3/users/{user_id}
system
domain
project
Show user details.
identity:list_users
(rule:admin_required) or (role:reader and system_scope:all) or (role:reader and domain_id:%(target.domain_id)s)
GET /v3/users
HEAD /v3/users
system
domain
project
List users.
identity:list_projects_for_user
<empty string>
GET `` /v3/auth/projects``
List all projects a user has access to via role assignments.
identity:list_domains_for_user
<empty string>
GET /v3/auth/domains
List all domains a user has access to via role assignments.
identity:create_user
rule:admin_required
POST /v3/users
system
domain
project
Create a user.
identity:update_user
rule:admin_required
PATCH /v3/users/{user_id}
system
domain
project
Update a user, including administrative password resets.
identity:delete_user
rule:admin_required
DELETE /v3/users/{user_id}
system
domain
project
Delete a user.
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.