POST /organizations/{organization_id}/role_mappings
Basic auth Api key

Adds the role assignments applicable when logging via SSO. Currently unavailable in self-hosted ECE.

Path parameters

  • organization_id string Required

    Identifier for the Organization

application/json

Body Required

The role mappings to add

  • mappings array[object] Required

    A rule to add to the role assignments in the organization

    Hide mappings attributes Show mappings attributes object
    • enabled boolean Required

      Whether or not the role mapping is enabled

    • name string Required

      The name of the role mapping

    • rule object Required

      The rule to match

      Hide rule attributes Show rule attributes object
      • any array[object]

        The rules that must match. Only one rule must match for the role assignment to be applied.

        Hide any attributes Show any attributes object
        • group string

          The group to match. Can have wildcards. Must specify either group or email but not both.

        • email string

          The email to match. Can have wildcards. Must specify either group or email but not both.

      • all array[object]

        The rules that must match. All rules must match for the role assignment to be applied.

        Hide all attributes Show all attributes object
        • group string

          The group to match. Can have wildcards. Must specify either group or email but not both.

        • email string

          The email to match. Can have wildcards. Must specify either group or email but not both.

    • role_assignments object Required

      The role assignments to apply if the rule matches

      Hide role_assignments attributes Show role_assignments attributes object
      • platform array[object]

        Assignments for roles with platform scope.

        Hide platform attribute Show platform attribute object

        Assignment for a role with platform scope.

        • role_id string Required

          The ID of the role that is assigned.

      • organization array[object]

        Assignments for roles with organization scope.

        Hide organization attributes Show organization attributes object

        Assignment for a role with organization scope.

        • role_id string Required

          The ID of the role that is assigned.

        • organization_id string Required

          The ID of the organization the role is scoped to.

        • application_roles array[string]

          If provided, the user assigned this role assignment will be granted this application role when signing in to a deployment or project

      • deployment array[object]

        Assignments for roles with deployment scope.

        Hide deployment attributes Show deployment attributes object

        Assignment for a role with deployment scope.

        • role_id string Required

          The ID of the role that is assigned.

        • organization_id string Required

          The ID of the organization the role is scoped to.

        • all boolean

          When true, the role applies to all deployments in the organization, otherwise the role is scoped to the deployments specified in deployment_ids.

        • deployment_ids array[string]

          The IDs of the deployments the role is scoped to. Must be absent if all is true, and present if all is false.

        • application_roles array[string]

          If provided, the user assigned this role assignment will be granted this application role when signing in to the deployment(s) specified in the role assignment.

      • project object

        Assignments for roles with project scope.

        Hide project attributes Show project attributes object
        • elasticsearch array[object]

          The Elasticsearch project-scoped role assignments to set

          Hide elasticsearch attributes Show elasticsearch attributes object

          Assignment for a role with project scope.

          • role_id string Required

            The ID of the role that is assigned.

          • organization_id string Required

            The ID of the organization the role is scoped to.

          • all boolean

            When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in project_ids.

          • project_ids array[string]

            The IDs of the projects the role is scoped to. Must be absent if all is true, and present if all is false.

          • application_roles array[string]

            If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.

        • observability array[object]

          The Observability project-scoped role assignments to set

          Hide observability attributes Show observability attributes object

          Assignment for a role with project scope.

          • role_id string Required

            The ID of the role that is assigned.

          • organization_id string Required

            The ID of the organization the role is scoped to.

          • all boolean

            When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in project_ids.

          • project_ids array[string]

            The IDs of the projects the role is scoped to. Must be absent if all is true, and present if all is false.

          • application_roles array[string]

            If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.

        • security array[object]

          The Security project-scoped role assignments to set

          Hide security attributes Show security attributes object

          Assignment for a role with project scope.

          • role_id string Required

            The ID of the role that is assigned.

          • organization_id string Required

            The ID of the organization the role is scoped to.

          • all boolean

            When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in project_ids.

          • project_ids array[string]

            The IDs of the projects the role is scoped to. Must be absent if all is true, and present if all is false.

          • application_roles array[string]

            If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.

        • workplaceai array[object]

          The WorkplaceAI project-scoped role assignments to set

          Hide workplaceai attributes Show workplaceai attributes object

          Assignment for a role with project scope.

          • role_id string Required

            The ID of the role that is assigned.

          • organization_id string Required

            The ID of the organization the role is scoped to.

          • all boolean

            When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in project_ids.

          • project_ids array[string]

            The IDs of the projects the role is scoped to. Must be absent if all is true, and present if all is false.

          • application_roles array[string]

            If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.

        • vectordb array[object]

          The VectorDB project-scoped role assignments to set

          Hide vectordb attributes Show vectordb attributes object

          Assignment for a role with project scope.

          • role_id string Required

            The ID of the role that is assigned.

          • organization_id string Required

            The ID of the organization the role is scoped to.

          • all boolean

            When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in project_ids.

          • project_ids array[string]

            The IDs of the projects the role is scoped to. Must be absent if all is true, and present if all is false.

          • application_roles array[string]

            If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.

Responses

  • 201 application/json

    An empty response
  • 400 application/json
    • Invalid rule. (code: org.role_mapping_rule.ambiguous_rule)
    • Empty rule. (code: org.role_mapping_rule.empty_rule)
    • Validation error. (code: org.role_mapping_rule.syntax_error)
    • Validation error. (code: org.role_mapping_rule.email_syntax_error)
    • Validation error. (code: org.role_mapping_rule.too_many_role_mappings)
    Hide headers attribute Show headers attribute
    • x-cloud-error-codes string

      The error codes associated with the response

      Values are org.role_mapping_rule.ambiguous_rule, org.role_mapping_rule.empty_rule, org.role_mapping_rule.syntax_error, org.role_mapping_rule.email_syntax_error, or org.role_mapping_rule.too_many_role_mappings.

    Hide response attribute Show response attribute object
    • errors array[object] Required

      A list of errors that occurred in the failing request

      Hide errors attributes Show errors attributes object
      • code string Required

        A structured code representing the error type that occurred

      • message string Required

        A human readable message describing the error that occurred

      • fields array[string]

        If the error can be tied to a specific field or fields in the user request, this lists those fields
  • 404 application/json

    Organization not found. (code: organization.not_found)

    Hide headers attribute Show headers attribute
    • x-cloud-error-codes string

      The error codes associated with the response

      Value is organization.not_found.

    Hide response attribute Show response attribute object
    • errors array[object] Required

      A list of errors that occurred in the failing request

      Hide errors attributes Show errors attributes object
      • code string Required

        A structured code representing the error type that occurred

      • message string Required

        A human readable message describing the error that occurred

      • fields array[string]

        If the error can be tied to a specific field or fields in the user request, this lists those fields
POST /organizations/{organization_id}/role_mappings 
curl \
 --request POST 'https://{{hostname}}/api/v1/organizations/{organization_id}/role_mappings' \
 --user "username:password" \
 --header "Content-Type: application/json" \
 --data '{
  "mappings": [
    {
      "enabled": true,
      "name": "string",
      "rule": {
        "any": [
          {
            "group": "string",
            "email": "string"
          }
        ],
        "all": [
          {
            "group": "string",
            "email": "string"
          }
        ]
      },
      "role_assignments": {
        "platform": [
          {
            "role_id": "string"
          }
        ],
        "organization": [
          {
            "role_id": "string",
            "organization_id": "string",
            "application_roles": [
              "string"
            ]
          }
        ],
        "deployment": [
          {
            "role_id": "string",
            "organization_id": "string",
            "all": true,
            "deployment_ids": [
              "string"
            ],
            "application_roles": [
              "string"
            ]
          }
        ],
        "project": {
          "elasticsearch": [
            {
              "role_id": "string",
              "organization_id": "string",
              "all": true,
              "project_ids": [
                "string"
              ],
              "application_roles": [
                "string"
              ]
            }
          ],
          "observability": [
            {
              "role_id": "string",
              "organization_id": "string",
              "all": true,
              "project_ids": [
                "string"
              ],
              "application_roles": [
                "string"
              ]
            }
          ],
          "security": [
            {
              "role_id": "string",
              "organization_id": "string",
              "all": true,
              "project_ids": [
                "string"
              ],
              "application_roles": [
                "string"
              ]
            }
          ],
          "workplaceai": [
            {
              "role_id": "string",
              "organization_id": "string",
              "all": true,
              "project_ids": [
                "string"
              ],
              "application_roles": [
                "string"
              ]
            }
          ],
          "vectordb": [
            {
              "role_id": "string",
              "organization_id": "string",
              "all": true,
              "project_ids": [
                "string"
              ],
              "application_roles": [
                "string"
              ]
            }
          ]
        }
      }
    }
  ]
}'