Modifying the user account roles

In this example, we will change the role of the user account from partner_admin to hci_admin in the partner tenant.

To modify the user account roles

  1. Authenticate to the cloud platform via the Python shell.

    The following variables should be available now:

    >>> base_url  # the base URL of the API
    '<the data center URL>/api/2'
    >>> auth  # the 'Authorization' header value with the access token
    {'Authorization': 'Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImMwMD...'}
    >>> tenant_id  # the UUID of the tenant to which the token provides access
    'ede9f834-70b3-476c-83d9-736f9f8c7dae'
    
  2. Assign the user_id variable the UUID of a user account created via the API or a user account found via search:

    >>> user_id = created_user_id
    >>> user_id
    '1c234e69-5469-424a-a6d1-ff5658b387a6'
    
  3. Define a variable named policies_object, and then assign the items array of the access policy objects with a new role to this variable:

    >>> policies_object = {
    ...     "items": [
    ...         {
    ...             "id": "00000000-0000-0000-0000-000000000000",
    ...             "issuer_id": "00000000-0000-0000-0000-000000000000",
    ...             "trustee_id": user_id,
    ...             "trustee_type": "user",
    ...             "tenant_id": tenant_id,
    ...             "role_id": "hci_admin",
    ...             "version": 0
    ...         }
    ...     ]
    ... }
    

    Name

    Value type

    Required

    Description

    id

    UUID string

    Yes

    {{internal}} Must be any valid UUID string.

    issuer_id

    UUID string

    Yes

    {{internal}} Must be any valid UUID string.

    tenant_id

    UUID string

    Yes

    The UUID of the tenant.

    trustee_id

    UUID string

    Yes

    The UUID of the user account.

    trustee_type

    string

    Yes

    The type of the user account. The only available value is user.

    role_id

    string

    Yes

    The role of the user account. See the table describing available roles.

    version

    number

    Yes

    Revision number.

    Important

    Setting a role with higher access level, such as partner_admin, will override all other roles related to the service(s).

  4. Convert the policies_object object to a JSON text:

    >>> policies_object = json.dumps(policies_object, indent=4)
    
  5. Send a PUT request with the JSON text to the /users/{user_id}/access_policies endpoint:

    >>> response = requests.put(
    ...     f'{base_url}/users/{user_id}/access_policies',
    ...     headers={'Content-Type': 'application/json', **auth},
    ...     data=policies_object,
    ... )
    

    Warning

    This request overwrites all existing access policies for the user account.

  6. Check the status code of the response:

    >>> response.status_code
    200
    

    Status code 200 means that the user account access policies have been successfully updated.

    Note

    A different status code means that an error has occurred. For details of the error, see HTTP status response codes and API error codes.

    Also, the response body contains the items array of updated access policy objects, formatted as a JSON text. When converted to an object, it will look like this:

    >>> pprint.pprint(response.json())
    {'items': [{'id': '00000000-0000-0000-0000-000000000000',
                'issuer_id': '00000000-0000-0000-0000-000000000000',
                'role_id': 'hci_admin',
                'tenant_id': 'ede9f834-70b3-476c-83d9-736f9f8c7dae',
                'trustee_id': '1c234e69-5469-424a-a6d1-ff5658b387a6',
                'trustee_type': 'user',
                'version': 0}]}