The following is a sample request for obtaining a token for
user A. The login password of the user is
********** and the domain name is
domain A. The scope of the token is
domain.
Token information stored in the response header:
X-Subject-Token:MIIDkgYJKoZIhvcNAQcCoIIDgzCCA38CAQExDTALBglghkgBZQMEAgEwgXXXXX...
Token information stored in the response body:
diff --git a/docs/iam/api-ref/en-us_topic_0057845623.html b/docs/iam/api-ref/en-us_topic_0057845623.html
index 62e434ec..6986123d 100644
--- a/docs/iam/api-ref/en-us_topic_0057845623.html
+++ b/docs/iam/api-ref/en-us_topic_0057845623.html
@@ -21,7 +21,7 @@
String
|
-ID of the domain to which a user group belongs. For details about how to obtain the domain ID, see Obtaining User, Account, User Group, Project, and Agency Information.
+ | ID of the domain which a user group belongs to. For details about how to obtain the domain ID, see Obtaining User, Account, User Group, Project, and Agency Information.
|
group_id
@@ -52,7 +52,7 @@
Request Parameters- Parameters in the request header
Parameter
|
-Mandatory
+ | Mandatory
|
Type
|
diff --git a/docs/iam/api-ref/en-us_topic_0057845624.html b/docs/iam/api-ref/en-us_topic_0057845624.html
index 56a78034..ed0da521 100644
--- a/docs/iam/api-ref/en-us_topic_0057845624.html
+++ b/docs/iam/api-ref/en-us_topic_0057845624.html
@@ -1,7 +1,7 @@
Obtaining User, Account, User Group, Project, and Agency Information
-Obtaining User, Account, and Project InformationYour username, user ID, account name, account ID, project name, and project ID need to be specified in the URL and request body for calling certain APIs. Obtain these parameters on the My Credentials page.
+ Obtaining User, Account, and Project InformationYour username, user ID, account name, account ID, project name, and project ID need to be specified in the URI and request body for calling certain APIs. Obtain these parameters on the My Credentials page.
- Log in to management console.
- Click the username in the upper right corner, and choose My Credentials.
- On the My Credentials page, view the username, user ID, account name, account ID, project name, and project ID.
Obtaining User Group Information- Log in to the IAM console, and choose User Groups in the navigation pane.
- Expand the details page of a user group and view the group name and ID.
diff --git a/docs/iam/api-ref/en-us_topic_0057845625.html b/docs/iam/api-ref/en-us_topic_0057845625.html
index 87644960..6a1112e7 100644
--- a/docs/iam/api-ref/en-us_topic_0057845625.html
+++ b/docs/iam/api-ref/en-us_topic_0057845625.html
@@ -234,7 +234,7 @@
String
|
- Project name.
+ | Project name. For example, eu-de and MOS. MOS is a built-in project of OBS.
|
|---|
diff --git a/docs/iam/api-ref/en-us_topic_0057845637.html b/docs/iam/api-ref/en-us_topic_0057845637.html
index a86e81eb..3a476898 100644
--- a/docs/iam/api-ref/en-us_topic_0057845637.html
+++ b/docs/iam/api-ref/en-us_topic_0057845637.html
@@ -63,9 +63,9 @@
Table 2 userParameter
|
-Mandatory
+ | Mandatory
|
-Type
+ | Type
|
Description
|
@@ -96,7 +96,7 @@
Boolean
|
Whether a user is enabled.
-The value can be true or false. true indicates the user is enabled and false indicates the user is not enabled. The default value is true.
+true (default value) indicates that the user is enabled. false indicates that the user is disabled.
|
|---|
password
@@ -105,7 +105,7 @@
|
String
|
-Password of the user. The password must meet the following requirements: - Can contain 6 to 32 characters. The system default minimum password length is 6 characters, and you can change the minimum password length.
- Must contain at least two of the following character types: uppercase letters, lowercase letters, digits, and special characters.
- Cannot be the username or the username spelled backwards.
- Cannot contain the user's mobile phone number or email address.
- Must comply with the password policies under Account Settings.
+ Password of the user. The password must meet the following requirements: - Can contain 6 to 32 characters. The default minimum password length is 6 characters.
- Must contain at least two of the following character types: uppercase letters, lowercase letters, digits, and special characters.
- Cannot be the username or the username spelled backwards.
- Cannot contain the user's mobile phone number or email address.
- Must comply with the password policies under Account Settings.
|
|
@@ -130,20 +130,29 @@
- Example request
1. Create the temporary file ${filename}.json based on the following template. ${filename} indicates the temporary file name, which is user-defined.
+ - Example request
+
+
+
+
+
+
+
+
+
+
+
+
+POST https://sample.domain.com/v3/users
{
"user": {
- "default_project_id": "acf2ffabba974fae8f30378ffde2cfa6",
- "domain_id": "88b16b6440684467b8825d7d96e154d8",
+ "name": "IAMUser",
+ "domain_id": "d78cbac186b744899480f25bd02...",
"enabled": true,
- "name": "jamesdoe",
- "password": "********"
+ "password": "IAMPassword@",
+ "description": "IAMDescription"
}
-}
-2. Run the following command under the directory storing the ${filename}.json file.
-curl -i -k -H 'Accept:application/json' -H 'Content-Type:application/json;charset=utf8' -H "X-Auth-Token:$token" -X POST -d @${filename}.json https://sample.domain.com/v3/users
-3. Run the following command under the directory of the ${filename}.json file to delete the ${filename}.json file.
-rm ${filename}.json
+}
Response Parameters- Parameters in the response body
@@ -170,7 +179,7 @@
- Description for the user format
-
Parameter
+Parameter
|
Mandatory
|
@@ -187,7 +196,7 @@
Boolean
|
Whether a user is enabled.
-The value can be true or false. true indicates the user is enabled and false indicates the user is not enabled. The default value is true.
+true (default value) indicates that the user is enabled. false indicates that the user is disabled.
|
|---|
id
@@ -241,7 +250,7 @@
|
String
|
-UTC when the password will expire. null indicates that the password will not expire.
+ | UTC when the password will expire. null indicates that the password has unlimited validity.
|
diff --git a/docs/iam/api-ref/en-us_topic_0057845638.html b/docs/iam/api-ref/en-us_topic_0057845638.html
index c56525e5..42abe908 100644
--- a/docs/iam/api-ref/en-us_topic_0057845638.html
+++ b/docs/iam/api-ref/en-us_topic_0057845638.html
@@ -51,7 +51,7 @@
Password expiration time. The format is password_expires_at=operator:timestamp.
Example:
password_expires_at=lt:2016-12-08T22:02:00Z
-- The value of operator can be lt, lte, gt, gte, eq, or neq.
- lt: The expiration time is earlier than timestamp.
- lte: The expiration time is earlier than or equal to timestamp.
- gt: The expiration time is later than timestamp.
- gte: The expiration time is equal to or later than timestamp.
- eq: The expiration time is equal to timestamp.
- neq: The expiration time is not equal to timestamp.
+- The value of operator can be lt, lte, gt, gte, eq, or neq.
- lt: The expiration time is earlier than timestamp.
- lte: The expiration time is earlier than or equal to timestamp.
- gt: The expiration time is later than timestamp.
- gte: The expiration time is equal to or later than timestamp.
- eq: The expiration time is equal to timestamp.
- neq: The expiration time is not equal to timestamp.
- The timestamp format is YYYY-MM-DDTHH:mm:ssZ.
|
@@ -130,9 +130,9 @@
- Description for the user format
Parameter
|
-Mandatory
+ | Mandatory
|
-Type
+ | Type
|
Description
|
@@ -198,7 +198,7 @@
String
|
-UTC time when the password will expire. null indicates that the password will not expire.
+ | UTC time when the password will expire. null indicates that the password has unlimited validity.
|
|---|
pwd_status
@@ -210,15 +210,6 @@
| Password status. true means that the password needs to be changed, and false means that the password is normal.
|
-pwd_strength
- |
-No
- |
-String
- |
-Password strength. The value can be high, mid, or low.
- |
-
default_project_id
|
No
@@ -264,7 +255,7 @@
"default_project_id": "263fd9",
"password_expires_at": "2016-12-07T00:00:00.000000Z",
"pwd_status": true,
- "pwd_strength": "high",
+
"last_project_id": ""
}],
"links": {
diff --git a/docs/iam/api-ref/en-us_topic_0064274720.html b/docs/iam/api-ref/en-us_topic_0064274720.html
index 1b13fad1..c919a78d 100644
--- a/docs/iam/api-ref/en-us_topic_0064274720.html
+++ b/docs/iam/api-ref/en-us_topic_0064274720.html
@@ -211,7 +211,7 @@
"id": "domainid"
}
}
-- user.name: Username of the delegating party.
- user.id: User ID of the delegating party.
- domain.name: Name of the domain to which the delegating party belongs.
- domain.id: ID of the domain.
- password_expires_at: Time when the password will expire. null indicates that the password will not expire. This parameter is optional.
+- user.name: Username of the delegating party.
- user.id: User ID of the delegating party.
- domain.name: Name of the domain which the delegating party belongs to.
- domain.id: ID of the domain which the delegating party belongs to.
- password_expires_at: Time when the password will expire. null indicates that the password will not expire. This parameter is optional.
|
domain
@@ -226,7 +226,7 @@
"name" : "domain A",
"id" : "domainid"
}
-- domain.name: Name of the domain to which the delegating party belongs.
- domain.id: ID of the domain.
+- domain.name: Name of the domain which the delegating party belongs to.
- domain.id: ID of the domain which the delegating party belongs to.
|
project
@@ -302,7 +302,7 @@
"id": "ff5ea657f1dd45c4b8f398cab..."
}
}
-- domain.name: Name of the domain to which the delegated party belongs.
- user.name: Username of the delegated party.
+- domain.name: Name of the domain which the delegated party belongs to.
- user.name: Username of the delegated party.
|
diff --git a/docs/iam/api-ref/en-us_topic_0066154565.html b/docs/iam/api-ref/en-us_topic_0066154565.html
index 15a36168..ccb3b2a4 100644
--- a/docs/iam/api-ref/en-us_topic_0066154565.html
+++ b/docs/iam/api-ref/en-us_topic_0066154565.html
@@ -65,7 +65,7 @@
String
|
-Parent project ID to which a project belongs.
+ | Parent project ID which a project belongs to.
|
domain_id
diff --git a/docs/iam/api-ref/en-us_topic_0079467612.html b/docs/iam/api-ref/en-us_topic_0079467612.html
index 9f49ea23..b29502bf 100644
--- a/docs/iam/api-ref/en-us_topic_0079467612.html
+++ b/docs/iam/api-ref/en-us_topic_0079467612.html
@@ -30,6 +30,14 @@
- Deleting Permissions of an Agency on a Domain
+- Querying All Permissions of an Agency
+
+- Granting Specified Permissions to an Agency for All Projects
+
+- Checking Whether an Agency Has Specified Permissions
+
+- Removing Specified Permissions of an Agency in All Projects
+
diff --git a/docs/iam/api-ref/en-us_topic_0097949518.html b/docs/iam/api-ref/en-us_topic_0097949518.html
index 5f884164..524db0c3 100644
--- a/docs/iam/api-ref/en-us_topic_0097949518.html
+++ b/docs/iam/api-ref/en-us_topic_0097949518.html
@@ -106,7 +106,7 @@
|
String
|
-domain.name: Name of the domain to which the delegating party belongs.
+ | domain.name: Name of the domain which the delegating party belongs to.
|
duration_seconds
diff --git a/docs/iam/api-ref/iam_01_0004.html b/docs/iam/api-ref/iam_01_0004.html
index 95b29421..d65e7fc4 100644
--- a/docs/iam/api-ref/iam_01_0004.html
+++ b/docs/iam/api-ref/iam_01_0004.html
@@ -1,7 +1,7 @@
Endpoints
-An endpoint is the request address for calling an API. Endpoints vary depending on services and regions. For the endpoints of all services, see Regions and Endpoints.
+ An endpoint is the request address for calling an API. Endpoints vary depending on services and regions. For the endpoints of all services, see Regions and Endpoints.
diff --git a/docs/iam/api-ref/iam_01_0007.html b/docs/iam/api-ref/iam_01_0007.html
index 73f1c50f..e97cbd3d 100644
--- a/docs/iam/api-ref/iam_01_0007.html
+++ b/docs/iam/api-ref/iam_01_0007.html
@@ -9,7 +9,7 @@
- Region
A region contains a physical data center, which is completely isolated to improve fault tolerance and stability. The region that is selected during resource creation cannot be changed after the resource is created. Regions are classified into universal regions and dedicated regions. A universal region provides universal cloud services for common tenants. A dedicated region provides specific services for specific tenants.
- AZ
An AZ is a physical location where resources use independent power supplies and networks. A region contains one or more AZs that are physically isolated but interconnected through internal networks. Because AZs are isolated from each other, any fault that occurs in an AZ will not affect other AZs.
- Project
Projects group and isolate resources (including compute, storage, and network resources) across physical regions. A default project is provided for each region, and subprojects can be created under each default project. Users can be granted permissions to access all resources in a specific project. For more refined access control, create subprojects under a project and create resources in the subprojects. Users can then be assigned permissions to access only specific resources in the subprojects.
-Figure 1 Project isolating model
+Figure 1 Project isolating model
diff --git a/docs/iam/api-ref/iam_01_0008.html b/docs/iam/api-ref/iam_01_0008.html
index e292a8c4..19a2c848 100644
--- a/docs/iam/api-ref/iam_01_0008.html
+++ b/docs/iam/api-ref/iam_01_0008.html
@@ -215,7 +215,7 @@
|
Querying the User Group to Which a User Belongs
|
-Query the information about the groups to which a specified user belongs.
+ | Query the information about the groups which a specified user belongs to.
|
Querying Users in a User Group
@@ -325,6 +325,11 @@
| Provided for the administrator to query permission information.
|
+Querying Permission Assignment Records
+ |
+Query permission assignment records of a specified account.
+ |
+
Querying Role Assignments (Discarded)
|
Query the user groups to which a specified role has been assigned.
diff --git a/docs/iam/api-ref/iam_02_0006.html b/docs/iam/api-ref/iam_02_0006.html
index 65dbbc5c..d2591f46 100644
--- a/docs/iam/api-ref/iam_02_0006.html
+++ b/docs/iam/api-ref/iam_02_0006.html
@@ -462,7 +462,7 @@
|
The value of name cannot exceed 64 characters.
|
-Check whether the value of name is correct.
+ | Check whether the value of name is correct.
|
400
@@ -473,7 +473,7 @@
|
The name field is invalid.
|
-Check whether the value of name is correct.
+ | Check whether the value of name is correct.
|
400
@@ -484,7 +484,7 @@
|
The description field is invalid.
|
-Check whether the value of description is correct.
+ | Check whether the value of description is correct.
|
400
@@ -495,7 +495,7 @@
|
The description_cn field is invalid.
|
-Check whether the value of description_cn is correct.
+ | Check whether the value of description_cn is correct.
|
400
@@ -689,7 +689,7 @@
|
IAM.1037
|
-The number of resource URIs [input Resource uri size ] must be greater than 0 and less than or equal to 20.
+ | The number of resource URIs [input Resource uri size] must be greater than 0 and less than or equal to 20.
|
Only 1 to 20 resources are allowed.
|
@@ -854,7 +854,7 @@
IAM.1052
|
-Invalid Attribute '[input attribute ]'.
+ | Invalid attribute '[input attribute]'.
|
The attribute is invalid.
|
@@ -876,7 +876,7 @@
IAM.1054
|
-The number [input attribute size ] of attributes '[input attribute]' for operator '[input operator]' must be greater than 0 and less than or equal to 10.
+ | The number [input attribute size] of attributes '[input attribute]' for operator '[input operator]' must be greater than 0 and less than or equal to 10.
|
Each operator can only be used together with 1 to 10 attributes.
|
@@ -887,7 +887,7 @@
IAM.1055
|
-Attribute '[input attribute ]' does not match operator '[input operator]'.
+ | Attribute '[input attribute]' does not match operator '[input operator]'.
|
The attribute does not match the operator.
|
@@ -966,7 +966,7 @@
Login protection has been bound to mfa, the unbinding operation cannot be performed.
|
-Login protection has been enabled and requires virtual MFA device based verification. You cannot unbind the virtual MFA device.
+ | Login protection has been enabled and requires virtual MFA authentication. You cannot unbind the virtual MFA device.
|
Check the request or contact technical support.
|
diff --git a/docs/iam/api-ref/iam_02_0008.html b/docs/iam/api-ref/iam_02_0008.html
index c78f13fd..6e840abd 100644
--- a/docs/iam/api-ref/iam_02_0008.html
+++ b/docs/iam/api-ref/iam_02_0008.html
@@ -53,7 +53,7 @@ POST https://www.example.com/v3/auth/tokens
For details, see "AK/SK-based Authentication" in Authentication.
-The API used to obtain a user token (Obtaining a User Token) does not require authentication. Therefore, only the Content-Type field needs to be added to requests for calling the API. An example of such requests is as follows:
+The API used to obtain a user token (Obtaining a User Token) does not require authentication. Only the Content-Type field needs to be added to requests for calling the API. An example of such requests is as follows:
POST https://www.example.com/v3/auth/tokens
diff --git a/docs/iam/api-ref/iam_02_0011.html b/docs/iam/api-ref/iam_02_0011.html
index 3b92322e..5fee4c6c 100644
--- a/docs/iam/api-ref/iam_02_0011.html
+++ b/docs/iam/api-ref/iam_02_0011.html
@@ -150,7 +150,7 @@
String
|
-ID of the domain to which the custom policy belongs.
+ | ID of the domain which the custom policy belongs to.
|
references
diff --git a/docs/iam/api-ref/iam_02_0023.html b/docs/iam/api-ref/iam_02_0023.html
index 56073b76..c4ece4d3 100644
--- a/docs/iam/api-ref/iam_02_0023.html
+++ b/docs/iam/api-ref/iam_02_0023.html
@@ -139,6 +139,15 @@
| Password validity period (days). Value range: 0–180. Value 0 indicates that this requirement does not apply.
|
+password_char_combination
+ |
+No
+ |
+Integer
+ |
+Minimum number of character types that a password must contain. Value range: 2–4.
+ |
+
Integer
|
-Session timeout (minutes) that will apply if you or users created using your account do not perform any operations within a specific period.
+ | Session timeout that will apply if you or users created using your account do not perform any operations within a specific period.
|
show_recent_login_info
diff --git a/docs/iam/api-ref/iam_02_0026.html b/docs/iam/api-ref/iam_02_0026.html
index 28202122..ca77264e 100644
--- a/docs/iam/api-ref/iam_02_0026.html
+++ b/docs/iam/api-ref/iam_02_0026.html
@@ -84,7 +84,7 @@
|
Integer
|
-Validity period (days) to disable users if they have not logged in within the period. Value range: 0–240. Validity period (days) to disable users if they have not logged in within the period If this parameter is set to 0, no users will be disabled.
+ | Validity period (days) to disable users if they have not logged in within the period. Value range: 0–240. If this parameter is set to 0, no users will be disabled.
|
custom_info_for_login
diff --git a/docs/iam/api-ref/iam_02_0040.html b/docs/iam/api-ref/iam_02_0040.html
new file mode 100644
index 00000000..e95f8236
--- /dev/null
+++ b/docs/iam/api-ref/iam_02_0040.html
@@ -0,0 +1,211 @@
+
+
+Querying All Permissions of an Agency
+FunctionThis API is provided for the administrator to query all permissions that have been assigned to an agency.
+
+ URIGET /v3.0/OS-INHERIT/domains/{domain_id}/agencies/{agency_id}/roles/inherited_to_projects
+
+ Table 1 URI parametersParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+agency_id
+ |
+Yes
+ |
+String
+ |
+Agency ID.
+ |
+
+domain_id
+ |
+Yes
+ |
+String
+ |
+ID of the delegating account.
+ |
+
+
+
+
+
+ Request Parameters
+ Table 2 Parameters in the request headerParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+X-Auth-Token
+ |
+Yes
+ |
+String
+ |
+Token with Security Administrator permissions.
+ |
+
+
+
+
+
+ Response Parameters
+ Table 3 Parameters in the response bodyParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+roles
+ |
+Array of objects
+ |
+Permission information.
+ |
+
+links
+ |
+object
+ |
+Resource link information.
+ |
+
+
+
+
+
+ Table 4 rolesParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+id
+ |
+String
+ |
+Permission ID.
+ |
+
+links
+ |
+object
+ |
+Permission resource link.
+ |
+
+name
+ |
+String
+ |
+Permission name.
+ |
+
+
+
+
+
+ Table 5 linksParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+self
+ |
+String
+ |
+Resource link.
+ |
+
+
+
+
+
+ Example RequestGET https://sample.domain.com/v3.0/OS-INHERIT/domains/{domain_id}/agencies/{agency_id}/roles/inherited_to_projects
+
+ Example ResponseStatus code: 200
+ The request is successful.
+ {
+ "roles" : [
+ {
+ "name" : "system_all_154",
+ "links" : {
+ "self" : "https://sample.domain.com/v3/roles/04570dfe267c45a3940e1ae9de868..."
+ },
+ "id" : "04570dfe267c45a3940e1ae9de868..."
+ },
+ {
+ "name" : "test1_admin",
+ "links" : {
+ "self" : "https://sample.domain.com/v3/roles/1bf20f1adba94747a6e02e1be3810..."
+ },
+ "id" : "1bf20f1adba94747a6e02e1be3810..."
+ }
+ ],
+ "links" : {
+ "self" : "https://sample.domain.com/v3.0/OS-INHERIT/domains/05b09b4723001dc90f27c0008f8b1.../agencies/08c6652e86801d234f01c00078308.../roles/inherited_to_projects"
+ }
+}
+
+ Status Codes
+ Status Code
+ |
+Description
+ |
+
|---|
+
+200
+ |
+The request is successful.
+ |
+
+401
+ |
+Authentication failed.
+ |
+
+403
+ |
+Access denied.
+ |
+
+404
+ |
+The requested resource cannot be found.
+ |
+
+500
+ |
+Internal server error.
+ |
+
+
+
+
+
+ Granting Specified Permissions to an Agency for All Projects
+FunctionThis API is provided for the administrator to grant specified permissions to an agency for all projects.
+
+ URIPUT /v3.0/OS-INHERIT/domains/{domain_id}/agencies/{agency_id}/roles/{role_id}/inherited_to_projects
+
+ Table 1 URI parametersParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+agency_id
+ |
+Yes
+ |
+String
+ |
+Agency ID.
+ |
+
+domain_id
+ |
+Yes
+ |
+String
+ |
+Domain ID of the delegating party.
+ |
+
+role_id
+ |
+Yes
+ |
+String
+ |
+Permission ID.
+ |
+
+
+
+
+
+ Request Parameters
+ Table 2 Parameters in the request headerParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+X-Auth-Token
+ |
+Yes
+ |
+String
+ |
+Token with Security Administrator permissions.
+ |
+
+
+
+
+
+ Response ParametersNone
+
+ Example RequestPUT https://sample.domain.com/v3.0/OS-INHERIT/domains/{domain_id}/agencies/{agency_id}/roles/{role_id}/inherited_to_projects
+
+
+ Status Codes
+ Status Code
+ |
+Description
+ |
+
|---|
+
+204
+ |
+The authorization is successful.
+ |
+
+401
+ |
+Authentication failed.
+ |
+
+403
+ |
+Access denied.
+ |
+
+404
+ |
+The requested resource cannot be found.
+ |
+
+500
+ |
+Internal server error.
+ |
+
+
+
+
+
+ Checking Whether an Agency Has Specified Permissions
+FunctionThis API is provided for the administrator to check whether an agency has specified permissions.
+
+ URIHEAD /v3.0/OS-INHERIT/domains/{domain_id}/agencies/{agency_id}/roles/{role_id}/inherited_to_projects
+
+ Table 1 URI parametersParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+agency_id
+ |
+Yes
+ |
+String
+ |
+Agency ID.
+ |
+
+domain_id
+ |
+Yes
+ |
+String
+ |
+Domain ID of the delegating party.
+ |
+
+role_id
+ |
+Yes
+ |
+String
+ |
+Permission ID.
+ |
+
+
+
+
+
+ Request Parameters
+ Table 2 Parameters in the request headerParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+X-Auth-Token
+ |
+Yes
+ |
+String
+ |
+Token with Security Administrator permissions.
+ |
+
+
+
+
+
+ Response ParametersNone
+
+ Example RequestHEAD https://sample.domain.com/v3.0/OS-INHERIT/domains/{domain_id}/agencies/{agency_id}/roles/{role_id}/inherited_to_projects
+
+
+ Status Codes
+ Status Code
+ |
+Description
+ |
+
|---|
+
+204
+ |
+The request is successful. (The agency has the specified permissions.)
+ |
+
+401
+ |
+Authentication failed.
+ |
+
+403
+ |
+Access denied.
+ |
+
+404
+ |
+The requested resource cannot be found.
+ |
+
+500
+ |
+Internal server error.
+ |
+
+
+
+
+
+ Removing Specified Permissions of an Agency in All Projects
+FunctionThis API is provided for the administrator to remove the specified permissions of an agency in all projects.
+
+ URIDELETE /v3.0/OS-INHERIT/domains/{domain_id}/agencies/{agency_id}/roles/{role_id}/inherited_to_projects
+
+ Table 1 URI parametersParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+agency_id
+ |
+Yes
+ |
+String
+ |
+Agency ID.
+ |
+
+domain_id
+ |
+Yes
+ |
+String
+ |
+Domain ID of the delegating party.
+ |
+
+role_id
+ |
+Yes
+ |
+String
+ |
+Permission ID.
+ |
+
+
+
+
+
+ Request Parameters
+ Table 2 Parameters in the request headerParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+X-Auth-Token
+ |
+Yes
+ |
+String
+ |
+Token with Security Administrator permissions.
+ |
+
+
+
+
+
+ Response ParametersNone
+
+ Example RequestDELETE https://sample.domain.com/v3.0/OS-INHERIT/domains/{domain_id}/agencies/{agency_id}/roles/{role_id}/inherited_to_projects
+
+
+ Status Codes
+ Status Code
+ |
+Description
+ |
+
|---|
+
+204
+ |
+Permissions are removed successfully.
+ |
+
+401
+ |
+Authentication failed.
+ |
+
+403
+ |
+Access denied.
+ |
+
+404
+ |
+The requested resource cannot be found.
+ |
+
+500
+ |
+Internal server error.
+ |
+
+
+
+
+
+ | iam:users:getUser
|
-Querying the User Group to Which a User Belongs
+ | Querying the User Group Which a User Belongs to
|
GET /v3/users/{user_id}/groups
|
@@ -393,7 +393,7 @@
Permissions Management
+ Permissions Management
Permission
|
API
diff --git a/docs/iam/api-ref/iam_02_0510.html b/docs/iam/api-ref/iam_02_0510.html
index e9ea6fba..90192cee 100644
--- a/docs/iam/api-ref/iam_02_0510.html
+++ b/docs/iam/api-ref/iam_02_0510.html
@@ -33,7 +33,9 @@
After a token is obtained, the X-Auth-Token header field must be added to requests to specify the token when calling other APIs. For example, if the token is ABCDEFJ...., X-Auth-Token: ABCDEFJ.... can be added to a request as follows:
-POST https://www.example.com/v3/auth/tokens
+GET https://iam.region1.example.com/v3/auth/projects
+Content-Type: application/json
+X-Auth-Token: ABCDEFJ....
AK/SK-based Authentication AK/SK-based authentication supports API requests with a body not larger than 12 MB. For API requests with a larger body, token-based authentication is recommended.
diff --git a/docs/iam/api-ref/iam_08_0004.html b/docs/iam/api-ref/iam_08_0004.html
index a8b5b9ab..456e2383 100644
--- a/docs/iam/api-ref/iam_08_0004.html
+++ b/docs/iam/api-ref/iam_08_0004.html
@@ -66,7 +66,7 @@
Object
|
- User information.
+ | IAM user information.
|
|
|---|
@@ -99,7 +99,7 @@
String
|
-ID of the account to which the user belongs.
+ | ID of the account which the user belongs to.
|
name
diff --git a/docs/iam/api-ref/iam_08_0011.html b/docs/iam/api-ref/iam_08_0011.html
index a16d0d48..ec1c92c7 100644
--- a/docs/iam/api-ref/iam_08_0011.html
+++ b/docs/iam/api-ref/iam_08_0011.html
@@ -109,7 +109,7 @@
|
String
|
-Password of the user. The password must meet the following requirements:
+ | New password of the user. The password must meet the following requirements:
- Can contain 6 to 32 characters. The default minimum password length is 6 characters.
- Must contain at least two of the following character types: uppercase letters, lowercase letters, digits, and special characters.
- Must meet the requirements of the password policy configured on the account settings page.
- Must be different from the old password.
|
@@ -281,7 +281,7 @@
String
|
-ID of the account to which the user belongs.
+ | ID of the account which the user belongs to.
|
enabled
diff --git a/docs/iam/api-ref/iam_08_0015.html b/docs/iam/api-ref/iam_08_0015.html
index a66df700..f1e542d6 100644
--- a/docs/iam/api-ref/iam_08_0015.html
+++ b/docs/iam/api-ref/iam_08_0015.html
@@ -31,7 +31,7 @@
|
String
|
-Access credential issued to a user to bear its identity and permissions.
+ | Access token issued to a user to bear its identity and permissions.
For details about the permissions required by the token, see "Actions".
|
@@ -78,7 +78,7 @@
String
|
-IAM user name, which consists of 1 to 32 characters. It can contain letters, digits, spaces, hyphens (-), underscores (_), and periods (.) and cannot start with a digit or space.
+ | IAM username, which consists of 1 to 64 characters. It can contain letters (case-sensitive), digits, spaces, hyphens (-), underscores (_), and periods (.), and cannot start with a digit or space.
|
domain_id
@@ -96,7 +96,7 @@
|
String
|
-Password of the user. The password must meet the following requirements:
+ | Password of the user.
|
email
@@ -105,7 +105,7 @@
|
String
|
-Email address with a maximum of 255 characters.
+ | Valid email address with a maximum of 255 characters.
|
areacode
@@ -250,7 +250,7 @@
|
String
|
-IAM user name, which consists of 1 to 32 characters. It can contain letters, digits, spaces, hyphens (-), underscores (_), and periods (.) and cannot start with a digit or space.
+ | IAM username, which consists of 1 to 32 characters. It can contain letters (case-sensitive), digits, spaces, hyphens (-), underscores (_), and periods (.), and cannot start with a digit or space.
|
phone
@@ -264,14 +264,14 @@
|
Boolean
|
-Whether the IAM user is an administrator.
+ | Indicates whether the IAM user is an administrator.
|
domain_id
|
String
|
-ID of the account to which the IAM user belongs.
+ | ID of the account used to create the IAM user.
|
enabled
@@ -300,7 +300,7 @@
| String
|
Time when the IAM user was created.
- NOTE: The value is a UTC time in the YYYY-MM-DDTHH:mm:ss.ssssssZ format, for example, 2023-06-28T08:56:33.710000Z. For details about the date and timestamp formats, see ISO-8601.
+ NOTE: The value is a UTC time in the YYYY-MM-DDTHH:mm:ss.ssssss format, for example, 2023-06-28T08:56:33.710000.
|
@@ -318,6 +318,13 @@
Business entity.
|
+default_project_id
+ |
+String
+ |
+Default project ID.
+ |
+
id
|
String
@@ -330,7 +337,7 @@
| String
|
Password expiration time. If this parameter is set to null, the password will never expire.
- NOTE: The value is a UTC time in the YYYY-MM-DDTHH:mm:ss.ssssssZ format, for example, 2023-06-28T08:56:33.710000Z. For details about the date and timestamp formats, see ISO-8601.
+ NOTE: The value is a UTC time in the YYYY-MM-DDTHH:mm:ss.ssssss format, for example, 2023-06-28T08:56:33.710000.
|
@@ -376,7 +383,10 @@
"create_time": "2020-01-06T08:05:16.000000",
"xdomain_id": "",
"xdomain_type": "",
- "id": "07664aec578026691f00c003a..."
+ "id": "07664aec578026691f00c003a...",
+ "status": null,
+ "password_expires_at": null,
+ "default_project_id": null
}
}
diff --git a/docs/iam/api-ref/iam_10_0011.html b/docs/iam/api-ref/iam_10_0011.html
index e6f8169f..f35c301b 100644
--- a/docs/iam/api-ref/iam_10_0011.html
+++ b/docs/iam/api-ref/iam_10_0011.html
@@ -85,18 +85,11 @@
Permission information.
|
-total_number
- |
-Integer
- |
-Total number of custom policies. This parameter is returned only when domain_id is specified in the request.
- |
-
- Table 4 RoleResultParameter
+Table 4 rolesParameter
|
Type
|
@@ -104,14 +97,7 @@
|---|
-domain_id
- |
-String
- |
-ID of the domain to which the permission belongs.
- |
-
-flag
+ | flag
|
String
|
@@ -122,7 +108,7 @@
String
|
-Description of the permission in Chinese.
+ | Description of the permission in Chinese. This parameter is returned in the response only when description_cn is specified during policy creation.
|
catalog
@@ -188,7 +174,7 @@
| String
|
Time when the permission was last updated.
- NOTE: The value is a UTC time in the YYYY-MM-DDTHH:mm:ss.ssssssZ format, for example, 2023-06-28T08:56:33.710000Z. For details about the date and timestamp formats, see ISO-8601.
+ NOTE: The value is a Unix timestamp in millisecond, for example, 1687913793000.
|
@@ -197,7 +183,7 @@
String
|
Time when the permission was created.
- NOTE: The value is a UTC time in the YYYY-MM-DDTHH:mm:ss.ssssssZ format, for example, 2023-06-28T08:56:33.710000Z. For details about the date and timestamp formats, see ISO-8601.
+ NOTE: The value is a Unix timestamp in millisecond, for example, 1687913793000.
|
@@ -205,7 +191,7 @@
Table 5 LinksParameter
+Table 5 linksParameter
|
Type
|
@@ -224,21 +210,21 @@
String
|
-Previous resource link.
+ | Previous resource link. If the previous resource link is unavailable, this parameter is set to null.
|
|---|
next
|
String
|
-Next resource link.
+ | Next resource link. If the next resource link is unavailable, this parameter is set to null.
|
Table 6 RolePolicyParameter
+Table 6 roles.policyParameter
|
Type
|
@@ -273,7 +259,7 @@
|---|
Table 7 PolicyDependsParameter
+Table 7 roles.policy.DependsParameter
|
Type
|
@@ -299,7 +285,7 @@
|---|
Table 8 PolicyStatementParameter
+Table 8 roles.policy.StatementParameter
|
Type
|
@@ -329,7 +315,7 @@
Object
|
-Conditions for the permission to take effect. A maximum of 10 conditions are allowed. For details, see "Creating a Custom Policy" in the Identity and Access Management User Guide.
+ | Conditions for the permission to take effect. The number of conditions cannot exceed 10. If this parameter is not specified during policy creation, it will not be returned in the response.
NOTE: Take the condition in the sample request as an example, the values of the condition key (obs:prefix) and string (public) must be equal (StringEquals).
"Condition": {
"StringEquals": {
@@ -343,9 +329,9 @@
|
|---|
Resource
|
-Array of strings
+ | Object
|
-Cloud resource. The array can contain a maximum of 10 resource strings, and each string cannot exceed 128 characters.
+ | Cloud resource. If this parameter is not specified during policy creation, it will not be returned in the response. The object can contain a maximum of 10 resource strings, and each string cannot exceed 128 characters.
NOTE: - Format: ::::. For example, obs:::bucket:*. Asterisks are allowed.
- The region segment can be * or a region accessible to the user. The specified resource must belong to the corresponding service that actually exists.
- In the case of a custom policy for agencies, the type of this parameter is Object, and the value should be set to "Resource": {"uri": ["/iam/agencies/07805acaba800fdd4fbdc00b8f888c7c"]}.
|
@@ -361,8 +347,7 @@
The request is successful.
{
"roles" : [ {
- "domain_id" : null,
- "description_cn" : "Description of the permission in Chinese",
+
"catalog" : "VulnScan",
"name" : "wscn_adm",
"description" : "Vulnerability Scan Service administrator of tasks and reports.",
@@ -389,9 +374,8 @@
} ]
}
}, {
- "domain_id" : null,
"flag" : "fine_grained",
- "description_cn" : "Description of the permission in Chinese",
+
"catalog" : "CSE",
"name" : "system_all_34",
"description" : "All permissions of CSE service.",
|
|---|
|
|---|
|
|---|
|
|---|
|
|---|
|
|---|
|