GXS Internal
Identity serverAPI reference

Authorization

/authorization/check

POST
/authorization/check

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
plane*string
Value in"admin""organization"
permission*string

Response Body

Whether the session's subject holds the permission, and who decided.

application/json
  1. response
allowed*boolean

The decision to act on. A refusal is still a 200.

reason*|

Why, from whoever decided: a registry reason under enforce, or legacy_allow/legacy_deny while the pre-registry check decides. Null when the host reports none. The set grows, so keep a default branch.

mode*|

Resolved per permission from the global setting and the permission's own enforcement, so two keys in one batch can differ.

Value in"legacy""shadow""enforce"null
curl -X POST 'https://dev.auth.graphxserver.io/api/auth/authorization/check' \  -H 'Content-Type: application/json' \  -d '{  "plane": "admin",  "permission": "string"}'
{  "allowed": true,  "reason": "string",  "mode": "legacy"}

/authorization/batch-check

POST
/authorization/batch-check

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
plane*string
Value in"admin""organization"
permissions*array<string>

Response Body

One answer per distinct permission asked.

application/json
  1. response
results*

Keyed by permission. Repeated keys collapse to one entry.

curl -X POST 'https://dev.auth.graphxserver.io/api/auth/authorization/batch-check' \  -H 'Content-Type: application/json' \  -d '{  "plane": "admin",  "permissions": [    "string"  ]}'
{  "results": {    "property1": {      "allowed": true,      "reason": "string",      "mode": "legacy"    },    "property2": {      "allowed": true,      "reason": "string",      "mode": "legacy"    }  }}

/authorization/list-organization-roles

GET
/authorization/list-organization-roles

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Query Parameters

organizationId?string
Length1 <= length
cursor?number
limit?number
search?string
status?|array<>
system?boolean|
sortBy?string
Value in"rank""role""displayName""createdAt"
sortDirection?string
Value in"asc""desc"

Response Body

One page of the organization's roles, native rows included.

application/json
  1. response
roles*array<>
nextCursor*|

The next page's cursor, or null on the last page.

previousCursor*integer|null
limit*integer
total*integer

Roles matching the filters, across every page.

curl -X GET 'https://dev.auth.graphxserver.io/api/auth/authorization/list-organization-roles'
{  "roles": [    {      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",      "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9",      "role": "string",      "type": "string",      "displayName": "string",      "description": "string",      "systemRoleId": "a73451d2-f8c5-42aa-8865-c55b4afe9de2",      "rank": 0,      "status": "active",      "archivedAt": "2019-08-24T14:15:22Z",      "createdByUserId": "4d2aef9a-17b0-44e6-902e-616812033620",      "createdAt": "2019-08-24T14:15:22Z",      "updatedAt": "2019-08-24T14:15:22Z",      "permissions": [        {          "key": "string",          "effect": "allow"        }      ]    }  ],  "nextCursor": 0,  "previousCursor": 0,  "limit": 0,  "total": 0}

/authorization/get-organization-role

GET
/authorization/get-organization-role

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Query Parameters

organizationId?string
Length1 <= length
roleId?string
Length1 <= length

Response Body

One organization role with its grants.

application/json
  1. response
id*string

The native role's id: the roleId every endpoint takes.

Formatuuid
organizationId*string
Formatuuid
role*string

The identifier stored in members.role.

type*string|null
displayName*string
description*string|null
systemRoleId*|

Set when this is a system role: its permissions are managed by identity and cannot be edited by the organization.

Formatuuid
rank*integer
status*string
Value in"active""archived"
archivedAt*|
Formatdate-time
createdByUserId*|
Formatuuid
createdAt*string
Formatdate-time
updatedAt*string
Formatdate-time
permissions*array<>
curl -X GET 'https://dev.auth.graphxserver.io/api/auth/authorization/get-organization-role'
{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9",  "role": "string",  "type": "string",  "displayName": "string",  "description": "string",  "systemRoleId": "a73451d2-f8c5-42aa-8865-c55b4afe9de2",  "rank": 0,  "status": "active",  "archivedAt": "2019-08-24T14:15:22Z",  "createdByUserId": "4d2aef9a-17b0-44e6-902e-616812033620",  "createdAt": "2019-08-24T14:15:22Z",  "updatedAt": "2019-08-24T14:15:22Z",  "permissions": [    {      "key": "string",      "effect": "allow"    }  ]}

/authorization/create-organization-role

POST
/authorization/create-organization-role

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
organizationId?string
Length1 <= length
role*string
Length3 <= length <= 64
displayName*string
Length1 <= length <= 100
description?|
Lengthlength <= 500
permissions?array<>

Response Body

The committed role with its grants, plus whether the write changed anything.

application/json
  1. response
id*string

The native role's id: the roleId every endpoint takes.

Formatuuid
organizationId*string
Formatuuid
role*string

The identifier stored in members.role.

type*string|null
displayName*string
description*string|null
systemRoleId*|

Set when this is a system role: its permissions are managed by identity and cannot be edited by the organization.

Formatuuid
rank*integer
status*string
Value in"active""archived"
archivedAt*|
Formatdate-time
createdByUserId*|
Formatuuid
createdAt*string
Formatdate-time
updatedAt*string
Formatdate-time
permissions*array<>
write*
curl -X POST 'https://dev.auth.graphxserver.io/api/auth/authorization/create-organization-role' \  -H 'Content-Type: application/json' \  -d '{  "role": "string",  "displayName": "string"}'
{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9",  "role": "string",  "type": "string",  "displayName": "string",  "description": "string",  "systemRoleId": "a73451d2-f8c5-42aa-8865-c55b4afe9de2",  "rank": 0,  "status": "active",  "archivedAt": "2019-08-24T14:15:22Z",  "createdByUserId": "4d2aef9a-17b0-44e6-902e-616812033620",  "createdAt": "2019-08-24T14:15:22Z",  "updatedAt": "2019-08-24T14:15:22Z",  "permissions": [    {      "key": "string",      "effect": "allow"    }  ],  "write": {    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "changed": true  }}

/authorization/update-organization-role

POST
/authorization/update-organization-role

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
organizationId?string
Length1 <= length
roleId*string
Length1 <= length
displayName?string
Length1 <= length <= 100
description?|
Lengthlength <= 500

Response Body

The committed role with its grants, plus whether the write changed anything.

application/json
  1. response
id*string

The native role's id: the roleId every endpoint takes.

Formatuuid
organizationId*string
Formatuuid
role*string

The identifier stored in members.role.

type*string|null
displayName*string
description*string|null
systemRoleId*|

Set when this is a system role: its permissions are managed by identity and cannot be edited by the organization.

Formatuuid
rank*integer
status*string
Value in"active""archived"
archivedAt*|
Formatdate-time
createdByUserId*|
Formatuuid
createdAt*string
Formatdate-time
updatedAt*string
Formatdate-time
permissions*array<>
write*
curl -X POST 'https://dev.auth.graphxserver.io/api/auth/authorization/update-organization-role' \  -H 'Content-Type: application/json' \  -d '{  "roleId": "string"}'
{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9",  "role": "string",  "type": "string",  "displayName": "string",  "description": "string",  "systemRoleId": "a73451d2-f8c5-42aa-8865-c55b4afe9de2",  "rank": 0,  "status": "active",  "archivedAt": "2019-08-24T14:15:22Z",  "createdByUserId": "4d2aef9a-17b0-44e6-902e-616812033620",  "createdAt": "2019-08-24T14:15:22Z",  "updatedAt": "2019-08-24T14:15:22Z",  "permissions": [    {      "key": "string",      "effect": "allow"    }  ],  "write": {    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "changed": true  }}

/authorization/set-organization-role-permissions

POST
/authorization/set-organization-role-permissions

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
organizationId?string
Length1 <= length
roleId*string
Length1 <= length
permissions*array<>

Response Body

The committed role with its grants, plus whether the write changed anything.

application/json
  1. response
id*string

The native role's id: the roleId every endpoint takes.

Formatuuid
organizationId*string
Formatuuid
role*string

The identifier stored in members.role.

type*string|null
displayName*string
description*string|null
systemRoleId*|

Set when this is a system role: its permissions are managed by identity and cannot be edited by the organization.

Formatuuid
rank*integer
status*string
Value in"active""archived"
archivedAt*|
Formatdate-time
createdByUserId*|
Formatuuid
createdAt*string
Formatdate-time
updatedAt*string
Formatdate-time
permissions*array<>
write*
curl -X POST 'https://dev.auth.graphxserver.io/api/auth/authorization/set-organization-role-permissions' \  -H 'Content-Type: application/json' \  -d '{  "roleId": "string",  "permissions": [    {      "key": "string"    }  ]}'
{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9",  "role": "string",  "type": "string",  "displayName": "string",  "description": "string",  "systemRoleId": "a73451d2-f8c5-42aa-8865-c55b4afe9de2",  "rank": 0,  "status": "active",  "archivedAt": "2019-08-24T14:15:22Z",  "createdByUserId": "4d2aef9a-17b0-44e6-902e-616812033620",  "createdAt": "2019-08-24T14:15:22Z",  "updatedAt": "2019-08-24T14:15:22Z",  "permissions": [    {      "key": "string",      "effect": "allow"    }  ],  "write": {    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "changed": true  }}

OAuth and OpenID Connect

Previous Page

Admin

Next Page