UpdateUserDelegations

Grant delegations to a user, or revoke them.

Only an Administrator can call this route, and it cannot be run as another user.

A delegation is one of 'add-project-test-suite', 'create-projects', 'add-project-abuse-case' or 'action-project-requests'. A later operation on the same delegation wins. Any other name is refused with HTTP 400 as described under Errors, rather than returned in error.

A delegation that does not exist on your AttackForge is skipped without an error, so status: ok does not confirm that it was granted. Get Available Delegations lists the ones that exist, and Get User Delegations lists the ones the user has now.

Headers

PATCH /api/ss/user/:id/delegations HTTP/1.1
Host: demo.attackforge.com
X-SSAPI-KEY: APIKey
Content-Type: application/json

Request

Path Parameters

id - string | required

ID of the user. Must be a 24-character hexadecimal id.

Body

operations - list of objects | required

Delegations to grant or revoke. At least one operation is required.

• delegations - list of strings | required

  • List of delegations. At least one is required.

• type - string | required

  • Must be either 'add' or 'remove'

Example

Request

curl --request PATCH \
	--url https://demo.attackforge.com/api/ss/user/5eacb8450c8d520a8281e539/delegations \
	--header 'content-type: application/json' \
	--header 'x-ssapi-key: ************' \
	--data '{
		"operations":[
			{
				"type":"add",
				"delegations":[
					"create-projects"
				]
			},
			{
				"type":"remove",
				"delegations":[
					"action-project-requests"
				]
			}
		]
	}'

Response

{
  "status": "ok | error",
  "error": "..."
}

Access and failures

Errors are returned in error: Unauthorized, Error Finding User, User Not Found, Error Finding Delegations, Error Granting Delegations or Error Revoking Delegations. Delegations are granted before any are revoked, so a revoking error means the grants were applied.