UpdateUserRESTfulAPIMethods

Grant a user access to RESTful API methods, or revoke it.

Only an Administrator can call this route, and it cannot be run as another user.

Methods are named by their operationId, e.g. 'getProjects'. Get Available RESTful API Methods lists every name that is accepted, and Get User RESTful API Methods lists the ones the user has now. A later operation on the same method wins. When the request adds a method, the user is given an API key if they have none.

Only access given to the user directly is changed. A method that one of their groups gives them stays available after it is removed here, until Update Group RESTful API Methods removes it from the group.

Headers

PATCH /api/ss/user/:id/methods HTTP/1.1
Host: demo.attackforge.com
X-SSAPI-KEY: APIKey
Content-Type: application/json

Request

Path Parameters

id - string | required

ID of the user. Must be a 24-character hexadecimal id.

Body

operations - list of objects | required

Delegations to grant or revoke. At least one operation is required.

• methods - list of strings | required

  • List of method names. At least one is required.

• type - string | required

  • Must be either 'add' or 'remove'

Example

Request

curl --request PATCH \
	--url https://demo.attackforge.com/api/ss/user/5eacb8450c8d520a8281e539/methods \
	--header 'content-type: application/json' \
	--header 'x-ssapi-key: ************' \
	--data '{
		"operations":[
			{
				"type":"add",
				"methods":[
					"getProjects",
					"getVulnerabilities"
				]
			},
			{
				"type":"remove",
				"methods":[
					"createProject"
				]
			}
		]
	}'

Response

{
  "status": "ok | error",
  "error": "..."
}

Access and failures

Errors are returned in error:

• Unauthorized - the caller is not an Administrator.

• User Not Found or Error Finding User - the user could not be found.

• Unknown methods: a, b - a method is not one of the RESTful API methods. Nothing is applied.

• Error Granting Methods or Error Revoking Methods - the change could not be saved. Methods are granted before any are revoked, so a revoking error means the grants were applied.