UpdateUserRunAsUsers

Change which users an Administrator can run requests as.

Only an Administrator can call this route, and it cannot be run as another user.

Send run_as_any_user, operations or both. The two settings are independent, and a body with both is applied as one update. A body with neither is refused with HTTP 400 as described under Errors.

run_as_any_user: true lets the user run as any user and leaves their run-as users as they are. The user must be an Administrator. false clears only that permission, and is allowed whatever the user's role.

 Any User {  "run_as_any_user": true }

operations adds user IDs to, or removes them from, the user's run-as users, and leaves run_as_any_user as it is. A later operation on the same ID wins. Removals apply before additions, so a removal makes room for an addition where the deployment limits how many users the list holds. Only additions are checked: the user must be an Administrator, the list must stay within that limit, and every ID added must be a user who is not an Administrator, not deleted and not the user themselves. Removing is allowed even when the user is no longer an Administrator.

Headers

PATCH /api/ss/user/:id/run-as-users HTTP/1.1
Host: demo.attackforge.com
X-SSAPI-KEY: APIKey
Content-Type: application/json

Request

Path Parameters

id - string | required

ID of the user. Must be a 24-character hexadecimal id.

Body

operations - list of objects | required

Run-as users to add or remove. At least one operation is required.

• type - string | required

  • Must be either 'add' or 'remove'

• user_ids - list of strings | required

  • List of user ids. At least one is required.

run_as_any_user - boolean

Whether the user can run as any user.

Example

Request

curl --request PATCH \
	--url https://demo.attackforge.com/api/ss/user/5eacb8450c8d520a8281e539/run-as-users \
	--header 'content-type: application/json' \
	--header 'x-ssapi-key: ************' \
	--data '{
		"operations":[
			{
				"type":"add",
				"user_ids":[
					"638fb228640930001c4705ff",
					"6662a9677ad9f6923e3fd46c"
				]
			},
			{
				"type":"remove",
				"user_ids":[
					"67aafc15f6e776e62bf8aacf"
				]
			}
		]
	}'

Response

{
  "status": "ok | error",
  "error": "...",
  "invalid_user_ids": [
    "..."
  ]
}

Access and failures

Errors are returned in error:

• Unauthorized - the caller is not an Administrator.

• User Not Found or Error Finding User - the user could not be found.

• Rejected - the change failed the checks above. The IDs at fault, when there are any, are in invalid_user_ids.

• Error Saving Run-As Users - the change could not be saved.