Fields: User's Permissions

See the associated Permissions resource section for more information on how to use this resource and supported operations.

Additional references

Type	Value	Additional information
Permissions resource	permissions/users	Permissions
Hooks filename	permissions.users.groovy	Pre and post-processing hooks
Distinct query-supported	Yes	Distinct

API version 3

UserPermission

Field Name	Type	Description
id	String	The unique ID of the cached user permission.
name	String	The unique name of the user.
permissions	List<Permission>	The list of permissions.

Permission

Represents a permission

Field Name	Type	Description
id	String	The unique ID of this role.
action	String	The action that can be performed on the resource.
description	String	A description of this permission.
fieldPath	String	Field level ACL control, if null or '', all fields are accessible, otherwise requests must match dot delimited path. Currently only checked when doing writable actions. Example - attributes.: create\|update
label	String	A human readable label for this permission.
resource	String	The resource the permission applies to.
resourceFilter	Map<String, Map>	A map used to limit which resource instances this permission applies to. If this is null then the permission will apply to all instances of the resource. For api permissions the filter uses mongo query syntax.
scope	PrivilegeScope	Whether this permission applies to the principal's tenant-associated resources or globally
type	String	The type of the permission. Only 'api' type permissions are enforced.

PrivilegeScope

Some permissions and roles ignore tenants and apply globally. Others apply only to the resources associated with the principal's tenants.

Value	Description
GLOBAL	Describes a role or permission that applies globally, irrespective of the principal's tenants. This scope can be applied to any role or permission.
TENANT	Describes a role or permission that applies only to the resources associated with the principal's tenants. This scope can be applied to any role, but only to those permissions associated with tenanted resources (e.g. nodes, services, etc.).
NONE	Scope doesn't apply to some permissions. As of right now, all non-domain permissions (e.g. those created by Viewpoint) don't need a scope. NONE should therefore be assigned to all non-domain permissions.

API version 2

UserPermission

Field Name	Type	Description
id	String	The unique ID of the cached user permission.
name	String	The unique name of the user.
permissions	List<Permission>	The list of permissions.

Permission

Represents a permission

Field Name	Type	Description
id	String	The unique ID of this role.
action	String	The action that can be performed on the resource.
description	String	A description of this permission.
fieldPath	String	Field level ACL control, if null or '', all fields are accessible, otherwise requests must match dot delimited path. Currently only checked when doing writable actions. Example - attributes.: create\|update
label	String	A human readable label for this permission.
resource	String	The resource the permission applies to.
resourceFilter	Map<String, Map>	A map used to limit which resource instances this permission applies to. If this is null then the permission will apply to all instances of the resource. For api permissions the filter uses mongo query syntax.
scope	PrivilegeScope	Whether this permission applies to the principal's tenant-associated resources or globally
type	String	The type of the permission. Only 'api' type permissions are enforced.

PrivilegeScope

Some permissions and roles ignore tenants and apply globally. Others apply only to the resources associated with the principal's tenants.

Value	Description
GLOBAL	Describes a role or permission that applies globally, irrespective of the principal's tenants. This scope can be applied to any role or permission.
TENANT	Describes a role or permission that applies only to the resources associated with the principal's tenants. This scope can be applied to any role, but only to those permissions associated with tenanted resources (e.g. nodes, services, etc.).
NONE	Scope doesn't apply to some permissions. As of right now, all non-domain permissions (e.g. those created by Viewpoint) don't need a scope. NONE should therefore be assigned to all non-domain permissions.

API version 1

UserPermission

Field Name	Type	Description
id	String	The unique ID of the cached user permission.
name	String	The unique name of the user.
permissions	List<Permission>	The list of permissions.

Permission

Represents a permission

Field Name	Type	Description
id	String	The unique ID of this role.
action	String	The action that can be performed on the resource.
description	String	A description of this permission.
fieldPath	String	Field level ACL control, if null or '', all fields are accessible, otherwise requests must match dot delimited path. Currently only checked when doing writable actions. Example - attributes.: create\|update
label	String	A human readable label for this permission.
resource	String	The resource the permission applies to.
resourceFilter	Map<String, Map>	A map used to limit which resource instances this permission applies to. If this is null then the permission will apply to all instances of the resource. For api permissions the filter uses mongo query syntax.
scope	PrivilegeScope	Whether this permission applies to the principal's tenant-associated resources or globally
type	String	The type of the permission. Only 'api' type permissions are enforced.

PrivilegeScope

Some permissions and roles ignore tenants and apply globally. Others apply only to the resources associated with the principal's tenants.

Value	Description
GLOBAL	Describes a role or permission that applies globally, irrespective of the principal's tenants. This scope can be applied to any role or permission.
TENANT	Describes a role or permission that applies only to the resources associated with the principal's tenants. This scope can be applied to any role, but only to those permissions associated with tenanted resources (e.g. nodes, services, etc.).
NONE	Scope doesn't apply to some permissions. As of right now, all non-domain permissions (e.g. those created by Viewpoint) don't need a scope. NONE should therefore be assigned to all non-domain permissions.