Authorization
API Authorization
The operations provided by this API may be authorized with the following authorization methods:
PublicAuthorizer
The PublicAuthorizer allows the operation if the endpoint
document’s public property is true.
RoleAuthorizer
A Role authorizer parses the request and the roles assigned to the current user. If one of the roles is in the listed set, then the operation is authorized. Understood roles are:
endpoint:owner
- Endpoint owner
endpoint:administrator
- Endpoint administrator
endpoint:activity_manager
- Endpoint activity_manager
endpoint:activity_monitor
- Endpoint activity_monitor
collection:administrator:*
- Collection administrator for any collection on this endpoint
collection:activity_manager:*
- Collection activity_manager for any collection on this endpoint
collection:activity_monitor:*
- Collection activity_monitor for any collection on this endpoint
collection:access_manager:*
- Collection access_manager for any collection on this endpoint
collection:administrator:{collection_id}- Collection administrator for the collection being operated on
collection:activity_manager:{collection_id}- Collection activity_manager for the collection being operated on
collection:activity_monitor:{collection_id}- Collection activity_monitor for the collection being operated on
collection:access_manager:{collection_id}- Collection access_manager for the collection being operated on
collection:administrator:{mapped_collection_id}- Collection administrator for the mapped collection associated with the guest collection that is being being operated on
collection:activity_manager:{mapped_collection_id}- activity_manager for the mapped collection associated the guest collection that is being being operated on
collection:activity_monitor:{mapped_collection_id}- activity_monitor for the mapped collection associated the guest collection that is being being operated on
collection:access_manager:{mapped_collection_id}- access_manager for the mapped collection associated the guest collection that is being being operated on
StorageGatewayAuthorizer
The StorageGatewayAuthorizer allows the operation if the caller’s identity set is allowed by the policies of a storage gateway. The parameter to this authorizer is one of the following:
*
- Any storage gateway
{storage_gateway_id}- Either the storage gateway that was passed in to this operation, or the storage gateway that the resource (either a user credential or collection) is associated with.