Access Service | Equinix Product Documentation

Get Effective Permissions

Request

Returns a unified representation of the caller's permissions for a given service, based on the supplied access token. A user in possession of a valid access token is always authorized to perform this operation. There is no corresponding action id, because permission to perform the operation does not depend on the role assignments or access policy of the caller.

Permissions are always returned in the context of a specific project. When a project id is not supplied, permissions are returned for the project containing access policy in the access token's scope. When the access token is not associated with an access policy, a project id must be specified.

The auth token's access policy must allow action:use/getEffectivePermissions.

Security

bearerAuth

Path

projectIdstring(ProjectId)^project:[0-9a-zA-Z](?![^:]*-$)(?![^:]*--)[0-...required

Globally unique identifier of a project. Callers may URL encode this value.

Example:project:abc-123

Query

serviceIdstring(ServiceId)^service:[a-zA-Z][a-zA-Z0-9]{0,49}/[a-zA-Z][a...required

Fully qualified, universally unique id of a service.

Example:serviceId=service:equinix/sts

projectErnstring(Ern)^ern:(?<cloud>[^:]{1,50}):(?<service>[^:/]{1,...

Equinix Resource Name of a project. Mutually exclusive with projectId.

Example:projectErn=ern:eqix:equinix/sts:global:abc-123:SomeType:res-id

Payload

// No request payload

Responses

Success

Bodyapplication/json

principalIdstring(Principal)^principal:([0-9a-zA-Z](?![^:]*-$)(?![^:]*--)...required

Globally unique string identifier for a principal formatted like "principal:...".

Example:"principal:abc-123:idp:example-user"

projectIdstring(ProjectId)^project:[0-9a-zA-Z](?![^:]*-$)(?![^:]*--)[0-...required

Globally unique identifier of a project.

Example:"project:abc-123"

serviceIdstring(ServiceId)^service:[a-zA-Z][a-zA-Z0-9]{0,49}/[a-zA-Z][a...required

Fully qualified, universally unique id of a service. Starts with the NamespaceId. Formatted like "service:<namespace>/<service>".

Example:"service:equinix/sts"

accessPolicyIdsArray of any, non-empty, unique

permissionsArray of objects, uniquerequired

Response

{
  "principalId": "principal:abc-123:idp:example-user",
  "projectId": "project:abc-123",
  "serviceId": "service:equinix/sts",
  "accessPolicyIds": [
    "accesspolicy:my-policy"
  ],
  "permissions": [
    { … }
  ]
}