Access Service | Equinix Product Documentation

Create Permission Set

Request

Allows users to define a permission set object which can then be used as a reusable building block when defining access policies. The permission set is created in the project identified by the projectId. A permission set is conceptually a set of action/resource tuples. The set is computed based on the permissions, intersect, and subtract fields. Each of those fields is a unioned composite and are then combined by taking the permissions tuples, intersected with the intersect tuples, and then from that the subtract tuples are removed. Access to this operation is controlled by the project being accessed.

The auth token's access policy must allow action:use/createPermissionSet.

Security

bearerAuth

Path

projectIdstring(ProjectId)^project:[0-9a-zA-Z](?![^:]*-$)(?![^:]*--)[0-...required

Globally unique identifier of a project. Callers may URL encode this value.

Example:project:abc-123

Bodyapplication/jsonrequired

tagsobject, <= 10 properties(Tags)required

Additional user-controlled data about this resource.

descriptionstring^.{0,500}$

Example:"A description string."

permissionsArray of any, unique(UserRectSet)required

A set of permissions, each of which may be an inline permission, a permission set reference, or a foreign access policy reference.

intersectArray of any, unique(UserRectSet)

Entries must appear in both the intersect field and the permissions to be in the results from this permission object.

subtractArray of objects, unique(InlinePermission)

Entries in the subtract field are not included in the results from this permission object.

permissionSetIdstring(PermissionSetId)^permissionset:[a-zA-Z](?![^:]*-$)(?![^:]*--)...required

Uniquely identifies a PermissionSet within a project.

Example:"permissionset:my-set"

allowBadRefsstring

Indicates that the permission set should be created even if it includes invalid references to permission objects.

Value:"additional"

Example:"additional"

Payload

{
  "tags": {
    "property1": "my tag value",
    "property2": "my tag value"
  },
  "description": "A description string.",
  "permissions": [
    { … }
  ],
  "intersect": [
    { … }
  ],
  "subtract": [
    { … }
  ],
  "permissionSetId": "permissionset:my-set",
  "allowBadRefs": "additional"
}

Responses

Success

Bodyapplication/json

descriptionstring^.{0,500}$

Example:"A description string."

tagsobject, <= 10 properties(Tags)required

Additional user-controlled data about this resource.

updatedAtstring(UpdatedAt)^.*$

A string timestamp indicating when the resource was last updated. Formatted like: "2025-02-12T17:24:19.033772087Z"

Example:"2024-01-15T12:00:00Z"

permissionsArray of any, unique(UserRectSet)required

A set of permissions, each of which may be an inline permission, a permission set reference, or a foreign access policy reference.

createdBystring(CreatedBy)^.*$

A string indicating the principal who invoked an operation to create the resource.

Example:"principal:ABCD-EFG-12345:idp:example-user"

createdAtstring(CreatedAt)^.*$

A string timestamp indicating when the resource was created. Formatted like: "2025-02-12T17:24:19.033772087Z"

Example:"2024-01-15T12:00:00Z"

revstring(ResourceRev)^.*$required

An opaque string that represents the revision of a given resource. Each time the resource is updated, this value changes.

Example:"abc123"

approvedAtstring(UpdatedAt)^.*$

A string timestamp indicating when the resource was last updated. Formatted like: "2025-02-12T17:24:19.033772087Z"

Example:"2024-01-15T12:00:00Z"

ernstring(Ern)^ern:(?<cloud>[^:]{1,50}):(?<service>[^:/]{1,...required

Equinix resource name, a universally unique identifier for a resource across all clouds, regions, and services. Formatted as "ern:<cloudId>:<serviceId>:<regionId>:<projectId>:<resourceType>:<resourceId>".

Example:"ern:eqix:equinix/sts:global:abc-123:SomeType:res-id"

updatedBystring(UpdatedBy)^.*$

A string indicating the principal who last invoked an operation to update the resource.

Example:"principal:ABCD-EFG-12345:idp:example-user"

managedany

Value:true

Example:true

intersectArray of any, unique(UserRectSet)

Entries must appear in both the intersect field and the permissions to be in the results from this permission object.

subtractArray of objects, unique(InlinePermission)

Entries in the subtract field are not included in the results from this permission object.

permissionSetIdPermissionSetId (string) or ManagedPermissionSetId (string)required

One of:

Uniquely identifies a PermissionSet within a project.

string(PermissionSetId)

approvedBystring(ApprovedBy)^.*$

A string indicating the principal who invoked an operation to approve the resource.

Example:"principal:ABCD-EFG-12345:idp:example-user"

Response

{
  "description": "A description string.",
  "tags": {
    "property1": "my tag value",
    "property2": "my tag value"
  },
  "updatedAt": "2024-01-15T12:00:00Z",
  "permissions": [
    { … }
  ],
  "createdBy": "principal:ABCD-EFG-12345:idp:example-user",
  "createdAt": "2024-01-15T12:00:00Z",
  "rev": "abc123",
  "approvedAt": "2024-01-15T12:00:00Z",
  "ern": "ern:eqix:equinix/sts:global:abc-123:SomeType:res-id",
  "updatedBy": "principal:ABCD-EFG-12345:idp:example-user",
  "managed": true,
  "intersect": [
    { … }
  ],
  "subtract": [
    { … }
  ],
  "permissionSetId": "permissionset:my-set",
  "approvedBy": "principal:ABCD-EFG-12345:idp:example-user"
}