Access Service | Equinix Product Documentation

Create Policy Mask

Request

Allows a project admin to create a project-scoped policy mask. The mask controls which managed policies and managed permission sets are available within this project. Access is controlled by the project.

The auth token's access policy must allow action:use/createPolicyMask.

Security

bearerAuth

Path

projectIdstring(ProjectId)^project:[0-9a-zA-Z](?![^:]*-$)(?![^:]*--)[0-...required

Globally unique identifier of a project. Callers may URL encode this value.

Example:project:abc-123

Bodyapplication/jsonrequired

managedPoliciesstring or Array of strings

One of:

string

Value:"none"

managedPermissionSetsstring or Array of strings

One of:

string

Value:"none"

subtractobject

tagsobject, <= 10 properties(Tags)required

Additional user-controlled data about this resource.

descriptionstring^.{0,500}$

Example:"A description string."

policyMaskIdstring(PolicyMaskId)^policymask:[a-zA-Z](?![^:]*-$)(?![^:]*--)[a-...required

Uniquely identifies a policy mask globally or within a governing project.

Example:"policymask:my-mask"

Payload

{
  "managedPolicies": "none",
  "managedPermissionSets": "none",
  "subtract": {
    "managedPolicies": [ … ],
    "managedPermissionSets": [ … ]
  },
  "tags": {
    "property1": "my tag value",
    "property2": "my tag value"
  },
  "description": "A description string.",
  "policyMaskId": "policymask:my-mask"
}

Responses

Success

Bodyapplication/json

descriptionstring^.{0,500}$

Example:"A description string."

tagsobject, <= 10 properties(Tags)required

Additional user-controlled data about this resource.

managedPermissionSetsstring or Array of strings

One of:

string

Value:"none"

updatedAtstring(UpdatedAt)^.*$

A string timestamp indicating when the resource was last updated. Formatted like: "2025-02-12T17:24:19.033772087Z"

Example:"2024-01-15T12:00:00Z"

createdBystring(CreatedBy)^.*$

A string indicating the principal who invoked an operation to create the resource.

Example:"principal:ABCD-EFG-12345:idp:example-user"

createdAtstring(CreatedAt)^.*$

A string timestamp indicating when the resource was created. Formatted like: "2025-02-12T17:24:19.033772087Z"

Example:"2024-01-15T12:00:00Z"

revstring(ResourceRev)^.*$required

An opaque string that represents the revision of a given resource. Each time the resource is updated, this value changes.

Example:"abc123"

ernstring(Ern)^ern:(?<cloud>[^:]{1,50}):(?<service>[^:/]{1,...required

Equinix resource name, a universally unique identifier for a resource across all clouds, regions, and services. Formatted as "ern:<cloudId>:<serviceId>:<regionId>:<projectId>:<resourceType>:<resourceId>".

Example:"ern:eqix:equinix/sts:global:abc-123:SomeType:res-id"

disabledPolicyany

Value:true

Example:true

updatedBystring(UpdatedBy)^.*$

A string indicating the principal who last invoked an operation to update the resource.

Example:"principal:ABCD-EFG-12345:idp:example-user"

policyMaskIdstring(PolicyMaskId)^policymask:[a-zA-Z](?![^:]*-$)(?![^:]*--)[a-...required

Uniquely identifies a policy mask globally or within a governing project.

Example:"policymask:my-mask"

managedPoliciesstring or Array of strings

One of:

string

Value:"none"

subtractobject

Response

{
  "description": "A description string.",
  "tags": {
    "property1": "my tag value",
    "property2": "my tag value"
  },
  "managedPermissionSets": "none",
  "updatedAt": "2024-01-15T12:00:00Z",
  "createdBy": "principal:ABCD-EFG-12345:idp:example-user",
  "createdAt": "2024-01-15T12:00:00Z",
  "rev": "abc123",
  "ern": "ern:eqix:equinix/sts:global:abc-123:SomeType:res-id",
  "disabledPolicy": true,
  "updatedBy": "principal:ABCD-EFG-12345:idp:example-user",
  "policyMaskId": "policymask:my-mask",
  "managedPolicies": "none",
  "subtract": {
    "managedPolicies": [ … ],
    "managedPermissionSets": [ … ]
  }
}