AE REST API - Granting Authorizations and Privileges
You can use the AE REST API to grant or deny Automation Engine Authorizations and Privileges to Users and User Groups as well as to set User authorizations at Object level.
You can also do so using the Automic Web Interface. For more information, see:
-
Defining the Authorizations Page (for object level authorizations)
This topic provides examples on how to use the AE REST API to work with Authorizations and Privileges.
Granting AE Privileges
The AE REST API allows you to specify the AWI areas, functions, folders and some system objects to which a User or User Group will have access.
Important!
-
You can only assign privileges that your own User definition contains.
-
The names of the privileges vary between AWI and the REST API. For a detailed description of the privileges and their name mapping in AWI and the AE REST API, see Granting Automation Engine Privileges.
Example
This request shows how to create a restricted User Group.
Request: POST http://{host}:{port}/ae/api/v1/{client}/objects
Example: http://my-jcp-host:8088/ae/api/v1/0/objects
{
"data": {
"usrg": {
"metadata": {
"version": "24.2.0"
},
"general_attributes": {
"type": "USRG",
"name": "USER_UG_REST",
"minimum_ae_version": "11.2"
},
"members" : [{"username":"USER/DEPT"}],
"user_group_attributes": {
"privileges": 0,
"privileges_set": [
"RECYCLE_BIN",
"TRANSPORT_CASE",
"ACCESS_TO_VERSION_MANAGEMENT_FOLDER",
"AUTOMATIC_PROCESSING",
"FILEEVENTS_START_WITHOUT_LOGIN_OBJECT_SPECIFIED",
"FILETRANSFER_START_WITHOUT_LOGIN_OBJECT_SPECIFIED",
"MANAGE_FAVORITES_ON_USERGROUP_LEVEL",
"SAP_CRITERIA_MANAGER",
"EXECUTE_AGENT_UPGRADES",
"ACCESS_TO_ADMINISTRATION",
"ACCESS_TO_ANALYTICS",
"ACCESS_TO_ANALYTICS_FOR_ALL_CLIENTS",
"ACCESS_TO_DASHBOARDS",
"ACCESS_TO_MESSAGES",
"ACCESS_TO_SERVICE_CATALOG",
"ACCESS_TO_PROCESS_ASSEMBLY",
"ACCESS_TO_PROCESS_MONITORING",
"CREATE_AND_MODIFY_BACKEND_VARIABLES",
"OBJECT_PROPERTIES_ALLOW_MANUAL_RESET_OF_EDIT_HINT",
"VIEW_ALL_MESSAGESFROM_ACCORDED_CLIENT",
"VIEW_MESSAGES",
"VIEW_ADMINISTRATORS_MESSAGES",
"VIEW_SECURITY_MESSAGES",
"ACCESS_TO_AUTOFORECAST",
"ACCESS_TO_SELECTIVE_STATISTICS",
"MODIFY_THE_STATUS_OF_A_TASK_MANUALLY",
"TAKE_OVER_TASK",
"VIEW_SERVER_USAGE_OF_ALL_CLIENTS",
"DEAL_WITH_AUTHORIZATIONS_AT_OBJECT_LEVEL"
]
},
}
}
}
Granting AE Authorizations
The AE REST API allows you to grant or deny User and/or User Group rights to objects, files, execution data, reports, and so on. The rights of a User are the sum of the authorizations it has been granted and those that have been granted to the User Groups to which the User is assigned.
Important! The authorization names vary between AWI and the REST API. For a detailed description of the authorizations and their name mapping in AWI and the AE REST API, see Granting Automation Engine Authorizations.
You grant or deny authorizations by specifying first the objects, type of objects or groups of objects:
-
auth_group
When using the REST API, 0 stands for access denial. If you are setting the User authorizations through Automic Web Interface, use NOT to deny access.
-
filter_object_type
-
filter_object_name
-
filter_agent_name1
-
filter_agent_name2
-
filter_user_id1
-
filter_user_id2
-
filter_file_names1
-
filter_file_names2
Then you define the authorization set that the user should have:
-
READ
-
WRITE
-
EXECUTE
-
DELETE
-
CANCEL
-
READ_STATISTIC
-
READ_REPORT
-
MODIFICATION_AT_RUNTIME
Example
This request shows how to create a restricted User in Client 100.
In this case, the user is not allowed to modify or delete clients.
Request: POST http://{host}:{port}/ae/api/v1/{client}/system/users?target_client=ClientNumber
Example: http://my-jcp-host:8088/ae/api/v1/0/system/users?target_client=100
{
"user": {
"metadata": {
"version": "24.2.0"
},
"general_attributes": {
"type": "USER",
"name": "REST-API/PORTAL"
},
"user_attributes": {
"is_active": 1,
"eh_refresh_interval": 90,
"privilege": 0,
"privileges_set": [
"ACCESS_TO_ADMINISTRATION",
"ACCESS_METRICS_ENDPOINT"
],
"is_locked": 0,
"usr_type": "DEFAULT ",
"usr_pw": "test",
"password_never_expires": false,
"password_change_at_next_login": false
},
"authorizations": [
{
"filter_object_type": "*",
"filter_object_name": "*",
"filter_agent_name1": "*",
"filter_agent_name2": "*",
"filter_user_id1": "*",
"filter_user_id2": "*",
"filter_file_names1": "*",
"filter_file_names2": "*",
"authorizations_set": [],
"auth_group": 1
},
{
"filter_object_type": "CLNT",
"filter_object_name": "*",
"filter_agent_name1": "*",
"filter_agent_name2": "*",
"filter_user_id1": "*",
"filter_user_id2": "*",
"filter_file_names1": "*",
"filter_file_names2": "*",
"bitcode": 0,
"authorizations_set": [
"WRITE",
"DELETE"
],
"auth_group": 0
}
]
}
}
Granting Object Level Authorizations
You can also grant or deny authorizations at Object level. This means that, in the Object definition, you can grant or deny authorizations to Users or User Groups, instead of doing it in the User or User Group authorization definition.
In this case, you use the object_authorizations to define the relevant User and/or User Group and define the authorization set that they should have.
-
READ
-
WRITE
-
EXECUTE
-
DELETE
-
CANCEL
-
READ_STATISTIC
-
READ_REPORT
-
MODIFICATION_AT_RUNTIME
-
DEFINE_SLA
The authorization names differ slightly in AWI and the REST API. For more information about object level authorizations and their name mapping, see Defining the Authorizations Page.
Example
This request shows how to grant all authorization to the UC_SYSTEM_SETTINGS for administrators but only read access for the SAAS_REST User.
Request: POST http://{host}:{port}/ae/api/v1/{client}/objects/object
Example: http://my-jcp-host:8088/ae/api/v1/0/objects/UC_SYSTEM_SETTINGS
{
"data": {
"vara": {
"metadata": {
"version": "24.2.0"
},
"general_attributes": {
"object_authorizations": [
{
"auth_object_name": "ADMIN/ADMIN",
"authorizations_set": [
"READ",
"WRITE",
"EXECUTE",
"DELETE",
"CANCEL",
"READ_STATISTIC",
"READ_REPORT",
"MODIFICATION_AT_RUNTIME",
"DEFINE_SLA"
]
},
{
"auth_object_name": "ADMINISTRATORS",
"authorizations_set": [
"READ",
"WRITE",
"EXECUTE",
"DELETE",
"CANCEL",
"READ_STATISTIC",
"READ_REPORT",
"MODIFICATION_AT_RUNTIME",
"DEFINE_SLA"
]
},
{
"auth_object_name": "SAAS_REST",
"authorizations_set": [
"READ"
]
}
]
}
}
}
}