The rules that must match. Only one rule must match for the role assignment to be applied.
groupstring
The group to match. Can have wildcards. Must specify either group or email but not both.
emailstring
The email to match. Can have wildcards. Must specify either group or email but not both.
allobject[]
The rules that must match. All rules must match for the role assignment to be applied.
groupstring
The group to match. Can have wildcards. Must specify either group or email but not both.
emailstring
The email to match. Can have wildcards. Must specify either group or email but not both.
role_assignmentsobjectrequired
Roles assigned to users, API keys or organization invitations. Currently unavailable in self-hosted ECE.
platformobject[]
Assignments for roles with platform scope.
role_idstringrequired
The ID of the role that is assigned.
organizationobject[]
Assignments for roles with organization scope.
role_idstringrequired
The ID of the role that is assigned.
organization_idstringrequired
The ID of the organization the role is scoped to.
application_rolesstring[]
If provided, the user assigned this role assignment will be granted this application role when signing in to a deployment or project
deploymentobject[]
Assignments for roles with deployment scope.
role_idstringrequired
The ID of the role that is assigned.
organization_idstringrequired
The ID of the organization the role is scoped to.
allboolean
When true, the role applies to all deployments in the organization, otherwise the role is scoped to the deployments specified in deployment_ids.
deployment_idsstring[]
The IDs of the deployments the role is scoped to. Must be absent if all is true, and present if all is false.
application_rolesstring[]
If provided, the user assigned this role assignment will be granted this application role when signing in to the deployment(s) specified in the role assignment.
projectobject
Assignments for roles with project scope.
elasticsearchobject[]
The Elasticsearch project-scoped role assignments to set
role_idstringrequired
The ID of the role that is assigned.
organization_idstringrequired
The ID of the organization the role is scoped to.
allboolean
When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in project_ids.
project_idsstring[]
The IDs of the projects the role is scoped to. Must be absent if all is true, and present if all is false.
application_rolesstring[]
If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
observabilityobject[]
The Observability project-scoped role assignments to set
role_idstringrequired
The ID of the role that is assigned.
organization_idstringrequired
The ID of the organization the role is scoped to.
allboolean
When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in project_ids.
project_idsstring[]
The IDs of the projects the role is scoped to. Must be absent if all is true, and present if all is false.
application_rolesstring[]
If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
securityobject[]
The Security project-scoped role assignments to set
role_idstringrequired
The ID of the role that is assigned.
organization_idstringrequired
The ID of the organization the role is scoped to.
allboolean
When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in project_ids.
project_idsstring[]
The IDs of the projects the role is scoped to. Must be absent if all is true, and present if all is false.
application_rolesstring[]
If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
workplaceaiobject[]
The WorkplaceAI project-scoped role assignments to set
role_idstringrequired
The ID of the role that is assigned.
organization_idstringrequired
The ID of the organization the role is scoped to.
allboolean
When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in project_ids.
project_idsstring[]
The IDs of the projects the role is scoped to. Must be absent if all is true, and present if all is false.
application_rolesstring[]
If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
vectordbobject[]
The VectorDB project-scoped role assignments to set
role_idstringrequired
The ID of the role that is assigned.
organization_idstringrequired
The ID of the organization the role is scoped to.
allboolean
When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in project_ids.
project_idsstring[]
The IDs of the projects the role is scoped to. Must be absent if all is true, and present if all is false.
application_rolesstring[]
If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.