You are looking at the documentation of a prior release. To read the documentation of the latest release, please
visit here.
Authorization
The Authorization API exposes the KubeDB Platform’s custom role management and permission inspection, backed by the platform’s relationship-based authorization model (OpenFGA-style checks). It lets you list the permissions the caller holds on a given object, discover the permissions that can be assigned within an organization, and create/manage custom roles that bundle permissions and assign them to teams.
All endpoints live under the /api/v1/authz prefix and require organization
context. That context is not taken from the path — it is supplied as a
?org=<org-slug> query parameter (for example ?org=appscode). A valid token
and membership of that organization are required.
Custom role management backed by the relationship-based authorization model.
| Method | Path | Auth | Description |
|---|---|---|---|
| GET | /api/v1/authz/objects/:objectType/:objID/allowed-permissions | Token + org | Allowed permissions on an object |
| POST | /api/v1/authz/objects/allowed-permissions | Token + org | Batch allowed-permissions query |
| GET | /api/v1/authz/roles/available_permissions | Token + org | List available permissions |
| GET/POST | /api/v1/authz/roles | Token + org (+create_role:org) | List / create roles |
| GET/PUT/DELETE | /api/v1/authz/roles/:id | authzCheck(view/edit/delete:role) | Manage a role |
| GET | /api/v1/authz/roles/:id/principals | authzCheck(viewer:role) | List principals assigned to a role |
Pages
- Roles & Permissions — object allowed-permissions lookups (single and batch), the available-permissions catalog, role CRUD, and role principal listings.