Help Center> Identity and Access Management> API Reference> API> Enterprise Project Management> Querying Permissions of a User Directly Associated with an Enterprise Project
View PDF

Querying Permissions of a User Directly Associated with an Enterprise Project

Function

This API is used to query the permissions of a user directly associated with a specified enterprise project.

The API can be called using both the global endpoint and region-specific endpoints. For IAM endpoints, see Regions and Endpoints.

URI

GET /v3.0/OS-PERMISSION/enterprise-projects/{enterprise_project_id}/users/{user_id}/roles

Table 1 URI parameters

Parameter

Mandatory

Type

Description

enterprise_project_id

Yes

String

Enterprise project ID.

user_id

Yes

String

User ID.

Request Parameters

Table 2 Parameters in the request header

Parameter

Mandatory

Type

Description

X-Auth-Token

Yes

String

Authenticated token with iam:permissions:listRolesForUserOnEnterpriseProject or Security Administrator permission.

Response Parameters

Status code: 200

Table 3 Parameters in the response body

Parameter

Type

Description

roles

Array of RolesItem objects

Role list.
Table 4 RolesItem

Parameter

Type

Description

catalog

String

Service catalog of the permission.

display_name

String

Display name of the permission.

description

String

Description of the permission in English.

description_cn

String

Description of the permission in Chinese.

domain_id

String

ID of the account to which the permission belongs.

flag

String

If this parameter is set to fine_grained, the permission is a system-defined policy.

id

String

Permission ID.

name

String

Permission name.

Policy

object

Content of the permission.

type

String

Display mode of the permission.

NOTE:
  • AX: Account level.
  • XA: Project level.
  • AA: Both the account level and project level.
  • XX: Neither the account level nor project level.
  • The display mode of a custom policy can only be AX or XA. A custom policy must be displayed at either of the two levels.
Table 5 RolePolicy

Parameter

Type

Description

Depends

Array of PolicyDepends objects

Dependency permissions.

Statement

Array of PolicyStatement objects

Statement of the permission.

Version

String

Policy version.

NOTE:
  • 1.0: System-defined role. Only a limited number of service-level roles are provided for authorization.
  • 1.1: Policy. A policy defines the permissions required to perform operations on a specific cloud resource under certain conditions.
Table 6 PolicyDepends

Parameter

Type

Description

catalog

String

Service catalog of the permission.

display_name

String

Display name of the permission.
Table 7 PolicyStatement

Parameter

Type

Description

Action

Array of strings

Specific operation permission on a resource. A maximum of 100 actions are allowed.

NOTE:
  • The value format is Service name:Resource type:Operation, for example, vpc:ports:create.
  • Service name: indicates the product name, such as ecs, evs, or vpc. Only lowercase letters are allowed. Resource types and operations are not case-sensitive. You can use an asterisk (*) to represent all operations.
  • In the case of a custom policy for agencies, this parameter should be set to "Action": ["iam:agencies:assume"].

Effect

String

Effect of the permission. The value can be Allow or Deny. If both Allow and Deny statements are found in a policy, the authentication starts from the Deny statements.

Condition

Object

Conditions for the permission to take effect. A maximum of 10 conditions are allowed.

Resource

Array of strings

Cloud resource. The array can contain a maximum of 10 resource strings, and each string cannot exceed 128 characters.

NOTE:
  • Format: ::::. For example, obs:::bucket:*. Asterisks are allowed.
  • The region segment can be * or a region accessible to the user. The specified resource must belong to the corresponding service that actually exists.
  • In the case of a custom policy for agencies, the type of this parameter is Object, and the value should be set to "Resource": {"uri": ["/iam/agencies/07805acaba800fdd4fbdc00b8f888c7c"]}.

Example Request

GET https://iam.myhuaweicloud.com/v3.0/OS-PERMISSION/enterprise-projects/{enterprise_project_id}/users/{user_id}/roles

Example Response

Status code: 200

The request is successful.

{
  "roles" : [ {
    "display_name" : "Customed ECS Viewer",
    "description" : "The read-only permissions to all ECS resources, which can be used for statistics and survey.",
    "domain_id" : "9698542758bc422088c0c3eabfc30d12",
    "catalog" : "CUSTOMED",
    "policy" : {
      "Version" : "1.1",
      "Statement" : [ {
        "Action" : [ "ecs:*:get*", "ecs:*:list*", "ecs:blockDevice:use", "ecs:serverGroups:manage", "ecs:serverVolumes:use", "evs:*:get*", "evs:*:list*", "vpc:*:get*", "vpc:*:list*", "ims:*:get*", "ims:*:list*" ],
        "Effect" : "Allow"
      } ]
    },
    "id" : "24e7a89bffe443979760c4e9715c13a5",
    "type" : "XA",
    "name" : "custom_9698542758bc422088c0c3eabfc30d12_0"
  } ]
}

Status Codes

Status Code

Description

200

The request is successful.

400

Parameter error.

401

Authentication failed.

403

Access denied.

404

The requested resource cannot be found.

500

The system is abnormal.