Cloud Operations Center (COC)

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, Service Control Policies (SCPs) in Organizations can also use these actions to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the entity. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU. The granted IAM permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see What Are the Differences in Access Control Between IAM and Organizations?

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify a URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by COC, see Resource Types (Resource).
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by COC, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for COC.

**Table 1** Actions supported by COC
Action	Description	Access Level	Resource Type (*: Required)	Condition Key	Alias
coc:application:list	Grants permission to query the application list.	List	application *	-	-
coc:application:create	Grants permission to create an application.	Write	application *	-	-
coc:application:update	Grants permission to modify an application.	Write	application *	-	-
coc:application:delete	Grants permission to delete an application.	Write	application *	-	-
coc:application:createGroup	Grants permission to create an application group.	Write	application *	-	-
coc:application:listGroups	Grants permission to query a specified application group list.	List	application *	-	-
coc:application:updateGroup	Grants permission to modify an application group.	Write	application *	-	-
coc:application:deleteGroup	Grants permission to delete an application group.	Write	application *	-	-
coc:application:syncGroupResource	Grants permissions to synchronize application group resources.	Write	application *	-	-
coc:application:updateResources	Grants permission to modify application resources.	Write	application *	-	-
coc:application:addResources	Grants permission to add resources to an application.	Write	application *	-	-
coc:application:removeResources	Grants permission to remove application resources.	Write	application *	-	-
coc:application:listResources	Grants permission to query the application resource list.	List	application *	-	-
coc:application:listResources	Grants permission to query the application resource list.	List	-	coc:ApplicationGroupCode	-
coc:application:countResourceRelations	Grant permission to query the number of resource relationships.	List	application *	-	-
coc:application:getCapacity	Grants permission to query resource capacities in an application.	List	application *	-	-
coc:application:getSortedCapacity	Grants permission to query the capacities of ordered resources in an application.	List	application *	-	-
coc:application:listModel	Grants permission to query application models.	List	application *	-	-
coc:vendorAccount:create	Grants permission to add a cloud vendor account.	Write	-	-	-
coc:vendorAccount:list	Grants permission to query a cloud vendor account.	List	-	-	-
coc:vendorAccount:update	Grants permission to modify a cloud vendor account.	Write	-	-	-
coc:vendorAccount:delete	Grants permission to delete a cloud vendor account.	Write	-	-	-
coc:resourceView:list	Grants permission to query resource views.	List	-	-	-
coc:resourceView:create	Grants permission to create a resource view.	Write	resourceView *	-	-
coc:resourceView:update	Grants permission to update a resource view.	Write	resourceView *	-	-
coc:resourceView:delete	Grants permission to delete a resource view.	Write	resourceView *	-	-
coc:resourceView:syncResources	Grants permission to synchronize the resource list in a specific resource view.	Write	resourceView *	-	-
coc:resourceView:listResources	Grants permission to query the resource list in a specific resource view.	List	resourceView *	-	-
coc:resourceView:countResources	Grants permission to query the number of resources in a specific resource view.	List	-	-	-
coc:instance:listResources	Grants permission to query the resource list.	List	-	-	-
coc:instance:syncResources	Grants permission to synchronize the resource list.	Write	-	-	-
coc:instance:countOtherResources	Grants permission to query the total number of offline resources (such as physical machine and middleware).	List	-	-	-
coc:instance:listTagsForResource	Grants permission to query resource tags.	List	-	-	coc:instance:listResourceTags
coc:instance:addResourceToTags	Grants permission to add resource tags.	Write	-	-	coc:instance:createResourceTags
coc:instance:countResources	Grants permission to query the total number of resources.	List	-	-	-
coc::listEpsCollection	Grants permission to query the favorited enterprise projects.	List	-	-	coc:enterpriseProject:listCollect
coc::updateEpsCollection	Grants permission to modify the favorited enterprise projects.	Write	-	-	coc:enterpriseProject:updateCollect
coc::getLastSyncStatus	Grants permission to query the latest synchronization status of an instance.	Read	-	-	coc:system:getLastSyncStatus
coc::getResourceSyncJobDetail	Grants permission to query details about a resource synchronization task.	Read	-	-	coc:system:getResourceSyncJobDetail
coc:schedule:create	Grants permission to create a scheduled task.	Write	schedule	g:EnterpriseProjectId	-
			instance	coc:ApplicationCode coc:ApplicationGroupCode g:EnterpriseProjectId
			document	coc:DocumentRiskLevel g:EnterpriseProjectId
			-	coc:TicketLevel coc:TicketScope coc:RequestScope coc:TicketCurrentHandlers coc:TicketStatus coc:TicketType coc:TicketBeginTime coc:TicketEndTime coc:RequestTarget coc:TicketTarget coc:OperatorName coc:EscapeSwitchIsEnabled
coc:schedule:list	Grants permission to query scheduled tasks.	List	-	g:EnterpriseProjectId	-
coc:schedule:update	Grants permission to update scheduled tasks.	Write	schedule *	g:EnterpriseProjectId	-
			instance	coc:ApplicationCode coc:ApplicationGroupCode g:EnterpriseProjectId
			document	coc:DocumentRiskLevel g:EnterpriseProjectId
coc:schedule:get	Grants permission to query scheduled task details.	Read	schedule *	-	-
coc:schedule:get	Grants permission to query scheduled task details.	Read	-	g:EnterpriseProjectId	-
coc:schedule:delete	Grants permission to delete a scheduled task.	Write	schedule *	g:EnterpriseProjectId	-
coc:schedule:enable	Grants permission to enable a scheduled task.	Write	schedule *	g:EnterpriseProjectId	-
coc:schedule:enable	Grants permission to enable a scheduled task.	Write	-	coc:TicketLevel coc:TicketScope coc:RequestScope coc:TicketCurrentHandlers coc:TicketStatus coc:TicketType coc:TicketBeginTime coc:TicketEndTime coc:RequestTarget coc:TicketTarget coc:OperatorName coc:EscapeSwitchIsEnabled	-
coc:schedule:disable	Grants permission to disable a scheduled task.	Write	schedule*	g:EnterpriseProjectId	-
coc:schedule:getHistories	Grants permission to query the execution history of a scheduled task.	Read	schedule*	g:EnterpriseProjectId	-
coc:instance:executeDocument	Grants permission to execute documents on an ECS.	Write	instance *	-	-
			document *	-
			-	coc:ApplicationId coc:ApplicationGroupId g:EnterpriseProjectId coc:DocumentRiskLevel
coc:alarm:clear	Grants permission to clear alarms.	Write	-	-	-
coc:alarm:createAlarmLinkedIncident	Grants permission to create incidents that are associated with alarms.	Write	-	-	-
coc:alarm:listHandleHistories	Grants permission to query the alarm handling history.	List	-	-	-
coc:alarm:get	Grants permission to query alarm information.	Read	-	-	-
coc:ticket:list	Grants permission to query incident tickets.	List	-	-	-
coc:ticket:create	Grants permission to create incident tickets.	Write	-	-	-
coc:ticket:get	Grants permission to query incident ticket details.	Read	-	-	-
coc:ticket:action	Grants permission to process incident tickets.	Write	-	-	-
coc:ticket:delete	Grants permission to delete incident tickets.	Write	-	-	-
coc:ticket:uploadFile	Grants permission to upload attachments for incident tickets.	Write	-	-	-
coc:ticket:downloadFile	Grants permission to download attachments for incident tickets.	Read
coc:ticket:listAuthorizable	Grants permission to query authorized tickets.	List
coc:warroom:create	Grants permission to create a war room.	Write	-	-	-
coc:ticket:update	Grants permission to modify incident tickets.	Write	-	-	-
coc:ticket:getOperationHistories	Grants permission to query the operation history of incident tickets.	List	-	-	-
coc:ticket:listActions	Grants permission to query the list of operations that can be performed.	List	-	-	-
coc:warroom:list	Grants permission to query the war room list.	List	-	-	-
coc:document:analyzeRisk	Grants permission to analyze document risks.	Read	-	-	-
coc:document:get	Grants permission to view document content.	Read	-	-	-
coc:document:getDocument	Grants permission to query document details.	Read	document *	-	-
coc:document:create	Grants permission to create a document.	Write	document *	-	-
coc:document:createDocument	Grants permission to create a document.	Write	document *	-	-
coc:document:delete	Grants permission to delete a document.	Write	document *	-	-
coc:document:deleteDocument	Grants permission to delete a document.	Write	document *	-	-
coc:document:execute	Grants permission to execute a document.	Write	document *	-	-
coc:document:update	Grants permission to modify a document.	Write	document *	-	-
coc:document:updateDocument	Grants permission to update a document.	Write	document *	-	-
coc:document:list	Grants permission to query the document list.	List	document *	-	-
coc:document:listDocument	Grants permission to query the document list.	List	-	-	-
coc:quota:get	Grants permission to query quotas.	Read	-	-	-
coc:instance:executeDocument	Grants permission to execute documents on an ECS.	Write	instance *	-	-
coc:instance:executeDocument	Grants permission to execute documents on an ECS.	Write	document *	-	-
coc:job:get	Grants permission to query service ticket details.	Read	job *	-	-
coc:job:get	Grants permission to query service ticket details.	Read	-	coc:JobType	-
coc:job:action	Grants permission to perform operations on service tickets.	Write	job *	-	-
coc:job:action	Grants permission to perform operations on service tickets.	Write	-	coc:JobType	-
coc:job:list	Grants permission to query the service ticket list.	List -	job *	-	-
coc:job:list	Grants permission to query the service ticket list.	List -	-	coc:JobType	-
coc:instance:autoBatchInstances	Grants the permission to automatically perform batch operations on instances.	Write	-	-	-
coc:documentAtomic:list	Grants permission to query the atomic capability list of a document.	List	-	-	-
coc:documentAtomic:get	Grants permission to query details about a document atomic capability.	Read	-	-	-
coc:execution:get	Grants permission to query service ticket details.	Read	-	-	-
coc:execution:listExecutionStep	Grants permission to query the list of service ticket execution steps.	Read	-	-	-
coc:execution:list	Grants permission to query the service ticket list.	List	-	-	-
coc:execution:listExecutionStepInstance	Grants permission to query the list of service ticket execution steps.	Read	-	-	-
coc:execution:operate	Grants permission to perform operations on a service ticket.	Write	-	-	-
coc:complianceReport:list	Grant permission to query the compliance report list.	List	-	-	-
coc:complianceReport:get	Grants permission to query compliance report details.	Read	-	-	-

Each API of COC usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by APIs
API	Action	Related Action
GET /v1/resources/count	coc:instance:countResources	-
GET /v1/applications	coc:application:list	-
POST /v1/applications	coc:application:create	-
PUT /v1/applications/{id}	coc:application:update	-
DELETE /v1/applications/{id}	coc:application:delete	-
POST /v1/groups	coc:application:createGroup	-
GET /v1/groups	coc:application:listGroups	-
PUT /v1/groups/{id}	coc:application:updateGroup	-
DELETE /v1/groups/{id}	coc:application:deleteGroup	-
POST /v1/groups/{id}/sync	coc:application:syncGroup	-
PUT /v1/group-resource-relations	coc:application:updateResources	-
POST /v1/group-resource-relations	coc:application:addResources	-
DELETE /v1/group-resource-relations	coc:application:removeResources	-
GET /v1/group-resource-relations	coc:application:listResources	-
GET /v1/group-resource-relations/count	coc:application:countResourceRelations	-
POST /v1/other-resources/import	coc:instance:syncResources	-
POST /v1/components	coc:application:create	-
GET /v1/components	coc:application:list	-
PUT /v1/components/{id}	coc:application:update	-
DELETE /v1/components/{id}	coc:application:delete	-
GET /v1/application-view/search	coc:application:list	-
POST /v1/capacity	coc:application:getCapacity	-
GET /v1/capacity/order	coc:application:getSortedCapacity	-
POST /v1/vendor-account	coc:vendorAccount:create	-
GET /v1/vendor-account	coc:vendorAccount:list	-
PUT /v1/vendor-account	coc:vendorAccount:update	-
DELETE /v1/vendor-account	coc:vendorAccount:delete	-
GET /v1/multicloud-resources/count	coc:instance:countResources	-
POST /v1/multicloud-resources/sync	coc:instance:syncResources	-
GET /v1/resource/views	coc:resourceView:list	-
POST /v1/resource/views	coc:resourceView:create	-
PUT /v1/resource/views/{id}	coc:resourceView:update	-
DELETE /v1/resource/views/{id}	coc:resourceView:delete	-
POST /v1/resource/views/{id}/sync	coc:resourceView:syncResources	-
GET /v1/resource/views/resources	coc:resourceView:listResources	-
GET /v1/resource/views/resources/count	coc:resourceView:countResources	-
GET /v1/other-resources	coc:instance:listResources	-
DELETE /v1/other-resources	coc:instance:syncResources	-
PUT /v1/other-resources/{id}	coc:instance:syncResources	-
GET /v1/other-resources/count	coc:instance:countOtherResources	-
GET /v1/resources/{resource_id}/tags	coc:instance:listResourceTags	-
POST /v1/resources/{resource_id}/tags	coc:instance:addResourceToTags	-
POST /v1/resources/uniagent/sync	coc:instance:syncResources	-
POST /v1/other-resources/uniagent/sync	coc:instance:syncResources	-
GET /v1/enterprise-project-collect	coc:enterpriseProject:listCollect	-
PUT /v1/enterprise-project-collect	coc:enterpriseProject:updateCollect	-
GET /v1/multicloud-resources/last-sync-status	coc:system:getLastSyncStatus	-
GET /v1/jobs/{job_id}	coc:system:getResourceSyncJobDetail	-
GET /v1/multicloud-resources	coc:instance:listResources	-
GET /v1/application-model/next	coc:application:listModel	-
POST /v1/application-view/batch-create	coc:application:create	-
GET /v1/resources	coc:instance:listResources	-
GET /v1/resources/multi-count	coc:instance:countResources	-
POST /v1/schedule/task	coc:schedule:create	iam:agencies:pass (Grants permission to pass an agency to a cloud service.)
GET /v1/schedule/task	coc:schedule:list	-
PUT /v1/schedule/task/{task_id}	coc:schedule:update	iam:agencies:pass (Grants permission to pass an agency to a cloud service.)
GET /v1/schedule/task/{task_id}	coc:schedule:get	-
DELETE /v1/schedule/task/{task_id}	coc:schedule:delete	-
POST /v1/schedule/task/{task_id}/enable	coc:schedule:enable	-
POST /v1/schedule/task/{task_id}/disable	coc:schedule:disable	-
GET /v1/schedule/task/history	coc:schedule:getHistories	-
POST /v1/alarm-mgmt/alarm/{alarm_id}/auto-process	coc:instance:executeDocument	-
POST /v1/alarm-mgmt/alarms/cancel	coc:alarm:clear	-
POST /v1/alarm-mgmt/alarms-linked-incident	coc:alarm:createAlarmLinkedIncident	-
GET /v1/alarm-mgmt/alarm/{alarm_id}/handle-histories	coc:alarm:listHandleHistories	-
GET /v1/alarm-mgmt/alarm/{alarm_id}	coc:alarm:get	-
POST /v2/incidents/{incident_id}/actions	coc:ticket:action	-
POST /v2/incidents/list	coc:ticket:list	-
POST /v2/incidents/{incident_id}/histories	coc:ticket:getOperationHistories	-
GET /v2/incidents/{incident_id}/tasks	coc:ticket:listActions	-
POST /v1/external/incident/create	coc:ticket:create	-
POST /v1/external/incident/attachments	coc:ticket:uploadFile	-
POST /v1/external/incident/handle	coc:ticket:action	-
POST /v1/external/{ticket_type}/list-histories	coc:ticket:getOperationHistories	-
POST /v1/external/list/authorizable-tickets	coc:ticket:listAuthorizable
GET /v1/incident-tickets	coc:ticket:list	-
GET /v1/external/incident/{incident_num}	coc:ticket:get	-
POST /v1/external/issues/create	coc:ticket:create	-
GET /v1/external/issues/{ticket_id}	coc:ticket:get	-
POST /v1/external/warrooms	coc:warroom:create	-
POST /v1/external/warrooms/list	coc:warroom:list	-
POST /v1/instances/batches	coc:instance:autoBatchInstances	-
POST /v1/job/analyze-job	coc:document:analyzeRisk	-
POST /v1/job/scripts/{script_uuid}	coc:instance:executeDocument	-
POST /v1/job/public-scripts/{script_uuid}	coc:instance:executeDocument	-
GET /v1/job/scripts	coc:document:list	-
GET /v1/job/scripts/{script_uuid}	coc:document:get	-
POST /v1/job/scripts	coc:document:create	-
PUT /v1/job/scripts/{script_uuid}	coc:document:update	-
DELETE /v1/job/scripts/{script_uuid}	coc:document:delete	-
POST /v1/job/scripts/{script_uuid}/action	coc:document:update	-
GET /v1/job/public-scripts	coc:document:list	-
GET /v1/job/public-scripts/{script_uuid}	coc:document:get	-
GET /v1/job/script/orders	coc:job:list	-
GET /v1/job/script/orders/{execute_uuid}	coc:job:get	-
GET /v1/job/script/orders/{execute_uuid}/batches/{batch_index}	coc:job:get	-
GET /v1/job/script/orders/{execute_uuid}/batches	coc:job:get	-
GET /v1/job/script/orders/{execute_uuid}/statistics	coc:job:get	-
PUT /v1/job/script/orders/{execute_uuid}/operation	coc:job:action	-
GET /v1/documents	coc:document:createDocument	-
POST /v1/documents	coc:document:listDocument	-
GET /v1/atomics	coc:documentAtomic:list	-
GET /v1/atomics/{atomic_unique_key}	coc:documentAtomic:get	-
PUT /v1/documents/{document_id}	coc:document:updateDocument	-
POST /v1/documents/{document_id}	coc:document:execute	-
GET /v1/documents/{document_id}	coc:document:getDocument	-
DELETE /v1/documents/{document_id}	coc:document:deleteDocument	-
GET /v1/executions/{execution_id}	coc:execution:get	-
GET /v1/executions/{execution_id}/steps	coc:execution:listExecutionStep	-
GET /v1/executions	coc:execution:list	-
GET /v1/executions/instances	coc:execution:listExecutionStepInstance	-
POST /v1/executions	coc:execution:operate	-
GET /v1/patch/instance/compliant	coc:complianceReport:list	-
GET /v1/patch/instance/compliant/{instance_compliant_id}	coc:complianceReport:get	-

Resource Types (Resource)

A resource type indicates the resource to which a policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in a policy to define resource types.

The following table lists the resource types that you can define in policy statements for COC.

**Table 3** Resource types supported by COC
Resource Type	URN
instance	ecs:<region>:<account-id>:instance:<server-id>
document	coc::<account-id>:document:<document-name>
application	coc::<account-id>:application:<application-code>
resourceView	coc::<account-id>:resourceView:<resourceViewId>
schedule	coc::<account-id>:schedule:<schedule-id>
job	coc::<account-id>:job:<job-id>
faultMode	coc::<account-id>:faultMode:<fault-mode-id>
contingencyPlan	coc::<account-id>:contingencyPlan:<contingency-plan-id>
attackTask	coc::<account-id>:attackTask:<attack-task-name>
attackRecord	coc::<account-id>:attackRecord:<attack-record-id>
drillTask	coc::<account-id>:drillTask:<drill-task-id>
attackTargetRecord	coc::<account-id>:attackTargetRecord:<attack-target-record-id>
drillRecord	coc::<account-id>:drillRecord:<drill-record-id>
drillPlan	coc::<account-id>:drillPlan:<drill-plan-id>
slaTemplate	coc::<account-id>:slaTemplate:<sla_template-id>
parameter	coc:<region>:<account-id>:parameter:<parameter-name>
accountBaseline	coc::<account-id>:accountBaseline:<account_baseline_id>
provisionedProduct	coc::<account-id>:provisionedProduct:<provisioned-product-id>
product	coc::<account-id>:product:<product-id>
portfolio	coc::<account-id>:portfolio:<portfolio-id>
sloDiagram	coc::<account-id>:sloDiagram:<diagram-id>
template	coc::<account-id>:template:<template-id>
templateInstance	coc::<account-id>:templateInstance:<template-instance-id>

Conditions

A condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, bms:) only apply to operations of the COC service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For details about supported operators, see Condition operators.

The following table lists the condition keys that you can define in identity policies for COC. You can include these condition keys to specify conditions for when your identity policy is in effect.

**Table 4** Service-specific condition keys supported by COC
Service-specific condition key	Type	Single-valued/Multivalued	Description
coc:TicketLevel	String	Single-valued	Filters access based on the ticket level in the request parameter.
coc:TicketCurrentHandlers	String	Multivalued	Filters access based on the ticket operator in the request parameter.
coc:TicketStatus	String	Single-valued	Filters access based on the ticket status in the request parameter.
coc:TicketType	String	Single-valued	Filters access based on the ticket type in the request parameter.
coc:TicketBeginTime	date	Single-valued	Filters access based on the ticket start time in the request parameter.
coc:TicketEndTime	date	Single-valued	Filters access based on the ticket end time in the request parameter.
coc:OperatorName	String	Single-valued	Filters access based on the operator in the request parameter.
coc:RequestTarget	String	Single-valued	Filters access based on the privilege escalation application in the request parameter.
coc:TicketTarget	String	Multivalued	Filters access based on the ticket application in the request parameter.
coc:TicketScope	String	Multivalued	Filters access based on the ticket scope in the request parameter.
coc:RequestScope	String	Single-valued	Filters access based on the privilege escalation scope in the request.
coc:EscapeSwitchIsEnabled	boolean	Single valued	Filters access based on the escape feature in the request parameter.
coc:Creator	String	Single-valued	Filters access based on the creator of resource in COC.
coc:Executor	String	Single-valued	Filters access based on the executor specified by the service ticket in COC.
coc:DocumentRiskLevel	String	Single-valued	Filters access based on the document risk level specified in the request parameter.
coc:JobType	String	Single-valued	Filters access based on the service ticket type specified in the request parameter.
coc:ApplicationCode	String	Multivalued	Filters access based on the application code specified in the request parameter.
coc:ApplicationGroupCode	String	Single-valued	Filters access based on the application group code specified in the request parameter.
coc:AttackTargetType	String	Single-valued	Filters access based on the attack target type specified in the request parameter.
coc:QuickSetupType	String	Single-valued	Filters access based on the request configuration type specified in the request parameter.