Access Control Policy

Manage the policies that control who can access which resources.

📄️List access policies

Returns the access policies. With no options it returns every access policy, including deleted and disabled ones. Use isDeleted or isDisabled to return only those.

📄️Create an access policy

Creates an access policy and returns it with its new id. A policy is either Resource based, which lets users run the policy activities on its resources, or Credential based, which lets users release a credential during a session. A Credential based policy automatically gets the Credential Release and File Release activities. The name must be unique among all access policies. Add members afterwards with the add routes.

📄️List activity cards with their access policies

Returns the activities available to a managed account as cards, together with the access policy details for each. Administrators can request another account; other users always see their own.

📄️List resources a user can start an activity session on

Returns the resources that the signed-in user can use to start an activity session, optionally narrowed to one activity and one access policy. Administrators can pass a managed account to see the list for that account.

📄️Add managed account group to multiple access policies

Adds the managed account group to every access policy in the list that exists, in one call. Ids that match no policy are ignored. Use it to give the managed account group access through several policies at once.

📄️Add managed account to multiple access policies

Adds the managed account to every access policy in the list that exists, in one call. Ids that match no policy are ignored. Use it to give the managed account access through several policies at once.

📄️Copy an access policy

Creates a new access policy from an existing one and returns it. The new policy takes its settings from the body you send, and keeps the accounts, account groups, user and group collections and credentials of the source policy; a resource-based copy also keeps the resources, resource groups and activities.

📄️Look up the activities in an access policy

Returns a map of activity ID to activity name for the activities in the access policy, including activities that come from activity groups. A deleted activity appears with the name 'Deleted Activity'.

📄️Look up the credentials in an access policy

Returns a map of credential ID to credential name for a credential access policy, including credentials that come from credential groups. Calling it on a policy of another type returns an error.

📄️Look up the resources in an access policy

Returns a map of resource ID to resource name for a resource access policy, including resources that come from resource groups. Calling it on a policy of another type returns an error.

📄️Remove a managed account from all access policies

Removes the managed account's direct assignment from every enabled access policy that applies to it. Access the account gets through a managed account group or collection is not changed. The response lists the access policies that were found for the account.

📄️List activity cards for a managed account

Returns the activity cards and access policy details for a managed account. Administrators can view any account; other users can view only their own.

📄️Find access policies for an account and resource

Returns the access policies that give a managed account access to a resource. If the account ID matches no account, the result is based on the resource alone.

📄️List access policies for a managed account group

Returns the activity cards for the access policies that include a managed account group.

📄️Remove a managed account group from all access policies

Intended to remove a managed account group from the access policies that include it. The policies are looked up by treating the ID as a managed account ID, so for a group ID the lookup normally finds no policies; the call then returns 202 with an empty array and changes nothing. Use the other delete route for a managed account.

📄️List access policies for a resource

Returns the access policies that apply to a resource, whether assigned to the resource directly or through a resource group it belongs to. Deleted and disabled policies are left out.

📄️List access policy names and IDs

Returns the ID and name of each access policy, sorted by name. Deleted policies are left out; disabled ones are included. Users with a custom role see only the access policies the role covers.

📄️Find the access policy for an account, resource and activity

Returns the access policy that lets a managed account run an activity on a resource. The resource is matched by host name, name or IP address, and the activity by name. Use getAll to return every matching policy instead of the first.

📄️Remove managed account from multiple access policies

Removes the managed account from every access policy in the list that exists, in one call. Ids that match no policy are ignored. Use it to withdraw access that the managed account has through several policies at once.

📄️Remove managed account group from multiple access policies

Removes the managed account group from every access policy in the list that exists, in one call. Ids that match no policy are ignored. Use it to withdraw access that the managed account group has through several policies at once.

📄️List the roles for an access policy

Returns the ID and name of each role associated with the access policy.

📄️Search the activities in an access policy

Returns the activities and activity groups that belong to the access policy.

📄️Search activities that can be added to an access policy

Returns the activities and activity groups that are not yet in the access policy and could be added to it.

📄️Search credentials that can be added to an access policy

Returns the credentials, credential groups or host users that could be added to a credential access policy.

📄️Search the credentials in an access policy

Returns the credentials, credential groups or host users that belong to a credential access policy.

📄️Search accounts that can be added to an access policy

Returns the managed accounts, groups and other account types that could be added to the access policy.

📄️Search the accounts in an access policy

Returns the managed accounts, groups and other account types that belong to the access policy.

📄️Search resources that can be added to an access policy

Lists the resources and resource groups that are not yet part of an access policy and can be added to it. Secret vaults and entries on the Active Directory platform are not included. Use it to build a resource picker, with paging, sorting and text filtering. For a custom-role user, the results are limited to the resources their role allows.

📄️Search the resources in an access policy

Lists the resources, resource groups and secret vaults that are already part of an access policy, with paging, sorting and text filtering.

📄️Delete an access policy

Permanently deletes the access policy. The call returns 202 Accepted with no body once the deletion is complete. An ID that matches no access policy also returns 202.

📄️Get an access policy by id

Returns one access policy with its settings and the ids of the resources, resource groups, credentials and activities it contains. The managedAccountIds and managedAccountGroupIds lists in the response are always empty; list the policy's accounts and account groups with their own list routes. The policy is returned whether or not it is deleted or disabled.

📄️Update an access policy

Updates the settings of an access policy and returns the updated policy. The id in the body must match the id in the path, and the name must stay unique. The settings you send replace the stored values. The member lists in the body only add members; change membership with the add and remove routes.

📄️List accounts assigned directly to an access policy

Returns the managed accounts that are directly assigned to an access policy. Use it to see who the policy applies to.

📄️Add accounts or account groups to an access policy

Adds accounts, account groups or user and group collections to an access policy and returns how many items passed and how many failed. Items already in the policy count as passed. Items whose id is not found are counted as failed. For a custom-role user, items outside their role are skipped and counted as failed.

📄️Disable, enable, delete or restore an access policy

Sets the disabled flag, the deleted flag or both on an access policy and returns the updated policy. Only the flags you send are changed.

📄️Add activities to an access policy

Adds activities or activity groups to an access policy and returns how many items passed and how many failed. Items already in the policy count as passed. Items whose id is not found or whose type is not 0 or 1 are counted as failed. For a custom-role user, items outside their role are skipped and counted as failed.

📄️Remove activities from an access policy

Removes activities or activity groups from an access policy and returns how many items passed and how many failed. Items that exist but are not in the policy count as passed. Items whose id is not found are counted as failed. For a custom-role user, items outside their role are skipped and counted as failed.

📄️Add credentials to an access policy

Adds credentials or credential groups to a Credential based access policy and returns how many items passed and how many failed. Items already in the policy count as passed. Items whose id is not found, items sent as 2 (HostUser), and credentials of internal types such as configuration, activity token and application credentials are not added and are counted as failed.

📄️Remove credentials from an access policy

Removes credentials or credential groups from a Credential based access policy and returns how many items passed and how many failed. Items that exist but are not in the policy count as passed. Items sent as 2 (HostUser) are not removed and are counted as failed.

📄️Remove accounts or account groups from an access policy

Removes accounts, account groups or user and group collections from an access policy and returns how many items passed and how many failed. Items that exist but are not in the policy count as passed. Items whose id is not found are counted as failed. For a custom-role user, items outside their role are skipped and counted as failed.

📄️List account groups assigned to an access policy

Returns the managed account groups that are assigned to an access policy. Use it to see which groups the policy applies to.

📄️Add resources or resource groups to an access policy

Adds resources or resource groups to a Resource based access policy and returns how many items passed and how many failed. Items already in the policy count as passed. Items whose id is not found are counted as failed.

📄️Remove resources or resource groups from an access policy

Removes resources or resource groups from a Resource based access policy and returns how many items passed and how many failed. Items that exist but are not in the policy count as passed. Items whose id is not found are counted as failed.

📄️Remove secret vaults from an access policy

Removes the listed secret vaults from the access policy. The response is the number of listed secret vaults that exist and were processed. The access policy must be a credential access policy. The server reads the list from the request body of this DELETE request, so the body is required. Some HTTP clients and API tools drop the body of a DELETE request; check that yours sends it.

📄️Add secret vaults to an access policy

Adds secret vaults to a Credential based access policy and returns the number of vaults added. Vaults already in the policy are counted. Ids that are not secret vaults are skipped.