Add an administrator to a computer's inventory

POST 
/computers/:computerId/admins

Adds a directory user, group, or computer account to the inventory of accounts that may request administrator access to this computer.

The id is looked up as a user, then a group, then a computer, and the matched object must have a SID. persistent defaults to false; a value that is not a boolean or the strings true or false (for example "yes") is stored as false.

On Linux computers the matching sudoers entries are added too. sudo_permissions is the privilege part of a sudoers line, for example ALL=(root) /usr/bin/systemctl restart nginx: the sudoers service prefixes each line with the account (name for a user, %name for a group), so sending a full line duplicates the name. Without it the service writes <user> ALL=(ALL) NOPASSWD:ALL (a group gets %<group> ALL=(ALL) NOPASSWD:ALL). If the computer has no sudoers yet the inventory entry is still added and no sudoers line is written. sudo_permissions is rejected (409 Sudoers isn't supported for non-Linux systems.) on non-Linux computers, and that check runs before the id is validated. On Linux, the account name must be unique among current admins (409), and with Netwrix directory bridging a domain account cannot be persistent (422 with a message that a domain account on a Netwrix-bridged computer cannot be persistent).

Errors: a missing or blank id is 422 Missing required parameters; a malformed id is 422 Invalid User ID: "<value>"; a well-formed id that matches nothing is 422 Invalid Admin ID; an account already in the inventory is 409 Administrator already exists in inventory. 400 occurs only on Linux when the sudoers service rejects the update.

Required role: superadmin or admin.

Request

Responses

200

Administrator added.

400

Linux only: the sudoers service rejected the update (BadRequestError). Missing or malformed id is 422, not 400.

401

No token, or the token is invalid or expired. The body is {message}: No auth token provided when no token is sent, otherwise the token check's message (jwt expired, jwt malformed, invalid signature, invalid token, jwt signature is required). Send Authorization: Bearer <token> exactly: the server drops the first seven characters of the header and reads the rest as the token, so a different scheme or an extra space fails. If Authorization is absent, the server reads a token field in the body, then a token query parameter, then x-access-token. Routes that validate query fields reject ?token= with 400 InvalidQuery.

403

The token's role is not allowed for this operation, or the token's scopes exclude the route (Scope not allowed by token).

404

No record has the :id in the path (the id is malformed or unknown). The body is the bare text Invalid <Type> ID (for example Invalid Computer ID, Invalid User ID) with Content-Type text/html; charset=utf-8, not JSON. Some routes return an empty body.

409

The request conflicts with the current state of the resource.

422

The request could not be processed, for example an id that is not a valid object id.