Check whether a user is authorized on a system
GET/systems/authorized
Evaluates whether the named user has administrative access to the named system and returns a boolean.
Identify the user with user[...] parameters and the system with computer[...] parameters (nested query syntax). Both are required. Keys are case-insensitive.
User keys: id, sid, dn (aliases for _id, objectSid, distinguishedName),
domainAndName (DOMAIN\sAMAccountName).
Computer keys: the same four plus dNSHostName and cn.
Example: ?user[sid]=S-1-5-21-1111111111-2222222222-3333333333-1001&computer[dNSHostName]=host01.example.com
Required role: admin or superadmin.
Request
Responses
- 200
- 400
- 401
- 403
- 422
The authorization result.
A key that is not in the allowed list for user or computer ("bogus" is not allowed), a scalar user/computer value instead of a nested one ("0" is not allowed), or a $-prefixed key. Typed error body InvalidQuery.
No token, or the token is invalid or expired. The body is {message}: No auth token provided when no token is sent, otherwise the token check's message (jwt expired, jwt malformed, invalid signature, invalid token, jwt signature is required). Send Authorization: Bearer <token> exactly: the server drops the first seven characters of the header and reads the rest as the token, so a different scheme or an extra space fails. If Authorization is absent, the server reads a token field in the body, then a token query parameter, then x-access-token. Routes that validate query fields reject ?token= with 400 InvalidQuery.
The token's role is not allowed for this operation, or the token's scopes exclude the route
(Scope not allowed by token).
user or computer is missing or empty; domainAndName has no backslash; an id value is not a valid object id (Invalid User ID: "zzz"); or the user or system is not found (User not found, System not found). Typed error body UnprocessableEntityError. Unknown lookups return 422, not 404.