Stage a desired-state sudoers file for a Linux computer
POST/computers/:computerId/sudoers
Stores the supplied full sudoers text as the staged (desired-state) sudoers.
It replaces any earlier staged document; individual lines cannot be patched. Nothing is written to the computer until Protect is enabled (or, if Protect is already on, until the next sync). Accounts named in the sudoers are reflected in the admin inventory, and inventory changes are reflected in the staged sudoers (inventory entries not named in the new text are dropped). The text is parsed with a trailing newline removed; the hash identifies the content.
Returns 400 if sudoers_blob is missing or empty, or the computer is not Linux. A non-string sudoers_blob (for example 123) is passed to the sudoers service and ends in 500. Errors from the sudoers service are passed through with that
service's status and a {message} body.
The server returns 500 when the request is made with the built-in secureone account: the staged document is created and then the call fails, and later GET and DELETE calls return 500 until a directory user stages a new sudoers; use a directory user's token to avoid it. Also, when
the service fails downstream (for example a missing service-account password), the staged document is still saved on the computer.
Accepts JSON and application/x-www-form-urlencoded.
Required role: superadmin or admin.
Request
Responses
- 200
- 400
- 401
- 403
- 404
- default
Staged sudoers stored.
Bad request. Access routes: InvalidQuery 'Invalid Access Duration Requested.' for a bad t. Any route: InvalidQuery 'illegal key "$ne" in query|body' when a query or body key starts with $. Malformed JSON gives an untyped {error} body. Sudoers routes: BadRequestError for a non-Linux computer, a missing or empty sudoers_blob, or a missing sudoersHash. Admin add/remove on Linux: BadRequestError carrying the sudoers service message. Missing or malformed ids on the admin routes are 422, not 400.
No token, or the token is invalid or expired. The body is {message}: No auth token provided when no token is sent, otherwise the token check's message (jwt expired, jwt malformed, invalid signature, invalid token, jwt signature is required). Send Authorization: Bearer <token> exactly: the server drops the first seven characters of the header and reads the rest as the token, so a different scheme or an extra space fails. If Authorization is absent, the server reads a token field in the body, then a token query parameter, then x-access-token. Routes that validate query fields reject ?token= with 400 InvalidQuery.
The token's role is not allowed for this operation, or the token's scopes exclude the route
(Scope not allowed by token).
No record has the :id in the path (the id is malformed or unknown). The body is the bare text Invalid <Type> ID (for example Invalid Computer ID, Invalid User ID) with Content-Type text/html; charset=utf-8, not JSON. Some routes return an empty body.
Failure reported by the sudoers service, passed through with that service's HTTP status and a {message} body. A 500 is returned when the service fails unexpectedly (a missing Linux service-account password, or a non-string sudoers_blob).