How do I assign policies, roles and users to each other using the API?

Related resources:

Explanation

Tutorials

Reference

IAM > How-to guides

Note: If you are the LUSID domain owner, you are automatically assigned the built-in lusid-administrator role, which has all the permissions necessary to perform the operations in this article. 

We have separate Identity and Access APIs because identity management and access control are two different systems, working closely together. Note you can also assign policies to roles and roles to users seamlessly using the LUSID web app.

Assigning a policy to a role

Use the Access API:

1. Obtain an API access token.
2. Obtain the code of the role you want to assign the policy to, for example using the Access GET /api/roles API endpoint.
3. Call the Access PUT /api/roles/<role-code> API endpoint for your LUSID domain, passing in your API access token. Because this is a PUT operation, make sure the request body includes any existing policies assigned to the role in addition to the new policy. For example, to add a new-policy to a test-role that already has an existing-policy, construct a JSON payload like this:

   {
     "description": "This is an example role",
     "resource": {
       "policyIdRoleResource": {
         "policies": [
           {
             "scope": "default",
             "code": "existing-policy"
           },
           {
             "scope": "default",
             "code": "new-policy"
           }
         ],
         "policyCollections": []
       }
     },
     "when": {
       "activate": "2021-08-31T18:00:00.0000000+00:00",
       "deactivate": "9999-12-31T18:00:00.0000000+00:00"
     }
   }
   

   An example PUT using Curl might look like this (note the JSON payload above has been obfuscated for clarity):

   curl -X PUT "https://<your-domain>.lusid.com/access/api/roles/<your-role-code>"
     -H "Authorization: Bearer <your-api-access-token>"
     -H "Content-Type: application/json"
     -d "<json-payload>"