You can assign permissions to a role or user in the API (RaaS) using save_role(...) or save_user(...) in the API AUTH interface.

Permission value syntax

Permission values in the API (RaaS) include a resource type and an action, based on the following syntax:

resource-action

Some permission values include a qualifier as follows:

resource-qualifier-action

For example, if you want to assign permission to run commands, you would use cmd-run. Whereas, to assign permission to run wheel commands, you would use cmd-wheel-run.

Note: The previous syntax does not apply to the Super User permission, whose API value is superuser.

API Permission values by resource

The following list includes all resource types and permitted actions:

Commands

  • cmd-delete
  • cmd-read
  • cmd-run
  • cmd-write

Runner commands

  • cmd-runner-run

SSH commands

  • cmd-ssh-delete
  • cmd-ssh-read
  • cmd-ssh-run
  • cmd-ssh-write

Wheel commands

  • cmd-wheel-run

Formulas

  • formula-delete
  • formula-read
  • formula-write

Filesystem

  • fs-delete
  • fs-read
  • fs-write

Groups

  • group-delete
  • group-read
  • group-write

Jobs

  • job-delete
  • job-read
  • job-run
  • job-write

License

  • license-read

Salt master

  • master-delete
  • master-read
  • master-write

Salt master configuration

  • master-config-delete
  • master-config-read
  • master-config-write

Salt master filesystem

  • master-fs-delete
  • master-fs-read
  • master-fs-write

Minion

  • minion-delete
  • minion-read
  • minion-write

Pillar

  • pillar-delete
  • pillar-read
  • pillar-write

Returners

  • returner-delete
  • returner-read
  • returner-write

Roles

  • role-delete
  • role-read
  • role-write

Schedules

  • schedule-delete
  • schedule-read
  • schedule-write

Super user

  • superuser

Target

  • target-delete
  • target-read
  • target-write
  • target-allminions-run

Users

  • user-delete
  • user-read
  • user-write