Manage roles and inheritance¶
Query and maintain roles, role lifecycles, and inheritance relationships. Check permissions, ownership, and deletion impact before deleting or changing roles. This page does not bind roles to specific users.
Prerequisites¶
Prepare credentials that can access the target workspace and the target role ID. For service endpoints, authentication, and general request formats, see Prepare to call an API.
Before changing inheritance or deleting a role, query the role list, inheritance relationships, and related impact information.
Call sequence¶
First list roles to identify the target role.
To understand current relationships, query inheritance relationships, the inheritance graph, and the permission view.
After adding or removing inheritance, query inheritance relationships again. After updating a role or lifecycle, query the role list to confirm the result.
Before deletion, query deletion and ownership impact, then confirm conditions and results on the action page.
API operations¶
Query roles, relationships, and impact¶
What you need to do |
API operation |
Use it when |
|---|---|---|
Query roles |
Select a target role or confirm a change. |
|
Query role inheritance |
View inheritance relationships before or after changes. |
|
Query the role inheritance graph |
View the inheritance relationship graph. |
|
Query the role permission view |
Confirm role permissions before changes. |
|
Query role audit events |
View role audit events. |
|
Query role deletion impact |
Confirm deletion impact before deleting a role. |
|
Query role ownership impact |
Confirm ownership impact before deletion or changes. |
Update roles and inheritance¶
What you need to do |
API operation |
Use it when |
|---|---|---|
Update a role |
You have the role ID and need to modify it. |
|
Update a role lifecycle |
Adjust a target role’s lifecycle. |
|
Add role inheritance |
You identified two roles and need to create an inheritance relationship. |
|
Remove role inheritance |
Confirm the target inheritance relationship before removing it. |
Delete a role¶
What you need to do |
API operation |
Use it when |
|---|---|---|
Delete a role |
You confirmed deletion and ownership impact. |
Confirm the result¶
After updating a role or inheritance, use List roles and List role inheritance to confirm the current result. After deletion, use the list to confirm whether the role remains available.
Limitations and notes¶
Deleting roles or changing their lifecycle or inheritance affects related roles. Before proceeding, use the impact actions and confirm conditions and results on the relevant Reference page.