plta-permissions-api-cbz

SourcedAdminRight

object

An admin right, tagged with where it comes from - held directly by the user, or inherited through membership of a role.

actionRestrictionstring

Name of the action that restricts the action usable in this operation to a specific hierarchy. Absent if the operation is not restricted to a specific action.

Example:write_narrative, read_compound

adminRightIdstring(uuid)read-only

The unique identifier of the underlying admin right, for use with DELETE /adminRights/{adminRightId}. Only present when source is “DIRECT” - a role-derived grant is deleted through DELETE /roles/{roleName}/adminGrants/{adminGrantId} instead, which is a different id.

operationNamestringrequired

Name of the operation.

Example:manageActions, manageResources, manageAccessRights, manageRoles

resourceRestrictionstring

Name of the resource that restricts the resource usable in this operation to a specific hierarchy. Absent if the operation is not restricted to a specific resource.

Example:compound_1245, study_1245

sourcestringrequiredread-only

Where this admin right comes from. “DIRECT” if held directly by the user, or “ROLE#” if inherited through membership of that role.

Example:DIRECT, ROLE#clintrials:study-reader

userIdstringrequiredread-only

The id of the user, as stored in IDP. For Sanofi internal user, it would be the oid (Unique identifier of the user in Azure AD). Always equal to the userId path parameter.

Example