Skip to main content

RBAC API

Role-Based Access Control (RBAC) allows you to manage roles, permissions, and directory federation.

Roles & Permissions​

List Permissions​

GET /api/rbac/permissions Returns a catalog of all available permissions in the tenant.

Get RBAC Capabilities​

GET /api/rbac/capabilities Returns the capabilities of the RBAC system, such as whether Directory Management is enabled.

List Roles​

GET /api/rbac/roles Returns all roles available in the tenant.

List Members​

GET /api/rbac/members Returns members assigned directly through Lumetry role groups, deployment membership records, and users that have already signed in. This endpoint does not expand LDAP/AD directory group members; directory-derived access is evaluated by the identity service during sign-in/token issuance.

Add Member​

POST /api/rbac/members Creates or links a member in the deployment's identity provider and assigns the selected Lumetry roles. In an isolated deployment, membership is implicit for the installation; there is no separate workspace or tenant membership record to configure.

If identity-provider administration is unavailable or misconfigured, the endpoint returns 503 with problem code identity.provider_management_unavailable.

Set Role Permissions​

PUT /api/rbac/roles/{role}/permissions Updates the permissions assigned to a specific role.

Reset Role Permissions​

POST /api/rbac/roles/{role}/reset Resets a role's permissions to the default state.

Set Member Roles​

PUT /api/rbac/members/{subject}/roles Updates the roles assigned to a specific member.

Directory Federation (LDAP/AD)​

Note: Directory Federation endpoints are only available when Directory Management is enabled (e.g., in Managed/On-Prem deployments).

Get Directory Federation​

GET /api/rbac/directory Gets the current LDAP/AD directory federation configuration.

Configure Directory Federation​

PUT /api/rbac/directory Configures LDAP/AD directory federation. The payload includes connection and bind settings, the user search base, user schema fields, and the LDAP attribute containing the user's group distinguished names. The bind password is write-only; omit or leave it blank on update to preserve the stored value.

Remove Directory Federation​

DELETE /api/rbac/directory Removes the LDAP/AD directory federation.

Test Directory Connection​

POST /api/rbac/directory/test Tests the LDAP/AD connection using the provided configuration.

List Directory Groups​

GET /api/rbac/directory/groups Lists only directory groups currently mapped to Lumetry roles. It does not browse or scan the full directory group catalog.

Bind Directory Group​

POST /api/rbac/directory/group-bindings Binds a directory group to a Lumetry role. The request body is { groupDn, groupDisplay?, role }. Repeating the same group DN updates its binding.

Update Directory Group Binding​

PUT /api/rbac/directory/group-bindings/{id} Updates the distinguished name, optional display label, and role of an existing binding. The request body is { groupDn, groupDisplay?, role }.

Remove Group Binding​

DELETE /api/rbac/directory/group-bindings/{id} Removes a directory group binding.