How to register a permission — Versola Docs
/docs
Pre-1.00.7.5versola.ioGitHub
RUEN

How to register a permission

Create a permission in the Versola admin console and map it to the resource endpoints it covers

A permission is a named set of resource endpoints. This page creates one in the admin console and attaches endpoints to it. For the fields and rules, see Permission.

Prerequisites

  • A tenant, selected in the console.
  • A resource with the endpoints you want to cover. You can only pick endpoints that already exist on a resource.

1. Open Permissions

Open Permissions under the tenant. Each card shows the description and the permission ID. Expand a card to see the resource and the endpoints it covers. With many resources, use the Resource field to narrow the list: type part of a host and pick it.

Permissions of the selected tenant, with a search by ID
Permissions page listing two permissions.
An expanded permission: the resource and the endpoint it covers
Permission expanded to show the resource endpoint it grants.

2. Start a new permission

Press + Create Permission.

Create Permission: ID, description and the resource picker
Empty Create Permission form.

3. Fill in the permission

  1. Permission ID: lowercase letters, digits, underscores and hyphens in segments separated by :, each segment starting with a letter, for example payments:export or payments:export:own. Dots are not accepted. You cannot change the ID later.
  2. English description: a label for the console. If you leave it empty, the console uses the ID.
  3. Under Add resource, choose a resource and press Add resource. Its card opens below.
  4. In the card, choose an endpoint under Add endpoint and press Add endpoint. The endpoint appears in the list with its method and path. Repeat for every endpoint, and add further resources if the permission spans several.
payments:export with GET /payments of one resource attached
Create Permission form filled in with a resource endpoint.

4. Create the permission

Press Create Permission. The permission is ready to be added to a role. For a service app that calls your APIs with client_credentials, add it to the client’s Permissions section instead.

A permission only maps endpoints. edge still evaluates each endpoint’s Allow (CEL), step-up and max auth age on every call. See Endpoint policies.

Edit or delete a permission

Press the pencil on a card to add or remove resources and endpoints, or to change the description. The ID cannot change. If an endpoint was removed from its resource, the permission lists it under Detached endpoints. Remove it there. The cross deletes the permission after a confirmation. Roles and clients keep the ID in their lists, but it then covers no endpoint and grants nothing.

Next steps