Please Note:

Granting Permissions to Users or Groups

Use the post /v1/cckm/sfdc/organizations/{id}/update-acls API to grant permissions to users or groups to perform specified operations on a Salesforce organization on the CipherTrust Manager.

User ID and group are mutually exclusive – specify either. For the first time users or groups, actions are permitted as configured by the CCKM administrator. However, if the permissions of a user or group need to be modified later, for example, a new action is to be permitted or an existing action is to be revoked, the CCKM administrator needs to set that particular action to true or false.

For example, a user or group is permitted actions, keycreate, keyupload, and keyimport. Now, to permit one more action keydestroy to the user or group, set "permit":true and "actions": "keydestroy" and run the API. Similarly, now to deny permission to the action keycreate, set "permit":false, "actions": "keycreate", and run the API.

Refer to Actions for actions supported by different APIs.

Syntax

curl -k '<IP>/api/v1/cckm/sfdc/organizations/{id}/update-acls' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n  "acls": [\n    {\n      "group": "<group>",\n      "actions": [\n        "<action-1>", "<action-2>"\n      ],\n      "permit": <true|false>\n    }\n  ]\n}' --compressed

Here, {id} represents the ID of the Salesforce organization resource on the CipherTrust Manager.

Request Parameters

Parameter	Type	Description
AUTHTOKEN	string	Authorization token.
acls	array of JSONs	Permissions to be granted to users and groups. Refer to ACLs for details.

ACLs

Parameter	Type	Description
actions	array of strings	List of actions. Refer to Actions for details.
group	string	Name of the user group to be granted permissions. User ID and group are mutually exclusive – specify either.
permit	boolean	Whether to permit users to perform specific operations. Set `true` to permit, `false` to deny.
user_id	string	ID of the user to be granted permissions. User ID and group are mutually exclusive – specify either.

Actions

The following table lists the accepted values:

APIs	Actions	Description
Create	keycreate	Permission to create SFDC keys.
Upload	keyrotatetobyok	Permission to upload keys to SFDC.
Destroy key	keydestroynative	Permission to destroy native SFDC keys.
Destroy key	keydestroybyok	Permission to destroy BYOK SFDC keys.
Import	keyimportnative	Permission to import a destroyed native SFDC keys.
Import	keyimportbyok	Permission to import a destroyed byok SFDC keys.
Synchronize	keysynchronize	Permission to synchronize SFDC keyss.
Cancel	keysynchronize	Permission to cancel a synchronization job.
Update	keyupdate	Permission to updates cache only key attributes (certificate and named credential).
List	view	Permission to view SFDC keys.
Get (SFDC Keys)	view	Permission to get the details of an SFDC key with the given id.
List SFDC Organization	view	Permission to view SFDC organizations.
Get (SFDC Organizations)	view	Permission to get the details of SFDC Organization with given id.
Create cache only key endpoint	endpointcreate	Permission to create cache only key endpoint.
Update cache only key endpoint	endpointupdate	Permission to update cache only key endpoint.
Delete cache only key endpoint	endpointdelete	Permission to delete cache only key endpoint.
Activate cache only key	cacheonlykeyactivate	Permission to activate cache only key.
Upload cache only key	cacheonlykeyupload	Permission to upload cache only key.
Update cache only key	cacheonlykeyupdate	Permission to update cache only key.
Destroy cache only key	cacheonlykeydestroy	Permission to destroy cache only key.
Create certificate	certificatecreate	Permission to create certificate to be used to encrypt tenant secret.
Delete certificate	certificatedelete	Permission to delete certificate.
Synchronize certificate	certificatesync	Permission to synchronize certificate from SFDC to CM.
Delete Backup	deletebackupnative	Permission to deletes a SFDC native key backup from CCKM.
Delete Backup	deletebackupbyok	Permission to deletes a SFDC byok key backup from CCKM.
Create Report	reportcreate	Permission to create a report.
Delete Report	reportdelete	Permission to delete a report.
Download Report	reportdownload	Permission to download a report.
View Report	reportview	Permission to view the content of a report.

Example Request

curl -k 'https://127.0.0.1/api/v1/cckm/sfdc/organizations/2473e846-31a8-4ee6-8299-17025548b4e2/update-acls' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJhOGY3N2IxZS1lOTY2LTQwMjEtODRjMC01YjZiNjAzMTBmOWEiLCJzdWIiOiJsb2NhbHwzM2Y5ZDFmNi04MjJiLTQ0NTItOGM4MC1mYzM0ZGYyZTI3OGQiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiNjcyMjMzMDAtYjU2ZC00ZmVmLTkwMDEtZGE1NGY2ZDdiMzY4Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6IjNkNWM4OWYzLTM1OWYtNGZmYS04ZTMyLWMxZjk0NTIyMWYzNiIsImlhdCI6MTYyMDE5NTY0NCwiZXhwIjoxNjIwMTk1OTQ0fQ.NAHcbm9TIB3YmVg-i_nfXf0-B0wMbAoXMSTaAJ-Ke-U' -H 'Content-Type: application/json' --data-binary $'{\n  "acls": [\n    {\n      "group": "CCKM Users",\n      "actions": [\n        "view", "keycreate"\n      ],\n      "permit": true\n    }\n  ]\n}' --compressed

Example Response

{
    "id": "2473e846-31a8-4ee6-8299-17025548b4e2",
    "uri": "kylo:kylo:cckm:sfdc-organization:2473e846-31a8-4ee6-8299-17025548b4e2",
    "account": "kylo:kylo:admin:accounts:kylo",
    "application": "ncryptify:gemalto:admin:apps:kylo",
    "devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
    "createdAt": "2021-07-22T09:21:07.019666Z",
    "updatedAt": "2021-07-22T09:29:20.198938053Z",
    "name": "Thales",
    "organization_id": "00DB000000040bIMAQ",
    "connection": "sfdc-connection",
    "cloud_name": "sfdc",
    "type": "Regular",
    "acls": [
        {
            "group": "CCKM Users",
            "actions": [
                "view",
                "keycreate"
            ]
        }
    ]
}

The output shows the updated permissions for the Salesforce organization with ID 2473e846-31a8-4ee6-8299-17025548b4e2.

Response Codes

Response Code	Description
2xx	Success
4xx	Client errors
5xx	Server errors

Refer to HTTP status codes for details.

Suggest A Change

Granting Permissions to Users or Groups

Syntax

Request Parameters

ACLs

Actions

Example Request

Example Response

Response Codes