AXIAM PHP SDK

ManifestBuilder
in package

FinalYes

Fluent construction of a {@see ManagementManifest} (CONTRACT.md §27.6).

One method per ManifestKind, each taking the manifest-local key first so a declaration reads as "this thing, called this, looks like this". Nothing here talks to the server: a builder produces a description, and describing a tenant is not the same act as changing one.

Table of Contents

Methods

build()  : ManagementManifest
Finishes the manifest.
group()  : self
Declares a group and the roles assigned to it.
networkPolicy()  : self
Declares the tenant's `Session-Timeout` cap (CONTRACT.md §27.6.2, contract 1.62): the `network` policy. A **singleton** — the tenant has exactly one, so it has no key, and a manifest that declares two is refused when it is built. The policy always exists on the server (the default, `version` 0, until the tenant first writes one), so it is never a `Create`: it is `NoChange` or an `Update`, sent as `replace_policy` with the version `plan` read. Planned and applied **before** the segments and profiles, because a profile's timeout is checked against the cap at the write.
networkProfile()  : self
Declares a segment's reply profile (CONTRACT.md §27.6.2, contract 1.62).
networkSegment()  : self
Declares a network segment (CONTRACT.md §27.6.2, contract 1.62).
permission()  : self
Declares a permission.
resource()  : self
Declares a resource.
role()  : self
Declares a role and the permissions granted to it.
serviceAccount()  : self
Declares a service account and the roles bound to it (CONTRACT.md §27.6.1 addition 3, contract 1.51).

Methods

group()

Declares a group and the roles assigned to it.

public group(string $key, string $name, string $description[, array<int, string|RoleBinding> $roleKeys = [] ][, array<string, mixed>|null $metadata = null ]) : self
Parameters
$key : string

Manifest-local identity.

$name : string

The group's name.

$description : string

Human-readable description.

$roleKeys : array<int, string|RoleBinding> = []

Roles this group carries — a bare role KEY (tenant-wide, exactly as before contract 1.51) or a RoleBinding scoped to a resource (RoleBinding::at()/::atOnly(), §27.6.1 addition 2).

$metadata : array<string, mixed>|null = null

Free-form metadata. null (the default) means UNSTATED; [] is a STATED empty object, distinct from null — see self::resource()'s identical $metadata doc (CONTRACT 1.52 N6.5, C-12).

Return values
self

networkPolicy()

Declares the tenant's `Session-Timeout` cap (CONTRACT.md §27.6.2, contract 1.62): the `network` policy. A **singleton** — the tenant has exactly one, so it has no key, and a manifest that declares two is refused when it is built. The policy always exists on the server (the default, `version` 0, until the tenant first writes one), so it is never a `Create`: it is `NoChange` or an `Update`, sent as `replace_policy` with the version `plan` read. Planned and applied **before** the segments and profiles, because a profile's timeout is checked against the cap at the write.

public networkPolicy(int $sessionTimeoutMaxSecs) : self
Parameters
$sessionTimeoutMaxSecs : int

The cap, in seconds. The server judges the range (300 to 86 400); the SDK does not.

Return values
self

networkProfile()

Declares a segment's reply profile (CONTRACT.md §27.6.2, contract 1.62).

public networkProfile(string $segmentKey, int $sessionTimeoutSecs[, RadiusTerminationAction|string|null $terminationAction = null ][, int|JsonNull|null $idleTimeoutSecs = null ][, string|JsonNull|null $filterId = null ][, RadiusServiceType|string|JsonNull|null $serviceType = null ]) : self

A profile has no name or id of its own: its natural key is its segment, named here by the manifest-local key of a self::networkSegment() of the same manifest — and a key the manifest does not declare is a dangling reference, refused when it is built. One profile per segment.

Every stated member is compared with the profile as the read returns it, the effective one: a stored session_timeout_secs above a lowered cap reads as the cap, so a manifest stating the cap is NoChange and one stating a value above it is an Update whose write the server refuses (403) — the action's failure; apply stops and nothing is lowered for you. An Update of a clamped profile that does not state its timeout carries the read's effective value, so it stores the clamped value from then on (§36.3 rule 6); raise the cap with self::networkPolicy() first to restore the stored one.

null is unstated: silent on a Create and carried from the read on an Update. JsonNull::Null is a member stated as none: left out of the body, which is how a replacement clears an optional member.

Parameters
$segmentKey : string

The segment's manifest-local key.

$sessionTimeoutSecs : int

Session-Timeout; the server judges the range.

$terminationAction : RadiusTerminationAction|string|null = null

default or radius_request.

$idleTimeoutSecs : int|JsonNull|null = null

Idle-Timeout.

$filterId : string|JsonNull|null = null

One of the segment's filter_ids.

$serviceType : RadiusServiceType|string|JsonNull|null = null

framed_user (the only value there is).

Return values
self

networkSegment()

Declares a network segment (CONTRACT.md §27.6.2, contract 1.62).

public networkSegment(string $key, string $site, NetworkSegmentKind|string $kind, string $name, int $vlanId[, int|null $rank = null ][, array<int, string>|null $filterIds = null ][, bool|null $enabled = null ]) : self

Reconciled by its natural key site + kind + name, where kind is the WIRE spelling, access or quarantine — the value create_segment writes and every read returns. The SDK keeps no other spelling and no mapping to the server's zones path segment. Those three never drift (a segment's kind, site and name do not change, §36.3 rule 4); every other stated member is compared with the value as the read returns it.

$filterIds is compared as a set: the same names in another order are NoChange, and when the SDK does write the segment it sends them in the order stated here. A list that repeats a name is refused when the manifest is built — it is a set, and a set has no repeated member. null for an optional member is unstated (silent, §27.6 rule 3); on an Update it is carried from the read.

Parameters
$key : string

Manifest-local identity, referred to by self::networkProfile().

$site : string

The wire site_key.

$kind : NetworkSegmentKind|string

access or quarantine; nothing else.

$name : string

The segment's name within its site.

$vlanId : int

The VLAN (the server checks 1 to 4094).

$rank : int|null = null

Placement rank, for an access segment.

$filterIds : array<int, string>|null = null

The segment's Filter-Id envelope.

$enabled : bool|null = null

Whether the segment is a placement candidate.

Tags
throws
ManifestException

when $kind is neither access nor quarantine.

Return values
self

permission()

Declares a permission.

public permission(string $key, string $action, string $description) : self
Parameters
$key : string

Manifest-local identity.

$action : string

The action this permission names (e.g. documents:read).

$description : string

Human-readable description.

Return values
self

resource()

Declares a resource.

public resource(string $key, string $name, string $type[, string|null $parentKey = null ][, array<string, mixed>|null $metadata = null ]) : self
Parameters
$key : string

Manifest-local identity.

$name : string

The resource's name.

$type : string

Its resource_type.

$parentKey : string|null = null

The KEY of the parent resource, not its UUID — a manifest cannot know a UUID that does not exist yet.

$metadata : array<string, mixed>|null = null

Free-form metadata. null (the default) means UNSTATED — this declaration says nothing about metadata, so it is never sent and never checked for drift. [] is a STATED empty object (CONTRACT 1.52 N6.5, C-12): sent on Create, and checked for drift on Update like any other stated value — distinct from null.

Return values
self

role()

Declares a role and the permissions granted to it.

public role(string $key, string $name, string $description[, bool $isGlobal = false ][, array<string, string> $grants = [] ]) : self

$grants maps a permission KEY to its effect — 'allow' or 'deny'. AXIAM's RBAC is DENY-OVERRIDE, not most-specific-wins: an explicit deny beats every allow, at any depth of the resource hierarchy and at equal specificity. A deny grant here is therefore a strong statement, not a default that a narrower allow can reverse.

Parameters
$key : string

Manifest-local identity.

$name : string

The role's name.

$description : string

Human-readable description.

$isGlobal : bool = false

Whether the role applies tenant-wide.

$grants : array<string, string> = []

Permission key => allow | deny.

Return values
self

serviceAccount()

Declares a service account and the roles bound to it (CONTRACT.md §27.6.1 addition 3, contract 1.51).

public serviceAccount(string $key, string $name[, string|null $description = null ][, array<int, string|RoleBinding> $roleKeys = [] ]) : self

Reconciled by NAME, which the server does not keep unique — ManifestApi refuses plan()/apply() before any write when more than one existing account matches. $description is the only field an Update reconciles; null is silent, exactly like an unstated resource metadata. apply() never rotates a secret: a Create's one-time client_secret is on ApplyReport::createdServiceAccounts().

Parameters
$key : string

Manifest-local identity, referred to by nothing else — a service account cannot itself hold another service account's role in contract 1.51.

$name : string

The account's name — its natural key, unenforced.

$description : string|null = null

Human-readable description. null is silent.

$roleKeys : array<int, string|RoleBinding> = []

Roles bound to this account — a bare role KEY or a resource-scoped RoleBinding.

Return values
self
On this page

Search results