AXIAM PHP SDK

RolesApi extends ManagementSupport
in package

Application

FinalYes

Roles, their permission sets, and their assignment to users and groups.

The roles namespace handle (CONTRACT.md §27.2), reached as $client->management()->roles(). Every method here goes through the one shared ManagementTransport, so §3 CSRF, the §4 cookie jar, the §5 tenant header, §6 TLS, §16 retry and §19 telemetry apply without this class doing anything to opt in (§27.8).

Methods

__construct() : mixed
assignToGroup() : void: `POST /api/v1/roles/{role_id}/groups`
assignToServiceAccount() : void: `POST /api/v1/roles/{role_id}/service-accounts`
assignToUser() : void: `POST /api/v1/roles/{role_id}/users`
create() : Role: `POST /api/v1/roles`
delete() : void: `DELETE /api/v1/roles/{role_id}`
forTenant() : static: A COPY of this handle scoped to `$tenantId` (§27.4 rule 3). See {@see self::inOrg()} for why it copies.
get() : Role: `GET /api/v1/roles/{role_id}`
grantPermission() : void: `POST /api/v1/roles/{role_id}/permissions`
inOrg() : static: A COPY of this handle scoped to `$orgId` (§27.4 rule 3).
listGroups() : array<int, RoleGroupAssignment>: `GET /api/v1/roles/{role_id}/groups`
listItems() : Page<string|int, Role>: `GET /api/v1/roles`
listPermissions() : array<int, ResolvedPermissionGrant>: `GET /api/v1/roles/{role_id}/permissions`
listServiceAccounts() : array<int, RoleServiceAccountAssignment>: `GET /api/v1/roles/{role_id}/service-accounts`
listUsers() : array<int, RoleUserAssignment>: `GET /api/v1/roles/{role_id}/users`
revokePermission() : void: `DELETE /api/v1/roles/{role_id}/permissions/{permission_id}`
unassignFromGroup() : void: `DELETE /api/v1/roles/{role_id}/groups/{group_id}`
unassignFromServiceAccount() : void: `DELETE /api/v1/roles/{role_id}/service-accounts/{service_account_id}`
unassignFromUser() : void: `DELETE /api/v1/roles/{role_id}/users/{user_id}`
update() : Role: `PUT /api/v1/roles/{role_id}`

__construct()


    public
                    __construct(ManagementTransport $transport[, NamespaceScope $scope = new NamespaceScope() ][, string|null $clientOrgId = null ][, string|null $clientTenantId = null ]) : mixed

Parameters

$transport : ManagementTransport: The one wire path (§27.8).
$scope : NamespaceScope = new NamespaceScope(): Per-handle {org_id}/{tenant_id} overrides.
$clientOrgId : string|null = null: The client's own organization id, or null.
$clientTenantId : string|null = null: The client's own tenant id, or null.

assignToGroup()

`POST /api/v1/roles/{role_id}/groups`


    public
                    assignToGroup(string $roleId, AssignRoleToGroupRequest $body) : void

POST /api/v1/roles/{role_id}/groups.

Returns nothing; the server answers with an empty body.

Parameters

$roleId : string: the {role_id} path parameter
$body : AssignRoleToGroupRequest: the request body

assignToServiceAccount()

`POST /api/v1/roles/{role_id}/service-accounts`


    public
                    assignToServiceAccount(string $roleId, AssignRoleToServiceAccountRequest $body) : void

POST /api/v1/roles/{role_id}/service-accounts.

Returns nothing; the server answers with an empty body.

Parameters

$roleId : string: the {role_id} path parameter
$body : AssignRoleToServiceAccountRequest: the request body

assignToUser()

`POST /api/v1/roles/{role_id}/users`


    public
                    assignToUser(string $roleId, AssignRoleToUserRequest $body) : void

POST /api/v1/roles/{role_id}/users.

Returns nothing; the server answers with an empty body.

Parameters

$roleId : string: the {role_id} path parameter
$body : AssignRoleToUserRequest: the request body

create()

`POST /api/v1/roles`


    public
                    create(CreateRoleRequest $body) : Role

POST /api/v1/roles.

Parameters

$body : CreateRoleRequest: the request body

Return values

Role

delete()

`DELETE /api/v1/roles/{role_id}`


    public
                    delete(string $roleId) : void

DELETE /api/v1/roles/{role_id}.

Returns nothing; the server answers with an empty body.

NOT idempotent (§27.4 rule 6): deleting something already deleted raises NotFoundError rather than succeeding quietly.

Parameters

$roleId : string: the {role_id} path parameter

forTenant()

A COPY of this handle scoped to `$tenantId` (§27.4 rule 3). See {@see self::inOrg()} for why it copies.


    public
                    forTenant(string $tenantId) : static

Parameters

$tenantId : string

Return values

static

get()

`GET /api/v1/roles/{role_id}`


    public
                    get(string $roleId) : Role

GET /api/v1/roles/{role_id}.

Parameters

$roleId : string: the {role_id} path parameter

Return values

Role

grantPermission()

`POST /api/v1/roles/{role_id}/permissions`


    public
                    grantPermission(string $roleId, GrantPermissionRequest $body) : void

POST /api/v1/roles/{role_id}/permissions.

Returns nothing; the server answers with an empty body.

Parameters

$roleId : string: the {role_id} path parameter
$body : GrantPermissionRequest: the request body

inOrg()

A COPY of this handle scoped to `$orgId` (§27.4 rule 3).


    public
                    inOrg(string $orgId) : static

Returns a new handle rather than mutating this one. An administrator holding a handle to their own organization should not find it repointed at someone else's because an unrelated code path re-scoped a shared object — and on a management surface that failure mode writes to the wrong tenant rather than merely reading from it.

Parameters

$orgId : string

Return values

static

listGroups()

`GET /api/v1/roles/{role_id}/groups`


    public
                    listGroups(string $roleId) : array<int, RoleGroupAssignment>

GET /api/v1/roles/{role_id}/groups.

Returns the server's complete list. This endpoint is NOT paginated, so the result is a plain list and never a Page (§27.4 rule 4).

Parameters

$roleId : string: the {role_id} path parameter

Return values

array<int, RoleGroupAssignment>

listItems()

`GET /api/v1/roles`


    public
                    listItems([PageRequest|null $page = null ]) : Page<string|int, Role>

GET /api/v1/roles.

Returns ONE page. Page::$total is the server's count across all pages and is not count($page) — see §27.4 rule 4.

Parameters

$page : PageRequest|null = null: which page to fetch; defaults to the first

Return values

Page<string|int, Role>

listPermissions()

`GET /api/v1/roles/{role_id}/permissions`


    public
                    listPermissions(string $roleId) : array<int, ResolvedPermissionGrant>

GET /api/v1/roles/{role_id}/permissions.

Returns the server's complete list. This endpoint is NOT paginated, so the result is a plain list and never a Page (§27.4 rule 4).

Parameters

$roleId : string: the {role_id} path parameter

Return values

array<int, ResolvedPermissionGrant>

listServiceAccounts()

`GET /api/v1/roles/{role_id}/service-accounts`


    public
                    listServiceAccounts(string $roleId) : array<int, RoleServiceAccountAssignment>

GET /api/v1/roles/{role_id}/service-accounts.

Returns the server's complete list. This endpoint is NOT paginated, so the result is a plain list and never a Page (§27.4 rule 4).

Parameters

$roleId : string: the {role_id} path parameter

Return values

array<int, RoleServiceAccountAssignment>

listUsers()

`GET /api/v1/roles/{role_id}/users`


    public
                    listUsers(string $roleId) : array<int, RoleUserAssignment>

GET /api/v1/roles/{role_id}/users.

Returns the server's complete list. This endpoint is NOT paginated, so the result is a plain list and never a Page (§27.4 rule 4).

Parameters

$roleId : string: the {role_id} path parameter

Return values

array<int, RoleUserAssignment>

revokePermission()

`DELETE /api/v1/roles/{role_id}/permissions/{permission_id}`


    public
                    revokePermission(string $roleId, string $permissionId) : void

DELETE /api/v1/roles/{role_id}/permissions/{permission_id}.

Returns nothing; the server answers with an empty body.

NOT idempotent (§27.4 rule 6): deleting something already deleted raises NotFoundError rather than succeeding quietly.

Parameters

$roleId : string: the {role_id} path parameter
$permissionId : string: the {permission_id} path parameter

unassignFromGroup()

`DELETE /api/v1/roles/{role_id}/groups/{group_id}`


    public
                    unassignFromGroup(string $roleId, string $groupId[, string|null $resourceId = null ]) : void

DELETE /api/v1/roles/{role_id}/groups/{group_id}.

Returns nothing; the server answers with an empty body.

NOT idempotent (§27.4 rule 6): deleting something already deleted raises NotFoundError rather than succeeding quietly.

Parameters

$roleId : string: the {role_id} path parameter
$groupId : string: the {group_id} path parameter
$resourceId : string|null = null: the optional resource_id query parameter

unassignFromServiceAccount()

`DELETE /api/v1/roles/{role_id}/service-accounts/{service_account_id}`


    public
                    unassignFromServiceAccount(string $roleId, string $serviceAccountId[, string|null $resourceId = null ]) : void

DELETE /api/v1/roles/{role_id}/service-accounts/{service_account_id}.

Returns nothing; the server answers with an empty body.

NOT idempotent (§27.4 rule 6): deleting something already deleted raises NotFoundError rather than succeeding quietly.

Parameters

$roleId : string: the {role_id} path parameter
$serviceAccountId : string: the {service_account_id} path parameter
$resourceId : string|null = null: the optional resource_id query parameter

unassignFromUser()

`DELETE /api/v1/roles/{role_id}/users/{user_id}`


    public
                    unassignFromUser(string $roleId, string $userId[, string|null $resourceId = null ]) : void

DELETE /api/v1/roles/{role_id}/users/{user_id}.

Returns nothing; the server answers with an empty body.

NOT idempotent (§27.4 rule 6): deleting something already deleted raises NotFoundError rather than succeeding quietly.

Parameters

$roleId : string: the {role_id} path parameter
$userId : string: the {user_id} path parameter
$resourceId : string|null = null: the optional resource_id query parameter

update()

`PUT /api/v1/roles/{role_id}`


    public
                    update(string $roleId, UpdateRole $body) : Role

PUT /api/v1/roles/{role_id}.

Parameters

$roleId : string: the {role_id} path parameter
$body : UpdateRole: the request body

Return values

Role

RolesApi extends ManagementSupport in package Application

Table of Contents

Methods

Methods

__construct()

Parameters

assignToGroup()

Parameters

assignToServiceAccount()

Parameters

assignToUser()

Parameters

create()

Parameters

Return values

delete()

Parameters

forTenant()

Parameters

Return values

get()

Parameters

Return values

grantPermission()

Parameters

inOrg()

Parameters

Return values

listGroups()

Parameters

Return values

listItems()

Parameters

Return values

listPermissions()

Parameters

Return values

listServiceAccounts()

Parameters

Return values

listUsers()

Parameters

Return values

revokePermission()

Parameters

unassignFromGroup()

Parameters

unassignFromServiceAccount()

Parameters

unassignFromUser()

Parameters

update()

Parameters

Return values

RolesApi extends ManagementSupport
in package

Application