Permissions
An authenticated request goes through three checks, in this order. Any one
that denies ends the request with 403.
| # | Check | What it verifies | Rejection |
|---|---|---|---|
| 1 | Token scope | the resource and access level granted to the token | 403 INSUFFICIENT_SCOPE |
| 2 | Person's role | what the token's person can do in the organization | 403 USER_PERMISSION_DENIED or 403 NOT_A_MEMBER |
| 3 | Organization permission | whether Kobana enabled the equivalent console screen for the organization | 403 FEATURE_NOT_ENABLED |
1. Scopes​
The token needs the resource scope and the access level that the method requires. The grammar, the resource table and the examples are in Authentication → Scopes.
2. Person's role​
A token issued for a person (with the email claim) never reaches more than
the person can: besides the scopes, their role in the organization applies.
Each route requires an agent.<resource>.<action> permission:
| Action | When |
|---|---|
list, read | list and get details |
create, update, delete | create, update and remove |
executions.run | run a task |
webhook_deliveries.replay | resend a webhook delivery |
repository.sync | sync the Playbook |
Roles accept wildcards: *, agent.* and agent.<resource>.*.
| Response | When |
|---|---|
403 USER_PERMISSION_DENIED | the role does not grant the permission (details.required says which) |
403 NOT_A_MEMBER | the token's person has no membership in the organization |
An integration token, with no person, is governed by scopes only.
GET /v1/me does not check the role.
3. Organization permission​
The routes that mirror console screens (run, logs, webhooks, deliveries,
environments, secrets, schedules, task endpoint, repository and usage) also
respect the permissions Kobana grants the organization. An operation that is
not enabled responds 403 FEATURE_NOT_ENABLED, with details.permission.
Contracted plan​
Running a task requires Kadu to be in the organization's plan. Without a plan,
the run responds 403 ENTITLEMENT_REQUIRED, with details.reason and
details.required_product. Reading, registration and cancellation are never
blocked by the plan. See Plan and costs.