Update iModel User Permissions - iModels

REST API Overview

Reference

Changelog

iModels

Download API definition:

Update iModel User Permissions

This operation is a Technical Preview and is available for testing purposes only. Do not use in production.

PATCH https://qa-api.bentley.com/imodels/{id}/userpermissions

Configures RBAC user permissions for the individual iModel. Specified permissions are assigned to the provided user.

Individual iModel permissions allow to have more granular permissions than assigned at iTwin level. This either broadens or shrinks the set of permission the user has at iTwin level. That is, once at least one user permission is configured on the given iModel, then this configuration takes precedence over permissions configured at iTwin level.

Role and User permissions are mutually exclusive and cannot be configured for an iModel at the same time.

Please refer to Access Control API to learn more about Role Based Access Control principles in general.

iModel permissions that could be assigned to the provided user:

imodels_webview - allows to view iModel in web browser, but does not allow to get its local copy and view in desktop app.

imodels_read - allows to open and view an iModel only in read-only state.

imodels_write - allows to make changes to an iModel. Allows to create and modify named versions. Allows to create mapping between PW connection and iModel to facilitate bridges.

imodels_manage - allows to manage locks, codes or local copies for the entire iModel.

Authentication

Requires Authorization header with valid Bearer token for scope itwin-platform.

For more documentation on authorization and how to get access token visit OAUTH2 Authorization page.

Authorization

User must have imodels_manage permission assigned at the iModel level. If iModel Role permissions at the iModel level are configured, then user must additionally have at least imodels_webview permission assigned at the iTwin level. If permissions at the iModel level are not configured, then user must have imodels_manage permission assigned at the iTwin level.

Alternatively the user should be an Organization Administrator for the Organization that owns a given iTwin the iModel belongs to.

For more information please refer to Account Administrator documentation section on Access Control API documentation page.

Rate limits

All iTwin Platform API operations have a rate limit. For more documentation on that visit Rate limits and quotas page.

Request

Request parameters

Yes

iModel id

Request headers

Content-Type

Authorization

Yes

OAuth access token with itwin-platform scope

Yes

Setting to application/vnd.bentley.itwin-platform.v2+json is recommended.

Request body

User permissions (update)

userPermissions

UserPermissions[]

An array of user permissions.

Example

json

{
    "userPermissions": [{
            "userId": "7890d54a-802b-4853-ba3b-1b8449a691e6",
            "permissions": ["imodels_webview"]
        },
        {
            "userId": "b091baae-77fd-4816-97aa-0108c0f6e099",
            "permissions": ["imodels_webview", "imodels_read", "imodels_write", "imodels_manage"]
        }
    ]
}

Response

Response 200 OK

json

{
    "userPermissions": [{
            "userId": "7890d54a-802b-4853-ba3b-1b8449a691e6",
            "permissions": ["imodels_webview"]
        },
        {
            "userId": "b091baae-77fd-4816-97aa-0108c0f6e099",
            "permissions": ["imodels_webview", "imodels_read", "imodels_write", "imodels_manage"]
        }
    ]
}

Response 401 Unauthorized

This response indicates that request lacks valid authentication credentials. Access token might not been provided, issued by the wrong issuer, does not have required scopes or request headers were malformed.

json

{
    "error": {
        "code": "HeaderNotFound",
        "message": "Header Authorization was not found in the request. Access denied."
    }
}

Response 403 Forbidden

User is not authorized to update a User permissions.

json

{
    "error": {
        "code": "InsufficientPermissions",
        "message": "The user has insufficient permissions for the requested operation."
    }
}

Response 404 Not Found

Requested iModel is not available.

json

{
    "error": {
        "code": "iModelNotFound",
        "message": "Requested iModel is not available."
    }
}

Response 409 Conflict

Role permissions are already configured or iModel is not initialized and modify operations are not allowed.

json

{
    "error": {
        "code": "PermissionsConflict",
        "message": "Role permissions are already configured."
    }
}

Response 415 Unsupported Media Type

This response indicates that the user has specified not supported media type in the request.

json

{
    "error": {
        "code": "UnsupportedMediaType",
        "message": "Media Type is not supported."
    }
}

Response 422 Unprocessable Entity

The 422 (Unprocessable Entity) status code indicates that the request cannot be processed by the server due to a client error (e.g. malformed request syntax)

json

{
    "error": {
        "code": "InvalidiModelsRequest",
        "message": "Cannot update User permissions.",
        "details": [{
                "code": "MissingRequiredProperty",
                "message": "Required property is missing.",
                "target": "userPermissions"
            },
            {
                "code": "InvalidRequestBody",
                "message": "Failed to parse request body. Make sure it is a valid JSON."
            }
        ]
    }
}

Response 429 Too many requests

This response indicates that the user has sent too many requests in a given amount of time.

json

{
    "error": {
        "code": "TooManyRequests",
        "message": "More requests were received than the subscription rate-limit allows."
    }
}

Response headers

retry-after

The number of requests exceeds the rate-limit for the client subscription.

Definitions

User permissions (update)

Properties of user permissions to be updated.

userPermissions

UserPermissions[]

An array of user permissions.

User permissions

Contains a list of user ids and their individual iModels permissions.

userId

String

Id of the User.

permissions

String[]

Array of permissions user has on an iModel.

User Permissions Response

List of User permissions.

userPermissions

UserPermissions[]

List of User permissions.

Error

Contains error information.

code

String

One of a server-defined set of error codes.

message

String

A human-readable representation of the error.

target

String, null

The target of the error.

Error Response

Gives details for an error that occurred while handling the request. Note that clients MUST NOT assume that every failed request will produce an object of this schema, or that all of the properties in the response will be non-null, as the error may have prevented this response from being constructed.

error

Error

Error information.