GET Security Roles ID

The GET /Security/Roles/{id} method is used to return a security role by ID. This method returns HTTP 200 OK on a success with details for the specified security roles.

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

/security/read/

This method has two available versions. Keyfactor strongly recommends using the newer method when possible; the v1 method has been deprecated since it supports Active Directory identities only. The v2 method has been redesigned to provide support for alternate identity providers and the newer claims-based authentication model that accompanies this. This version of the method supports both Active Directory and other identity providers. For more information about versioning, see Versioning.

Version 2 of the GET /Security/Roles/{id} method has been redesigned to provide support for alternate identity providers and the newer claims-based authentication model that accompanies this. All new development should use this version.

Table 665: GET Security Roles {id} v2 Input Parameters

Name In Description
id Path

Required. The Keyfactor Command reference ID of the security role to retrieve.

Use the GET /Security/Roles method (see GET Security Roles) to retrieve a list of all the security roles to determine the role's ID.

Table 666: GET Security Roles {id} v2 Response Data

Name Description
Id

An integer containing the Keyfactor Command identifier for the security role.
Name A string containing the short reference name for the security role.
Description A string containing the description for the security role.
EmailAddress A string containing an email address for the role. This address can be used from workflows to direct email messages to the owner of certificates for uses such as certificate expiration alerts (assuming the certificate owner for the certificates, a security role, has been populated)
Immutable A Boolean indicating if the role is immutable or not. Only the built-in Administrators role is considered immutable. The value of this parameter cannot be changed.
Permission SetId

A string containing the Keyfactor Command reference GUID of the permission set to which the role is assigned (see Permission Sets).

Tip:  For details of the permissions associated with the role, use the GET /SecurityRoles/{id} method (see GET Security Roles ID) for the desired role. For details of the permissions associated withe the permission set to which the role belongs, use GET /PermissionSets/{id} method (see GET Permission Sets ID) using this permission set GUID. A role may be only granted a subset of the permissions available in a permission set.
Permissions

An array of strings containing the permissions assigned to the role in a comma-separated list of Name:Value pairs. See Version Two Permission Model for an overview of the possible permissions.

For example:

Copy 
"Permissions": [  
   "/portal/read/",
   "/dashboard/read/",
   "/certificates/collections/metadata/modify/6/",
   "/certificates/collections/private_key/read/6/"
],
Claims

An array of objects containing the claims associated with the role. ClosedShow claim details.

Version 1 of the GET /Security/Roles/{id} method includes the same capabilities as version 2, but offers support for managing legacy formatted Active Directory identities.

Important:  This has been deprecated since it supports Active Directory identities only. It is retained for backwards compatibility, but all new development should use methods that provide support for alternate identity providers and the newer claims-based authentication model that accompanies this. These newer methods support both Active Directory and other identity providers. See version 2 of this method.

Table 667: GET Security Roles {id} v1 Input Parameters

Name In Description
id Path

Required. The Keyfactor Command reference ID of the security role to retrieve.

Use the GET /Security/Roles method (see GET Security Roles) to retrieve a list of all the security roles to determine the role's ID.

Table 668: GET Security Roles {id} v1 Response Data

Name Description
Id

An integer containing the Keyfactor Command identifier for the security role.
Name A string containing the short reference name for the security role.
Description A string containing the description for the security role.
EmailAddress A string containing an email address for the role. This address can be used from workflows to direct email messages to the owner of certificates for uses such as certificate expiration alerts (assuming the certificate owner for the certificates, a security role, has been populated).
Enabled

A Boolean that indicates whether the security role is enabled (true) or not (false). Security roles that have been disabled cannot be assigned to security identities. The default is true.

This is considered deprecated and may be removed in a future release.
Immutable A Boolean that indicates whether the security role has been marked as editable (false) or not (true). Internal Keyfactor Command roles are not editable. This setting is reserved for Keyfactor Command internal use.
Valid A Boolean that indicates whether the security role's audit XML is valid (true) or not (false). A security role may become invalid if Keyfactor Command determines that it appears to have been tampered with. This setting is not end-user configurable.
Private

A Boolean that indicates whether the security role has been marked private (true) or not (false). The default is false.

This is considered deprecated and may be removed in a future release.
Permission SetId A string indicating the Keyfactor Command reference GUID of the permission set associated with the role (see Permission Sets).
Identities

An array of objects containing information about the security identities assigned to the security role. ClosedShow identity details.
Permissions

An array of strings containing the permissions assigned to the role in a comma-separated list of Name:Value pairs. See Version One Permission Model for an overview of the possible permissions.

For example:

Copy 
"Permissions": [
   "AdminPortal:Read",
   "Dashboard:Read"
],
Tip:  See the Keyfactor API Reference and Utility which provides a utility through which the Keyfactor APIClosed An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. endpoints can be called and results returned. It is intended to be used primarily for validation, testing and workflowClosed A workflow is a series of steps necessary to complete a process. In Keyfactor Command, it refers to the workflow builder, which allows you to automate event-driven tasks such as when a certificate is requested, revoked or found in a certificate store. development. It also serves secondarily as documentation for the API. The link to the Keyfactor API Reference and Utility is in the dropdown from the help icon () at the top of the Management Portal page next to the Log Out button.