POST Security Roles

The POST /Security/Roles method is used to create a new security role in Keyfactor Command. This method returns HTTP 200 OK on a success with the details of the security role.

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

/security/modify/

The user must hold a role containing this permission in the Global Permission Set (see Permission Sets).

This endpointClosed An endpoint is a URL that enables the API to gain access to resources on a server. will be found by selecting V2 (Version 2) in the Keyfactor APIClosed A set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. Reference and Utility. See Versioning.

Version 2 of the POST /Security/Roles method has been redesigned to provide support for multiple identity providers and the newer claims-based authentication model that accompanies it. This version of the endpoint supports both Active Directory and other identity providers.

Table 605: POST Security Roles v2 Input Parameters

Name Description
Name Required. A string containing the short reference name for the security role.
Description Required. A string containing the description for the security role.
Permission Set Id

A string containing the Keyfactor Command reference GUID of the permission set to which the role is assigned (see Permission Sets).
Permissions

An array of strings containing the permissions assigned to the role in a comma-separated list of Name:Value pairs. See Version Two Permission Model for an overview of the possible permissions.

For example:

"Permissions": [  
   "/portal/read/",
   "/dashboard/read/",
   "/certificates/collections /metadata/modify/6/",
   "/certificates/collections /private_key/read/6/"
],
Claims

An array of objects containing the claims associated with the role.

Name In Description
Description Body A string indicating a description for the security claim.
Claim Type Body

A string indicating the type of claim. Supported values are:

Claim Type Integer Claim Type String Description
0 User Active Directory user account
1 Group

Active Directory group.
2 Computer

Active Directory machine account
3 OAuthOid

An open authorization claim of a type not covered by client, role or subject
4 OAuthRole

An open authorization group claim
5 OAuthSubject

An open authorization user claim
6 OAuthClientId

An open authorization client application claim
Claim Value Body A string containing the identifying information for the entity specified in the claim. For Active Directory users and groups, this will be in the form DOMAIN\user or group name (e.g. KEYEXAMPLE\PKI Administrators). For Active Directory computers, this will be in the form of a machine account (e.g. KEYEXAMPLE\MyServer$).
Provider Authentication Scheme Body A string indicating the provider authentication scheme (e.g. Active Directory, or Client Certificate Authentication CA, or unknown).

Table 606: POST Security Roles v2 Response Data

Name

In

 Description
Id Body

An integer containing the Keyfactor Command identifier for the security role.
Name Body A string containing the short reference name for the security role.
Description Body A string containing the description for the security role.
Immutable Body A Boolean indicating if the role is immutable (true) or not (false). Only the built-in Administrators role is considered immutable. The value of this parameter cannot be changed.
PermissionSetId Body

A string containing the Keyfactor Command reference GUID of the permission set to which the role is assigned (see Permission Sets).
Permissions Body

An array of strings containing the permissions assigned to the role in a comma-separated list of Name:Value pairs. See Version Two Permission Model for an overview of the possible permissions.

For example:

"Permissions": [  
   "/portal/read/",
   "/dashboard/read/",
   "/certificates/collections/metadata/modify/6/",
   "/certificates/collections/private_key/read/6/"
],
Claims Body

An array of objects containing the claims associated with the role.

Name In Description
Id   An integer containing the Keyfactor Command reference ID for the security claim.
Description Body A string indicating a description for the security claim.
Claim Type Body

A string indicating the type of claim. Supported values are:

Claim Type Integer Claim Type String Description
0 User Active Directory user account
1 Group

Active Directory group.
2 Computer

Active Directory machine account
3 OAuthOid

An open authorization claim of a type not covered by client, role or subject
4 OAuthRole

An open authorization group claim
5 OAuthSubject

An open authorization user claim
6 OAuthClientId

An open authorization client application claim
Claim Value Body A string containing the identifying information for the entity specified in the claim. For Active Directory users and groups, this will be in the form DOMAIN\user or group name (e.g. KEYEXAMPLE\PKI Administrators). For Active Directory computers, this will be in the form of a machine account (e.g. KEYEXAMPLE\MyServer$).
Provider Body

An object containing information about the provider assigned to the security claim.

Name Description
Id A string indicating the Keyfactor Command reference GUID for the provider.
Authentication Scheme A string indicating the provider authentication scheme (e.g. Active Directory, or Client Certificate Authentication CA, or unknown).
Display Name A string containing the short reference name for the provider (e.g. Active Directory).
Tip:  See the Keyfactor API Reference and Utility which provides a utility through which the Keyfactor API endpoints can be called and results returned. It is intended to be used primarily for validation, testing and workflowClosed A workflow is a series of steps necessary to complete a process. In the context of Keyfactor Command, it refers to the workflow builder, which allows you automate event-driven tasks when a certificate is requested or revoked. development. It also serves secondarily as documentation for the API. The link to the Keyfactor API Reference and Utility is in the dropdown from the help icon () at the top of the Management Portal page next to the Log Out button.