GET Security Roles ID

The GET /Security/Roles/{id} method is used to return a security role by ID. This method returns HTTP 200 OK on a success with details for the specified security roles.

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

/security/read/

This method has two available versions. Keyfactor strongly recommends using the newer method when possible; the v1 method has been deprecated since it supports Active Directory identities only. The v2 method has been redesigned to provide support for alternate identity providers and the newer claims-based authentication model that accompanies this. This version of the method supports both Active Directory and other identity providers. For more information about versioning, see Versioning.

Version 2 of the GET /Security/Roles/{id} method has been redesigned to provide support for alternate identity providers and the newer claims-based authentication model that accompanies this. All new development should use this version.

Table 640: GET Security Roles {id} v2 Input Parameters

Name In Description
id Path

Required. The Keyfactor Command reference ID of the security role to retrieve.

Use the GET /Security/Roles method (see GET Security Roles) to retrieve a list of all the security roles to determine the role's ID.

Table 641: GET Security Roles {id} v2 Response Data

Name Description
Id

An integer containing the Keyfactor Command identifier for the security role.
Name A string containing the short reference name for the security role.
Description A string containing the description for the security role.
Immutable A Boolean indicating if the role is immutable or not. Only the built-in Administrators role is considered immutable. The value of this parameter cannot be changed.
Permission SetId

A string containing the Keyfactor Command reference GUID of the permission set to which the role is assigned (see Permission Sets).
Permissions

An array of strings containing the permissions assigned to the role in a comma-separated list of Name:Value pairs. See Version Two Permission Model for an overview of the possible permissions.

For example:

Copy 
"Permissions": [  
   "/portal/read/",
   "/dashboard/read/",
   "/certificates/collections/metadata/modify/6/",
   "/certificates/collections/private_key/read/6/"
],
Claims

An array of objects containing the claims associated with the role.

Name In Description
Description Body A string indicating a description for the security claim.
Claim Type Body

A string indicating the type of claim. Supported values are:

Claim Type Integer Claim Type String Description
0 User Active Directory user account
1 Group

Active Directory group.
2 Computer

Active Directory machine account
3 OAuth Oid

An open authorization claim of a type not covered by client, role or subject
4 OAuth Role

An open authorization group claim
5 OAuth Subject

An open authorization user claim
6 OAuth ClientId

An open authorization client application claim
Claim Value Body A string containing the identifying information for the entity specified in the claim. For Active Directory users and groups, this will be in the form DOMAIN\user or group name (e.g. KEYEXAMPLE\PKI Administrators). For Active Directory computers, this will be in the form of a machine account (e.g. KEYEXAMPLE\MyServer$).
Provider Authentication Scheme Body A string indicating the provider authentication scheme (e.g. Active Directory, or Client Certificate Authentication CA, or unknown).
Tip:  See the Keyfactor API Reference and Utility which provides a utility through which the Keyfactor APIClosed endpoints can be called and results returned. It is intended to be used primarily for validation, testing and workflowClosed development. It also serves secondarily as documentation for the API. The link to the Keyfactor API Reference and Utility is in the dropdown from the help icon () at the top of the Management Portal page next to the Log Out button.