Repository navigation
docs(api): describe access rules for team filters, private resources and roles - #1071
Merged
Merged
Conversation
…and roles - is_my_team / channel filters: an empty intersection with the caller's teams or accessible channels returns an empty result (alert events, templates, insights, schedules, RUM applications) - mapping API headers are returned only to callers who can edit the API - has_next_page on alert and incident lists stays exact past 1,000 rows - schedule delete checks every schedule and fails on an incomplete reference check; drop rule writes require Channels Manage; the 5-calendar limit applies to every member - disabled roles grant no permissions; built-in roles are rejected by upsert/enable/disable/delete; upsert only updates roles of the account - RUM private applications are enforced on batch get, facet count, session replay and issue detail/update; webhook test requires Applications Manage; replay segment not-yet-indexed error - Monitors SLS metadata and Prometheus proxy require datasource query access; rule detail requires folder access
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents updated access rules in the On-call, Platform, RUM and Monitors API references (EN and ZH, per-module specs plus the consolidated copy), and the pagination convention page.
is_my_teamwithteam_idsthat share no team with the caller, or a caller in no team, returns an empty result (/template/list,/insight/*,/schedule/list,/rum/application/list)./alert-event/listreturns nothing when none of the sentchannel_idsis accessible./schedule/listwithis_my_manageignores team IDs outside the caller's teams.headersisnullin/enrichment/mapping/api/listand/infounless the caller can edit the API.has_next_pageon/alert/listand/incident/listis exact in page-number mode past 1,000 rows;totalstays capped./schedule/deleterequires edit access to every schedule and fails withInternalErrorwhen the reference check cannot complete; drop-rule writes require Channels Manage; the 5-calendar limit applies to every member./role/upsertwith an unknownrole_idreturnsno role found by idand keeps a disabled role disabled./rum/application/infos,/rum/facet/count, session replay and issue info/update;/rum/application/webhook/testrequires Applications Manage; replay segments not yet indexed returnResourceNotFound./monit/rule/v2/inforequires access to the rule's folder.Checks:
scripts/lint_openapi.py,scripts/api_path_redirects.py --check, EN/ZH parity and consolidated-equality checks pass.Merge after the corresponding backend release.