Microsoft.Authorization (stable:7.5)

2025/01/15 • 8 updated methods

RoleAssignments_ListForScope (updated)
Description :  Gets role assignments for a scope.
Reference :  Link ¶

⚶ Changes

{
  "#id": "RoleAssignments_ListForScope",
  "$parameters": [
    {
      "#name": "api-version",
      "Description": {
        "new": "The API version to use for this operation.",
        "old": "Client API version."
      }
    }
  ],
  "$responses": {
    "default": {
      "$properties": {
        "error": [
          {
            "#name": "innererror",
            "Type": {
              "new": "string",
              "old": "object"
            }
          }
        ]
      }
    }
  }
}

⚼ Request

GET:  /{scope}/providers/Microsoft.Authorization/roleAssignments
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
scope:
{
Description: The scope of the role assignments. ,
Required: True ,
}
string ,
$filter:
{
Description: The filter to apply on the operation. Use $filter=atScope() to return all role assignments at or above the scope. Use $filter=principalId eq {id} to return all role assignments at, above or below the scope for the specified principal. ,
Required: False ,
}
string ,
}

⚐ Response (200)

{
value:
{
Description: Role assignment list. ,
Required: False ,
}
[
{
id:
{
Description: The role assignment ID. ,
Required: False ,
}
string ,
name:
{
Description: The role assignment name. ,
Required: False ,
}
string ,
type:
{
Description: The role assignment type. ,
Required: False ,
}
string ,
properties:
{
Description: Role assignment properties. ,
Required: False ,
}
{
scope:
{
Description: The role scope. ,
Enum:
{
/: Global scope ,
/keys: Keys scope ,
}
,
Required: False ,
}
enum ,
roleDefinitionId:
{
Description: The role definition ID. ,
Required: False ,
}
string ,
principalId:
{
Description: The principal ID. ,
Required: False ,
}
string ,
}
,
}
,
]
,
nextLink:
{
Description: The URL to use for getting the next set of results. ,
Required: False ,
}
string ,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
RoleAssignments_Get (updated)
Description :  Get the specified role assignment.
Reference :  Link ¶

⚶ Changes

{
  "#id": "RoleAssignments_Get",
  "$parameters": [
    {
      "#name": "api-version",
      "Description": {
        "new": "The API version to use for this operation.",
        "old": "Client API version."
      }
    }
  ],
  "$responses": {
    "default": {
      "$properties": {
        "error": [
          {
            "#name": "innererror",
            "Type": {
              "new": "string",
              "old": "object"
            }
          }
        ]
      }
    }
  }
}

⚼ Request

GET:  /{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentName}
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
scope:
{
Description: The scope of the role assignment. ,
Required: True ,
}
string ,
roleAssignmentName:
{
Description: The name of the role assignment to get. ,
Required: True ,
}
string ,
}

⚐ Response (200)

{
id:
{
Description: The role assignment ID. ,
Required: False ,
}
string ,
name:
{
Description: The role assignment name. ,
Required: False ,
}
string ,
type:
{
Description: The role assignment type. ,
Required: False ,
}
string ,
properties:
{
Description: Role assignment properties. ,
Required: False ,
}
{
scope:
{
Description: The role scope. ,
Enum:
{
/: Global scope ,
/keys: Keys scope ,
}
,
Required: False ,
}
enum ,
roleDefinitionId:
{
Description: The role definition ID. ,
Required: False ,
}
string ,
principalId:
{
Description: The principal ID. ,
Required: False ,
}
string ,
}
,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
RoleAssignments_Create (updated)
Description :  Creates a role assignment.
Reference :  Link ¶

⚶ Changes

{
  "#id": "RoleAssignments_Create",
  "$parameters": [
    {
      "#name": "api-version",
      "Description": {
        "new": "The API version to use for this operation.",
        "old": "Client API version."
      }
    }
  ],
  "$responses": {
    "default": {
      "$properties": {
        "error": [
          {
            "#name": "innererror",
            "Type": {
              "new": "string",
              "old": "object"
            }
          }
        ]
      }
    }
  }
}

⚼ Request

PUT:  /{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentName}
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
scope:
{
Description: The scope of the role assignment to create. ,
Required: True ,
}
string ,
roleAssignmentName:
{
Description: The name of the role assignment to create. It can be any valid GUID. ,
Required: True ,
}
string ,
parameters:
{
Description: Parameters for the role assignment. ,
Required: True ,
}
{
properties:
{
Description: Role assignment properties. ,
Required: True ,
}
{
roleDefinitionId:
{
Description: The role definition ID used in the role assignment. ,
Required: True ,
}
string ,
principalId:
{
Description: The principal ID assigned to the role. This maps to the ID inside the Active Directory. It can point to a user, service principal, or security group. ,
Required: True ,
}
string ,
}
,
}
,
}

⚐ Response (201)

{
id:
{
Description: The role assignment ID. ,
Required: False ,
}
string ,
name:
{
Description: The role assignment name. ,
Required: False ,
}
string ,
type:
{
Description: The role assignment type. ,
Required: False ,
}
string ,
properties:
{
Description: Role assignment properties. ,
Required: False ,
}
{
scope:
{
Description: The role scope. ,
Enum:
{
/: Global scope ,
/keys: Keys scope ,
}
,
Required: False ,
}
enum ,
roleDefinitionId:
{
Description: The role definition ID. ,
Required: False ,
}
string ,
principalId:
{
Description: The principal ID. ,
Required: False ,
}
string ,
}
,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
RoleAssignments_Delete (updated)
Description :  Deletes a role assignment.
Reference :  Link ¶

⚶ Changes

{
  "#id": "RoleAssignments_Delete",
  "$parameters": [
    {
      "#name": "api-version",
      "Description": {
        "new": "The API version to use for this operation.",
        "old": "Client API version."
      }
    }
  ],
  "$responses": {
    "default": {
      "$properties": {
        "error": [
          {
            "#name": "innererror",
            "Type": {
              "new": "string",
              "old": "object"
            }
          }
        ]
      }
    }
  }
}

⚼ Request

DELETE:  /{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentName}
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
scope:
{
Description: The scope of the role assignment to delete. ,
Required: True ,
}
string ,
roleAssignmentName:
{
Description: The name of the role assignment to delete. ,
Required: True ,
}
string ,
}

⚐ Response (200)

{
id:
{
Description: The role assignment ID. ,
Required: False ,
}
string ,
name:
{
Description: The role assignment name. ,
Required: False ,
}
string ,
type:
{
Description: The role assignment type. ,
Required: False ,
}
string ,
properties:
{
Description: Role assignment properties. ,
Required: False ,
}
{
scope:
{
Description: The role scope. ,
Enum:
{
/: Global scope ,
/keys: Keys scope ,
}
,
Required: False ,
}
enum ,
roleDefinitionId:
{
Description: The role definition ID. ,
Required: False ,
}
string ,
principalId:
{
Description: The principal ID. ,
Required: False ,
}
string ,
}
,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
RoleDefinitions_List (updated)
Description :  Get all role definitions that are applicable at scope and above.
Reference :  Link ¶

⚶ Changes

{
  "#id": "RoleDefinitions_List",
  "$parameters": [
    {
      "#name": "api-version",
      "Description": {
        "new": "The API version to use for this operation.",
        "old": "Client API version."
      }
    }
  ],
  "$responses": {
    "200": {
      "$properties": {
        "value": {
          "$properties": [
            {
              "#name": "type",
              "Enum": {
                "new": [
                  [
                    "Microsoft.Authorization/roleDefinitions",
                    "Microsoft-defined role definitions."
                  ]
                ],
                "old": [
                  [
                    "Microsoft.Authorization/roleDefinitions",
                    ""
                  ]
                ]
              }
            }
          ]
        }
      }
    },
    "default": {
      "$properties": {
        "error": [
          {
            "#name": "innererror",
            "Type": {
              "new": "string",
              "old": "object"
            }
          }
        ]
      }
    }
  }
}

⚼ Request

GET:  /{scope}/providers/Microsoft.Authorization/roleDefinitions
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
scope:
{
Description: The scope of the role definition. ,
Required: True ,
}
string ,
$filter:
{
Description: The filter to apply on the operation. Use atScopeAndBelow filter to search below the given scope as well. ,
Required: False ,
}
string ,
}

⚐ Response (200)

{
value:
{
Description: Role definition list. ,
Required: False ,
}
[
{
id:
{
Description: The role definition ID. ,
Required: False ,
}
string ,
name:
{
Description: The role definition name. ,
Required: False ,
}
string ,
type:
{
Description: The role definition type. ,
Enum:
{
Microsoft.Authorization/roleDefinitions: Microsoft-defined role definitions. ,
}
,
Required: False ,
}
enum ,
properties:
{
Description: Role definition properties. ,
Required: False ,
}
{
roleName:
{
Description: The role name. ,
Required: False ,
}
string ,
description:
{
Description: The role definition description. ,
Required: False ,
}
string ,
type:
{
Description: The role type. ,
Enum:
{
AKVBuiltInRole: Built in role. ,
CustomRole: Custom role. ,
}
,
Required: False ,
}
enum ,
permissions:
{
Description: Role definition permissions. ,
Required: False ,
}
[
{
actions:
{
Description: Action permissions that are granted. ,
Required: False ,
}
[
string ,
]
,
notActions:
{
Description: Action permissions that are excluded but not denied. They may be granted by other role definitions assigned to a principal. ,
Required: False ,
}
[
string ,
]
,
dataActions:
{
Description: Data action permissions that are granted. ,
Required: False ,
}
[
string ,
]
,
notDataActions:
{
Description: Data action permissions that are excluded but not denied. They may be granted by other role definitions assigned to a principal. ,
Required: False ,
}
[
string ,
]
,
}
,
]
,
assignableScopes:
{
Description: Role definition assignable scopes. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
]
,
nextLink:
{
Description: The URL to use for getting the next set of results. ,
Required: False ,
}
string ,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
RoleDefinitions_Get (updated)
Description :  Get the specified role definition.
Reference :  Link ¶

⚶ Changes

{
  "#id": "RoleDefinitions_Get",
  "$parameters": [
    {
      "#name": "api-version",
      "Description": {
        "new": "The API version to use for this operation.",
        "old": "Client API version."
      }
    }
  ],
  "$responses": {
    "200": {
      "$properties": [
        {
          "#name": "type",
          "Enum": {
            "new": [
              [
                "Microsoft.Authorization/roleDefinitions",
                "Microsoft-defined role definitions."
              ]
            ],
            "old": [
              [
                "Microsoft.Authorization/roleDefinitions",
                ""
              ]
            ]
          }
        }
      ]
    },
    "default": {
      "$properties": {
        "error": [
          {
            "#name": "innererror",
            "Type": {
              "new": "string",
              "old": "object"
            }
          }
        ]
      }
    }
  }
}

⚼ Request

GET:  /{scope}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionName}
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
scope:
{
Description: The scope of the role definition to get. Managed HSM only supports '/'. ,
Required: True ,
}
string ,
roleDefinitionName:
{
Description: The name of the role definition to get. ,
Required: True ,
}
string ,
}

⚐ Response (200)

{
id:
{
Description: The role definition ID. ,
Required: False ,
}
string ,
name:
{
Description: The role definition name. ,
Required: False ,
}
string ,
type:
{
Description: The role definition type. ,
Enum:
{
Microsoft.Authorization/roleDefinitions: Microsoft-defined role definitions. ,
}
,
Required: False ,
}
enum ,
properties:
{
Description: Role definition properties. ,
Required: False ,
}
{
roleName:
{
Description: The role name. ,
Required: False ,
}
string ,
description:
{
Description: The role definition description. ,
Required: False ,
}
string ,
type:
{
Description: The role type. ,
Enum:
{
AKVBuiltInRole: Built in role. ,
CustomRole: Custom role. ,
}
,
Required: False ,
}
enum ,
permissions:
{
Description: Role definition permissions. ,
Required: False ,
}
[
{
actions:
{
Description: Action permissions that are granted. ,
Required: False ,
}
[
string ,
]
,
notActions:
{
Description: Action permissions that are excluded but not denied. They may be granted by other role definitions assigned to a principal. ,
Required: False ,
}
[
string ,
]
,
dataActions:
{
Description: Data action permissions that are granted. ,
Required: False ,
}
[
string ,
]
,
notDataActions:
{
Description: Data action permissions that are excluded but not denied. They may be granted by other role definitions assigned to a principal. ,
Required: False ,
}
[
string ,
]
,
}
,
]
,
assignableScopes:
{
Description: Role definition assignable scopes. ,
Required: False ,
}
[
string ,
]
,
}
,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
RoleDefinitions_CreateOrUpdate (updated)
Description :  Creates or updates a custom role definition.
Reference :  Link ¶

⚶ Changes

{
  "#id": "RoleDefinitions_CreateOrUpdate",
  "$parameters": [
    {
      "#name": "api-version",
      "Description": {
        "new": "The API version to use for this operation.",
        "old": "Client API version."
      }
    }
  ],
  "$responses": {
    "201": {
      "$properties": [
        {
          "#name": "type",
          "Enum": {
            "new": [
              [
                "Microsoft.Authorization/roleDefinitions",
                "Microsoft-defined role definitions."
              ]
            ],
            "old": [
              [
                "Microsoft.Authorization/roleDefinitions",
                ""
              ]
            ]
          }
        }
      ]
    },
    "default": {
      "$properties": {
        "error": [
          {
            "#name": "innererror",
            "Type": {
              "new": "string",
              "old": "object"
            }
          }
        ]
      }
    }
  }
}

⚼ Request

PUT:  /{scope}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionName}
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
scope:
{
Description: The scope of the role definition to create or update. Managed HSM only supports '/'. ,
Required: True ,
}
string ,
roleDefinitionName:
{
Description: The name of the role definition to create or update. It can be any valid GUID. ,
Required: True ,
}
string ,
parameters:
{
Description: Parameters for the role definition. ,
Required: True ,
}
{
properties:
{
Description: Role definition properties. ,
Required: True ,
}
{
roleName:
{
Description: The role name. ,
Required: False ,
}
string ,
description:
{
Description: The role definition description. ,
Required: False ,
}
string ,
type:
{
Description: The role type. ,
Enum:
{
AKVBuiltInRole: Built in role. ,
CustomRole: Custom role. ,
}
,
Required: False ,
}
enum ,
permissions:
{
Description: Role definition permissions. ,
Required: False ,
}
[
{
actions:
{
Description: Action permissions that are granted. ,
Required: False ,
}
[
string ,
]
,
notActions:
{
Description: Action permissions that are excluded but not denied. They may be granted by other role definitions assigned to a principal. ,
Required: False ,
}
[
string ,
]
,
dataActions:
{
Description: Data action permissions that are granted. ,
Required: False ,
}
[
string ,
]
,
notDataActions:
{
Description: Data action permissions that are excluded but not denied. They may be granted by other role definitions assigned to a principal. ,
Required: False ,
}
[
string ,
]
,
}
,
]
,
assignableScopes:
{
Description: Role definition assignable scopes. ,
Required: False ,
}
[
string ,
]
,
}
,
}
,
}

⚐ Response (201)

{
id:
{
Description: The role definition ID. ,
Required: False ,
}
string ,
name:
{
Description: The role definition name. ,
Required: False ,
}
string ,
type:
{
Description: The role definition type. ,
Enum:
{
Microsoft.Authorization/roleDefinitions: Microsoft-defined role definitions. ,
}
,
Required: False ,
}
enum ,
properties:
{
Description: Role definition properties. ,
Required: False ,
}
{
roleName:
{
Description: The role name. ,
Required: False ,
}
string ,
description:
{
Description: The role definition description. ,
Required: False ,
}
string ,
type:
{
Description: The role type. ,
Enum:
{
AKVBuiltInRole: Built in role. ,
CustomRole: Custom role. ,
}
,
Required: False ,
}
enum ,
permissions:
{
Description: Role definition permissions. ,
Required: False ,
}
[
{
actions:
{
Description: Action permissions that are granted. ,
Required: False ,
}
[
string ,
]
,
notActions:
{
Description: Action permissions that are excluded but not denied. They may be granted by other role definitions assigned to a principal. ,
Required: False ,
}
[
string ,
]
,
dataActions:
{
Description: Data action permissions that are granted. ,
Required: False ,
}
[
string ,
]
,
notDataActions:
{
Description: Data action permissions that are excluded but not denied. They may be granted by other role definitions assigned to a principal. ,
Required: False ,
}
[
string ,
]
,
}
,
]
,
assignableScopes:
{
Description: Role definition assignable scopes. ,
Required: False ,
}
[
string ,
]
,
}
,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
RoleDefinitions_Delete (updated)
Description :  Deletes a custom role definition.
Reference :  Link ¶

⚶ Changes

{
  "#id": "RoleDefinitions_Delete",
  "$parameters": [
    {
      "#name": "api-version",
      "Description": {
        "new": "The API version to use for this operation.",
        "old": "Client API version."
      }
    }
  ],
  "$responses": {
    "200": {
      "$properties": [
        {
          "#name": "type",
          "Enum": {
            "new": [
              [
                "Microsoft.Authorization/roleDefinitions",
                "Microsoft-defined role definitions."
              ]
            ],
            "old": [
              [
                "Microsoft.Authorization/roleDefinitions",
                ""
              ]
            ]
          }
        }
      ]
    },
    "default": {
      "$properties": {
        "error": [
          {
            "#name": "innererror",
            "Type": {
              "new": "string",
              "old": "object"
            }
          }
        ]
      }
    }
  }
}

⚼ Request

DELETE:  /{scope}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionName}
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
scope:
{
Description: The scope of the role definition to delete. Managed HSM only supports '/'. ,
Required: True ,
}
string ,
roleDefinitionName:
{
Description: The name (GUID) of the role definition to delete. ,
Required: True ,
}
string ,
}

⚐ Response (200)

{
id:
{
Description: The role definition ID. ,
Required: False ,
}
string ,
name:
{
Description: The role definition name. ,
Required: False ,
}
string ,
type:
{
Description: The role definition type. ,
Enum:
{
Microsoft.Authorization/roleDefinitions: Microsoft-defined role definitions. ,
}
,
Required: False ,
}
enum ,
properties:
{
Description: Role definition properties. ,
Required: False ,
}
{
roleName:
{
Description: The role name. ,
Required: False ,
}
string ,
description:
{
Description: The role definition description. ,
Required: False ,
}
string ,
type:
{
Description: The role type. ,
Enum:
{
AKVBuiltInRole: Built in role. ,
CustomRole: Custom role. ,
}
,
Required: False ,
}
enum ,
permissions:
{
Description: Role definition permissions. ,
Required: False ,
}
[
{
actions:
{
Description: Action permissions that are granted. ,
Required: False ,
}
[
string ,
]
,
notActions:
{
Description: Action permissions that are excluded but not denied. They may be granted by other role definitions assigned to a principal. ,
Required: False ,
}
[
string ,
]
,
dataActions:
{
Description: Data action permissions that are granted. ,
Required: False ,
}
[
string ,
]
,
notDataActions:
{
Description: Data action permissions that are excluded but not denied. They may be granted by other role definitions assigned to a principal. ,
Required: False ,
}
[
string ,
]
,
}
,
]
,
assignableScopes:
{
Description: Role definition assignable scopes. ,
Required: False ,
}
[
string ,
]
,
}
,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}