Skip to main content

Update Cloud Role (V2)

Partially updates a custom Cloud ACL role. Provided policies replace the complete policy set.

PUT/v2/roles/{roleId}
Connection Endpoint

The base URL for this API is in the following format:

https://api.cloud.zilliz.com

📘Notes

The endpoints on the control plane currently supports up to 20 requests per second per user per endpoint.

shell
export BASE_URL="https://api.cloud.zilliz.com"
Parameters
Authorizationstringheaderrequired

The authentication token should be an API key with appropriate privileges.

Example Value: Bearer {{TOKEN}}
roleIdstringpathrequired

The role ID.

Example Value: r-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Request Bodyapplication/json
projectIdstring

The project boundary assertion for a project-scoped role.

roleNamestring

The replacement role display name.

descriptionstring

The replacement description. Send an empty string to clear it.

policiesarray

The complete replacement policy set. An empty array is rejected.

[]policiesobject

A policy statement attached to a custom Cloud role.

resourceTypestringrequired

The second-level resource the statement targets. Organization-level types: org_member, group, api_key, org_role, project_role, project, billing, authentication, org_control_ops, recovery. Project-level types: project_member, security, backup, observability, serving_cluster, on_demand_cluster, volume, storage_integration, model_provider_integration, kms_integration, datadog_integration, serving_cluster_data, on_demand_compute_data, volume_data.

privilegesarrayrequired

Atomic privileges on that resource, e.g. ["view", "create"].

[]privilegesstring
(To be added soon)
resourcesarray

Which instances the statement covers: * for all, or explicit ids (validated against the role's project). Required on serving_cluster, on_demand_cluster, volume, serving_cluster_data, volume_data, storage_integration, model_provider_integration, kms_integration and datadog_integration, unless the statement's only privilege is create. For on_demand_compute_data, predefined roles return ["*"]; on write this field is rejected and should be omitted. Everywhere else, omit it — it is rejected on write and never returned.

[]resourcesstring
(To be added soon)
scopeobject

Reserved for future use. Omit this field.

Replace Policiesbash
export TOKEN="YOUR_API_KEY"
export roleId="r-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

curl --request PUT \
--url "${BASE_URL}/v2/roles/${roleId}" \
--header "Authorization: Bearer ${TOKEN}" \
--header "Request-Timeout: 5" \
--header "Content-Type: application/json" \
-d '{
    "roleName": "Data Reader",
    "policies": [
        {
            "resourceType": "serving_cluster",
            "resources": [
                "*"
            ],
            "privileges": [
                "view"
            ]
        }
    ]
}'
Responses200 OK - application/json

Returns a successful result or an error message.

A successful response.

codeintegerrequired

The response code.

Example Value: 0
dataobjectrequired

A Cloud ACL role.

roleIdstringrequired

The role ID.

roleNamestringrequired

The role display name.

roleTypestringrequired

The role scope.

roleKindstringrequired

Whether the role is predefined or custom.

projectIdstring

The project ID for a project-scoped role. For an organization-scoped role, this field returns an empty string.

descriptionstring

The role description.

policiesarray

The policy statements attached to the role.

[]policiesobject

A policy statement attached to a custom Cloud role.

resourceTypestringrequired

The second-level resource the statement targets. Organization-level types: org_member, group, api_key, org_role, project_role, project, billing, authentication, org_control_ops, recovery. Project-level types: project_member, security, backup, observability, serving_cluster, on_demand_cluster, volume, storage_integration, model_provider_integration, kms_integration, datadog_integration, serving_cluster_data, on_demand_compute_data, volume_data.

privilegesarrayrequired

Atomic privileges on that resource, e.g. ["view", "create"].

[]privilegesstring
(To be added soon)
resourcesarray

Which instances the statement covers: * for all, or explicit ids (validated against the role's project). Required on serving_cluster, on_demand_cluster, volume, serving_cluster_data, volume_data, storage_integration, model_provider_integration, kms_integration and datadog_integration, unless the statement's only privilege is create. For on_demand_compute_data, predefined roles return ["*"]; on write this field is rejected and should be omitted. Everywhere else, omit it — it is rejected on write and never returned.

[]resourcesstring
(To be added soon)
scopeobject

Reserved for future use. Omit this field.

A failure response.

codeintegerrequired

The response code.

messagestringrequired

The error message.

Successjson
{
    "code": 0,
    "data": {
        "roleId": "r-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
        "roleName": "Data Reader",
        "roleType": "project",
        "roleKind": "custom",
        "projectId": "proj-xxxxxxxx",
        "description": "Can read serving clusters",
        "policies": [
            {
                "resourceType": "serving_cluster",
                "resources": [
                    "*"
                ],
                "privileges": [
                    "view"
                ]
            }
        ]
    }
}
Ctrl I