> For the complete documentation index, see [llms.txt](https://docs.truedat.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.truedat.io/v8.12/api-integrations/authentication-management/acl-entries.md).
# ACL Entries
## List ACL entries
> Returns every ACL entry known to the authorization service.\
> \
> Requires administrve privileges (\*\*administrator or service account\*\*). Regular users need \*\*'View domains'\*\* permission on the root domain, which is not granted by default.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/acl_entries":{"get":{"description":"Returns every ACL entry known to the authorization service.\n\nRequires administrve privileges (**administrator or service account**). Regular users need **'View domains'** permission on the root domain, which is not granted by default.\n","operationId":"TdAuthWeb.AclEntryController.index","parameters":[],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AclEntryListResponse"}}},"description":"ACL entries list"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"List ACL entries","tags":["ACL Entries"]}}},"components":{"schemas":{"AclEntryListResponse":{"additionalProperties":false,"properties":{"data":{"items":{"$ref":"#/components/schemas/AclEntry"},"type":"array"}},"required":["data"],"title":"AclEntryListResponse","type":"object"},"AclEntry":{"additionalProperties":false,"description":"A single ACL entry associating a role with a resource, granted either to a user or to a group.\n\nExactly one of `user_id` or `group_id` is populated; the other is `null`. The `resource_type` field determines what the ACL applies to.\n","properties":{"description":{"description":"Free-form description of the grant. At most 120 characters.","maxLength":120,"nullable":true,"type":"string"},"group_id":{"description":"Group the role is granted to. `null` when the entry is granted to a user.","nullable":true,"type":"integer"},"id":{"description":"Unique ACL entry identifier.","type":"integer"},"resource_id":{"description":"Identifier of the resource.","type":"integer"},"resource_type":{"description":"Type of the resource. Stored in singular form (`domain`, `structure`) regardless of the form used at creation time.","enum":["domain","structure"],"type":"string"},"role_id":{"description":"Identifier of the granted role.","type":"integer"},"user_id":{"description":"User the role is granted to. `null` when the entry is granted to a group.","nullable":true,"type":"integer"}},"required":["id","resource_id","resource_type","role_id"],"title":"AclEntry","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## Create ACL entry
> Creates an ACL entry granting a role on a resource to a user or a group.\
> \
> \*\*Permissions:\*\*\
> \- For \`domain\` resources: requires \*\*'Assign domain roles to users or groups'\*\* on the target domain.\
> \- For \`structure\` resources: requires \*\*'Assign structure roles to users or groups'\*\* on the domain(s) that own the structure.\
> \
> Exactly one of \`user\_id\` or \`group\_id\` should be supplied to identify the principal.\
> \
> \`resource\_type\` selects which resource the role is granted on. Supported values are \`domain\` and \`structure\`.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/acl_entries":{"post":{"description":"Creates an ACL entry granting a role on a resource to a user or a group.\n\n**Permissions:**\n- For `domain` resources: requires **'Assign domain roles to users or groups'** on the target domain.\n- For `structure` resources: requires **'Assign structure roles to users or groups'** on the domain(s) that own the structure.\n\nExactly one of `user_id` or `group_id` should be supplied to identify the principal.\n\n`resource_type` selects which resource the role is granted on. Supported values are `domain` and `structure`.\n","operationId":"TdAuthWeb.AclEntryController.create","parameters":[],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AclEntryCreateRequest"}}},"description":"ACL entry creation payload","required":false},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AclEntryResponse"}}},"description":"ACL entry created"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnprocessableEntityChangesetResponse"}}},"description":"Unprocessable Entity"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"Create ACL entry","tags":["ACL Entries"]}}},"components":{"schemas":{"AclEntryCreateRequest":{"additionalProperties":false,"description":"Payload for creating an ACL entry.\n\nExactly one of `user_id` or `group_id` must be supplied: if both are provided, one is cleared server-side; if neither is provided, the create fails on the database's XOR constraint.\n","properties":{"acl_entry":{"additionalProperties":false,"properties":{"description":{"description":"Free-form description of the grant.","maxLength":120,"nullable":true,"type":"string"},"group_id":{"description":"Group the role is granted to. Mutually exclusive with `user_id`: setting one clears the other server-side.","nullable":true,"type":"integer"},"resource_id":{"description":"Identifier of the resource the role is granted on.","type":"integer"},"resource_type":{"description":"Type of the resource. Singularized server-side, so `domains` and `domain` are equivalent.","enum":["domain","structure"],"type":"string"},"role_id":{"description":"Identifier of the role to grant.","type":"integer"},"user_id":{"description":"User the role is granted to. Mutually exclusive with `group_id`: setting one clears the other server-side.","nullable":true,"type":"integer"}},"required":["role_id","resource_id","resource_type"],"type":"object"}},"required":["acl_entry"],"title":"AclEntryCreateRequest","type":"object"},"AclEntryResponse":{"additionalProperties":false,"properties":{"data":{"$ref":"#/components/schemas/AclEntry"}},"required":["data"],"title":"AclEntryResponse","type":"object"},"AclEntry":{"additionalProperties":false,"description":"A single ACL entry associating a role with a resource, granted either to a user or to a group.\n\nExactly one of `user_id` or `group_id` is populated; the other is `null`. The `resource_type` field determines what the ACL applies to.\n","properties":{"description":{"description":"Free-form description of the grant. At most 120 characters.","maxLength":120,"nullable":true,"type":"string"},"group_id":{"description":"Group the role is granted to. `null` when the entry is granted to a user.","nullable":true,"type":"integer"},"id":{"description":"Unique ACL entry identifier.","type":"integer"},"resource_id":{"description":"Identifier of the resource.","type":"integer"},"resource_type":{"description":"Type of the resource. Stored in singular form (`domain`, `structure`) regardless of the form used at creation time.","enum":["domain","structure"],"type":"string"},"role_id":{"description":"Identifier of the granted role.","type":"integer"},"user_id":{"description":"User the role is granted to. `null` when the entry is granted to a group.","nullable":true,"type":"integer"}},"required":["id","resource_id","resource_type","role_id"],"title":"AclEntry","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHUnprocessableEntityChangesetResponse":{"additionalProperties":false,"description":"Response emitted for Ecto.Changeset validation failures. Keys under `errors` are the invalid field names and values are lists of messages.","properties":{"errors":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"}},"required":["errors"],"title":"AUTHUnprocessableEntityChangesetResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## Get ACL entry
> Returns the specified ACL entry.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/acl_entries/{id}":{"get":{"description":"Returns the specified ACL entry.","operationId":"TdAuthWeb.AclEntryController.show","parameters":[{"description":"ACL entry ID.","in":"path","name":"id","required":true,"schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AclEntryResponse"}}},"description":"ACL entry detail"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHNotFoundResponse"}}},"description":"Not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"Get ACL entry","tags":["ACL Entries"]}}},"components":{"schemas":{"AclEntryResponse":{"additionalProperties":false,"properties":{"data":{"$ref":"#/components/schemas/AclEntry"}},"required":["data"],"title":"AclEntryResponse","type":"object"},"AclEntry":{"additionalProperties":false,"description":"A single ACL entry associating a role with a resource, granted either to a user or to a group.\n\nExactly one of `user_id` or `group_id` is populated; the other is `null`. The `resource_type` field determines what the ACL applies to.\n","properties":{"description":{"description":"Free-form description of the grant. At most 120 characters.","maxLength":120,"nullable":true,"type":"string"},"group_id":{"description":"Group the role is granted to. `null` when the entry is granted to a user.","nullable":true,"type":"integer"},"id":{"description":"Unique ACL entry identifier.","type":"integer"},"resource_id":{"description":"Identifier of the resource.","type":"integer"},"resource_type":{"description":"Type of the resource. Stored in singular form (`domain`, `structure`) regardless of the form used at creation time.","enum":["domain","structure"],"type":"string"},"role_id":{"description":"Identifier of the granted role.","type":"integer"},"user_id":{"description":"User the role is granted to. `null` when the entry is granted to a group.","nullable":true,"type":"integer"}},"required":["id","resource_id","resource_type","role_id"],"title":"AclEntry","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHNotFoundResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHNotFoundResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## Update ACL entry
> Updates the description of the specified ACL entry. Only the \`description\` field may be modified.\
> \
> \*\*Permissions:\*\*\
> \- For \`domain\` resources: requires \*\*'Update domain roles'\*\* on the target domain.\
> \- For \`structure\` resources: requires \*\*'Assign structure roles to users or groups'\*\* on the domain(s) that own the structure.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/acl_entries/{id}":{"put":{"description":"Updates the description of the specified ACL entry. Only the `description` field may be modified.\n\n**Permissions:**\n- For `domain` resources: requires **'Update domain roles'** on the target domain.\n- For `structure` resources: requires **'Assign structure roles to users or groups'** on the domain(s) that own the structure.\n","operationId":"TdAuthWeb.AclEntryController.update","parameters":[{"description":"ACL entry ID.","in":"path","name":"id","required":true,"schema":{"type":"integer"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AclEntryUpdateRequest"}}},"description":"ACL entry update payload","required":false},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AclEntryResponse"}}},"description":"ACL entry updated"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHNotFoundResponse"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnprocessableEntityChangesetResponse"}}},"description":"Unprocessable Entity"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"Update ACL entry","tags":["ACL Entries"]}}},"components":{"schemas":{"AclEntryUpdateRequest":{"additionalProperties":false,"description":"Update payload. Only the `description` field may be modified on an existing ACL entry.","properties":{"acl_entry":{"additionalProperties":false,"properties":{"description":{"description":"New description. At most 120 characters.","maxLength":120,"nullable":true,"type":"string"}},"type":"object"}},"required":["acl_entry"],"title":"AclEntryUpdateRequest","type":"object"},"AclEntryResponse":{"additionalProperties":false,"properties":{"data":{"$ref":"#/components/schemas/AclEntry"}},"required":["data"],"title":"AclEntryResponse","type":"object"},"AclEntry":{"additionalProperties":false,"description":"A single ACL entry associating a role with a resource, granted either to a user or to a group.\n\nExactly one of `user_id` or `group_id` is populated; the other is `null`. The `resource_type` field determines what the ACL applies to.\n","properties":{"description":{"description":"Free-form description of the grant. At most 120 characters.","maxLength":120,"nullable":true,"type":"string"},"group_id":{"description":"Group the role is granted to. `null` when the entry is granted to a user.","nullable":true,"type":"integer"},"id":{"description":"Unique ACL entry identifier.","type":"integer"},"resource_id":{"description":"Identifier of the resource.","type":"integer"},"resource_type":{"description":"Type of the resource. Stored in singular form (`domain`, `structure`) regardless of the form used at creation time.","enum":["domain","structure"],"type":"string"},"role_id":{"description":"Identifier of the granted role.","type":"integer"},"user_id":{"description":"User the role is granted to. `null` when the entry is granted to a group.","nullable":true,"type":"integer"}},"required":["id","resource_id","resource_type","role_id"],"title":"AclEntry","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHNotFoundResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHNotFoundResponse","type":"object"},"AUTHUnprocessableEntityChangesetResponse":{"additionalProperties":false,"description":"Response emitted for Ecto.Changeset validation failures. Keys under `errors` are the invalid field names and values are lists of messages.","properties":{"errors":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"}},"required":["errors"],"title":"AUTHUnprocessableEntityChangesetResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## Delete ACL entry
> Deletes the specified ACL entry.\
> \
> \*\*Permissions:\*\*\
> \- For \`domain\` resources: requires \*\*'Delete domain roles'\*\* on the target domain.\
> \- For \`structure\` resources: requires \*\*'Assign structure roles to users or groups'\*\* on the domain(s) that own the structure.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/acl_entries/{id}":{"delete":{"description":"Deletes the specified ACL entry.\n\n**Permissions:**\n- For `domain` resources: requires **'Delete domain roles'** on the target domain.\n- For `structure` resources: requires **'Assign structure roles to users or groups'** on the domain(s) that own the structure.\n","operationId":"TdAuthWeb.AclEntryController.delete","parameters":[{"description":"ACL entry ID.","in":"path","name":"id","required":true,"schema":{"type":"integer"}}],"responses":{"204":{"description":"ACL entry deleted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHNotFoundResponse"}}},"description":"Not found"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"Delete ACL entry","tags":["ACL Entries"]}}},"components":{"schemas":{"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHNotFoundResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHNotFoundResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## Update ACL entry
> Updates the description of the specified ACL entry. Only the \`description\` field may be modified.\
> \
> \*\*Permissions:\*\*\
> \- For \`domain\` resources: requires \*\*'Update domain roles'\*\* on the target domain.\
> \- For \`structure\` resources: requires \*\*'Assign structure roles to users or groups'\*\* on the domain(s) that own the structure.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/acl_entries/{id}":{"patch":{"description":"Updates the description of the specified ACL entry. Only the `description` field may be modified.\n\n**Permissions:**\n- For `domain` resources: requires **'Update domain roles'** on the target domain.\n- For `structure` resources: requires **'Assign structure roles to users or groups'** on the domain(s) that own the structure.\n","operationId":"TdAuthWeb.AclEntryController.update (2)","parameters":[{"description":"ACL entry ID.","in":"path","name":"id","required":true,"schema":{"type":"integer"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AclEntryUpdateRequest"}}},"description":"ACL entry update payload","required":false},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AclEntryResponse"}}},"description":"ACL entry updated"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHNotFoundResponse"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnprocessableEntityChangesetResponse"}}},"description":"Unprocessable Entity"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"Update ACL entry","tags":["ACL Entries"]}}},"components":{"schemas":{"AclEntryUpdateRequest":{"additionalProperties":false,"description":"Update payload. Only the `description` field may be modified on an existing ACL entry.","properties":{"acl_entry":{"additionalProperties":false,"properties":{"description":{"description":"New description. At most 120 characters.","maxLength":120,"nullable":true,"type":"string"}},"type":"object"}},"required":["acl_entry"],"title":"AclEntryUpdateRequest","type":"object"},"AclEntryResponse":{"additionalProperties":false,"properties":{"data":{"$ref":"#/components/schemas/AclEntry"}},"required":["data"],"title":"AclEntryResponse","type":"object"},"AclEntry":{"additionalProperties":false,"description":"A single ACL entry associating a role with a resource, granted either to a user or to a group.\n\nExactly one of `user_id` or `group_id` is populated; the other is `null`. The `resource_type` field determines what the ACL applies to.\n","properties":{"description":{"description":"Free-form description of the grant. At most 120 characters.","maxLength":120,"nullable":true,"type":"string"},"group_id":{"description":"Group the role is granted to. `null` when the entry is granted to a user.","nullable":true,"type":"integer"},"id":{"description":"Unique ACL entry identifier.","type":"integer"},"resource_id":{"description":"Identifier of the resource.","type":"integer"},"resource_type":{"description":"Type of the resource. Stored in singular form (`domain`, `structure`) regardless of the form used at creation time.","enum":["domain","structure"],"type":"string"},"role_id":{"description":"Identifier of the granted role.","type":"integer"},"user_id":{"description":"User the role is granted to. `null` when the entry is granted to a group.","nullable":true,"type":"integer"}},"required":["id","resource_id","resource_type","role_id"],"title":"AclEntry","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHNotFoundResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHNotFoundResponse","type":"object"},"AUTHUnprocessableEntityChangesetResponse":{"additionalProperties":false,"description":"Response emitted for Ecto.Changeset validation failures. Keys under `errors` are the invalid field names and values are lists of messages.","properties":{"errors":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"}},"required":["errors"],"title":"AUTHUnprocessableEntityChangesetResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## List ACL entries for a resource
> Returns every ACL entry attached to the resource identified by \`resource\_type\` and \`resource\_id\`.\
> \
> \*\*Permissions:\*\*\
> \- For \`domain\` resources: requires \*\*'View domains'\*\* on the target domain.\
> \- For \`structure\` resources: requires \*\*'View structures'\*\* on the domains that own the structure.\
> \
> The response is a HAL-style document: entries live under \`\_embedded.acl\_entries\` and hypermedia controls under \`\_links.self\`. Each entry declares the HTTP methods the caller is allowed to use on that specific ACL entry.\
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/acl_entries/{resource_type}/{resource_id}":{"get":{"description":"Returns every ACL entry attached to the resource identified by `resource_type` and `resource_id`.\n\n**Permissions:**\n- For `domain` resources: requires **'View domains'** on the target domain.\n- For `structure` resources: requires **'View structures'** on the domains that own the structure.\n\nThe response is a HAL-style document: entries live under `_embedded.acl_entries` and hypermedia controls under `_links.self`. Each entry declares the HTTP methods the caller is allowed to use on that specific ACL entry.\n\n","operationId":"TdAuthWeb.ResourceAclController.show","parameters":[{"description":"Resource type. Singularized server-side.","in":"path","name":"resource_type","required":true,"schema":{"$ref":"#/components/schemas/ResourceType"}},{"description":"Resource identifier.","in":"path","name":"resource_id","required":true,"schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceAclShowResponse"}}},"description":"ACL entries for the resource"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"List ACL entries for a resource","tags":["ACL Entries"]}}},"components":{"schemas":{"ResourceType":{"description":"Type of the resource the ACL applies to. Singularized server-side, so `domains` and `domain` resolve to the same type.\n\nOnly `domain` and `structure` are meaningful: the create endpoint rejects any other value with `422`, and the list endpoint returns an empty list for types with no entries in the database.\n","enum":["domain","structure"],"title":"ResourceType","type":"string"},"ResourceAclShowResponse":{"additionalProperties":false,"description":"HAL-style listing of every ACL entry attached to a resource, with hypermedia controls at the top level.","properties":{"_embedded":{"additionalProperties":false,"properties":{"acl_entries":{"items":{"$ref":"#/components/schemas/ResourceAclEntry"},"type":"array"}},"required":["acl_entries"],"type":"object"},"_links":{"$ref":"#/components/schemas/ResourceAclLinksMap"}},"required":["_embedded","_links"],"title":"ResourceAclShowResponse","type":"object"},"ResourceAclEntry":{"additionalProperties":true,"description":"ACL entry as embedded inside a resource ACL listing.\n\nThis is a hypermedia-flavoured representation: it carries the role name, the principal and a `_links` block, instead of the raw identifiers exposed by the flat ACL entry schema.\n","properties":{"_actions":{"additionalProperties":true,"description":"Optional map of actions available on this entry, mirroring the hypermedia controls.","nullable":true,"type":"object"},"_links":{"$ref":"#/components/schemas/ResourceAclLinksMap"},"acl_entry_id":{"description":"Identifier of the ACL entry.","type":"integer"},"description":{"maxLength":120,"nullable":true,"type":"string"},"principal":{"$ref":"#/components/schemas/ResourceAclPrincipal"},"principal_type":{"description":"Whether the ACL is granted to a user or to a group.","enum":["user","group"],"type":"string"},"role_id":{"type":"integer"},"role_name":{"type":"string"}},"required":["acl_entry_id","principal_type","principal","role_id","role_name","_links"],"title":"ResourceAclEntry","type":"object"},"ResourceAclLinksMap":{"additionalProperties":false,"properties":{"self":{"$ref":"#/components/schemas/ResourceAclLink"}},"required":["self"],"title":"ResourceAclLinksMap","type":"object"},"ResourceAclLink":{"additionalProperties":false,"description":"Hypermedia link with the HTTP methods allowed on the target.","properties":{"href":{"description":"Target URL.","type":"string"},"methods":{"description":"HTTP methods the caller is allowed to use on the target.","items":{"type":"string"},"type":"array"}},"required":["href","methods"],"title":"ResourceAclLink","type":"object"},"ResourceAclPrincipal":{"description":"Principal the ACL is granted to. The concrete shape is selected by `principal_type`.","oneOf":[{"$ref":"#/components/schemas/ResourceAclPrincipalUser"},{"$ref":"#/components/schemas/ResourceAclPrincipalGroup"}],"title":"ResourceAclPrincipal"},"ResourceAclPrincipalUser":{"additionalProperties":false,"description":"User the ACL is granted to. Only the fields needed to identify the principal are exposed.","properties":{"full_name":{"nullable":true,"type":"string"},"id":{"type":"integer"},"user_name":{"nullable":true,"type":"string"}},"required":["id"],"title":"ResourceAclPrincipalUser","type":"object"},"ResourceAclPrincipalGroup":{"additionalProperties":false,"description":"Group the ACL is granted to.","properties":{"alias":{"nullable":true,"type":"string"},"description":{"nullable":true,"type":"string"},"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"title":"ResourceAclPrincipalGroup","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```
## Create ACL entry for a resource
> Creates an ACL entry granting a role on the resource identified by \`resource\_type\` and \`resource\_id\` to a user or a group.\
> \
> \*\*Permissions:\*\*\
> \- For \`domain\` resources: requires \*\*'Assign domain roles to users or groups'\*\* on the target domain.\
> \- For \`structure\` resources: requires \*\*'Assign structure roles to users or groups'\*\* on the domains that own the structure.\
> \
> \*\*Behavior:\*\*\
> \- The resource identity is taken from the URL path. The body only describes the principal and the role.\
> \- If \`role\_name\` does not match an existing role, the entry cannot be created.\
> \- On success the endpoint responds with \`303 See Other\` and a \`Location\` header pointing at the resource ACL listing. The response body is empty.
```json
{"openapi":"3.0.0","info":{"title":"td-auth","version":"Truedat 8.12.0"},"paths":{"/api/acl_entries/{resource_type}/{resource_id}":{"post":{"description":"Creates an ACL entry granting a role on the resource identified by `resource_type` and `resource_id` to a user or a group.\n\n**Permissions:**\n- For `domain` resources: requires **'Assign domain roles to users or groups'** on the target domain.\n- For `structure` resources: requires **'Assign structure roles to users or groups'** on the domains that own the structure.\n\n**Behavior:**\n- The resource identity is taken from the URL path. The body only describes the principal and the role.\n- If `role_name` does not match an existing role, the entry cannot be created.\n- On success the endpoint responds with `303 See Other` and a `Location` header pointing at the resource ACL listing. The response body is empty.\n","operationId":"TdAuthWeb.ResourceAclController.create","parameters":[{"description":"Resource type. Singularized server-side.","in":"path","name":"resource_type","required":true,"schema":{"$ref":"#/components/schemas/ResourceType"}},{"description":"Resource identifier.","in":"path","name":"resource_id","required":true,"schema":{"type":"integer"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceAclCreateRequest"}}},"description":"ACL entry creation payload","required":false},"responses":{"303":{"description":"ACL entry created. The `Location` header points at the resource ACL listing."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnauthorizedMessageResponse"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHForbiddenResponse"}}},"description":"Forbidden"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHUnprocessableEntityChangesetResponse"}}},"description":"Unprocessable Entity"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AUTHInternalServerErrorResponse"}}},"description":"Internal Server Error"}},"summary":"Create ACL entry for a resource","tags":["ACL Entries"]}}},"components":{"schemas":{"ResourceType":{"description":"Type of the resource the ACL applies to. Singularized server-side, so `domains` and `domain` resolve to the same type.\n\nOnly `domain` and `structure` are meaningful: the create endpoint rejects any other value with `422`, and the list endpoint returns an empty list for types with no entries in the database.\n","enum":["domain","structure"],"title":"ResourceType","type":"string"},"ResourceAclCreateRequest":{"additionalProperties":false,"description":"Payload for creating an ACL entry through the resource-scoped endpoint.\n\nThe resource is identified by the URL path, so the body only needs to describe the principal and the role.\n","properties":{"acl_entry":{"additionalProperties":false,"properties":{"description":{"description":"Free-form description of the grant.","maxLength":120,"nullable":true,"type":"string"},"principal_id":{"description":"Identifier of the user or group. Interpreted according to `principal_type`.","type":"integer"},"principal_type":{"description":"Whether the role is granted to a user or to a group.","enum":["user","group"],"type":"string"},"role_name":{"description":"Name of the role to grant","type":"string"}},"required":["principal_type","principal_id","role_name"],"type":"object"}},"required":["acl_entry"],"title":"ResourceAclCreateRequest","type":"object"},"AUTHUnauthorizedMessageResponse":{"additionalProperties":false,"description":"Response emitted by the authentication pipeline when credentials are missing or invalid.","properties":{"message":{"description":"Error type, e.g. \"unauthorized\".","type":"string"}},"required":["message"],"title":"AUTHUnauthorizedMessageResponse","type":"object"},"AUTHForbiddenResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHForbiddenResponse","type":"object"},"AUTHUnprocessableEntityChangesetResponse":{"additionalProperties":false,"description":"Response emitted for Ecto.Changeset validation failures. Keys under `errors` are the invalid field names and values are lists of messages.","properties":{"errors":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"}},"required":["errors"],"title":"AUTHUnprocessableEntityChangesetResponse","type":"object"},"AUTHInternalServerErrorResponse":{"additionalProperties":false,"properties":{"errors":{"properties":{"detail":{"type":"string"}},"required":["detail"],"type":"object"}},"required":["errors"],"title":"AUTHInternalServerErrorResponse","type":"object"}}}}
```