Access Control List

Overview

Access control lists are the data structure used to administer resource-based authorization. TimeseriesAPI permissions endpoints are used to post, update, and delete access control list objects, and thus, grant and revoke access permission to users, devices, applications, and organizations.

Access Control Lists

An access control list has the following format:

{
    "objectId": "ID_OF_RESOURCE_TO_AUTH",
    "accesscontrolitems": {
        "sub:dev:DEvICE_ID": "PERMISSION",
        "sub:user:USER_ID": "PERMISSION",
        "sub:app:APPLICATION_ID": "PERMISSION",
        "org:ORG_ID": "PERMISSION"
    }
}

Permissions

In the case of TimeseriesAPI, ID_OF_RESOURCE_TO_AUTH is the TimeseriesID. The remaining ID fields in the example are the principal IDs assigned by the identity management system. PERMISSION is one of the following:

  • owner: Represents the principal who registered the given Timeseries object.
  • admin: Can make changes to the Timeseries object and metric definitions, and can delete samples
  • readwrite: Can write, but not delete, samples on the Timeseries
  • readonly: Can only read Timeseries and Samples objects

Principals

A principal is denoted by PRINCIPAL_TYPE:PRINCIPAL_ID. The principal type is one of the following types:

  • sub:user: Principal is a user.
  • sub:dev: Principal is a device.
  • sub:app: Principal is an application.
  • org: Principal is an organization.
  • group:ORGID: Principal is a group in an organization denoted by ORGID.

When a new Timeseries object is registered, a new access control list is automatically created and the principal making the registration request is assigned owner permissions on the Timeseries.