Authorization

In previous versions of Itential Automation Platform (IAP), users and groups had their own menu option. IAP now has a new user interface (UI) to administer users, groups, and roles. Users and groups are contained, along with a new UI for role configuration, in Authorization Manager.

Terminology

Various terms related to IAP users, groups, and roles are defined in the following table.

Term	Definition
User	An entity that can perform specific actions within multiple IAP applications based on group associations.
Group	A collection of roles that can be assigned to a user.
Role	A collection of granular level privileges that can be assigned to groups.
Privilege	Permission granted to an API and a View.
Provenance	The source of a group; where it was learned. For external groups, this is set to the IAP AAA adapter ID. For IAP groups, it is not set.

Authorization Manager

There are two pathways to access Authorization Manager. You can navigate to Admin Essentials > Quick Start > Authorization. Another way is to click the Authorization icon in the top toolbar above the left sidebar menu.

Networking Requirements

If you have Cisco NSO and want to use the NSO External Authentication script, network connectivity is required between the two, typically port 3000. For more information on how to install the NSO External Authentication script, see the Network Adapters section of the IAP Integrations guide.

Users

A user is an entity that comes from an external AAA System such as LDAP. Users may be a member of any number of groups and through group membership may be assigned any number of roles.

Itential Automation Platform (IAP) provides the ability to assign roles directly to users. Also, with IAP groups, administrators are able to manage user membership.

All operations within IAP are associated with a user. User roles, whether directly assigned or inherited from a group, determine what the user can see and do within IAP. The final permission set of a user will be a combination of permissions granted to all the roles assigned to the user, or to any groups in which the user is a member.

Managing Users

Users are accounts from an external system. Therefore, it is not possible to create a new user within IAP. Instead, IAP will create the user record when someone has successfully logged in using the user’s AAA system credentials.

Use Authorization Manager to see a list of users IAP has encountered and to manage their permissions.

1. Login to IAP as Administrator (a user with the Pronghorn.admin role).
2. Navigate to Admin Essentials > Quick Start > Authorization.
3. Select the Users tab.
4. Locate the user in the list. Optionally, filter the list by typing in the Search Users field and pressing Enter, or click the search icon.
5. Select the appropriate user from the list to view or edit.
6. Edit attributes, as desired.
7. Edit Roles and Groups, as desired.
8. Click Save to finalize your changes.

Roles assigned by Groups are grayed out (disabled). This indicates the assignment is inherited.

Configuring Role Assignments for Users

There are two ways to assign users to roles:

• Directly
• By group membership

To assign roles directly to a user:

1. Select the Roles tab.
2. Locate the role you wish to assign. You can filter the list by typing in the column header text box.
3. Add or remove a role assignment using the checkbox.

Roles assigned by Groups are grayed out (disabled). This indicates the assignment is inherited.

Configuring Group Membership for Users

External group memberships for users are managed by the external AAA system and cannot be edited in IAP. A user may only be added or removed from IAP Groups within Authorization Manager. Addition or removal of AAA groups must be performed in the AAA system and will be noticed by IAP the next time the user logs in.

To change the IAP Groups to which a user belongs:

1. Click the Groups tab.
2. Find the group in the list. You can filter the list by typing in the column header textbox.
3. Add or remove group membership using the checkbox.

AAA-managed group memberships will be grayed out (disabled), indicating the membership is not editable in IAP.

Groups

This section captures how users and groups are created and assigned in IAP. Group management and configuration is also explained.

• Users are assigned to external groups within the external AAA system. Users cannot be assigned to external groups using IAP.
• An external group is an account that comes from an external AAA System such as LDAP. An external group cannot be created within IAP.
• An IAP group is an account created within the IAP system. Users are assigned to IAP groups through Authorization Manager.

Note: If User1 is a member of Group1 and starts a job, and User2 is not a member of Group1, then User2 will not be able to see the job.

Managing Groups

External groups cannot be created within IAP. Instead, IAP will create the external group record once it has been learned from the AAA system.

To manage groups within IAP:

1. Login to IAP as an administrator (a user with the Pronghorn.admin Role).
2. Navigate to Admin Essentials > Quick Start > Authorization.
3. Select the Groups tab. A list of all defined groups and their provenances is displayed.
4. Locate the group in the list. You can filter the list by typing in the Search Groups field.
5. Select the group in the list to view or edit.
6. Edit the description as desired.
7. Edit roles and groups as desired.
8. Click Save to finalize your changes.

Configuring Group Membership

An IAP Group may be added or removed using the Authorization Manager. IAP groups and external groups can be given membership to an IAP group. In contrast, neither group can be given membership to an external group.

To change group membership:

1. Login to IAP as an administrator (a user with the Pronghorn.admin Role).
2. Navigate to Admin Essentials > Quick Start > Authorization.
3. Select the Groups tab. A list of defined groups is displayed.
4. Locate the group in the list. You can filter the list by typing in the Search Groups field.
5. Select the group in the list to view or edit.
6. From the Edit Group canvas, select the Groups tab.
7. Add or remove group membership by selecting the checkbox.

Identifying Group Members

A members list identifies the users and groups that are direct members of a Group.

1. Navigate to the Group edit screen.
2. Locate the Members list (right side of screen). There is no indicator for inherited memberships.

Deleting a Group

Caution: This is a hard delete. Deleting a group will remove the role from all Users and Groups assigned to it.

Only IAP Groups can be deleted.

1. Select the group.
2. Click the Delete button.
3. Confirm the deletion.

Alternate method:

1. Click the View List icon in the Groups header to access the Groups table view.
2. Locate the group you wish to delete. You can filter the list using the filter fields in the column header.
3. Click the Delete button for the group.
4. Confirm the deletion.

Roles

A role is a bundle of permissions assigned to users and/or groups. Roles are pre-defined in the pronghorn.json file for each application and assigned to methods/tasks and views with the roles property. Custom roles can be created within your installation by navigating to Authorization Manager > Roles.

Built-In Roles

The following is a list of built-in roles within IAP.

• admin
• apiread
• apiwrite
• support
• operations/operator
• engineering
• taskread
• taskwrite
• authorization
• read-only

Endpoints

A role grants permission to access one or more endpoints. Endpoints are defined by the applications and IAP. There are essentially two types of endpoints.

Endpoint Type	Description
Methods	Represent API Endpoints that read or write data.
Views	Represent web pages in the browser. A view will typically rely on one or more methods to read/write data.

A role may be assigned to any number of users or groups. This provides access to all endpoints granted to the role. The final permission set for a user is a combination of permissions granted to all the roles assigned to a user, or to any groups in which the user is a member.

Managing Roles

In addition to built-in roles defined by applications, IAP allows administrators to define custom roles for an installation to allow for different authorization strategies. Built-in roles are hard coded in the services (or in IAP) and are not user-editable. Users can only utilize services from their active server profile, and cannot add roles for services that are currently not running.

To manage roles within IAP:

1. Login to IAP as an administrator (a user with the Pronghorn.admin Role).
2. Navigate to Admin Essentials > Quick Start > Authorization.
3. Select the Roles tab. A sectioned list displays.
   • There is a section for each application installed in the system.
   • If any custom roles have been defined, a Custom section also appears.
4. Expand a section to display the roles defined within it.
5. Select a role to open it for viewing or editing.
6. Click Save to finalize any changes.
7. Click the View List icon in the Roles header to show an advanced table view.
   • You can view all roles in a single list.
   • You can filter and/or sort roles using various fields.

Configuring Role Assignments

Groups are assigned to roles in two ways:

• Directly.
• By membership in another group.

To assign roles directly to a group in IAP:

1. In the left-side navigation panel, select the Groups tab.
2. Select a group to open it for viewing or editing.
3. In the Edit Group canvas, locate the role you wish to assign.
4. Filter the list by typing in the Role or Source text box.
5. Add or remove a role assignment by selecting the checkbox.

Roles which are assigned by other groups are grayed out (disabled). This indicates the assignment is inherited.

Inspecting a Built-In Role

To inspect a built-in role:

1. In the left-side navigation panel, select the Roles tab.
2. Click the View List icon in the Roles header to show the Roles table view.
3. Optionally, type a column filter.
4. Click the Inspect Role icon next to a role to show the list of all endpoints granted to the role.

Creating a Custom Role

Use a unique name when creating a custom role.

1. Click the Add New Role icon in the Role header.
2. Give the new custom role a name (required).
3. Give the new custom role a description (optional).
4. Optionally, edit permissions. Refer to Managing Custom Role Permissions below.
5. Click Save to finalize your changes.

Editing a Custom Role

Only custom roles may be edited.

1. In the left-side navigation panel, select the Roles tab.
2. Expand the Custom section or optionally type the name of the role in the Search Roles field.
   • Select the desired role from the results list.
   • Update the role name, if needed.
   • Update the role description, if needed.
   • Optionally, edit permissions. Refer to Managing Custom Role Permissions below.
   • Click Save to finalize your changes.
3. Alternatively, click the View List icon in the Roles header to open the Roles table view.
   • Optionally type a column filter.
   • Click the Edit Role icon next to a custom role.
   • Update the role name, if needed.
   • Update the role description, if needed.
   • Optionally, edit permissions. Refer to Managing Custom Role Permissions below.
   • Click Save to finalize your changes.

Managing Custom Role Permissions

Custom role permissions are managed in two ways: simple view or advanced view.

Simple View

1. Type the name of an installed application in the Application field.
2. Select the application from the results list.
   • The application will be added to the Application table and selected for editing.
   • The endpoints for the selected application will display in the Detail panel, with tabs for Methods and Views, respectively.
3. Locate the endpoint you would like to grant or remove.
   • Filter the list by typing in the header text box.
4. Use one of the following to add or remove permitted endpoints:
   • Add or remove by selecting the checkbox.
   • Use the header checkbox to select or deselect all.

Advanced View

1. Click Advanced next to the Application field.
2. Locate the endpoint you would like to grant or remove.
   • Filter the list by typing in the headers of the Endpoints tables.
3. Add or remove permitted endpoints by selecting the checkbox.

Deleting a Custom Role

Caution: This is a hard delete. Deleting a custom role will remove references to the role from all users and groups assigned to it.

As with any other modifications, only custom roles may be deleted.

1. In the left-side navigation panel, click the View List icon in the Roles header to access the Roles table view.
2. Locate the custom role you wish to delete. Filter the list using the filter fields in the column header.
3. Click the Delete button for the role.
4. Confirm the deletion.

Custom Applications and Built-In Roles

Built-in application roles along with endpoints are defined in the pronghorn.json file. The following excerpt from a pronghorn.json file is provided as an example.

{
    "roles": [
        "admin",
        "engineering",
        "support",
        "apiread",
        "authorization"
    ],
    "methods": [
        {
            "name": "getTasksList",
            "roles": [
                "admin",
                "engineering",
                "support"
            ]
        }
    ],
    "views": [
        {
            "path": "/edit",
            "roles": [
                "admin",
                "engineering"
            ]
        }
    ]
}

In the preceding example, five (5) built-in roles were defined. The getTasksList method is granted to three of them. In contrast, the /edit view is granted to only two.

The declarations will be ingested at application load time and cached in the IAP database to assist with various queries. At application load time, the roles that are cached for the application will be replaced with the roles and permissions defined in pronghorn.json.

If pronghorn.json is inconsistent in its role names, warnings will appear in the IAP logs at application load time.

Note: If an application is upgraded and the new version no longer declares a role, it will be deleted and references to it will be removed from all users and groups. Additionally, role names are the identifier for application roles. Renaming a role is effectively the same as deleting it and declaring a new one. In each case, some users may lose access to your application. Therefore, removal or renaming of existing roles is considered a breaking change.

Application Roles by API Method, Task, and View

The charts in this section show the default roles found in pronghorn.json for each application as delivered.

Note: These charts will change based on the version of IAP that is running. Therefore, as a best practice, Itential recommends that you review the APIs, application roles and their respective permissions for the latest information. You can view this in the Itential UI by navigating to the Authorization Manager page and selecting Roles (Admin Essentials > Quick Start > Authorization > Roles).

Admin Essentials

API Method/Task	admin	apiread
availableArtifacts	x	x
exportArtifact	x	x
getArtifact	x	x
getArtifacts	x	x
getServicesHealth	x	x
importArtifact	x
installArtifact	x
removeArtifact	x
updateArtifact	x

	view	admin
Admin Essentials	/	x

AG Manager

API Method/Task	admin	apiread	apiwrite
discoverModules	x	x
undiscoverAll	x		x
undiscoverModules	x		x

Automation Catalog

API Method/Task	admin	apiread	other	readonly
createAutomation	x	x	x	x
deleteAutomations	x	x	x	x
exportAutomation	x	x	x	x
getAutomationById	x	x	x	x
getAutomations	x	x	x	x
importAutomations	x	x	x	x
runAutomation	x	x	x	x
scheduleAutomation	x	x	x	x
updateAutomation	x	x	x	x

	view	admin
Automation Catalog	/	x

Automation Studio

API Method/Task	admin	apiread	apiwrite	designer	engineering	readonly	support
createAutomation	x		x	x
createTemplate	x		x	x
deleteTemplate	x		x	x
getMethodOptions	x				x		x
getTemplate	x	x		x		x
getTemplates	x	x		x		x
importAutomations	x		x	x
importTemplates	x		x	x
runTransformation	x				x		x
updateAutomation	x		x	x
updateTemplate	x		x	x

	view	designer
Automation Studio	/	x

Configuration Manager

API Method/Task	admin	apiread	apiwrite
adapterProxy	x		x
addDevicesToGroup	x		x
addDevicesToGroupByName	x		x
addDevicesToNode	x		x
addTasksToNode	x		x
advancedAutoRemediation	x		x
backUpDevice	x		x
buildSpecLines	x	x
createConfigSpec	x		x
createDeviceGroup	x		x
createGoldenConfigNode	x		x
createGoldenConfigTree	x		x
createGoldenConfigTreeVersion	x		x
createJSONSpec	x		x
createTaskInstance	x		x
deleteDeviceBackups	x		x
deleteDeviceGroups	x		x
deleteDeviceGroupsByName	x		x
deleteDevicesFromGroup	x		x
deleteGoldenConfigNode	x		x
deleteGoldenConfigTree	x		x
deleteGoldenConfigTrees	x		x
deleteGoldenConfigTreeVersion	x		x
deletePins	x		x
deleteTaskInstances	x		x
deleteVariables	x		x
exportGoldenConfigTree	x		x
getAdapterTask	x	x
getAdapterTasks	x	x
getBackups	x	x
getComplianceReportDetail	x	x
getComplianceReportDeviceHistory	x	x
getComplianceReportNodeSummary	x	x
getComplianceReportsByBatch	x	x
getComplianceReportsDetail	x	x
getComplianceReportTaskHistory	x	x
getComplianceReportTreeSummary	x	x
getConfigSpec	x	x
getConfigTemplate	x	x
getDevice	x	x
getDeviceBackupById	x	x
getDeviceConfig	x	x
getDeviceConfigFormat	x	x
getDeviceGroupById	x	x
getDeviceGroupByName	x	x
getDeviceGroups	x	x
getDevicesFiltered	x	x
getGoldenConfigTree	x	x
getGoldenConfigTrees	x	x
getGoldenConfigTreeVersion	x	x
getJSONComplianceReportDetail	x	x
getJSONComplianceReportsByBatch	x	x
getJSONSpec	x	x
getJSONSpecWithInheritance	x	x
getPins	x	x
getTaskInstances	x	x
getTopIssues	x	x
getTopIssuesJson	x	x
getTreesForDevice	x	x
gradeComplianceReport	x		x
gradeComplianceReports	x		x
gradeDeviceComplianceHistory	x		x
gradeTaskComplianceHistory	x		x
handlePin	x	x
importBackup	x		x
importGoldenConfigTree	x		x
importGroup	x		x
isAlive	x	x
lookupDiff	x	x
patchDeviceConfiguration	x		x
removeDevicesFromGroup	x		x
removeDevicesFromNode	x		x
removeTasksFromNode	x		x
renderJinja2	x	x
runAdapterTask	x	x
runAutoRemediation	x		x
runCompliance	x	x
runComplianceForDevice	x	x
runComplianceForNode	x	x
runComplianceForTree	x	x
runTaskInstance	x	x
searchDeviceGroups	x	x
searchGroups	x	x
translateConfigSpec	x	x
updateConfigSpec	x		x
updateDeviceBackupById	x		x
updateDeviceGroups	x		x
updateGoldenConfigNode	x		x
updateGoldenConfigTree	x		x
updateGoldenConfigTreeVersion	x		x
updateJSONSpec	x		x
updateTaskInstance	x		x

	view	admin	taskwrite
Configuration Manager	/	x
Diff Viewer	/task/DiffViewer	x	x
Manual Remediation Results Task	/task/ManualRemediationResults	x	x
Manual Remediation Task	/task/ManualRemediation	x	x

Core

API Method/Task	admin	apiread
createAccount	x
createAdapter	x
createGroup	x
createIntegration	x
createIntegrationModel	x
createProfile	x
deleteAccount	x
deleteAdapter	x
deleteGroup	x
deleteIntegration	x
deleteIntegrationModel	x
deleteProfile	x
exportPrebuilt	x	x
getAccount	x
getAccounts	x
getAdapter	x	x
getAdapterChangelogs	x	x
getAdapterHealth	x	x
getAdapterModelTypes	x	x
getAdapters	x	x
getAdapterSchema	x	x
getAdaptersHealth	x	x
getApplication	x	x
getApplicationChangelogs	x	x
getApplicationHealth	x	x
getApplications	x	x
getApplicationSchema	x	x
getApplicationsHealth	x	x
getAssignableRoles	x
getGroup	x
getGroups	x
getIntegration	x	x
getIntegrationModel	x	x
getIntegrationModels	x	x
getIntegrations	x	x
getIntegrationSchema	x	x
getPrebuilt	x	x
getPrebuilts	x	x
getProfile	x	x
getProfiles	x	x
getProfileSchema	x	x
getRepositoryPrebuilts	x	x
getServerHealth	x	x
getSystemHealth	x	x
importPrebuilt	x
removePrebuilt	x
restartAdapter	x
restartApplication	x
setAccountGroups	x
setAccountPassword	x
setGroupRoles	x
startAdapter	x
startApplication	x
stopAdapter	x
stopApplication	x
switchActiveProfile	x
updateAdapter	x
updateAdapterLogging	x
updateAdapterProperties	x
updateApplication	x
updateApplicationLogging	x
updateApplicationProperties	x
updateIntegration	x
updateIntegrationModel	x
updateIntegrationProperties	x
updatePrebuilt	x
updateProfile	x
validateIntegrationModel	x
validatePrebuilt	x

Form Builder

API Method/Task	admin	apiread	apiwrite	authorization	operator
createFormGroupEntry				x
deleteForm	x		x
deleteFormGroups				x
exportForm	x	x
fetchData	x		x		x
getElementDefinition	x	x			x
getForm	x	x			x
getFormByName	x	x			x
importForm	x		x
listElements	x	x			x
listFormGroups		x		x
listForms	x	x			x
preserveFormData	x	x			x
removeFormGroup				x
replaceFormGroups				x
saveForm	x		x
searchForms	x	x			x

	view	admin	engineering	operator
About	/dialog/about	x	x
Automation Studio	/edit	x
Show Form	/task/ShowForm	x		x
Show Form and Pop Yang Containers	/task/ShowFormPreserveData	x		x
Show Form and Set Dropdown List Values	/task/ProviderForm	x		x
Show Form by Name	/task/ShowFormByName	x		x

JSON Forms

API Method/Task	admin	apiread	other	readonly
createForm	x	x	x	x
deleteForms	x	x	x	x
getFormById	x	x	x	x
getForms	x	x	x	x
importForms	x	x	x	x
updateForm	x	x	x	x
validateData	x	x	x	x
validateForm	x	x	x	x
yangToSchema	x	x	x	x

	view	admin	operator
JSON Forms	/	x
Render JSON Schema	/task/RenderJsonSchema	x	x
Render Yang as JSON Form	/task/RenderYangForm	x	x
Show Json Form	/task/ShowJsonForm	x	x

JST

API Method/Task	admin	apiread	other	readonly
createTransformation	x	x	x	x
deleteTransformation	x	x	x	x
getTransformation	x	x	x	x
runTransformation	x	x	x	x
searchTransformations	x	x	x	x
updateTransformation	x	x	x	x

	view	designer
Automation Studio	/edit/jst	x

MOP

API Method/Task	admin	apiread	apiwrite	engineering	support
createAnalyticTemplate	x		x
createTemplate	x		x
deleteAnalyticTemplate	x		x
deleteTemplate	x		x
exportTemplate	x	x
GetBootFlash	x	x		x	x
getDeviceObjectsFiltered	x			x	x
getDevicesFiltered	x			x	x
getDevicesFilteredDetailedResults	x			x	x
importTemplate	x		x
listAnalyticTemplates	x	x		x	x
listAnAnalyticTemplate	x	x		x	x
listATemplate	x	x		x	x
listTemplates	x	x		x	x
passThru	x		x
reattempt	x		x	x	x
runAnalyticsTemplate	x		x	x	x
runAnalyticsTemplateDevices	x		x	x	x
RunCommand	x		x
RunCommandDevices	x		x
RunCommandTemplate	x		x
RunCommandTemplateSingleCommand	x		x
RunTemplateDevice	x		x
RunTemplateDevices	x		x
runTemplatesDiffArray	x		x	x	x
SetBoot	x		x
updateAnalyticTemplate	x		x
updateTemplate	x		x

	view	admin	engineering	support
About	/dialog/about	x	x
Automation Studio	/analytic	x	x	x
Automation Studio	/template	x	x	x
Choose Device	/task/chooseDevice	x	x	x
MOP confirm Task	/task/confirmTask	x	x	x
MOP Decision Task	/task/decisionTask	x	x	x
MOP Diff Config	/task/diffConfig	x	x	x
MOP Diff Config	/task/runTemplatesDiff	x	x	x
MOP Manual Task	/task/reloadFailed	x	x	x
MOP Review Summary	/task/reviewSummary	x	x	x
MOP Verify Config	/task/verifyConfig	x	x	x
Variable Selector	/modals/variableSelector	x	x	x
View MOP Template Results	/task/viewTemplateResults	x	x	x

NSO Manager

API Method/Task	admin	apiread	other	readonly
addLockItem	x
applyTemplates	x
deleteQueueItem	x
getAllAuthGroups	x
getAllNEDs	x	x	x	x
getAuthGroups	x
getCommitQueueDeep	x
getDevicesFiltered	x
getDevicesFilteredForAdapter	x
getNEDs	x
getNEDsDeep	x	x	x	x
getQueuedDevices	x
getQueueItemDetails	x
isAlive	x
liveStatus	x
lockQueueItem	x
pruneDevicesAllItems	x
pruneDevicesFromItem	x
restAction	x
restQuery	x
runAction	x
runCommand	x
runCommands	x
setItemNacmGroup	x
setLeaf	x
unlockQueueItem	x
verifyConfig	x		x

	view	admin
Add Device Form	/task/addDeviceForm	x
Commit Queue Manager	/commit_queue_manager	x
Ned Validator	/ned_inspector	x
Set Device Configuration	/task/SetDeviceConfiguration	x
User creates a list of devices from a given list of device options	/modal/devicePicker	x
View queue item details	/modal/itemDetails	x

Policy Manager

API Method/Task	admin	apiread	other	readonly
addRuleToPolicy	x	x	x	x
addRuleToTemplate	x	x	x	x
checkProposal	x	x	x	x
createNetwork	x	x	x	x
createNetworkGroup	x	x	x	x
createPolicy	x	x	x	x
createRuleTemplate	x	x	x	x
createSchedule	x	x	x	x
createService	x	x	x	x
createServiceGroup	x	x	x	x
deleteAdminSettings	x	x	x	x
deleteDevices	x	x	x	x
deleteIntegration	x	x	x	x
deleteNetworkGroups	x	x	x	x
deleteNetworks	x	x	x	x
deletePolicies	x	x	x	x
deleteRuleTemplates	x	x	x	x
deleteSchedules	x	x	x	x
deleteServiceGroups	x	x	x	x
deleteServices	x	x	x	x
getAdminSettings	x	x	x	x
getDeviceById	x	x	x	x
getDevices	x	x	x	x
getDevicesFiltered	x	x	x	x
getDeviceTargets	x	x	x	x
getIntegrations	x	x	x	x
getNetworkGroupById	x	x	x	x
getNetworkGroups	x	x	x	x
getNetworkGroupUsage	x	x	x	x
getNetworkRules	x	x	x	x
getNetworks	x	x	x	x
getNetworksAndGroups	x	x	x	x
getPolicies	x	x	x	x
getPolicyById	x	x	x	x
getPolicyTargets	x	x	x	x
getProtocolPort	x	x	x	x
getRuleTemplateById	x	x	x	x
getRuleTemplatePolicies	x	x	x	x
getRuleTemplates	x	x	x	x
getScheduleRules	x	x	x	x
getSchedules	x	x	x	x
getServiceGroupById	x	x	x	x
getServiceGroups	x	x	x	x
getServiceGroupUsage	x	x	x	x
getServiceRules	x	x	x	x
getServices	x	x	x	x
getServicesAndGroups	x	x	x	x
importIntegration	x	x	x	x
importPoliciesFromDevice	x	x	x	x
importPoliciesPreview	x	x	x	x
insertImportData	x	x	x	x
modifyPolicyRule	x	x	x	x
modifyTemplateRule	x	x	x	x
pushDryrun	x	x	x	x
pushToDevice	x	x	x	x
showRedundantRules	x	x	x	x
showRedundantRulesForRuleTemplate	x	x	x	x
updateAdminSettings	x	x	x	x
updateIntegration	x	x	x	x
updateNetwork	x	x	x	x
updateNetworkGroup	x	x	x	x
updatePolicy	x	x	x	x
updatePolicyRules	x	x	x	x
updateRuleTemplate	x	x	x	x
updateSchedule	x	x	x	x
updateService	x	x	x	x
updateServiceGroup	x	x	x	x
updateTargets	x	x	x	x
updateTemplateRules	x	x	x	x
validateIp	x	x	x	x
validateIpNetworks	x	x	x	x
validateIpv4Networks	x	x	x	x
validateIpv6Networks	x	x	x	x

	view	admin	taskwrite
Policy Manager	/	x
Preview Import	/task/PreviewImport	x	x
View Dryrun	/task/ViewDryrun	x	x

Service Catalog

API Method/Task	admin	apiread	apiwrite	engineering	support
AddNewServiceToCatalog	x		x	x	x
CreateServiceOrder	x		x	x	x
deleteService	x		x	x	x
GetFormData	x	x		x	x
GetFormId	x	x		x	x
GetForms	x	x		x	x
getGroups	x	x		x	x
GetUserObject	x	x		x	x
GetWorkflows	x	x		x	x
invokeServiceOrder	x	x		x	x
ServiceCatalogStore	x	x		x	x
ServiceModels	x	x		x	x
UpdateServiceInCatalog	x		x	x	x

	view	admin	engineering	operations
Service Catalog	/	x	x	x
Service Catalog Builder	/edit	x	x
Service Catalog Builder	/manage	x	x

Service Manager

API Method/Task	admin	apiread	apiwrite	engineering	support
addServiceInstance	x		x	x	x
addServiceInstances	x		x	x	x
checkSync	x	x		x	x
config	x	x		x	x
createServiceModelForm	x		x	x	x
deleteInstance	x			x	x
deleteInstances	x		x	x	x
deleteServiceModelFromDatabase	x		x	x	x
deleteServicePath	x		x	x	x
deleteServicePathDryRun	x	x		x	x
deleteServicePaths	x		x	x	x
deleteServicePathsDryRun	x	x		x	x
deviceModifications	x	x		x	x
dryrunServiceInstance	x	x		x	x
DryRunServiceWithFlags	x	x		x	x
getDevicesInServiceInstance	x	x		x	x
getInstance	x	x
getInstancesOfService	x	x		x	x
getMergedServiceModelFields	x	x		x	x
getServiceInstanceMap	x	x		x	x
getServiceInstanceObjectTemplate	x	x		x	x
getServiceModel	x	x		x	x
getServiceModelDatabase	x	x		x	x
getServiceModelFields	x	x		x	x
getServiceModelFieldsForGroup	x	x		x	x
getServiceModelMap	x	x		x	x
getServicesDetails	x	x		x	x
listServiceModels	x	x		x	x
mapInstanceDataToModel	x	x		x	x
reactiveRedeploy	x		x	x	x
saveInstance	x		x	x	x
saveInstances	x		x	x	x
setServiceInstanceTenant	x		x	x	x
testInstance	x	x		x	x
testInstances	x	x		x	x
updateNSOData	x		x	x	x
updateServiceModelDatabase	x		x	x	x

	view	admin	engineering	operations	support	taskread	taskwrite
Choose Hub-Site	/task/IWANChooseHub	x					x
Choose QOS	/task/IWANChooseQOS	x					x
Choose Site	/task/IWANChooseSite	x					x
Device Config	/deviceConfigDialog	x	x	x
Dry Run	/dryRunDialog	x	x	x
Dry Run	/task/DryRun	x					x
Out of Sync	/outOfSyncDialog	x	x	x
Service Manager	/	x	x
Service Manager	/cloned_form	x	x
Service Manager	/edit	x	x
Service Manager	/form	x	x
Service Manager	/instances	x	x
Service Manager	/list	x	x
Service Manager	/view	x	x
Set Fields For Group	/task/SetFieldsForGroup	x					x
Set Fields For Group	/task/SetGroupData	x					x
View Dry Run	/task/ViewDryRun	x				x
View Dry Run Results	/task/ViewDryRunService	x				x
View Dry Run Results	/task/ViewTestService	x			x	x	x
View Service Model	/task/ViewServiceModelForm	x				x

Task Worker

API Method/Task	admin
activate	x
deactivate	x
isActive	x

Template Builder

API Method/Task	admin	apiread	other	readonly
applyTemplates	x	x
createTemplate	x	x	x	x
deleteTemplate	x	x	x	x
duplicateTemplate	x	x	x	x
getTemplate	x	x	x	x
getTemplatesFiltered	x	x	x	x
importTemplate	x	x	x	x
parseTemplate	x	x	x	x
renderJinjaTemplate	x	x	x	x
templateDetails	x	x	x	x
templates	x	x	x	x
updateTemplate	x	x	x	x

Workflow Builder

API Method/Task	admin	apiread	apiwrite	authorization	engineering	support
createWorkflowGroupEntry				x
deleteWorkflow	x				x	x
deleteWorkflowGroups				x
exportWorkflow	x	x
getTaskDetails	x				x	x
getTasksList	x				x	x
importWorkflow	x		x
listWorkflowGroups		x		x
removeWorkflowGroup				x
renameWorkflow	x				x	x
replaceWorkflowGroups				x
saveWorkflow	x				x	x

	view	admin	engineering
About	/dialog/about	x	x
Add Event Listener	/editEventListener	x	x
Add New Job Variable	/editNewVariable	x	x
Automation Studio	/edit	x	x
Clone Workflow	/dialog/cloneWorkflow	x	x
Create Workflow	/dialog/createWorkflow	x	x
Edit Child Job	/editChildJob	x	x
Edit Deep Merge	/editDeepMerge	x	x
Edit Eval	/editEval	x	x
Edit Merge	/editMerge	x	x
Edit Push	/editPush	x	x
Edit Shift or Pop	/editShiftPop	x	x
Edit Task	/editTask	x	x
Edit Transformation	/editTransformation	x	x
Edit Transition	/editTransition	x	x
Job Description	/dialog/jobDescription	x	x
Reference Warning	/referenceWarn	x	x
Select Task	/dialog/selectTask	x	x
Set Variables	/dialog/setVariables	x	x
Test Task	/task/TestTask	x	x
View Schema	/viewSchema	x	x
Workflow Settings	/dialog/workflowSettings	x	x

Workflow Engine

API Method/Task	admin	apiread	apiwrite	authorization	engineering	support
activate	x
addDuration	x	x	x		x	x
addWatchers	x		x
arrayConcat	x
arrayIncludes	x
arrayIndexOf	x
arrayLastIndexOf	x
arrayLength	x
arrayPop	x
arrayPush	x
arrayShift	x
arraySlice	x
arrayToLocaleString	x
arrayToString	x
assign	x
calculateTimeDiff	x	x	x		x	x
calculateWorkflowSchema	x	x			x	x
cancelJob	x		x		x	x
charAt	x
charCodeAt	x
checkWorkflowForJobVariables	x	x			x	x
childJob	x		x
claimTask	x	x	x		x	x
codePointAt	x
convertEpochToObject	x	x	x		x	x
convertTimeFormat	x	x	x		x	x
convertTimeToEpoch	x	x	x		x	x
convertTimezone	x	x	x		x	x
copyWithin	x
createJobGroupEntry				x
deactivate	x
decision	x	x
deepmerge	x		x
delay	x		x
deleteJobGroups				x
diffToHTML	x
endsWith	x
evaluation	x	x
eventListener	x
eventListenerJob	x
extractField	x	x	x		x	x
fill	x
find	x	x
findForwardPaths	x	x			x	x
finishManualTask	x
fixJob	x		x
FlattenJSONFormInput	x				x
forEach	x		x
getAllLoopTasks	x	x
getAssociatedJobs	x	x
getEntireJob	x	x
getJob	x	x
getJobDeep	x	x
getJobDetails	x	x
getJobFromTaskQuery	x	x
getJobHistory	x	x
getJobList	x	x
getJobShallow	x	x
getJobVisualizationData	x	x			x	x
getManualTaskController	x	x			x	x
getTask	x	x
getTaskDetails	x	x
getTaskIterations	x	x
getTaskStatuses	x	x			x	x
getTime	x	x	x		x	x
getWorkflowsDetailedByName	x	x			x	x
isActive	x
isArray	x
join	x
keys	x
listJobGroups		x		x
localeCompare	x
makeData	x				x
map	x	x
match	x
merge	x		x
modify	x		x
newVariable	x		x
normalize	x
numberToString	x
objectHasOwnProperty	x
objectToString	x
padEnd	x
padStart	x
parse	x
parseInt	x
pauseJob	x		x
pop	x		x
prepareMetricsLogs	x	x
push	x		x
query	x	x
queryJobs	x	x
queryTasksBrief	x	x
releaseTask	x	x	x		x	x
removeJobGroup				x
repeat	x
replace	x
replaceJobGroups				x
restCall	x				x
resumeJob	x		x
returnCompletedTaskData	x	x			x	x
reverse	x
revertToTask	x		x
runEvaluationGroup	x		x
runEvaluationGroups	x		x
runValidation	x	x	x		x	x
search	x
searchJobs	x	x
searchTasks	x	x
searchWorkflows	x	x
setObjectKey	x
shift	x		x
sort	x
split	x
startJobWithOptions	x		x		x	x
startsWith	x
stringConcat	x
stringIncludes	x
stringIndexOf	x
stringLastIndexOf	x
stringLength	x
stringSlice	x
stringValueOf	x
stub	x				x
substring	x
toLocaleLowerCase	x
toLocaleUpperCase	x
toLowerCase	x
toUpperCase	x
transformation	x	x
trim	x
trimEnd	x
trimStart	x
unshift	x
unwatchJob	x		x
updateJobDescription	x		x
validateAllLoops	x	x
values	x
watchJob	x		x

	view	admin	engineering	operations
Active Jobs	/jobs	x	x
Active Tasks	/	x	x
Display Message with Data	/task/ViewData	x	x	x
Error Handling	/task/ErrorHandling	x	x
Job Manager	/job	x	x
Job Manager	/manager	x
Job Manager	/viewer	x
Review Job Errors	/dialog/JobErrors	x	x	x
Review Task Details	/dialog/TaskReview	x	x	x
Review Task Options	/dialog/TaskOptions	x	x	x
Task Manager	/task_manager	x
View Diff	/task/ViewDiff	x	x