swagger: "2.0"
schemes:
  - https
host: management.azure.com
info:
  description: Role based access control provides you a way to apply granular level policy administration down to individual resources or resource groups. These operations enable you to manage role assignments. A role assignment grants access to Azure Active Directory users.
  title: AuthorizationManagementClient
  version: 2018-09-01-preview
  x-apisguru-categories:
    - cloud
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png
  x-origin:
    - format: swagger
      url: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/authorization/resource-manager/Microsoft.Authorization/preview/2018-09-01-preview/authorization-RoleAssignmentsCalls.json
      version: "2.0"
  x-preferred: true
  x-providerName: azure.com
  x-serviceName: authorization-authorization-RoleAssignmentsCalls
  x-tags:
    - Azure
    - Microsoft
consumes:
  - application/json
produces:
  - application/json
securityDefinitions:
  azure_auth:
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
    description: Azure Active Directory OAuth2 Flow
    flow: implicit
    scopes:
      user_impersonation: impersonate your user account
    type: oauth2
security:
  - azure_auth:
      - user_impersonation
parameters:
  ApiVersionParameter:
    description: The API version to use for this operation.
    in: query
    name: api-version
    required: true
    type: string
  ResourceGroupNameParameter:
    description: The name of the resource group.
    in: path
    name: resourceGroupName
    required: true
    type: string
    x-ms-parameter-location: method
  ResourceProviderNamespaceParameter:
    description: The namespace of the resource provider.
    in: path
    name: resourceProviderNamespace
    required: true
    type: string
    x-ms-parameter-location: method
  SubscriptionIdParameter:
    description: The ID of the target subscription.
    in: path
    name: subscriptionId
    required: true
    type: string
paths:
  "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments":
    get:
      description: Gets all role assignments for the subscription.
      operationId: RoleAssignments_List
      parameters:
        - description: The filter to apply on the operation. Use $filter=atScope() to return all role assignments at or above the scope. Use $filter=principalId eq {id} to return all role assignments at, above or below the scope for the specified principal.
          in: query
          name: $filter
          required: false
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: OK - Returns an array of role assignments.
          schema:
            $ref: "#/definitions/RoleAssignmentListResult"
      tags:
        - RoleAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-09-01-preview
            subscriptionId: subId
          responses:
            "200":
              body:
                value:
                  - id: /subscriptions/subId/resourcegroups/rgname/providers/Microsoft.Authorization/roleAssignments/roleassignmentId
                    name: raId
                    properties:
                      canDelegate: false
                      principalId: Pid
                      principalType: Ptype
                      roleDefinitionId: /subscriptions/subId/providers/Microsoft.Authorization/roleDefinitions/roledefinitionId
                      scope: /subscriptions/subId/resourcegroups/rgname
                    type: Microsoft.Authorization/roleAssignments
      x-ms-odata: "#/definitions/RoleAssignmentFilter"
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/roleAssignments":
    get:
      description: Gets role assignments for a resource group.
      operationId: RoleAssignments_ListForResourceGroup
      parameters:
        - $ref: "#/parameters/ResourceGroupNameParameter"
        - description: The filter to apply on the operation. Use $filter=atScope() to return all role assignments at or above the scope. Use $filter=principalId eq {id} to return all role assignments at, above or below the scope for the specified principal.
          in: query
          name: $filter
          required: false
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: OK - Returns an array of role assignments.
          schema:
            $ref: "#/definitions/RoleAssignmentListResult"
      tags:
        - RoleAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-09-01-preview
            resourceGroupName: rgname
            subscriptionId: subId
          responses:
            "200":
              body:
                value:
                  - id: /subscriptions/subId/resourcegroups/rgname/providers/Microsoft.Authorization/roleAssignments/roleassignmentId
                    name: raId
                    properties:
                      canDelegate: false
                      principalId: Pid
                      principalType: Ptype
                      roleDefinitionId: /subscriptions/subId/providers/Microsoft.Authorization/roleDefinitions/roledefinitionId
                      scope: /subscriptions/subId/resourcegroups/rgname
                    type: Microsoft.Authorization/roleAssignments
      x-ms-odata: "#/definitions/RoleAssignmentFilter"
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{parentResourcePath}/{resourceType}/{resourceName}/providers/Microsoft.Authorization/roleAssignments":
    get:
      description: Gets role assignments for a resource.
      operationId: RoleAssignments_ListForResource
      parameters:
        - $ref: "#/parameters/ResourceGroupNameParameter"
        - $ref: "#/parameters/ResourceProviderNamespaceParameter"
        - description: The parent resource identity.
          in: path
          name: parentResourcePath
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The resource type of the resource.
          in: path
          name: resourceType
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The name of the resource to get role assignments for.
          in: path
          name: resourceName
          required: true
          type: string
        - description: The filter to apply on the operation. Use $filter=atScope() to return all role assignments at or above the scope. Use $filter=principalId eq {id} to return all role assignments at, above or below the scope for the specified principal.
          in: query
          name: $filter
          required: false
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: OK - Returns an array of role assignments.
          schema:
            $ref: "#/definitions/RoleAssignmentListResult"
      tags:
        - RoleAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-09-01-preview
            parentResourcePath: parentResourcePath
            resourceGroupName: rgname
            resourceName: resourceName
            resourceProviderNamespace: resourceProviderNamespace
            resourceType: resourceType
            subscriptionId: subId
          responses:
            "200":
              body:
                value:
                  - id: /subscriptions/subId/resourcegroups/rgname/providers/Microsoft.Authorization/roleAssignments/roleassignmentId
                    name: raId
                    properties:
                      canDelegate: false
                      principalId: Pid
                      principalType: Ptype
                      roleDefinitionId: /subscriptions/subId/providers/Microsoft.Authorization/roleDefinitions/roledefinitionId
                      scope: /subscriptions/subId/resourcegroups/rgname
                    type: Microsoft.Authorization/roleAssignments
      x-ms-odata: "#/definitions/RoleAssignmentFilter"
      x-ms-pageable:
        nextLinkName: nextLink
  "/{roleId}":
    delete:
      description: Deletes a role assignment.
      operationId: RoleAssignments_DeleteById
      parameters:
        - description: The ID of the role assignment to delete.
          in: path
          name: roleId
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: OK - Returns information about the role assignment.
          schema:
            $ref: "#/definitions/RoleAssignment"
      tags:
        - RoleAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-09-01-preview
            roleId: roleAssignmentId
            scope: scope
          responses:
            "200":
              body:
                id: /subscriptions/subId/resourcegroups/rgname/providers/Microsoft.Authorization/roleAssignments/roleassignmentId
                name: roleassignmentId
                properties:
                  canDelegate: false
                  principalId: Pid
                  principalType: Ptype
                  roleDefinitionId: /subscriptions/subId/providers/Microsoft.Authorization/roleDefinitions/roledefinitionId
                  scope: /subscriptions/subId/resourcegroups/rgname
                type: Microsoft.Authorization/roleAssignments
    get:
      description: Gets a role assignment by ID.
      operationId: RoleAssignments_GetById
      parameters:
        - description: The ID of the role assignment to get.
          in: path
          name: roleId
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: OK - Returns the role assignment.
          schema:
            $ref: "#/definitions/RoleAssignment"
      tags:
        - RoleAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-09-01-preview
            roleId: roleassignmentId
          responses:
            "200":
              body:
                id: /subscriptions/subId/resourcegroups/rgname/providers/Microsoft.Authorization/roleAssignments/roleassignmentId
                name: roleassignmentId
                properties:
                  canDelegate: false
                  principalId: Pid
                  principalType: Ptype
                  roleDefinitionId: /subscriptions/subId/providers/Microsoft.Authorization/roleDefinitions/roledefinitionId
                  scope: /subscriptions/subId/resourcegroups/rgname
                type: Microsoft.Authorization/roleAssignments
    put:
      description: Creates a role assignment by ID.
      operationId: RoleAssignments_CreateById
      parameters:
        - description: The ID of the role assignment to create.
          in: path
          name: roleId
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: Parameters for the role assignment.
          in: body
          name: parameters
          required: true
          schema:
            $ref: "#/definitions/RoleAssignmentCreateParameters"
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "201":
          description: Created - Returns the role assignment.
          schema:
            $ref: "#/definitions/RoleAssignment"
      tags:
        - RoleAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-09-01-preview
            parameters:
              properties:
                canDelegate: false
                principalId: d93a38bc-d029-4160-bfb0-fbda779ac214
                principalType: User
                roleDefinitionId: /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/providers/Microsoft.Authorization/roleDefinitions/de139f84-1756-47ae-9be6-808fbbe84772
            roleId: roleAssignmentId
            scope: scope
          responses:
            "201":
              body:
                id: /subscriptions/subId/resourcegroups/rgname/providers/Microsoft.Authorization/roleAssignments/roleassignmentId
                name: roleassignmentId
                properties:
                  canDelegate: false
                  principalId: Pid
                  principalType: Ptype
                  roleDefinitionId: /subscriptions/subId/providers/Microsoft.Authorization/roleDefinitions/roledefinitionId
                  scope: /subscriptions/subId/resourcegroups/rgname
                type: Microsoft.Authorization/roleAssignments
  "/{scope}/providers/Microsoft.Authorization/roleAssignments":
    get:
      description: Gets role assignments for a scope.
      operationId: RoleAssignments_ListForScope
      parameters:
        - description: The scope of the role assignments.
          in: path
          name: scope
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The filter to apply on the operation. Use $filter=atScope() to return all role assignments at or above the scope. Use $filter=principalId eq {id} to return all role assignments at, above or below the scope for the specified principal.
          in: query
          name: $filter
          required: false
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: OK - Returns an array of role assignments.
          schema:
            $ref: "#/definitions/RoleAssignmentListResult"
      tags:
        - RoleAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-09-01-preview
            scope: scope
          responses:
            "200":
              body:
                value:
                  - id: /subscriptions/subId/resourcegroups/rgname/providers/Microsoft.Authorization/roleAssignments/roleassignmentId
                    name: raId
                    properties:
                      canDelegate: false
                      principalId: Pid
                      principalType: Ptype
                      roleDefinitionId: /subscriptions/subId/providers/Microsoft.Authorization/roleDefinitions/roledefinitionId
                      scope: /subscriptions/subId/resourcegroups/rgname
                    type: Microsoft.Authorization/roleAssignments
      x-ms-odata: "#/definitions/RoleAssignmentFilter"
      x-ms-pageable:
        nextLinkName: nextLink
  "/{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentName}":
    delete:
      description: Deletes a role assignment.
      operationId: RoleAssignments_Delete
      parameters:
        - description: The scope of the role assignment to delete.
          in: path
          name: scope
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The name of the role assignment to delete.
          in: path
          name: roleAssignmentName
          required: true
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: OK - Returns information about the role assignment.
          schema:
            $ref: "#/definitions/RoleAssignment"
      tags:
        - RoleAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-09-01-preview
            roleAssignmentName: roleAssignmentName
            scope: scope
          responses:
            "200":
              body:
                id: /subscriptions/subId/resourcegroups/rgname/providers/Microsoft.Authorization/roleAssignments/roleassignmentId
                name: roleassignmentId
                properties:
                  canDelegate: false
                  principalId: Pid
                  principalType: Ptype
                  roleDefinitionId: /subscriptions/subId/providers/Microsoft.Authorization/roleDefinitions/roledefinitionId
                  scope: /subscriptions/subId/resourcegroups/rgname
                type: Microsoft.Authorization/roleAssignments
    get:
      description: Get the specified role assignment.
      operationId: RoleAssignments_Get
      parameters:
        - description: The scope of the role assignment.
          in: path
          name: scope
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The name of the role assignment to get.
          in: path
          name: roleAssignmentName
          required: true
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: OK - Returns information about the role assignment.
          schema:
            $ref: "#/definitions/RoleAssignment"
      tags:
        - RoleAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-09-01-preview
            roleAssignmentName: roleAssignmentName
            scope: scope
            subscriptionId: subId
          responses:
            "200":
              body:
                id: /subscriptions/subId/resourcegroups/rgname/providers/Microsoft.Authorization/roleAssignments/roleassignmentId
                name: raId
                properties:
                  canDelegate: false
                  principalId: Pid
                  principalType: Ptype
                  roleDefinitionId: /subscriptions/subId/providers/Microsoft.Authorization/roleDefinitions/roledefinitionId
                  scope: /subscriptions/subId/resourcegroups/rgname
                type: Microsoft.Authorization/roleAssignments
    put:
      description: Creates a role assignment.
      operationId: RoleAssignments_Create
      parameters:
        - description: The scope of the role assignment to create. The scope can be any REST resource instance. For example, use '/subscriptions/{subscription-id}/' for a subscription, '/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}' for a resource group, and '/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/{resource-provider}/{resource-type}/{resource-name}' for a resource.
          in: path
          name: scope
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The name of the role assignment to create. It can be any valid GUID.
          in: path
          name: roleAssignmentName
          required: true
          type: string
        - description: Parameters for the role assignment.
          in: body
          name: parameters
          required: true
          schema:
            $ref: "#/definitions/RoleAssignmentCreateParameters"
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "201":
          description: Created - Returns information about the role assignment.
          schema:
            $ref: "#/definitions/RoleAssignment"
      tags:
        - RoleAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-09-01-preview
            parameters:
              properties:
                canDelegate: false
                principalId: d93a38bc-d029-4160-bfb0-fbda779ac214
                principalType: User
                roleDefinitionId: /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/providers/Microsoft.Authorization/roleDefinitions/de139f84-1756-47ae-9be6-808fbbe84772
            roleAssignmentName: roleAssignmentName
            scope: scope
          responses:
            "201":
              body:
                id: /subscriptions/subId/resourcegroups/rgname/providers/Microsoft.Authorization/roleAssignments/roleassignmentId
                name: roleassignmentId
                properties:
                  canDelegate: false
                  principalId: Pid
                  principalType: Ptype
                  roleDefinitionId: /subscriptions/subId/providers/Microsoft.Authorization/roleDefinitions/roledefinitionId
                  scope: /subscriptions/subId/resourcegroups/rgname
                type: Microsoft.Authorization/roleAssignments
definitions:
  RoleAssignment:
    description: Role Assignments
    properties:
      id:
        description: The role assignment ID.
        readOnly: true
        type: string
      name:
        description: The role assignment name.
        readOnly: true
        type: string
      properties:
        $ref: "#/definitions/RoleAssignmentPropertiesWithScope"
        description: Role assignment properties.
        x-ms-client-flatten: true
      type:
        description: The role assignment type.
        readOnly: true
        type: string
  RoleAssignmentCreateParameters:
    description: Role assignment create parameters.
    properties:
      properties:
        $ref: "#/definitions/RoleAssignmentProperties"
        description: Role assignment properties.
        x-ms-client-flatten: true
    required:
      - properties
  RoleAssignmentFilter:
    description: Role Assignments filter
    properties:
      canDelegate:
        description: The Delegation flag for the role assignment
        type: boolean
      principalId:
        description: Returns role assignment of the specific principal.
        type: string
  RoleAssignmentListResult:
    description: Role assignment list operation result.
    properties:
      nextLink:
        description: The URL to use for getting the next set of results.
        type: string
      value:
        description: Role assignment list.
        items:
          $ref: "#/definitions/RoleAssignment"
        type: array
  RoleAssignmentProperties:
    description: Role assignment properties.
    properties:
      canDelegate:
        description: The delegation flag used for creating a role assignment
        type: boolean
      principalId:
        description: The principal ID assigned to the role. This maps to the ID inside the Active Directory. It can point to a user, service principal, or security group.
        type: string
      principalType:
        description: The principal type of the assigned principal ID.
        enum:
          - User
          - Group
          - ServicePrincipal
          - Unknown
          - DirectoryRoleTemplate
          - ForeignGroup
          - Application
          - MSI
          - DirectoryObjectOrGroup
          - Everyone
        type: string
        x-ms-enum:
          modelAsString: true
          name: PrincipalType
      roleDefinitionId:
        description: The role definition ID used in the role assignment.
        type: string
    required:
      - roleDefinitionId
      - principalId
  RoleAssignmentPropertiesWithScope:
    description: Role assignment properties with scope.
    properties:
      canDelegate:
        description: The Delegation flag for the role assignment
        type: boolean
      principalId:
        description: The principal ID.
        type: string
      principalType:
        description: The principal type of the assigned principal ID.
        enum:
          - User
          - Group
          - ServicePrincipal
          - Unknown
          - DirectoryRoleTemplate
          - ForeignGroup
          - Application
          - MSI
          - DirectoryObjectOrGroup
          - Everyone
        type: string
        x-ms-enum:
          modelAsString: true
          name: PrincipalType
      roleDefinitionId:
        description: The role definition ID.
        type: string
      scope:
        description: The role assignment scope.
        type: string
