swagger: "2.0"
schemes:
  - https
host: management.azure.com
info:
  description: Role based access control provides you a way to apply granular level policy administration down to individual resources or resource groups. These operations allow you to manage role definitions. A role definition describes the set of actions that can be performed on resources.
  title: AuthorizationManagementClient
  version: 2018-01-01-preview
  x-apisguru-categories:
    - cloud
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png
  x-origin:
    - format: swagger
      url: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/authorization/resource-manager/Microsoft.Authorization/preview/2018-01-01-preview/authorization-RoleDefinitionsCalls.json
      version: "2.0"
  x-preferred: true
  x-providerName: azure.com
  x-serviceName: authorization-authorization-RoleDefinitionsCalls
  x-tags:
    - Azure
    - Microsoft
consumes:
  - application/json
produces:
  - application/json
securityDefinitions:
  azure_auth:
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
    description: Azure Active Directory OAuth2 Flow
    flow: implicit
    scopes:
      user_impersonation: impersonate your user account
    type: oauth2
security:
  - azure_auth:
      - user_impersonation
parameters:
  ApiVersionParameter:
    description: The API version to use for this operation.
    in: query
    name: api-version
    required: true
    type: string
  FilterParameter:
    description: The filter to apply on the operation. Use $filter=atScope() to return all deny assignments at or above the scope. Use $filter=denyAssignmentName eq '{name}' to search deny assignments by name at specified scope. Use $filter=principalId eq '{id}' to return all deny assignments at, above and below the scope for the specified principal. Use $filter=gdprExportPrincipalId eq '{id}' to return all deny assignments at, above and below the scope for the specified principal. This filter is different from the principalId filter as it returns not only those deny assignments that contain the specified principal is the Principals list but also those deny assignments that contain the specified principal is the ExcludePrincipals list. Additionally, when gdprExportPrincipalId filter is used, only the deny assignment name and description properties are returned.
    in: query
    name: $filter
    required: false
    type: string
    x-ms-parameter-location: method
  ResourceGroupNameParameter:
    description: The name of the resource group.
    in: path
    name: resourceGroupName
    required: true
    type: string
    x-ms-parameter-location: method
  ResourceProviderNamespaceParameter:
    description: The namespace of the resource provider.
    in: path
    name: resourceProviderNamespace
    required: true
    type: string
    x-ms-parameter-location: method
  SubscriptionIdParameter:
    description: The ID of the target subscription.
    in: path
    name: subscriptionId
    required: true
    type: string
paths:
  "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Authorization/permissions":
    get:
      description: Gets all permissions the caller has for a resource group.
      operationId: Permissions_ListForResourceGroup
      parameters:
        - $ref: "#/parameters/ResourceGroupNameParameter"
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: OK - Returns an array of permissions.
          schema:
            $ref: "#/definitions/PermissionGetResult"
      tags:
        - Permissions
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2015-07-01
            resourceGroupName: rgname
            subscriptionId: subID
          responses:
            "200":
              body:
                nextLink: nextlink
                value:
                  - actions: []
                    dataActions: []
                    notActions: []
                    notDataActions: []
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{parentResourcePath}/{resourceType}/{resourceName}/providers/Microsoft.Authorization/permissions":
    get:
      description: Gets all permissions the caller has for a resource.
      operationId: Permissions_ListForResource
      parameters:
        - $ref: "#/parameters/ResourceGroupNameParameter"
        - $ref: "#/parameters/ResourceProviderNamespaceParameter"
        - description: The parent resource identity.
          in: path
          name: parentResourcePath
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The resource type of the resource.
          in: path
          name: resourceType
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The name of the resource to get the permissions for.
          in: path
          name: resourceName
          required: true
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: OK - Returns an array of permissions.
          schema:
            $ref: "#/definitions/PermissionGetResult"
      tags:
        - Permissions
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2015-07-01
            parentResourcePath: parentResourcePath
            resourceGroupName: rgname
            resourceName: resourceName
            resourceProviderNamespace: rpnamespace
            resourceType: resourceType
            subscriptionId: subId
          responses:
            "200":
              body:
                value:
                  - actions: []
                    notActions: []
      x-ms-pageable:
        nextLinkName: nextLink
  "/{scope}/providers/Microsoft.Authorization/roleDefinitions":
    get:
      description: Get all role definitions that are applicable at scope and above.
      operationId: RoleDefinitions_List
      parameters:
        - description: The scope of the role definition.
          in: path
          name: scope
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The filter to apply on the operation. Use atScopeAndBelow filter to search below the given scope as well.
          in: query
          name: $filter
          required: false
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: OK - Returns an array of role definitions.
          schema:
            $ref: "#/definitions/RoleDefinitionListResult"
      tags:
        - RoleDefinitions
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-01-01-preview
            scope: scope
          responses:
            "200":
              body:
                value:
                  - id: /subscriptions/subID/providers/Microsoft.Authorization/roleDefinitions/roleDefinitionId
                    name: roleDefinitionId
                    properties:
                      assignableScopes:
                        - /subscriptions/subId
                      description: Role description
                      permissions:
                        - actions:
                            - action
                          dataActions:
                            - dataAction
                          notActions: []
                          notDataActions: []
                      roleName: Role name
                      type: roletype
                    type: Microsoft.Authorization/roleDefinitions
      x-ms-odata: "#/definitions/RoleDefinitionFilter"
      x-ms-pageable:
        nextLinkName: nextLink
  "/{scope}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId}":
    delete:
      description: Deletes a role definition.
      operationId: RoleDefinitions_Delete
      parameters:
        - description: The scope of the role definition.
          in: path
          name: scope
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The ID of the role definition to delete.
          in: path
          name: roleDefinitionId
          required: true
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: OK - Returns information about the role definition.
          schema:
            $ref: "#/definitions/RoleDefinition"
      tags:
        - RoleDefinitions
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-01-01-preview
            roleDefinitionId: roleDefinitionId
            scope: scope
          responses:
            "200":
              body:
                id: /subscriptions/subID/providers/Microsoft.Authorization/roleDefinitions/roleDefinitionId
                name: roleDefinitionId
                properties:
                  assignableScopes:
                    - /subscriptions/subId
                  description: Role description
                  permissions:
                    - actions:
                        - action
                      dataActions:
                        - dataAction
                      notActions: []
                      notDataActions: []
                  roleName: Role name
                  type: roletype
                type: Microsoft.Authorization/roleDefinitions
    get:
      description: Get role definition by name (GUID).
      operationId: RoleDefinitions_Get
      parameters:
        - description: The scope of the role definition.
          in: path
          name: scope
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The ID of the role definition.
          in: path
          name: roleDefinitionId
          required: true
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: OK - Returns information about the role definition.
          schema:
            $ref: "#/definitions/RoleDefinition"
      tags:
        - RoleDefinitions
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-01-01-preview
            roleDefinitionId: roleDefinitionId
            scope: scope
          responses:
            "200":
              body:
                id: /subscriptions/subID/providers/Microsoft.Authorization/roleDefinitions/roleDefinitionId
                name: roleDefinitionId
                properties:
                  assignableScopes:
                    - /subscriptions/subId
                  description: Role description
                  permissions:
                    - actions:
                        - action
                      dataActions:
                        - dataAction
                      notActions: []
                      notDataActions: []
                  roleName: Role name
                  type: roletype
                type: Microsoft.Authorization/roleDefinitions
    put:
      description: Creates or updates a role definition.
      operationId: RoleDefinitions_CreateOrUpdate
      parameters:
        - description: The scope of the role definition.
          in: path
          name: scope
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The ID of the role definition.
          in: path
          name: roleDefinitionId
          required: true
          type: string
        - description: The values for the role definition.
          in: body
          name: roleDefinition
          required: true
          schema:
            $ref: "#/definitions/RoleDefinition"
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "201":
          description: OK - Returns information about the role definition.
          schema:
            $ref: "#/definitions/RoleDefinition"
      tags:
        - RoleDefinitions
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-01-01-preview
            body:
              roleDefinition:
                assignableScopes:
                  - /subscriptions/subId
                description: Role description
                id: /subscriptions/subID/providers/Microsoft.Authorization/roleDefinitions/roleDefinitionId
                name: roleDefinitionId
                permissions:
                  - actions:
                      - action
                    dataActions:
                      - dataAction
                    notActions: []
                    notDataActions: []
                roleName: Role name
                type: Microsoft.Authorization/roleDefinitions
            roleDefinition: {}
            roleDefinitionId: roleDefinitionId
            scope: scope
          responses:
            "201":
              body:
                id: /subscriptions/subID/providers/Microsoft.Authorization/roleDefinitions/roleDefinitionId
                name: roleDefinitionId
                properties:
                  assignableScopes:
                    - /subscriptions/subId
                  description: Role description
                  permissions:
                    - actions:
                        - action
                      dataActions:
                        - dataAction
                      notActions: []
                      notDataActions: []
                  roleName: Role name
                  type: roletype
                type: Microsoft.Authorization/roleDefinitions
definitions:
  Permission:
    description: Role definition permissions.
    properties:
      actions:
        description: Allowed actions.
        items:
          type: string
        type: array
      dataActions:
        description: Allowed Data actions.
        items:
          type: string
        type: array
      notActions:
        description: Denied actions.
        items:
          type: string
        type: array
      notDataActions:
        description: Denied Data actions.
        items:
          type: string
        type: array
  PermissionGetResult:
    description: Permissions information.
    properties:
      nextLink:
        description: The URL to use for getting the next set of results.
        type: string
      value:
        description: An array of permissions.
        items:
          $ref: "#/definitions/Permission"
        type: array
  RoleDefinition:
    description: Role definition.
    properties:
      id:
        description: The role definition ID.
        readOnly: true
        type: string
      name:
        description: The role definition name.
        readOnly: true
        type: string
      properties:
        $ref: "#/definitions/RoleDefinitionProperties"
        description: Role definition properties.
        x-ms-client-flatten: true
      type:
        description: The role definition type.
        readOnly: true
        type: string
  RoleDefinitionFilter:
    description: Role Definitions filter
    properties:
      roleName:
        description: Returns role definition with the specific name.
        type: string
      type:
        description: Returns role definition with the specific type.
        type: string
  RoleDefinitionListResult:
    description: Role definition list operation result.
    properties:
      nextLink:
        description: The URL to use for getting the next set of results.
        type: string
      value:
        description: Role definition list.
        items:
          $ref: "#/definitions/RoleDefinition"
        type: array
  RoleDefinitionProperties:
    description: Role definition properties.
    properties:
      assignableScopes:
        description: Role definition assignable scopes.
        items:
          type: string
        type: array
      description:
        description: The role definition description.
        type: string
      permissions:
        description: Role definition permissions.
        items:
          $ref: "#/definitions/Permission"
        type: array
      roleName:
        description: The role name.
        type: string
      type:
        description: The role type.
        type: string
        x-ms-client-name: roleType
x-ms-paths:
  "/{roleId}?disambiguation_dummy":
    get:
      description: Gets a role definition by ID.
      operationId: RoleDefinitions_GetById
      parameters:
        - description: The fully qualified role definition ID. Use the format, /subscriptions/{guid}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId} for subscription level role definitions, or /providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId} for tenant level role definitions.
          in: path
          name: roleId
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: OK - Returns information about the role definition.
          schema:
            $ref: "#/definitions/RoleDefinition"
      tags:
        - RoleDefinitions
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-01-01-preview
            roleId: roleDefinitionId
          responses:
            "200":
              body:
                id: /subscriptions/subID/providers/Microsoft.Authorization/roleDefinitions/roleDefinitionId
                name: roleDefinitionId
                properties:
                  assignableScopes:
                    - /subscriptions/subId
                  description: Role description
                  permissions:
                    - actions:
                        - action
                      dataActions:
                        - dataAction
                      notActions: []
                      notDataActions: []
                  roleName: Role name
                  type: roletype
                type: Microsoft.Authorization/roleDefinitions
