Access rules

Access rules provide user authorization to system resources and entities. It is managed using Role-based access control (RBAC) which is a policy-neutral access control mechanism defined around roles and privileges. The components of RBAC make it simple to manage access to system resources and entities. For more information, see Access control.

List the access rules.

get

Retrieve a list of access rules.

Authorizations

bearerAuth

AuthorizationstringRequired

Bearer authentication

Query parameters

subjectTypestringOptional

The type of resource we want to filter by.

Example: user

subjectIdFilterstringOptionalDeprecated

Part of the subject id that we want to filter by.

Example: some.user

subjectIdsstring[]Optional

The ids of the subjects to filter the response for.

Example: [email protected]

limitinteger · int32 · min: 1 · max: 500Optional

The maximum number of entries to return.

Default: 50

offsetinteger · int32Optional

The offset of the first item returned in the collection.

Example: 100

lastUpdatedstringOptional

Filter by last update time.

Example: 2021-12-14T16:04:15.099Z

includeDeletedbooleanOptional

True to include deleted objects in the result.

Default: falseExample: false

clusterIdstring · uuidOptional

Filter using the Universally Unique Identifier (UUID) of the cluster.

Example: d73a738f-fab3-430a-8fa3-5241493d7128

scopeTypestringOptionalDeprecated

The type of resource we want to filter by.

Example: project

scopeIdstringOptional

The scope resource id that we want to filter by.

Example: 2

roleIdinteger · int32 · min: 1OptionalDeprecated

The role id we want to filter by.

sortOrderstring · enumOptional

Sort results in descending or ascending order.

Default: ascPossible values:

sortBystring · enumOptional

Sort results by a parameter.

Possible values:

filterBystring[]Optional

Filter results by a parameter. Use the format field-name operator value. Operators are == Equals, != Not equals, <= Less than or equal, >= Greater than or equal, =@ contains, !@ Does not contains, =^ Starts with and =$ Ends with. Dates are in ISO 8601 timestamp format and available for operators ==, !=, <= and >=.

Example: ["name!=some-access-rule-name","createdAt>=2023-01-01T00:00:00Z"]

Responses

200

Executed successfully.

application/json

401

Unauthorized

application/json

403

Forbidden

application/json

500

unexpected error

application/json

503

unexpected error

application/json

get

/api/v1/authorization/access-rules

HTTPcURLJavaScriptPython

GET /api/v1/authorization/access-rules HTTP/1.1
Host: app.run.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "totalRecords": 1,
  "displayRecords": 1,
  "accessRules": [
    {
      "subjectId": "[email protected]",
      "subjectType": "user",
      "roleId": 53142648,
      "scopeId": "a418ed33-9399-48c0-a890-122cadd13bfd",
      "scopeType": "system",
      "clusterId": "71f69d83-ba66-4822-adf5-55ce55efd210",
      "roleName": "admin",
      "scopeName": "tenant-x",
      "id": 32,
      "createdAt": "2026-02-08T07:18:14.064Z",
      "updatedAt": "2026-02-08T07:18:14.064Z",
      "deletedAt": "2026-02-08T07:18:14.064Z",
      "tenantId": 1001,
      "createdBy": "[email protected]"
    }
  ]
}

Create an access rule.

post

Use to bind a predefined role to a subject (user, group or application) in a scope.

Authorizations

bearerAuth

AuthorizationstringRequired

Bearer authentication

Body

application/json

subjectIdstringRequiredExample: [email protected]

subjectTypestring · enumRequiredPossible values:

roleIdinteger · int32RequiredExample: 53142648

scopeIdstringRequiredExample: a418ed33-9399-48c0-a890-122cadd13bfd

scopeTypestring · enumRequiredPossible values:

clusterIdstring · uuidOptional

The id of the cluster.

Example: 71f69d83-ba66-4822-adf5-55ce55efd210

Responses

201

Created

application/json

400

Bad request.

application/json

401

Unauthorized

application/json

403

Forbidden

application/json

404

The specified resource was not found

application/json

500

unexpected error

application/json

503

unexpected error

application/json

post

/api/v1/authorization/access-rules

HTTPcURLJavaScriptPython

POST /api/v1/authorization/access-rules HTTP/1.1
Host: app.run.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 187

{
  "subjectId": "[email protected]",
  "subjectType": "user",
  "roleId": 53142648,
  "scopeId": "a418ed33-9399-48c0-a890-122cadd13bfd",
  "scopeType": "system",
  "clusterId": "71f69d83-ba66-4822-adf5-55ce55efd210"
}

{
  "subjectId": "[email protected]",
  "subjectType": "user",
  "roleId": 53142648,
  "scopeId": "a418ed33-9399-48c0-a890-122cadd13bfd",
  "scopeType": "system",
  "clusterId": "71f69d83-ba66-4822-adf5-55ce55efd210",
  "roleName": "admin",
  "scopeName": "tenant-x",
  "id": 32,
  "createdAt": "2026-02-08T07:18:14.064Z",
  "updatedAt": "2026-02-08T07:18:14.064Z",
  "deletedAt": "2026-02-08T07:18:14.064Z",
  "tenantId": 1001,
  "createdBy": "[email protected]"
}

Get an access rule.

get

Use to retrieve the details of an access rule by id.

Authorizations

bearerAuth

AuthorizationstringRequired

Bearer authentication

Path parameters

accessRuleIdinteger · int32Required

The id of the access rule to retrieve

Example: 32

Responses

200

Executed successfully.

application/json

401

Unauthorized

application/json

403

Forbidden

application/json

404

The specified resource was not found

application/json

500

unexpected error

application/json

503

unexpected error

application/json

get

/api/v1/authorization/access-rules/{accessRuleId}

HTTPcURLJavaScriptPython

GET /api/v1/authorization/access-rules/{accessRuleId} HTTP/1.1
Host: app.run.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "subjectId": "[email protected]",
  "subjectType": "user",
  "roleId": 53142648,
  "scopeId": "a418ed33-9399-48c0-a890-122cadd13bfd",
  "scopeType": "system",
  "clusterId": "71f69d83-ba66-4822-adf5-55ce55efd210",
  "roleName": "admin",
  "scopeName": "tenant-x",
  "id": 32,
  "createdAt": "2026-02-08T07:18:14.064Z",
  "updatedAt": "2026-02-08T07:18:14.064Z",
  "deletedAt": "2026-02-08T07:18:14.064Z",
  "tenantId": 1001,
  "createdBy": "[email protected]",
  "scopePath": "runai/production-cluster/dep-42/prj-73"
}

Delete an access rule.

delete

Use to delete the subject permissions assigned by access rule id.

Authorizations

bearerAuth

AuthorizationstringRequired

Bearer authentication

Path parameters

accessRuleIdinteger · int32Required

The id of the access rule to retrieve

Example: 32

Responses

204

No Content.

401

Unauthorized

application/json

403

Forbidden

application/json

404

The specified resource was not found

application/json

500

unexpected error

application/json

503

unexpected error

application/json

delete

/api/v1/authorization/access-rules/{accessRuleId}

HTTPcURLJavaScriptPython

DELETE /api/v1/authorization/access-rules/{accessRuleId} HTTP/1.1
Host: app.run.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Count access rules.

get

Use to retrieve the number of access rules.

Authorizations

bearerAuth

AuthorizationstringRequired

Bearer authentication

Query parameters

includeDeletedbooleanOptional

True to include deleted objects in the result.

Default: falseExample: false

filterBystring[]Optional

Filter results by a parameter. Use the format field-name operator value. Operators are == Equals, != Not equals, <= Less than or equal, >= Greater than or equal, =@ contains, !@ Does not contains, =^ Starts with and =$ Ends with. Dates are in ISO 8601 timestamp format and available for operators ==, !=, <= and >=.

Example: ["name!=some-access-rule-name","createdAt>=2023-01-01T00:00:00Z"]

Responses

200

Executed successfully.

application/json

400

Bad request.

application/json

401

Unauthorized

application/json

403

Forbidden

application/json

500

unexpected error

application/json

503

unexpected error

application/json

get

/api/v1/authorization/access-rules/count

HTTPcURLJavaScriptPython

GET /api/v1/authorization/access-rules/count HTTP/1.1
Host: app.run.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "count": 1
}