/
Permissions Required to Invoke Admin Services

This site contains the documentation that is relevant to older WSO2 product versions and offerings.
For the latest WSO2 documentation, visit https://wso2.com/documentation/.

Permissions Required to Invoke Admin Services

Feb 01, 2017

The following table lists out the various operations that can be performed with different permission levels.

Permission level

Service

Operations

Tenant level permissions

/admin

UserStoreConfigAdminService

  • addUserStore

  • changeUserStoreState

  • deleteUserStore

  • deleteUserStoresSet

  • editUserStore

  • editUserStoreWithDomainName

  • getAvailableUserStoreClasses

  • getSecondaryRealmConfigurations

  • getUserStoreManagerProperties

/admin/configure 

EntitlementAdminService

  • clearAllAttributeCaches

  • clearAllResourceCaches

  • clearAttributeFinderCache

  • clearAttributeFinderCacheByAttributes

  • clearCarbonAttributeCache

  • clearCarbonResourceCache

  • clearDecisionCache

  • clearPolicyCache

  • clearResourceFinderCache

  • doTestRequest

  • doTestRequestForGivenPolicies

  • getGlobalPolicyAlgorithm

  • getPDPData

  • getPIPAttributeFinderData

  • getPIPResourceFinderData

  • getPolicyFinderData

  • refreshAttributeFinder

  • refreshPolicyFinders

  • refreshResourceFinder

  • setGlobalPolicyAlgorithm

EntitlementPolicyAdminService

  • addPolicies

  • addPolicy

  • addSubscriber

  • deleteSubscriber

  • dePromotePolicy

  • enableDisablePolicy

  • getAllPolicies

  • getAllPolicyIds

  • getEntitlementData

  • getEntitlementDataModules

  • getLightPolicy

  • getPolicy

  • getPolicyByVersion

  • getPolicyVersions

  • getPublisherModuleData

  • getStatusData

  • getSubscriber

  • getSubscriberIds

  • importPolicyFromRegistry

  • orderPolicy

  • publish

  • publishPolicies

  • publishToPDP

  • removePolicies

  • removePolicy

  • rollBackPolicy

  • updatePolicy

  • updateSubscriber

/admin/configure/security          

ClaimManagementService

  • addNewClaimDialect

  • addNewClaimMapping

  • getClaimMappingByDialect

  • getClaimMappings

  • removeClaimDialect

  • removeClaimMapping

  • upateClaimMapping

KeyStoreAdminService

  • addKeyStore

  • addTrustStore

  • deleteStore

  • getKeystoreInfo

  • getPaginatedKeystoreInfo

  • getStoreEntries

  • importCertToStore

  • removeCertFromStore

RemoteAuthorizationManagerService

  • authorizeRole

  • authorizeUser

  • clearAllRoleAuthorization

  • clearAllUserAuthorization

  • clearResourceAuthorizations

  • clearRoleActionOnAllResources

  • clearRoleAuthorization

  • clearUserAuthorization

  • denyRole

  • denyUser

  • getAllowedRolesForResource

  • getAllowedUIResourcesForUser

  • getDeniedRolesForResource

  • getExplicitlyAllowedUsersForResource

  • getExplicitlyDeniedUsersForResource

  • isRoleAuthorized

  • isUserAuthorized

  • resetPermissionOnUpdateRole

RemoteClaimManagerService

  • addNewClaimMapping

  • deleteClaimMapping

  • getAllClaimMappings

  • getAllClaimUris

  • getAllRequiredClaimMappings

  • getAllSupportClaimMappingsByDefault

  • getAttributeName

  • getAttributeNameFromDomain

  • getClaim

  • getClaimMapping

  • updateClaimMapping

RemoteProfileConfigurationManagerService

  • addProfileConfig

  • deleteProfileConfig

  • getAllProfiles

  • getProfileConfig

  • updateProfileConfig

RemoteUserStoreManagerService

  • addRole

  • addUser

  • addUserClaimValue

  • addUserClaimValues

  • authenticate

  • deleteRole

  • deleteUser

  • deleteUserClaimValue

  • deleteUserClaimValues

  • getAllProfileNames

  • getHybridRoles

  • getPasswordExpirationTime

  • getProfileNames

  • getProperties

  • getRoleListOfUser

  • getRoleNames

  • getTenantId

  • getTenantIdofUser

  • getUserClaimValue

  • getUserClaimValues

  • getUserClaimValuesForClaims

  • getUserId

  • getUserList

  • getUserListOfRole

  • isExistingRole

  • isExistingUser

  • isReadOnly

  • listUsers

  • setUserClaimValue

  • setUserClaimValues

  • updateCredential

  • updateCredentialByAdmin

  • updateRoleListOfUser

  • updateRoleName

  • updateUserListOfRole

SCIMConfigAdminService

  • addGlobalProvider

  • deleteGlobalProvider

  • getAllGlobalProviders

  • getGlobalProvider

  • updateGlobalProvider

STSAdminService

  • addTrustedService

  • getCertAliasOfPrimaryKeyStore

  • getProofKeyType

  • getTrustedServices

  • removeTrustedService

  • setProofKeyType

 UserAdmin

  • addInternalRole

  • addRemoveRolesOfUser

  • addRemoveUsersOfRole

  • addRole

  • bulkImportUsers

  • deleteRole

  • getAllSharedRoleNames

  • getAllUIPermissions

  • getRolePermissions

  • getRolesOfUser

  • isSharedRolesEnabled

  • listUserByClaim

  • setRoleUIPermission

  • updateRoleName

  • updateRolesOfUser

  • updateUsersOfRole

/admin/configure/security/rolemgt

UserAdmin

  • getUsersOfRole

/admin/configure/security/usermgt

MultipleCredentialsUserAdmin

  • addUserWithUserId

  • authenticate

  • deleteUserClaimValue

  • deleteUserClaimValues

  • getUserClaimValue

  • getUserClaimValues

  • getUserId

  • setUserClaimValue

  • setUserClaimValues

/admin/configure/security/usermgt/passwords

MultipleCredentialsUserAdmin 

  • addCredential

  • deleteCredential

  • getCredentials

  • updateCredential

UserAdmin

  • changePassword

 /admin/configure/security/usermgt/provisioning

SCIMConfigAdminService

  • addUserProvider

  • deleteUserProvider

  • getAllUserProviders

  • getUserProvider

  • updateUserProvider

/admin/configure/security/usermgt/users

MultipleCredentialsUserAdmin

  • addUser

  • addUsers

  • deleteUser

UserAdmin

  • addUser

  • deleteUser

/admin/login

AccountCredentialMgtConfigService

  • getEmailConfig

  • saveEmailConfig

EntitlementService

  • getAllEntitlements

  • getBooleanDecision

  • getDecision

  • getDecisionByAttributes

  • getEntitledAttributes

  • XACMLAuthzDecisionQuery

IdentityProviderAdminService

  • addOpenID

  • extractPrimaryUserName

  • getAllOpenIDs

  • getPrimaryOpenID

  • removeOpenID

  • getAllIdPs

IWAAuthenticator

  • canHandle

  • login

LoggedUserInfoAdmin

  • getUserInfo

MultipleCredentialsUserAdmin

  • getAllUserClaimValues

OAuthAdminService

  • getAppsAuthorizedByUser

  • revokeAuthzForAppsByResoureOwner

UserAdmin

  • changePasswordByUser

  • getRolesOfCurrentUser

  • getUserRealmInfo

  • hasMultipleUserStores

UserIdentityManagementAdminService

  • changeUserPassword

  • deleteUser

  • getAllChallengeQuestions

  • getAllPromotedUserChallenge

  • getAllUserIdentityClaims

  • getChallengeQuestionsOfUser

  • isReadOnlyUserStore

  • lockUserAccount

  • resetUserPassword

  • setChallengeQuestions

  • setChallengeQuestionsOfUser

  • unlockUserAccount

  • updateUserIdentityClaims

UserInformationRecoveryService

  • confirmUserSelfRegistration

  • getAllChallengeQuestions

  • getCaptcha

  • getUserChallengeQuestion

  • getUserChallengeQuestionIds

  • getUserIdentitySupportedClaims

  • registerUser

  • sendRecoveryNotification

  • updatePassword

  • verifyAccount

  • verifyConfirmationCode

  • verifyUser

  • verifyUserChallengeAnswer

UserProfileMgtService

  • associateID

  • deleteUserProfile

  • getAssociatedIDs

  • getInstance

  • getNameAssociatedWith

  • getProfileFieldsForInternalStore

  • getUserProfile

  • getUserProfiles

  • isAddProfileEnabled

  • isAddProfileEnabledForDomain

  • isReadOnlyUserStore

  • removeAssociateID

  • setUserProfile

XMPPConfigurationService