Temporal Server

Learn about actions >

• add-auth-rule

  Adds an authorization rule to the OpenFGA store using the specified authorization model. This can be triggered using one of two parameter combinations:

  • user, group: adds a user as a member of a group.
  • group, namespace, role: assigns 'role' access to all members of a group to a namespace.

  Params

  • group string

    The group to add a user to, or assign access to a namespace depending on the parameter combination.

  • namespace string

    The Temporal namespace to assign access to.

  • role string

    One of "reader", "writer" or "admin".

  • user string

    The user's email.

• check-auth-rule

  Checks for an authorization rule. This can be triggered using one of three parameter combinations:

  • user, group: checks if a user is a member of a group.
  • user, namespace, role: checks if a user has 'role' access to a namespace.
  • group, namespace, role: checks if a group has 'role' access to a namespace.

  Params

  • group string

    The group to check access for.

  • namespace string

    The Temporal namespace to check access for.

  • role string

    One of "reader", "writer" or "admin".

  • user string

    The user's email to check access for.

• create-authorization-model

  Creates the authorization model using the content of the specified file and returns the authorization model ID.

  Params

  • model string

    The JSON string containing the authorization model.

  Required

  model

• list-auth-rule

  Lists all authorization rules associated with a given parameter. This can be triggered using one of three parameter combinations:

  • user: lists all groups a user is a member of and all namespaces a user has access to as a result of group memberships.
  • group: lists all namespaces a given group has access to.
  • namespace: for a given namespace, lists all groups that has access to it.

  Params

  • group string

    The group to list access for.

  • namespace string

    The Temporal namespace to list access for.

  • user string

    The user's email to list access for.

• list-system-admins

  Lists all system admins who are members of any group listed in the "auth-admin-groups" config parameters.

• remove-auth-rule

  Removes an authorization rule from the OpenFGA store using the specified authorization model. This can be triggered using one of two parameter combinations:

  • user, group: removes a user as a member from a group.
  • group, namespace, role: revokes 'role' access to all members of a group the to a namespace.

  Params

  • group string

    The group to remove a user from, or remove access to a namespace from depending on the parameter combination.

  • namespace string

    The Temporal namespace to remove access from.

  • role string

    One of "reader", "writer" or "admin".

  • user string

    The user's email.

• restart

  Restart the Temporal server.