Skip to content
CCPEDIAby Unity Nodes
Documentation/Canton Network Docs/Ledger APIOpenAPIView on Canton Network Docs

POST /v2/users/:user-id/rights

POST
/
v2
/
users
/
{user-id}
/
rights
Try it
cURL
Python
JavaScript
PHP
Go
Java
Ruby
curl --request POST \
  --url 'http://localhost:7575/v2/users/{user-id}/rights' \
  --header 'Authorization: Bearer $TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "userId": "<string>",
  "rights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ],
  "identityProviderId": "<string>"
}'
import json
import requests

url = "http://localhost:7575/v2/users/{user-id}/rights"
headers = {'Authorization': 'Bearer <token>', 'Content-Type': 'application/json'}
payload = json.loads(r'''{
  "userId": "<string>",
  "rights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ],
  "identityProviderId": "<string>"
}''')
response = requests.request(
    "POST", url, headers=headers, json=payload
)

print(response.text)
const response = await fetch('http://localhost:7575/v2/users/{user-id}/rights', {
  method: 'POST',
  headers: {
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
},
  body: JSON.stringify({
  "userId": "<string>",
  "rights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ],
  "identityProviderId": "<string>"
}),
});

console.log(await response.text());
<?php
$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'http://localhost:7575/v2/users/{user-id}/rights',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_POSTFIELDS => <<<'JSON'
{
  "userId": "<string>",
  "rights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ],
  "identityProviderId": "<string>"
}
JSON,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer <token>",
        "Content-Type: application/json"
    ],
]);

$response = curl_exec($curl);
echo $response;
package main

import (
  "bytes"
  "fmt"
  "io"
  "net/http"
)

func main() {
  req, _ := http.NewRequest("POST", "http://localhost:7575/v2/users/{user-id}/rights", bytes.NewBufferString(`{
  "userId": "<string>",
  "rights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ],
  "identityProviderId": "<string>"
}`))
  req.Header.Set("Authorization", "Bearer <token>")
  req.Header.Set("Content-Type", "application/json")
  response, _ := http.DefaultClient.Do(req)
  defer response.Body.Close()
  body, _ := io.ReadAll(response.Body)
  fmt.Println(string(body))
}
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

var request = HttpRequest.newBuilder()
    .uri(URI.create("http://localhost:7575/v2/users/{user-id}/rights"))
    .header("Authorization", "Bearer <token>")
    .header("Content-Type", "application/json")
    .method("POST", HttpRequest.BodyPublishers.ofString("""
{
  "userId": "<string>",
  "rights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ],
  "identityProviderId": "<string>"
}
"""))
    .build();
var response = HttpClient.newHttpClient().send(
    request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());
require 'net/http'
require 'uri'

uri = URI('http://localhost:7575/v2/users/{user-id}/rights')
request = Net::HTTP::Post.new(uri)
request['Authorization'] = 'Bearer <token>'
request['Content-Type'] = 'application/json'
request.body = <<~JSON
{
  "userId": "<string>",
  "rights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ],
  "identityProviderId": "<string>"
}
JSON
response = Net::HTTP.start(uri.hostname, uri.port) do |http|
  http.request(request)
end
puts response.body
200
400
default
{
  "newlyGrantedRights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ]
}
<string>
{
  "code": "<string>",
  "cause": "<string>",
  "correlationId": "<string>",
  "traceId": "<string>",
  "context": {},
  "resources": [
    [
      "<string>"
    ]
  ],
  "errorCategory": 123,
  "grpcCodeValue": 123,
  "retryInfo": "<string>",
  "definiteAnswer": false
}

Grant rights to a user. Granting rights does not affect the resource version of the corresponding user.

cURL
Python
JavaScript
PHP
Go
Java
Ruby
curl --request POST \
  --url 'http://localhost:7575/v2/users/{user-id}/rights' \
  --header 'Authorization: Bearer $TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "userId": "<string>",
  "rights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ],
  "identityProviderId": "<string>"
}'
import json
import requests

url = "http://localhost:7575/v2/users/{user-id}/rights"
headers = {'Authorization': 'Bearer <token>', 'Content-Type': 'application/json'}
payload = json.loads(r'''{
  "userId": "<string>",
  "rights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ],
  "identityProviderId": "<string>"
}''')
response = requests.request(
    "POST", url, headers=headers, json=payload
)

print(response.text)
const response = await fetch('http://localhost:7575/v2/users/{user-id}/rights', {
  method: 'POST',
  headers: {
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
},
  body: JSON.stringify({
  "userId": "<string>",
  "rights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ],
  "identityProviderId": "<string>"
}),
});

console.log(await response.text());
<?php
$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'http://localhost:7575/v2/users/{user-id}/rights',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_POSTFIELDS => <<<'JSON'
{
  "userId": "<string>",
  "rights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ],
  "identityProviderId": "<string>"
}
JSON,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer <token>",
        "Content-Type: application/json"
    ],
]);

$response = curl_exec($curl);
echo $response;
package main

import (
  "bytes"
  "fmt"
  "io"
  "net/http"
)

func main() {
  req, _ := http.NewRequest("POST", "http://localhost:7575/v2/users/{user-id}/rights", bytes.NewBufferString(`{
  "userId": "<string>",
  "rights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ],
  "identityProviderId": "<string>"
}`))
  req.Header.Set("Authorization", "Bearer <token>")
  req.Header.Set("Content-Type", "application/json")
  response, _ := http.DefaultClient.Do(req)
  defer response.Body.Close()
  body, _ := io.ReadAll(response.Body)
  fmt.Println(string(body))
}
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

var request = HttpRequest.newBuilder()
    .uri(URI.create("http://localhost:7575/v2/users/{user-id}/rights"))
    .header("Authorization", "Bearer <token>")
    .header("Content-Type", "application/json")
    .method("POST", HttpRequest.BodyPublishers.ofString("""
{
  "userId": "<string>",
  "rights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ],
  "identityProviderId": "<string>"
}
"""))
    .build();
var response = HttpClient.newHttpClient().send(
    request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());
require 'net/http'
require 'uri'

uri = URI('http://localhost:7575/v2/users/{user-id}/rights')
request = Net::HTTP::Post.new(uri)
request['Authorization'] = 'Bearer <token>'
request['Content-Type'] = 'application/json'
request.body = <<~JSON
{
  "userId": "<string>",
  "rights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ],
  "identityProviderId": "<string>"
}
JSON
response = Net::HTTP.start(uri.hostname, uri.port) do |http|
  http.request(request)
end
puts response.body
200
400
default
{
  "newlyGrantedRights": [
    {
      "kind": {
        "CanActAs": {
          "value": {
            "party": "<string>"
          }
        }
      }
    }
  ]
}
<string>
{
  "code": "<string>",
  "cause": "<string>",
  "correlationId": "<string>",
  "traceId": "<string>",
  "context": {},
  "resources": [
    [
      "<string>"
    ]
  ],
  "errorCategory": 123,
  "grpcCodeValue": 123,
  "retryInfo": "<string>",
  "definiteAnswer": false
}

Authorizations

httpAuth

Authorization
string
required
HTTP bearer authentication. Send the token as Authorization: Bearer &lt;token&gt;. Ledger API standard JWT token

apiKeyAuth

Sec-WebSocket-Protocol
string
required
API key authentication in the header. Ledger API standard JWT token (websocket)

Path parameters

user-id
string
required

Body

application/json
userId
string
required
The user to whom to grant rights. Required
rights
object[]
OpenAPI type: Right[].The rights to grant. Optional: can be empty

Show child attributes

kind
object
OpenAPI type: Kind.Required

Show child attributes

Variant 1
object

Show child attributes

CanActAs
object
required
OpenAPI type: CanActAs.

Show child attributes

value
object
required
OpenAPI type: CanActAs1.

Show child attributes

party
string
required
The right to authorize commands for this party. Required
Variant 2
object

Show child attributes

CanExecuteAs
object
required
OpenAPI type: CanExecuteAs.

Show child attributes

value
object
required
OpenAPI type: CanExecuteAs1.

Show child attributes

party
string
required
The right to prepare and execute submissions as this party. This right does not entitle the user to perform any reads. If reading is required, a separate ReadAs right must be added. Right to execute as a party is also implicitly contained in the CanActAs right. Required
Variant 3
object

Show child attributes

CanExecuteAsAnyParty
object
required
OpenAPI type: CanExecuteAsAnyParty.The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.

Show child attributes

value
object
required
OpenAPI type: CanExecuteAsAnyParty1.The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
Variant 4
object

Show child attributes

CanReadAs
object
required
OpenAPI type: CanReadAs.

Show child attributes

value
object
required
OpenAPI type: CanReadAs1.

Show child attributes

party
string
required
The right to read ledger data visible to this party. Required
Variant 5
object

Show child attributes

CanReadAsAnyParty
object
required
OpenAPI type: CanReadAsAnyParty.The rights of a participant’s super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.

Show child attributes

value
object
required
OpenAPI type: CanReadAsAnyParty1.The rights of a participant’s super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
Variant 6
object

Show child attributes

Empty
object
required
OpenAPI type: Empty8.
Variant 7
object

Show child attributes

IdentityProviderAdmin
object
required
OpenAPI type: IdentityProviderAdmin.The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.

Show child attributes

value
object
required
OpenAPI type: IdentityProviderAdmin1.The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
Variant 8
object

Show child attributes

ParticipantAdmin
object
required
OpenAPI type: ParticipantAdmin.The right to administer the participant node.

Show child attributes

value
object
required
OpenAPI type: ParticipantAdmin1.The right to administer the participant node.
identityProviderId
string
The id of the Identity Provider If not set, assume the user is managed by the default identity provider. Optional

Responses

200

application/json
newlyGrantedRights
Right[]
The rights that were newly granted by the request. Optional: can be empty

Show child attributes

kind
Kind
Required

Show child attributes

Variant 1
object

Show child attributes

CanActAs
CanActAs
required

Show child attributes

value
CanActAs1
required

Show child attributes

party
string
required
The right to authorize commands for this party. Required
Variant 2
object

Show child attributes

CanExecuteAs
CanExecuteAs
required

Show child attributes

value
CanExecuteAs1
required

Show child attributes

party
string
required
The right to prepare and execute submissions as this party. This right does not entitle the user to perform any reads. If reading is required, a separate ReadAs right must be added. Right to execute as a party is also implicitly contained in the CanActAs right. Required
Variant 3
object

Show child attributes

CanExecuteAsAnyParty
CanExecuteAsAnyParty
required
The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.

Show child attributes

value
CanExecuteAsAnyParty1
required
The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
Variant 4
object

Show child attributes

CanReadAs
CanReadAs
required

Show child attributes

value
CanReadAs1
required

Show child attributes

party
string
required
The right to read ledger data visible to this party. Required
Variant 5
object

Show child attributes

CanReadAsAnyParty
CanReadAsAnyParty
required
The rights of a participant’s super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.

Show child attributes

value
CanReadAsAnyParty1
required
The rights of a participant’s super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
Variant 6
object

Show child attributes

Empty
Empty8
required
Variant 7
object

Show child attributes

IdentityProviderAdmin
IdentityProviderAdmin
required
The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.

Show child attributes

value
IdentityProviderAdmin1
required
The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
Variant 8
object

Show child attributes

ParticipantAdmin
ParticipantAdmin
required
The right to administer the participant node.

Show child attributes

value
ParticipantAdmin1
required
The right to administer the participant node.

400

Invalid value, Invalid value for: body
text/plain
value
string
required

default

application/json
code
string
required
cause
string
required
correlationId
string
traceId
string
context
Map_String
required
resources
Tuple2_String_String[]
errorCategory
integer (int32)
required
grpcCodeValue
integer (int32)
retryInfo
string
definiteAnswer
boolean

History

Updated3.5

The POST /v2/users/{user-id}/rights operation changed in this snapshot.