Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Switch direct OpenStack API access on or off for the organisation
Switches direct OpenStack API access for the whole organisation. ON lets members and service accounts
create OpenStack API credentials. OFF deletes EVERY API principal and with it every credential of the
organisation (Keystone deletes a user's application credentials with the user) — it is double-confirmed:
dryRun: true returns the counts that would be deleted without changing anything, and the real switch-off
needs confirm: true.
Authorization: iam: manage from a SUBSCRIPTION-level grant of the built-in owner role (a project-only
owner or any custom role is refused) plus an interactive session with a second factor verified in the last
5 minutes (bearer tokens / service-account keys are refused).
Operator lock: when the platform operator disabled the organisation's access, switching it ON
is refused with 403 FORBIDDEN details.reason API_ACCESS_DISABLED_BY_OPERATOR until the operator lifts
the lock; operatorLock in the response says when and why.
Errors: 401; 403 (FORBIDDEN with details.reason SUBSCRIPTION_OWNER_REQUIRED,
API_ACCESS_DISABLED_BY_OPERATOR, MFA_STEP_UP_REQUIRED, INTERACTIVE_SESSION_REQUIRED); 404; 422
switch-off without confirm; 503 OFF was applied but some principals could not be deleted yet (they are
retried; nothing new can be created).
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
application/json- body
enabled*booleanconfirm?booleanRequired (true) to switch OFF -- it deletes every principal and credential.
dryRun?booleanWith enabled=false, only report what would be deleted.
The switch state after the change (or the dry-run counts).
application/json- response
The organisation's direct OpenStack API access switch.
enabled*booleanchangedBy?string|nullchangedAt?|date-timeprincipals*integerAPI principals (Keystone users) of the organisation.
activeCredentials*integeroperatorLock?|Set while the platform operator has disabled the organisation's API access. Only the operator can lift it; until then the switch cannot be turned on and no credential can be created or rotated.
curl -X PUT "https://example.com/scopes/string/iam/openstack-api-access" \ -H "Content-Type: application/json" \ -d '{ "enabled": true }'{ "enabled": true, "changedBy": "string", "changedAt": "2019-08-24T14:15:22Z", "principals": 0, "activeCredentials": 0, "operatorLock": { "lockedAt": "2019-08-24T14:15:22Z", "reason": "string" }}