Identity & Access Management

Preview — pending review

This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.

Rename a project

PATCH
/tenants/{tenantId}/subscriptions/{subscriptionId}/projects/{projectId}

Renames the project. The request settles every question it can answer itself -- an invalid name is 422 and a name a sibling project already uses (case-insensitive) is 409, both here, never on a later failing Operation -- then hands the two writes (Keystone description, then the catalog row) to one durable iam.scope.rename command. Returns 202 with the PENDING Operation. The project id, the Keystone project id and the Keystone project NAME do not change; resources, billing and grants are untouched. Renaming to the current name is accepted (a no-op). Authorization: the caller must OWN the project (an owner grant on it or on the subscription above it): reached-but-not-owner 403, unreached/unknown project 404. An API token is refused 403 TOKEN_SCOPE_MISSING (iam:write is never grantable); tenant on non-payment hold 403 TENANT_SUSPENDED. Async & state: 202; Operation PENDING → RUNNING → SUCCEEDED | FAILED. Errors: 401; 403; 404; 409 sibling name clash / idempotency body mismatch; 422 invalid name, unknown field, non-UUID Idempotency-Key; 500. Idempotency/Concurrency: Idempotency-Key (UUID) is optional (recommended); a refused rename leaves no idempotency record, so a corrected retry with the same key is evaluated afresh.

Authorization

bearerToken
headerAuthorizationBearer <token>

An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.

Path Parameters

tenantId*string

The tenant id.

subscriptionId*string

The subscription id (unique platform-wide, derived from the tenant id + the subscription's name at creation).

projectId*string

The project id (also the project's scopeId).

Header Parameters

Idempotency-Key?string

Optional; recommended for safe retries. When sent, the same key+body within 24h replays the original result and the same key with a different body is 409 CONFLICT; keys are unique per tenant. When an API token or service-account (bearer) caller omits it, the request is applied once with no replay protection (a retry may apply it again). A console session gets one from the edge.

Formatuuid

Request Body

application/json
  1. body

Body of PATCH /tenants/{tenantId}/subscriptions/{subscriptionId}/projects/{projectId}.

name*string

New display name; same rule as create, unique (case-insensitive) among the subscription's projects.

Response Body

Rename accepted; the PENDING iam.scope.rename Operation.

application/json
  1. response

A long-running operation record. GET /operations/{operationId} returns its current state.

id*string

Operation identifier, unique platform-wide.

action*string

Canonical action id that started this operation, e.g. compute.instance.create.

state*OperationState

State machine for long-running operations. PENDING and RUNNING are transitional; the rest are terminal.

Value in"PENDING""RUNNING""SUCCEEDED""FAILED""CANCELLED"
resourceKind?|

Kind of the target resource (matches RealtimeEvent.kind), null for resource-less actions.

resourceId?|

Identifier of the target resource; null until the resource is allocated.

resourceName?|

Human-readable name of the target resource captured when the operation was opened; null when unknown or the resource has been deleted (clients fall back to resourceId).

principalId?|

Subject id (user id/email or service-account id) of the actor that initiated this operation, captured at the create chokepoint; null on internal/worker paths with no request-scoped principal or for historical rows. This is the real actor the Activity feed renders.

sourceIp?|

Source IP address of the request that initiated this operation; null when unavailable (internal/worker paths, historical rows).

progressPercent?|

Best-effort progress; null when the action does not report progress.

Range0 <= value <= 100
error?|null

Populated only when state is FAILED (or CANCELLED with partial rollback notes).

warning?|null

Non-fatal degradation recorded on an operation that still SUCCEEDED - the primary action completed but something explicitly requested could not be delivered (e.g. publicIp was requested at instance create but no floating IP could be assigned). On a CANCELLED create it reports that the provider resource had already been created and was kept (live and billed until deleted; details.disposition = left_in_place). Same code+message shape as error so clients render both uniformly; null when the operation ran without degradation.

startedAt?|

When the worker began executing; null while PENDING.

finishedAt?|

When a terminal state was reached; null while transitional.

createdAt*string
updatedAt*string
curl -X PATCH "https://example.com/tenants/string/subscriptions/string/projects/string" \  -H "Content-Type: application/json" \  -d '{    "name": "string"  }'
{  "id": "string",  "action": "string",  "state": "PENDING",  "resourceKind": "string",  "resourceId": "string",  "resourceName": "string",  "principalId": "string",  "sourceIp": "string",  "progressPercent": 0,  "error": {    "code": "string",    "message": "string",    "field": "string",    "details": {},    "retryable": false  },  "warning": {    "code": "string",    "message": "string",    "field": "string",    "details": {},    "retryable": false  },  "startedAt": "string",  "finishedAt": "string",  "createdAt": "string",  "updatedAt": "string"}