Set Cluster Access Policy

Set the organisation cluster access policy. creator_grant_role none seeds no grant for the creator; a creator role above max_grant_role is refused, and so is a creator role above view while elevated_max_ttl_seconds is set (sent or stored), because the creator’s grant is standing and would be over policy as soon as it is seeded. A lowered ceiling leaves manual and creator grants above it in place, but they cannot be re-timed; grants that come from organisation roles are lowered to the new ceiling on the next role sync (about a minute), each with an audit row and one organisation notification per sync. New grants above the ceiling answer 403 cluster_access_policy_violation. elevated_max_ttl_seconds and require_reason_from_role are optional: an omitted bound keeps its stored value and null clears it; new and re-timed grants outside them answer 403 cluster_access_grant_expiry_required, cluster_access_grant_lifetime_exceeded or cluster_access_grant_reason_required. Requires kube_access.policy, which is human-only: an API token must name it in its scopes, and an unscoped or wildcard token answers 403 permission_denied. organisation_id and organisation_name name the organisation written.

PUT /api/v1/org/cluster-access-policy

Set Cluster Access Policy

Python

import requests

url = "https://platform.ankra.app/api/v1/org/cluster-access-policy"

payload = {}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

200

{
  "policy": {
    "creator_grant_role": "none",
    "max_grant_role": "view",
    "elevated_max_ttl_seconds": 15768030,
    "require_reason_from_role": "view",
    "is_configured": true
  },
  "organisation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "organisation_name": "<string>"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

authorization · string | null

x-ankra-organisation-id · string | null

Body

application/json

creator_grant_role · enum<string> · required

Available options: none, view, edit, admin, cluster-admin

max_grant_role · enum<string> · required

Available options: view, edit, admin, cluster-admin

elevated_max_ttl_seconds · integer | null

The longest a grant above view may last, in seconds: such a grant must expire, and no later than this from when it is created or re-timed. It is also the window a kube_access.elevate holder may give itself (4 hours when null). null clears the bound; omitting the field keeps the stored value.

Required range: 60 <= x <= 31536000

require_reason_from_role · enum<string> | null

The lowest role whose grants must carry a reason. null clears the bound; omitting the field keeps the stored value.

Available options: view, edit, admin, cluster-admin

Response

200

application/json

Successful Response

policy · ClusterAccessPolicy · object · required

Show child attributes

organisation_id · string<uuid> · required

The organisation this policy belongs to: the one the request selected (a token's own unless X-Ankra-Organisation-Id names another, or the session's current organisation).

organisation_name · string | null · required

That organisation's name; null for an organisation without one.