Versions Compared

Old Version 78

changes.mady.by.user Bruce Hoff

Saved on

compared with

New Version Current

changes.mady.by.user David Burdick

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
{section} {column:width=50%} On This page {toc} {column} {column:width=5%} {column} {column:width=45%} On Related Pages {pagetree:root=@parent|startDepth=3} {column} {section} h1. API for Authentication and Authorization h2. API for Authentication h3. Create User {code}
Wiki Markup
Section
Column
width50%

On This page

Table of Contents
Column
width5%
 
Column
width45%

On Related Pages

Page Tree
root@parent
startDepth3

API for Authentication and Authorization

API for Authentication

Create User

Code Block
POST https://auth-staging-auth.elasticbeanstalksagebase.comorg/auth/v1/user
{"email":"demouser@sagebase.org", "firstName":"demo", "lastName":"user", "displayName":"Demo User"}
{code}


Successful

Successful Response:

...

}
Code Block
HTTP/1.1 201 Created
{code}


Missing password or user ID already exists:
{code}

Missing password or user ID already exists:

Code Block
HTTP/1.1 400401 Bad Request
{code}


Note:  As a side effect this will send an email to the given address, prompting the user to set their password.


h3. Get User

Retrieves the user based on the session token header, which is required.  Note:  the "password" field will be null, since retrieving a user's password is not permitted.


{code}
GET https://staging-auth.elasticbeanstalk.comUnauthorized

Note:  As a side effect this will send an email to the given address, prompting the user to set their password.

Send Change-Password Email

Code Block
POST https://auth-staging.sagebase.org/auth/v1/user/password/email
{"email":"demouser@sagebase.org"}

Successful Response:

Code Block
HTTP/1.1 204 No Content

If the email address is not in the user database:

Code Block
HTTP/1.1 404 Not Found

Set Password

Code Block
POST https://auth-staging.sagebase.org/auth/v1/user
{code}

{code}
/password
{"sessionToken":"abcdefgh-0123-4567-ijkl-mnopqrstuvwx", "password":"foobar"}

Successful Response:

Code Block
HTTP/1.1 200204 OKNo Content-Type: application/json
{
  "displayName": "Demo User",
  "email": "demouser@sagebase.org",
  "firstName": "demo",
  "lastName": "user",
  "password": null
}
{code}

h3. Update User

{code}
PUT https://staging-auth.elasticbeanstalk.com/auth/v1/user
sessionToken:<sessionToken>
{"email":"demouser@sagebase.org", "firstName":"demo", "lastName":"user", "displayName":"Demo User"}
{code}

&nbsp;where <sessionToken> is that returned by "Initiate Session", below.



Note the authentication service manage the properties shown (principally the userId and password) while the repository services (below) manage other related user attributes.


Successful Response:
{code}
HTTP/1.1 204 No Content
{code}

Error Response, if the session token is missing or does not match userId:
{code}
HTTP/1.1 400 Bad Request
Content-Type: application/json
{"reason":"Not authorized."}
{code}

h3. Send Change-Password Email
{code}
POST https://staging-auth.elasticbeanstalk.com/auth/v1/userPasswordEmail
{"email":"demouser@sagebase.org"}
{code}


Successful Response:
{code}

Get Secret Key for HMAC Authentication

Code Block
GET https://auth-staging.sagebase.org/auth/v1/secretKey

Successful Response:

Code Block
HTTP/1.1 200 {"secretKey":"0Ocy/cW/3WIdZg3Up9dguO4Kh5smBKpN7iWXAvVQqekGD3gT4nc7PWwlfOhcL+KW6W4PjXtgPQNhiP7yrwjfwQ=="}

Note: Session token is required in request header.  The returned key is that of the authenticated user.

Invalidate Secret Key

Code Block
DELETE https://auth-staging.sagebase.org/auth/v1/secretKey

Successful Response:

Code Block
HTTP/1.1 204  No Content

Note: Session token or HMAC signature is required in request header.  The key which is invalidated is that of the authenticated user.

Initiate Session (Login)

Request:

Code Block
POST https://auth-staging.sagebase.org/auth/v1/session
{"email":"demouser@sagebase.org", "password":"demouser-pw"}

Successful Response:

Code Block
HTTP/1.1 201 Created
Content-Type: application/json
{"sessionToken":"AYcOhWIm9NdOC6BdzzzisQ00", "acceptsTermsOfUse":"true"}

Note: If the "acceptsTermsOfUse" field is "false", then an additional call to accept the Synapse terms of use is required before the session token can be used for authenticated requests

Session token is valid for a period of time, currently set to 24 hours.

Refresh Token (reset timer)

Request:

Code Block
PUT https://auth-staging.sagebase.org/auth/v1/session
{"sessionToken":"AYcOhWIm9NdOC6BdzzzisQ00"}

Successful Response:

Code Block
HTTP/1.1 204 No Content

Error Response, if the session token is invalid:

Code Block
HTTP/1.1 401 Unauthorized
{"reason":"Session token is not valid"}

Error Response, if the user has not signed the terms of use yet:

Code Block
HTTP/1.1 403 Forbidden
{"reason":"Terms of use must be signed"}

Terminate Session (Logout)

 Note: Sessions initiated by multiple clients for the same user around the same time will receive identical "single sign on" tokens.  Since session termination is linked to the session token, terminating the session for one client via this command will have the side effect of terminating all sessions.  An alternative is for the client simply to delete its own copy of the token.

Request:

Code Block
DELETE https://auth-staging.sagebase.org/auth/v1/session

Note: Session token is required in request header.

Response:

Code Block
HTTP/1.1 204 No Content

Accept the Synapse Terms of Use

Request:

Code Block
POST https://auth-staging.sagebase.org/auth/v1/termsOfUse
{"sessionToken":"AYcOhWIm9NdOC6BdzzzisQ00", "acceptsTermsOfUse":"true"}

Response:

Code Block
HTTP/1.1 204 No Content
{code}

If the email address is not in the user database:
{code}
HTTP/1.1 400 Bad Request
{code}


Note: The email template is in the auth-util package, in the file resetpasswordEmail.txt. The reset link, along with the smtp parameters, is in the file authutil.properties.

h3. Send Set-API-Password EmailPOST https://staging-auth.elasticbeanstalk.com/auth/v1/apiPasswordEmail
{"email":"demouser@sagebase.org"}


Successful Response:HTTP/1.1 204 No Content

If the email address is not in the user database:HTTP/1.1 400 Bad Request


Note: The email template is in the auth-util package, in the file setAPIpasswordEmail.txt. The reset link, along with the smtp parameters, is in the file authutil.properties.

h3. Set Password
{code}
POST https://staging-auth.elasticbeanstalk.com/auth/v1/userPassword
{"email":"demouser@sagebase.org", "password":"foobar"}
{code}


Successful Response:
{code}
HTTP/1.1 201 No Content
{code}




Note:&nbsp; Session token is required in request header.


h3. Initiate Session (Login)

Request:

{code}
POST https://staging-auth.elasticbeanstalk.com/auth/v1/session
{"email":"demouser@sagebase.org", "password":"demouser-pw"}
{code}


Successful Response:
{code}
HTTP/1.1 201 Created
Content-Type: application/json
{"displayName":"Demo User","sessionToken":"AYcOhWIm9NdOC6BdzzzisQ00"}
{code}

Error Response, if the user authentication details are incorrect:
{code}
HTTP/1.1 400 Bad Request
AuthenticationURL: https://staging-auth.elasticbeanstalk.com/auth/v1/session
Content-Type: application/json
{"reason":"Unable to authenticate."}
{code}




Session token is valid for a period of time, currently set to 24 hours.



h3. Refresh Token (reset timer)

Request:

{code}
PUT https://staging-auth.elasticbeanstalk.com/auth/v1/session
{"sessionToken":"AYcOhWIm9NdOC6BdzzzisQ00"}
{code}


Successful Response:
{code}
HTTP/1.1 204 No Content
{code}

Error Response, if the session token is invalid:
{code}
HTTP/1.1 404 Not Found
{"reason":"Unable to validate session."}
{code}

h3. Terminate Session (Logout)

&nbsp;Note: Sessions initiated by multiple clients for the same user around the same time will receive identical "single sign on" tokens.&nbsp; Since session termination is linked to the session token, terminating the session for one client via this command will have the side effect of terminating all sessions.&nbsp; An alternative is for the client simply to delete its own copy of the token.

Request:

{code}
DELETE https://staging-auth.elasticbeanstalk.com/auth/v1/session
{"sessionToken":"AYcOhWIm9NdOC6BdzzzisQ00"}
{code}


Response:

{code}
HTTP/1.1 204 NO CONTENT
{code}



h2. Sample commands, issued from cURL:

Create User:
curl \-k \-H "Content-Type:application/json" \-H "Accept:application/json" \-d "\{\"email\":\"demouser@sagebase.org\", \"firstName\":\"demo\", \"lastName\":\"user\", \"displayName\":\"Demo User\"}" \-X POST [https://staging-auth.elasticbeanstalk.com/auth/v1/user]






















Update User:
curl \-k \-H "Content-Type:application/json" \-H "Accept:application/json" \-d "\{\"email\":\"demouser@sagebase.org\", \"firstName\":\"NEWdemo\", \"lastName\":\"NEWuser\", \"displayName\":\"NEWDemo User\"}" \-X PUT [https://staging-auth.elasticbeanstalk.com/auth/v1/user]
















































Send Change Password Email:
curl \-k \-H "Content-Type:application/json" \-H "Accept:application/json" \-d "\{\"email\":\"demouser@sagebase.org\"}" \-X POST [https://staging-auth.elasticbeanstalk.com/auth/v1/userPasswordEmail]

















































Login:
curl \-k \-H "Content-Type:application/json" \-H "Accept:application/json" \-d "\{\"email\":\"demouser@sagebase.org\", \"password\":\"demouser-pw\"\}" \-X POST [https://staging-auth.elasticbeanstalk.com/auth/v1/session]











































Refresh session token:

curl \-k \-H "Content-Type:application/json" \-H "Accept:application/json" \-d "\{\"sessionToken\":\"QYNoamrOKK0dBhjZOFfbAg00\"\}" \-X PUT [https://staging-auth.elasticbeanstalk.com/auth/v1/session]
















































Logout:
curl \-k \-H "Content-Type:application/json" \-H "Accept:application/json" \-d "\{\"sessionToken\":\"QYNoamrOKK0dBhjZOFfbAg00\"}" \-X DELETE [https://staging-auth.elasticbeanstalk.com/auth/v1/session]
















































Access repository services anonymously:
curl \-H Accept:application/json [https://staging-reposervice.elasticbeanstalk.com/repo/v1/dataset/test]
















































Access repository services with session token (obtained by logging in):
curl \-H Accept:application/json \-H sessionToken:AprxPRzpmaPm7FXzV1ik0w00 [https://staging-reposervice.elasticbeanstalk.com/repo/v1/dataset/test]\\




h3. Authentication of Requests to Platform

Requests shall include a header named "sessionToken"&nbsp;whose value is that&nbsp;returned by the Initiate Session request, above.&nbsp; (The session will timeout eventually, with a nominal duration of 24 hours.)

For requests that fail to be authenticated the response will include the headers:

WWW-Authenticate: authenticate Crowd










and a plain text body:&nbsp; "The token provided was invalid or expired."

h2. API for Authorization

h3. Get the users who can be added to a resource's ACL
{code}
GET https://staging-reposervice.elasticbeanstalk.com/repo/v1/user
{code}
{code}
[
  {"name":"anonymous","id":"3","creationDate":1307402971000,"uri":null,"etag":null,"individual":true},
  {"name":"foo@sagebase.org","id":"4","creationDate":1307403226000,"uri":null,"etag":null,"individual":true}
]
{code}


h3. Get the groups who can be added to a resource's ACL
{code}
GET https://staging-reposervice.elasticbeanstalk.com/repo/v1/userGroup
{code}
{code}
[
  {"name":"Identified Users","id":"1","creationDate":1307141423000,"uri":null,"etag":null,"individual":false},
  {"name":"Federation Group","id":"2","creationDate":1307141423000,"uri":null,"etag":null,"individual":false}
]
{code}

Note: The "id" fields returned from /user and /userGroup are used in the "userGroupId" fields in the ACLs shown below.

h3. Get Access Control List for a Resource

Returns the ACL for the node responsible for the given node's permissions. Note: In the following example, 'resourceId' is the id of the node to which permissions are attached, either rid or one of rid's ancestors; 'resource_type' is the type of rid (project, dataset, layer, etc.); there is one 'resourceAccess' entry per UserGroup (aka 'principal') having access to the resource; 'userGroupId' is the id of the UserGroup object; 'accessType' is the list of types of access the given UserGroup has to the given resource.
{code}
GET https://staging-reposervice.elasticbeanstalk.com/repo/v1/{resource_type}/{rid}/acl
{code}

{code}
{"id":"1",
 "creationDate":1307141851484,
 "uri":null,
 "etag":"0",
 "createdBy":"admin",
 "resourceId":"1",
 "resourceAccess":[
	{"id":"1",
	 "userGroupId":"4",
	 "accessType":["READ","CHANGE_PERMISSIONS","DELETE","UPDATE","CREATE"]
	}
 ],
 "modifiedBy":"admin",
 "modifiedOn":1307141851483
}
{code}


h3. Create Access Control List for a Resource

Note: This is only used when the resource 'rid' currently inherits its access control list from an ancestor. This request causes 'rid' to cease ACL inheritance and instead use the ACL passed in with the request.
{code}
POST https://staging-reposervice.elasticbeanstalk.com/repo/v1/{resource_type}/{rid}/acl
{
 "resourceId":{rid},
 "resourceAccess":[
	{"userGroupId":"4",
	 "accessType":["READ","CHANGE_PERMISSIONS","DELETE","UPDATE","CREATE"]
	}
 ]
}
{code}



h3. Update Access Control List for a Resource

Note: This is only used when a "resourceId" already specifies its access control list (does not inherit from an ancestor).
{code}
PUT https://staging-reposervice.elasticbeanstalk.com/repo/v1/{resource_type}/{rid}/acl
{"id":"1",
 "etag":"0",
 "resourceId":{rid},
 "resourceAccess":[
	{"id":"1",
	 "userGroupId":"4",
	 "accessType":["READ","CHANGE_PERMISSIONS","DELETE","UPDATE","CREATE"]
	}
 ],
}
{code}

h3. Delete Access Control List for a Resource

This deletes the given object's ACL, restoring its dependence on its owner's permissions.

{code}
DELETE https://staging-reposervice.elasticbeanstalk.com/repo/v1/{resource_type}/{rid}/acl
{code}


h3. Ask whether there is access to a Resource

Note: The query is asked for the user who is implied by the session token, or 'anonymous' if there is no token.

{code}
GET https://staging-reposervice.elasticbeanstalk.com/repo/v1/{resource_type}/{rid}/access?accessType={accessType}
{code}

{code}
{"result":true}
{code}

h1. More Examples

h2. Add a particular user with full access and identified individuals with read-only access to a project.

*Get Request:*{code}

Note: The ToU are available at this URL:

Code Block
https://auth-prod.sagebase.org/auth/v1/termsOfUse.html

Authentication via OpenID

Synapse supports authentication via OpenID with Google as the identity provider.  You as a client initiate the users identity verification with Google, and pass through the URL parameters to our REST api which will unpack the openID parameters, and verify the account. If login is successful a Session object will be returned. See the Synapse Authentication REST API documentation for details. 

Sample commands, issued from cURL:

Create User:
curl -k -H "Content-Type:application/json" -H "Accept:application/json" -d "{\"email\":\"demouser@sagebase.org\", \"firstName\":\"demo\", \"lastName\":\"user\", \"displayName\":\"Demo User\"}" -X POST https://auth-staging.sagebase.org/auth/v1/user

Send Change Password Email:
curl -k -H "Content-Type:application/json" -H "Accept:application/json" -d "{\"email\":\"demouser@sagebase.org\"}" -X POST https://auth-staging.sagebase.org/auth/v1/user/password/email

Login:
curl -k -H "Content-Type:application/json" -H "Accept:application/json" -d "{\"email\":\"demouser@sagebase.org\", \"password\":\"demouser-pw\"}" -X POST https://auth-staging.sagebase.org/auth/v1/session

Refresh session token:

curl -k -H "Content-Type:application/json" -H "Accept:application/json" -d "{\"sessionToken\":\"QYNoamrOKK0dBhjZOFfbAg00\"}" -X PUT https://auth-staging.sagebase.org/auth/v1/session

Logout:
curl -k -H "Content-Type:application/json" -H "Accept:application/json" -d "{\"sessionToken\":\"QYNoamrOKK0dBhjZOFfbAg00\"}" -X DELETE https://auth-staging.sagebase.org/auth/v1/session

Access repository services anonymously:
curl -H Accept:application/json https://repo-staging.sagebase.org/repo/v1/dataset/test

Access repository services with session token (obtained by logging in):
curl -H Accept:application/json -H sessionToken:AprxPRzpmaPm7FXzV1ik0w00 https://repo-staging.sagebase.org/repo/v1/dataset/test

Access repository services with HMAC-SHA1 signed request:
curl -i -H "Content-Type:application/json" -H "Accept:application/json" -H signatureTimestamp:2011-09-27T21:59:22.371-07:00 -H signature:yhMgokIH9ErQklj8oUuhHR5o5QM= -H userId:demouser@sagebase.org -X GET "http://localhost:8080/services-repository-0.7-SNAPSHOT/repo/v1/dataset?sort=name&limit=3"

Authentication of Requests to Platform

Authentication via Session Token

Requests shall include a header named "sessionToken" whose value is that returned by the Initiate Session request, above. (The session will timeout eventually, with a nominal duration of 24 hours.)

Authentication via Secret Key

Request shall include the following headers:

Code Block
userId: demouser@sagebase.org
signatureTimestamp: 2011-07-16T19:20:30.45+01:00 (i.e. in ISO8601 format including time zone)
signature: <signature>

where <signature> is the HMAC-SHA1 hash created using the shared secret key generated above, and the hashed data is the concatenation:
userId + uri + signatureTimestamp

URI example: If the request is made to

https://repo-staging.sagebase.org/repo/v1/dataset?sort=name&limit=3

then the URI is:

/repo/v1/dataset

Authentication Failure

For requests that fail to be authenticated the response will include the headers:

WWW-Authenticate: "Digest" your email

and a plain text body:  "The token provided was invalid or expired."

API for Authorization

Default groups

Currently, there are two default groups that can be used to set permissions:

Group Name

Description

PUBLIC

All users belong to this group. This is the only group that the anonymous@sagebase.org user belongs to. The anonymous user is used for anyone that has not logged in to Synapse. Therefore, granting permission to PUBLIC will grant that permission to everyone including users that have not logged in.

AUTHENTICATED_USERS

All users that have logged in will automatically belong to this group. Therefore, granting permissions to AUTHENTICATED_USERS will grant that permission to any user that has logged in to Synapse.

Get the users who can be added to a resource's ACL

Code Block
GET https://repo-staging.sagebase.org/repo/v1/user?offset=1&limit=100
Code Block
{"totalNumberOfResults":340,
    "results":[
        {"lastName":"Bar","etag":"403","ownerId":"273956","firstName":"Foo","displayName":"Foo Bar"},
        ....
    ],
    "paging":{"next":"/repo/v1/user?offset=101&limit=100"}
}

Get the groups who can be added to a resource's ACL

Code Block
GET https://repo-staging.sagebase.org/repo/v1/userGroup
Code Block
[
  {"name":"AUTHENTICATED_USERS","id":"1","creationDate":1307141423000,"uri":null,"etag":null,"individual":false},
  {"name":"PUBLIC","id":"2","creationDate":1307141423000,"uri":null,"etag":null,"individual":false},
  {"name":"Federation Group","id":"3","creationDate":1307141423000,"uri":null,"etag":null,"individual":false}
]

Note: The "name" fields returned from /user and /userGroup are used in the "groupName" fields in the ACLs shown below.

Get Access Control List for a Resource

Returns the ACL for the node responsible for the given node's permissions. Note: In the following example, 'id' is the id of the node to which permissions are attached; there is one 'resourceAccess' entry per UserGroup (aka 'principal') having access to the resource; 'groupName' is the name of the UserGroup object; 'accessType' is the list of types of access the given UserGroup has to the given resource.

Code Block
GET https://repo-staging.sagebase.org/repo/v1/entity/{entity_id}/acl
Code Block
{"id":"1",
 "creationDate":1307141851484,
 "uri":null,
 "etag":"0",
 "createdBy":"admin",
 "resourceAccess":[
	{"id":"1",
	 "groupName":"PUBLIC",
	 "accessType":["READ","CHANGE_PERMISSIONS","DELETE","UPDATE","CREATE"]
	}
 ],
 "modifiedBy":"admin",
 "modifiedOn":1307141851483
}

Create Access Control List for a Resource

Note: This is only used when the resource 'rid' currently inherits its access control list from an ancestor. This request causes 'rid' to cease ACL inheritance and instead use the ACL passed in with the request.

Code Block
POST https://repo-staging.sagebase.org/repo/v1/entity/{entity_id}/acl
{"id":"{entity_id}",
 "resourceAccess":[
	{"groupName":"PUBLIC",
	 "accessType":["READ","CHANGE_PERMISSIONS","DELETE","UPDATE","CREATE"]
	}
 ]
}

Update Access Control List for a Resource

Note: This is only used when a "entity_id" already specifies its access control list (does not inherit from an ancestor).

Code Block
PUT https://repo-staging.sagebase.org/repo/v1/entity/{entity_id}/acl
{"id":"1",
 "etag":"0",
 "resourceAccess":[
	{"id":"1",
	 "groupName":"PUBLIC",
	 "accessType":["READ","CHANGE_PERMISSIONS","DELETE","UPDATE","CREATE"]
	}
 ],
}

Delete Access Control List for a Resource

This deletes the given object's ACL, restoring its dependence on its owner's permissions.

Code Block
DELETE https://repo-staging.sagebase.org/repo/v1/entity/{entity_id}/acl

Ask whether there is access to a Resource

Note: The query is asked for the user who is implied by the session token, or 'anonymous' if there is no token.

Code Block
GET https://repo-staging.sagebase.org/repo/v1/entity/{entity_id}/access?accessType={accessType}
Code Block
{"result":true}

API For Resource Access

The Synapse Authorization Services include support for creating abstract 'resources' and allowing users access.  The defined requests are shown below.  Note:  All requests must be authenticated, as described earlier in this document.

Authorize a User for a Resource

Code Block
POST https://auth-staging.sagebase.org/auth/v1/resourceAccess/{resourceName}
{"userName":"demouser@sagebase.org", "userData":"some-user-data"}

Note:  The user executing this request must be a Synapse Administrator.

Successful Response:

Code Block
HTTP/1.1 201 Created

Create a Resource-Access Session

Code Block
POST https://auth-staging.sagebase.org/auth/v1/resourceSession/{resourceName}

Note:  The session is created for the user authenticated in the request.

Successful Response:

Code Block
HTTP/1.1 201 Created
{"resourceAccessToken":"a1b2c3d4e5f6"}

Unsuccessful Response:

Code Block
HTTP/1.1 401 Unauthorized
{"reason": "Not authorized."}

 

Validate a Resource-Access Session

Code Block
GET https://auth-staging.sagebase.org/auth/v1/resourceSession/a1b2c3d4e5f6

Note:  Though the request must be authenticated, the user making the request need not be the same as the user whose session is indicated by the passed token.  This allows (for example) a 'service account' to request authentication of tokens owned by real users.

Successful Response:

Code Block
HTTP/1.1 200 OK
{"userName":"demouser@sagebase.org", "userData":"some-user-data"}

Unsuccessful Response:

Code Block
HTTP/1.1 401 Unauthorized
{"reason": "Not authorized."}

 

API for User Profiles

Get your own profile

Code Block
GET https://repo-staging.sagebase.org/repo/v1/userProfile

returns the profile of the authenticated user:

Code Block
{
	"firstName":"Jane",
	"lastName":"Smith",
	"userName","janesmith@sagebase.org",
	"displayName":"Jane Smith",
	"rStudioUrl":"http://rstudiohost.sagebase.org",
	"ownerId":"1001",
	"uri":"/userProfile",
	"etag":"0"
}

Get another's profile

Code Block
GET https://repo-staging.sagebase.org/repo/v1/userProfile/1001

returns the profile of the specified user, where "ownerId" is the "id" field returned in the "/user" request, described above, https://sagebionetworks.jira.com/wiki/display/PLFM/Authentication+and+Authorization+API#AuthenticationandAuthorizationAPI-GettheuserswhocanbeaddedtoaresourcesACL.

Note:  Private fields (e.g. "rStudioUrl") are omitted unless the requestor is the profile owner or an administrator.

 

Code Block
{
	"firstName":"Jane",
	"lastName":"Smith",
	"displayName":"Jane Smith",
	"ownerId":"1001",
	"uri":"/userProfile",
	"etag":"0"
} 


Update your own profile

Code Block
PUT https://repo-staging.sagebase.org/repo/v1/userProfile
{
	"firstName":"Jane",
	"lastName":"Smith",
	"userName","janesmith@sagebase.org",
	"displayName":"Jane Smith",
	"rStudioUrl":"http://rstudiohost.sagebase.org",
	"ownerId":"1001",
	"uri":"/userProfile",
	"etag":"0"
} 

Note:  The user associated with "ownerId" must match the identity of the authenticated user making the request, otherwise and Unauthorized response will occur.

 

Update another's profile

Code Block
PUT https://repo-staging.sagebase.org/repo/v1/userProfile/1001
{
	"firstName":"Jane",
	"lastName":"Smith",
	"userName","janesmith@sagebase.org",
	"displayName":"Jane Smith",
	"rStudioUrl":"http://rstudiohost.sagebase.org",
	"ownerId":"1001",
	"uri":"/userProfile",
	"etag":"0"
} 

Note:  This API is available only to administrators.

Get a batch of Headers for Users and Groups

Synapse provides a batch UserGroupHeader service to fetch information about a collection of users or groups, specified by Synapse IDs. UserGroupHeaders contain a user's name, e-mail address, display name, and picture URL, when available.

Code Block
GET https://repo-staging.sagebase.org/repo/v1/userGroupHeaders/batch?ids=1001,819

Note that ids are specified as request parameters at the end of the URL, separated by commas. In the example above, we are fetching headers for Synapse IDs 1001 and 819.

Get Users and Groups by email

This service can be used to search for synapse users by name or email:

Code Block
GET {repo-endpoint}/userGroupHeaders?prefix=john.doe@somedomain.org

returns:

Code Block
{'totalNumberOfResults': 1,
 'children':[
    {'displayName': 'John Doe',
     'firstName': 'John',
     'lastName': 'Doe',
     'pic': {'contentType': 'image/jpeg',
             'name': '1421211.jpg',
             'tokenId': '1444862/1421211.jpg',
             'previewId': '1444863/1421211.jpg',
             'md5': '3211e11de379bc62b70bd2a1fc49255e',
             'previewState': 'PREVIEW_EXISTS'},
     'email': 'joh...e@somedomain.org',
     'ownerId': '1421212',
     'isIndividual': True}],
 'prefixFilter': 'john.doe@somedomain.org'}
 

More Examples

Add a particular user with full access and identified individuals with read-only access to a project.

Get Request:

Code Block
curl -H sessionToken:XXXXXXXXXXXXXXXXXX -H Content-Type:application/json -k  https://reposvcrepo-alphastaging.sagebase.org/repo/v1/project/498/acl
{code}

*Get

Get Response:

...

}
Code Block
{
   "id":"3",
   "creationDate":1308274656084,
   "etag":"0",
   "createdBy":"nicole.deflaux@sagebase.org",
   "resourceId":"498",
   "resourceAccess":[
      {
         "id":"4",
         "userGroupIdgroupName":"7AUTHENTICATED_USERS",
         "accessType":[
            "DELETE",
            "CHANGE_PERMISSIONS",
            "UPDATE",
            "READ",
            "CREATE"
         ]
      }
   ],
   "modifiedBy":"nicole.deflaux@sagebase.org",
   "modifiedOn":1308274656084,
   "uri":"/repo/v1/project/498/acl"
}{code}


*Update Request*:{code}

Update Request:

Code Block
curl -H sessionToken:XXXXXXXXX -H Content-Type:application/json -X PUT -d '{
   "id":"3",
   "creationDate":1308274656084,
   "etag":"0",
   "createdBy":"nicole.deflaux@sagebase.org",
   "resourceId":"498",
   "resourceAccess":[
      {
         "userGroupIdgroupName":"1AUTHENTICATED_USERS",
         "accessType":[
            "READ"
         ]
      },
      {
         "userGroupIdgroupName":"7nicole.deflaux@sagebase.org",
         "accessType":[
            "DELETE",
            "CHANGE_PERMISSIONS",
            "UPDATE",
            "READ",
            "CREATE"
         ]
      },
      {
         "userGroupIdgroupName":"18someuser@sagebase.org",
         "accessType":[
            "DELETE",
            "CHANGE_PERMISSIONS",
            "UPDATE",
            "READ",
            "CREATE"
         ]
      }
   ],
   "modifiedBy":"nicole.deflaux@sagebase.org",
   "modifiedOn":1308274656084,
   "uri":"/repo/v1/project/498/acl"
}' https://reposvcrepo-alphastaging.sagebase.org/repo/v1/project/498/acl
{code}

*Update Response*:{code}

Update Response:

Code Block
{
   "id":"3",
   "creationDate":1308274656084,
   "etag":"0",
   "createdBy":"nicole.deflaux@sagebase.org",
   "resourceId":"498",
   "resourceAccess":[
      {
         "id":null,
         "userGroupIdgroupName":"7someuser@sagebase.org",
         "accessType":[
            "DELETE",
            "UPDATE",
            "CHANGE_PERMISSIONS",
            "READ",
            "CREATE"
         ]
      },
      {
         "id":null,
         "userGroupIdgroupName":"18nicole.deflaux@sagebase.org",
         "accessType":[
            "DELETE",
            "UPDATE",
            "CHANGE_PERMISSIONS",
            "READ",
            "CREATE"
         ]
      },
      {
         "id":null,
         "userGroupIdgroupName":"1AUTHENTICATED_USERS",
         "accessType":[
            "READ"
         ]
      }
   ],
   "modifiedBy":"nicole.deflaux@sagebase.org",
   "modifiedOn":1308274656084,
   "uri":"/repo/v1/project/498/acl"
}{code}