1181 lines
29 KiB
ReStructuredText
1181 lines
29 KiB
ReStructuredText
..
|
|
Copyright 2011-2012 OpenStack Foundation
|
|
All Rights Reserved.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
not use this file except in compliance with the License. You may obtain
|
|
a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
License for the specific language governing permissions and limitations
|
|
under the License.
|
|
|
|
=======================
|
|
API Examples using Curl
|
|
=======================
|
|
|
|
--------------------------
|
|
v3 API Examples Using Curl
|
|
--------------------------
|
|
|
|
Tokens
|
|
======
|
|
|
|
Default scope
|
|
-------------
|
|
|
|
Get an token with default scope (may be unscoped):
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -i \
|
|
-H "Content-Type: application/json" \
|
|
-d '
|
|
{ "auth": {
|
|
"identity": {
|
|
"methods": ["password"],
|
|
"password": {
|
|
"user": {
|
|
"name": "admin",
|
|
"domain": { "id": "default" },
|
|
"password": "adminpwd"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}' \
|
|
http://localhost:5000/v3/auth/tokens ; echo
|
|
|
|
Example response::
|
|
|
|
HTTP/1.1 201 Created
|
|
X-Subject-Token: MIIFvgY...
|
|
Vary: X-Auth-Token
|
|
Content-Type: application/json
|
|
Content-Length: 1025
|
|
Date: Tue, 10 Jun 2014 20:55:16 GMT
|
|
|
|
{"token": {"methods": ["password"], "roles": [{"id":
|
|
"9fe2ff9ee4384b1894a90878d3e92bab", "name": "_member_"}, {"id":
|
|
"c703057be878458588961ce9a0ce686b", "name": "admin"}], "expires_at":
|
|
"2014-06-10T2:55:16.806001Z", "project": {"domain": {"id": "default", "name":
|
|
"Default"}, "id": "8538a3f13f9541b28c2620eb19065e45", "name": "admin"},
|
|
"catalog": [{"endpoints": [{"url": "http://localhost:3537/v2.0", "region":
|
|
"RegionOne", "interface": "admin", "id": "29beb2f1567642eb810b042b6719ea88"},
|
|
{"url": "http://localhost:5000/v2.0", "region": "RegionOne", "interface":
|
|
"internal", "id": "8707e3735d4415c97ae231b4841eb1c"}, {"url":
|
|
"http://localhost:5000/v2.0", "region": "RegionOne", "interface": "public",
|
|
"id": "ef303187fc8d41668f25199c298396a5"}], "type": "identity", "id":
|
|
"bd73972c0e14fb69bae8ff76e112a90", "name": "keystone"}], "extras": {},
|
|
"user": {"domain": {"id": "default", "name": "Default"}, "id":
|
|
"3ec3164f750146be97f21559ee4d9c51", "name": "admin"}, "issued_at":
|
|
"201406-10T20:55:16.806027Z"}}
|
|
|
|
|
|
Project-scoped
|
|
--------------
|
|
|
|
Get a project-scoped token:
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -i \
|
|
-H "Content-Type: application/json" \
|
|
-d '
|
|
{ "auth": {
|
|
"identity": {
|
|
"methods": ["password"],
|
|
"password": {
|
|
"user": {
|
|
"name": "admin",
|
|
"domain": { "id": "default" },
|
|
"password": "adminpwd"
|
|
}
|
|
}
|
|
},
|
|
"scope": {
|
|
"project": {
|
|
"name": "demo",
|
|
"domain": { "id": "default" }
|
|
}
|
|
}
|
|
}
|
|
}' \
|
|
http://localhost:5000/v3/auth/tokens ; echo
|
|
|
|
Example response::
|
|
|
|
HTTP/1.1 201 Created
|
|
X-Subject-Token: MIIFfQ...
|
|
Vary: X-Auth-Token
|
|
Content-Type: application/json
|
|
Content-Length: 960
|
|
Date: Tue, 10 Jun 2014 20:40:14 GMT
|
|
|
|
{"token": {"methods": ["password"], "roles": [{"id":
|
|
"c703057be878458588961ce9a0ce686b", "name": "admin"}], "expires_at":
|
|
"2014-06-10T21:40:14.360795Z", "project": {"domain": {"id": "default",
|
|
"name": "Default"}, "id": "3d4c2c82bd5948f0bcab0cf3a7c9b48c", "name":
|
|
"demo"}, "catalog": [{"endpoints": [{"url":
|
|
"http://localhost:35357/v2.0", "region": "RegionOne", "interface": "admin",
|
|
"id": "29beb2f1567642eb810b042b6719ea88"}, {"url":
|
|
"http://localhost:5000/v2.0", "region": "RegionOne", "interface":
|
|
"internal", "id": "87057e3735d4415c97ae231b4841eb1c"}, {"url":
|
|
"http://localhost:5000/v2.0", "region": "RegionOne", "interface": "public",
|
|
"id": "ef303187fc8d41668f25199c298396a5"}], "type": "identity", "id":
|
|
"bd7397d2c0e14fb69bae8ff76e112a90", "name": "keystone"}], "extras": {},
|
|
"user": {"domain": {"id": "default", "name": "Default"}, "id":
|
|
"3ec3164f750146be97f21559ee4d9c51", "name": "admin"}, "issued_at":
|
|
"2014-06-10T20:40:14.360822Z"}}
|
|
|
|
|
|
Domain-Scoped
|
|
-------------
|
|
|
|
Get a domain-scoped token (Note that you're going to need a role-assignment on
|
|
the domain first!):
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -i \
|
|
-H "Content-Type: application/json" \
|
|
-d '
|
|
{ "auth": {
|
|
"identity": {
|
|
"methods": ["password"],
|
|
"password": {
|
|
"user": {
|
|
"name": "admin",
|
|
"domain": { "id": "default" },
|
|
"password": "adminpwd"
|
|
}
|
|
}
|
|
},
|
|
"scope": {
|
|
"domain": {
|
|
"id": "default"
|
|
}
|
|
}
|
|
}
|
|
}' \
|
|
http://localhost:5000/v3/auth/tokens ; echo
|
|
|
|
Example response::
|
|
|
|
HTTP/1.1 201 Created
|
|
X-Subject-Token: MIIFNg...
|
|
Vary: X-Auth-Token
|
|
Content-Type: application/json
|
|
Content-Length: 889
|
|
Date: Tue, 10 Jun 2014 20:52:59 GMT
|
|
|
|
{"token": {"domain": {"id": "default", "name": "Default"}, "methods":
|
|
["password"], "roles": [{"id": "c703057be878458588961ce9a0ce686b", "name":
|
|
"admin"}], "expires_at": "2014-06-10T21:52:58.852167Z", "catalog":
|
|
[{"endpoints": [{"url": "http://localhost:35357/v2.0", "region": "RegionOne",
|
|
"interface": "admin", "id": "29beb2f1567642eb810b042b6719ea88"}, {"url":
|
|
"http://localhost:5000/v2.0", "region": "RegionOne", "interface": "internal",
|
|
"id": "87057e3735d4415c97ae231b4841eb1c"}, {"url":
|
|
"http://localhost:5000/v2.0", "region": "RegionOne", "interface": "public",
|
|
"id": "ef303187fc8d41668f25199c298396a5"}], "type": "identity", "id":
|
|
"bd7397d2c0e14fb69bae8ff76e112a90", "name": "keystone"}], "extras": {},
|
|
"user": {"domain": {"id": "default", "name": "Default"}, "id":
|
|
"3ec3164f750146be97f21559ee4d9c51", "name": "admin"}, "issued_at":
|
|
"2014-06-10T20:52:58.852194Z"}}
|
|
|
|
|
|
Getting a token from a token
|
|
----------------------------
|
|
|
|
Get a token from a token:
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -i \
|
|
-H "Content-Type: application/json" \
|
|
-d '
|
|
{ "auth": {
|
|
"identity": {
|
|
"methods": ["token"],
|
|
"token": {
|
|
"id": "'$OS_TOKEN'"
|
|
}
|
|
}
|
|
}
|
|
}' \
|
|
http://localhost:5000/v3/auth/tokens ; echo
|
|
|
|
|
|
Example response::
|
|
|
|
HTTP/1.1 201 Created
|
|
X-Subject-Token: MIIFxw...
|
|
Vary: X-Auth-Token
|
|
Content-Type: application/json
|
|
Content-Length: 1034
|
|
Date: Tue, 10 Jun 2014 21:00:05 GMT
|
|
|
|
{"token": {"methods": ["token", "password"], "roles": [{"id":
|
|
"9fe2ff9ee4384b1894a90878d3e92bab", "name": "_member_"}, {"id":
|
|
"c703057be878458588961ce9a0ce686b", "name": "admin"}], "expires_at":
|
|
"2014-06-10T21:55:16.806001Z", "project": {"domain": {"id": "default",
|
|
"name": "Default"}, "id": "8538a3f13f9541b28c2620eb19065e45", "name":
|
|
"admin"}, "catalog": [{"endpoints": [{"url": "http://localhost:35357/v2.0",
|
|
"region": "RegionOne", "interface": "admin", "id":
|
|
"29beb2f1567642eb810b042b6719ea88"}, {"url": "http://localhost:5000/v2.0",
|
|
"region": "RegionOne", "interface": "internal", "id":
|
|
"87057e3735d4415c97ae231b4841eb1c"}, {"url": "http://localhost:5000/v2.0",
|
|
"region": "RegionOne", "interface": "public", "id":
|
|
"ef303187fc8d41668f25199c298396a5"}], "type": "identity", "id":
|
|
"bd7397d2c0e14fb69bae8ff76e112a90", "name": "keystone"}], "extras": {},
|
|
"user": {"domain": {"id": "default", "name": "Default"}, "id":
|
|
"3ec3164f750146be97f21559ee4d9c51", "name": "admin"}, "issued_at":
|
|
"2014-06-10T21:00:05.548559Z"}}
|
|
|
|
|
|
.. note::
|
|
|
|
If a scope was included in the request body then this would get a token
|
|
with the new scope.
|
|
|
|
|
|
DELETE /v3/auth/tokens
|
|
----------------------
|
|
|
|
Revoke a token:
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -i -X DELETE \
|
|
-H "X-Auth-Token: $OS_TOKEN" \
|
|
-H "X-Subject-Token: $OS_TOKEN" \
|
|
http://localhost:5000/v3/auth/tokens
|
|
|
|
If there's no error then the response is empty.
|
|
|
|
|
|
Domains
|
|
=======
|
|
|
|
GET /v3/domains
|
|
---------------
|
|
|
|
List domains:
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -s \
|
|
-H "X-Auth-Token: $OS_TOKEN" \
|
|
http://localhost:5000/v3/domains | python -mjson.tool
|
|
|
|
Example response:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"domains": [
|
|
{
|
|
"description": "Owns users and tenants (i.e. projects) available on Identity API v2.",
|
|
"enabled": true,
|
|
"id": "default",
|
|
"links": {
|
|
"self": "http://identity-server:5000/v3/domains/default"
|
|
},
|
|
"name": "Default"
|
|
}
|
|
],
|
|
"links": {
|
|
"next": null,
|
|
"previous": null,
|
|
"self": "http://identity-server:5000/v3/domains"
|
|
}
|
|
}
|
|
|
|
|
|
POST /v3/domains
|
|
----------------
|
|
|
|
Create a domain:
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -s \
|
|
-H "X-Auth-Token: $OS_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{ "domain": { "name": "newdomain"}}' \
|
|
http://localhost:5000/v3/domains | python -mjson.tool
|
|
|
|
Example response:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"domain": {
|
|
"enabled": true,
|
|
"id": "3a5140aecd974bf08041328b53a62458",
|
|
"links": {
|
|
"self": "http://identity-server:5000/v3/domains/3a5140aecd974bf08041328b53a62458"
|
|
},
|
|
"name": "newdomain"
|
|
}
|
|
}
|
|
|
|
|
|
Projects
|
|
========
|
|
|
|
GET /v3/projects
|
|
----------------
|
|
|
|
List projects:
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -s \
|
|
-H "X-Auth-Token: $OS_TOKEN" \
|
|
http://localhost:5000/v3/projects | python -mjson.tool
|
|
|
|
Example response:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"links": {
|
|
"next": null,
|
|
"previous": null,
|
|
"self": "http://localhost:5000/v3/projects"
|
|
},
|
|
"projects": [
|
|
{
|
|
"description": null,
|
|
"domain_id": "default",
|
|
"enabled": true,
|
|
"id": "3d4c2c82bd5948f0bcab0cf3a7c9b48c",
|
|
"links": {
|
|
"self": "http://localhost:5000/v3/projects/3d4c2c82bd5948f0bcab0cf3a7c9b48c"
|
|
},
|
|
"name": "demo"
|
|
}
|
|
]
|
|
}
|
|
|
|
|
|
PATCH /v3/projects/{id}
|
|
-----------------------
|
|
|
|
Disable a project:
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -s -X PATCH \
|
|
-H "X-Auth-Token: $OS_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d '
|
|
{
|
|
"project": {
|
|
"enabled": false
|
|
}
|
|
}'\
|
|
http://localhost:5000/v3/projects/$PROJECT_ID | python -mjson.tool
|
|
|
|
Example response:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"project": {
|
|
"description": null,
|
|
"domain_id": "default",
|
|
"enabled": false,
|
|
"extra": {},
|
|
"id": "3d4c2c82bd5948f0bcab0cf3a7c9b48c",
|
|
"links": {
|
|
"self": "http://localhost:5000/v3/projects/3d4c2c82bd5948f0bcab0cf3a7c9b48c"
|
|
},
|
|
"name": "demo"
|
|
}
|
|
}
|
|
|
|
|
|
GET /v3/services
|
|
================
|
|
|
|
List the services:
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -s \
|
|
-H "X-Auth-Token: $OS_TOKEN" \
|
|
http://localhost:5000/v3/services | python -mjson.tool
|
|
|
|
Example response:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"links": {
|
|
"next": null,
|
|
"previous": null,
|
|
"self": "http://localhost:5000/v3/services"
|
|
},
|
|
"services": [
|
|
{
|
|
"description": "Keystone Identity Service",
|
|
"enabled": true,
|
|
"id": "bd7397d2c0e14fb69bae8ff76e112a90",
|
|
"links": {
|
|
"self": "http://localhost:5000/v3/services/bd7397d2c0e14fb69bae8ff76e112a90"
|
|
},
|
|
"name": "keystone",
|
|
"type": "identity"
|
|
}
|
|
]
|
|
}
|
|
|
|
|
|
|
|
GET /v3/endpoints
|
|
=================
|
|
|
|
List the endpoints:
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -s \
|
|
-H "X-Auth-Token: $OS_TOKEN" \
|
|
http://localhost:5000/v3/endpoints | python -mjson.tool
|
|
|
|
Example response:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"endpoints": [
|
|
{
|
|
"enabled": true,
|
|
"id": "29beb2f1567642eb810b042b6719ea88",
|
|
"interface": "admin",
|
|
"links": {
|
|
"self": "http://localhost:5000/v3/endpoints/29beb2f1567642eb810b042b6719ea88"
|
|
},
|
|
"region": "RegionOne",
|
|
"service_id": "bd7397d2c0e14fb69bae8ff76e112a90",
|
|
"url": "http://localhost:35357/v2.0"
|
|
}
|
|
],
|
|
"links": {
|
|
"next": null,
|
|
"previous": null,
|
|
"self": "http://localhost:5000/v3/endpoints"
|
|
}
|
|
}
|
|
|
|
|
|
Users
|
|
=====
|
|
|
|
GET /v3/users
|
|
-------------
|
|
|
|
List users:
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -s \
|
|
-H "X-Auth-Token: $OS_TOKEN" \
|
|
http://localhost:5000/v3/users | python -mjson.tool
|
|
|
|
POST /v3/users
|
|
--------------
|
|
|
|
Create a user:
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -s \
|
|
-H "X-Auth-Token: $OS_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"user": {"name": "newuser", "password": "changeme"}}' \
|
|
http://localhost:5000/v3/users | python -mjson.tool
|
|
|
|
Example response:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"user": {
|
|
"domain_id": "default",
|
|
"enabled": true,
|
|
"id": "ec8fc20605354edd91873f2d66bf4fc4",
|
|
"links": {
|
|
"self": "http://identity-server:5000/v3/users/ec8fc20605354edd91873f2d66bf4fc4"
|
|
},
|
|
"name": "newuser"
|
|
}
|
|
}
|
|
|
|
GET /v3/users/{user_id}
|
|
-----------------------
|
|
|
|
Show details for a user:
|
|
|
|
.. code-block:: bash
|
|
|
|
USER_ID=ec8fc20605354edd91873f2d66bf4fc4
|
|
|
|
curl -s \
|
|
-H "X-Auth-Token: $OS_TOKEN" \
|
|
http://localhost:5000/v3/users/$USER_ID | python -mjson.tool
|
|
|
|
Example response:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"user": {
|
|
"domain_id": "default",
|
|
"enabled": true,
|
|
"id": "ec8fc20605354edd91873f2d66bf4fc4",
|
|
"links": {
|
|
"self": "http://localhost:5000/v3/users/ec8fc20605354edd91873f2d66bf4fc4"
|
|
},
|
|
"name": "newuser"
|
|
}
|
|
}
|
|
|
|
POST /v3/users/{user_id}/password
|
|
---------------------------------
|
|
|
|
Change password (using the default policy, this can be done as the user):
|
|
|
|
.. code-block:: bash
|
|
|
|
USER_ID=b7793000f8d84c79af4e215e9da78654
|
|
ORIG_PASS=userpwd
|
|
NEW_PASS=newuserpwd
|
|
|
|
curl \
|
|
-H "X-Auth-Token: $OS_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{ "user": {"password": "'$NEW_PASS'", "original_password": "'$ORIG_PASS'"} }' \
|
|
http://localhost:5000/v3/users/$USER_ID/password
|
|
|
|
.. note::
|
|
|
|
This command doesn't print anything if the request was successful.
|
|
|
|
PATCH /v3/users/{user_id}
|
|
-------------------------
|
|
|
|
Reset password (using the default policy, this requires admin):
|
|
|
|
.. code-block:: bash
|
|
|
|
USER_ID=b7793000f8d84c79af4e215e9da78654
|
|
NEW_PASS=newuserpwd
|
|
|
|
curl -s -X PATCH \
|
|
-H "X-Auth-Token: $OS_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{ "user": {"password": "'$NEW_PASS'"} }' \
|
|
http://localhost:5000/v3/users/$USER_ID | python -mjson.tool
|
|
|
|
Example response:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"user": {
|
|
"default_project_id": "3d4c2c82bd5948f0bcab0cf3a7c9b48c",
|
|
"domain_id": "default",
|
|
"email": "demo@example.com",
|
|
"enabled": true,
|
|
"extra": {
|
|
"email": "demo@example.com"
|
|
},
|
|
"id": "269348fdd9374b8885da1418e0730af1",
|
|
"links": {
|
|
"self": "http://localhost:5000/v3/users/269348fdd9374b8885da1418e0730af1"
|
|
},
|
|
"name": "demo"
|
|
}
|
|
}
|
|
|
|
|
|
PUT /v3/projects/{project_id}/groups/{group_id}/roles/{role_id}
|
|
===============================================================
|
|
|
|
Create group role assignment on project:
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -s -X PUT \
|
|
-H "X-Auth-Token: $OS_TOKEN" \
|
|
http://localhost:5000/v3/projects/$PROJECT_ID/groups/$GROUP_ID/roles/$ROLE_ID |
|
|
python -mjson.tool
|
|
|
|
There's no data in the response if the operation is successful.
|
|
|
|
|
|
POST /v3/OS-TRUST/trusts
|
|
========================
|
|
|
|
Create a trust:
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -s \
|
|
-H "X-Auth-Token: $OS_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d '
|
|
{ "trust": {
|
|
"expires_at": "2014-12-30T23:59:59.999999Z",
|
|
"impersonation": false,
|
|
"project_id": "'$PROJECT_ID'",
|
|
"roles": [
|
|
{ "name": "admin" }
|
|
],
|
|
"trustee_user_id": "'$DEMO_USER_ID'",
|
|
"trustor_user_id": "'$ADMIN_USER_ID'"
|
|
}}'\
|
|
http://localhost:5000/v3/OS-TRUST/trusts | python -mjson.tool
|
|
|
|
Example response:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"trust": {
|
|
"expires_at": "2014-12-30T23:59:59.999999Z",
|
|
"id": "394998fa61f14736b1f0c1f322882949",
|
|
"impersonation": false,
|
|
"links": {
|
|
"self": "http://localhost:5000/v3/OS-TRUST/trusts/394998fa61f14736b1f0c1f322882949"
|
|
},
|
|
"project_id": "3d4c2c82bd5948f0bcab0cf3a7c9b48c",
|
|
"remaining_uses": null,
|
|
"roles": [
|
|
{
|
|
"id": "c703057be878458588961ce9a0ce686b",
|
|
"links": {
|
|
"self": "http://localhost:5000/v3/roles/c703057be878458588961ce9a0ce686b"
|
|
},
|
|
"name": "admin"
|
|
}
|
|
],
|
|
"roles_links": {
|
|
"next": null,
|
|
"previous": null,
|
|
"self": "http://localhost:5000/v3/OS-TRUST/trusts/394998fa61f14736b1f0c1f322882949/roles"
|
|
},
|
|
"trustee_user_id": "269348fdd9374b8885da1418e0730af1",
|
|
"trustor_user_id": "3ec3164f750146be97f21559ee4d9c51"
|
|
}
|
|
}
|
|
|
|
|
|
-------------------------------
|
|
Service API Examples Using Curl
|
|
-------------------------------
|
|
|
|
The service API is defined to be a subset of the Admin API and, by
|
|
default, runs on port 5000.
|
|
|
|
GET /
|
|
=====
|
|
|
|
This call is identical to that documented for the Admin API, except
|
|
that it uses port 5000, instead of port 35357, by default:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl http://0.0.0.0:5000
|
|
|
|
or:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl http://0.0.0.0:5000/v2.0/
|
|
|
|
See the `Admin API Examples Using Curl`_ for more info.
|
|
|
|
GET /extensions
|
|
===============
|
|
|
|
This call is identical to that documented for the Admin API.
|
|
|
|
POST /tokens
|
|
============
|
|
|
|
This call is identical to that documented for the Admin API.
|
|
|
|
GET /tenants
|
|
============
|
|
|
|
List all of the tenants your token can access:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl -H "X-Auth-Token:887665443383838" http://localhost:5000/v2.0/tenants
|
|
|
|
Returns:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"tenants_links": [],
|
|
"tenants": [
|
|
{
|
|
"enabled": true,
|
|
"description": "None",
|
|
"name": "customer-x",
|
|
"id": "1"
|
|
}
|
|
]
|
|
}
|
|
|
|
-----------------------------
|
|
Admin API Examples Using Curl
|
|
-----------------------------
|
|
|
|
These examples assume a default port value of 35357, and depend on the
|
|
``sampledata`` bundled with keystone.
|
|
|
|
GET /
|
|
=====
|
|
|
|
Discover API version information, links to documentation (PDF, HTML, WADL),
|
|
and supported media types:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl http://0.0.0.0:35357
|
|
|
|
or:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl http://0.0.0.0:35357/v2.0/
|
|
|
|
Returns:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"version":{
|
|
"id":"v2.0",
|
|
"status":"beta",
|
|
"updated":"2011-11-19T00:00:00Z",
|
|
"links":[
|
|
{
|
|
"rel":"self",
|
|
"href":"http://127.0.0.1:35357/v2.0/"
|
|
},
|
|
{
|
|
"rel":"describedby",
|
|
"type":"text/html",
|
|
"href":"http://docs.openstack.org/"
|
|
},
|
|
],
|
|
"media-types":[
|
|
{
|
|
"base":"application/xml",
|
|
"type":"application/vnd.openstack.identity-v2.0+xml"
|
|
},
|
|
{
|
|
"base":"application/json",
|
|
"type":"application/vnd.openstack.identity-v2.0+json"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
GET /extensions
|
|
===============
|
|
|
|
Discover the API extensions enabled at the endpoint:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl http://localhost:35357/v2.0/extensions/
|
|
|
|
Returns:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"extensions":{
|
|
"values":[]
|
|
}
|
|
}
|
|
|
|
POST /tokens
|
|
============
|
|
|
|
Authenticate by exchanging credentials for an access token:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl -d '{"auth":{"tenantName": "customer-x", "passwordCredentials": {"username": "joeuser", "password": "secrete"}}}' -H "Content-type: application/json" http://localhost:35357/v2.0/tokens
|
|
|
|
Returns:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"access":{
|
|
"token":{
|
|
"expires":"2012-02-05T00:00:00",
|
|
"id":"887665443383838",
|
|
"tenant":{
|
|
"id":"1",
|
|
"name":"customer-x"
|
|
}
|
|
},
|
|
"serviceCatalog":[
|
|
{
|
|
"endpoints":[
|
|
{
|
|
"adminURL":"http://swift.admin-nets.local:8080/",
|
|
"region":"RegionOne",
|
|
"internalURL":"http://127.0.0.1:8080/v1/AUTH_1",
|
|
"publicURL":"http://swift.publicinternets.com/v1/AUTH_1"
|
|
}
|
|
],
|
|
"type":"object-store",
|
|
"name":"swift"
|
|
},
|
|
{
|
|
"endpoints":[
|
|
{
|
|
"adminURL":"http://cdn.admin-nets.local/v1.1/1",
|
|
"region":"RegionOne",
|
|
"internalURL":"http://127.0.0.1:7777/v1.1/1",
|
|
"publicURL":"http://cdn.publicinternets.com/v1.1/1"
|
|
}
|
|
],
|
|
"type":"object-store",
|
|
"name":"cdn"
|
|
}
|
|
],
|
|
"user":{
|
|
"id":"1",
|
|
"roles":[
|
|
{
|
|
"tenantId":"1",
|
|
"id":"3",
|
|
"name":"Member"
|
|
}
|
|
],
|
|
"name":"joeuser"
|
|
}
|
|
}
|
|
}
|
|
|
|
.. note::
|
|
|
|
Take note of the value ['access']['token']['id'] value produced here (``887665443383838``, above), as you can use it in the calls below.
|
|
|
|
GET /tokens/{token_id}
|
|
======================
|
|
|
|
.. note::
|
|
|
|
This call refers to a token known to be valid, ``887665443383838`` in this case.
|
|
|
|
Validate a token:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl -H "X-Auth-Token:999888777666" http://localhost:35357/v2.0/tokens/887665443383838
|
|
|
|
If the token is valid, returns:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"access":{
|
|
"token":{
|
|
"expires":"2012-02-05T00:00:00",
|
|
"id":"887665443383838",
|
|
"tenant":{
|
|
"id":"1",
|
|
"name":"customer-x"
|
|
}
|
|
},
|
|
"user":{
|
|
"name":"joeuser",
|
|
"tenantName":"customer-x",
|
|
"id":"1",
|
|
"roles":[
|
|
{
|
|
"serviceId":"1",
|
|
"id":"3",
|
|
"name":"Member"
|
|
}
|
|
],
|
|
"tenantId":"1"
|
|
}
|
|
}
|
|
}
|
|
|
|
HEAD /tokens/{token_id}
|
|
=======================
|
|
|
|
This is a high-performance variant of the GET call documented above, which
|
|
by definition, returns no response body:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl -I -H "X-Auth-Token:999888777666" http://localhost:35357/v2.0/tokens/887665443383838
|
|
|
|
... which returns ``200``, indicating the token is valid::
|
|
|
|
HTTP/1.1 200 OK
|
|
Content-Length: 0
|
|
Content-Type: None
|
|
Date: Tue, 08 Nov 2011 23:07:44 GMT
|
|
|
|
GET /tokens/{token_id}/endpoints
|
|
================================
|
|
|
|
List all endpoints for a token:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl -H "X-Auth-Token:999888777666" http://localhost:35357/v2.0/tokens/887665443383838/endpoints
|
|
|
|
Returns:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"endpoints_links": [
|
|
{
|
|
"href": "http://127.0.0.1:35357/tokens/887665443383838/endpoints?'marker=5&limit=10'",
|
|
"rel": "next"
|
|
}
|
|
],
|
|
"endpoints": [
|
|
{
|
|
"internalURL": "http://127.0.0.1:8080/v1/AUTH_1",
|
|
"name": "swift",
|
|
"adminURL": "http://swift.admin-nets.local:8080/",
|
|
"region": "RegionOne",
|
|
"tenantId": 1,
|
|
"type": "object-store",
|
|
"id": 1,
|
|
"publicURL": "http://swift.publicinternets.com/v1/AUTH_1"
|
|
},
|
|
{
|
|
"internalURL": "http://localhost:8774/v1.0",
|
|
"name": "nova_compat",
|
|
"adminURL": "http://127.0.0.1:8774/v1.0",
|
|
"region": "RegionOne",
|
|
"tenantId": 1,
|
|
"type": "compute",
|
|
"id": 2,
|
|
"publicURL": "http://nova.publicinternets.com/v1.0/"
|
|
},
|
|
{
|
|
"internalURL": "http://localhost:8774/v1.1",
|
|
"name": "nova",
|
|
"adminURL": "http://127.0.0.1:8774/v1.1",
|
|
"region": "RegionOne",
|
|
"tenantId": 1,
|
|
"type": "compute",
|
|
"id": 3,
|
|
"publicURL": "http://nova.publicinternets.com/v1.1/
|
|
},
|
|
{
|
|
"internalURL": "http://127.0.0.1:9292/v1.1/",
|
|
"name": "glance",
|
|
"adminURL": "http://nova.admin-nets.local/v1.1/",
|
|
"region": "RegionOne",
|
|
"tenantId": 1,
|
|
"type": "image",
|
|
"id": 4,
|
|
"publicURL": "http://glance.publicinternets.com/v1.1/"
|
|
},
|
|
{
|
|
"internalURL": "http://127.0.0.1:7777/v1.1/1",
|
|
"name": "cdn",
|
|
"adminURL": "http://cdn.admin-nets.local/v1.1/1",
|
|
"region": "RegionOne",
|
|
"tenantId": 1,
|
|
"type": "object-store",
|
|
"id": 5,
|
|
"publicURL": "http://cdn.publicinternets.com/v1.1/1"
|
|
}
|
|
]
|
|
}
|
|
|
|
GET /tenants
|
|
============
|
|
|
|
List all of the tenants in the system (requires an Admin ``X-Auth-Token``):
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl -H "X-Auth-Token:999888777666" http://localhost:35357/v2.0/tenants
|
|
|
|
Returns:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"tenants_links": [],
|
|
"tenants": [
|
|
{
|
|
"enabled": false,
|
|
"description": "None",
|
|
"name": "project-y",
|
|
"id": "3"
|
|
},
|
|
{
|
|
"enabled": true,
|
|
"description": "None",
|
|
"name": "ANOTHER:TENANT",
|
|
"id": "2"
|
|
},
|
|
{
|
|
"enabled": true,
|
|
"description": "None",
|
|
"name": "customer-x",
|
|
"id": "1"
|
|
}
|
|
]
|
|
}
|
|
|
|
GET /tenants/{tenant_id}
|
|
========================
|
|
|
|
Retrieve information about a tenant, by tenant ID:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl -H "X-Auth-Token:999888777666" http://localhost:35357/v2.0/tenants/1
|
|
|
|
Returns:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"tenant":{
|
|
"enabled":true,
|
|
"description":"None",
|
|
"name":"customer-x",
|
|
"id":"1"
|
|
}
|
|
}
|
|
|
|
GET /tenants/{tenant_id}/users/{user_id}/roles
|
|
==============================================
|
|
|
|
List the roles a user has been granted on a tenant:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl -H "X-Auth-Token:999888777666" http://localhost:35357/v2.0/tenants/1/users/1/roles
|
|
|
|
Returns:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"roles_links":[],
|
|
"roles":[
|
|
{
|
|
"id":"3",
|
|
"name":"Member"
|
|
}
|
|
]
|
|
}
|
|
|
|
GET /users/{user_id}
|
|
====================
|
|
|
|
Retrieve information about a user, by user ID:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl -H "X-Auth-Token:999888777666" http://localhost:35357/v2.0/users/1
|
|
|
|
Returns:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"user":{
|
|
"tenantId":"1",
|
|
"enabled":true,
|
|
"id":"1",
|
|
"name":"joeuser"
|
|
}
|
|
}
|
|
|
|
GET /users/{user_id}/roles
|
|
==========================
|
|
|
|
Retrieve the roles granted to a user, given a user ID:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ curl -H "X-Auth-Token:999888777666" http://localhost:35357/v2.0/users/4/roles
|
|
|
|
Returns:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"roles_links":[],
|
|
"roles":[
|
|
{
|
|
"id":"2",
|
|
"name":"KeystoneServiceAdmin"
|
|
}
|
|
]
|
|
}
|
|
|
|
GET /tokens/revoked
|
|
===================
|
|
|
|
Get the revocation list:
|
|
|
|
.. code-block:: bash
|
|
|
|
curl -s -H "X-Auth-Token: $OS_TOKEN" \
|
|
http://localhost:35357/v2.0/tokens/revoked |
|
|
jq -r .signed |
|
|
openssl cms -verify \
|
|
-certfile /etc/keystone/ssl/certs/signing_cert.pem \
|
|
-CAfile /etc/keystone/ssl/certs/ca.pem \
|
|
-inform PEM \
|
|
-nosmimecap -nodetach -nocerts -noattr 2>/dev/null |
|
|
python -m json.tool
|
|
|
|
Example response:
|
|
|
|
.. code-block:: javascript
|
|
|
|
{
|
|
"revoked": [
|
|
{
|
|
"expires": "2014-06-10T21:40:14Z",
|
|
"id": "e6e2b5c9092751f88d2bcd30b09777a9"
|
|
},
|
|
{
|
|
"expires": "2014-06-10T21:47:29Z",
|
|
"id": "883ef5d610bd1c68fbaa8ac528aa9f17"
|
|
},
|
|
{
|
|
"expires": "2014-06-10T21:51:52Z",
|
|
"id": "41775ff4838f8f406b7bad28bea0dde6"
|
|
}
|
|
]
|
|
}
|