> This page is for API. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.eon.io/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server. # Update Role PUT https://%7Baccount-domain%7D.console.eon.io/api/v1/roles/{roleId} Content-Type: application/json This API operation updates the details of a role using its unique ID. The request body must contain the updated role details. Reference: https://docs.eon.io/api/api-reference/access-management/roles/update-role ## Authentication - `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer `, where token is your auth token. ## Request ### Path parameters - `roleId` (string, required) — ID of the role ### Body (application/json) This endpoint expects an UpdateRoleRequest. - `name` (string, required) — The name of the role - `permissionGrants` (list of PermissionGrantInput, required) — The permissions of the role - `accessConditions` (list of AccessCondition, optional) — The condition of the role, keyed by name - `restoreDestinationLimits` (RestoreDestinationLimits, optional) — Limits the restore accounts that can be used as restore destinations for operations granted by the role. ## Response ### 200 Role updated. - `role` (Role, required) — Role. ## Errors ### 404 Not Found Error Role not found - `any` ## Types ### PermissionGrantInput - `permission` (enum, required) — User permission. - Allowed values: `permission_id_unspecified`, `global_settings.view`, `vault_accounts.manage`, `cost_explorer.view`, `user_access.manage`, `saml_group_access.manage`, `api_credentials.manage`, `api_credentials.rotate_secret`, `custom_roles.manage`, `dashboard.view`, `inventory.view`, `jobs.view`, `audit_logs.view`, `backup_settings.view`, `storage_gateway.view`, `database_explorer.search`, `file_explorer.search`, `snapshots.take_or_convert`, `resources.restore`, `configuration.validate`, `files.restore`, `databases.query`, `data_classes.override`, `environments.override`, `detected_apps.override`, `network_classification.override`, `control_violations.mute`, `backup_exclusion.manage`, `vaults.manage`, `source_accounts.manage`, `restore_accounts.manage`, `backup_policies.manage`, `discovery_configuration.manage`, `backup_configuration.manage`, `controls.manage`, `ransomware_detection.manage`, `notification_policies.manage`, `storage_gateway.manage`, `oauth_apps.manage`, `file_explorer.delete`, `storage_gateway_data.download`, `storage_gateway_metadata.view`, `data_catalog.view`, `discovery.trigger` - `accessConditionId` (string, optional) — If present, the ID of the set of access conditions that restrict the resources the permission is granted for. The ID must be present in an entry in `accessConditions`, and the permission itself must support access conditions. If omitted, the permission is granted for all resources. ### AccessCondition - `id` (string, required) — Display name for the data access rule, which also serves as its ID for use in `permissionGrants`. Valid characters: `[a-zA-Z0-9-_.\s]`. - `effect` (enum, required) — Whether the data access condition is an allowlist or blocklist. - Allowed values: `INCLUSIVE`, `EXCLUSIVE` - `expression` (AccessConditionalExpression, required) — Conditional expression to evaluate to determine which resources are accessible. Only one of the expressions below can be used. For multiple conditions using `AND` or `OR` logic, group expressions with `group`. You can nest multiple groups to create more complex expressions. ### RestoreDestinationLimits Limits the restore accounts that can be used as restore destinations for operations granted by the role. - `effect` (enum, required) — Whether the data access condition is an allowlist or blocklist. - Allowed values: `INCLUSIVE`, `EXCLUSIVE` - `restoreAccountProviderIds` (list of string, required) — List of cloud-provider-assigned restore account IDs to match against. ### Role Role. - `id` (string, required) — Role ID. - `name` (string, required) — Role display name. - `isBuiltInRole` (boolean, required) — Whether the role is a default role. If `true`, the role is a default role provided by Eon and can't be modified or deleted. If `false`, the role is a custom, user-created role. - `permissionGrants` (list of PermissionGrant, required) — List of permissions granted by the role. - `accessConditions` (list of AccessCondition, optional) — Sets of access conditions that restrict the resources a permission is granted for. IDs are set by you and are applied to the relevant permission in `permissionGrants`. An access condition can be applied to more than one permission grant. - `restoreDestinationLimits` (RestoreDestinationLimits, optional) — Limits the restore accounts that can be used as restore destinations for operations granted by the role. ### AccessConditionalExpression Conditional expression to evaluate to determine which resources are accessible. Only one of the expressions below can be used. For multiple conditions using `AND` or `OR` logic, group expressions with `group`. You can nest multiple groups to create more complex expressions. - `group` (RoleAccessGroupCondition, optional) — Group of expressions to evaluate using the logical operator specified in `operator`. Each item in the `operands` list can be either a single expression or a nested `group` expression. - `resourceType` (ResourceTypeCondition, optional) - `dataClasses` (DataClassesCondition, optional) - `environment` (EnvironmentCondition, optional) - `apps` (AppsCondition, optional) - `cloudProvider` (CloudProviderCondition, optional) - `accountId` (AccountIdCondition, optional) - `sourceRegion` (RegionCondition, optional) - `vpc` (VpcCondition, optional) - `subnets` (SubnetsCondition, optional) - `resourceGroupName` (ResourceGroupNameCondition, optional) - `resourceName` (ResourceNameCondition, optional) - `resourceId` (ResourceIdCondition, optional) - `tagKeys` (TagKeysCondition, optional) - `tagKeyValues` (TagKeyValuesCondition, optional) ### PermissionGrant - `permission` (enum, required) — User permission. - Allowed values: `permission_id_unspecified`, `global_settings.view`, `vault_accounts.manage`, `cost_explorer.view`, `user_access.manage`, `saml_group_access.manage`, `api_credentials.manage`, `api_credentials.rotate_secret`, `custom_roles.manage`, `dashboard.view`, `inventory.view`, `jobs.view`, `audit_logs.view`, `backup_settings.view`, `storage_gateway.view`, `database_explorer.search`, `file_explorer.search`, `snapshots.take_or_convert`, `resources.restore`, `configuration.validate`, `files.restore`, `databases.query`, `data_classes.override`, `environments.override`, `detected_apps.override`, `network_classification.override`, `control_violations.mute`, `backup_exclusion.manage`, `vaults.manage`, `source_accounts.manage`, `restore_accounts.manage`, `backup_policies.manage`, `discovery_configuration.manage`, `backup_configuration.manage`, `controls.manage`, `ransomware_detection.manage`, `notification_policies.manage`, `storage_gateway.manage`, `oauth_apps.manage`, `file_explorer.delete`, `storage_gateway_data.download`, `storage_gateway_metadata.view`, `data_catalog.view`, `discovery.trigger` - `accessConditionId` (string, optional) — If present, the ID of the set of access conditions that restrict the resources the permission is granted for. The ID must be present in an entry in `accessConditions`, and the permission itself must support access conditions. If omitted, the permission is granted for all resources. ### RoleAccessGroupCondition Group of expressions to evaluate using the logical operator specified in `operator`. Each item in the `operands` list can be either a single expression or a nested `group` expression. - `operator` (enum, required) — Logical operator to apply to the list of `operands`. `UNSPECIFIED` is supported only in responses. - Allowed values: `AND`, `OR`, `UNSPECIFIED` - `operands` (list of AccessConditionalExpression, required) — List of expressions to evaluate using the logical operator specified in `operator`. Each item in the list can be either a single expression or a nested `group` expression. Must contain at least 2 items. ### ResourceTypeCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `resourceTypes` (list of enum, required) — Resource types to evaluate. `RESOURCE_TYPE_UNSPECIFIED` is supported only in responses. - Allowed values: `AWS_EC2`, `AWS_RDS`, `AWS_S3`, `AWS_EFS`, `AWS_FSX`, `AWS_EKS_NAMESPACE`, `AWS_DYNAMO_DB`, `AZURE_VIRTUAL_MACHINE`, `AZURE_FILE_SHARE`, `AZURE_STORAGE_ACCOUNT`, `AZURE_DISK`, `AZURE_SQL_DATABASE`, `AZURE_SQL_MANAGED_INSTANCE`, `AZURE_SQL_VIRTUAL_MACHINE`, `AZURE_MYSQL`, `AZURE_POSTGRESQL`, `AZURE_COSMOSDB_MONGODB`, `AZURE_COSMOSDB_NOSQL`, `ATLAS_MONGODB_CLUSTER`, `GCP_COMPUTE_ENGINE_INSTANCE`, `GCP_CLOUD_SQL_INSTANCE`, `GCP_CLOUD_STORAGE_BUCKET`, `RESOURCE_TYPE_UNSPECIFIED` ### DataClassesCondition - `operator` (enum, required) — Evaluates whether the original list constains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses. - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED` - `dataClasses` (list of string, required) ### EnvironmentCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `environments` (list of enum, required) - Allowed values: `PROD`, `PROD_INTERNAL`, `STAGE`, `ENVIRONMENT_UNSPECIFIED` ### AppsCondition - `operator` (enum, required) — Evaluates whether the original list constains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses. - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED` - `apps` (list of string, required) ### CloudProviderCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `cloudProviders` (list of enum, required) - Allowed values: `AWS`, `AZURE`, `GCP`, `MONGO_ATLAS`, `PROVIDER_UNSPECIFIED` ### AccountIdCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `accountIds` (list of string, required) ### RegionCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `regions` (list of string, required) ### VpcCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `vpcs` (list of string, required) ### SubnetsCondition - `operator` (enum, required) — Evaluates whether the original list constains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses. - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED` - `subnets` (list of string, required) ### ResourceGroupNameCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `resourceGroupNames` (list of string, required) ### ResourceNameCondition - `operator` (enum, required) — Evaluates string values. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `CONTAINS`, `NOT_CONTAINS`, `STARTS_WITH`, `NOT_STARTS_WITH`, `ENDS_WITH`, `NOT_ENDS_WITH`, `UNSPECIFIED` - `resourceNames` (list of string, required) ### ResourceIdCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `resourceIds` (list of string, required) ### TagKeysCondition - `operator` (enum, required) — Evaluates whether the original list constains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses. - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED` - `tagKeys` (list of string, required) ### TagKeyValuesCondition - `operator` (enum, required) — Evaluates whether the original list constains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses. - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED` - `tagKeyValues` (list of TagKeyValue, required) ### TagKeyValue - `key` (string, required) - `value` (string, optional) ## Examples **Request** ```json { "name": "string", "permissionGrants": [ { "permission": "inventory.view" } ] } ``` **Response** ```json { "role": { "id": "daa42222-6ad2-5d37-bb26-4f2a9cba73da", "name": "My custom role", "isBuiltInRole": false, "permissionGrants": [ { "permission": "inventory.view", "accessConditionId": "Non-PII only." } ], "accessConditions": [ { "id": "Non-PII only", "effect": "INCLUSIVE", "expression": { "group": { "operator": "AND", "operands": [ { "resourceType": { "operator": "IN", "resourceTypes": [ "AWS_EC2", "AWS_RDS" ] } }, { "environment": { "operator": "IN", "environments": [ "PROD", "PROD_INTERNAL" ] } } ] }, "resourceType": { "operator": "IN", "resourceTypes": [ "AWS_EC2" ] }, "dataClasses": { "operator": "CONTAINS_ANY_OF", "dataClasses": [ "PII" ] }, "environment": { "operator": "IN", "environments": [ "PROD" ] }, "apps": { "operator": "CONTAINS_ANY_OF", "apps": [ "string" ] }, "cloudProvider": { "operator": "IN", "cloudProviders": [ "AWS" ] }, "accountId": { "operator": "IN", "accountIds": [ "string" ] }, "sourceRegion": { "operator": "IN", "regions": [ "string" ] }, "vpc": { "operator": "IN", "vpcs": [ "string" ] }, "subnets": { "operator": "CONTAINS_ANY_OF", "subnets": [ "string" ] }, "resourceGroupName": { "operator": "IN", "resourceGroupNames": [ "string" ] }, "resourceName": { "operator": "CONTAINS", "resourceNames": [ "string" ] }, "resourceId": { "operator": "IN", "resourceIds": [ "string" ] }, "tagKeys": { "operator": "CONTAINS_ANY_OF", "tagKeys": [ "string" ] }, "tagKeyValues": { "operator": "CONTAINS_ANY_OF", "tagKeyValues": [ { "key": "string", "value": "string" } ] } } } ], "restoreDestinationLimits": { "effect": "INCLUSIVE", "restoreAccountProviderIds": [ "123456789012", "987654321098" ] } } } ``` **SDK Code** ```python import requests url = "https://{account-domain}.console.eon.io/api/v1/roles/roleId" payload = { "name": "string", "permissionGrants": [{ "permission": "inventory.view" }] } headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.put(url, json=payload, headers=headers) print(response.json()) ``` ```javascript const url = 'https://{account-domain}.console.eon.io/api/v1/roles/roleId'; const options = { method: 'PUT', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"name":"string","permissionGrants":[{"permission":"inventory.view"}]}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.put("https://{account-domain}.console.eon.io/api/v1/roles/roleId") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"name\": \"string\",\n \"permissionGrants\": [\n {\n \"permission\": \"inventory.view\"\n }\n ]\n}") .asString(); ```