Skip to main content

UpdatePrincipalCallerKind

PATCH 
/admin/v1/customers/:customer_id/principals/:id/caller-kind

UpdatePrincipalCallerKind corrects whether a principal is a person or an application. It records the reason, the caller and the time on the principal, sets its caller_kind_source to "admin", and writes one audit row with the old kind, the new kind and the reason in the same transaction. It changes nothing else: not the principal's type, not the rules that match it, not its cap, its API key, its budget or whether it is disabled. A request log that the management plane stamped keeps the kind it was stamped with, including unknown. A request log that nothing stamped (stored before 0.12.0, or whose key lookup failed) takes the key's current kind when it is read or rolled up. The management plane caches a principal's kind for 30 seconds, so a request log stored within about 30 seconds of the correction can still carry the old kind.

It refuses with FAILED_PRECONDITION, and writes a failed audit row, a principal whose kind the identity provider sets (decision record 104): a record of an install in directory identity mode, which has no project, and any principal whose caller_kind_source is "idp_claim" or "idp_registration". Such a kind is corrected on the IdP registration, in its people or applications setting or in the kind claim it names.

Request​

Responses​

Success