1. Docs
  2. Denies
  3. Manage Denies

Manage Denies

Create a deny in the Developer Console or the API, see who it refuses before you confirm, trace a refusal to it, and delete it.

In the Developer Console

Denies live under Access Control, after Roles. The page needs env_denies.view; Create Deny needs env_denies.manage and the reads its steps are made of: permissions, the hierarchy and roles.

Application
Developer Console
Path
Access ControlDenies
Opens with
  • env_denies.view Read the Environment's denies and who each one refuses today.
Context
Select an Application and an Environment in the switcher first; the page belongs to that Environment.
Create a deny
Open Denies and click Create Deny.Target: choose Identity, Machine client or Role, then pick one. A role search matches a role's name or its organization's; Browse lists every role, the Environment's own first. Enter the Reason: it is required and recorded in the audit log.Permissions: pick the node, which the deny applies at and everywhere below, and tick the permissions to refuse.Exceptions: optionally pick up to 20 roles whose holders keep access.Review: check the summary and who loses access: the count, a line per permission, the people one page at a time, and who an exception spares. Click Create Deny.

The review is read again each time you reach it, so going back to change a step changes what it shows. People are named only to a reader who may see the Environment's people; anyone else sees the counts.

Find the Denies That Apply

The list filters by search (target name or permission key), target type, permission, and node. With a node picked, choose Denies at this node for the denies made there, or Denies that apply here for every deny at the node or above it: everything that refuses access there.

Trace a Refusal to Its Deny

When a check is refused by a deny, Explain Access says so: the verdict names the node that holds the deny, the path shows the deny as its own row there, and the grants it overrides read Overridden by deny. Open deny on that row opens the deny on the Denies page, with who it refuses today.

Delete a Deny

Open a deny from the list and click Delete Deny, then Delete in the confirm. Access returns to whatever grants allow.

With the API

On the API, reads need the deny.view scope and writes deny.manage. Preview takes the same body as create, so what you preview is what you create.

POST /api/v1/denies/preview: who would lose each permission, who an exception spares, and who another deny already refuses. Writes nothing.POST /api/v1/denies: create the deny. An identical deny is refused with 409 deny.duplicate, naming the existing one in data.deny_id.GET /api/v1/denies: list them, filtered by node_id with node_mode at or applies, target_type, target_id and permission.GET /api/v1/denies/:id/reach: who an existing deny refuses today.DELETE /api/v1/denies/:id: delete it.
Environment
API version
v1.0
 On this page Was this page helpful?

Tell us how we can improve this guide.

Canopy