update_vertical_user_access¶

VerticalsApi.update_vertical_user_access(id, action, role_id, verticals_user_update_obj, content_type=None, _request_timeout=None, _request_auth=None, _content_type=None, _headers=None, _host_index=0)¶

Grant, revoke, or upgrade vertical user access

Updates another user’s vertical access. Requires verticals.fullaccess on role_id and owner ACL on the vertical (editor is not enough). Query action is required: grant-access, revoke-access, or upgrade-role. Body Username is required. AllowedApps in the body is ignored; apps are derived from Cognito custom:attr3. For the BI vertical (VerticalType bi), grant/revoke/upgrade also require the caller to be a BI admin role manager (AUTH-1002 otherwise). grant-access and upgrade-role require QuicksightAccessType of ADMIN, AUTHOR, or READER. When the vertical has IsQEnabled=yes, ADMIN_PRO, AUTHOR_PRO, and READER_PRO are also accepted. upgrade-role may include EnableGenAIFeatures and waits synchronously for QuickSight role upgrade. grant-access and revoke-access for BI start an async registration/deletion and email the user when complete. BI revoke-access may include delete_action delete_resources or transfer_resources (the latter requires new_owner_user with owner/editor on BI). Users with only a single vertical app and no Amorphic user record cannot be revoke-access’d; they must be deleted from user management. For non-BI verticals, grant-access and upgrade-role both add the vertical type to Cognito allowed_apps; revoke-access removes it. Cognito apps for the BI vertical are not updated in this Lambda (the QuickSight worker does that asynchronously). Success Message is chosen in this order: - action=upgrade-role (any vertical): “Successfully upgraded quicksight user role” - BI grant-access or revoke-access: “Initiated BI Application access update, user will receive email on completion” - otherwise: “Successfully modified access of user for the {VerticalName}” This Lambda maps InvalidInputException and UnauthorizedUserException to HTTP 400. Example: PUT /verticals/{id}/users?action=grant-access

Parameters:

id (str) – VerticalId whose user access is being changed. (required)
action (str) – grant-access, revoke-access, or upgrade-role. Other values raise IPV-1041. Missing action raises IPV-1051. (required)
role_id (str) – Amorphic role ID used to authorize the request. Must grant verticals.fullaccess. The caller must belong to the role. (required)
verticals_user_update_obj (VerticalsUserUpdateObj) – (required)
content_type (str) – Must be application/json.
_request_timeout (int, tuple(int, int), optional) – timeout setting for this request. If one number provided, it will be total request timeout. It can also be a pair (tuple) of (connection, read) timeouts.
_request_auth (dict, optional) – set to override the auth_settings for an a single request; this effectively ignores the authentication in the spec for a single request.
_content_type (str, Optional) – force content-type for the request.
_headers (dict, optional) – set to override the headers for a single request; this effectively ignores the headers in the spec for a single request.
_host_index (int, optional) – set to override the host_index for a single request; this effectively ignores the host_index in the spec for a single request.

Return type:

UpdateVerticalUserAccessResponse

Returns:

Returns the result object.

Request and Response Examples¶

HTTP: PUT /verticals/{id}/users

Parameter examples¶

Name	In	Example
`id`	path	`"11111111-2222-3333-4444-555555555555"`
`action`	query	`"grant-access"`
`role_id`	header	`"custom-role-123e4567-e89b-12d3-a456-426614174000"`

Request¶

Grant BI access with a QuickSight role

{
  "Username": "jane.doe",
  "QuicksightAccessType": "AUTHOR"
}

Revoke BI access and transfer resources

{
  "Username": "jane.doe",
  "delete_action": "transfer_resources",
  "new_owner_user": "john.smith"
}

Upgrade QuickSight role

{
  "Username": "jane.doe",
  "QuicksightAccessType": "ADMIN",
  "EnableGenAIFeatures": true
}

Success (HTTP 200)¶

Access update accepted or completed. See Message.

nonBi

{
  "Message": "Successfully modified access of user for the IDP Application"
}

biAsync

{
  "Message": "Initiated BI Application access update, user will receive email on completion"
}

upgrade

{
  "Message": "Successfully upgraded quicksight user role"
}

Errors¶

Documented error codes: AUTH-1001.

HTTP 400

InvalidInputException or UnauthorizedUserException. Body is {“Message”: “<CODE> - <text>”}.

missingRole

{
  "Message": "AUTH-1001 - Missing role information in event header"
}

HTTP 500

GenericFailure, InconsistentMetadata, or unhandled exception. Body is {“Message”: “<CODE> - <text>”} or a raw exception string.

unexpected

{
  "Message": "Unexpected error - <exception text>"
}