Roles and privileges

Roles

A role is a named set of privileges plus a set of scope attributes. The platform creates built-in roles, which cannot be modified or deleted. The cluster administrator creates custom roles, whose numbering starts at 10000.

id	Role	Level	Purpose
1	`Cluster Master`	Cluster	Full access to the entire cluster
2	`vDC Admin`	VDC	Virtual data center (VDC) administration
3	`vDC User`	VDC	Work with resources within a VDC
4	`vDC Viewer`	VDC	View VDC objects
5	`Resource Viewer`	Cluster	View cluster resources
6	`Security Admin`	Cluster	Security log and audit
7	`VM Developer`	VDC	Create and configure virtual machines
≥ 10000	Custom name, up to 64 characters	Determined by scope attributes	Custom role

The Security Admin and VM Developer roles were introduced in 3.0.3.

Cluster Master has no scope binding at all: its set of scopes is empty, so it applies to the entire cluster. Built-in roles have an empty creator field; for a custom role, it contains the ID of the user who created it.

Privileges

Access is granted through scoped privileges rather than a fixed association with a specific role: the same privilege can apply to the entire cluster or to a single VDC.

Privileges are organized into categories, and the UI displays them in the same sections on the role card. A category only groups privileges; it does not expand permissions.

Category	Name in the UI	Privileges
`1` VDC	`vDC`	10
`2` Virtual machines	`VM`	43
`3` Networks	`Network`	17
`4` Edge routers	`Edge`	34
`5` Storage	`Storage`	6
`6` Nodes	`Node`	19
`7` Cluster	`Cluster`	11
`8` Users and roles	`User`	31
`9` Miscellaneous	`Misc`	4
`10` Authentication	`Auth`	2
`11` Security log	`Security`	10
`12` Web UI	`User Interface`	1
`13` VDC storage (Unified Storage)	`Unified Storage`	27
`14` OS image library	`OS Image Library`	7
`15` Backup	`Backup`	3

Three role management privileges cannot be granted to a custom role: Create Role (7111), Edit Role (7112), and Delete Role (7113). Otherwise, a custom role could expand its own permissions. Attempts to include them in the set are rejected with -22502 when creating a role and -22513 when editing it.

Scope

A scope determines which objects a privilege applies to: the entire cluster, a specific VDC, or an individual object.

There are only two scope types, and the distinction is fundamental.

Scope	Available to custom roles	Meaning
VDC (`vdc_id`)	yes	The privilege applies in VDCs where the role is assigned
Object creator (`creator`)	no	The privilege applies to objects created by the user themselves

The "own objects only" restriction for a custom role is set through existing Own privileges rather than visibility scope: Edit Own Network (2010) and related privileges in the "Networks" and "Edge routers" categories. Attempts to give a custom role the creator scope are rejected with -22505 when creating it and -22517 when editing it.

A role is assigned within a VDC: if the role has a VDC scope, a VDC must be specified when assigning it.

Privilege registry

The complete registry below contains 225 privileges across 15 categories. Names appear exactly as shown on the role card. A privilege ID is immutable, and the API uses it to address the privilege.

VDC (category `1`, `vDC`)

id	Privilege
`1000`	`View vDC`
`1001`	`Create vDC`
`1002`	`Edit vDC`
`1003`	`Delete vDC`
`1004`	`Assign vDC Network`
`1005`	`Deassign vDC Network`
`1006`	`View vDC Networks`
`1007`	`Manage vDC Network Limit`
`1008`	`View vDC Roles`
`1009`	`View vDC Volumes`

Virtual machines (category `2`, `VM`)

id	Privilege
`1100`	`View VM List`
`1101`	`View VM Details`
`1102`	`Access VM Console`
`1103`	`View VM Statuses`
`1104`	`View VM Profiles`
`1105`	`View VM History`
`1107`	`View Boot Media`
`1108`	`View VM Performance`
`1109`	`View Import Area`
`1110`	`Process Import Area`
`1111`	`View VM Inventory`
`1112`	`View VM Infrastructure Details`
`1113`	`View VM Migration Status`
`1114`	`Check VM Configuration`
`1200`	`Create VM`
`1201`	`Remove VM`
`1202`	`Edit VM Settings`
`1203`	`Change VM VDC`
`1204`	`Unlock VM`
`1205`	`Register VM Image`
`1206`	`Set VM Service ID`
`1300`	`Start VM`
`1301`	`Stop VM`
`1302`	`Restart VM`
`1303`	`Suspend VM`
`1304`	`Resume VM`
`1305`	`Suspend VM Pool`
`1306`	`Resume VM Pool`
`1400`	`Add VM Disk`
`1401`	`Remove VM Disk`
`1402`	`Resize VM Disk`
`1403`	`Label VM Disk`
`1404`	`Add VM NIC`
`1405`	`Remove VM NIC`
`1500`	`Create VM Snapshot`
`1501`	`Remove VM Snapshot`
`1502`	`Rollback VM Snapshot`
`1600`	`Rate Limit VM NIC`
`1601`	`Rate Limit VM Disk`
`1602`	`Set VM CPU Priority`
`1603`	`Set VM vCPU Class`
`1604`	`Set VM Memory Balloon`
`1605`	`Migrate VM`
`1606`	`Set VM Reserved vCPU Class`
`1607`	`Live Migrate VM`

Networks (category `3`, `Network`)

id	Privilege
`2000`	`View Networks`
`2001`	`Edit Network`
`2002`	`Create Network`
`2003`	`Delete Network`
`2005`	`View Own Networks`
`2010`	`Edit Own Network`
`2011`	`Delete Own Network`
`2100`	`View IP Pool Usage`
`2101`	`View IP Pool Free Addresses`
`2102`	`View IP Pool Details`
`2103`	`Add IP Pool`
`2104`	`Delete IP Pool`
`2105`	`View Own Network IP Pool Usage`
`2106`	`View Own Network IP Pool Free`
`2107`	`Add Own Network IP Pool`
`2108`	`Delete Own Network IP Pool`
`2109`	`View Own Network IP Pool Details`

Edge routers (category `4`, `Edge`)

id	Privilege
`3000`	`View Edge List`
`3001`	`View Edge Details`
`3002`	`Create Edge`
`3003`	`Remove Edge`
`3004`	`Add Edge NIC`
`3005`	`Remove Edge NIC`
`3006`	`Start Edge`
`3007`	`Stop Edge`
`3008`	`Restart Edge`
`3009`	`Rate Limit Edge`
`3010`	`View Edge Logs`
`3011`	`View Edge Admin Details`
`3013`	`View Own Edge List`
`3014`	`View Own Edge Details`
`3020`	`Remove Own Edge`
`3021`	`Add Own Edge NIC`
`3022`	`Remove Own Edge NIC`
`3023`	`Start Own Edge`
`3024`	`Stop Own Edge`
`3025`	`Restart Own Edge`
`3026`	`Rate Limit Own Edge`
`3027`	`View Own Edge Logs`
`3028`	`Deploy Own Edge Rules`
`3029`	`Add Own Edge NAT Rule`
`3030`	`Add Own Edge Firewall Rule`
`3031`	`Remove Own Edge NAT Rule`
`3032`	`Remove Own Edge Firewall Rule`
`3033`	`View Own Edge Rules`
`3100`	`View Edge Rules`
`3101`	`Add NAT Rule`
`3102`	`Add Firewall Rule`
`3103`	`Remove NAT Rule`
`3104`	`Remove Firewall Rule`
`3105`	`Deploy Edge Rules`

Storage (category `5`, `Storage`)

id	Privilege
`4000`	`View Storage Pools`
`4001`	`View Storage Pool Details`
`4002`	`View Pool Map`
`4003`	`View Pool Map By GUID`
`4100`	`View Filesystem`
`4101`	`Edit Filesystem`

Nodes (category `6`, `Node`)

id	Privilege
`5000`	`View Nodes`
`5001`	`View Node Performance`
`5002`	`View Node CPU Cores`
`5003`	`View Node Software`
`5004`	`View Software Inventory`
`5005`	`View Node Inventory`
`5006`	`View Host Inventory`
`5007`	`View Node Hardware`
`5008`	`View PD Status Map`
`5100`	`Get Node Config`
`5101`	`Set Node Config`
`5102`	`View Node Config Map`
`5200`	`View Physical Disks`
`5201`	`Control PD LED`
`5202`	`View Port Groups`
`5203`	`Spare Physical Disk`
`5204`	`Use Physical Disk`
`5205`	`Replace Physical Disk`
`5206`	`View Disk Info`

Cluster (category `7`, `Cluster`)

id	Privilege
`6000`	`View Cluster Status Map`
`6001`	`View Cluster Overview`
`6002`	`View Cluster Totals`
`6003`	`View Cluster Status Map (full)`
`6004`	`View Cluster Status Map (dashboard)`
`6100`	`Enable Cluster Node`
`6101`	`Disable Cluster Node`
`6102`	`Enable Cluster Service`
`6103`	`Disable Cluster Service`
`6104`	`Start Cluster Service`
`6105`	`Stop Cluster Service`

Users and roles (category `8`, `User`)

id	Privilege
`7000`	`View Users`
`7001`	`View User Details`
`7002`	`Create User`
`7003`	`Delete User`
`7004`	`Set Own User Password`
`7005`	`Unlock User`
`7100`	`View Roles`
`7101`	`View User Role`
`7102`	`View Own User Roles`
`7103`	`View Roles Map`
`7104`	`Assign User Role`
`7105`	`Deassign User Role`
`7106`	`View Any User Roles`
`7107`	`View Privileges`
`7108`	`View Role Privileges`
`7109`	`View Privilege Categories`
`7110`	`View Privilege Scopes`
`7111`	`Create Role`
`7112`	`Edit Role`
`7113`	`Delete Role`
`7114`	`View Role Details`
`7115`	`View Role Scopes`
`7200`	`Get User Params`
`7201`	`Set User Params`
`7202`	`View User Remotes`
`7203`	`Add User Remote`
`7204`	`Delete User Remote`
`7205`	`View User VHosts`
`7206`	`Add User VHost`
`7207`	`Delete User VHost`
`7208`	`Set Any User Password`

Miscellaneous (category `9`, `Misc`)

id	Privilege
`8000`	`View Own User Task`
`8001`	`View All Snapshots`
`8002`	`View Any Task`
`8003`	`View Own User Snapshots`

Authentication (category `10`, `Auth`)

id	Privilege
`9000`	`View Security Settings`
`9001`	`Edit Security Settings`

Security log (category `11`, `Security`)

id	Privilege
`10000`	`View Security Log`
`10001`	`Export Security Log`
`10002`	`Verify Security Log`
`10003`	`View Security Archive`
`10004`	`Export Security Archive`
`10005`	`View Security Archive Settings`
`10006`	`Edit Security Archive Settings`
`10007`	`Acknowledge Security Event`
`10008`	`View Security Notify Settings`
`10009`	`Edit Security Notify Settings`

Web UI (category `12`, `User Interface`)

id	Privilege
`12000`	`Web UI`

VDC storage (Unified Storage) (category `13`, `Unified Storage`)

id	Privilege
`13000`	`Enable vDC Storage`
`13004`	`iSCSI Create Portal Group`
`13005`	`iSCSI Delete Portal Group`
`13006`	`iSCSI View Portal Group`
`13007`	`iSCSI List Portal Groups`
`13009`	`Configure vDC Storage iSCSI`
`13010`	`View vDC Storage`
`13011`	`List vDC Storages`
`13012`	`Create vDC Volume`
`13013`	`View vDC Initiator Group List`
`13014`	`View vDC Initiator Group`
`13015`	`Create vDC Initiator Group`
`13016`	`Set vDC Initiator Group`
`13017`	`Delete vDC Initiator Group`
`13018`	`Map vDC Volume`
`13019`	`Unmap vDC Volume`
`13020`	`View vDC Volume Detail`
`13021`	`View vDC Auth Group List`
`13022`	`View vDC Auth Group`
`13023`	`Create vDC Auth Group`
`13024`	`Set vDC Auth Group`
`13025`	`Set vDC Target Auth`
`13026`	`View vDC Storage iSCSI Detail`
`13027`	`Delete vDC Auth Group`
`13028`	`Delete vDC Volume`
`13029`	`List All Volumes`
`13030`	`View Storage Overview`

OS image library (category `14`, `OS Image Library`)

id	Privilege
`4200`	`Manage Image Library`
`4201`	`View Image Library`
`4202`	`Sync Image Library`
`4203`	`View Image Catalog`
`4204`	`Import Golden Image`
`4205`	`View Image Dependencies`
`4206`	`Remove OS Image`

Backup (category `15`, `Backup`)

id	Privilege
`14000`	`Backup VM Send`
`14001`	`Backup VM Restore`
`14002`	`Backup Dataset Ops`

API methods

The registry is returned by privilege-list, privilege-categories, privilege-scopes, role-privilege-list, and role-scopes; roles are handled by role-list, role-get, role-create, role-set, role-delete — see the API reference.

Roles​

Privileges​

Scope​

Privilege registry​

VDC (category 1, vDC)​

Virtual machines (category 2, VM)​

Networks (category 3, Network)​

Edge routers (category 4, Edge)​

Storage (category 5, Storage)​

Nodes (category 6, Node)​

Cluster (category 7, Cluster)​

Users and roles (category 8, User)​

Miscellaneous (category 9, Misc)​

Authentication (category 10, Auth)​

Security log (category 11, Security)​

Web UI (category 12, User Interface)​

VDC storage (Unified Storage) (category 13, Unified Storage)​

OS image library (category 14, OS Image Library)​

Backup (category 15, Backup)​

See also​

API methods​