# keystone.api.system module

class keystone.api.system.SystemAPI(blueprint_url_prefix='', api_url_prefix='', default_mediatype='application/json', decorators=None, errors=None)

  Bases: `APIBase`

  resource_mapping = [(<class 'keystone.api.system.SystemUsersListResource'>, '/system/users/<string:user_id>/roles', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/system_user_roles', 'stable', {'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.system.SystemUsersResource'>, '/system/users/<string:user_id>/roles/<string:role_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/system_user_role', 'stable', {'role_id': 'https://docs.openstack.org/api/openstack-identity/3/param/role_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.system.SystemGroupsRolesListResource'>, '/system/groups/<string:group_id>/roles', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/system_group_roles', 'stable', {'group_id': 'https://docs.openstack.org/api/openstack-identity/3/param/group_id'})), (<class 'keystone.api.system.SystemGroupsRolestResource'>, '/system/groups/<string:group_id>/roles/<string:role_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/system_group_role', 'stable', {'group_id': 'https://docs.openstack.org/api/openstack-identity/3/param/group_id', 'role_id': 'https://docs.openstack.org/api/openstack-identity/3/param/role_id'}))]
  resources = []

class keystone.api.system.SystemGroupsRolesListResource

  Bases: `Resource`

  get(group_id)

    List all system grants for a specific group.

    GET/HEAD /system/groups/{group_id}/roles

  methods: t.ClassVar[t.Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.system.SystemGroupsRolestResource

  Bases: `Resource`

  delete(group_id, role_id)

    Revoke a role from the group on the system.

    DELETE /system/groups/{group_id}/roles/{role_id}

  get(group_id, role_id)

    Check if a group has a specific role on the system.

    GET/HEAD /system/groups/{group_id}/roles/{role_id}

  methods: t.ClassVar[t.Collection[str] | None] = {'DELETE', 'GET', 'PUT'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  put(group_id, role_id)

    Grant a role to a group on the system.

    PUT /system/groups/{group_id}/roles/{role_id}

class keystone.api.system.SystemUsersListResource

  Bases: `Resource`

  get(user_id)

    List all system grants for a specific user.

    GET/HEAD /system/users/{user_id}/roles

  methods: t.ClassVar[t.Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.system.SystemUsersResource

  Bases: `Resource`

  delete(user_id, role_id)

    Revoke a role from user on the system.

    DELETE /system/users/{user_id}/roles/{role_id}

  get(user_id, role_id)

    Check if a user has a specific role on the system.

    GET/HEAD /system/users/{user_id}/roles/{role_id}

  methods: t.ClassVar[t.Collection[str] | None] = {'DELETE', 'GET', 'PUT'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  put(user_id, role_id)

    Grant a role to a user on the system.

    PUT /system/users/{user_id}/roles/{role_id}

this page last updated: 2026-06-11 21:50:20

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug