# keystone.api.os_inherit module

class keystone.api.os_inherit.OSInheritAPI(blueprint_url_prefix='', api_url_prefix='', default_mediatype='application/json', decorators=None, errors=None)

  Bases: `APIBase`

  resource_mapping = [(<class 'keystone.api.os_inherit.OSInheritDomainGroupRolesResource'>, '/domains/<string:domain_id>/groups/<string:group_id>/roles/<string:role_id>/inherited_to_projects', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-INHERIT/1.0/rel/domain_group_role_inherited_to_projects', 'stable', {'domain_id': 'https://docs.openstack.org/api/openstack-identity/3/param/domain_id', 'group_id': 'https://docs.openstack.org/api/openstack-identity/3/param/group_id', 'role_id': 'https://docs.openstack.org/api/openstack-identity/3/param/role_id'})), (<class 'keystone.api.os_inherit.OSInheritDomainGroupRolesListResource'>, '/domains/<string:domain_id>/groups/<string:group_id>/roles/inherited_to_projects', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-INHERIT/1.0/rel/domain_group_roles_inherited_to_projects', 'stable', {'domain_id': 'https://docs.openstack.org/api/openstack-identity/3/param/domain_id', 'group_id': 'https://docs.openstack.org/api/openstack-identity/3/param/group_id'})), (<class 'keystone.api.os_inherit.OSInheritDomainUserRolesResource'>, '/domains/<string:domain_id>/users/<string:user_id>/roles/<string:role_id>/inherited_to_projects', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-INHERIT/1.0/rel/domain_user_role_inherited_to_projects', 'stable', {'domain_id': 'https://docs.openstack.org/api/openstack-identity/3/param/domain_id', 'role_id': 'https://docs.openstack.org/api/openstack-identity/3/param/role_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.os_inherit.OSInheritDomainUserRolesListResource'>, '/domains/<string:domain_id>/users/<string:user_id>/roles/inherited_to_projects', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-INHERIT/1.0/rel/domain_user_roles_inherited_to_projects', 'stable', {'domain_id': 'https://docs.openstack.org/api/openstack-identity/3/param/domain_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.os_inherit.OSInheritProjectUserResource'>, '/projects/<string:project_id>/users/<string:user_id>/roles/<string:role_id>/inherited_to_projects', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-INHERIT/1.0/rel/project_user_role_inherited_to_projects', 'stable', {'project_id': 'https://docs.openstack.org/api/openstack-identity/3/param/project_id', 'role_id': 'https://docs.openstack.org/api/openstack-identity/3/param/role_id', 'user_id': 'https://docs.openstack.org/api/openstack-identity/3/param/user_id'})), (<class 'keystone.api.os_inherit.OSInheritProjectGroupResource'>, '/projects/<string:project_id>/groups/<string:group_id>/roles/<string:role_id>/inherited_to_projects', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-INHERIT/1.0/rel/project_group_role_inherited_to_projects', 'stable', {'group_id': 'https://docs.openstack.org/api/openstack-identity/3/param/group_id', 'project_id': 'https://docs.openstack.org/api/openstack-identity/3/param/project_id', 'role_id': 'https://docs.openstack.org/api/openstack-identity/3/param/role_id'}))]
  resources = []

class keystone.api.os_inherit.OSInheritDomainGroupRolesListResource

  Bases: `Resource`

  get(domain_id, group_id)

    List roles (inherited) for a group on a domain.

    GET/HEAD /OS-INHERIT/domains/{domain_id}/groups/{group_id}

      /roles/inherited_to_projects

  methods: t.ClassVar[t.Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.os_inherit.OSInheritDomainGroupRolesResource

  Bases: `Resource`

  delete(domain_id, group_id, role_id)

    Revoke an inherited grant for a group on a domain.

    DELETE /OS-INHERIT/domains/{domain_id}/groups/{group_id}

      /roles/{role_id}/inherited_to_projects

  get(domain_id, group_id, role_id)

    Check for an inherited grant for a group on a domain.

    GET/HEAD /OS-INHERIT/domains/{domain_id}/groups/{group_id}

      /roles/{role_id}/inherited_to_projects

  methods: t.ClassVar[t.Collection[str] | None] = {'DELETE', 'GET', 'PUT'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  put(domain_id, group_id, role_id)

    Create an inherited grant for a group on a domain.

    PUT /OS-INHERIT/domains/{domain_id}/groups/{group_id}

      /roles/{role_id}/inherited_to_projects

class keystone.api.os_inherit.OSInheritDomainUserRolesListResource

  Bases: `Resource`

  get(domain_id, user_id)

    List roles (inherited) for a user on a domain.

    GET/HEAD /OS-INHERIT/domains/{domain_id}/users/{user_id}

      /roles/inherited_to_projects

  methods: t.ClassVar[t.Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.os_inherit.OSInheritDomainUserRolesResource

  Bases: `Resource`

  delete(domain_id, user_id, role_id)

    Revoke a grant from a user on a domain.

    DELETE /OS-INHERIT/domains/{domain_id}/users/{user_id}/roles

      /{role_id}/inherited_to_projects

  get(domain_id, user_id, role_id)

    Check for an inherited grant for a user on a domain.

    GET/HEAD /OS-INHERIT/domains/{domain_id}/users/{user_id}/roles

      /{role_id}/inherited_to_projects

  methods: t.ClassVar[t.Collection[str] | None] = {'DELETE', 'GET', 'PUT'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  put(domain_id, user_id, role_id)

    Create an inherited grant for a user on a domain.

    PUT /OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}

      /inherited_to_projects

class keystone.api.os_inherit.OSInheritProjectGroupResource

  Bases: `Resource`

  delete(project_id, group_id, role_id)

    Revoke an inherited grant for a group on a project.

    DELETE /OS-INHERIT/projects/{project_id}/groups/{group_id}

      /roles/{role_id}/inherited_to_projects

  get(project_id, group_id, role_id)

    Check for an inherited grant for a group on a project.

    GET/HEAD /OS-INHERIT/projects/{project_id}/groups/{group_id}

      /roles/{role_id}/inherited_to_projects

  methods: t.ClassVar[t.Collection[str] | None] = {'DELETE', 'GET', 'PUT'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  put(project_id, group_id, role_id)

    Create an inherited grant for a group on a project.

    PUT /OS-INHERIT/projects/{project_id}/groups/{group_id}

      /roles/{role_id}/inherited_to_projects

class keystone.api.os_inherit.OSInheritProjectUserResource

  Bases: `Resource`

  delete(project_id, user_id, role_id)

    Revoke an inherited grant for a user on a project.

    DELETE /OS-INHERIT/projects/{project_id}/users/{user_id}

      /roles/{role_id}/inherited_to_projects

  get(project_id, user_id, role_id)

    Check for an inherited grant for a user on a project.

    GET/HEAD /OS-INHERIT/projects/{project_id}/users/{user_id}

      /roles/{role_id}/inherited_to_projects

  methods: t.ClassVar[t.Collection[str] | None] = {'DELETE', 'GET', 'PUT'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  put(project_id, user_id, role_id)

    Create an inherited grant for a user on a project.

    PUT /OS-INHERIT/projects/{project_id}/users/{user_id}

      /roles/{role_id}/inherited_to_projects

this page last updated: 2026-06-11 21:50:20

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug