# Policies

Warning

Using a JSON-formatted policy file is deprecated since Blazar 7.0.0 (Wallaby). This oslopolicy-convert-json-to-yaml tool will migrate your existing JSON-formatted policy file to YAML in a backward-compatible way.

The following is an overview of all available policies in Blazar. For a sample configuration file, refer to Sample Policy File.

To change policies, please create a policy file in /etc/blazar/ and specify the policy file name at the oslo_policy/policy_file option in blazar.conf.

## blazar

`admin`
  Default:

    `is_admin:True or role:admin`

  Default rule for most Admin APIs.

`admin_or_owner`
  Default:

    `rule:admin or project_id:%(project_id)s`

  Default rule for most non-Admin APIs.

`project_member_api`
  Default:

    `role:member and project_id:%(project_id)s`

  Default rule for Project Member (non-Admin) APIs.

`project_reader_api`
  Default:

    `role:reader and project_id:%(project_id)s`

  Default rule for Project Reader (read-only) APIs.

`project_member_or_admin`
  Default:

    `rule:project_member_api or rule:admin`

  Default rule for Project Member or Admin APIs.

`project_reader_or_admin`
  Default:

    `rule:project_reader_api or rule:admin`

  Default rule for Project Reader or Admin APIs.

`blazar:leases:get`
  Default:

    `rule:project_reader_or_admin`

  Operations:

    - GET `/{api_version}/leases`

    - GET `/{api_version}/leases/{lease_id}`

  Scope Types:

    - project

  Policy rule for List/Show Lease(s) API.

`blazar:leases:post`
  Default:

    `rule:project_member_or_admin`

  Operations:

    - POST `/{api_version}/leases`

  Scope Types:

    - project

  Policy rule for Create Lease API.

`blazar:leases:put`
  Default:

    `rule:project_member_or_admin`

  Operations:

    - PUT `/{api_version}/leases/{lease_id}`

  Scope Types:

    - project

  Policy rule for Update Lease API.

`blazar:leases:delete`
  Default:

    `rule:project_member_or_admin`

  Operations:

    - DELETE `/{api_version}/leases/{lease_id}`

  Scope Types:

    - project

  Policy rule for Delete Lease API.

`blazar:oshosts:get`
  Default:

    `rule:admin`

  Operations:

    - GET `/{api_version}/os-hosts`

    - GET `/{api_version}/os-hosts/{host_id}`

  Scope Types:

    - project

  Policy rule for List/Show Host(s) API.

`blazar:oshosts:post`
  Default:

    `rule:admin`

  Operations:

    - POST `/{api_version}/os-hosts`

  Scope Types:

    - project

  Policy rule for Create Host API.

`blazar:oshosts:put`
  Default:

    `rule:admin`

  Operations:

    - PUT `/{api_version}/os-hosts/{host_id}`

  Scope Types:

    - project

  Policy rule for Update Host API.

`blazar:oshosts:delete`
  Default:

    `rule:admin`

  Operations:

    - DELETE `/{api_version}/os-hosts/{host_id}`

  Scope Types:

    - project

  Policy rule for Delete Host API.

`blazar:oshosts:get_allocations`
  Default:

    `rule:admin`

  Operations:

    - GET `/{api_version}/os-hosts/allocations`

    - GET `/{api_version}/os-hosts/{host_id}/allocation`

  Scope Types:

    - project

  Policy rule for List/Get Host(s) Allocations API.

`blazar:oshosts:get_resource_properties`
  Default:

    `rule:admin`

  Operations:

    - GET `/{api_version}/os-hosts/resource_properties`

  Scope Types:

    - project

  Policy rule for Resource Properties API.

`blazar:oshosts:update_resource_properties`
  Default:

    `rule:admin`

  Operations:

    - PATCH `/{api_version}/os-hosts/resource_properties/{property_name}`

  Scope Types:

    - project

  Policy rule for Resource Properties API.

`blazar:floatingips:get`
  Default:

    `rule:project_reader_or_admin`

  Operations:

    - GET `/{api_version}/floatingips`

    - GET `/{api_version}/floatingips/{floatingip_id}`

  Scope Types:

    - project

  Policy rule for List/Show FloatingIP(s) API.

`blazar:floatingips:post`
  Default:

    `rule:admin`

  Operations:

    - POST `/{api_version}/floatingips`

  Scope Types:

    - project

  Policy rule for Create Floating IP API.

`blazar:floatingips:delete`
  Default:

    `rule:admin`

  Operations:

    - DELETE `/{api_version}/floatingips/{floatingip_id}`

  Scope Types:

    - project

  Policy rule for Delete Floating IP API.

this page last updated: 2026-04-13 10:34:52

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug