import requests
url = "https://platform.ankra.app/api/v1/org/cluster-access-policy/proposals"
payload = { "reason": "<string>" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({reason: '<string>'})
};
fetch('https://platform.ankra.app/api/v1/org/cluster-access-policy/proposals', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));curl --request POST \
--url https://platform.ankra.app/api/v1/org/cluster-access-policy/proposals \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"reason": "<string>"
}
'{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "pending",
"proposed": {
"creator_grant_role": "none",
"max_grant_role": "view",
"elevated_max_ttl_seconds": 15768030,
"require_reason_from_role": "view"
},
"base": {
"creator_grant_role": "none",
"max_grant_role": "view",
"elevated_max_ttl_seconds": 15768030,
"require_reason_from_role": "view",
"is_configured": true
},
"current": {
"creator_grant_role": "none",
"max_grant_role": "view",
"elevated_max_ttl_seconds": 15768030,
"require_reason_from_role": "view",
"is_configured": true
},
"base_matches_current": true,
"reason": "<string>",
"proposed_by": {
"user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"principal": "<string>",
"token_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"token_name": "<string>"
},
"created_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"decided_by_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"decided_at": "2023-11-07T05:31:56Z",
"decision_note": "<string>",
"apply_url": "<string>"
}{
"detail": "Cluster not found"
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}Propose a cluster access policy change
Propose a change to the organisation cluster access policy. This never changes the policy: it records a proposal that an organisation owner or admin applies, signed in to the Ankra web app, from apply_url. Every field but reason is optional and an omitted one keeps its current value; elevated_max_ttl_seconds and require_reason_from_role may be null to clear the bound. The proposed policy is validated exactly like a policy write, and a proposal identical to the current policy answers 422. A new proposal supersedes the pending one; a proposal expires after 7 days, and applying it answers 409 policy_changed if the policy changed since it was proposed. Requires kube_access.manage, which is not human-only: an administrator’s CLI token can propose. Applying and dismissing have no token route.
import requests
url = "https://platform.ankra.app/api/v1/org/cluster-access-policy/proposals"
payload = { "reason": "<string>" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({reason: '<string>'})
};
fetch('https://platform.ankra.app/api/v1/org/cluster-access-policy/proposals', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));curl --request POST \
--url https://platform.ankra.app/api/v1/org/cluster-access-policy/proposals \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"reason": "<string>"
}
'{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "pending",
"proposed": {
"creator_grant_role": "none",
"max_grant_role": "view",
"elevated_max_ttl_seconds": 15768030,
"require_reason_from_role": "view"
},
"base": {
"creator_grant_role": "none",
"max_grant_role": "view",
"elevated_max_ttl_seconds": 15768030,
"require_reason_from_role": "view",
"is_configured": true
},
"current": {
"creator_grant_role": "none",
"max_grant_role": "view",
"elevated_max_ttl_seconds": 15768030,
"require_reason_from_role": "view",
"is_configured": true
},
"base_matches_current": true,
"reason": "<string>",
"proposed_by": {
"user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"principal": "<string>",
"token_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"token_name": "<string>"
},
"created_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"decided_by_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"decided_at": "2023-11-07T05:31:56Z",
"decision_note": "<string>",
"apply_url": "<string>"
}{
"detail": "Cluster not found"
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
Why the policy should change; the owner or admin who applies the proposal reads it. Whitespace alone is refused.
3 - 500Omitted keeps the current value.
none, view, edit, admin, cluster-admin Omitted keeps the current value.
view, edit, admin, cluster-admin null clears the bound; omitting the field keeps the current value.
60 <= x <= 31536000null clears the bound; omitting the field keeps the current value.
view, edit, admin, cluster-admin Response
Successful Response
A pending proposal past expires_at reads as expired.
pending, applied, dismissed, expired, superseded Show child attributes
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Show child attributes
false means the policy changed since the proposal was made, and applying it answers 409 policy_changed.
Show child attributes
Show child attributes
The Ankra web app page (Organisation > Roles, with ?org= and ?proposal=) an owner or admin applies the proposal from, signed in.