authorizations

Creates, updates, deletes, gets or lists an authorizations resource.

Overview

Name	authorizations
Type	Resource
Id	nvidia.nvcf_functions.authorizations

Fields

The following fields are returned by SELECT queries:

list_version

Name	Datatype	Description
id	string (uuid)	Function id
nca_id	string (UTF-8)	NVIDIA Cloud Account Id (wire: ncaId)
version_id	string (uuid)	Function version id (wire: versionId)
authorized_parties	array	Authorized parties allowed to invoke the function (wire: authorizedParties)

list

Name	Datatype	Description
id	string (uuid)	Function id
nca_id	string (UTF-8)	NVIDIA Cloud Account Id (wire: ncaId)
version_id	string (uuid)	Function version id (wire: versionId)
authorized_parties	array	Authorized parties allowed to invoke the function (wire: authorizedParties)

list_all

Name	Datatype	Description
id	string (uuid)	Function id
nca_id	string (UTF-8)	NVIDIA Cloud Account Id (wire: ncaId)
version_id	string (uuid)	Function version id (wire: versionId)
authorized_parties	array	Authorized parties allowed to invoke the function (wire: authorizedParties)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_version	select	function_id, function_version_id		Gets NVIDIA Cloud Account IDs that are authorized to invoke specified function version. Response includes authorized accounts that were added specifically at the version level and the authorized accounts that were inherited from function level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header
list	select	function_id		Lists function versions of the specified function and their corresponding authorized accounts allowed to invoke the function version. Individual versions of a function can have their own authorized accounts. So, each object in the array can have different authorized accounts listed. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header
list_all	select			Lists all the function versions in an account that have been shared/authorized with/to other accounts. Response includes the nca-ids of the authorized accounts. If a function version is not shared/authorized, then it is not included in the response. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header
add_version	insert	function_id, function_version_id, authorized_party		Adds the specified NVIDIA Cloud Account to the set of authorized accounts that can invoke the specified function version. If the specified function version does not have any existing inheritable authorized accounts, it results in a response with status 404. If the specified account is already in the set of existing authorized accounts that are directly associated with the function version, it results in a response wit status code 409. If a function is public, then Account Admin cannot perform this operation. Note that the response does not include inherited authorized accounts that were added at the function level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header
add	insert	function_id, authorized_party		Adds the specified NVIDIA Cloud Account to the set of authorized accounts that are can invoke all the versions of the specified function. If the specified function does not have any existing inheritable authorized accounts, it results in a response with status 404. If the specified account is already in the set of existing inheritable authorized accounts, it results in a response with status code 409. If a function is public, then Account Admin cannot perform this operation. Note that response only includes authz accounts at the function level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header
set_version	replace	function_id, function_version_id, authorized_parties		Authorizes additional NVIDIA Cloud Accounts to invoke a specific function version. By default, a function belongs to the NVIDIA Cloud Account that created it, and the credentials used for function invocation must reference the same NVIDIA Cloud Account. Upon invocation of this endpoint, any existing authorized accounts will be overwritten by the newly specified authorized accounts. Note that the response does NOT include inherited authorized accounts that were added at the function level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header
set	replace	function_id, authorized_parties		Authorizes additional NVIDIA Cloud Accounts to invoke any version of the specified function. By default, a function belongs to the NVIDIA Cloud Account that created it, and the credentials used for function invocation must reference the same NVIDIA Cloud Account. Upon invocation of this endpoint, any existing authorized accounts will be overwritten by the newly specified authorized accounts. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header
remove_version	delete	function_id, function_version_id		Removes the specified NVIDIA Cloud Account from the set of authorized accounts that are directly associated with specified function version. If the specified function version does not have any of its own(not inherited) authorized accounts, it results in a response with status 404. Also, if the specified authorized account is not in the set of existing authorized parties that are directly associated with the specified function version, it results in a response with status code 404. If the specified function version is public, then Account Admin cannot perform this operation. Note that the response does not include inherited authorized accounts that were added at the function level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header
remove	delete	function_id		Removes the specified NVIDIA Cloud Account from the set of authorized accounts that can invoke all the versions of the specified function. If the specified function does not have any existing inheritable authorized parties, it results in a response with status 404. Also, if the specified account is not in the existing set of inheritable authorized accounts, it results in a response with status 404. If the specified function is public, then Account Admin cannot perform this operation. Note that response only includes the remaining authorized accounts at the function level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header
delete_all	exec	function_id		Deletes authorizations at the function level. This impacts all versions of the function. If a function versions has its own set of authorizations, those are not deleted. If the specified function is public, then Account Admin cannot perform this operation. Note that the response does not include any authz accounts at version level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header
delete_all_version	exec	function_id, function_version_id		Deletes all the authorized accounts that are directly associated with the specified function version. Authorized parties that are inherited by the function version are not deleted. If the specified function version is public, then Account Admin cannot perform this operation. Note that the response does not include inherited authorized accounts that were added at the function level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
function_id	string (uuid)	Function id
function_version_id	string (uuid)	Function version

SELECT examples

list_version

Gets NVIDIA Cloud Account IDs that are authorized to invoke specified function version. Response includes authorized accounts that were added specifically at the version level and the authorized accounts that were inherited from function level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header

SELECT
id,
nca_id,
version_id,
authorized_parties
FROM nvidia.nvcf_functions.authorizations
WHERE function_id = '{{ function_id }}' -- required
AND function_version_id = '{{ function_version_id }}' -- required
;

list

Lists function versions of the specified function and their corresponding authorized accounts allowed to invoke the function version. Individual versions of a function can have their own authorized accounts. So, each object in the array can have different authorized accounts listed. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header

SELECT
id,
nca_id,
version_id,
authorized_parties
FROM nvidia.nvcf_functions.authorizations
WHERE function_id = '{{ function_id }}' -- required
;

list_all

Lists all the function versions in an account that have been shared/authorized with/to other accounts. Response includes the nca-ids of the authorized accounts. If a function version is not shared/authorized, then it is not included in the response. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header

SELECT
id,
nca_id,
version_id,
authorized_parties
FROM nvidia.nvcf_functions.authorizations
;

INSERT examples

add_version

Adds the specified NVIDIA Cloud Account to the set of authorized accounts that can invoke the specified function version. If the specified function version does not have any existing inheritable authorized accounts, it results in a response with status 404. If the specified account is already in the set of existing authorized accounts that are directly associated with the function version, it results in a response wit status code 409. If a function is public, then Account Admin cannot perform this operation. Note that the response does not include inherited authorized accounts that were added at the function level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header

INSERT INTO nvidia.nvcf_functions.authorizations (
authorized_party,
function_id,
function_version_id
)
SELECT 
'{{ authorized_party }}' /* required */,
'{{ function_id }}',
'{{ function_version_id }}'
RETURNING
function
;

add

Adds the specified NVIDIA Cloud Account to the set of authorized accounts that are can invoke all the versions of the specified function. If the specified function does not have any existing inheritable authorized accounts, it results in a response with status 404. If the specified account is already in the set of existing inheritable authorized accounts, it results in a response with status code 409. If a function is public, then Account Admin cannot perform this operation. Note that response only includes authz accounts at the function level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header

INSERT INTO nvidia.nvcf_functions.authorizations (
authorized_party,
function_id
)
SELECT 
'{{ authorized_party }}' /* required */,
'{{ function_id }}'
RETURNING
function
;

Manifest

# Description fields are for documentation purposes
- name: authorizations
props:
  - name: function_id
    value: "{{ function_id }}"
    description: Required parameter for the authorizations resource.
  - name: function_version_id
    value: "{{ function_version_id }}"
    description: Required parameter for the authorizations resource.
  - name: authorized_party
    description: |
      Data Transfer Object(DTO) representing an authorized party.
    value:
      clientId: "{{ clientId }}"
      ncaId: "{{ ncaId }}"

REPLACE examples

set_version

Authorizes additional NVIDIA Cloud Accounts to invoke a specific function version. By default, a function belongs to the NVIDIA Cloud Account that created it, and the credentials used for function invocation must reference the same NVIDIA Cloud Account. Upon invocation of this endpoint, any existing authorized accounts will be overwritten by the newly specified authorized accounts. Note that the response does NOT include inherited authorized accounts that were added at the function level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header

REPLACE nvidia.nvcf_functions.authorizations
SET 
authorized_parties = '{{ authorized_parties }}'
WHERE 
function_id = '{{ function_id }}' --required
AND function_version_id = '{{ function_version_id }}' --required
AND authorized_parties = '{{ authorized_parties }}' --required
RETURNING
function;

set

Authorizes additional NVIDIA Cloud Accounts to invoke any version of the specified function. By default, a function belongs to the NVIDIA Cloud Account that created it, and the credentials used for function invocation must reference the same NVIDIA Cloud Account. Upon invocation of this endpoint, any existing authorized accounts will be overwritten by the newly specified authorized accounts. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header

REPLACE nvidia.nvcf_functions.authorizations
SET 
authorized_parties = '{{ authorized_parties }}'
WHERE 
function_id = '{{ function_id }}' --required
AND authorized_parties = '{{ authorized_parties }}' --required
RETURNING
function;

DELETE examples

remove_version

Removes the specified NVIDIA Cloud Account from the set of authorized accounts that are directly associated with specified function version. If the specified function version does not have any of its own(not inherited) authorized accounts, it results in a response with status 404. Also, if the specified authorized account is not in the set of existing authorized parties that are directly associated with the specified function version, it results in a response with status code 404. If the specified function version is public, then Account Admin cannot perform this operation. Note that the response does not include inherited authorized accounts that were added at the function level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header

DELETE FROM nvidia.nvcf_functions.authorizations
WHERE function_id = '{{ function_id }}' --required
AND function_version_id = '{{ function_version_id }}' --required
;

remove

Removes the specified NVIDIA Cloud Account from the set of authorized accounts that can invoke all the versions of the specified function. If the specified function does not have any existing inheritable authorized parties, it results in a response with status 404. Also, if the specified account is not in the existing set of inheritable authorized accounts, it results in a response with status 404. If the specified function is public, then Account Admin cannot perform this operation. Note that response only includes the remaining authorized accounts at the function level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header

DELETE FROM nvidia.nvcf_functions.authorizations
WHERE function_id = '{{ function_id }}' --required
;

Lifecycle Methods

EXEC variables use wire (API) names.

delete_all

Deletes authorizations at the function level. This impacts all versions of the function. If a function versions has its own set of authorizations, those are not deleted. If the specified function is public, then Account Admin cannot perform this operation. Note that the response does not include any authz accounts at version level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header

EXEC nvidia.nvcf_functions.authorizations.delete_all 
@function_id='{{ function_id }}' --required
;

delete_all_version

Deletes all the authorized accounts that are directly associated with the specified function version. Authorized parties that are inherited by the function version are not deleted. If the specified function version is public, then Account Admin cannot perform this operation. Note that the response does not include inherited authorized accounts that were added at the function level. Access to this functionality mandates the inclusion of a bearer token with the 'authorize_clients' scope in the HTTP Authorization header

EXEC nvidia.nvcf_functions.authorizations.delete_all_version 
@function_id='{{ function_id }}' --required, 
@function_version_id='{{ function_version_id }}' --required
;