Group-based permissions with JWT authentication. Control who can execute what, on which resources, on which nodes.
DevOps, Security, and Platform teams need different permissions. A single shared cluster with fine-grained access control.
# Create DevOps group
$ curl -X POST /api/v1.0/groups \
-d '{
"name": "devops",
"permissions": {
"orchestrations": ["can_read", "can_create", "can_execute"],
"vault": ["can_read:app-*"],
"servers": ["can_read", "can_register"],
"files": ["can_upload"]
}
}'
# Security team - limited access
$ curl -X POST /api/v1.0/groups \
-d '{
"name": "security",
"permissions": {
"vault": ["can_read"],
"logs": ["can_query"],
"users": ["can_read"]
}
}'vault:prod-*can_execute_on:prod-serversShort-lived access tokens minimize damage if leaked:
# Login to get tokens
$ curl -X POST /api/v1.0/auth/login \
-d '{
"username": "alice",
"password": "secret"
}'
{
"access_token": "eyJ...valid for 15 min",
"refresh_token": "eyJ...valid for 30 days"
}
# Token automatically validated on every request
$ curl /api/v1.0/orchestrations \
-H "Authorization: Bearer $ACCESS_TOKEN"Pre-defined roles (Admin, Developer, Viewer) with ability to create custom roles with specific permission sets.
"role": "app-deployer",
"permissions": [
"orchestrations:execute:prod-*",
"vault:read:app-secrets"
]Grant access for specific time windows. Perfect for maintenance windows or contractor access.
"permissions": [{
"action": "execute",
"from": "2025-03-12T10:00Z",
"to": "2025-03-12T12:00Z"
}]Control access at the resource level: specific orchestrations, vaults, or servers.
"resources": {
"orch-deploy": ["read", "execute"],
"vault-prod": ["read"]
}Optional MFA support via TOTP for sensitive operations and user management.
"mfa": {
"required_for": [
"vault:write",
"user:create"
],
"algorithm": "TOTP"
}Users get minimum permissions needed for their job.
All access logged for compliance and forensics.
15-minute access tokens limit exposure window.
JWT tokens, SHA-256 hashed passwords only.