Skip to main content
 print this page

Grant, revoke, or upgrade vertical user access

PUT 
/verticals/:id/users

Updates another user's vertical access. Requires verticals.fullaccess on role_id and owner ACL on the vertical (editor is not enough). Query action is required: grant-access, revoke-access, or upgrade-role. Body Username is required. AllowedApps in the body is ignored; apps are derived from Cognito custom:attr3. For the BI vertical (VerticalType bi), grant/revoke/upgrade also require the caller to be a BI admin role manager (AUTH-1002 otherwise). grant-access and upgrade-role require QuicksightAccessType of ADMIN, AUTHOR, or READER. When the vertical has IsQEnabled=yes, ADMIN_PRO, AUTHOR_PRO, and READER_PRO are also accepted. upgrade-role may include EnableGenAIFeatures and waits synchronously for QuickSight role upgrade. grant-access and revoke-access for BI start an async registration/deletion and email the user when complete. BI revoke-access may include delete_action delete_resources or transfer_resources (the latter requires new_owner_user with owner/editor on BI). Users with only a single vertical app and no Amorphic user record cannot be revoke-access'd; they must be deleted from user management. For non-BI verticals, grant-access and upgrade-role both add the vertical type to Cognito allowed_apps; revoke-access removes it. Cognito apps for the BI vertical are not updated in this Lambda (the QuickSight worker does that asynchronously). Success Message is chosen in this order: - action=upgrade-role (any vertical): "Successfully upgraded quicksight user role"

  • BI grant-access or revoke-access: "Initiated BI Application access update, user will receive email on completion"
  • otherwise: "Successfully modified access of user for the {VerticalName}"

This Lambda maps InvalidInputException and UnauthorizedUserException to HTTP 400. Example: PUT /verticals/{id}/users?action=grant-access

Request​

Responses​

Access update accepted or completed. See Message.

Response Headers
    Access-Control-Allow-Origin
    Access-Control-Allow-Methods
    Access-Control-Allow-Headers