IAM reference — Origin Cloud Docs

Look up exact commands, roles and API operations here. For how IAM works, see Access model.

Reference pages

CLI commands
Every origin iam command with its options. See origin iam commands.

Built-in roles
Every role with its URN and permissions. See Built-in roles.

Errors
Error codes shared by every API operation. See Errors.

All queries are fields of the iam namespace of the query root.

Query	Returns
`currentUser`	The signed-in user.
`currentUserGrants`	Every role assignment the caller holds, in all organizations.
`principalGrants`	Every role assignment one principal holds in the organization, with its scope and creation time. Needs `iam.member.list`, like `orgRoleAssignments`.
`roles`	Every built-in role with its permissions.
`role`	One built-in role by the URN `roles` lists. Needs no permission.
`groups`	The three built-in groups, by name and description. Groups aren’t principals and can’t hold roles.
`group`	One built-in group by URN, with your organization ID in it: `urn:origin:cloud:iam::<org-id>::builtin/group/<group-id>`.
`permissions`	Every permission the platform defines.
`hasPermission`	Whether a principal holds a permission on a resource.
`orgMembers`	Every principal with a role assignment in the organization, with its role URNs.
`orgRoleAssignments`	Every role assignment in the organization, with its scope and creation time.
`orgInvites`	Pending invites in the organization.
`serviceAccounts`	Every service account in the organization, active or revoked, without secrets.
`auditLogEntries`	One page of the organization’s audit log. See Audit log.

All mutations are fields of the iam namespace of the mutation root.

Mutation	Effect
`assignRole`	Assigns a built-in role to a principal, org-wide or for one project. Only a role whose permissions you hold yourself at that scope.
`revokeRole`	Revokes one role from a principal at exactly the given scope. Only a role whose permissions you hold yourself at that scope.
`inviteMember`	Invites a person by email with one org-wide role, which you must be able to assign.
`removeMember`	Revokes every role a principal holds in the organization, if you could revoke each of them.
`revokeInvite`	Cancels a pending invite.
`createServiceAccount`	Creates a service account and returns its client ID and one-time client secret.
`revokeServiceAccount`	Disables a service account’s credential.