7. PanFS Users

Per-tenant PanFS identities, with POSIX uid/gid, used for S3 object ownership, distinct from the tenant users who sign in to PanAPI itself.

Endpoint Summary

GET /api/v1/tenants/{tenant_id}/fs-users

List PanFS users

Every PanFS user in the tenant, sorted by name. No secrets.

Authentication: required (PasswordLogin or BearerJWT).

Parameters

Responses

Response Body (200, FsUserListResponse)

POST /api/v1/tenants/{tenant_id}/fs-users

Create PanFS user

Create a PanFS user in the tenant. The name must be unique within the tenant, and so must the S3 access key, which defaults to the name. The S3 secret is minted here and is not returned: read it through the reveal route, which gates on a stronger permission.

Authentication: required (PasswordLogin or BearerJWT).

Parameters

Request Body (application/json, required)

Schema: FsUserCreateRequest

Request payload for creating a PanFS user.

Example

{
   "gid" : 1000,
   "name" : "alice",
   "uid" : 1000
}

Responses

Response Body (201, FsUserResponse)

GET /api/v1/tenants/{tenant_id}/fs-users/{fs_user_id}

Get PanFS user

Fetch one PanFS user.

Authentication: required (PasswordLogin or BearerJWT).

Parameters

Responses

Response Body (200, FsUserResponse)

PATCH /api/v1/tenants/{tenant_id}/fs-users/{fs_user_id}

Update PanFS user

Partial update of uid, gid, profile and/or access_key. The secret cannot be changed here - rotation is its own operation, because it is destructive.

Authentication: required (PasswordLogin or BearerJWT).

Parameters

Request Body (application/json, required)

Schema: FsUserPatchRequest

Request payload for updating a PanFS user. The secret is not among the fields.

Responses

Response Body (200, FsUserResponse)

DELETE /api/v1/tenants/{tenant_id}/fs-users/{fs_user_id}

Delete PanFS user

Idempotent: deleting a user that is already gone succeeds, so a retry resumes.

Authentication: required (PasswordLogin or BearerJWT).

Parameters

Responses

GET /api/v1/tenants/{tenant_id}/fs-users/{fs_user_id}/s3/secret

Reveal a PanFS user S3 secret

Return the S3 secret. Gated on fs-users:read-s3-secret rather than fs-users:view, because it hands over a credential rather than describing one. The S3 gateway resolves a secret by access key instead, through POST /s3/gateway/s3-credentials/{access_key}/reveal.

Authentication: required (PasswordLogin or BearerJWT).

Parameters

Responses

Response Body (200, FsUserSecretResponse)

Example

{
   "access_key" : "alice",
   "secret_key" : "..."
}

POST /api/v1/tenants/{tenant_id}/fs-users/{fs_user_id}/s3/secret/rotate

Rotate a PanFS user S3 secret

Mint a new secret and return it once. The access key is left standing: it is what bucket owner fields and audit lines name. Permitted regardless of profile, so an operator can prepare a disabled user before re-enabling it.

Authentication: required (PasswordLogin or BearerJWT).

Parameters

Responses

Response Body (200, FsUserSecretResponse)

Example

{
   "access_key" : "alice",
   "secret_key" : "..."
}