ListUserPrivateAccessPolicies-阿里云帮助中心

Queries the list of user zero trust policies.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

csas:ListUserPrivateAccessPolicies

list

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
SaseUserId	string	Yes	The user ID.	su_e8f218fb171edd167c2ad917d21f53148bdefc510ca1f3c3cc0249d3643d****
CurrentPage	integer	Yes	The current page number.	1
PageSize	integer	Yes	The number of entries per page set for the paginated query. Valid values: 1 to 100.	10
Name	string	No	The name of the private access policy. The name must be 1 to 128 characters in length, and can contain Chinese characters, uppercase letters, lowercase letters, digits, periods (.), underscores (_), and hyphens (-).	private_access_policy_name

Response elements

Element	Type	Description	Example
	object	Schema of Response.
RequestId	string	Id of the request.	9D852F87-AFB5-51B8-AACD-F7D0EFB8277D
TotalNum	integer	The total number of authorized access policies.	20
Polices	array<object>	The list of authorized access policies.
	array<object>	The private access policy.
PolicyId	string	The ID of the private access policy.	pa-policy-1b0d0e8b4bcf****
Name	string	The name of the private access policy.	private_access_policy_name
Priority	integer	The priority of the private access policy. The number 1 indicates the highest priority.	1
PolicyAction	string	The action of the private access policy. Valid values: Block: blocks the access. Allow: allows the access. Valid values: Block : Block Allow : Allow	Allow
UserGroupMode	string	The user group type of the private access policy. Valid values: Normal: a normal user group. Custom: a custom user group. Valid values: Custom : Custom user group Normal : Normal user group	Custom
MatchedUserGroup	string	The user group to which the policy belongs.	user_group_name
DeviceAttributeName	string	The associated security baseline.	device_attribute_name
CustomUserAttributes	array<object>	The collection of custom user group attributes. Multiple custom user group attributes have an OR relationship and take effect as a union.
	object	The custom user group attribute.
UserGroupType	string	Type of the user group. Values: username: Username. department: Department. email: Email. telephone: Telephone. Valid values: telephone : 手机 department : 部门 email : 邮箱 username : 用户名	department
Relation	string	Relation of the user group. Values: Equal: Equal. Unequal: Not equal. Valid values: Unequal : 不等于 Equal : 等于	Equal
Value	string	The value of the user group attribute. When the user group type is username, it represents the value of the username. The length is 1 to 128 characters, supporting Chinese and case-sensitive English letters, and can include numbers, periods (.), underscores (_), and hyphens (-). When the user group type is department, it represents the value of the department. For example: OU=Department1,OU=SASE DingTalk. When the user group type is email, it represents the value of the email. For example: username@example.com. When the user group type is telephone, it represents the value of the phone number. For example: 13900001234.	OU=部门1,OU=SASE钉钉
IdpId	integer	The identity provider ID of the user group. This value exists when the custom user group type is department.	12
TrustedSoftwareIds	array	The list of trusted software IDs.
	string	The trusted software ID.	swb-xxxxxxx
TrustedProcessGroupIds	array	The list of trusted process group IDs.
	string	The trusted process group ID.	pg-xdxxxxxx

Examples

Success response

JSON format

{
  "RequestId": "9D852F87-AFB5-51B8-AACD-F7D0EFB8277D",
  "TotalNum": 20,
  "Polices": [
    {
      "PolicyId": "pa-policy-1b0d0e8b4bcf****",
      "Name": "private_access_policy_name",
      "Priority": 1,
      "PolicyAction": "Allow",
      "UserGroupMode": "Custom",
      "MatchedUserGroup": "user_group_name",
      "DeviceAttributeName": "device_attribute_name",
      "CustomUserAttributes": [
        {
          "UserGroupType": "department",
          "Relation": "Equal",
          "Value": "OU=部门1,OU=SASE钉钉",
          "IdpId": 12
        }
      ],
      "TrustedSoftwareIds": [
        "swb-xxxxxxx"
      ],
      "TrustedProcessGroupIds": [
        "pg-xdxxxxxx"
      ]
    }
  ]
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.