Rest api for authorization

[dvg06]

Hi Splunkers, 

Trying to disable certain capabilities from roles via rest api, but havent been successful yet. Please help.

What is the rest endpoint url that I should use to disable.

I tried something like https://127.0.0.1:8089/services/authorization/roles/power/capabilities/rtsearch/disable, but this is invalid end point. Splunk documentation has not been very helpful. 

[dvg06]

thanks @manjunathmeti 

I can update the capabilities using the above command.

But any idea how to delete this particular capability? what flag should I use instead of -d?

[manjunathmeti]

First, you can GET list of capabilities and remove the role from the list and POST it back.

[manjunathmeti]

You can use /authorization/roles/<rolename> enpoint to get and update capabilities of a role. Refer this https://docs.splunk.com/Documentation/Splunk/8.1.1/RESTREF/RESTaccess#authorization.2Froles.2F.7Bnam....

curl -k -u admin:changeme https://localhost:8089/services/authorization/roles/power -d capabilities=search