GraphQL - Removing Usergroup Role Document Assignments via GraphQL

Products

• CloudHealth

Issue/Introduction

Usergroup Assignments can be removed from the platform through use of the following mutation - 

mutation { 
updateUserGroupRoleBindings( 
input: { deletes: [{ id: "crn:1:role-mgmt/ugrb:1" }] } 
) { 
deletes 
} 
}

The crn:1:role-mgmt/ugrb:1 portion represents the unique ID for a Role Document assignment.

As a quick example I'll run through using the GetRoleDoc query referenced here - https://help.cloudhealthtech.com/graphql-api/#getaroledocument and how it can be used to pull back this ID see example query below - 

query GetARoleDoc {
  node(id: "crn:53635:role-document/6587") {
    ... on RoleDocument {
      updatedAt
      userGroupRoleBindings(after: "string", before: "string", first: 20, last: 20) {
        edges {
          cursor
          node {
            id
            organizationId
            updatedAt
            updatedById
            userGroupId
            userGroup {
            name
          }
          }
        }
        pageInfo {
          hasNextPage
          hasPreviousPage
          startCursor
          endCursor
        }
      }
      }
    }
  }
  }

Note: the First and Last arguments within the "userGroupRoleBindings" section controls the amount of results returned for each binding.  This has been set at 20 for testing purposes but if the role document is assigned to more than 20 Usergroups you would want to increase those two numbers.
 
This query will return a response similar to the following -

{
  "data": {
    "node": {
      "updatedAt": "2020-12-21T08:31:53Z",
      "userGroupRoleBindings": {
        "edges": [
          {
            "cursor": "MQ",
            "node": {
              "id": "crn:573:role-mgmt/ugrb:103986",
              "organizationId": "crn:573:organization/137438953498",
              "updatedAt": "2023-06-08T01:43:57Z",
              "updatedById": "crn:573:user/138259",
              "userGroupId": "crn:573:user-group/137438953511",
              "userGroup": {
                "name": "50971"
              }
            }
          },
          {
            "cursor": "Mg",
            "node": {
              "id": "crn:573:role-mgmt/ugrb:24147",
              "organizationId": "crn:573:organization/137438953498",
              "updatedAt": "2020-12-21T08:34:46Z",
              "updatedById": "crn:573:user/153420",
              "userGroupId": "crn:573:user-group/137438953512",
              "userGroup": {
                "name": "50971_New"
              }
            }
          }
        ],
        "pageInfo": {
          "hasNextPage": false,
          "hasPreviousPage": false,
          "startCursor": "MQ",
          "endCursor": "Mg"
        }
      }
    }
  }
}

Explaining the response, each of the nodes represents an assignment to a specific Usergroup, e.g - crn:573:role-mgmt/ugrb:103986 represent the assignment of the role document - crn:573:role-document/1128 to the Usergroup with name 50971, whereas crn:573:role-mgmt/ugrb:24147 represents the assignment to the Usergroup with name 50971_New.

Resolution

To remove the assignment of role doc - crn:573:role-document/1128 from the 50971_New Usergroup, issue the following ID in the UpdateUserRoleBindings mutation - 
 

mutation { 
updateUserGroupRoleBindings( 
input: { deletes: [{ id: "crn:573:role-mgmt/ugrb:24147" }] } 
) { 
deletes 
} 
}