# privilege.query

Type: object

##

Type: array
No Additional Items

#### Tuple Validation

##### Parameter 1: filters

#### filters

Type: array Default: []

List of filters for query results. See API documentation for "Query Methods" for more guidance.

No Additional Items

##### Each item of this array must be:

Type: object
Examples:

    [
        [
            "name",
            "=",
            "bob"
        ]
    ]

    [
        [
            "OR",
            [
                [
                    [
                        "name",
                        "=",
                        "bob"
                    ]
                ],
                [
                    [
                        "name",
                        "=",
                        "larry"
                    ]
                ]
            ]
        ]
    ]

##### Parameter 2: options

#### options

Type: object
Default:
{ "extra": {}, "order_by": [], "select": [], "count": false, "get": false, "offset": 0, "limit": 0, "force_sql_filters": false }

Query options including pagination, ordering, and additional parameters.

No Additional Properties

##

#### Extra

Type: object Default: {}

Extra options are defined on a per-endpoint basis and are described in the documentation for the associated query method.

##

#### Order By

Type: array of string Default: []

An array of field names describing the manner in which query results should be ordered. The field names may also have one of more of the following special prefixes: `-` (reverse sort direction), `nulls_first:` (place any null values at the head of the results list), `nulls_last:` (place any null values at the tail of the results list).

No Additional Items

##### Each item of this array must be:

Type: string
Example:

    [
        "size",
        "-devname",
        "nulls_first:-expiretime"
    ]

##

#### Select

Type: array Default: []

An array of field names specifying the exact fields to include in the query return. The dot character `.` may be used to explicitly select only subkeys of the query result.

No Additional Items

##### Each item of this array must be:

## Any of

Type: string
Type: array
No Additional Items

##### Each item of this array must be:

Type: object
Example:

    [
        "username",
        "Authentication.status"
    ]

##

#### Count

Type: boolean Default: false

Return a numeric value representing the number of items that match the specified `query-filters`.

##

#### Get

Type: boolean Default: false

Return the JSON object of the first result matching the specified `query-filters`. The query fails if there specified `query-filters` return no results.

##

#### Offset

Type: integer Default: 0

This specifies the beginning offset of the results array. When combined with the `limit` query-option it may be used to implement pagination of large results arrays. WARNING: some query methods provide volatile results and the onus is on the developer to understand whether pagination is appropriate for a particular query API method.

##

#### Limit

Type: integer Default: 0

This specifies the maximum number of results matching the specified `query-filters` to return. When combined wtih the `offset` query-option it may be used to implement pagination of large results arrays.

WARNING: Some query methods provide volatile results and the onus is on the developer to understand whether pagination is appropriate for a particular query API method.

##

#### Force Sql Filters

Type: boolean Default: false

Force use of SQL for result filtering to reduce response time. May not work for all methods.

##

#### Result

## Any of

Type: array of object
No Additional Items

##### Each item of this array must be:

#### PrivilegeQueryResultItem

Type: object
No Additional Properties

##

#### Id

Type: integer

Unique identifier for the privilege.

##

#### Builtin Name

Name of the built-in privilege if this is a system privilege. `null` for custom privileges.

## Any of

Type: string
Type: null

##

#### Name

Type: string

Display name of the privilege.

Must be at least `1` characters long

##

#### Local Groups

Type: array

Array of local groups assigned to this privilege.

No Additional Items

##### Each item of this array must be:

## Any of

#### GroupEntry

Type: object
No Additional Properties

##

#### Id

Type: integer

This is the API identifier for the group. Use this ID for `group.update` and `group.delete` API calls. This ID also appears in the `groups` array for each user entry in `user.query` results.

NOTE: For groups from a directory service, the `id` is calculated by adding 100000000 to the `gid`. This ensures consistent API results. You cannot change directory service accounts through TrueNAS.

##

#### Gid

Type: integer

A non-negative integer used to identify a group. TrueNAS uses this value for permission checks and many other system purposes.

##

#### Name

Type: string

A string used to identify a group.

Must be at least `1` characters long

##

#### Builtin

Type: boolean

If `True`, the group is an internal system account for the TrueNAS server. Typically, one should create dedicated groups for access to the TrueNAS server webui and shares.

##

#### Sudo Commands

Type: array of string Default: []

A list of commands that group members may execute with elevated privileges. User is prompted for password when executing any command from the list.

No Additional Items

##### Each item of this array must be:

Type: string

Must be at least `1` characters long

##

#### Sudo Commands Nopasswd

Type: array of string Default: []

A list of commands that group members may execute with elevated privileges. User is not prompted for password when executing any command from the list.

No Additional Items

##### Each item of this array must be:

Type: string

Must be at least `1` characters long

##

#### Smb

Type: boolean Default: true

If set to `True`, the group can be used for SMB share ACL entries. The group is mapped to an NT group account on the TrueNAS SMB server and has a `sid` value.

##

#### Userns Idmap

Default: null

Specifies the subgid mapping for this group. If DIRECT then the GID will be directly mapped to all containers. Alternatively, the target GID may be explicitly specified. If null, then the GID will not be mapped.

NOTE: This field will be ignored for groups that have been assigned TrueNAS roles.

## Any of

Type: const
Specific value: `"DIRECT"`
Type: integer

Value must be greater or equal to `1` and lesser or equal to `4294967294`

Type: null

##

#### Group

Type: string

A string used to identify a group. Identical to the `name` key.

Must be at least `1` characters long

##

#### Local

Type: boolean

If `True`, the group is local to the TrueNAS server. If `False`, the group is provided by a directory service.

##

#### Sid

The Security Identifier (SID) of the user if the account an `smb` account. The SMB server uses this value to check share access and for other purposes.

## Any of

Type: string
Type: null

##

#### Roles

Type: array of string

List of roles assigned to this groups. Roles control administrative access to TrueNAS through the web UI and API. You can change group roles by using `privilege.create`, `privilege.update`, and `privilege.delete`.

No Additional Items

##### Each item of this array must be:

Type: string

##

#### Users

Type: array of integer Default: []

A list a API user identifiers for local users who are members of this group. These IDs match the `id` field from `user.query`.

NOTE: This field is empty for groups that come from directory services (`local` is `False`).

No Additional Items

##### Each item of this array must be:

Type: integer

##

#### Immutable

Type: boolean

This is a read-only field showing if the group entry can be changed. If `True`, the group is immutable and cannot be changed. If `False`, the group can be changed.

#### UnmappedGroupEntry

Type: object
No Additional Properties

##

#### Gid

Group ID if this is a local group that couldn't be mapped. `null` for directory service groups.

## Any of

Type: integer
Type: null

##

#### Sid

Security identifier if this is a directory service group that couldn't be mapped. `null` for local groups.

## Any of

Type: string
Type: null

##

#### Group

Type: null

Always `null` for unmapped groups.

##

#### Ds Groups

Type: array

Array of directory service groups assigned to this privilege.

No Additional Items

##### Each item of this array must be:

## Any of

#### GroupEntry

Type: object
No Additional Properties

##

#### Id

Type: integer

This is the API identifier for the group. Use this ID for `group.update` and `group.delete` API calls. This ID also appears in the `groups` array for each user entry in `user.query` results.

NOTE: For groups from a directory service, the `id` is calculated by adding 100000000 to the `gid`. This ensures consistent API results. You cannot change directory service accounts through TrueNAS.

##

#### Gid

Type: integer

A non-negative integer used to identify a group. TrueNAS uses this value for permission checks and many other system purposes.

##

#### Name

Type: string

A string used to identify a group.

Must be at least `1` characters long

##

#### Builtin

Type: boolean

If `True`, the group is an internal system account for the TrueNAS server. Typically, one should create dedicated groups for access to the TrueNAS server webui and shares.

##

#### Sudo Commands

Type: array of string Default: []

A list of commands that group members may execute with elevated privileges. User is prompted for password when executing any command from the list.

No Additional Items

##### Each item of this array must be:

Type: string

Must be at least `1` characters long

##

#### Sudo Commands Nopasswd

Type: array of string Default: []

A list of commands that group members may execute with elevated privileges. User is not prompted for password when executing any command from the list.

No Additional Items

##### Each item of this array must be:

Type: string

Must be at least `1` characters long

##

#### Smb

Type: boolean Default: true

If set to `True`, the group can be used for SMB share ACL entries. The group is mapped to an NT group account on the TrueNAS SMB server and has a `sid` value.

##

#### Userns Idmap

Default: null

Specifies the subgid mapping for this group. If DIRECT then the GID will be directly mapped to all containers. Alternatively, the target GID may be explicitly specified. If null, then the GID will not be mapped.

NOTE: This field will be ignored for groups that have been assigned TrueNAS roles.

## Any of

Type: const
Specific value: `"DIRECT"`
Type: integer

Value must be greater or equal to `1` and lesser or equal to `4294967294`

Type: null

##

#### Group

Type: string

A string used to identify a group. Identical to the `name` key.

Must be at least `1` characters long

##

#### Local

Type: boolean

If `True`, the group is local to the TrueNAS server. If `False`, the group is provided by a directory service.

##

#### Sid

The Security Identifier (SID) of the user if the account an `smb` account. The SMB server uses this value to check share access and for other purposes.

## Any of

Type: string
Type: null

##

#### Roles

Type: array of string

List of roles assigned to this groups. Roles control administrative access to TrueNAS through the web UI and API. You can change group roles by using `privilege.create`, `privilege.update`, and `privilege.delete`.

No Additional Items

##### Each item of this array must be:

Type: string

##

#### Users

Type: array of integer Default: []

A list a API user identifiers for local users who are members of this group. These IDs match the `id` field from `user.query`.

NOTE: This field is empty for groups that come from directory services (`local` is `False`).

No Additional Items

##### Each item of this array must be:

Type: integer

##

#### Immutable

Type: boolean

This is a read-only field showing if the group entry can be changed. If `True`, the group is immutable and cannot be changed. If `False`, the group can be changed.

#### UnmappedGroupEntry

Type: object
No Additional Properties

##

#### Gid

Group ID if this is a local group that couldn't be mapped. `null` for directory service groups.

## Any of

Type: integer
Type: null

##

#### Sid

Security identifier if this is a directory service group that couldn't be mapped. `null` for local groups.

## Any of

Type: string
Type: null

##

#### Group

Type: null

Always `null` for unmapped groups.

##

#### Roles

Type: array of string

Array of role names included in this privilege.

No Additional Items

##### Each item of this array must be:

Type: string

##

#### Web Shell

Type: boolean

Whether this privilege grants access to the web shell.

#### PrivilegeQueryResultItem

Type: object
No Additional Properties

##

#### Id

Type: integer

Unique identifier for the privilege.

##

#### Builtin Name

Name of the built-in privilege if this is a system privilege. `null` for custom privileges.

## Any of

Type: string
Type: null

##

#### Name

Type: string

Display name of the privilege.

Must be at least `1` characters long

##

#### Local Groups

Type: array

Array of local groups assigned to this privilege.

No Additional Items

##### Each item of this array must be:

## Any of

Type: object
Type: object

##

#### Ds Groups

Type: array

Array of directory service groups assigned to this privilege.

No Additional Items

##### Each item of this array must be:

## Any of

Type: object
Type: object

##

#### Roles

Type: array of string

Array of role names included in this privilege.

No Additional Items

##### Each item of this array must be:

Type: string

##

#### Web Shell

Type: boolean

Whether this privilege grants access to the web shell.

Type: integer

Required roles: PRIVILEGE_READ