pbs_acl_update
Grant or revoke a PBS ACL entry to manage access permissions on a specified path for a user or group.
Instructions
MUTATION (HIGH): grant or revoke a PBS ACL entry (PUT /access/acl) — this GRANTS or REVOKES AUTHORITY, so it is treated as HIGH risk unconditionally on this plane (PBS's ACL-inheritance/shadow semantics are not schema-documented or live-verified here, unlike PVE's plan_acl_modify which computes a shadow/widen preview — every change here is flagged HIGH rather than risk under-flagging one this module cannot yet analyze).
Dry-run by default (reads the current entries at this exact path for context). Exactly one of auth_id (a user or token principal) / group is required — PBS's PUT /access/acl carries a single 'role' (not PVE's comma-separated multi-role list) and folds user+token identity into one 'auth-id' field. delete=False = grant; delete=True = revoke. confirm=True executes and returns a dict; synchronous, no UPID. Use pbs_acl_get to see current entries or pbs_roles_list to see PBS's fixed set of built-in roles. Needs PROXIMO_PBS_* config.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ACL path the entry applies to, e.g. '/datastore/ds1' or '/'. | |
| role | Yes | A single PBS role id to grant or revoke, e.g. 'DatastoreAdmin'. | |
| group | No | Group principal. Exactly one of auth_id/group is required. | |
| delete | No | False to grant the role, True to revoke it. | |
| digest | No | Optional SHA256 config digest to prevent concurrent modifications. | |
| auth_id | No | User or token principal ('user@realm' or 'user@realm!token-name'). Exactly one of auth_id/group is required. | |
| confirm | No | False (default) returns a dry-run PLAN preview; True executes the mutation. | |
| propagate | No | Whether the grant propagates to child paths below `path`; omit for PBS's default (true). | |
| proximo_target | No | Which configured Proxmox target to run this call against — a target name from your multi-target config (a specific PVE/PBS/PMG/PDM box). Omit to use the single/default target from the environment; the selection applies only to this call. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |