pve_acl_modify
Grant or revoke Proxmox ACL entries with dry-run preview to avoid shadow or widen effects. Execute with confirmation to apply changes.
Instructions
MUTATION: grant or revoke an ACL entry (PUT /access/acl).
Dry-run by default (returns a PLAN) — it surfaces the critical Proxmox gotcha: a specific-path ACL REPLACES inherited grants (SHADOW) and revoking can RESTORE them (WIDEN). confirm=True executes and returns a dict; synchronous, no UPID. Use pve_acl_list to see current entries, pve_overbroad_grants to find over-broad ones, or pve_acl_prune to narrow/remove one.
kind='user' (default), 'group', or 'token'. delete=False = grant; delete=True = revoke.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | Principal type of target: 'user', 'group', or 'token'. | user |
| path | Yes | Resource path the ACL entry applies to, e.g. '/vms/100' or '/'. | |
| roles | Yes | Comma-separated role id(s) to grant or revoke, e.g. 'PVEVMAdmin'. | |
| delete | No | False to grant the roles, True to revoke them. | |
| target | Yes | Principal the ACL entry applies to: userid, groupid, or tokenid depending on kind. | |
| confirm | No | False (default) returns a dry-run PLAN preview; True executes the mutation. | |
| propagate | No | Whether the grant propagates to child paths below `path`. | |
| proximo_target | No | Which configured Proxmox target to run this call against — a target name from your multi-target config (a specific PVE/PBS/PMG/PDM box). Omit to use the single/default target from the environment; the selection applies only to this call. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |