# # Generated by: zmprov grd com.zimbra.cs.service.admin # # Date: January 20, 2016 # # Packages: # com.zimbra.cs.service.admin # ======================================== Package: com.zimbra.cs.service.admin ======================================== ------------------------------ AddAccountAliasRequest Related rights: addCalendarResourceAlias addAccountAlias createAlias Notes: Need createAlias right on the domain in which the alias is to be created. Need addAccountAlias right if adding alias for an account. Need addCalendarResourceAlias right if adding alias for a calendar resource. ------------------------------ AddAccountLoggerRequest Related rights: manageAccountLogger Notes: ------------------------------ AddDistributionListAliasRequest Related rights: addDistributionListAlias addGroupAlias createAlias Notes: ------------------------------ AddDistributionListMemberRequest Related rights: addDistributionListMember addGroupMember Notes: ------------------------------ AddGalSyncDataSourceRequest Related rights: createAccount Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyAccount right, which allows setting all attributes on account, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ AdminCreateWaitSetRequest Related rights: Notes: If allAccounts is specified, Only system admins are allowed. Otherwise, for each requested account, If the target is an account, need the adminLoginAs right; If the target is a calendar resource, need the R_adminLoginCalendarResourceAs right. ------------------------------ AdminDestroyWaitSetRequest Related rights: Notes: If the waitset is on all accounts, Only system admins are allowed. Otherwise, must be the owner of the specified waitset ------------------------------ AdminWaitSetRequest Related rights: Notes: If the waitset is on all accounts, Only system admins are allowed. Otherwise, must be the owner of the specified waitset ------------------------------ AuthRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ AutoCompleteGalRequest Related rights: accessGAL Notes: ------------------------------ AutoProvAccountRequest Related rights: autoProvisionAccount Notes: ------------------------------ AutoProvTaskControlRequest Related rights: Notes: Only system admins are allowed. ------------------------------ CheckAuthConfigRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ CheckBlobConsistencyRequest Related rights: Notes: Only system admins are allowed. ------------------------------ CheckDirectoryRequest Related rights: checkDirectoryOnFileSystem Notes: ------------------------------ CheckDomainMXRecordRequest Related rights: checkDomainMXRecord Notes: ------------------------------ CheckExchangeAuthRequest Related rights: checkExchangeAuthConfig Notes: ------------------------------ CheckGalConfigRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ CheckHealthRequest Related rights: checkHealth Notes: The checkHealth is needed only when the client making the SOAP request is localhost. ------------------------------ CheckHostnameResolveRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ CheckPasswordStrengthRequest Related rights: checkPasswordStrength checkCalendarResourcePasswordStrength Notes: ------------------------------ CheckRightRequest Related rights: checkRightUsr Notes: ------------------------------ ClearCookieRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ CompactIndexRequest Related rights: reindexMailbox reindexCalendarResourceMailbox Notes: ------------------------------ ComputeAggregateQuotaUsageRequest Related rights: Notes: TDB ------------------------------ ConfigureZimletRequest Related rights: Notes: TDB Currently the soap gets a uploaded blob containing metadata. The zimlet name is encoded in in the blob and is decoded in ZimletUtil. We need a way to know the zimlet name (and cos name if any, currently it seems to always only update the default cos) in the SOAP handler in order to check right. ------------------------------ CopyCosRequest Related rights: createCos getCos Notes: Need the getCos right on the source cos. ------------------------------ CountAccountRequest Related rights: countAccount Notes: ------------------------------ CountObjectsRequest Related rights: countAccount countAlias countDomain countDistributionList countCos countServer countCalendarResource Notes: ------------------------------ CreateAccountRequest Related rights: createAccount Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyAccount right, which allows setting all attributes on account, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. Notes on zimbraCOSId: If setting zimbraCOSId, needs the assignCos right on the cos. ------------------------------ CreateAlwaysOnClusterRequest Related rights: createAlwaysOnCluster Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the createAlwaysOnCluster right, which allows setting all attributes on alwaysOnCluster, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ CreateCalendarResourceRequest Related rights: createCalendarResource Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyCalendarResource right, which allows setting all attributes on calendar resource, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ CreateCosRequest Related rights: createCos Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyCos right, which allows setting all attributes on cos, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ CreateDataSourceRequest Related rights: adminLoginAs adminLoginCalendarResourceAs Notes: If the target is an account, need the adminLoginAs right; If the target is a calendar resource, need the R_adminLoginCalendarResourceAs right. ------------------------------ CreateDistributionListRequest Related rights: createDistributionList createGroup Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyDistributionList right, which allows setting all attributes on distribution list, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyGroup right, which allows setting all attributes on group, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ CreateDomainRequest Related rights: createTopDomain createSubDomain Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyDomain right, which allows setting all attributes on domain, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ CreateGalSyncAccountRequest Related rights: createAccount Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyAccount right, which allows setting all attributes on account, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ CreateServerRequest Related rights: createServer Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyServer right, which allows setting all attributes on server, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ CreateSystemRetentionPolicyRequest Related rights: Notes: Need set attr right on attribute zimbraMailPurgeSystemPolicy ------------------------------ CreateUCServiceRequest Related rights: createUCService Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyUCService right, which allows setting all attributes on ucservice, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ CreateVolumeRequest Related rights: manageVolume Notes: ------------------------------ CreateXMPPComponentRequest Related rights: createXMPPComponent Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyXMPPComponent right, which allows setting all attributes on XMPP component, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ CreateZimletRequest Related rights: createZimlet Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyZimlet right, which allows setting all attributes on zimlet, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ DedupeBlobsRequest Related rights: Notes: Only system admins are allowed. ------------------------------ DelegateAuthRequest Related rights: adminLoginAs adminLoginCalendarResourceAs Notes: If the target is an account, need the adminLoginAs right; If the target is a calendar resource, need the R_adminLoginCalendarResourceAs right. ------------------------------ DeleteAccountRequest Related rights: deleteAccount Notes: ------------------------------ DeleteAlwaysOnClusterRequest Related rights: deleteAlwaysOnCluster Notes: ------------------------------ DeleteCalendarResourceRequest Related rights: deleteCalendarResource Notes: ------------------------------ DeleteCosRequest Related rights: deleteCos Notes: ------------------------------ DeleteDataSourceRequest Related rights: adminLoginAs adminLoginCalendarResourceAs Notes: If the target is an account, need the adminLoginAs right; If the target is a calendar resource, need the R_adminLoginCalendarResourceAs right. ------------------------------ DeleteDistributionListRequest Related rights: deleteDistributionList deleteGroup Notes: ------------------------------ DeleteDomainRequest Related rights: deleteDomain Notes: ------------------------------ DeleteGalSyncAccountRequest Related rights: deleteAccount Notes: ------------------------------ DeleteMailboxRequest Related rights: deleteAccount Notes: ------------------------------ DeleteServerRequest Related rights: deleteServer Notes: ------------------------------ DeleteSystemRetentionPolicyRequest Related rights: Notes: Need set attr right on attribute zimbraMailPurgeSystemPolicy ------------------------------ DeleteUCServiceRequest Related rights: deleteUCService Notes: ------------------------------ DeleteVolumeRequest Related rights: manageVolume Notes: ------------------------------ DeleteXMPPComponentRequest Related rights: deleteXMPPComponent Notes: ------------------------------ DeleteZimletRequest Related rights: deleteZimlet Notes: ------------------------------ DeployZimletRequest Related rights: deployZimlet Notes: If deploying on all servers, need the deployZimlet right on all servers or on global grant. If deploying on local server, need the deployZimlet on the local server. ------------------------------ DumpSessionsRequest Related rights: getSessions Notes: ------------------------------ ExportAndDeleteItemsRequest Related rights: Notes: Only system admins are allowed. ------------------------------ FixCalendarEndTimeRequest Related rights: Notes: Only system admins are allowed. ------------------------------ FixCalendarPriorityRequest Related rights: Notes: Only system admins are allowed. ------------------------------ FixCalendarTZRequest Related rights: Notes: Only system admins are allowed. ------------------------------ FlushCacheRequest Related rights: flushCache Notes: ------------------------------ GetAccountInfoRequest Related rights: getAccountInfo getCalendarResourceInfo Notes: ------------------------------ GetAccountLoggersRequest Related rights: manageAccountLogger Notes: ------------------------------ GetAccountMembershipRequest Related rights: getAccountMembership Notes: If the authed admin has get attr right on distribution list attr zimbraIsAdminGroup, it is returned in the response if set. ------------------------------ GetAccountRequest Related rights: getAccount Notes: Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>.To allow an admin to get all attributes, grant the getAccount right ------------------------------ GetAdminConsoleUICompRequest Related rights: viewAccountAdminUI viewDistributionListAdminUI Notes: If account/dl is not specified, Do not need any right, all admins are allowed. If an account is specified, need the viewAccountAdminUI right. If a dl is specified, need the viewDistributionListAdminUI right. Note, this call does not check for the get attr right for zimbraAdminConsoleUIComponents attribute on the account/dl, nor on the admin groups they belong. It simply checks the viewAccountAdminUI or viewDistributionListAdminUI right. ------------------------------ GetAdminExtensionZimletsRequest Related rights: listZimlet getZimlet Notes: Only zimlets on which the authed admin has effective listZimlet and getZimlet rights will appear in the response. e.g. there are zimlet1, zimlet2, zimlet3, if an admin has effective listZimlet and getZimlet rights on zimlet1, zimlet2, then only zimlet1, zimlet2 will appear in the GetAdminExtensionZimletsResponse. The GetAdminExtensionZimletsRequest itself will not get PERM_DENIED. ------------------------------ GetAdminSavedSearchesRequest Related rights: viewAdminSavedSearch Notes: ------------------------------ GetAggregateQuotaUsageOnServerRequest Related rights: Notes: TDB ------------------------------ GetAllAccountLoggersRequest Related rights: manageAccountLogger Notes: ------------------------------ GetAllAccountsRequest Related rights: listAccount getAccount Notes: If the authenticated admin does not have the corresponding list{Entry} right for an entry, the entry is skipped in the getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception will be thrown. Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>. ------------------------------ GetAllActiveServersRequest Related rights: Notes: Only system admins are allowed. ------------------------------ GetAllAdminAccountsRequest Related rights: listAccount getAccount Notes: If the authenticated admin does not have the corresponding list{Entry} right for an entry, the entry is skipped in the getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception will be thrown. Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>. ------------------------------ GetAllAlwaysOnClustersRequest Related rights: listAlwaysOnCluster getAlwaysOnCluster Notes: If the authenticated admin does not have the corresponding list{Entry} right for an entry, the entry is skipped in the getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception will be thrown. Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>. ------------------------------ GetAllCalendarResourcesRequest Related rights: listCalendarResource getCalendarResource Notes: If the authenticated admin does not have the corresponding list{Entry} right for an entry, the entry is skipped in the getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception will be thrown. Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>. ------------------------------ GetAllConfigRequest Related rights: getGlobalConfig Notes: ------------------------------ GetAllCosRequest Related rights: listCos getCos Notes: If the authenticated admin does not have the corresponding list{Entry} right for an entry, the entry is skipped in the getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception will be thrown. Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>. ------------------------------ GetAllDistributionListsRequest Related rights: listDistributionList getDistributionList Notes: If the authenticated admin does not have the corresponding list{Entry} right for an entry, the entry is skipped in the getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception will be thrown. Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>. ------------------------------ GetAllDomainsRequest Related rights: listDomain getDomain Notes: If the authenticated admin does not have the corresponding list{Entry} right for an entry, the entry is skipped in the getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception will be thrown. Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>. ------------------------------ GetAllEffectiveRightsRequest Related rights: checkRightUsr checkRightGrp Notes: If grantee to check for is an account, needs the checkRightUsr right If grantee to check for is a group, needs the checkRightGrp right ------------------------------ GetAllFreeBusyProvidersRequest Related rights: getAllFreeBusyProviders Notes: ------------------------------ GetAllLocalesRequest Related rights: Notes: Allow all admins ------------------------------ GetAllMailboxesRequest Related rights: Notes: Only system admins are allowed. ------------------------------ GetAllRightsRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ GetAllServersRequest Related rights: listServer getServer Notes: If the authenticated admin does not have the corresponding list{Entry} right for an entry, the entry is skipped in the getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception will be thrown. Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>. ------------------------------ GetAllSkinsRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ GetAllUCServicesRequest Related rights: listUCService getUCService Notes: If the authenticated admin does not have the corresponding list{Entry} right for an entry, the entry is skipped in the getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception will be thrown. Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>. ------------------------------ GetAllVolumesRequest Related rights: manageVolume Notes: ------------------------------ GetAllXMPPComponentsRequest Related rights: listXMPPComponent getXMPPComponent Notes: If the authenticated admin does not have the corresponding list{Entry} right for an entry, the entry is skipped in the getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception will be thrown. Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>. ------------------------------ GetAllZimletsRequest Related rights: listZimlet getZimlet Notes: If the authenticated admin does not have the corresponding list{Entry} right for an entry, the entry is skipped in the getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception will be thrown. Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>. ------------------------------ GetAlwaysOnClusterRequest Related rights: getAlwaysOnCluster Notes: Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>.To allow an admin to get all attributes, grant the getAlwaysOnCluster right ------------------------------ GetAttributeInfoRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ GetCalendarResourceRequest Related rights: getCalendarResource Notes: Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>.To allow an admin to get all attributes, grant the getCalendarResource right ------------------------------ GetConfigRequest Related rights: Notes: Need get attr right for the specified attribute. ------------------------------ GetCosRequest Related rights: getCos Notes: Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>.To allow an admin to get all attributes, grant the getCos right ------------------------------ GetCreateObjectAttrsRequest Related rights: checkRightUsr Notes: ------------------------------ GetCurrentVolumesRequest Related rights: manageVolume Notes: ------------------------------ GetDataSourcesRequest Related rights: adminLoginAs adminLoginCalendarResourceAs Notes: If the target is an account, need the adminLoginAs right; If the target is a calendar resource, need the R_adminLoginCalendarResourceAs right. ------------------------------ GetDelegatedAdminConstraintsRequest Related rights: Notes: Need set attr right on attribute zimbraConstraint ------------------------------ GetDistributionListMembershipRequest Related rights: getDistributionListMembership Notes: ------------------------------ GetDistributionListRequest Related rights: getDistributionList getGroup Notes: Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>.To allow an admin to get all attributes, grant the getDistributionList right Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>.To allow an admin to get all attributes, grant the getGroup right ------------------------------ GetDomainInfoRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ GetDomainRequest Related rights: getDomain Notes: Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>.To allow an admin to get all attributes, grant the getDomain right ------------------------------ GetEffectiveRightsRequest Related rights: checkRightUsr Notes: ------------------------------ GetFreeBusyQueueInfoRequest Related rights: Notes: Only system admins are allowed. ------------------------------ GetGrantsRequest Related rights: viewGrants Notes: Needs a get attr right of zimbraACE on each the target entry. Granting the viewGrants is one way to do it, which will give the right on all target types. Use inline right if more granularity is needed. See doc for the viewGrants right in zimbra-rights.xml for more details. ------------------------------ GetIndexStatsRequest Related rights: reindexMailbox reindexCalendarResourceMailbox Notes: ------------------------------ GetLicenseInfoRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ GetLoggerStatsRequest Related rights: getServerStats Notes: ------------------------------ GetMailQueueInfoRequest Related rights: manageMailQueue Notes: ------------------------------ GetMailQueueRequest Related rights: manageMailQueue Notes: ------------------------------ GetMailboxRequest Related rights: getMailboxInfo Notes: ------------------------------ GetMailboxStatsRequest Related rights: getMailboxStats Notes: ------------------------------ GetMemcachedClientConfigRequest Related rights: Notes: TDB ------------------------------ GetQuotaUsageRequest Related rights: getDomainQuotaUsage Notes: If a domain is specified, need the the domain right getDomainQuotaUsage. If domain is not specified, only system admins are allowed. ------------------------------ GetRightRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ GetRightsDocRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ GetServerNIfsRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ GetServerRequest Related rights: getServer Notes: Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>.To allow an admin to get all attributes, grant the getServer right ------------------------------ GetServerStatsRequest Related rights: getServerStats Notes: ------------------------------ GetServiceStatusRequest Related rights: getServiceStatus Notes: ------------------------------ GetSessionsRequest Related rights: getSessions Notes: ------------------------------ GetShareInfoRequest Related rights: adminLoginAs adminLoginCalendarResourceAs Notes: If the target is an account, need the adminLoginAs right; If the target is a calendar resource, need the R_adminLoginCalendarResourceAs right. ------------------------------ GetSystemRetentionPolicyRequest Related rights: Notes: Need get attr right on attribute zimbraMailPurgeSystemPolicy ------------------------------ GetUCServiceRequest Related rights: getUCService Notes: Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>.To allow an admin to get all attributes, grant the getUCService right ------------------------------ GetVersionInfoRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ GetVolumeRequest Related rights: manageVolume Notes: ------------------------------ GetXMPPComponentRequest Related rights: getXMPPComponent Notes: Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>.To allow an admin to get all attributes, grant the getXMPPComponent right ------------------------------ GetZimletRequest Related rights: getZimlet Notes: Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>.To allow an admin to get all attributes, grant the getZimlet right ------------------------------ GetZimletStatusRequest Related rights: listZimlet listCos getZimlet Notes: Only zimlets on which the authed admin has effective listZimlet and getZimlet rights will appear in <zimlets> in the response. Only zimlets on which the authed admin has effective listCos right will be appear in <cos> in the response. e.g. there are zimlet1, zimlet2, zimlet3 and cos1, cos2 , if an admin has effective listZimlet and getZimlet rights on zimlet1, zimlet2, then only zimlet1, zimlet2 will appear in <zimlets> in GetZimletStatusResponse, and only cos1 will appear in <cos> in the resposne. The GetZimletStatusRequest itself will not get PERM_DENIED. ------------------------------ GrantRightRequest Related rights: Notes: Grantor must have the same or more rights on the same target or on a larger target set. ------------------------------ LockoutMailboxRequest Related rights: Notes: TDB ------------------------------ MailQueueActionRequest Related rights: manageMailQueue Notes: ------------------------------ MailQueueFlushRequest Related rights: manageMailQueue Notes: ------------------------------ MigrateAccountRequest Related rights: adminLoginAs Notes: ------------------------------ ModifyAccountRequest Related rights: assignCos Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyAccount right, which allows setting all attributes on account, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. Notes on zimbraCOSId: If setting zimbraCOSId, needs the assignCos right on the cos.If removing zimbraCOSId, needs the assignCos right on the domain default cos. (in domain attribute zimbraDomainDefaultCOSId). ------------------------------ ModifyAdminSavedSearchesRequest Related rights: setAdminSavedSearch Notes: ------------------------------ ModifyAlwaysOnClusterRequest Related rights: Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyAlwaysOnCluster right, which allows setting all attributes on alwaysOnCluster, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ ModifyCalendarResourceRequest Related rights: Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyCalendarResource right, which allows setting all attributes on calendar resource, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ ModifyConfigRequest Related rights: Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyGlobalConfig right, which allows setting all attributes on global config, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ ModifyCosRequest Related rights: Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyCos right, which allows setting all attributes on cos, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ ModifyDataSourceRequest Related rights: adminLoginAs adminLoginCalendarResourceAs Notes: If the target is an account, need the adminLoginAs right; If the target is a calendar resource, need the R_adminLoginCalendarResourceAs right. ------------------------------ ModifyDelegatedAdminConstraintsRequest Related rights: Notes: Need set attr right on attribute zimbraConstraint ------------------------------ ModifyDistributionListRequest Related rights: Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyDistributionList right, which allows setting all attributes on distribution list, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ ModifyDomainRequest Related rights: Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyDomain right, which allows setting all attributes on domain, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. Notes on zimbraDomainDefaultCOSId: If setting zimbraDomainDefaultCOSId, needs the assignCos right on the cos. ------------------------------ ModifyServerRequest Related rights: Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyServer right, which allows setting all attributes on server, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ ModifySystemRetentionPolicyRequest Related rights: Notes: Need set attr right on attribute zimbraMailPurgeSystemPolicy ------------------------------ ModifyUCServiceRequest Related rights: Notes: All attrs provided in the attribute list have to be settable by the authed admin. You can grant the modifyUCService right, which allows setting all attributes on ucservice, or grant the set attrs right just for the attributes the admin needs to set while creating an entry. ------------------------------ ModifyVolumeRequest Related rights: manageVolume Notes: ------------------------------ ModifyZimletRequest Related rights: manageZimlet modifyZimlet Notes: For acl: needs manageZimlet on cos. For status: needs right to set zimbraZimletEnabled on the zimlet For priority: needs right to set zimbraZimletPriority on *all* zimlets, because potentially the attribute can be modified on all zimlets. ------------------------------ NoOpRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ PingRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ PurgeAccountCalendarCacheRequest Related rights: Notes: Only system admins are allowed. ------------------------------ PurgeFreeBusyQueueRequest Related rights: Notes: Only system admins are allowed. ------------------------------ PurgeMessagesRequest Related rights: purgeMessages Notes: If account ids are specified, needs effective purgeMessages right for each account. If account ids are not specified, the authed account has to be a system admin. ------------------------------ PushFreeBusyRequest Related rights: adminLoginAs adminLoginCalendarResourceAs Notes: If the target is an account, need the adminLoginAs right; If the target is a calendar resource, need the R_adminLoginCalendarResourceAs right. ------------------------------ QueryWaitSetRequest Related rights: Notes: Only system admins are allowed. ------------------------------ ReIndexRequest Related rights: reindexMailbox reindexCalendarResourceMailbox Notes: ------------------------------ RecalculateMailboxCountsRequest Related rights: adminLoginAs adminLoginCalendarResourceAs Notes: If the target is an account, need the adminLoginAs right; If the target is a calendar resource, need the R_adminLoginCalendarResourceAs right. ------------------------------ RefreshRegisteredAuthTokensRequest Related rights: Notes: Only system admins are allowed. ------------------------------ ReloadLocalConfigRequest Related rights: Notes: TDB ------------------------------ ReloadMemcachedClientConfigRequest Related rights: Notes: TDB ------------------------------ RemoveAccountAliasRequest Related rights: removeAccountAlias removeCalendarResourceAlias deleteAlias Notes: ------------------------------ RemoveAccountLoggerRequest Related rights: manageAccountLogger Notes: ------------------------------ RemoveDistributionListAliasRequest Related rights: removeDistributionListAlias removeGroupAlias deleteAlias Notes: ------------------------------ RemoveDistributionListMemberRequest Related rights: removeDistributionListMember removeGroupMember Notes: ------------------------------ RenameAccountRequest Related rights: renameAccount createAccount Notes: ------------------------------ RenameCalendarResourceRequest Related rights: renameCalendarResource createCalendarResource Notes: ------------------------------ RenameCosRequest Related rights: renameCos Notes: ------------------------------ RenameDistributionListRequest Related rights: renameDistributionList createDistributionList Notes: ------------------------------ RenameUCServiceRequest Related rights: renameUCService Notes: ------------------------------ ResetAllLoggersRequest Related rights: Notes: TDB ------------------------------ RevokeRightRequest Related rights: Notes: Grantor must have the same or more rights on the same target or on a larger target set. ------------------------------ RunUnitTestsRequest Related rights: Notes: Do not need any right, all admins are allowed. ------------------------------ SearchAccountsRequest Related rights: getAccount getCalendarResource getDistributionList getDomain listAccount listCalendarResource listDistributionList listDomain Notes: If the authenticated admin does not have the corresponding list{Entry} right for an entry, the entry is skipped in the getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception will be thrown. Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>. ------------------------------ SearchAutoProvDirectoryRequest Related rights: autoProvisionAccount Notes: ------------------------------ SearchCalendarResourcesRequest Related rights: getCalendarResource listCalendarResource Notes: If the authenticated admin does not have the corresponding list{Entry} right for an entry, the entry is skipped in the getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception will be thrown. Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>. ------------------------------ SearchDirectoryRequest Related rights: getAccount getCalendarResource getDistributionList getDomain getCos listAccount listCalendarResource listDistributionList listDomain listCos Notes: If the authenticated admin does not have the corresponding list{Entry} right for an entry, the entry is skipped in the getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception will be thrown. Attributes that are not allowed to be get by the authenticated admin will be returned as <a n="{attr-name}" pd="1"/>. ------------------------------ SearchGalRequest Related rights: accessGAL Notes: ------------------------------ SetCurrentVolumeRequest Related rights: manageVolume Notes: ------------------------------ SetLocalServerOnlineRequest Related rights: Notes: Only system admins are allowed. ------------------------------ SetPasswordRequest Related rights: setAccountPassword changeAccountPassword setCalendarResourcePassword changeCalendarResourcePassword Notes: ------------------------------ SetServerOfflineRequest Related rights: Notes: Only system admins are allowed. ------------------------------ SyncGalAccountRequest Related rights: Notes: TDB ------------------------------ UndeployZimletRequest Related rights: deployZimlet Notes: Need the deployZimlet right on all servers. ------------------------------ VerifyIndexRequest Related rights: reindexMailbox reindexCalendarResourceMailbox Notes: ------------------------------ VerifyStoreManagerRequest Related rights: Notes: TDB