NerdGraph tutorial: Create custom role for Scorecards

preview

We're still working on this feature, but we'd love for you to try it out!

This feature is currently provided as part of a preview program pursuant to our pre-release policies.

A Scorecard serves as a container for various rules that collectively assess adherence to defined standards. Scorecards use rules to monitor compliance across different entities and teams, identify areas for improvement, and ensure alignment with both internal and external requirements. This document provides instruction on how to create and manage Scorecards and its rules in New Relic.

In New Relic, two types of users can manage Scorecards:

Organization Product Admin
Scorecard custom role users

This section provides instructions on using NerdGraph GraphQL mutations to create a custom role for managing Scorecards and associated rules.

To create a Scorecards administrator custom role, you need to:

Find the required permission IDs for Scorecards
Retrieve your organization ID
Create the custom role for Scorecards administrator
Add the custom role to a user group

Prerequisites:

General NerdGraph requirements
You must be an Organization Product Admin to create a custom role.

Mutations

New Relic provides various NerdGraph mutations to create custom role for Scorecards managers.

Use the customerAdministration query to retrieve a list of capabilities, their permission IDs, and related information.

Input parameters

Parameter	Data Type	Is it Required?	Description
`eq`	String	Yes	Set the value to `organization` to retrieve permissions for Scorecards.

Sample request

{
  customerAdministration {
    permissions(filter: { scope: { eq: "organization" } }) {
      items {
        feature
        category
        id
        product
      }
    }
  }
}

Sample response

{
  "data": {
    "customerAdministration": {
      "permissions": {
        "items": [
          {
            "category": "READ",
            "feature": "Scorecards Rules",
            "id": "xxxxx",
            "product": "New Relic One"
          },
          {
            "category": "MANAGE",
            "feature": "Scorecards Rules",
            "id": "xxxxx",
            "product": "New Relic One"
          },
          {
            "category": "READ",
            "feature": "Scorecards",
            "id": "xxxxx",
            "product": "New Relic One"
          },
          {
            "category": "MANAGE",
            "feature": "Scorecards",
            "id": "xxxxx",
            "product": "New Relic One"
          },
          {
            "category": "READ",
            "feature": "Teams",
            "id": "xxxxx",
            "product": "New Relic One"
          },
          {
            "category": "OTHER",
            "feature": "Teams",
            "id": "xxxxxx",
            "product": "New Relic One"
          },
          {
            "category": "DELETE",
            "feature": "Teams",
            "id": "xxxxx",
            "product": "New Relic One"
          },
          {
            "category": "MODIFY",
            "feature": "Teams",
            "id": "xxxxxx",
            "product": "New Relic One"
          }
        ]
      }
    }
  }
}

Copy and paste the information related to Scorecards in a text file matching the following criteria:

category: MANAGE
"feature"``: "Scorecards" or "Scorecards Rules"

For example, in the previous response, the following matches the criteria:

({
  "category": "MANAGE",
  "feature": "Scorecards Rules",
  "id": "xxxxx",
  "product": "New Relic One"
},
{
  "category": "MANAGE",
  "feature": "Scorecards",
  "id": "xxxxx",
  "product": "New Relic One"
})

Fetch your organization ID to use in various mutations further.

Sample request

{
  actor {
    organization {
      id
    }
  }
}

Sample response

{
  "data": {
    "actor": {
      "organization": {
        "id": "xxx****xxx-xx**00**-xxx-x*x*-xx**XXX**XX"
      }
    }
  }
}

Copy the organization ID and keep it aside to create a role.

Run the customRoleCreate mutation to create your own custom role.

Input parameters

Parameter	Data Type	Is it Required?	Description
`id`	String	Yes	The organization ID copied in the previous step.
`type`	String	Yes	Set the type to `organization`.
`name`	String	Yes	The name of the role.
`permissionIds`	[Int]	Yes	List the IDs for the feature identified using `customerAdministration` query for Scorecards and Scorecards rules.
`scope`	String	Yes	Set the scope to `organization`.

Sample request

mutation {
  customRoleCreate(
    container: {
      id: "xxx****xxx-xx**00**-xxx-x*x*-xx**XXX**XX"
      type: "organization"
    }
    name: "Scorecards manager"
    permissionIds: [xxxxx, xxxxx]
    scope: "organization"
  ) {
    id
  }
}

Sample response

{
  "data": {
    "customRoleCreate": {
      "id": 9999999
    }
  }
}

Parameter	Data Type	Description
`id`	Int	The custom role ID. Copy and keep this ID for future use.

After you have created the custom role, you must associate this role with a user group on the New Relic platform.

Fetch the group ID

You can use customerAdministration query to retrieve the list of group IDs.

Input parameters

Parameter	Data Type	Is it Required?	Description
`id`	String	Yes	The organization ID copied in the previous step.

Sample request

{
  customerAdministration {
    groups(
      filter: {
        organizationId: { eq: "xxx****xxx-xx**00**-xxx-x*x*-xx**XXX**XX" }
      }
    ) {
      nextCursor
      items {
        id
        name
        users {
          items {
            id
            email
          }
        }
      }
    }
  }
}

From the displayed list of group IDs, copy the desired group ID to associate the custom Scorecard role you created earlier.

Add the rule to a user group

You can use authorizationManagementGrantAccess mutation to add the role to a user group.

Input parameters

Parameter	Data Type	Is it Required?	Description
`roleId`	String	Yes	The custom role ID created in the Custom role section.
`groupId`	String	No	The group ID retrieved in the previous step.

Sample request

mutation {
  authorizationManagementGrantAccess(
    grantAccessOptions: {
      organizationAccessGrants: { roleId: "99999999" }
      groupId: "xxx****xxx-xx**00**-xxx-x*x*-xx**XXX**XX"
    }
  ) {
    roles {
      id
      name
      organizationId
      roleId
      groupId
      displayName
    }
  }
}

Sample response

{
  "data": {
    "authorizationManagementGrantAccess": {
      "roles": [
        {
          "displayName": "Scorecards manager",
          "groupId": null,
          "id": "99999999",
          "name": "scorecards_manager",
          "organizationId": "xxx****xxx-xx**00**-xxx-x*x*-xx**XXX**XX",
          "roleId": 99999
        }
      ]
    }
  }
}

Check the new role in New Relic platform

You can validate if the scorecard role is reflecting in the New Relic platform.

To check the role:

Log in to your new relic account.
Click on your name at the bottom left.
Go to Administration > Access Management.
Click the Grants tab: You can see the custom role you created in the list of roles:

NerdGraph tutorial: Create custom role for Scorecards

preview

Mutations .css-21sua1{background:none;border:none;width:0;padding:0;}

Retrieve your organization ID

Create custom role

Add custom role to a user group

Check the new role in New Relic platform

Mutations