NerdGraph tutorial: Create custom role for Scorecards

preview

We're still working on this feature, but we'd love for you to try it out!

This feature is currently provided as part of a preview program pursuant to our pre-release policies.

A Scorecard serves as a container for various rules that collectively assess adherence to defined standards. Scorecards use rules to monitor compliance across different entities and teams, identify areas for improvement, and ensure alignment with both internal and external requirements. This document provides instruction on how to create and manage Scorecards and its rules in New Relic.

In New Relic, two types of users can manage Scorecards:

Organization Admin
Scorecard custom role users

This section provides instructions on using NerdGraph GraphQL mutations to create a custom role for managing Scorecards and associated rules.

To create a Scorecards administrator custom role, you need to:

Retrieve all the organization-scoped capabilities
Retrieve your organization ID
Find the required permission IDs for Scorecards
Create the custom role for Scorecards administrator
Add the custom role to a user group

Prerequisites:

General NerdGraph requirements
You must be an Organization Admin to create a custom role.

Mutations

New Relic provides various NerdGraph mutations to create custom role for Scorecards managers.

Use the customerAdministration mutation to retrieve a list of capabilities, their permission ID’s, and related information.

Input parameters

Parameter	Data Type	Is it Required?	Description
`eq`	String	Yes	Set the value to `organization` to retrieve role for Scorecards.

Sample request

{
  customerAdministration {
    permissions(filter: { scope: { eq: "organization" } }) {
      items {
        feature
        category
        id
        product
      }
    }
  }
}

Sample response

{
  "data": {
    "customerAdministration": {
      "permissions": {
        "items": [
          {
            "category": "READ",
            "feature": "Scorecards Rules",
            "id": "xxxxx",
            "product": "New Relic One"
          },
          {
            "category": "MANAGE",
            "feature": "Scorecards Rules",
            "id": "xxxxx",
            "product": "New Relic One"
          },
          {
            "category": "READ",
            "feature": "Scorecards",
            "id": "xxxxx",
            "product": "New Relic One"
          },
          {
            "category": "MANAGE",
            "feature": "Scorecards",
            "id": "xxxxx",
            "product": "New Relic One"
          },
          {
            "category": "READ",
            "feature": "Teams",
            "id": "xxxxx",
            "product": "New Relic One"
          },
          {
            "category": "OTHER",
            "feature": "Teams",
            "id": "xxxxxx",
            "product": "New Relic One"
          },
          {
            "category": "DELETE",
            "feature": "Teams",
            "id": "xxxxx",
            "product": "New Relic One"
          },
          {
            "category": "MODIFY",
            "feature": "Teams",
            "id": "xxxxxx",
            "product": "New Relic One"
          }
        ]
      }
    }
  }
}

Copy and paste the information related to Scorecards in a text file matching the following criteria:

category: MANAGE
"feature"``: "Scorecards" or “Scorecards Rules”

For example, in the previous response, the following matches the criteria:

{
        "category": "MANAGE",
        "feature": "Scorecards Rules",
        "id": "xxxxx",
        "product": "New Relic One"
      },
{
        "category": "MANAGE",
        "feature": "Scorecards",
        "id": "xxxxx",
        "product": "New Relic One"
      }

Fetch your organization ID to use in various mutations further.

Sample request

{
  actor {
    organization {
      id
    }
  }
}

Sample response

{
  "data": {
    "actor": {
      "organization": {
        "id": "xxx****xxx-xx**00**-xxx-x*x*-xx**XXX**XX"
      }
    }
  }
}

Copy the organization ID and keep it aside to create a role.

Run the customRoleCreate mutation to create your own custom role.

Input parameters

Parameter	Data Type	Is it Required?	Description
`id`	String	Yes	The organization ID copied in the previous step.
`type`	String	Yes	Set the type to `organization`.
`name`	String	Yes	The name of the role.
`PermissionId`	Int	Yes	List the ID's for the feature retrieved using `customerAdministration` mutations for Scorecards and Scorecards rules.
`scope`	String	Yes	Set the scope to `organization`.

Sample request

mutation {
  customRoleCreate(
    container: {
      id: "xxx****xxx-xx**00**-xxx-x*x*-xx**XXX**XX"
      type: "organization"
    }
    name: "Scorecards manager"
    permissionIds: [xxxxx, xxxxx]
    scope: "organization"
  ) {
    id
  }
}

Sample response

{
  "data": {
    "customRoleCreate": {
      "id": 9999999
    }
  }
}

Parameter	Data Type	Description
`id`	Int	The custom role ID. Copy and keep this ID for future use.

After you have created the custom role, you must associate this role with a user group on the New Relic platform.

Fetch the group ID

You can use customerAdministration mutation to retrieve the list of group ID's.

Input parameters

Parameter	Data Type	Is it Required?	Description
`id`	String	Yes	The organization ID copied in the previous step.

Sample request

{
  customerAdministration {
    groups(
      filter: {
        organizationId: { eq: "xxx****xxx-xx**00**-xxx-x*x*-xx**XXX**XX" }
      }
    ) {
      nextCursor
      items {
        id
        name
        users {
          items {
            id
            email
          }
        }
      }
    }
  }
}

From the displayed list of group IDs, copy the desired group ID to associate the custom Scorecard role you created earlier.

Add the rule to a user group

You can use authorizationManagementGrantAccess mutation to add the role to a user group.

Input parameters

Parameter	Data Type	Is it Required?	Description
`roleId`	String	Yes	The custom role ID created in the Custom role section.
`groupId`	String	No	The group ID retrieved in the previous step.

Sample request

mutation {
  authorizationManagementGrantAccess(
    grantAccessOptions: {
      organizationAccessGrants: { roleId: "99999999" }
      groupId: "xxx****xxx-xx**00**-xxx-x*x*-xx**XXX**XX"
    }
  ) {
    roles {
      id
      name
      organizationId
      roleId
      groupId
      displayName
    }
  }
}

Sample response

{
  "data": {
    "authorizationManagementGrantAccess": {
      "roles": [
        {
          "displayName": "Scorecards manager",
          "groupId": null,
          "id": "99999999",
          "name": "scorecards_manager",
          "organizationId": "xxx****xxx-xx**00**-xxx-x*x*-xx**XXX**XX",
          "roleId": 99999
        }
      ]
    }
  }
}

Check the new role in New Relic platform

You can validate if the scorecard role is reflecting in the New Relic platform.

To check the role:

Log in to your new relic account.
Click on your name at the bottom left.
Go to Administration > Access Management.
Click the Grants tab: You can see the custom role you created in the list of roles:

NerdGraph tutorial: Create custom role for Scorecards

preview

Mutations

Retrieve organization-scoped capabilities

Input parameters

Sample request

Sample response

Retrieve your organization ID

Sample request

Sample response

Create custom role

Input parameters

Sample request

Sample response

Add custom role to a user group

Fetch the group ID

Input parameters

Sample request

Add the rule to a user group

Input parameters

Sample request

Sample response

Check the new role in New Relic platform