Support
SupportService manages support cases and role-based access control. Access is granted when all three conditions hold: - case.status == “open” - tier ∈ case.allowedTiers - now < case.activeUntil
Base path: /support
POST /support/OpenSupportCase
Section titled “POST /support/OpenSupportCase”OpenSupportCase opens a new support case with optional tier grants. The returned caseId serves as both the external ID for trust policy and the primary case identifier. Opening a case with an empty allowedTiers grants no access until tiers are set via SetSupportCaseTiers.
Request (OpenSupportCaseRequest)
| Field | Type | Description |
|---|---|---|
subject | string | |
description | string? | |
allowed_tiers | RoleTier[] | |
activation_seconds | int64? |
Response (OpenSupportCaseResponse)
| Field | Type | Description |
|---|---|---|
case_id | string |
POST /support/CloseSupportCase
Section titled “POST /support/CloseSupportCase”CloseSupportCase closes an open support case, revoking access immediately. Closing an already-closed case is a no-op. Case history and audit trail are retained.
Request (CloseSupportCaseRequest)
| Field | Type | Description |
|---|---|---|
case_id | string |
Response (CloseSupportCaseResponse)
No fields.
POST /support/ListSupportCases
Section titled “POST /support/ListSupportCases”ListSupportCases lists all support cases for the tenant. Note: status values are “open” or “closed”; access is determined by the three-condition predicate, not by a computed field. Use activeUntil to distinguish active from inactive (lapsed) cases.
Request (ListSupportCasesRequest)
No fields.
Response (ListSupportCasesResponse)
| Field | Type | Description |
|---|---|---|
cases | SupportCase[] |
POST /support/SetSupportCaseTiers
Section titled “POST /support/SetSupportCaseTiers”SetSupportCaseTiers sets the allowed tiers for a support case. The tier list may be empty, which revokes access without closing the case. Pointer rows are diffed: tiers added get pointer rows written, tiers removed get them deleted. Returns the updated case.
Request (SetSupportCaseTiersRequest)
| Field | Type | Description |
|---|---|---|
case_id | string | |
allowed_tiers | RoleTier[] | |
activation_seconds | int64? |
Response (SetSupportCaseTiersResponse)
| Field | Type | Description |
|---|---|---|
case | SupportCase |
POST /support/SetSupportCaseActiveUntil
Section titled “POST /support/SetSupportCaseActiveUntil”SetSupportCaseActiveUntil sets the activation window for a support case. This RPC handles both extension (setting a future time) and immediate deactivation (setting now). Deactivation does not close the case; reactivation restores the same caseId, externalId, and tier set. The window is capped at 7 days; attempts to exceed it are rejected server-side.
Request (SetSupportCaseActiveUntilRequest)
| Field | Type | Description |
|---|---|---|
case_id | string | |
active_until | Timestamp |
Response (SetSupportCaseActiveUntilResponse)
| Field | Type | Description |
|---|---|---|
case | SupportCase |
POST /support/ListSupportRoleAssumptions
Section titled “POST /support/ListSupportRoleAssumptions”ListSupportRoleAssumptions lists CloudTrail AssumeRole events recorded for a support case, combining archived (DynamoDB) and live (CloudTrail Event history) results, deduplicated by eventId.
Request (ListSupportRoleAssumptionsRequest)
| Field | Type | Description |
|---|---|---|
case_id | string |
Response (ListSupportRoleAssumptionsResponse)
| Field | Type | Description |
|---|---|---|
assumptions | SupportRoleAssumption[] | |
live_lookup_complete | bool | live_lookup_complete is false when the live CloudTrail half failed or is not yet authoritative. CloudTrail events take ~15 minutes to appear, so the UI must be able to say “may not have propagated yet” instead of presenting an ambiguous empty list. |