Information to save resource permission
(Optional) The check-in time limit in seconds. Default is 60.
(Optional) The check-out time limit in seconds. Default is 60.
Variables declared by this permission, as a plain array of strings — fully backward compatible with the historical shape (e.g. ["host","user"]). A bare entry ("host") is a String variable; the single dynamic-password variable is marked with a :password suffix ("newpwd:password"). Since ':' is not allowed in a variable name the split is unambiguous; at most one entry may carry :password (otherwise 400 RM-0021), and any other entry is treated as String. The dynamic-password flow is configured on the profile-permission binding (VariableValues): an optional regexPattern, generated server-side when isSystemDefined=true or supplied at checkout via Settings.checkoutVariableValues when promptAtCheckout=true.
Default bindings for declared variables (system defined or prompt at checkout); set on update only.
Variable binding on a profile-permission. Three mutually exclusive runtime resolution states encoded by (isSystemDefined, promptAtCheckout): Static (both false; value is literal); System-defined (isSystemDefined=true; server resolves at runtime); Prompt-at-checkout (promptAtCheckout=true; end user supplies at checkout via Settings.checkoutVariableValues). isSystemDefined=true AND promptAtCheckout=true is rejected (RM-0027). Sending a non-blank value in a state that resolves it at checkout is rejected (RM-0031) — see the value property.
Populated in the Static state, and in the System-defined state for type=String (the system template). Null for Prompt-at-checkout and for a System-defined type=password, both of which resolve the value at checkout. Sending a non-blank value in either of those two resolved states is rejected at attach and update (400 RM-0031) rather than silently dropped, so declarative clients do not see a permanent diff on the field. A blank value is accepted and normalized to null.
marks the System-defined state - value is server-generated for type=password (RM-0031), otherwise it must be a system defined value (RM-0037)
Marks the Prompt-at-checkout state. Applies to any type, including String. The end user supplies the value at checkout, so a non-blank value on the binding is rejected (RM-0031). Mutually exclusive with isSystemDefined. Legacy records (no flag) are interpreted as promptAtCheckout=true iff type=password AND isSystemDefined=false.
Java-compatible regular expression constraining this variable's value (syntax-checked at attach time; 400 RM-0023 when invalid). For type=password: required in every state (RM-0022) — governs server-side generation (System-defined) and validation of user-supplied values (Prompt-at-checkout); a password must be system-defined or prompt-at-checkout (static rejected, RM-0028). For type=String: optional, and only valid with promptAtCheckout=true -- sending it in the system-defined or static state is rejected (400 RM-0032) rather than silently dropped, so declarative clients do not see a permanent diff on the field.
Optional human-readable explanation of regexPattern, shown to the end user at checkout so they understand what a valid value looks like. Valid only alongside a regexPattern (any type); sending it without one is rejected (400 RM-0033), keeping the two in lockstep.
Resource type saved successfully
(Optional) The check-in time limit in seconds. Default is 60.
(Optional) The check-out time limit in seconds. Default is 60.
Variables declared by this permission, as a plain array of strings — fully backward compatible with the historical shape (e.g. ["host","user"]). A bare entry ("host") is a String variable; the single dynamic-password variable is marked with a :password suffix ("newpwd:password"). Since ':' is not allowed in a variable name the split is unambiguous; at most one entry may carry :password (otherwise 400 RM-0021), and any other entry is treated as String. The dynamic-password flow is configured on the profile-permission binding (VariableValues): an optional regexPattern, generated server-side when isSystemDefined=true or supplied at checkout via Settings.checkoutVariableValues when promptAtCheckout=true.
Default bindings for declared variables (system defined or prompt at checkout); set on update only.
Variable binding on a profile-permission. Three mutually exclusive runtime resolution states encoded by (isSystemDefined, promptAtCheckout): Static (both false; value is literal); System-defined (isSystemDefined=true; server resolves at runtime); Prompt-at-checkout (promptAtCheckout=true; end user supplies at checkout via Settings.checkoutVariableValues). isSystemDefined=true AND promptAtCheckout=true is rejected (RM-0027). Sending a non-blank value in a state that resolves it at checkout is rejected (RM-0031) — see the value property.
Populated in the Static state, and in the System-defined state for type=String (the system template). Null for Prompt-at-checkout and for a System-defined type=password, both of which resolve the value at checkout. Sending a non-blank value in either of those two resolved states is rejected at attach and update (400 RM-0031) rather than silently dropped, so declarative clients do not see a permanent diff on the field. A blank value is accepted and normalized to null.
marks the System-defined state - value is server-generated for type=password (RM-0031), otherwise it must be a system defined value (RM-0037)
Marks the Prompt-at-checkout state. Applies to any type, including String. The end user supplies the value at checkout, so a non-blank value on the binding is rejected (RM-0031). Mutually exclusive with isSystemDefined. Legacy records (no flag) are interpreted as promptAtCheckout=true iff type=password AND isSystemDefined=false.
Variable type, server-derived (read-only). Set at attach time from the permission's variable token — password when the permission declares the variable as name:password, otherwise String. Any value sent by the client is ignored and overwritten.
Java-compatible regular expression constraining this variable's value (syntax-checked at attach time; 400 RM-0023 when invalid). For type=password: required in every state (RM-0022) — governs server-side generation (System-defined) and validation of user-supplied values (Prompt-at-checkout); a password must be system-defined or prompt-at-checkout (static rejected, RM-0028). For type=String: optional, and only valid with promptAtCheckout=true -- sending it in the system-defined or static state is rejected (400 RM-0032) rather than silently dropped, so declarative clients do not see a permanent diff on the field.
Optional human-readable explanation of regexPattern, shown to the end user at checkout so they understand what a valid value looks like. Valid only alongside a regexPattern (any type); sending it without one is rejected (400 RM-0033), keeping the two in lockstep.