> ## Documentation Index > Fetch the complete documentation index at: https://docs.domino.ai/llms.txt > Use this file to discover all available pages before exploring further. # Creates or updates custom MatchableAttributesConfiguration at the project level > Update the customized resource attributes associated with a project ## OpenAPI ````yaml /api-specs/cloud/flyte-native-api.json put /api/v1/project_attributes/{attributes.project} openapi: 3.0.3 info: description: >- Reference for the upstream Flyte control plane API, which backs Domino Flows. title: Flyte native API version: version not set servers: - description: >- Replace 'mycluster.domino.tech' with your Domino cluster hostname. For Domino Cloud customers, that is `your-subdomain`.domino.tech (e.g., acme.domino.tech). For self-hosted deployments, it is the hostname you reach the Domino UI at. url: https://mycluster.domino.tech/flows security: [] tags: - name: Children - name: Data - name: Description entities - name: Domains - name: Events - name: Executions - name: Launch plans - name: Matchable attributes - name: Metrics - name: Named entities - name: Node executions - name: Project attributes - name: Project domain attributes - name: Projects - name: Task executions - name: Tasks - name: Version - name: Workflow attributes - name: Workflows paths: /api/v1/project_attributes/{attributes.project}: put: tags: - Project attributes summary: >- Creates or updates custom MatchableAttributesConfiguration at the project level description: Update the customized resource attributes associated with a project operationId: AdminService_UpdateProjectAttributes parameters: - description: Unique project id for which this set of attributes will be applied. in: path name: attributes.project required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/AdminServiceUpdateProjectAttributesBody' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/adminProjectAttributesUpdateResponse' description: A successful response. default: content: application/json: schema: $ref: '#/components/schemas/googlerpcStatus' description: An unexpected error response. components: schemas: AdminServiceUpdateProjectAttributesBody: properties: attributes: properties: matching_attributes: $ref: '#/components/schemas/adminMatchingAttributes' org: description: Optional, org key applied to the project. type: string title: +required type: object title: >- Sets custom attributes for a project For more info on matchable attributes, see MatchableAttributesConfiguration type: object adminProjectAttributesUpdateResponse: description: Purposefully empty, may be populated in the future. type: object googlerpcStatus: properties: code: format: int32 type: integer details: items: $ref: '#/components/schemas/protobufAny' type: array message: type: string type: object adminMatchingAttributes: description: >- Generic container for encapsulating all types of the above attributes messages. properties: cluster_assignment: $ref: '#/components/schemas/adminClusterAssignment' cluster_resource_attributes: $ref: '#/components/schemas/adminClusterResourceAttributes' execution_cluster_label: $ref: '#/components/schemas/adminExecutionClusterLabel' execution_queue_attributes: $ref: '#/components/schemas/adminExecutionQueueAttributes' plugin_overrides: $ref: '#/components/schemas/adminPluginOverrides' quality_of_service: $ref: '#/components/schemas/coreQualityOfService' task_resource_attributes: $ref: '#/components/schemas/adminTaskResourceAttributes' workflow_execution_config: $ref: '#/components/schemas/adminWorkflowExecutionConfig' type: object protobufAny: additionalProperties: {} description: >- `Any` contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message. Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type. Example 1: Pack and unpack a message in C++. Foo foo = ...; Any any; any.PackFrom(foo); ... if (any.UnpackTo(&foo)) { ... } Example 2: Pack and unpack a message in Java. Foo foo = ...; Any any = Any.pack(foo); ... if (any.is(Foo.class)) { foo = any.unpack(Foo.class); } // or ... if (any.isSameTypeAs(Foo.getDefaultInstance())) { foo = any.unpack(Foo.getDefaultInstance()); } Example 3: Pack and unpack a message in Python. foo = Foo(...) any = Any() any.Pack(foo) ... if any.Is(Foo.DESCRIPTOR): any.Unpack(foo) ... Example 4: Pack and unpack a message in Go foo := &pb.Foo{...} any, err := anypb.New(foo) if err != nil { ... } ... foo := &pb.Foo{} if err := any.UnmarshalTo(foo); err != nil { ... } The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z". JSON ==== The JSON representation of an `Any` value uses the regular representation of the deserialized, embedded message, with an additional field `@type` which contains the type URL. Example: package google.profile; message Person { string first_name = 1; string last_name = 2; } { "@type": "type.googleapis.com/google.profile.Person", "firstName": , "lastName": } If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field `value` which holds the custom JSON in addition to the `@type` field. Example (for message [google.protobuf.Duration][]): { "@type": "type.googleapis.com/google.protobuf.Duration", "value": "1.212s" } properties: '@type': description: >- A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one "/" character. The last segment of the URL's path must represent the fully qualified name of the type (as in `path/google.protobuf.Duration`). The name should be in a canonical form (e.g., leading "." is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme `http`, `https`, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, `https` is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than `http`, `https` (or the empty scheme) might be used with implementation specific semantics. type: string type: object adminClusterAssignment: description: >- Encapsulates specifications for routing an execution onto a specific cluster. properties: cluster_pool_name: type: string type: object adminClusterResourceAttributes: properties: attributes: additionalProperties: type: string description: >- Custom resource attributes which will be applied in cluster resource creation (e.g. quotas). Map keys are the *case-sensitive* names of variables in templatized resource files. Map values should be the custom values which get substituted during resource creation. type: object type: object adminExecutionClusterLabel: properties: value: title: Label value to determine where the execution will be run type: string type: object adminExecutionQueueAttributes: properties: tags: description: >- Tags used for assigning execution queues for tasks defined within this project. items: type: string type: array type: object adminPluginOverrides: properties: overrides: items: $ref: '#/components/schemas/adminPluginOverride' type: array type: object coreQualityOfService: description: Indicates the priority of an execution. properties: spec: $ref: '#/components/schemas/coreQualityOfServiceSpec' tier: $ref: '#/components/schemas/QualityOfServiceTier' type: object adminTaskResourceAttributes: description: >- Defines task resource defaults and limits that will be applied at task registration. properties: defaults: $ref: '#/components/schemas/adminTaskResourceSpec' limits: $ref: '#/components/schemas/adminTaskResourceSpec' type: object adminWorkflowExecutionConfig: description: >- Adds defaults for customizable workflow-execution specifications and overrides. properties: annotations: $ref: '#/components/schemas/adminAnnotations' envs: $ref: '#/components/schemas/adminEnvs' execution_env_assignments: description: Execution environment assignments to be set for the execution. items: $ref: '#/components/schemas/coreExecutionEnvAssignment' type: array interruptible: description: >- Allows for the interruptible flag of a workflow to be overwritten for a single execution. Omitting this field uses the workflow's value as a default. As we need to distinguish between the field not being provided and its default value false, we have to use a wrapper around the bool field. type: boolean labels: $ref: '#/components/schemas/adminLabels' max_parallelism: description: >- Can be used to control the number of parallel nodes to run within the workflow. This is useful to achieve fairness. format: int32 type: integer overwrite_cache: description: >- Allows for all cached values of a workflow and its tasks to be overwritten for a single execution. If enabled, all calculations are performed even if cached results would be available, overwriting the stored data once execution finishes successfully. type: boolean raw_output_data_config: $ref: '#/components/schemas/adminRawOutputDataConfig' security_context: $ref: '#/components/schemas/coreSecurityContext' type: object adminPluginOverride: description: >- This MatchableAttribute configures selecting alternate plugin implementations for a given task type. In addition to an override implementation a selection of fallbacks can be provided or other modes for handling cases where the desired plugin override is not enabled in a given Flyte deployment. properties: missing_plugin_behavior: $ref: '#/components/schemas/PluginOverrideMissingPluginBehavior' plugin_id: description: >- A set of plugin ids which should handle tasks of this type instead of the default registered plugin. The list will be tried in order until a plugin is found with that id. items: type: string type: array task_type: description: A predefined yet extensible Task type identifier. type: string type: object coreQualityOfServiceSpec: description: Represents customized execution run-time attributes. properties: queueing_budget: description: Indicates how much queueing delay an execution can tolerate. type: string type: object QualityOfServiceTier: default: UNDEFINED description: ' - UNDEFINED: Default: no quality of service specified.' enum: - UNDEFINED - HIGH - MEDIUM - LOW type: string adminTaskResourceSpec: description: >- Defines a set of overridable task resource attributes set during task registration. properties: cpu: type: string ephemeral_storage: type: string gpu: type: string memory: type: string storage: type: string type: object adminAnnotations: description: >- Annotation values to be applied to an execution resource. In the future a mode (e.g. OVERRIDE, APPEND, etc) can be defined to specify how to merge annotations defined at registration and execution time. properties: values: additionalProperties: type: string description: Map of custom annotations to be applied to the execution resource. type: object type: object adminEnvs: description: >- Environment variable values to be applied to an execution resource. In the future a mode (e.g. OVERRIDE, APPEND, etc) can be defined to specify how to merge environment variables defined at registration and execution time. properties: values: description: >- Map of custom environment variables to be applied to the execution resource. items: $ref: '#/components/schemas/flyteidlcoreKeyValuePair' type: array type: object coreExecutionEnvAssignment: description: >- ExecutionEnvAssignment is a message that is used to assign an execution environment to a set of nodes. properties: execution_env: $ref: '#/components/schemas/coreExecutionEnv' node_ids: description: >- node_ids is a list of node ids that are being assigned the execution environment. items: type: string type: array task_type: description: >- task_type is the type of task that is being assigned. This is used to override which Flyte plugin will be used during execution. type: string type: object adminLabels: description: >- Label values to be applied to an execution resource. In the future a mode (e.g. OVERRIDE, APPEND, etc) can be defined to specify how to merge labels defined at registration and execution time. properties: values: additionalProperties: type: string description: Map of custom labels to be applied to the execution resource. type: object type: object adminRawOutputDataConfig: description: >- Encapsulates user settings pertaining to offloaded data (i.e. Blobs, Schema, query data, etc.). See https://github.com/flyteorg/flyte/issues/211 for more background information. properties: output_location_prefix: title: |- Prefix for where offloaded data from user workflows will be written e.g. s3://bucket/key or s3://bucket/ type: string type: object coreSecurityContext: description: SecurityContext holds security attributes that apply to tasks. properties: run_as: $ref: '#/components/schemas/coreIdentity' secrets: description: >- secrets indicate the list of secrets the task needs in order to proceed. Secrets will be mounted/passed to the pod as it starts. If the plugin responsible for kicking of the task will not run it on a flyte cluster (e.g. AWS Batch), it's the responsibility of the plugin to fetch the secret (which means propeller identity will need access to the secret) and to pass it to the remote execution engine. items: $ref: '#/components/schemas/coreSecret' type: array tokens: description: >- tokens indicate the list of token requests the task needs in order to proceed. Tokens will be mounted/passed to the pod as it starts. If the plugin responsible for kicking of the task will not run it on a flyte cluster (e.g. AWS Batch), it's the responsibility of the plugin to fetch the secret (which means propeller identity will need access to the secret) and to pass it to the remote execution engine. items: $ref: '#/components/schemas/coreOAuth2TokenRequest' type: array type: object PluginOverrideMissingPluginBehavior: default: FAIL description: |2- - FAIL: By default, if this plugin is not enabled for a Flyte deployment then execution will fail. - USE_DEFAULT: Uses the system-configured default implementation. enum: - FAIL - USE_DEFAULT type: string flyteidlcoreKeyValuePair: description: A generic key value pair. properties: key: description: required. type: string value: description: +optional. type: string type: object coreExecutionEnv: description: >- ExecutionEnv is a message that is used to specify the execution environment. properties: extant: description: extant is a reference to an existing environment. type: object name: description: >- name is a human-readable identifier for the execution environment. This is combined with the project, domain, and version to uniquely identify an execution environment. type: string spec: description: spec is a specification of the environment. type: object type: description: type is the type of the execution environment. type: string version: description: >- version is the version of the execution environment. This may be used differently by each individual environment type (ex. auto-generated or manually provided), but is intended to allow variance in environment specifications with the same ID. type: string type: object coreIdentity: description: >- Identity encapsulates the various security identities a task can run as. It's up to the underlying plugin to pick the right identity for the execution environment. properties: execution_identity: title: execution_identity references the subject who makes the execution type: string iam_role: description: >- iam_role references the fully qualified name of Identity & Access Management role to impersonate. type: string k8s_service_account: description: >- k8s_service_account references a kubernetes service account to impersonate. type: string oauth2_client: $ref: '#/components/schemas/coreOAuth2Client' type: object coreSecret: description: >- Secret encapsulates information about the secret a task needs to proceed. An environment variable FLYTE_SECRETS_ENV_PREFIX will be passed to indicate the prefix of the environment variables that will be present if secrets are passed through environment variables. FLYTE_SECRETS_DEFAULT_DIR will be passed to indicate the prefix of the path where secrets will be mounted if secrets are passed through file mounts. properties: env_var: title: >- env_var is optional. Custom environment variable to set the value of the secret. If mount_requirement is ENV_VAR, then the value is the secret itself. If mount_requirement is FILE, then the value is the path to the secret file. +optional type: string group: title: >- The name of the secret group where to find the key referenced below. For K8s secrets, this should be the name of the v1/secret object. For Confidant, this should be the Credential name. For Vault, this should be the secret name. For AWS Secret Manager, this should be the name of the secret. +required type: string group_version: title: >- The group version to fetch. This is not supported in all secret management systems. It'll be ignored for the ones that do not support it. +optional type: string key: title: >- The name of the secret to mount. This has to match an existing secret in the system. It's up to the implementation of the secret management system to require case sensitivity. For K8s secrets, Confidant and Vault, this should match one of the keys inside the secret. For AWS Secret Manager, it's ignored. +optional type: string mount_requirement: $ref: '#/components/schemas/SecretMountType' type: object coreOAuth2TokenRequest: description: >- OAuth2TokenRequest encapsulates information needed to request an OAuth2 token. FLYTE_TOKENS_ENV_PREFIX will be passed to indicate the prefix of the environment variables that will be present if tokens are passed through environment variables. FLYTE_TOKENS_PATH_PREFIX will be passed to indicate the prefix of the path where secrets will be mounted if tokens are passed through file mounts. properties: client: $ref: '#/components/schemas/coreOAuth2Client' idp_discovery_endpoint: title: >- idp_discovery_endpoint references the discovery endpoint used to retrieve token endpoint and other related information. +optional type: string name: title: >- name indicates a unique id for the token request within this task token requests. It'll be used as a suffix for environment variables and as a filename for mounting tokens as files. +required type: string token_endpoint: title: >- token_endpoint references the token issuance endpoint. If idp_discovery_endpoint is not provided, this parameter is mandatory. +optional type: string type: $ref: '#/components/schemas/coreOAuth2TokenRequestType' type: object coreOAuth2Client: description: >- OAuth2Client encapsulates OAuth2 Client Credentials to be used when making calls on behalf of that task. properties: client_id: title: >- client_id is the public id for the client to use. The system will not perform any pre-auth validation that the secret requested matches the client_id indicated here. +required type: string client_secret: $ref: '#/components/schemas/coreSecret' type: object SecretMountType: default: ANY description: |2- - ANY: Default case, indicates the client can tolerate either mounting options. - ENV_VAR: ENV_VAR indicates the secret needs to be mounted as an environment variable. - FILE: FILE indicates the secret needs to be mounted as a file. enum: - ANY - ENV_VAR - FILE type: string coreOAuth2TokenRequestType: default: CLIENT_CREDENTIALS description: |- Type of the token requested. - CLIENT_CREDENTIALS: CLIENT_CREDENTIALS indicates a 2-legged OAuth token requested using client credentials. enum: - CLIENT_CREDENTIALS type: string ```` ## Related topics - [Creates or updates custom MatchableAttributesConfiguration for a project and domain.](/api-reference/project-domain-attributes/creates-or-updates-custom-matchableattributesconfiguration-for-a-project-and-domain.md) - [Creates or updates custom MatchableAttributesConfiguration for a project, domain and workflow.](/api-reference/workflow-attributes/creates-or-updates-custom-matchableattributesconfiguration-for-a-project-domain-and-workflow.md) - [Deletes custom MatchableAttributesConfiguration for a project and domain.](/api-reference/project-attributes/deletes-custom-matchableattributesconfiguration-for-a-project-and-domain.md) - [Fetches custom MatchableAttributesConfiguration for a project and domain.](/api-reference/project-attributes/fetches-custom-matchableattributesconfiguration-for-a-project-and-domain.md)