openapi: 3.2.0
info:
  title: Attribute Based Access Control Products API
  description: "Access Control in Adobe Experience Platform allows organization administrators to assign roles and permissions for various Platform capabilities. The Access Control API provides a public endpoint to retrieve effective policies for a user on given resources within a specified sandbox. All other access control capabilities are provided through the [Adobe Admin Console](https://adminconsole.adobe.com).\n- Related documentation:\n    - [Access Control documentation](https://adobe.com/go/access-control-overview-en)\n\n- Visualize API calls with Postman (a free, third-party software):\n    - [Access Control API Postman collection on GitHub](https://github.com/adobe/experience-platform-postman-samples/blob/master/apis/experience-platform/Access%20Control%20API.postman_collection.json)\n    - [Video guide for creating the Postman environment](https://video.tv.adobe.com/v/28832)\n    - [Steps for importing environments and collections in Postman](https://learning.getpostman.com/docs/postman/collection_runs/using_environments_in_collection_runs/)\n\n- API paths:\n    - PLATFORM Gateway URL: https://<span>platform.adobe.io\n    - Base path for this API: /data/foundation/access-control\n    - Example of a complete path for making a call to \"/acl/effective-policies\": https://<span>platform.adobe.io/data/foundation/access-control/acl/effective-policies\n\n- Required headers:\n    - All service calls require the headers `Authorization`, `x-gw-ims-org-id`, and `x-api-key`. For more information on how to obtain these values, see the [authentication tutorial](http://www.adobe.com/go/platform-api-authentication-en).\n    - All resources in Experience Platform are isolated to specific virtual sandboxes. All requests to Platform APIs require the header `x-sandbox-name` whose value is the all-lowercase name of the sandbox the operation will take place in (for example, \"prod\"). See the [sandboxes overview](https://adobe.com/go/sandbox-overview-en) for more information.\n    - All requests with a payload in the request body (such as POST, PUT, and PATCH calls) must include the header `Content-Type` with a value of `application/json`."
  version: '1.0'
servers:
- url: //{environment}.adobe.io/data/foundation/access-control
  variables:
    environment:
      default: platform
      enum:
      - platform
      - platform-stage
tags:
- name: Attribute Based Access Control Products
  description: Attribute based access control products endpoints allow you to manage products as well as permission categories and permission sets associated with products in your organization. More information about using this set of endpoints can be found in the [products endpoint guide](https://experienceleague.adobe.com/docs/experience-platform/access-control/abac/abac-api/products.html).
paths:
  /administration/products:
    get:
      tags:
      - Attribute Based Access Control Products
      summary: List all entitled products
      operationId: listEntitledProducts
      parameters:
      - $ref: '#/components/parameters/authorization'
      - $ref: '#/components/parameters/x-api-key'
      - $ref: '#/components/parameters/x-gw-ims-org-id'
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                type: object
                properties:
                  products:
                    type: array
                    description: A list of products belonging to your organization.
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          example: 4525859963018
                          description: The ID of the product.
                        name:
                          type: string
                          example: Adobe Experience Platform
                          description: The name of the product.
                        serviceCode:
                          type: string
                          example: '{SERVICE_CODE}'
                          description: The service code of the product.
  /administration/products/{PRODUCT_ID}/categories:
    get:
      tags:
      - Attribute Based Access Control Products
      summary: Retrieve permission categories
      operationId: listPermissionCategories
      parameters:
      - $ref: '#/components/parameters/authorization'
      - $ref: '#/components/parameters/x-api-key'
      - $ref: '#/components/parameters/x-gw-ims-org-id'
      - name: PRODUCT_ID
        in: path
        description: The ID of the product you want to retrieve.
        required: true
        schema:
          type: string
          example: 4525859963018
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                type: object
                properties:
                  categories:
                    type: object
                    properties:
                      name:
                        type: string
                        description: The name of the permission category.
                    example:
                    - name: Profile Management
                    - name: Data Ingestion
                    - name: Sandbox Administration
                    - name: Query Service
                    - name: Data Management
                    - name: Identity Management
                    - name: Data Modeling
                    - name: Data Science Workspace
                    - name: Dashboards
                    - name: Alerts
                    - name: Data Governance
  /administration/products/{PRODUCT_ID}/permission-sets:
    get:
      tags:
      - Attribute Based Access Control Products
      summary: Retrieve permission sets
      operationId: listPermissionSets
      parameters:
      - $ref: '#/components/parameters/authorization'
      - $ref: '#/components/parameters/x-api-key'
      - $ref: '#/components/parameters/x-gw-ims-org-id'
      - name: PRODUCT_ID
        in: path
        description: The ID of the product you want to retrieve.
        required: true
        schema:
          type: string
          example: 4525859963018
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                type: object
                properties:
                  permission-sets:
                    type: object
                    properties:
                      id:
                        type: string
                        description: The corresponding ID of the queried permission set.
                      name:
                        type: string
                        description: The corresponding name of the queried permission set.
                      category:
                        type: string
                        description: The available permission category.
                      permissions:
                        type: object
                        properties:
                          resource:
                            type: string
                            description: The asset or object that a subject can or cannot access. Resources can be files, applications, servers, or even APIs.
                          actions:
                            type: string
                            description: The action that a subject is permitted to do against a queried resource. Possible values include view, read, create, edit, and delete.
                    example:
                    - id: manage-schemas
                      name: Manage Schemas
                      category: Data Modeling
                      permissions:
                        example:
                        - resource: schemas
                          actions:
                          - read
                          - write
                          - delete
                        - resource: schema-fields
                          actions:
                          - read
                          - write
                          - delete
                        - resource: sandboxes
                          actions:
                          - view
                    - id: view-schemas
                      name: View Schemas
                      category: Data Modeling
                      permissions:
                        example:
                        - resource: schemas
                          actions:
                          - read
                        - resource: schema-fields
                          actions:
                          - read
                        - resource: sandboxes
                          actions:
                          - view
components:
  parameters:
    authorization:
      name: Authorization
      in: header
      description: The access token which can be copied from your Experience Platform integration, prefixed with "Bearer ". For more information on how to obtain this value, visit the [authentication tutorial](http://www.adobe.com/go/platform-api-authentication-en). If a user token is being passed, then the user of the token must have an “org admin” role for the requested org.
      required: true
      schema:
        type: string
    x-gw-ims-org-id:
      name: x-gw-ims-org-id
      in: header
      description: The Organization ID which can be copied from your Experience Platform integration. For more information on how to obtain this value, visit the [authentication tutorial](http://www.adobe.com/go/platform-api-authentication-en).
      required: true
      schema:
        type: string
    x-api-key:
      name: x-api-key
      in: header
      description: The API key which can be copied from your Experience Platform integration. For more information on how to obtain this value, visit the [authentication tutorial](http://www.adobe.com/go/platform-api-authentication-en).
      required: true
      schema:
        type: string
x-original-swagger-version: '2.0'