openapi: 3.0.3
info:
  title: APIClarity BFLA
  version: 0.0.1
  description: APIClarity Module API
paths:
  /version:
    get:
      operationId: getVersion
      summary: Get the version of this Module
      description: Get the version of this Module
      tags:
      - local-bfla
      responses:
        '200':
          description: Version of the Module
          content:
            application/json:
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ModuleVersion'

  /authorizationModel/{apiID}:
    post:
      parameters:
        - name: apiID
          in: path
          required: true
          schema:
            $ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID

      tags:
      - bfla
      requestBody:
        content:
            'application/json':
              schema:
                $ref: '#/components/schemas/AuthorizationModel'
      responses:
        '201':
          description: 'Success'
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
        default:
          description: "Error response"
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
    get:
      parameters:
        - name: apiID
          in: path
          required: true
          schema:
            $ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID

      tags:
        - bfla
      responses:
        '200':
          description: 'Success'
          content:
            'application/json':
              schema:
                $ref: '#/components/schemas/AuthorizationModel'
        default:
          description: "Error response"
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
  /authorizationModel/{apiID}/state:
    get:
      parameters:
        - name: apiID
          in: path
          required: true
          schema:
            $ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
      tags:
        - bfla
      responses:
        '200':
          description: 'Success'
          content:
            'application/json':
              schema:
                $ref: '#/components/schemas/BFLAState'
        default:
          description: "Error response"
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'

  /authorizationModel/{apiID}/approve:
    put:
      tags:
      - local-bfla
      parameters:
        - name: apiID
          in: path
          required: true
          schema:
            $ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
        - in: query
          name: method
          required: true
          schema:
            type: string
        - in: query
          name: path
          required: true
          schema:
            type: string
        - in: query
          name: k8sClientUid
          required: true
          schema:
            type: string
      responses:
        '200':
          description: 'Success'
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
        default:
          description: "Error response"
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
  /authorizationModel/{apiID}/deny:
    put:
      tags:
      - local-bfla
      parameters:
        - name: apiID
          in: path
          required: true
          schema:
            $ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
        - in: query
          name: method
          required: true
          schema:
            type: string
        - in: query
          name: path
          required: true
          schema:
            type: string
        - in: query
          name: k8sClientUid
          required: true
          schema:
            type: string
      responses:
        '200':
          description: 'Success'
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
        default:
          description: "Error response"
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
  /authorizationModel/{apiID}/learning/start:
    put:
      tags:
      - bfla
      parameters:
        - name: apiID
          in: path
          required: true
          schema:
            $ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID

        - in: query
          name: nr_traces
          schema:
            type: integer
      responses:
        '200':
          description: 'Success'
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
        default:
          description: "Error response"
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
  /authorizationModel/{apiID}/reset:
    post:
      tags:
      - bfla
      parameters:
        - name: apiID
          in: path
          required: true
          schema:
            $ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
      responses:
        '200':
          description: 'Success'
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
        default:
          description: "Error response"
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'

  /authorizationModel/{apiID}/learning/stop:
    put:
      tags:
      - bfla
      parameters:
        - name: apiID
          in: path
          required: true
          schema:
            $ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID

      responses:
        '200':
          description: 'Success'
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
        default:
          description: "Error response"
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'

  /authorizationModel/{apiID}/detection/start:
    put:
      tags:
      - bfla
      parameters:
        - name: apiID
          in: path
          required: true
          schema:
            $ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID

      responses:
        '200':
          description: 'Success'
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
        default:
          description: "Error response"
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'

  /authorizationModel/{apiID}/detection/stop:
    put:
      tags:
      - bfla
      parameters:
        - name: apiID
          in: path
          required: true
          schema:
            $ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID

      responses:
        '200':
          description: 'Success'
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
        default:
          description: "Error response"
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'

  /event/{id}:
    get:
      tags:
        - local-bfla
      operationId: get_event
      parameters:
        - name: id
          in: path
          schema:
            type: integer
          required: true
      summary: Get the event with the annotations and bfla status
      responses:
        '200':
          description: API Event with annotations
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIEventAnnotations'

  /event/{id}/{operation}:
    put:
      tags:
        - local-bfla
      parameters:
        - in: path
          schema:
            type: integer
          required: true
          name: id
        - in: path
          required: true
          name: operation
          schema:
            $ref: '#/components/schemas/OperationEnum'
      responses:
        '200':
          description: 'Success'
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
        default:
          description: "Error response"
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
  /apiFindings/{apiID}:
    get:
      tags:
        - bfla
      operationId: GetApiFindings
      summary: 'Get findings for an API and module'
      description: 'Asks for findings of an APIClarity module, and API. Implemented by each module'
      parameters:
        - name: apiID
          in: path
          required: true
          schema:
            $ref: ../../../../../../api3/common/openapi.yaml#/components/schemas/ApiID
        - $ref: '../../../../../../api3/common/openapi.yaml#/components/parameters/Sensitive'
      responses:
        '200':
          description: 'An API Findings Bundle'
          content:
            application/json:
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/APIFindings'
        default:
          description: 'Error response'
          content:
            'application/json':
              schema:
                $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/ApiResponse'
components:
  schemas:
    APIEventAnnotations:
      required: [bflaStatus, external, mismatchedScopes]
      properties:
        external:
          type: boolean
        mismatchedScopes:
          type: boolean
        destinationK8sObject:
          $ref: '#/components/schemas/K8sObjectRef'
        sourceK8sObject:
          $ref: '#/components/schemas/K8sObjectRef'
        bflaStatus:
          $ref: '#/components/schemas/BFLAStatus'
        detectedUser:
          $ref: '#/components/schemas/DetectedUser'

    DetectedUser:
      required: [id, source, ip_address]
      properties:
        id:
          type: string
        source:
          type: string
          enum:
            - JWT
            - BASIC
            - KONG_X_CONSUMER_ID
        ip_address:
          type: string

    K8sObjectRef:
      type: object
      required: [uid, kind, name, namespace, apiVersion]
      properties:
        uid:
          type: string
        kind:
          type: string
        name:
          type: string
        namespace:
          type: string
        apiVersion:
          type: string
    
    BFLAState:
      type: string
      enum:
        - BFLA_START
        - BFLA_LEARNING
        - BFLA_DETECTING
        - BFLA_LEARNT

    BFLAStatus:
      type: string
      enum:
        - NO_SPEC
        - LEARNING
        - LEGITIMATE
        - SUSPICIOUS_MEDIUM
        - SUSPICIOUS_HIGH

    AuthorizationModelAudience:
      type: object
      required: [end_users, authorized, external, statusCode, warningStatus]
      properties:
        warningStatus:
          $ref: '#/components/schemas/BFLAStatus'
        statusCode:
          type: integer
        lastTime:
          type: 'string'
          format: 'date-time'
        authorized:
          type: boolean
        external:
          type: boolean
        end_users:
          type: array
          items:
            $ref: '#/components/schemas/DetectedUser'
        k8s_object:
          $ref: '#/components/schemas/K8sObjectRef'

    AuthorizationModelOperation:
      type: object
      required: [path, method, audience, tags]
      properties:
        path:
          type: string
        method:
          type: string
        tags:
          items:
            type: string
          type: array
        audience:
          type: array
          items:
            $ref: '#/components/schemas/AuthorizationModelAudience'
    SpecType:
      type: string
      enum:
        - NONE
        - PROVIDED
        - RECONSTRUCTED

    AuthorizationModel:
      type: object
      required: [specType, operations, learning]
      properties:
        specType:
          $ref: '#/components/schemas/SpecType'
        learning:
          type: boolean
        operations:
          type: array
          items:
            $ref: '#/components/schemas/AuthorizationModelOperation'

    OperationEnum:
      type: string
      enum:
        - approve
        - deny
        - approve_user
        - deny_user

    AuthorizationModelNotification:
      allOf:
      - $ref: '../../../../../../api3/common/openapi.yaml#/components/schemas/BaseNotification'
      - $ref: '#/components/schemas/AuthorizationModel'