openapi: 3.0.0
info:
  title: aserto//v2/.proto Authorizer API
  version: version not set
security:
- AuthorizerAPIKey: []
  TenantID: []
tags:
- name: Authorizer
paths:
  /api/v2/authz/compile:
    post:
      description: Executes a partial query on the loaded policy runtime.
      operationId: authorizer.compile
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v2CompileRequest'
        required: true
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2CompileResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/rpcStatus'
      security:
      - AuthorizerAPIKey: []
        TenantID: []
      summary: Compile
      tags:
      - Authorizer
  /api/v2/authz/decisiontree:
    post:
      description: Returns decision tree for given identity context.
      operationId: authorizer.decision_tree
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v2DecisionTreeRequest'
        required: true
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2DecisionTreeResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/rpcStatus'
      security:
      - AuthorizerAPIKey: []
        TenantID: []
      summary: Decision tree
      tags:
      - Authorizer
  /api/v2/authz/is:
    post:
      description: Determines if identity context is authorized to access the resource guarded by the given policy.
      operationId: authorizer.is
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v2IsRequest'
        required: true
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2IsResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/rpcStatus'
      security:
      - AuthorizerAPIKey: []
        TenantID: []
      summary: Is (authorized)
      tags:
      - Authorizer
  /api/v2/authz/query:
    post:
      description: Executes a rego query on the loaded policy runtime.
      operationId: authorizer.query
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v2QueryRequest'
        required: true
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2QueryResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/rpcStatus'
      security:
      - AuthorizerAPIKey: []
        TenantID: []
      summary: Query
      tags:
      - Authorizer
components:
  schemas:
    apiIdentityType:
      default: IDENTITY_TYPE_UNKNOWN
      description: "Identity types, describes the payload type of the identity field inside the IdentityContext message.\n\n - IDENTITY_TYPE_UNKNOWN: Unknown, value not set, requests will fail with identity type not set error.\n - IDENTITY_TYPE_NONE: None, no explicit identity context set, equals anonymous.\n - IDENTITY_TYPE_SUB: Sub(ject), identity field contains an oAUTH subject.\n - IDENTITY_TYPE_JWT: JWT, identity field contains a JWT access token.\n - IDENTITY_TYPE_MANUAL: Manual, propagates thw identity field as-is, without validation, into the input object."
      enum:
      - IDENTITY_TYPE_UNKNOWN
      - IDENTITY_TYPE_NONE
      - IDENTITY_TYPE_SUB
      - IDENTITY_TYPE_JWT
      - IDENTITY_TYPE_MANUAL
      type: string
    authorizerv2Decision:
      properties:
        decision:
          type: string
        is:
          type: boolean
      type: object
    apiIdentityContext:
      properties:
        identity:
          type: string
        type:
          $ref: '#/components/schemas/apiIdentityType'
      type: object
    v2TraceLevel:
      default: TRACE_LEVEL_UNKNOWN
      enum:
      - TRACE_LEVEL_UNKNOWN
      - TRACE_LEVEL_OFF
      - TRACE_LEVEL_FULL
      - TRACE_LEVEL_NOTES
      - TRACE_LEVEL_FAILS
      title: "- TRACE_LEVEL_UNKNOWN: Value not set.\n - TRACE_LEVEL_OFF: ExplainOffV1   ExplainModeV1 = \"off\"\n - TRACE_LEVEL_FULL: ExplainFullV1  ExplainModeV1 = \"full\"\n - TRACE_LEVEL_NOTES: ExplainNotesV1 ExplainModeV1 = \"notes\"\n - TRACE_LEVEL_FAILS: ExplainFailsV1 ExplainModeV1 = \"fails\""
      type: string
    v2CompileRequest:
      properties:
        disable_inlining:
          items:
            type: string
          type: array
        identity_context:
          $ref: '#/components/schemas/apiIdentityContext'
        input:
          type: string
        options:
          $ref: '#/components/schemas/v2QueryOptions'
        policy_context:
          $ref: '#/components/schemas/apiPolicyContext'
        policy_instance:
          $ref: '#/components/schemas/apiPolicyInstance'
        query:
          type: string
        resource_context:
          type: object
        unknowns:
          items:
            type: string
          type: array
      type: object
    v2IsRequest:
      properties:
        identity_context:
          $ref: '#/components/schemas/apiIdentityContext'
        policy_context:
          $ref: '#/components/schemas/apiPolicyContext'
        policy_instance:
          $ref: '#/components/schemas/apiPolicyInstance'
        resource_context:
          type: object
      type: object
    v2PathSeparator:
      default: PATH_SEPARATOR_UNKNOWN
      enum:
      - PATH_SEPARATOR_UNKNOWN
      - PATH_SEPARATOR_DOT
      - PATH_SEPARATOR_SLASH
      title: "- PATH_SEPARATOR_UNKNOWN: Value not set.\n - PATH_SEPARATOR_DOT: Dot \".\" path separator\n - PATH_SEPARATOR_SLASH: Slash \"/\" path separtor"
      type: string
    protobufAny:
      additionalProperties: {}
      properties:
        '@type':
          type: string
      type: object
    apiPolicyContext:
      properties:
        decisions:
          items:
            type: string
          title: list (1..N) of policy decisions (aka rules)
          type: array
        path:
          title: policy path aka package name
          type: string
      type: object
    v2DecisionTreeOptions:
      properties:
        path_separator:
          $ref: '#/components/schemas/v2PathSeparator'
      type: object
    apiPolicyInstance:
      properties:
        instance_label:
          title: label identifying the instance of the policy
          type: string
        name:
          title: policy name
          type: string
      type: object
    v2QueryResponse:
      properties:
        metrics:
          type: object
        response:
          type: object
        trace:
          items:
            type: object
          type: array
        trace_summary:
          items:
            type: string
          type: array
      type: object
    v2QueryRequest:
      properties:
        identity_context:
          $ref: '#/components/schemas/apiIdentityContext'
        input:
          type: string
        options:
          $ref: '#/components/schemas/v2QueryOptions'
        policy_context:
          $ref: '#/components/schemas/apiPolicyContext'
        policy_instance:
          $ref: '#/components/schemas/apiPolicyInstance'
        query:
          type: string
        resource_context:
          type: object
      type: object
    v2CompileResponse:
      properties:
        metrics:
          type: object
        result:
          type: object
        trace:
          items:
            type: object
          type: array
        trace_summary:
          items:
            type: string
          type: array
      type: object
    rpcStatus:
      properties:
        code:
          format: int32
          type: integer
        details:
          items:
            $ref: '#/components/schemas/protobufAny'
          type: array
        message:
          type: string
      type: object
    v2QueryOptions:
      properties:
        instrument:
          title: default false
          type: boolean
        metrics:
          title: default false
          type: boolean
        trace:
          $ref: '#/components/schemas/v2TraceLevel'
        trace_summary:
          title: default false
          type: boolean
      type: object
    v2IsResponse:
      properties:
        decisions:
          items:
            $ref: '#/components/schemas/authorizerv2Decision'
          type: array
      type: object
    v2DecisionTreeResponse:
      properties:
        path:
          type: object
        path_root:
          type: string
      type: object
    v2DecisionTreeRequest:
      properties:
        identity_context:
          $ref: '#/components/schemas/apiIdentityContext'
        options:
          $ref: '#/components/schemas/v2DecisionTreeOptions'
        policy_context:
          $ref: '#/components/schemas/apiPolicyContext'
        policy_instance:
          $ref: '#/components/schemas/apiPolicyInstance'
        resource_context:
          type: object
      type: object
  securitySchemes:
    AuthorizerAPIKey:
      in: header
      name: authorization
      type: apiKey
    TenantID:
      in: header
      name: aserto-tenant-id
      type: apiKey