swagger: '2.0'
x-endpoint-name: iam
x-products: ALTUS,CDP
x-form-factors: public,private
x-altus-releases: PUBLIC
x-cdp-releases: PUBLIC
x-audit: true
x-extensions: pvcapipath
info:
  version: 0.9.163
  title: Cloudera IAM Service
  license:
    name: Apache 2.0
  description: Cloudera CDP IAM is a web service that you can use to manage users and user permissions under your CDP account.
  termsOfService: https://www.cloudera.com/legal/commercial-terms-and-conditions.html
schemes:
  - https
consumes:
  - application/json
produces:
  - application/json
paths:
  /iam/getUser:
    post:
      summary: Gets information on a user.
      description: Gets information on a user. If no user name is specified. The user name is determined from the access key used to make the request.
      operationId: getUser
      x-form-factors: public,private
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/GetUserRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/GetUserResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listUsers:
    post:
      summary: Lists users.
      description: Lists users.
      operationId: listUsers
      x-form-factors: public,private
      x-right: iam/listUsers
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListUsersRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListUsersResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/createUser:
    post:
      summary: Creates a user in CDP.
      description: Creates a user in CDP.
      operationId: createUser
      x-form-factors: public,private
      x-right: iam/createUser
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/CreateUserRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/CreateUserResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/updateUser:
    post:
      summary: Updates a user.
      description: Updates a user. Updates request fields provided. An error is returned if no field updates are defined in the request.
      operationId: updateUser
      x-right: iam/updateUser
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UpdateUserRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UpdateUserResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/deleteUser:
    post:
      summary: Deletes a user and all associated resources.
      description: Deletes a user. This includes deleting all associated access keys and unassigning all roles and resource roles assigned to the user. The user is also removed from all groups it belongs to. If the call succeeds the user will not be able to login interactively, or use any access keys to access the CDP control plane. This feature is under development and some resources may be left behind after a successful call. Note that user-sync is not triggered yet by this call and the caller must trigger that to ensure that the user loses access to all environments as soon as possible.
      operationId: deleteUser
      x-form-factors: public,private
      x-right: iam/deleteUser
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/DeleteUserRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/DeleteUserResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/createUserAccessKey:
    post:
      summary: Creates a new access key for a user.
      description: Creates a new access key for a user.
      operationId: createUserAccessKey
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/CreateUserAccessKeyRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/CreateUserAccessKeyResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/createMachineUserAccessKey:
    post:
      summary: Creates a new access key for a machine user.
      description: Creates a new access key for a machine user.
      operationId: createMachineUserAccessKey
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/CreateMachineUserAccessKeyRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/CreateMachineUserAccessKeyResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/deleteAccessKey:
    post:
      summary: Deletes an access key.
      description: Deletes an access key.
      operationId: deleteAccessKey
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/DeleteAccessKeyRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/DeleteAccessKeyResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/updateAccessKey:
    post:
      summary: Updates an access key.
      description: Updates an access key.
      operationId: updateAccessKey
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UpdateAccessKeyRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UpdateAccessKeyResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/getAccessKey:
    post:
      summary: Gets information on an access key.
      description: Gets information on an access key. If no access key ID is specified. Information on the access key used to make the request is returned.
      operationId: getAccessKey
      x-form-factors: public,private
      x-right: iam/getAccessKey
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/GetAccessKeyRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/GetAccessKeyResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listAccessKeys:
    post:
      summary: Lists access keys.
      description: Lists access keys.
      operationId: listAccessKeys
      x-form-factors: public,private
      x-right: iam/listAccessKeys
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListAccessKeysRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListAccessKeysResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listRoles:
    post:
      summary: Lists all the available roles.
      description: Lists all the available roles. Roles grant rights to users via policies that are attached to the roles.
      operationId: listRoles
      x-form-factors: public,private
      x-right: iam/listRoles
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListRolesRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListRolesResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listResourceRoles:
    post:
      summary: Lists all the available resource roles.
      description: Lists all the available resource roles. Resource roles grant rights over certain resources.
      operationId: listResourceRoles
      x-form-factors: public,private
      x-right: iam/listResourceRoles
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListResourceRolesRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListResourceRolesResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/setAccountMessages:
    post:
      summary: Set messages for an account.
      description: Set messages for an account.
      operationId: setAccountMessages
      x-form-factors: public
      x-right: iam/setAccountMessages
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/SetAccountMessagesRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/SetAccountMessagesResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/getAccountMessages:
    post:
      summary: Get account messages.
      description: Get account messages.
      operationId: getAccountMessages
      x-form-factors: public
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/GetAccountMessagesRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/GetAccountMessagesResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/assignUserRole:
    post:
      summary: Assign a role to a user.
      description: Assign a role to a user. If the role is already assigned to the user the request will fail.
      operationId: assignUserRole
      x-form-factors: public,private
      x-right: iam/assignRole
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/AssignUserRoleRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/AssignUserRoleResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/unassignUserRole:
    post:
      summary: Unassign a role from a user.
      description: Unassign a role from a user. If the role is not currently assigned to the user the request will fail.
      operationId: unassignUserRole
      x-form-factors: public,private
      x-right: iam/unassignRole
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UnassignUserRoleRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UnassignUserRoleResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/assignUserResourceRole:
    post:
      summary: Assign a resource role to a user.
      description: Assign a resource role to a user. If the resource role is already assigned to the user the request will fail.
      operationId: assignUserResourceRole
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/AssignUserResourceRoleRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/AssignUserResourceRoleResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/unassignUserResourceRole:
    post:
      summary: Unassign a resource role from a user.
      description: Unassign a resource role from a user. If the resource role is not currently assigned to the user the request will fail.
      operationId: unassignUserResourceRole
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UnassignUserResourceRoleRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UnassignUserResourceRoleResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listUserAssignedRoles:
    post:
      summary: Lists the user's assigned roles.
      description: Lists the user's assigned roles.
      operationId: listUserAssignedRoles
      x-form-factors: public,private
      x-right: iam/listAssignedRoles
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListUserAssignedRolesRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListUserAssignedRolesResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listUserAssignedResourceRoles:
    post:
      summary: Lists a user's assigned resource roles.
      description: Lists a user's assigned resource roles.
      operationId: listUserAssignedResourceRoles
      x-form-factors: public,private
      x-right: iam/listAssignedResourceRoles
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListUserAssignedResourceRolesRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListUserAssignedResourceRolesResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/assignMachineUserRole:
    post:
      summary: Assign a role to a machine user.
      description: Assign a role to a machine user. If the role is already assigned to the machine user the request will fail.
      operationId: assignMachineUserRole
      x-form-factors: public,private
      x-right: iam/assignRole
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/AssignMachineUserRoleRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/AssignMachineUserRoleResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/unassignMachineUserRole:
    post:
      summary: Unassign a role from a machine user.
      description: Unassign a role from a machine user. If the role is not currently assigned to the machine user the request will fail.
      operationId: unassignMachineUserRole
      x-form-factors: public,private
      x-right: iam/unassignRole
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UnassignMachineUserRoleRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UnassignMachineUserRoleResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/assignMachineUserResourceRole:
    post:
      summary: Assign a resource role to a machine user.
      description: Assign a resource role to a machine user. If the resource role is already assigned to the machine user the request will fail.
      operationId: assignMachineUserResourceRole
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/AssignMachineUserResourceRoleRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/AssignMachineUserResourceRoleResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/unassignMachineUserResourceRole:
    post:
      summary: Unassign a resource role from a machine user.
      description: Unassign a resource role from a machine user. If the resource role is not currently assigned to the machine user the request will fail.
      operationId: unassignMachineUserResourceRole
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UnassignMachineUserResourceRoleRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UnassignMachineUserResourceRoleResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listMachineUserAssignedRoles:
    post:
      summary: Lists the machine user's assigned roles.
      description: Lists the machine user's assigned roles.
      operationId: listMachineUserAssignedRoles
      x-form-factors: public,private
      x-right: iam/listAssignedRoles
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListMachineUserAssignedRolesRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListMachineUserAssignedRolesResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listMachineUserAssignedResourceRoles:
    post:
      summary: Lists a machine user's assigned resource roles.
      description: Lists a machine user's assigned resource roles.
      operationId: listMachineUserAssignedResourceRoles
      x-form-factors: public,private
      x-right: iam/listAssignedResourceRoles
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListMachineUserAssignedResourceRolesRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListMachineUserAssignedResourceRolesResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listResourceAssignees:
    post:
      summary: List the resource assignees and their respective resource roles for the resource.
      description: List the resource assignees and their respective resource roles for the resource.
      operationId: listResourceAssignees
      x-form-factors: public,private
      x-right: iam/listResourceAssignees
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListResourceAssigneesRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListResourceAssigneesResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/createMachineUser:
    post:
      summary: Create a machine user.
      description: Creates a machine user in the account. A machine user can be used to access CDP API. A machine user can have access keys associated with it and can be assigned roles and resource roles. A machine user cannot login to the CDP console.
      operationId: createMachineUser
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/CreateMachineUserRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/CreateMachineUserResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listMachineUsers:
    post:
      summary: Lists machine users.
      description: Lists machine users in the account.
      operationId: listMachineUsers
      x-form-factors: public,private
      x-right: iam/listMachineUsers
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListMachineUsersRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListMachineUsersResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/deleteMachineUser:
    post:
      summary: Delete a machine user.
      description: Deletes a machine user. This includes deleting all associated access keys and unassigning all roles and resource roles assigned to the machine user. The machine user is also removed from all groups it belongs to. If the call succeeds the machine user will not be able to use any access keys to access the CDP control plane. Note that user-sync is not triggered yet by this call and the caller must trigger that to ensure that the machine user loses access to all environments as soon as possible.
      operationId: deleteMachineUser
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/DeleteMachineUserRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/DeleteMachineUserResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/createSamlProvider:
    post:
      summary: Creates a SAML provider in CDP.
      description: Creates a SAML provider in CDP.
      operationId: createSamlProvider
      x-form-factors: public,private
      x-right: iam/createSamlProvider
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/CreateSamlProviderRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/CreateSamlProviderResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/deleteSamlProvider:
    post:
      summary: Deletes a SAML provider in CDP account.
      description: Deletes a SAML provider in CDP account.
      operationId: deleteSamlProvider
      x-form-factors: public,private
      x-right: iam/deleteSamlProvider
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/DeleteSamlProviderRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/DeleteSamlProviderResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listSamlProviders:
    post:
      summary: Lists SAML providers in CDP account.
      description: Lists SAML providers in CDP account.
      operationId: listSamlProviders
      x-form-factors: public,private
      x-right: iam/listSamlProviders
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListSamlProvidersRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListSamlProvidersResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/describeSamlProvider:
    post:
      summary: Describes one SAML provider.
      description: Describes one SAML provider.
      operationId: describeSamlProvider
      x-form-factors: public,private
      x-right: iam/listSamlProviders
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/DescribeSamlProviderRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/DescribeSamlProviderResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/updateSamlProvider:
    post:
      summary: Updates a SAML provider in CDP.
      description: Updates a SAML provider in CDP.
      operationId: updateSamlProvider
      x-form-factors: public,private
      x-right: iam/updateSamlProvider
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UpdateSamlProviderRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UpdateSamlProviderResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/enableClouderaSSOLogin:
    post:
      summary: Enables interactive login using Cloudera SSO for this account.
      description: Enables interactive login using Cloudera SSO for this account. This is a no-op if login using Cloudera SSO are already enabled.
      operationId: enableClouderaSSOLogin
      x-form-factors: public
      x-right: iam/manageClouderaSSOLogin
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/EnableClouderaSSOLoginRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/EnableClouderaSSOLoginResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/disableClouderaSSOLogin:
    post:
      summary: Disables interactive login using Cloudera SSO for this account.
      description: Disables interactive login using Cloudera SSO for this account. When disabled, only users who are designated account administrators will be able to use Cloudera SSO to interactively login to the CDP account. All other users will only be able to interactively login using SAML providers defined for the account. This is a no-op if login using Cloudera SSO are already disabled.
      operationId: disableClouderaSSOLogin
      x-form-factors: public
      x-right: iam/manageClouderaSSOLogin
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/DisableClouderaSSOLoginRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/DisableClouderaSSOLoginResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/getAccount:
    post:
      summary: Retrieves information about the CDP account.
      description: Retrieves information about the CDP account.
      operationId: getAccount
      x-form-factors: public,private
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/GetAccountRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/GetAccountResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/createGroup:
    post:
      summary: Create a group.
      description: Create a group. A group is a named collection of users and machine users. Roles and resource roles can be assigned to a group impacting all members of the group.
      operationId: createGroup
      x-form-factors: public,private
      x-right: iam/createGroup
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/CreateGroupRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/CreateGroupResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/deleteGroup:
    post:
      summary: Delete a group.
      description: Delete a group.
      operationId: deleteGroup
      x-form-factors: public,private
      x-right: iam/deleteGroup
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/DeleteGroupRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/DeleteGroupResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listGroups:
    post:
      summary: Lists groups.
      description: Lists groups. If no group names are specified, the call lists all groups.
      operationId: listGroups
      x-form-factors: public,private
      x-right: iam/listGroups
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListGroupsRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListGroupsResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/updateGroup:
    post:
      summary: Update a group.
      description: Update a group.
      operationId: updateGroup
      x-form-factors: public,private
      x-right: iam/updateGroup
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UpdateGroupRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UpdateGroupResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/addUserToGroup:
    post:
      summary: Add a user to a group.
      description: Add a user to group.
      operationId: addUserToGroup
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/AddUserToGroupRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/AddUserToGroupResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/addMachineUserToGroup:
    post:
      summary: Add a machine user to group.
      description: Add a machine user to a group.
      operationId: addMachineUserToGroup
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/AddMachineUserToGroupRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/AddMachineUserToGroupResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/removeUserFromGroup:
    post:
      summary: Remove a user from a group.
      description: Remove a user from a group.
      operationId: removeUserFromGroup
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/RemoveUserFromGroupRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/RemoveUserFromGroupResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/removeMachineUserFromGroup:
    post:
      summary: Remove a machine user from a group.
      description: Remove a machine user from a group.
      operationId: removeMachineUserFromGroup
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/RemoveMachineUserFromGroupRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/RemoveMachineUserFromGroupResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listGroupMembers:
    post:
      summary: List the members of a group.
      description: List the members of a group.
      operationId: listGroupMembers
      x-form-factors: public,private
      x-right: iam/listGroupMembers
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListGroupMembersRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListGroupMembersResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listGroupsForUser:
    post:
      summary: List the groups that the user belongs to.
      description: List the groups that the user belongs to.
      operationId: listGroupsForUser
      x-form-factors: public,private
      x-right: iam/listGroupsForActor
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListGroupsForUserRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListGroupsForUserResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listGroupsForMachineUser:
    post:
      summary: List the groups that the machine user belongs to.
      description: List the groups that the machine user belongs to.
      operationId: listGroupsForMachineUser
      x-form-factors: public,private
      x-right: iam/listGroupsForActor
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListGroupsForMachineUserRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListGroupsForMachineUserResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/assignGroupRole:
    post:
      summary: Assign a role to a group.
      description: Assign a role to a group. If the role is already assigned to the group the request will fail.
      operationId: assignGroupRole
      x-form-factors: public,private
      x-right: iam/assignRole
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/AssignGroupRoleRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/AssignGroupRoleResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/unassignGroupRole:
    post:
      summary: Unassign a role from a group.
      description: Unassign a role from a group. If the role is not currently assigned to the group the request will fail.
      operationId: unassignGroupRole
      x-form-factors: public,private
      x-right: iam/unassignRole
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UnassignGroupRoleRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UnassignGroupRoleResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/assignGroupResourceRole:
    post:
      summary: Assign a resource role to a group.
      description: Assign a resource role to a group. If the resource role is already assigned to the group the request will fail.
      operationId: assignGroupResourceRole
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/AssignGroupResourceRoleRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/AssignGroupResourceRoleResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/unassignGroupResourceRole:
    post:
      summary: Unassign a resource role from a group.
      description: Unassign a resource role from a group. If the resource role is not currently assigned to the group the request will fail.
      operationId: unassignGroupResourceRole
      x-form-factors: public,private
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UnassignGroupResourceRoleRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UnassignGroupResourceRoleResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listGroupAssignedRoles:
    post:
      summary: Lists the group's assigned roles.
      description: Lists the group's assigned roles.
      operationId: listGroupAssignedRoles
      x-form-factors: public,private
      x-right: iam/listAssignedRoles
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListGroupAssignedRolesRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListGroupAssignedRolesResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listGroupAssignedResourceRoles:
    post:
      summary: Lists a group's assigned resource roles.
      description: Lists a group's assigned resource roles.
      operationId: listGroupAssignedResourceRoles
      x-form-factors: public,private
      x-right: iam/listAssignedResourceRoles
      x-paging-default-max-items: 100
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListGroupAssignedResourceRolesRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListGroupAssignedResourceRolesResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/setWorkloadPassword:
    post:
      summary: Set the workload password for an actor.
      description: Set the workload password for an actor. This will be the actor's password in all Environments they have access to, including Environments they are given access to after setting the password. The password plaintext is not kept.
      operationId: setWorkloadPassword
      x-form-factors: public
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/SetWorkloadPasswordRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/SetWorkloadPasswordResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/unsetWorkloadPasswordMinLifetime:
    post:
      summary: Removes workload password minimum lifetime date for an actor.
      description: Removes the workload password minimum lifetime date for an actor.
      operationId: unsetWorkloadPasswordMinLifetime
      x-form-factors: public
      x-right: iam/unsetWorkloadPasswordMinLifetime
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UnsetWorkloadPasswordMinLifetimeRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UnsetWorkloadPasswordMinLifetimeResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/setWorkloadPasswordPolicy:
    post:
      summary: Set the workload password policy for the account.
      description: Set the workload password for the account. Changes to the workload password policy only affect passwords that are set after the policy has been updated. By default, passwords never expire.
      operationId: setWorkloadPasswordPolicy
      x-right: iam/setWorkloadPasswordPolicy
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/SetWorkloadPasswordPolicyRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/SetWorkloadPasswordPolicyResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/unsetWorkloadPasswordPolicy:
    post:
      summary: Unset workload password policy for the account.
      description: Unset the workload password for the account. Changes to the workload password policy only affect passwords that are set after the policy has been updated.
      operationId: unsetWorkloadPasswordPolicy
      x-right: iam/unsetWorkloadPasswordPolicy
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UnsetWorkloadPasswordPolicyRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UnsetWorkloadPasswordPolicyResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/addSshPublicKey:
    post:
      summary: Adds an SSH public key for an actor.
      description: Adds an SSH public key for an actor. The private key that corresponds to this public key can be used to SSH into any workload cluster that the actor is authorized to use.
      operationId: addSshPublicKey
      x-form-factors: public
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/AddSshPublicKeyRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/AddSshPublicKeyResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listSshPublicKeys:
    post:
      summary: Lists SSH public keys for an actor.
      description: Lists SSH public keys for an actor.
      operationId: listSshPublicKeys
      x-form-factors: public
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListSshPublicKeysRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListSshPublicKeysResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/describeSshPublicKey:
    post:
      summary: Describes an SSH public key for an actor.
      description: Describe an SSH public key for an actor.
      operationId: describeSshPublicKey
      x-form-factors: public
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/DescribeSshPublicKeyRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/DescribeSshPublicKeyResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/deleteSshPublicKey:
    post:
      summary: Deletes an SSH public key for an actor.
      description: Delete an SSH public key for an actor.
      operationId: deleteSshPublicKey
      x-form-factors: public
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/DeleteSshPublicKeyRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/DeleteSshPublicKeyResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/updateLdapProvider:
    post:
      summary: UpdateLdapProvider
      description: Update an LDAP provider.
      operationId: updateLdapProvider
      x-form-factors: private
      x-right: iam/updateLdapProvider
      x-entitlement: CORE_SRV_ON_PRIVATE_CLOUD
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UpdateLdapProviderRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UpdateLdapProviderResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/createLdapProvider:
    post:
      summary: CreateLdapProvider
      description: Create an LDAP provider.
      operationId: createLdapProvider
      x-form-factors: private
      x-right: iam/createLdapProvider
      x-entitlement: CORE_SRV_ON_PRIVATE_CLOUD
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/CreateLdapProviderRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/CreateLdapProviderResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/getDefaultIdentityProvider:
    post:
      summary: Retrieves the CRN of the default identity provider.
      description: Retrieves the CRN of the default identity provider used for CDP initiated login requests.
      operationId: getDefaultIdentityProvider
      x-form-factors: public,private
      x-right: iam/getDefaultIdentityProvider
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/GetDefaultIdentityProviderRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/GetDefaultIdentityProviderResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/setDefaultIdentityProvider:
    post:
      summary: Sets the default identity provider.
      description: Sets the default identity provider used for CDP initiated login requests.
      operationId: setDefaultIdentityProvider
      x-form-factors: public,private
      x-right: iam/setDefaultIdentityProvider
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/SetDefaultIdentityProviderRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/SetDefaultIdentityProviderResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/generateWorkloadAuthToken:
    post:
      summary: Generates an authentication token for workload APIs.
      description: Generates an authentication token which is required for sending requests to workload APIs.
      operationId: generateWorkloadAuthToken
      x-form-factors: public,private
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/GenerateWorkloadAuthTokenRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/GenerateWorkloadAuthTokenResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/createScimAccessToken:
    post:
      summary: Creates a SCIM access token for a SCIM enabled identity provider.
      description: Creates a SCIM access token for a SCIM enabled identity provider. This token is used to authenticate requests sent to the SCIM endpoints. This operation is not supported for Cloudera for Government.
      operationId: createScimAccessToken
      x-form-factors: public
      x-right: iam/createScimAccessToken
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/CreateScimAccessTokenRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/CreateScimAccessTokenResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/listScimAccessTokens:
    post:
      summary: Lists SCIM access tokens for a SCIM enabled identity provider.
      description: Lists SCIM access tokens for a SCIM enabled identity provider. These access tokens are used to authenticate requests sent to the SCIM endpoints. This operation is not supported for Cloudera for Government.
      operationId: listScimAccessTokens
      x-form-factors: public
      x-paginates: true
      x-paging-default-max-items: 100
      x-right: iam/listScimAccessTokens
      x-mutating: false
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/ListScimAccessTokensRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/ListScimAccessTokensResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/deleteScimAccessToken:
    post:
      summary: Deletes a SCIM access token.
      description: Deletes a SCIM access token. This operation is not supported for Cloudera for Government.
      operationId: deleteScimAccessToken
      x-form-factors: public
      x-right: iam/deleteScimAccessToken
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/DeleteScimAccessTokenRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/DeleteScimAccessTokenResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/unlockUserInControlPlane:
    post:
      summary: Unlocks user in the CDP control plane.
      description: Unlocks user in the CDP control plane. This operation is idempotent. Unlocking an active user will succeed and leave the user active. This operation is only supported on Cloudera for Government.
      operationId: unlockUserInControlPlane
      x-form-factors: public
      x-right: iam/unlockUserInControlPlane
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UnlockUserInControlPlaneRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UnlockUserInControlPlaneResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/unlockMachineUserInControlPlane:
    post:
      summary: Unlocks machine user in the CDP control plane.
      description: Unlocks machine user in the CDP control plane. This operation is idempotent. Unlocking an active machine user will succeed and leave the machine user active. This operation is only supported on Cloudera for Government.
      operationId: unlockMachineUserInControlPlane
      x-form-factors: public
      x-right: iam/unlockMachineUserInControlPlane
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/UnlockMachineUserInControlPlaneRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/UnlockMachineUserInControlPlaneResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/setSamlAuthnRequestSigningKey:
    post:
      summary: Sets the SAML AuthnRequest signing key and verification certificate.
      description: Sets the SAML AuthnRequest signing key and verification certificate. The signing key will be used by CDP to sign the AuthnRequest and the verification certificate(s) will be used by the customer's Identity Provider to verify the AuthnRequest. These keys are generated and managed by the customer. The API always replaces the previously stored signing key and verification certificates with the given key and certificates. The parameters that are omitted from the request will be cleared.
      operationId: setSamlAuthnRequestSigningKey
      x-form-factors: private
      x-entitlement: IAM_SIGN_SAML_AUTHN_REQUEST_BY_EXTERNAL_KEY
      x-right: iam/setSamlAuthnRequestSigningKey
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/SetSamlAuthnRequestSigningKeyRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/SetSamlAuthnRequestSigningKeyResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/migrateUsersToIdentityProvider:
    post:
      summary: Migrates all users from an identity provider connector to a different identity provider connector.
      description: Allow existing users to be associated with a different identity provider connector. It is required that the identity provider user ID for each user be the same in both identity providers. This is expected to be used for migration from LDAP authentication to SAML authentication for the same physical IdP. A new SAML connector would be created in CDP, integrated with the same IdP as the original LDAP connector. First the LDAP mapping would be set to use the planned SAML name id mapping. Then this method can switch users created via LDAP login to be associated with the SAML connector and enable SAML authentication instead of LDAP authentication.
      operationId: migrateUsersToIdentityProvider
      x-form-factors: private
      x-right: iam/migrateUsersToIdentityProvider
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/MigrateUsersToIdentityProviderRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/MigrateUsersToIdentityProviderResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/setSamlResponseDecryptionKey:
    post:
      summary: Sets encryption certificate and decryption key for SAML response sent from customer's Identity Provider to CDP.
      description: Sets encryption certificate and decryption key for SAML response sent from customer's Identity Provider to CDP. These keys are generated and managed by the customer. The API always replaces the previously stored encryption and decryption keys with the given keys. The keys that are omitted from the request will be cleared. The encryption key will be used by the Identity Provider to encrypt the SAML response, and the decryption key will be used by CDP to decrypt the SAML response.
      operationId: setSamlResponseDecryptionKey
      x-form-factors: private
      x-entitlement: IAM_DECRYPT_SAML_RESPONSE_BY_EXTERNAL_KEY
      x-right: iam/setSamlResponseDecryptionKey
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/SetSamlResponseDecryptionKeyRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/SetSamlResponseDecryptionKeyResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/enableUserWorkloadPasswordChangedNotifications:
    post:
      summary: Enables sending user workload password changed email notifications for the account.
      description: Enables sending user workload password change email notifications for the account.
      operationId: enableUserWorkloadPasswordChangedNotifications
      x-form-factors: public
      x-entitlement: IAM_PASSWORD_CHANGED_NOTIFICATION_TOGGLE
      x-right: iam/enableUserWorkloadPasswordChangedNotifications
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/EnableUserWorkloadPasswordChangedNotificationsRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/EnableUserWorkloadPasswordChangedNotificationsResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
  /iam/disableUserWorkloadPasswordChangedNotifications:
    post:
      summary: Disables sending user workload password changed email notifications for the account.
      description: Disables sending user workload password changed email notifications for the account.
      operationId: disableUserWorkloadPasswordChangedNotifications
      x-form-factors: public
      x-entitlement: IAM_PASSWORD_CHANGED_NOTIFICATION_TOGGLE
      x-right: iam/disableUserWorkloadPasswordChangedNotifications
      x-mutating: true
      parameters:
        - name: input
          in: body
          required: true
          schema:
            $ref: '#/definitions/DisableUserWorkloadPasswordChangedNotificationsRequest'
      responses:
        200:
          description: Expected response to a valid request.
          schema:
            $ref: '#/definitions/DisableUserWorkloadPasswordChangedNotificationsResponse'
        default:
          description: The default response on an error.
          schema:
            $ref: '#/definitions/Error'
definitions:
  Error:
    type: object
    description: An object returned on an error.
    properties:
      code:
        type: string
        description: The error code.
      message:
        type: string
        description: The error message.
  WorkloadPasswordPolicy:
    type: object
    description: Information about the workload password policy for an account.
    required:
      - maxPasswordLifetimeDays
      - minPasswordLength
      - mustIncludeUpperCaseCharacters
      - mustIncludeLowerCaseCharacters
      - mustIncludeNumbers
      - mustIncludeSymbols
      - minPasswordLifetimeDays
      - passwordHistorySize
    properties:
      maxPasswordLifetimeDays:
        type: integer
        format: int32
        description: The maximum lifetime, in days, of the password. If '0' passwords never expire.
      minPasswordLength:
        type: integer
        format: int32
        description: The minimum length of a password.
      mustIncludeUpperCaseCharacters:
        type: boolean
        description: Whether passwords must include upper case characters.
      mustIncludeLowerCaseCharacters:
        type: boolean
        description: Whether passwords must include lower case characters.
      mustIncludeNumbers:
        type: boolean
        description: Whether passwords must include numbers.
      mustIncludeSymbols:
        type: boolean
        description: Whether passwords must include symbols. The symbols are '#', '&', '*', '$', '%', '@', '^', '.', '_', and '!'.
      minPasswordLifetimeDays:
        type: integer
        format: int32
        description: The minimum lifetime of passwords, in days. The password must be used for this duration before it can be changed. If set to '0' the password may be changed any time. The default is 0.
      passwordHistorySize:
        type: integer
        format: int32
        description: The number of previous passwords that should be remembered. The user or machine user is prevented from reusing these passwords. Can be any number between 0 and 20. The default is 0, this value means all previous passwords may be reused.
  Account:
    type: object
    description: Information about a Cloudera CDP account.
    required:
      - clouderaSSOLoginEnabled
      - clouderaSSOAllLoginEnabled
      - workloadPasswordPolicy
    properties:
      clouderaSSOLoginEnabled:
        type: boolean
        description: Whether interactive login using Cloudera SSO is enabled for users who are not account administrators. Its default value is 'true'. When it is 'true', the account administrators, as well as non-administrator users can login through Cloudera SSO. When it is 'false', Cloudera SSO users who are not account administrators will not be able to login.
      clouderaSSOAllLoginEnabled:
        type: boolean
        description: Whether login is enabled for Cloudera SSO users. It can only be set by Cloudera upon request and disables interactive login through Cloudera SSO. Note that restricting Cloudera SSO login will prevent account administrators from logging in interactively. Its default value is 'true'. When it is 'true', the Cloudera SSO interactive login behavior is controlled according to the existing `clouderaSSOLoginEnabled` flag. When it is 'false', it overrides the setting for `clouderaSSOLoginEnabled`.
      workloadPasswordPolicy:
        $ref: '#/definitions/WorkloadPasswordPolicy'
        description: The workload password policy object.
      machineUserWorkloadPasswordPolicy:
        $ref: '#/definitions/WorkloadPasswordPolicy'
        description: The machine user workload password policy object. May be omitted if no such policy was defined.
  User:
    type: object
    description: Information about a Cloudera CDP user.
    required:
      - userId
      - crn
      - email
      - firstName
      - lastName
      - creationDate
      - accountAdmin
      - identityProviderCrn
    x-limits:
      - scope: account
        value: 100
        doc: The maximum number of users that can be created in an account.
    properties:
      userId:
        type: string
        description: The stable, unique identifier of the user.
      crn:
        type: string
        description: The CRN of the user.
      email:
        type: string
        description: The user's email address.
      firstName:
        type: string
        description: The user's first name.
      lastName:
        type: string
        description: The user's last name.
      creationDate:
        type: string
        format: date-time
        description: The date when this user record was created.
      accountAdmin:
        type: boolean
        description: Whether the user is an administrator of their CDP account.
      identityProviderCrn:
        type: string
        description: The identity provider that the user belongs to. It can be "Cloudera-Default", "Cloudera-Administration", or a customer defined IdP.
      lastInteractiveLogin:
        type: string
        format: date-time
        description: The date of the user's last interactive login.
      workloadUsername:
        type: string
        description: The username used in all the workload clusters of the user.
        x-no-compatibility-guarantee: true
      status:
        type: string
        description: The current status of the user. The possible status values are ACTIVE, CONTROL_PLANE_LOCKED_OUT, and DEACTIVATED. ACTIVE indicates that the user is active in CDP. An active user can authenticate to the CDP control plane and workload clusters. CONTROL_PLANE_LOCKED_OUT indicates that the user is locked out of the CDP control plane. The locked-out user can no longer authenticate to the control plane but can authenticate to the workload clusters. DEACTIVATED indicates that the user is deactivated in CDP. A deactivated user can neither authenticate to the control plane nor to the workload clusters. Note that more statuses could be added in the future. The statuses other than ACTIVE are only returned on Cloudera for Government.
      workloadPasswordDetails:
        $ref: '#/definitions/WorkloadPasswordDetails'
        description: Information about the workload password for the user.
  MachineUser:
    type: object
    description: Information about a Cloudera CDP machine user.
    required:
      - machineUserName
      - crn
      - creationDate
    x-limits:
      - scope: account
        value: 100
        doc: The maximum number of machine users that can be created in an account.
    properties:
      machineUserName:
        type: string
        description: The machine user name.
      crn:
        type: string
        description: The CRN of the user.
      creationDate:
        type: string
        format: date-time
        description: The date when this machine user record was created.
      workloadUsername:
        type: string
        description: The username used in all the workload clusters of the machine user.
        x-no-compatibility-guarantee: true
      status:
        type: string
        description: The current status of the machine user. The possible status values are ACTIVE and CONTROL_PLANE_LOCKED_OUT. ACTIVE indicates that the machine user is active in CDP. An active machine user can authenticate to the CDP control plane and workload clusters. CONTROL_PLANE_LOCKED_OUT indicates that the machine user is locked out of the CDP control plane. The locked-out machine user can no longer authenticate to the control plane but can authenticate to the workload clusters. Note that more statuses could be added in the future. The statuses other than ACTIVE are only returned on Cloudera for Government.
      workloadPasswordDetails:
        $ref: '#/definitions/WorkloadPasswordDetails'
        description: Information about the workload password for the machine user.
  WorkloadPasswordDetails:
    type: object
    description: Information about the workload password for a user or machine user.
    required:
      - isPasswordSet
    properties:
      isPasswordSet:
        type: boolean
        description: Whether a workload password is set.
      passwordExpirationDate:
        type: string
        format: date-time
        description: The date at which the workload password will expire.
      passwordMinLifetimeDate:
        type: string
        format: date-time
        description: The minimum lifetime date of the workload password. A new password can't be set until this date.
  AccessKeyType:
    type: string
    description: The version of an access key. `V1` - Deprecated, use RSA as the request signing algorithm. `V2` - Use ED25519 as the request signing algorithm. `V3` - Use ECDSA as the request signing algorithm. `DEFAULT` - Use the system default signing algorithm (V3 in GovCloud, V2 in other regions).
    enum:
      - V1
      - V2
      - V3
  AccessKey:
    type: object
    description: Information about a Cloudera CDP access key.
    required:
      - accessKeyId
      - crn
      - actorCrn
      - creationDate
    x-limits:
      - scope: account
        value: 200
        doc: The maximum number of access keys that can be created in an account.
    properties:
      accessKeyId:
        type: string
        description: The ID of the access key.
      crn:
        type: string
        description: The CRN of the access key.
      actorCrn:
        type: string
        description: The CRN of the actor with which this access key is associated.
      creationDate:
        type: string
        format: date-time
        description: The date when the access key was created.
      status:
        type: string
        description: The status of an access key.
        enum:
          - ACTIVE
          - INACTIVE
      type:
        $ref: '#/definitions/AccessKeyType'
        description: The type of an access key.
      lastUsage:
        $ref: '#/definitions/AccessKeyLastUsage'
        description: Information on the last time this access key was used.
  AccessKeyLastUsage:
    type: object
    description: Information on the last time an access key was used.
    properties:
      lastUsageDate:
        type: string
        format: date-time
        description: The date when the access key was last used.
      serviceName:
        type: string
        description: The name of the service with which this access key was most recently used.
  PolicyStatement:
    type: object
    description: A policy statement is a list of rights and zero or more resources on which the rights are granted.
    required:
      - rights
      - resources
    properties:
      rights:
        type: array
        items:
          type: string
        description: The list of rights in the policy statement.
      resources:
        type: array
        items:
          type: string
        description: The resources on which the rights are granted.
  Policy:
    type: object
    description: A policy contains a list of one or more policy statements.
    required:
      - crn
      - policyStatements
    properties:
      crn:
        type: string
        description: The policy crn.
      policyStatements:
        type: array
        items:
          $ref: '#/definitions/PolicyStatement'
        description: The policy statements.
  ResourceRole:
    type: object
    description: Information about a resource role. A resource role is a role that grants a collection of rights to a user on resources.
    required:
      - crn
      - rights
    properties:
      crn:
        type: string
        description: The CRN of the resource role.
      rights:
        type: array
        items:
          type: string
        description: The rights granted by this role.
  Role:
    type: object
    description: Information about a role.
    required:
      - crn
      - policies
    properties:
      crn:
        type: string
        description: The role's CRN.
      policies:
        type: array
        items:
          $ref: '#/definitions/Policy'
        description: The list of policies that belong to the role. Cannot be empty.
  ResourceAssignment:
    type: object
    description: Information about a resource assignment.
    required:
      - resourceCrn
      - resourceRoleCrn
    properties:
      resourceCrn:
        type: string
        description: The assigned resource's CRN.
      resourceRoleCrn:
        type: string
        description: The assigned resource role CRN.
  ResourceAssignee:
    type: object
    description: Information about the resource role assignee for the resource.
    required:
      - assigneeCrn
      - resourceRoleCrn
    properties:
      assigneeCrn:
        type: string
        description: The CRN of the assignee.
      resourceRoleCrn:
        type: string
        description: The assigned resource role CRN.
  Group:
    type: object
    description: Information about a group.
    required:
      - groupName
      - crn
      - creationDate
    properties:
      groupName:
        type: string
        description: The group name.
      crn:
        type: string
        description: The CRN of the group.
      creationDate:
        type: string
        format: date-time
        description: The date when this group record was created.
      syncMembershipOnUserLogin:
        type: boolean
        description: Whether group membership is synced when a user logs in. The default is to sync group membership.
  SamlProvider:
    type: object
    description: Information used to connect a CDP account to an external identity provider.
    required:
      - crn
      - creationDate
      - samlProviderName
      - samlProviderId
      - syncGroupsOnLogin
    properties:
      crn:
        type: string
        description: CRN of the SAML provider in CDP.
        x-no-compatibility-guarantee: true
      creationDate:
        type: string
        format: date-time
        description: The date when this SAML provider record was created.
        x-no-compatibility-guarantee: true
      samlProviderName:
        type: string
        description: Name of the SAML provider.
      samlProviderId:
        type: string
        description: The unique ID of the saml provider.
      syncGroupsOnLogin:
        type: boolean
        description: Whether users federated with this SAML provider will have their group membership synchronized. Group membership can be passed using the https://cdp.cloudera.com/SAML/Attributes/groups SAML assertion.
      generateWorkloadUsernameByEmail:
        type: boolean
        description: Whether to generate users' workload username by email or by identity provider user ID (SAML NameID).
      enableScim:
        type: boolean
        description: Whether SCIM is enabled on this SAML provider. System for Cross-domain Identity Management (SCIM) version 2.0 is a standard for automating the provisioning of user and group identity information from identity provider to CDP. It is omitted for Cloudera for Government.
        x-form-factors: public
      scimUrl:
        type: string
        description: The SCIM URL if SCIM is enabled. It is omitted for Cloudera for Government.
      samlMetadataDocument:
        type: string
        description: The original metadata that was passed while creating the SAML provider connector. This field will not be set when the SAML provider does not have metadata. This field will not be set for listSamlProviders API response.
      cdpSpMetadata:
        type: string
        description: The Service Provider SAML metadata specific to this CDP SAML provider. This field will only be set for createSamlProvider and describeSamlProvider API calls.
      authnRequestConfigurationLastUpdated:
        type: string
        format: date-time
        description: The date when SAML AuthnRequest signing key and verification certificates were set or cleared.
        x-form-factor: private
      authnRequestSigningKeyDefined:
        type: boolean
        description: Whether the AuthnRequest signing key is set or cleared.
        x-form-factor: private
      currentAuthnRequestVerificationCertificateDefined:
        type: boolean
        description: Whether the current AuthnRequest verification certificate is set or cleared.
        x-form-factor: private
      nextAuthnRequestVerificationCertificateDefined:
        type: boolean
        description: Whether the next AuthnRequest verification certificate is set or cleared.
        x-form-factor: private
      samlResponseEncryptionDecryptionConfigurationLastUpdated:
        type: string
        format: date-time
        description: The date when SAML response encryption certificate and decryption keys were set or cleared.
        x-form-factor: private
      samlResponseEncryptionCertificateDefined:
        type: boolean
        description: Whether the SAML response encryption certificate is set or cleared.
        x-form-factor: private
      currentSamlResponseDecryptionKeyDefined:
        type: boolean
        description: Whether the current decryption key for SAML response is set or cleared.
        x-form-factor: private
      nextSamlResponseDecryptionKeyDefined:
        type: boolean
        description: Whether the next decryption key for SAML response is set or cleared.
        x-form-factor: private
  SshPublicKey:
    type: object
    description: Information about an SSH public key.
    required:
      - crn
      - publicKeyFingerprint
    properties:
      crn:
        type: string
        description: The SSH public key CRN.
      publicKeyFingerprint:
        type: string
        description: The SSH public key SHA256 fingerprint. This is identical to the SHA256 produced by running the following command on a public key named 'key.pub'; ssh-keygen -l -E SHA256 -f /home/user/.ssh/key.pub. Note that ssh-keygen removes any padding bytes from the BASE64 fingerprint encoding (the '=' characters at the end of the fingerprint) which is also true for this fingerprint.
      description:
        type: string
        description: An optional description for the public key.
      publicKey:
        type: string
        description: The SSH public key string. Only populated for DescribeSshPublicKeyResponses. This is the same string that was used when the key was added.
  GetUserRequest:
    type: object
    description: Request object for a get user request.
    properties:
      userId:
        type: string
        description: The ID of the user to get information about. If it is not included, it defaults to the user making the request.
  GetUserResponse:
    type: object
    description: Response object for a get user request.
    required:
      - user
    properties:
      user:
        $ref: '#/definitions/User'
        description: Information about the user.
  ListUsersRequest:
    type: object
    description: Request object for a list users request.
    properties:
      userIds:
        type: array
        items:
          type: string
        description: The user IDs or CRNs of the users.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 500
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListUsersResponse:
    type: object
    description: Response object for a list users request.
    required:
      - users
    properties:
      users:
        type: array
        items:
          $ref: '#/definitions/User'
        x-paging-result: true
        description: The users.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  CreateUserAccessKeyRequest:
    type: object
    description: Request object for a create user access key request.
    properties:
      user:
        type: string
        description: The ID or CRN of the user to whom this access key will be associated. If it is not included, it defaults to the user making the request.
      type:
        $ref: '#/definitions/AccessKeyType'
        description: The version of an access key to create.
  CreateUserAccessKeyResponse:
    type: object
    description: Response object for a create user access key request.
    required:
      - accessKey
      - privateKey
    properties:
      accessKey:
        $ref: '#/definitions/AccessKey'
        description: The access key that was created.
      privateKey:
        type: string
        description: The private key associated with this access key. This string is the contents of a PEM file containing a PKCS#8 private key.
        x-sensitive: true
  CreateMachineUserAccessKeyRequest:
    type: object
    description: Request object for a create machine user access key request.
    required:
      - machineUserName
    properties:
      machineUserName:
        type: string
        description: The name or CRN of the machine user to whom this access key will be associated.
      type:
        $ref: '#/definitions/AccessKeyType'
        description: The version of an access key to create.
  CreateMachineUserAccessKeyResponse:
    type: object
    description: Response object for a create machine user access key request.
    required:
      - accessKey
      - privateKey
    properties:
      accessKey:
        $ref: '#/definitions/AccessKey'
        description: The access key that was created.
      privateKey:
        type: string
        description: The private key associated with this access key. This string is the contents of a PEM file containing a PKCS#8 private key.
        x-sensitive: true
  DeleteAccessKeyRequest:
    type: object
    description: Request object for a delete access key request.
    required:
      - accessKeyId
    properties:
      accessKeyId:
        type: string
        description: The ID of the access key.
  DeleteAccessKeyResponse:
    type: object
    description: Response object for a delete access key request.
  UpdateAccessKeyRequest:
    type: object
    description: Request object for an update access key request.
    required:
      - accessKeyId
      - status
    properties:
      accessKeyId:
        type: string
        description: The ID of the access key to update.
      status:
        type: string
        description: The status to assign to the access key.
        enum:
          - ACTIVE
          - INACTIVE
  UpdateAccessKeyResponse:
    type: object
    description: Response object for an update access key request.
    required:
      - accessKey
    properties:
      accessKey:
        $ref: '#/definitions/AccessKey'
        description: The access key that was updated.
  GetAccessKeyRequest:
    type: object
    description: Request object for a get access key request.
    properties:
      accessKeyId:
        type: string
        description: The ID of the access key to get information about. If it is not included, it defaults to the access key used to make the request.
  GetAccessKeyResponse:
    type: object
    description: Response object for a get access key request.
    required:
      - accessKey
    properties:
      accessKey:
        $ref: '#/definitions/AccessKey'
        description: Information about the access key.
  ListAccessKeysRequest:
    type: object
    description: Request object for a list access keys request.
    properties:
      accessKeyIds:
        type: array
        items:
          type: string
        description: The access key IDs or CRNs of the access keys.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 500
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListAccessKeysResponse:
    type: object
    description: Response object for a list access keys request.
    required:
      - accessKeys
    properties:
      accessKeys:
        type: array
        items:
          $ref: '#/definitions/AccessKey'
        x-paging-result: true
        description: The access keys.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  CreateSamlProviderRequest:
    type: object
    description: Request object for creating SAML provider request.
    required:
      - samlProviderName
    properties:
      samlProviderName:
        type: string
        description: The name of SAML provider. The name must be unique, must have a maximum of 128 characters, and must contain only alphanumeric characters, "-" and "_". Names are are not case-sensitive.
      samlMetadataDocument:
        type: string
        description: SAML metadata document XML file. Length of meta data document cannot be more than 200 KB (200,000 bytes).
        maxLength: 200000
      syncGroupsOnLogin:
        type: boolean
        description: Whether to sync group information for users federated with this SAML provider. Group membership can be passed using the https://cdp.cloudera.com/SAML/Attributes/groups SAML assertion. The default is to synchronize group membership.
      generateWorkloadUsernameByEmail:
        type: boolean
        description: Whether to generate users' workload username by email . The default is to generate workload usernames by identity provider user ID (SAML NameID).
      enableScim:
        type: boolean
        description: Whether to enable SCIM on this SAML provider. System for Cross-domain Identity Management (SCIM) version 2.0 is a standard for automating the provisioning of user and group identity information from identity provider to CDP. It is not supported for Cloudera for Government.
        x-form-factors: public
  CreateSamlProviderResponse:
    type: object
    description: Response object for a creating SAML provider request.
    required:
      - samlProvider
    properties:
      samlProvider:
        $ref: '#/definitions/SamlProvider'
        description: The SAML provider.
  DeleteSamlProviderRequest:
    type: object
    description: Request object for deleting SAML provider request.
    required:
      - samlProviderName
    properties:
      samlProviderName:
        type: string
        description: The name or CRN of the SAML provider to delete.
  DeleteSamlProviderResponse:
    type: object
    description: Response object for delete SAML provider request.
  ListSamlProvidersRequest:
    type: object
    description: Request object for a list SAML providers request.
    properties:
      samlProviderNames:
        type: array
        description: The SAML providers names or CRNs to retrieve. If empty all SAML providers will be returned.
        items:
          type: string
          description: The SAML providers names or CRNs to retrieve. If empty all SAML providers will be returned.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListSamlProvidersResponse:
    type: object
    description: Response object for a list SAML providers request.
    required:
      - samlProviders
    properties:
      samlProviders:
        type: array
        items:
          $ref: '#/definitions/SamlProvider'
        x-paging-result: true
        description: The SAML providers.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  DescribeSamlProviderRequest:
    type: object
    description: Request object for a describe SAML provider request.
    required:
      - samlProviderName
    properties:
      samlProviderName:
        type: string
        description: The name or CRN of the SAML provider to describe.
  DescribeSamlProviderResponse:
    type: object
    description: Response object for a describe SAML request.
    required:
      - samlProvider
    properties:
      samlProvider:
        $ref: '#/definitions/SamlProvider'
        description: The SAML provider.
  UpdateSamlProviderRequest:
    type: object
    description: Request object for an updating SAML provider request.
    required:
      - samlProviderName
    properties:
      samlProviderName:
        type: string
        description: The name or CRN of SAML provider to update.
      samlMetadataDocument:
        type: string
        description: SAML metadata document XML file. Length of meta data document cannot be more than 200 KB (200,000 bytes). Can be omitted if no update is required.
        maxLength: 200000
      syncGroupsOnLogin:
        type: boolean
        description: Whether to sync group information for users federated with this SAML provider. Group membership can be passed using the https://cdp.cloudera.com/SAML/Attributes/groups SAML assertion. The default is to synchronize group membership. Can be omitted if no update is required.
      generateWorkloadUsernameByEmail:
        type: boolean
        description: Whether to generate users' workload username by email. The default is to generate workload usernames by identity provider user ID (SAML NameID).
      enableScim:
        type: boolean
        description: Whether to enable SCIM on this SAML provider. System for Cross-domain Identity Management (SCIM) version 2.0 is a standard for automating the provisioning of user and group identity information from identity provider to CDP. It is not supported for Cloudera for Government.
        x-form-factors: public
  UpdateSamlProviderResponse:
    type: object
    description: Response object for an updating SAML provider request.
    required:
      - samlProvider
    properties:
      samlProvider:
        $ref: '#/definitions/SamlProvider'
        description: The SAML provider.
  ListRolesRequest:
    type: object
    description: Request object for a list roles request.
    properties:
      roleNames:
        type: array
        items:
          type: string
        description: The roles names or CRNs to retrieve. If empty all roles will be returned.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListRolesResponse:
    type: object
    description: Response object for a list roles request.
    required:
      - roles
    properties:
      roles:
        type: array
        items:
          $ref: '#/definitions/Role'
        x-paging-result: true
        description: The list of roles in the account.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  ListResourceRolesRequest:
    type: object
    description: Request object for a list resource roles request.
    properties:
      resourceRoleNames:
        type: array
        items:
          type: string
        description: The resource roles CRNs to retrieve. If empty all resource roles will be returned.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListResourceRolesResponse:
    type: object
    description: Response object for a list resource roles request.
    required:
      - resourceRoles
    properties:
      resourceRoles:
        type: array
        items:
          $ref: '#/definitions/ResourceRole'
        x-paging-result: true
        description: The list of resource roles. Cannot be empty.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  SetAccountMessagesRequest:
    type: object
    description: Request object for set account messages for account.
    properties:
      contactYourAdministratorMessage:
        type: string
        description: Message shown to user when user does not have sufficient rights. Length of message cannot be more than 512 characters. If string is empty, default message is displayed.
  SetAccountMessagesResponse:
    type: object
    description: Response object for set account messages.
  GetAccountMessagesRequest:
    type: object
    description: Request object for get account messages.
  GetAccountMessagesResponse:
    type: object
    description: Response object for get account messages.
    properties:
      contactYourAdministratorMessage:
        type: string
        description: Message shown to user when user does not have sufficient rights.
  AssignUserRoleRequest:
    type: object
    description: Request object for an assign user role request.
    required:
      - user
      - role
    properties:
      user:
        type: string
        description: The user the role is assigned to. Can be the user's CRN or id.
      role:
        type: string
        description: The role to assign to the user. Can be the role's CRN or name.
  AssignUserRoleResponse:
    type: object
    description: Response object for an assign user role request.
  UnassignUserRoleRequest:
    type: object
    description: Request object for an unassign user role request.
    required:
      - user
      - role
    properties:
      user:
        type: string
        description: The user to unassigned the roles from. Can be the user CRN or id.
      role:
        type: string
        description: The role to unassigned from the user. Can be the role's CRN or name.
  UnassignUserRoleResponse:
    type: object
    description: Response object for an unassign user role request.
  AssignUserResourceRoleRequest:
    type: object
    description: Request object for an assign user resource role request.
    required:
      - user
      - resourceRoleCrn
      - resourceCrn
    properties:
      user:
        type: string
        description: The user to assign the resource role to. Can be the user's CRN or id.
      resourceRoleCrn:
        type: string
        description: The CRN of the resource role to assign to the user.
      resourceCrn:
        type: string
        description: The resource for which the resource role rights are granted.
  AssignUserResourceRoleResponse:
    type: object
    description: Response object for an assign user resource role request.
  UnassignUserResourceRoleRequest:
    type: object
    description: Request object for an unassign user role request.
    required:
      - user
      - resourceRoleCrn
      - resourceCrn
    properties:
      user:
        type: string
        description: The user to unassign the resource role from.
      resourceRoleCrn:
        type: string
        description: The CRN of the resource role to unassigned from the user.
      resourceCrn:
        type: string
        description: The CRN of the resource for which the resource role rights will be unassigned.
  UnassignUserResourceRoleResponse:
    type: object
    description: Response object for an unassign user role request.
  ListUserAssignedRolesRequest:
    type: object
    description: Request object for a list user assigned roles request.
    properties:
      user:
        type: string
        description: The user to list the assigned roles for. Can be the user's CRN or id. If it is not included, it defaults to the user making the request.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListUserAssignedRolesResponse:
    type: object
    description: Response object for a list user assigned roles request.
    required:
      - roleCrns
    properties:
      roleCrns:
        type: array
        items:
          type: string
        x-paging-result: true
        description: The role CRNs assigned to the user.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  ListUserAssignedResourceRolesRequest:
    type: object
    description: Request object for a list user assigned resource roles request.
    properties:
      user:
        type: string
        description: The user to list the assigned roles for. Can be the user's CRN or id. If it is not included, it defaults to the user making the request.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListUserAssignedResourceRolesResponse:
    type: object
    description: Response object for a list user assigned roles request.
    required:
      - resourceAssignments
    properties:
      resourceAssignments:
        type: array
        items:
          $ref: '#/definitions/ResourceAssignment'
        x-paging-result: true
        description: The user's resource assignments.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  AssignMachineUserRoleRequest:
    type: object
    description: Request object for an assign machine user role request.
    required:
      - machineUserName
      - role
    properties:
      machineUserName:
        type: string
        description: The machine user the role is assigned to. Can be the machine user's name or CRN.
      role:
        type: string
        description: The role to assign to the machine user. Can be the role's name or CRN.
  AssignMachineUserRoleResponse:
    type: object
    description: Response object for an assign machine user role request.
  UnassignMachineUserRoleRequest:
    type: object
    description: Request object for an unassign machine user role request.
    required:
      - machineUserName
      - role
    properties:
      machineUserName:
        type: string
        description: The machine user to unassigned the roles from. Can be the machine user's name or CRN.
      role:
        type: string
        description: The role to unassigned from the user. Can be the role's name or CRN.
  UnassignMachineUserRoleResponse:
    type: object
    description: Response object for an unassign machine user role request.
  AssignMachineUserResourceRoleRequest:
    type: object
    description: Request object for an assign machine user resource role request.
    required:
      - machineUserName
      - resourceRoleCrn
      - resourceCrn
    properties:
      machineUserName:
        type: string
        description: The machine user to assign the resource role to. Can be the machine user's name or CRN.
      resourceRoleCrn:
        type: string
        description: The CRN of the resource role to assign to the machine user.
      resourceCrn:
        type: string
        description: The resource for which the resource role rights are granted.
  AssignMachineUserResourceRoleResponse:
    type: object
    description: Response object for an assign machine user resource role request.
  UnassignMachineUserResourceRoleRequest:
    type: object
    description: Request object for an unassign machine user role request.
    required:
      - machineUserName
      - resourceRoleCrn
      - resourceCrn
    properties:
      machineUserName:
        type: string
        description: The machine user to unassign the resource role from. Can be the machine user's name or CRN.
      resourceRoleCrn:
        type: string
        description: The CRN of the resource role to unassigned from the machine user.
      resourceCrn:
        type: string
        description: The CRN of the resource for which the resource role rights will be unassigned.
  UnassignMachineUserResourceRoleResponse:
    type: object
    description: Response object for an unassign machine user role request.
  ListMachineUserAssignedRolesRequest:
    type: object
    description: Request object for a list machine user assigned roles request.
    required:
      - machineUserName
    properties:
      machineUserName:
        type: string
        description: The machine user to list the assigned roles for. Can be the machine user's name or CRN.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListMachineUserAssignedRolesResponse:
    type: object
    description: Response object for a list machine user assigned roles request.
    required:
      - roleCrns
    properties:
      roleCrns:
        type: array
        items:
          type: string
        x-paging-result: true
        description: The role CRNs assigned to the user.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  ListMachineUserAssignedResourceRolesRequest:
    type: object
    description: Request object for a list machine user assigned resource roles request.
    required:
      - machineUserName
    properties:
      machineUserName:
        type: string
        description: The machine user to list the assigned resource roles for. Can be the machine user's name or CRN.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListMachineUserAssignedResourceRolesResponse:
    type: object
    description: Response object for a list machine user assigned roles request.
    required:
      - resourceAssignments
    properties:
      resourceAssignments:
        type: array
        items:
          $ref: '#/definitions/ResourceAssignment'
        x-paging-result: true
        description: The user's resource assignments.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  ListResourceAssigneesRequest:
    type: object
    description: Request object for a list resource assignees request.
    required:
      - resourceCrn
    properties:
      resourceCrn:
        type: string
        description: The resource CRN for which to list the assignees.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListResourceAssigneesResponse:
    type: object
    description: Response object for a list resource assignees request.
    required:
      - resourceAssignees
    properties:
      resourceAssignees:
        type: array
        items:
          $ref: '#/definitions/ResourceAssignee'
        x-paging-result: true
        description: List of resource assignees and their respective resource roles for the resource.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  CreateMachineUserRequest:
    type: object
    description: Request object for create machine user request.
    required:
      - machineUserName
    properties:
      machineUserName:
        type: string
        description: The name to use for the new machine user. The name must be an alpha numeric string, including '-' and '_', cannot start with '__' (double underscore) and cannot be longer than 128 characters. Only one machine user with this name can exist in an account at a given time.
  CreateMachineUserResponse:
    type: object
    description: Response object for create machine user request.
    required:
      - machineUser
    properties:
      machineUser:
        $ref: '#/definitions/MachineUser'
        description: Information about the machine user.
  ListMachineUsersRequest:
    type: object
    description: Request object for a list machine users request.
    properties:
      machineUserNames:
        type: array
        items:
          type: string
        description: The names or the CRNs of the machine users. If not provided all machine users for the account are retrieved.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListMachineUsersResponse:
    type: object
    description: Response object for a list machine users request.
    required:
      - machineUsers
    properties:
      machineUsers:
        type: array
        items:
          $ref: '#/definitions/MachineUser'
        x-paging-result: true
        description: The machine users.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  DeleteMachineUserRequest:
    type: object
    description: Request object for delete machine user request.
    required:
      - machineUserName
    properties:
      machineUserName:
        type: string
        description: The name or CRN of the machine user to delete.
  DeleteMachineUserResponse:
    type: object
    description: Response object for delete machine user request.
    required:
      - accessKeysDeleted
      - groupsModified
      - rolesUnassigned
      - resourcesUnassigned
    properties:
      accessKeysDeleted:
        type: array
        items:
          type: string
        description: The list of associated access key CRNs that were deleted.
      groupsModified:
        type: array
        items:
          type: string
        description: The list of group CRNs from which the machine user has been removed.
      rolesUnassigned:
        type: array
        items:
          type: string
        description: The list of role CRNs unassigned from the machine user.
      resourcesUnassigned:
        type: array
        items:
          $ref: '#/definitions/ResourceAssignment'
        description: The list of resource role assignments that have been unassigned from the machine user.
  CreateGroupRequest:
    type: object
    description: Request object for create group request.
    required:
      - groupName
    properties:
      groupName:
        type: string
        description: The name of the group. This name must be unique. There are certain restrictions on the group name. Refer to the How To > User Management section in the Management Console documentation for the details.
      syncMembershipOnUserLogin:
        x-nullable: true
        type: boolean
        description: Whether group membership is synced when a user logs in. The default is to sync group membership.
  CreateGroupResponse:
    type: object
    description: Response object for create group request.
    required:
      - group
    properties:
      group:
        $ref: '#/definitions/Group'
        description: Information about the group.
  DeleteGroupRequest:
    type: object
    description: Request object for delete group request.
    required:
      - groupName
    properties:
      groupName:
        type: string
        description: The name or CRN of the group to delete.
  DeleteGroupResponse:
    type: object
    description: Response object for delete group request.
  ListGroupsRequest:
    type: object
    description: Request object for a list groups request.
    properties:
      groupNames:
        type: array
        items:
          type: string
        description: The group names or CRNs of the groups. If not provided, all groups in the account are retrieved.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListGroupsResponse:
    type: object
    description: Response object for a list groups request.
    required:
      - groups
    properties:
      groups:
        type: array
        items:
          $ref: '#/definitions/Group'
        x-paging-result: true
        description: The list of groups.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  UpdateGroupRequest:
    type: object
    description: Request object for update group request.
    required:
      - groupName
    properties:
      groupName:
        type: string
        description: The name or CRN of the group to update.
      syncMembershipOnUserLogin:
        type: boolean
        description: Whether group membership is synced when a user logs in. Can be omitted if no update is required.
  UpdateGroupResponse:
    type: object
    description: Response object for update group request.
    required:
      - group
    properties:
      group:
        $ref: '#/definitions/Group'
        description: Information about the updated group.
  AddUserToGroupRequest:
    type: object
    description: Request object for an add user to group request.
    required:
      - userId
      - groupName
    properties:
      userId:
        type: string
        description: The ID or CRN of the user to add to the group.
      groupName:
        type: string
        description: The name or CRN of the group to add the user to.
  AddUserToGroupResponse:
    type: object
    description: Response object for an add user to group request.
  AddMachineUserToGroupRequest:
    type: object
    description: Request object for an add machine user to group request.
    required:
      - machineUserName
      - groupName
    properties:
      machineUserName:
        type: string
        description: The name or CRN of the machine user to add to the group.
      groupName:
        type: string
        description: The name or CRN of the group to add the machine user to.
  AddMachineUserToGroupResponse:
    type: object
    description: Response object for add machine user to group request.
  RemoveUserFromGroupRequest:
    type: object
    description: Request object for a remove user from group request.
    required:
      - userId
      - groupName
    properties:
      userId:
        type: string
        description: The ID or CRN of the user to remove from the group.
      groupName:
        type: string
        description: The name or CRN of the group to remove the user from.
  RemoveUserFromGroupResponse:
    type: object
    description: Response object for a remove user from group request.
  RemoveMachineUserFromGroupRequest:
    type: object
    description: Request object for a remove machine user from group request.
    required:
      - machineUserName
      - groupName
    properties:
      machineUserName:
        type: string
        description: The name or CRN of the machine user to add to the group.
      groupName:
        type: string
        description: The name or CRN of the group to remove the machine user from.
  RemoveMachineUserFromGroupResponse:
    type: object
    description: Response object for a remove machine user from group request.
  ListGroupMembersRequest:
    type: object
    description: Request object for a list group members request.
    required:
      - groupName
    properties:
      groupName:
        type: string
        description: The name or CRN of the group to list the membership of.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListGroupMembersResponse:
    type: object
    description: Response object for a list group members request.
    required:
      - memberCrns
    properties:
      memberCrns:
        type: array
        items:
          type: string
        description: The list of group members.
        x-paging-result: true
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  ListGroupsForUserRequest:
    type: object
    description: Request object for a list groups for user request.
    required:
      - userId
    properties:
      userId:
        type: string
        description: The ID or CRN of the user to list the groups of.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListGroupsForUserResponse:
    type: object
    description: Response object for a list groups for user request.
    required:
      - groupCrns
    properties:
      groupCrns:
        type: array
        items:
          type: string
        x-paging-result: true
        description: The list of groups.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  ListGroupsForMachineUserRequest:
    type: object
    description: Request object for a list groups for machine user request.
    required:
      - machineUserName
    properties:
      machineUserName:
        type: string
        description: The name or CRN of the machine user to list the groups of.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListGroupsForMachineUserResponse:
    type: object
    description: Response object for a list groups for machine user request.
    required:
      - groupCrns
    properties:
      groupCrns:
        type: array
        items:
          type: string
        x-paging-result: true
        description: The list of groups.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  AssignGroupRoleRequest:
    type: object
    description: Request object for an assign group role request.
    required:
      - groupName
      - role
    properties:
      groupName:
        type: string
        description: The group to which the role is assigned to. Can be the group name or CRN.
      role:
        type: string
        description: The role being assigned to the group. Can be the role's CRN or name.
  AssignGroupRoleResponse:
    type: object
    description: Response object for an assign group role request.
  UnassignGroupRoleRequest:
    type: object
    description: Request object for an unassign group role request.
    required:
      - groupName
      - role
    properties:
      groupName:
        type: string
        description: The group to unassign the role from. Can be the group name or CRN.
      role:
        type: string
        description: The role to unassign from the group. Can be the role's CRN or name.
  UnassignGroupRoleResponse:
    type: object
    description: Response object for an unassign group role request.
  AssignGroupResourceRoleRequest:
    type: object
    description: Request object for an assign group resource role request.
    required:
      - groupName
      - resourceRoleCrn
      - resourceCrn
    properties:
      groupName:
        type: string
        description: The group to assign the resource role to. Can be the group's name or CRN.
      resourceRoleCrn:
        type: string
        description: The CRN of the resource role being assigned to the group.
      resourceCrn:
        type: string
        description: The resource for which the resource role rights are granted.
  AssignGroupResourceRoleResponse:
    type: object
    description: Response object for an assign group resource role request.
  UnassignGroupResourceRoleRequest:
    type: object
    description: Request object for an unassign group resource role request.
    required:
      - groupName
      - resourceRoleCrn
      - resourceCrn
    properties:
      groupName:
        type: string
        description: The group to unassign the resource role from.
      resourceRoleCrn:
        type: string
        description: The CRN of the resource role to unassign from the group.
      resourceCrn:
        type: string
        description: The CRN of the resource for which the resource role rights will be unassigned.
  UnassignGroupResourceRoleResponse:
    type: object
    description: Response object for an unassign group role request.
  ListGroupAssignedRolesRequest:
    type: object
    description: Request object for a list group assigned roles request.
    required:
      - groupName
    properties:
      groupName:
        type: string
        description: The group to list the assigned roles for. Can be the group's name or CRN.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListGroupAssignedRolesResponse:
    type: object
    description: Response object for a list group assigned roles request.
    required:
      - roleCrns
    properties:
      roleCrns:
        type: array
        items:
          type: string
        x-paging-result: true
        description: The role CRNs assigned to the group.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  ListGroupAssignedResourceRolesRequest:
    type: object
    description: Request object for a list group assigned resource roles request.
    required:
      - groupName
    properties:
      groupName:
        type: string
        description: The group to list the assigned resource roles for. Can be the group's name or CRN.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListGroupAssignedResourceRolesResponse:
    type: object
    description: Response object for a list group assigned resource roles request.
    required:
      - resourceAssignments
    properties:
      resourceAssignments:
        type: array
        items:
          $ref: '#/definitions/ResourceAssignment'
        x-paging-result: true
        description: The group's resource assignments.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  EnableClouderaSSOLoginRequest:
    type: object
    description: Request object for an enable Cloudera SSO login request.
  EnableClouderaSSOLoginResponse:
    type: object
    description: Response object for an enable Cloudera SSO login request.
  DisableClouderaSSOLoginRequest:
    type: object
    description: Request object for a disable Cloudera SSO login request.
  DisableClouderaSSOLoginResponse:
    type: object
    description: Response object for a disable Cloudera SSO login request.
  GetAccountRequest:
    type: object
    description: Request object for a get account request.
  GetAccountResponse:
    type: object
    description: Response object for a get account response.
    required:
      - account
    properties:
      account:
        $ref: '#/definitions/Account'
        description: The account object.
  CreateUserRequest:
    type: object
    description: Request object for creating user request.
    required:
      - identityProviderUserId
      - email
    properties:
      identityProviderUserId:
        type: string
        description: The identity provider user id for the user. This ID must match the NameId attribute value that will be passed for the user in the SAML response using the associated SAML provider.
      email:
        type: string
        description: The email address for the user. Used for display purposes only.
      samlProviderName:
        type: string
        description: The name or CRN of the SAML provider the user will use for login.
      groups:
        type: array
        items:
          type: string
        description: The list of groups the user belongs to. The groups will be created if they do not exist. There are certain restrictions on the group name. Refer to the How To > User Management section in the Management Console documentation for the details.
      firstName:
        type: string
        description: The user first name.
      lastName:
        type: string
        description: The user last name.
  CreateUserResponse:
    type: object
    description: Response object for a create user request.
    required:
      - user
    properties:
      user:
        $ref: '#/definitions/User'
        description: Information about the user.
  UpdateUserRequest:
    type: object
    description: Request object to update a user.
    required:
      - user
    properties:
      user:
        type: string
        description: The CRN or userId of the user to be updated.
      active:
        type: boolean
        description: The active state to which to set the user. When it is 'true', the user will be activated. When it is 'false' the user will be deactivated.
  UpdateUserResponse:
    type: object
    description: Response object to update a user.
    required:
      - user
    properties:
      user:
        $ref: '#/definitions/User'
        description: Information about the updated user.
  DeleteUserRequest:
    type: object
    description: Request object to delete a user.
    required:
      - userId
    properties:
      userId:
        type: string
        description: The ID or CRN of the user to delete.
  DeleteUserResponse:
    type: object
    description: Response object to delete a user.
    required:
      - accessKeysDeleted
      - groupsModified
      - rolesUnassigned
      - resourcesUnassigned
    properties:
      accessKeysDeleted:
        type: array
        items:
          type: string
        description: The list of associated access key CRNs that were deleted.
      groupsModified:
        type: array
        items:
          type: string
        description: The list of group CRNs from which the user has been removed.
      rolesUnassigned:
        type: array
        items:
          type: string
        description: The list of role CRNs unassigned from the user.
      resourcesUnassigned:
        type: array
        items:
          $ref: '#/definitions/ResourceAssignment'
        description: The list of resource role assignments that have been unassigned from the user.
  SetWorkloadPasswordRequest:
    type: object
    description: Request object for a set workload password request.
    required:
      - password
    properties:
      password:
        type: string
        description: The password value to set
        x-sensitive: true
      actorCrn:
        type: string
        description: The CRN of the user or machine user for whom the password will be set. If it is not included, it defaults to the user making the request.
  SetWorkloadPasswordResponse:
    type: object
    description: Response object for a set workload password request.
  PasswordPolicy:
    type: object
    description: An object representing password policy options.
    properties:
      maxPasswordLifetimeDays:
        type: integer
        format: int32
        minimum: 0
        description: The maximum lifetime of passwords, in days. If set to '0' passwords never expire. The default is 0.
      minPasswordLength:
        type: integer
        format: int32
        minimum: 6
        maximum: 256
        description: The minimum length of a password. Can be any number between 6 and 256. The default minimum password length is 8.
      mustIncludeUpperCaseCharacters:
        type: boolean
        description: Whether passwords must include upper case characters. The default is 'true'.
      mustIncludeLowerCaseCharacters:
        type: boolean
        description: Whether passwords must include lower case characters. The default is 'true'.
      mustIncludeNumbers:
        type: boolean
        description: Whether passwords must include numbers. The default is 'true'.
      mustIncludeSymbols:
        type: boolean
        description: Whether passwords must include symbols. The symbols are '#', '&', '*', '$', '%', '@', '^', '.', '_', and '!'. The default is 'true'.
      minPasswordLifetimeDays:
        type: integer
        format: int32
        minimum: 0
        description: The minimum lifetime of passwords, in days. The password must be used for this duration before it can be changed. If set to '0' the password may be changed any time. The default is 0. The minPasswordLifetimeDays must be greater than maxPasswordLifetimeDays.
      passwordHistorySize:
        type: integer
        format: int32
        minimum: 0
        maximum: 20
        description: The number of previous passwords that should be remembered. The user or machine user is prevented from reusing these passwords. Can be any number between 0 and 20. The default is 0, this value means all previous passwords may be reused.
  SetWorkloadPasswordPolicyRequest:
    type: object
    description: Request object for a set workload password policy request.
    properties:
      globalPasswordPolicy:
        $ref: '#/definitions/PasswordPolicy'
        description: The global password policy object. If set, maxPasswordLifetimeDays is ignored, and if not set the default values for the different password policies are used. See PasswordPolicy for more details on the different default values.
      machineUsersPasswordPolicy:
        $ref: '#/definitions/PasswordPolicy'
        description: The password policy object for machine users. If set, this will be used for enforcing password complexity for machine users instead of the global password policy.
  SetWorkloadPasswordPolicyResponse:
    type: object
    description: Response object for a set workload password policy request.
  UnsetWorkloadPasswordMinLifetimeRequest:
    type: object
    description: Request object for a unset workload password min lifetime request.
    required:
      - actorCrn
    properties:
      actorCrn:
        type: string
        description: The CRN of the actor for whom to unset the workload password minimum lifetime date.
  UnsetWorkloadPasswordMinLifetimeResponse:
    type: object
    description: Response object for an unset workload password minimum lifetime request.
  UnsetWorkloadPasswordPolicyRequest:
    type: object
    description: Request object for a unset workload password policy request.
    properties:
      unsetGlobalPasswordPolicy:
        type: boolean
        description: Whether to unset the global password policy. This will reset the global policy to its defaults.
      unsetMachineUsersPasswordPolicy:
        type: boolean
        description: Whether to unset the machine user password policy, if one exists.
  UnsetWorkloadPasswordPolicyResponse:
    type: object
    description: Response object for a unset workload password policy request.
  AddSshPublicKeyRequest:
    type: object
    description: Request object for add user ssh public key.
    required:
      - publicKey
    properties:
      publicKey:
        type: string
        description: The RSA or ED25519 public ssh key to add. DSA and ECDSA public keys are not supported. The public key should be in RFC4253 format. (e.g. ssh-rsa AAAAB3NzaC1yc2EAAA.. user@host) as produced, for example, by ssh-keygen.
      actorCrn:
        type: string
        description: The CRN of the user or machine user for whom the SSH public key will be added. If it is not included, it defaults to the user making the request.
      description:
        type: string
        description: An optional description for the public key.
  AddSshPublicKeyResponse:
    type: object
    description: Response object for add ssh public key.
    required:
      - sshPublicKey
    properties:
      sshPublicKey:
        $ref: '#/definitions/SshPublicKey'
        description: Information about the SSH public key.
  ListSshPublicKeysRequest:
    type: object
    description: Request object for list SSH public key.
    properties:
      actorCrn:
        type: string
        description: The CRN of the user or machine user to list SSH public keys for. If it is not included, it defaults to the actor making the request.
  ListSshPublicKeysResponse:
    type: object
    description: Response object for list SSH public key.
    required:
      - sshPublicKeys
    properties:
      sshPublicKeys:
        type: array
        items:
          $ref: '#/definitions/SshPublicKey'
        description: The list of SSH Public keys.
  DescribeSshPublicKeyRequest:
    type: object
    description: Request object for describe SSH public key.
    required:
      - crnOrFingerprint
    properties:
      crnOrFingerprint:
        type: string
        description: The SSH public key CRN or its SHA256 fingerprint.
      actorCrn:
        type: string
        description: The CRN of the user or machine user that the SSH public key belongs to. If it is not included, it defaults to the actor making the request.
  DescribeSshPublicKeyResponse:
    type: object
    description: Response object for describe user SSH public key.
    required:
      - sshPublicKey
    properties:
      sshPublicKey:
        $ref: '#/definitions/SshPublicKey'
        description: Information about the SSH public key.
  DeleteSshPublicKeyRequest:
    type: object
    description: Request object for delete SSH public key.
    required:
      - crnOrFingerprint
    properties:
      crnOrFingerprint:
        type: string
        description: The SSH public key CRN or the keys SHA256 fingerprint to remove.
      actorCrn:
        type: string
        description: The CRN of the user or machine user that the SSH public key belongs to. If it is not included, it defaults to the actor making the request.
  DeleteSshPublicKeyResponse:
    type: object
    description: Response object for delete SSH public key.
  UpdateLdapProviderRequest:
    type: object
    description: Update LDAP Provider for account.
    x-form-factors: private
    required:
      - ldapProviderName
      - url
      - userSearchBase
      - userSearchFilter
      - groupSearchBase
      - groupSearchFilter
      - usernameMappingAttribute
    properties:
      ldapProviderName:
        type: string
        description: The name or CRN of LDAP provider to update.
      url:
        type: string
        description: The URL of the LDAP server. The URL must be prefixed with ldap:// or ldaps://. The URL can optionally specify a custom port, for example ldaps://ldap.example.org:663.
      userSearchBase:
        type: string
        description: Part of the directory tree under which to search for users. For example, ou=users,dc=example,dc=org.
      userSearchFilter:
        type: string
        description: The search filter to use for finding users. For example, (uid={{username}}).
      groupSearchBase:
        type: string
        description: The distinguished name indicating the path within the directory information tree to begin user searches from. For example, ou=groups,dc=example,dc=com.
      groupSearchFilter:
        type: string
        description: The search filter to use for finding groups for authorization of authenticated users.
      usernameMappingAttribute:
        type: string
        description: The LDAP displayName attribute name, will be used as the user's name. For example, uid, sAMAccountName.
      bindDn:
        type: string
        description: Bind DN. For example, uid=myapp,ou=users,dc=example,dc=org.Optional. It is required if bind is not anonymous.
      bindPassword:
        type: string
        description: The password of the bind user.
        x-sensitive: true
      userBindProperty:
        type: string
        description: Property of the LDAP user object to use when binding to verify the password. For example, dn.
      groupDnProperty:
        type: string
        description: The property of user object to use in {{dn}} interpolation of groupSearchFilter.
      emailMappingAttribute:
        type: string
        description: The LDAP email attribute name, will be used as the user's email. For example, mail.
      firstNameMappingAttribute:
        type: string
        description: The LDAP attribute used as firstname , will be used as the user's firstname. For example, givenName.
      lastNameMappingAttribute:
        type: string
        description: The LDAP sn attribute name, will be used as the user's lastname. For example, sn.
      groupNameMappingAttribute:
        type: string
        description: The LDAP group attribute name, will be used for user's group. For example, cn, name.
      tlsCaCertificates:
        type: array
        items:
          type: string
        description: If the ldaps:// server uses a self-signed SSL certificate or a certificate issued by a private Certificate Authority (CA), you need to provide the trusted certificates that can be used to validate the LDAP server certificate.
        x-sensitive: true
      skipGroupSyncOnLogin:
        type: boolean
        description: Whether to skip syncing groups.
      startTls:
        type: boolean
        description: Whether a start TLS request should be initiated on connect.
  UpdateLdapProviderResponse:
    type: object
    description: Update LDAP provider response
    x-form-factors: private
    required:
      - ldapProvider
    properties:
      ldapProvider:
        description: The updated LDAP identity provider connector configuration details.
        $ref: '#/definitions/LdapProvider'
  CreateLdapProviderRequest:
    type: object
    description: Create an LDAP Provider for account.
    x-form-factors: private
    required:
      - ldapProviderName
      - url
      - userSearchBase
      - userSearchFilter
      - groupSearchBase
      - groupSearchFilter
      - usernameMappingAttribute
    properties:
      ldapProviderName:
        type: string
        description: The name of LDAP provider to create.
      url:
        type: string
        description: The URL of the LDAP server. The URL must be prefixed with ldap:// or ldaps://. The URL can optionally specify a custom port, for example ldaps://ldap.example.org:663.
      userSearchBase:
        type: string
        description: Part of the directory tree under which to search for users. For example, ou=users,dc=example,dc=org.
      userSearchFilter:
        type: string
        description: The search filter to use for finding users. For example, (uid={{username}}).
      groupSearchBase:
        type: string
        description: The distinguished name indicating the path within the directory information tree to begin user searches from. For example, ou=groups,dc=example,dc=com.
      groupSearchFilter:
        type: string
        description: The search filter to use for finding groups for authorization of authenticated users.
      usernameMappingAttribute:
        type: string
        description: The LDAP displayName attribute name, will be used as the user's name. For example, uid, sAMAccountName.
      bindDn:
        type: string
        description: Bind DN. For example, uid=myapp,ou=users,dc=example,dc=org. Optional. Required if bind is not anonymous.
      bindPassword:
        type: string
        description: The password of the bind user.
        x-sensitive: true
      userBindProperty:
        type: string
        description: Property of the LDAP user object to use when binding to verify the password. For example, dn.
      groupDnProperty:
        type: string
        description: The property of user object to use in {{dn}} interpolation of groupSearchFilter.
      emailMappingAttribute:
        type: string
        description: The LDAP email attribute name, will be used as the user's email. For example, mail.
      firstNameMappingAttribute:
        type: string
        description: The LDAP attribute used as firstname , will be used as the user's firstname. For example, givenName.
      lastNameMappingAttribute:
        type: string
        description: The LDAP sn attribute name, will be used as the user's lastname. For example, sn.
      groupNameMappingAttribute:
        type: string
        description: The LDAP group attribute name, will be used as for user's group. For example, cn, name.
      tlsCaCertificates:
        type: array
        items:
          type: string
        description: If the ldaps:// server uses a self-signed SSL certificate or a certificate issued by a private Certificate Authority (CA), then provide the trusted certificates that can be used to validate the LDAP server certificate.
        x-sensitive: true
      skipGroupSyncOnLogin:
        type: boolean
        description: Whether to skip group sync.
      startTls:
        type: boolean
        description: Whether a start TLS request should be initiated on connecting to ldap.
  CreateLdapProviderResponse:
    type: object
    description: Create LDAP provider response
    x-form-factors: private
    required:
      - ldapProvider
    properties:
      ldapProvider:
        description: The created LDAP identity provider connector configuration details.
        $ref: '#/definitions/LdapProvider'
  LdapProvider:
    type: object
    description: LDAP Provider details.
    x-private: true
    required:
      - identityProviderConnectorId
      - ldapProviderName
      - crn
      - creationDate
      - skipGroupSyncOnLogin
    properties:
      identityProviderConnectorId:
        type: string
        description: The unique ID of the LDAP provider.
      ldapProviderName:
        type: string
        description: Name of the LDAP provider connector.
      crn:
        type: string
        description: The LDAP provider connector CRN.
      skipGroupSyncOnLogin:
        type: boolean
        description: Indicates whether group sync is skipped or not.
      creationDate:
        type: integer
        format: int64
        description: The creation date in ms from the java epoch of 1970-01-01T00:00:00Z.
      ldapDetails:
        description: The updated LDAP identity provider connector configuration detail. This will be empty in listLdapProvidersResponse.
        $ref: '#/definitions/LdapProviderInfo'
  LdapProviderInfo:
    type: object
    description: Information about an LDAP provider connector.
    x-private: true
    required:
      - url
      - userSearchBase
      - userSearchFilter
      - groupSearchBase
      - groupSearchFilter
    properties:
      url:
        type: string
        description: The URL of the LDAP server.
      userSearchBase:
        type: string
        description: Part of the directory tree under which to search for users.
      userSearchFilter:
        type: string
        description: The search filter to use for finding users.
      groupSearchBase:
        type: string
        description: Part of the directory tree under which group searches should be performed.
      groupSearchFilter:
        type: string
        description: Filter which is used to search for group membership.
      bindDn:
        type: string
        description: Bind DN.
      userBindProperty:
        type: string
        description: Property of the LDAP user object to use when binding to the LDAP directory.
      groupDnProperty:
        type: string
        description: The property of user object to use in {{dn}} interpolation of groupSearchFilter.
      usernameMappingAttribute:
        type: string
        description: The LDAP displayName attribute name, will be used as the user's name.
      emailMappingAttribute:
        type: string
        description: The LDAP email attribute name, will be used as the user's email.
      firstNameMappingAttribute:
        type: string
        description: The LDAP attribute used as firstname , will be used as the user's firstname.
      lastNameMappingAttribute:
        type: string
        description: The LDAP sn attribute name, will be used as the user's lastname.
      groupNameMappingAttribute:
        type: string
        description: The LDAP group attribute name, will be used as for user's group.
      tlsCaCertificates:
        type: array
        items:
          type: string
        description: If your ldaps:// server uses a self-signed SSL certificate or a certificate issued by a private Certificate Authority (CA), you need to provide the trusted certificates that can be used to validate the LDAP server certificate.
        x-sensitive: true
      startTls:
        type: boolean
        description: Indicates whether a start TLS request should be initiated on connect.
  GetDefaultIdentityProviderRequest:
    type: object
    description: Request object to get the default identity provider.
  GetDefaultIdentityProviderResponse:
    type: object
    description: Response object to get the default identity provider.
    required:
      - crn
    properties:
      crn:
        type: string
        description: The CRN of the identity provider used for CDP initiated login requests. The CRN could be a user defined identity provider's CRN or one of the CDP built-ins (like Cloudera SSO). To retrieve more information about your own user-defined saml providers (or other provider types, not the default ones) call the relevant describeXXXProvider, e.g. for SAML providers call describeSamlProvider.
  SetDefaultIdentityProviderRequest:
    type: object
    description: Request object to set the default identity provider.
    required:
      - nameOrCrn
    properties:
      nameOrCrn:
        type: string
        description: The name or CRN of the default identity provider.
  SetDefaultIdentityProviderResponse:
    type: object
    description: Response object to set the default identity provider.
  GenerateWorkloadAuthTokenRequest:
    type: object
    description: Request object for GenerateWorkloadAuthToken method.
    required:
      - workloadName
    properties:
      workloadName:
        description: The workload name
        $ref: '#/definitions/WorkloadName'
      environmentCrn:
        type: string
        description: The environment CRN, required by DF.
      excludeGroups:
        type: boolean
        description: Whether to exclude 'groups' claim from the token.
        x-form-factors: private
  GenerateWorkloadAuthTokenResponse:
    type: object
    description: Response object for GenerateWorkloadAuthToken method.
    properties:
      endpointUrl:
        type: string
        description: The workload endpoint URL
      token:
        type: string
        description: The authentication token
        x-sensitive: true
      expireAt:
        type: string
        format: date-time
        description: When the information should expire
  WorkloadName:
    type: string
    description: The workload name.
    enum:
      - DE
      - DF
      - OPDB
  CreateScimAccessTokenRequest:
    type: object
    description: Request object to create the SCIM access token.
    required:
      - identityProviderNameOrCrn
      - accessTokenLifetimeDays
    properties:
      identityProviderNameOrCrn:
        type: string
        description: The name or CRN of the SCIM enabled identity provider.
      accessTokenLifetimeDays:
        type: integer
        format: int32
        minimum: 1
        description: The lifetime, in days, of the access token.
  CreateScimAccessTokenResponse:
    type: object
    description: Response object to create the SCIM access token.
    required:
      - accessToken
      - accessTokenSecret
    properties:
      accessToken:
        $ref: '#/definitions/ScimAccessToken'
        description: The SCIM access token that was created.
      accessTokenSecret:
        type: string
        description: The SCIM access token secret. This secret could be used to authenticate requests sent to SCIM endpoints.
        x-sensitive: true
  ListScimAccessTokensRequest:
    type: object
    description: Request object to list the SCIM access tokens.
    required:
      - identityProviderNameOrCrn
    properties:
      identityProviderNameOrCrn:
        type: string
        description: The name or CRN of the identity provider.
      pageSize:
        type: integer
        format: int32
        minimum: 1
        maximum: 100
        x-paging-page-size: true
        description: The size of each page.
      startingToken:
        type: string
        x-paging-input-token: true
        description: A token to specify where to start paginating. This is the nextToken from a previously truncated response.
  ListScimAccessTokensResponse:
    type: object
    description: Response object to list the SCIM access tokens.
    required:
      - accessTokens
    properties:
      accessTokens:
        type: array
        items:
          $ref: '#/definitions/ScimAccessToken'
        x-paging-result: true
        description: The SCIM access tokens.
      nextToken:
        type: string
        x-paging-output-token: true
        description: The token to use when requesting the next set of results. If not present, there are no additional results.
  DeleteScimAccessTokenRequest:
    type: object
    description: Request object to delete the SCIM access token.
    required:
      - accessTokenIdOrCrn
    properties:
      accessTokenIdOrCrn:
        type: string
        description: The ID or CRN of the SCIM access token.
  DeleteScimAccessTokenResponse:
    type: object
    description: Response object to delete the SCIM access token.
  ScimAccessToken:
    type: object
    description: Information about the SCIM access token.
    required:
      - accessTokenId
      - crn
      - creationDate
    properties:
      accessTokenId:
        type: string
        description: The SCIM access token id.
      crn:
        type: string
        description: The SCIM access token CRN.
      creationDate:
        type: string
        format: date-time
        description: The date when this SCIM access token was created.
      expirationDate:
        type: string
        format: date-time
        description: The SCIM access token expiration date. The access token never expires if the value is not set.
  UnlockUserInControlPlaneRequest:
    type: object
    description: Request object for unlocking the user in the CDP control plane.
    required:
      - user
    properties:
      user:
        type: string
        description: The ID or CRN of the user to be unlocked in the CDP control plane.
  UnlockUserInControlPlaneResponse:
    type: object
    description: Response object for unlocking the user in the CDP control plane.
    required:
      - user
    properties:
      user:
        $ref: '#/definitions/User'
        description: The unlocked user.
  UnlockMachineUserInControlPlaneRequest:
    type: object
    description: Request object for unlocking the machine user in the control plane.
    required:
      - machineUser
    properties:
      machineUser:
        type: string
        description: The name or CRN of the machine user to be unlocked in the CDP control plane.
  UnlockMachineUserInControlPlaneResponse:
    type: object
    description: Response object for unlocking the machine user in the CDP control plane.
    required:
      - machineUser
    properties:
      machineUser:
        $ref: '#/definitions/MachineUser'
        description: The unlocked machine user.
  SetSamlAuthnRequestSigningKeyRequest:
    type: object
    description: Request object for setting the SAML AuthnRequest signing key and verification certificate.
    x-form-factor: private
    required:
      - samlProvider
    properties:
      samlProvider:
        type: string
        description: The name or CRN of the SAML Provider associated with the signing key.
      authnRequestSigningKey:
        type: string
        description: The private key used for signing AuthnRequests sent from CDP to the customer's SAML provider. It must be in PEM format. It must be non-empty and valid when 'currentAuthnRequestVerificationCertificate' is set. Omitting it from request will remove this key.
        x-sensitive: true
      currentAuthnRequestVerificationCertificate:
        type: string
        description: The certificate used by SAML provider to verify AuthnRequests sent from CDP. It must be in PEM format. It must be non-empty and valid when 'authnRequestSigningKey' is set. Omitting it from request will remove this certificate.
        x-skip-logging: true
      nextAuthnRequestVerificationCertificate:
        type: string
        description: The next verification certificate used by the SAML provider to verify AuthnRequests sent from CDP. It must be in PEM format. It is used for rotating verification certificate, and is expected to be empty after certification rotation completes. When both the current and next AuthnRequest certificates are set, both will appear in the CDP SP SAML metadata, indicating the Identity Provider should validate if either of the certificates validates the signature of the AuthnRequest. Both must be valid certificates, not expired. Once the Identity Provider has been updated with the new CDP SP SAML metadata to use both certificates, the signing key can be updated to correspond to the next certificate, the current certificate set to what had been next, and the next certificate cleared. The CDP SP SAML metadata can then be updated in the Identity Provider to use only a single certificate before the previous certificate expires. This allows rotating the signing key without downtime.
          Omitting it from request will remove this certificate.
        x-skip-logging: true
  SetSamlAuthnRequestSigningKeyResponse:
    type: object
    description: Response object for setting the SAML AuthnRequest signing key and verification certificate.
    x-form-factor: private
    required:
      - authnRequestConfigurationLastUpdated
      - authnRequestSigningKeyDefined
      - currentAuthnRequestVerificationCertificateDefined
      - nextAuthnRequestVerificationCertificateDefined
    properties:
      authnRequestConfigurationLastUpdated:
        type: string
        format: date-time
        description: The date when SAML AuthnRequest signing key and verification certificates were set or cleared.
      authnRequestSigningKeyDefined:
        type: boolean
        description: Whether the AuthnRequest signing key is set or cleared.
      currentAuthnRequestVerificationCertificateDefined:
        type: boolean
        description: Whether the current AuthnRequest verification certificate is set or cleared.
      nextAuthnRequestVerificationCertificateDefined:
        type: boolean
        description: Whether the next AuthnRequest verification certificate is set or cleared.
  MigrateUsersToIdentityProviderRequest:
    type: object
    description: Request object for migrating users from an Identity Provider Connector to a new one.
    x-form-factor: private
    required:
      - originalProviderName
      - newProviderName
    properties:
      originalProviderName:
        type: string
        description: The name or CRN of the original IdP provider to migrate from.
      newProviderName:
        type: string
        description: The name or CRN of the new IdP provider to migrate to.
  MigrateUsersToIdentityProviderResponse:
    type: object
    description: Response object for migrating users from old Identity Provider Connector to a new one.
    x-form-factor: private
    required:
      - numberOfUpdatedUsers
    properties:
      numberOfUpdatedUsers:
        type: integer
        format: int32
        description: The number of users that were migrated from the old IdP to the new one.
  SetSamlResponseDecryptionKeyRequest:
    type: object
    description: Request object for setting the encryption certificate and decryption key for SAML response.
    x-form-factor: private
    required:
      - samlProvider
    properties:
      samlProvider:
        type: string
        description: The name or CRN of the SAML Provider associated with the decryption key.
      samlResponseEncryptionCertificate:
        type: string
        description: The certificate used by Identity Provider for encrypting SAML responses. It must be in PEM format. It must be non-empty and valid when 'currentSamlResponseDecryptionKey' is also set. Setting it to an empty string will remove this certificate.
        x-skip-logging: true
      currentSamlResponseDecryptionKey:
        type: string
        description: The current private key used for decrypting incoming encrypted SAML responses from the customer's Identity Provider to CDP. It must be in PEM format. It must be non-empty and valid when 'samlResponseEncryptionCertificate' is set. Setting it to an empty string will remove this key.
        x-sensitive: true
      nextSamlResponseDecryptionKey:
        type: string
        description: The next private key used for decrypting incoming encrypted SAML responses from the customer's IdP to CDP, during key rotation. It must be in PEM format. It is used for rotating keys without downtime, and is expected to be empty after key rotation completes. When both the current and next decryption keys are set, CDP will try to decrypt with both the keys. Both must be valid keys. Omitting this parameter from the request will remove it.
        x-sensitive: true
  SetSamlResponseDecryptionKeyResponse:
    type: object
    description: Response object for setting the encryption certificate and decryption key for SAML response.
    x-form-factor: private
    required:
      - samlResponseEncryptionDecryptionConfigurationLastUpdated
      - samlResponseEncryptionCertificateDefined
      - currentSamlResponseDecryptionKeyDefined
      - nextSamlResponseDecryptionKeyDefined
    properties:
      samlResponseEncryptionDecryptionConfigurationLastUpdated:
        type: string
        format: date-time
        description: The date when SAML response encryption certificate and decryption keys were set or cleared.
      samlResponseEncryptionCertificateDefined:
        type: boolean
        description: Whether the SAML response encryption certificate is set or cleared.
      currentSamlResponseDecryptionKeyDefined:
        type: boolean
        description: Whether the current decryption key for SAML response is set or cleared.
      nextSamlResponseDecryptionKeyDefined:
        type: boolean
        description: Whether the next decryption key for SAML response is set or cleared.
  EnableUserWorkloadPasswordChangedNotificationsRequest:
    type: object
    description: Request object to enable user workload password changed notifications.
  EnableUserWorkloadPasswordChangedNotificationsResponse:
    type: object
    description: Response object to enable user workload password changed notifications.
    required:
      - account
    properties:
      account:
        $ref: '#/definitions/Account'
        description: The account object.
  DisableUserWorkloadPasswordChangedNotificationsRequest:
    type: object
    description: Request object to disable user workload password changed notifications.
  DisableUserWorkloadPasswordChangedNotificationsResponse:
    type: object
    description: Response object to disable user workload password changed notifications.
    required:
      - account
    properties:
      account:
        $ref: '#/definitions/Account'
        description: The account object.