openapi: 3.2.0
info:
  title: Administration User API
  version: v2
  description: CloudGuard account users
servers:
- url: https://api.dome9.com/
  description: US region
- url: https://api.{region}.dome9.com/
  description: Other regions
  variables:
    region:
      enum:
      - eu1
      - ap1
      - ap2
      - ap3
      - cace1
      default: eu1
security:
- basic: []
tags:
- name: User
  description: CloudGuard account users
paths:
  /v2/user/{id}:
    get:
      tags:
      - User
      summary: Get
      operationId: User_Get_get_/v2/user/{id}
      parameters:
      - name: id
        in: path
        description: Can be 'me' or a numeric value
        required: true
        schema:
          type: string
          default: me
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Dome9.Web.Api.User.UserViewModel'
      description: Get the user with the specified id.
    put:
      tags:
      - User
      summary: Put
      operationId: User_Put_put_/v2/user/{id}
      parameters:
      - name: id
        in: path
        description: Can be 'me' or a numeric value
        required: true
        schema:
          type: string
          default: me
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Dome9.Web.Api.User.UserViewModel'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Dome9.Web.Api.User.UserViewModel'
        description: Can update permissions with "Permissions", roles with "RoleIds" and SSO Enabled with "SsoEnabled"
        required: true
      description: Update the user with the specified id
    delete:
      tags:
      - User
      summary: Delete
      operationId: User_Delete_delete_/v2/user/{id}
      parameters:
      - name: id
        in: path
        description: Can be 'me' or a numeric value
        required: true
        schema:
          type: string
          default: me
      responses:
        '204':
          description: No Content
      description: Delete a user
  /v2/user/{id}/unlock:
    put:
      tags:
      - User
      summary: Unlock User
      operationId: User_UnlockUser_put_/v2/user/{id}/unlock
      parameters:
      - name: id
        in: path
        description: Can be 'me' or a numeric value
        required: true
        schema:
          type: string
          default: me
      responses:
        '204':
          description: No Content
      description: Unlock a user that was locked out after a certain number of failed authentications.
  /v2/user/{id}/iam-safe/accounts/{accountId}/iamEntities:
    put:
      tags:
      - User
      summary: Put Iam Safe Account Iam Entities
      operationId: User_PutIamSafeAccountIamEntities_put_/v2/user/{id}/iam-safe/accounts/{accountId}/iamEntities
      parameters:
      - name: id
        in: path
        description: Can be 'me' or a numeric value
        required: true
        schema:
          type: string
          default: me
      - name: accountId
        in: path
        description: The cloud account id
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Dome9.Web.Api.UserAndRole.IamSafe.UserIamSafeAccountPutViewModel'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Dome9.Web.Api.UserAndRole.IamSafe.UserIamSafeAccountPutViewModel'
        description: The IAM entities to link
        required: true
      description: Update IAM Safe entities for a user.
  /v2/user/{id}/iam-safe/accounts/{cloudAccountId}/iamEntities:
    post:
      tags:
      - User
      summary: Post Iam Safe Account Iam Entities
      operationId: User_PostIamSafeAccountIamEntitiesAsync_post_/v2/user/{id}/iam-safe/accounts/{cloudAccountId}/iamEntities
      parameters:
      - name: id
        in: path
        description: Can be 'me' or a numeric value
        required: true
        schema:
          type: string
          default: me
      - name: cloudAccountId
        in: path
        description: Dome9 internal ID or AWS ID
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Dome9.Web.Api.UserAndRole.IamSafe.UserIamSafeAccountPutViewModel'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Dome9.Web.Api.UserAndRole.IamSafe.UserIamSafeAccountPutViewModel'
        description: The IAM entities to link
        required: true
      description: Add IAM Safe entities for a user.
  /v2/user/{id}/iam-safe/accounts/{accountId}/deleteIamEntities:
    post:
      tags:
      - User
      summary: Delete Iam Safe Entities For User
      operationId: User_DeleteIamSafeEntitiesForUser_post_/v2/user/{id}/iam-safe/accounts/{accountId}/deleteIamEntities
      parameters:
      - name: id
        in: path
        description: Can be 'me' or a numeric value
        required: true
        schema:
          type: string
          default: me
      - name: accountId
        in: path
        description: The cloud account id
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Dome9.Web.Api.UserAndRole.IamSafe.UserIamSafeAccountPutViewModel'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Dome9.Web.Api.UserAndRole.IamSafe.UserIamSafeAccountPutViewModel'
        description: The IAM entities to remove
        required: true
      description: Delete iam entities for user
  /v2/user:
    get:
      tags:
      - User
      summary: Get
      operationId: User_Get_get_/v2/user
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Dome9.Web.Api.User.UserViewModel'
      description: Get all Dome9 users for the Dome9 account.
    post:
      tags:
      - User
      summary: Post
      operationId: User_Post_post_/v2/user
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Dome9.Web.Api.User.UserPostViewModel'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Dome9.Web.Api.User.UserPostViewModel'
        description: The new user
        required: true
      description: Create a new Dome9 user
components:
  schemas:
    Dome9.Web.Api.User.PermissionsViewModel:
      type: object
      properties:
        access:
          description: Access permission list (list of SRLs)
          type: array
          items:
            type: string
        manage:
          description: Manage permission list (list of SRLs)
          type: array
          items:
            type: string
        rulesets:
          description: Compliance permission list (list of SRLs)
          type: array
          items:
            type: string
        notifications:
          description: Compliance permission list (list of SRLs)
          type: array
          items:
            type: string
        policies:
          description: Compliance permission list (list of SRLs)
          type: array
          items:
            type: string
        alertActions:
          description: Compliance permission list (list of SRLs)
          type: array
          items:
            type: string
        create:
          description: Create permission list (list of SRLs)
          type: array
          items:
            type: string
        view:
          description: View permission list (list of SRLs)
          type: array
          items:
            type: string
        onBoarding:
          description: View permission SRL
          type: array
          items:
            type: string
        crossAccountAccess:
          type: array
          items:
            type: string
    Dome9.Web.Api.UserAndRole.IamSafe.UserIamSafeConfigViewModel:
      type: object
      properties:
        cloudAccounts:
          type: array
          items:
            $ref: '#/components/schemas/Dome9.Web.Api.UserAndRole.IamSafe.UserIamSafeAccountViewModel'
    Dome9.Web.Api.UserAndRole.IamSafe.UserIamSafeAccountPutViewModel:
      required:
      - iamEntities
      type: object
      properties:
        iamEntities:
          type: array
          items:
            type: string
    Dome9.Web.Api.User.UserPostViewModel:
      required:
      - email
      - firstName
      - lastName
      type: object
      properties:
        email:
          format: email
          description: Email Address
          pattern: ^([0-9a-zA-Z]([-.'\w\+]*[0-9a-zA-Z])*@([0-9a-zA-Z][-\w]*\.)+[a-zA-Z]{2,})$
          type: string
          example: MyName@gmail.com
        firstName:
          description: '[Required]'
          maxLength: 50
          minLength: 0
          type: string
        lastName:
          description: '[Required]'
          maxLength: 50
          minLength: 0
          type: string
        ssoEnabled:
          description: Determines whether this user is an SSO user (as opposed to Dome9 native authentication)
          type: boolean
    Dome9.Web.Api.UserAndRole.MfaUserEnforcementViewModel:
      type: object
      properties:
        mfaCoercingDate:
          type: string
        isEnforced:
          type: boolean
        enforcerFullName:
          type: string
    Dome9.Web.Api.User.UserViewModel:
      required:
      - permissions
      type: object
      properties:
        id:
          format: int32
          description: user id
          type: integer
          readOnly: true
        name:
          description: user name
          type: string
          readOnly: true
        email:
          format: email
          description: Email Address
          type: string
          readOnly: true
          example: MyName@gmail.com
        accountId:
          format: int64
          description: The account id of the user
          type: integer
          readOnly: true
        isSuspended:
          description: user is suspended
          type: boolean
          readOnly: true
        isOwner:
          description: user is account owner
          type: boolean
          readOnly: true
        isSuperUser:
          description: user is Super User
          type: boolean
          readOnly: true
        isAuditor:
          description: user is auditor user
          type: boolean
          readOnly: true
        hasApiKey:
          description: user has generated an API Key - V1 or V2
          type: boolean
          readOnly: true
        hasApiKeyV1:
          description: user has generated an API Key - V1
          type: boolean
          readOnly: true
        hasApiKeyV2:
          description: user has generated an API Key - V2
          type: boolean
          readOnly: true
        isMfaEnabled:
          description: user has enabled MFA authentication
          type: boolean
          readOnly: true
        ssoEnabled:
          description: user has enabled SSO sign-on
          type: boolean
        roleIds:
          description: list of roles for the user
          type: array
          items:
            format: int64
            type: integer
        iamSafe:
          $ref: '#/components/schemas/Dome9.Web.Api.UserAndRole.IamSafe.UserIamSafeConfigViewModel'
          description: IAM safety details for the user
        canSwitchRole:
          description: user can switch roles
          type: boolean
        isLocked:
          type: boolean
        lastLogin:
          format: date-time
          type: string
        permissions:
          $ref: '#/components/schemas/Dome9.Web.Api.User.PermissionsViewModel'
          description: User direct permissions
        calculatedPermissions:
          $ref: '#/components/schemas/Dome9.Web.Api.User.PermissionsViewModel'
        isMobileDevicePaired:
          description: user has paired mobile device
          type: boolean
        mfaEnforcement:
          $ref: '#/components/schemas/Dome9.Web.Api.UserAndRole.MfaUserEnforcementViewModel'
        apiKeys:
          type: array
          items:
            $ref: '#/components/schemas/Dome9.Web.Api.UserAndRole.IamSafe.UserApiKeyViewModel'
    Dome9.Web.Api.UserAndRole.IamSafe.UserApiKeyViewModel:
      required:
      - id
      type: object
      properties:
        name:
          maxLength: 50
          minLength: 0
          pattern: '[^/]+$'
          type: string
        id:
          format: uuid
          type: string
          example: 00000000-0000-0000-0000-000000000000
        dateCreated:
          format: date-time
          type: string
        lastUsed:
          format: date-time
          type: string
    Dome9.Web.Api.UserAndRole.IamSafe.IamEntityLastLeaseTimeViewModel:
      type: object
      properties:
        iamEntity:
          type: string
        lastLeaseTime:
          format: date-time
          type: string
    Dome9.Web.Api.UserAndRole.IamSafe.UserIamSafeAccountViewModel:
      type: object
      properties:
        cloudAccountId:
          format: uuid
          type: string
          example: 00000000-0000-0000-0000-000000000000
        name:
          type: string
        externalAccountNumber:
          type: string
        lastLeaseTime:
          format: date-time
          type: string
        state:
          type: string
        iamEntities:
          type: array
          items:
            type: string
        iamEntitiesLastLeaseTime:
          type: array
          items:
            $ref: '#/components/schemas/Dome9.Web.Api.UserAndRole.IamSafe.IamEntityLastLeaseTimeViewModel'
        cloudAccountState:
          type: string
        iamEntity:
          type: string
          readOnly: true
  securitySchemes:
    basic:
      type: http
      scheme: basic
x-readme:
  explorer-enabled: true
  proxy-enabled: true