openapi: 3.1.0
info:
  contact:
    email: support@cloudquery.io
    name: CloudQuery Support Team
    url: https://cloudquery.io
  description: 'Welcome to the CloudQuery Platform API documentation! This API can be used to interact with the CloudQuery platform. As a user, the API allows you to search the CloudQuery asset inventory, run SQL queries against the data warehouse, save and load searches, and much more. As an administrator, it allows you to manage your teams, syncs, and other objects.

    ### Authentication

    The API is secured using bearer tokens. To get started, you can generate an API key for your Platform deployment from your platform dashboard. For a step-by-step guide, see: https://www.cloudquery.io/docs/cli/managing-cloudquery/deployments/generate-api-key.

    The base URL for the API depends on where your CloudQuery Platform is hosted. If running locally, this is usually http://localhost:3000/api. In a production deployment it should be an HTTPS URL. For purposes of illustration, we will assume the platform instance is available at https://cloudquery.mycompany.com. In this case, the base API endpoint will be https://cloudquery.mycompany.com/api.

    ### Example Request

    To test your connection to the API, we can use the `/plugins` endpoint. For example:

    `curl -v -H "Authorization: Bearer $CLOUDQUERY_API_KEY" \ https://cloudquery.mycompany.com/api/plugins`

    '
  license:
    name: MIT
    url: https://spdx.org/licenses/MIT
  termsOfService: https://www.cloudquery.io/terms
  title: CloudQuery Platform OpenAPI Spec admin onboardings API
  version: 1.0.0
security:
- bearerAuth: []
- cookieAuth: []
tags:
- name: onboardings
paths:
  /onboardings/aws/oidc:
    post:
      operationId: PlatformCreateAWSOnboarding
      description: Create an interactive onboarding for AWS
      tags:
      - onboardings
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
              - single_account
              properties:
                single_account:
                  type: boolean
                  description: 'Specifies the type of onboarding to create: either a single account onboarding or an organization onboarding

                    '
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlatformOnboardingAWSCreateResponse'
          description: Created
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/oidc/{onboarding_id}:
    get:
      operationId: PlatformGetAWSOnboarding
      description: Query an interactive onboarding for AWS
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      tags:
      - onboardings
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlatformOnboardingAWS'
          description: OK
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '404':
          $ref: '#/components/responses/PlatformNotFound'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/oidc/{onboarding_id}/notify:
    post:
      operationId: PlatformNotifyOnboarding
      description: Update onboarding state
      tags:
      - onboardings
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PlatformOnboardingAWSNotification'
      responses:
        '202':
          description: Accepted
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/oidc/{onboarding_id}/accounts:
    get:
      operationId: PlatformGetAWSAccountsInRoot
      description: Query AWS accounts under organization root
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      tags:
      - onboardings
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlatformOnboardingAWSAccounts'
          description: OK
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '404':
          $ref: '#/components/responses/PlatformNotFound'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/oidc/{onboarding_id}/accounts/{aws_orgunit_id}:
    get:
      operationId: PlatformGetAWSAccountsInParent
      description: Query AWS accounts under a specifc Organizational Unit
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      - $ref: '#/components/parameters/platform_aws_orgunit_id'
      tags:
      - onboardings
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlatformOnboardingAWSAccounts'
          description: OK
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '404':
          $ref: '#/components/responses/PlatformNotFound'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/oidc/{onboarding_id}/accounts/provision:
    post:
      operationId: PlatformProvisionOnboardingConfiguration
      description: Provision onboarding configuration into the cloud account
      tags:
      - onboardings
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PlatformOnboardingAWSProvision'
      responses:
        '202':
          description: Accepted
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '404':
          $ref: '#/components/responses/PlatformNotFound'
        '422':
          $ref: '#/components/responses/PlatformUnprocessableEntity'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/cur:
    post:
      operationId: PlatformCreateAWSCUROnboarding
      description: Create an interactive onboarding for AWS CUR
      tags:
      - onboardings
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlatformOnboardingAWSCURCreateResponse'
          description: Created
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/cur/{onboarding_id}:
    get:
      operationId: PlatformGetAWSCUROnboarding
      description: Query an interactive onboarding for AWS CUR
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      tags:
      - onboardings
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlatformOnboardingAWSCUR'
          description: OK
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '404':
          $ref: '#/components/responses/PlatformNotFound'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/cur/{onboarding_id}/notify:
    post:
      operationId: PlatformNotifyAWSCUROnboarding
      description: Update AWS CUR onboarding state
      tags:
      - onboardings
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PlatformOnboardingAWSCURNotification'
      responses:
        '202':
          description: Accepted
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/cur/{onboarding_id}/verify:
    post:
      operationId: PlatformVerifyAWSCUROnboarding
      description: Trigger verification of the AWS CUR onboarding
      tags:
      - onboardings
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      responses:
        '202':
          description: Accepted
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '404':
          $ref: '#/components/responses/PlatformNotFound'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/unified:
    post:
      operationId: PlatformCreateAWSUnifiedOnboarding
      description: Create a unified composable onboarding for AWS
      tags:
      - onboardings
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedCreateRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedCreateResponse'
          description: Created
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/unified/{onboarding_id}:
    get:
      operationId: PlatformGetAWSUnifiedOnboarding
      description: Query a unified AWS onboarding
      tags:
      - onboardings
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlatformOnboardingAWSUnified'
          description: OK
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '404':
          $ref: '#/components/responses/PlatformNotFound'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/unified/{onboarding_id}/notify:
    post:
      operationId: PlatformNotifyAWSUnifiedOnboarding
      description: Update unified AWS onboarding state via CloudFormation callback
      tags:
      - onboardings
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedNotification'
      responses:
        '202':
          description: Accepted
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/unified/{onboarding_id}/accounts:
    get:
      operationId: PlatformGetAWSUnifiedAccountsInRoot
      description: Query AWS accounts under the organization root (requires asset_inventory feature)
      tags:
      - onboardings
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlatformOnboardingAWSAccounts'
          description: OK
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '404':
          $ref: '#/components/responses/PlatformNotFound'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/unified/{onboarding_id}/accounts/{aws_orgunit_id}:
    get:
      operationId: PlatformGetAWSUnifiedAccountsInParent
      description: Query AWS accounts under a specific Organizational Unit
      tags:
      - onboardings
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      - name: aws_orgunit_id
        in: path
        required: true
        description: Organizational Unit ID
        schema:
          type: string
          x-go-name: OrganizationalUnitID
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlatformOnboardingAWSAccounts'
          description: OK
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '404':
          $ref: '#/components/responses/PlatformNotFound'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/unified/{onboarding_id}/accounts/provision:
    post:
      operationId: PlatformProvisionUnifiedOnboardingConfiguration
      description: Provision sync roles into selected AWS accounts (requires asset_inventory feature)
      tags:
      - onboardings
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PlatformOnboardingAWSProvision'
      responses:
        '202':
          description: Provisioning started
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/unified/{onboarding_id}/verify-cur:
    post:
      operationId: PlatformVerifyAWSUnifiedCUR
      description: Verify CUR S3 access for the unified onboarding (requires cost_and_usage feature)
      tags:
      - onboardings
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      responses:
        '202':
          description: Verification started
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '404':
          $ref: '#/components/responses/PlatformNotFound'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/unified/{onboarding_id}/test-connections:
    post:
      operationId: PlatformCreateAWSUnifiedTestConnections
      description: Create test connections for all enabled features in one call
      tags:
      - onboardings
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedTestConnectionsRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedTestConnectionsResponse'
          description: Created
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '404':
          $ref: '#/components/responses/PlatformNotFound'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /onboardings/aws/unified/{onboarding_id}/integrations:
    post:
      operationId: PlatformCreateAWSUnifiedIntegrations
      description: Create integrations for all enabled features using completed test connections
      tags:
      - onboardings
      parameters:
      - $ref: '#/components/parameters/platform_onboarding_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedIntegrationsRequest'
      responses:
        '201':
          description: Integrations created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedIntegrationsResponse'
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '404':
          $ref: '#/components/responses/PlatformNotFound'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /aws/unified/test-connections:
    post:
      operationId: PlatformCreateAWSUnifiedTestConnectionsStandalone
      description: Create test connections for AWS unified features without an onboarding. Frontend is expected to provide a per-feature plugin spec (with ${ENV_VAR} placeholders for sensitive values like external_id) plus an env list containing the corresponding values.
      tags:
      - onboardings
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PlatformAWSUnifiedTestConnectionsRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedTestConnectionsResponse'
          description: Created
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
  /aws/unified/integrations:
    post:
      operationId: PlatformCreateAWSUnifiedIntegrationsStandalone
      description: 'Create AWS unified integrations from previously created standalone test connections (no onboarding). Like the onboarding-bound counterpart, this endpoint may create multiple syncs from a single request: asset_inventory creates a main sync plus a CloudTrail companion sync, additional_metadata creates a metadata sync, and cost_and_usage creates a CUR sync.'
      tags:
      - onboardings
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PlatformAWSUnifiedIntegrationsRequest'
      responses:
        '201':
          description: Integrations created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedIntegrationsResponse'
        '400':
          $ref: '#/components/responses/PlatformBadRequest'
        '401':
          $ref: '#/components/responses/PlatformRequiresAuthentication'
        '500':
          $ref: '#/components/responses/PlatformInternalError'
components:
  schemas:
    PlatformOnboardingAWSCreateResponse:
      type: object
      description: AWS OpenID onboarding
      additionalProperties: false
      required:
      - id
      - issuer_url
      - audience
      - subject
      - template_url
      - notify_path
      - notify_token
      properties:
        id:
          $ref: '#/components/schemas/PlatformOnboardingID'
        region:
          type: string
          description: An AWS region (such as 'us-east-1') where stack is deployed
        stack_name:
          type: string
          description: Stack name that should be used
          maxLength: 128
        issuer_url:
          type: string
          description: URL of the OpenID server to use when setting up a trust relationship
          x-go-name: IssuerURL
        audience:
          type: string
          description: OpenID audience claim for the trust realshionship
          x-go-name: Audience
        subject:
          type: string
          description: OpenID subject claim for the trust relationship
          x-go-name: Subject
        notify_path:
          type: string
          description: Path of the notify endpoint to use for status updates
          x-go-name: NotifyPath
        template_url:
          type: string
          description: URL of the CloudFormation template to use for the authentication
          x-go-name: TemplateURL
        notify_token:
          type: string
          description: An authentication token that should be used for notifications
    PlatformOnboardingAWSProvision:
      type: object
      description: Stackset provisioning configuration
      required:
      - notify_url
      - organizational_units
      properties:
        notify_url:
          type: string
          description: URL that should be used for provisioning notifications (including scheme, hostname, and path)
        organizational_units:
          type: array
          description: OUs to provision roles into
          items:
            type: string
            pattern: ^(r-[0-9a-z]{4,32}|ou-[a-z0-9]{4,32}-[a-z0-9]{8,32})$
            example: r-xvfz
            x-pattern-message: must start with either "r-" followed by 4 to 32 lowercase letters or digits,  or "ou-" followed by 4 to 32 lowercase letters or digits, a hyphen, and then  8 to 32 lowercase letters or digits, with no additional characters before or after.
        skip_accounts:
          type: array
          description: Account IDs to skip onboarding
          items:
            description: ID of an account in AWS
            type: string
            example: '615713231484'
            pattern: ^\d{12}$
            x-pattern-message: account ID must be exactly 12 digits
    PlatformOnboardingAWSAccounts:
      type: object
      description: AWS OpenID onboarding account structure
      additionalProperties: false
      required:
      - id
      - type
      properties:
        id:
          type: string
          description: ID of the account or OU
          x-go-name: ID
        arn:
          type: string
          description: ARN of the account or OU
          x-go-name: ARN
        type:
          type: string
          description: Type of the account
          enum:
          - OU
          - account
          - root
        name:
          type: string
          description: Display name of the account or OU
        children:
          type: array
          description: Children accounts and OUs of the target account
          items:
            $ref: '#/components/schemas/PlatformOnboardingAWSAccounts'
    PlatformStartedNotification:
      allOf:
      - $ref: '#/components/schemas/PlatformBaseNotification'
      - type: object
        properties:
          status:
            enum:
            - started
    PlatformCompletedNotification:
      allOf:
      - $ref: '#/components/schemas/PlatformBaseNotification'
      - type: object
        required:
        - admin_role_arn
        - sync_role_name
        - organizational_units
        - skipped_accounts
        properties:
          status:
            enum:
            - completed
          admin_role_arn:
            type: string
          sync_role_name:
            type: string
          organizational_units:
            type: array
            items:
              type: string
          skipped_accounts:
            type: array
            items:
              type: string
          failed_accounts:
            type: number
          additional_stack_ids:
            type: array
            items:
              type: string
    PlatformOnboardingAWSUnifiedTestConnectionsRequest:
      type: object
      description: Request to create test connections for all enabled features
      additionalProperties: false
      properties:
        asset_inventory:
          type: object
          description: Configuration for asset inventory test connection (regions, etc.)
          additionalProperties: true
        cost_and_usage:
          type: object
          description: Configuration for cost and usage test connection
          additionalProperties: true
        additional_metadata:
          type: object
          description: Configuration for additional metadata test connection
          additionalProperties: true
    PlatformFieldError:
      allOf:
      - $ref: '#/components/schemas/PlatformBasicError'
      - properties:
          errors:
            items:
              type: string
            type: array
          field_errors:
            additionalProperties:
              type: string
            type: object
        type: object
    PlatformOnboardingAWSNotification:
      oneOf:
      - $ref: '#/components/schemas/PlatformStartedNotification'
      - $ref: '#/components/schemas/PlatformRevokedNotification'
      - $ref: '#/components/schemas/PlatformFailedNotification'
      - $ref: '#/components/schemas/PlatformDeployedNotification'
      - $ref: '#/components/schemas/PlatformCompletedNotification'
      - $ref: '#/components/schemas/PlatformCompletedSingleAccountNotification'
      discriminator:
        propertyName: status
        mapping:
          started: '#/components/schemas/PlatformStartedNotification'
          revoked: '#/components/schemas/PlatformRevokedNotification'
          failed: '#/components/schemas/PlatformFailedNotification'
          deployed: '#/components/schemas/PlatformDeployedNotification'
          completed: '#/components/schemas/PlatformCompletedNotification'
          completed_account: '#/components/schemas/PlatformCompletedSingleAccountNotification'
    PlatformOnboardingAWSCURCreateResponse:
      type: object
      description: AWS CUR onboarding create response
      additionalProperties: false
      required:
      - id
      - region
      - issuer_url
      - audience
      - subject
      - template_url
      - notify_path
      - notify_token
      properties:
        id:
          $ref: '#/components/schemas/PlatformOnboardingID'
        region:
          type: string
          description: AWS region where the CUR stack must be deployed. Always 'us-east-1' because AWS Cost and Usage Reports are only available in that region.
        stack_name:
          type: string
          description: Stack name that should be used
          maxLength: 128
        issuer_url:
          type: string
          description: URL of the OpenID server to use when setting up a trust relationship
          x-go-name: IssuerURL
        audience:
          type: string
          description: OpenID audience claim for the trust relationship
          x-go-name: Audience
        subject:
          type: string
          description: OpenID subject claim for the trust relationship
          x-go-name: Subject
        notify_path:
          type: string
          description: Path of the notify endpoint to use for status updates
          x-go-name: NotifyPath
        template_url:
          type: string
          description: URL of the CloudFormation template to use for the CUR setup
          x-go-name: TemplateURL
        notify_token:
          type: string
          description: An authentication token that should be used for notifications
    PlatformOnboardingAWSCURNotification:
      oneOf:
      - $ref: '#/components/schemas/PlatformStartedNotification'
      - $ref: '#/components/schemas/PlatformRevokedNotification'
      - $ref: '#/components/schemas/PlatformFailedNotification'
      - $ref: '#/components/schemas/PlatformDeployedCURNotification'
      discriminator:
        propertyName: status
        mapping:
          started: '#/components/schemas/PlatformStartedNotification'
          revoked: '#/components/schemas/PlatformRevokedNotification'
          failed: '#/components/schemas/PlatformFailedNotification'
          deployed_cur: '#/components/schemas/PlatformDeployedCURNotification'
    PlatformOnboardingAWSUnifiedIntegrationConfig:
      type: object
      description: Per-feature configuration for a unified integration, containing only the test connection reference
      additionalProperties: false
      required:
      - test_connection_id
      properties:
        test_connection_id:
          type: string
          format: uuid
          x-go-name: TestConnectionID
    PlatformOnboardingAWSUnifiedCreateRequest:
      type: object
      description: Request to create a unified AWS onboarding
      additionalProperties: false
      required:
      - features
      properties:
        features:
          type: array
          description: 'List of features to enable. Determines the CloudFormation template composition.

            '
          items:
            type: string
            enum:
            - asset_inventory
            - cost_and_usage
            - additional_metadata
          minItems: 1
        single_account:
          type: boolean
          default: false
          description: 'Only relevant when asset_inventory is selected. If true, uses single-account mode instead of organization mode.

            '
    PlatformDeployedUnifiedNotification:
      type: object
      description: Notification sent when unified CloudFormation stack deployment completes
      additionalProperties: false
      required:
      - status
      - stack_id
      properties:
        status:
          type: string
          enum:
          - deployed_unified
        stack_id:
          type: string
          description: CloudFormation stack ARN
        management_role_arn:
          type: string
          description: Management role ARN (present when asset_inventory is active)
          x-go-name: ManagementRoleArn
        deployment_mode:
          type: string
          description: Deployment mode (present when asset_inventory is active)
        cur_main_role_arn:
          type: string
          description: CUR main role ARN (present when cost_and_usage is active)
          x-go-name: CurMainRoleArn
        cur_sync_role_arn:
          type: string
          description: CUR sync role ARN (present when cost_and_usage is active)
          x-go-name: CurSyncRoleArn
        cur_s3_bucket_name:
          type: string
          description: S3 bucket for CUR data (present when cost_and_usage is active)
          x-go-name: CurS3BucketName
        cur_s3_report_prefix:
          type: string
          description: S3 prefix for CUR reports (present when cost_and_usage is active)
          x-go-name: CurS3ReportPrefix
        cur_report_name:
          type: string
          description: BCM Data Export name (present when cost_and_usage is active)
          x-go-name: CurReportName
    PlatformOnboardingID:
      description: ID of the cloud provider onboarding session
      type: string
      format: uuid
      example: 12345678-1234-1234-1234-1234567890ab
      x-go-name: OnboardingID
    PlatformOnboardingAWSUnifiedIntegrationsResponse:
      type: object
      description: 'Response containing the integrations created by the unified onboarding flow. Some features create multiple integrations from a single config: asset_inventory creates both a main sync and a companion sync with a "-cloudtrail" suffix, and additional_metadata creates a sync with a "-metadata" suffix. All names are derived from the user-provided name in the request.

        '
      required:
      - integrations
      properties:
        integrations:
          type: array
          items:
            type: object
            required:
            - name
            - feature
            properties:
              name:
                type: string
                description: 'The integration name. For asset_inventory, this may be the base name or the base name with a "-cloudtrail" suffix. For additional_metadata, this is the base name with a "-metadata" suffix.

                  '
              feature:
                type: string
                enum:
                - asset_inventory
                - cost_and_usage
                - additional_metadata
    PlatformAWSUnifiedTestConnectionsRequest:
      type: object
      description: Request to create test connections for AWS unified features without an onboarding. Each feature is enabled by including its config block. The frontend is responsible for building the full plugin spec (e.g. cloudquery/aws with an accounts array of {role_arn, external_id}) and supplying any external_id values via the env list.
      additionalProperties: false
      properties:
        asset_inventory:
          $ref: '#/components/schemas/PlatformAWSUnifiedFeatureTestConnectionConfig'
        cost_and_usage:
          $ref: '#/components/schemas/PlatformAWSUnifiedFeatureTestConnectionConfig'
        additional_metadata:
          $ref: '#/components/schemas/PlatformAWSUnifiedFeatureTestConnectionConfig'
    PlatformOnboardingAWSUnifiedCreateResponse:
      type: object
      description: Response when creating a unified AWS onboarding
      additionalProperties: false
      required:
      - id
      - features
      - issuer_url
      - audience
      - subject
      - template_url
      - notify_path
      - notify_token
      properties:
        id:
          $ref: '#/components/schemas/PlatformOnboardingID'
        features:
          type: array
          items:
            type: string
            enum:
            - asset_inventory
            - cost_and_usage
            - additional_metadata
        region:
          type: string
          description: AWS region for stack deployment. Forced to us-east-1 when cost_and_usage is included.
        stack_name:
          type: string
          description: CloudFormation stack name to use
          maxLength: 128
        issuer_url:
          type: string
          description: URL of the OpenID server to use when setting up a trust relationship
          x-go-name: IssuerURL
        audience:
          type: string
          description: OpenID audience claim for the trust relationship
          x-go-name: Audience
        subject:
          type: string
          description: OpenID subject claim for the trust relationship
          x-go-name: Subject
        notify_path:
          type: string
          description: Path of the notify endpoint to use for status updates
          x-go-name: NotifyPath
        template_url:
          type: string
          description: URL of the composed CloudFormation template matching requested features
          x-go-name: TemplateURL
        notify_token:
          type: string
          description: Authentication token for notifications
    PlatformOnboardingAWSCUR:
      type: object
      description: AWS CUR onboarding
      additionalProperties: false
      required:
      - id
      - stage
      - created_at
      - updated_at
      - issuer_url
      - audience
      - subject
      properties:
        id:
          $ref: '#/components/schemas/PlatformOnboardingID'
        stage:
          type: string
          description: Stage of the onboarding process
          x-go-name: OnboardingStage
        created_at:
          type: string
          format: date-time
          example: '2017-07-14T16:53:42Z'
        updated_at:
          type: string
          format: date-time
          example: '2017-07-14T16:53:42Z'
        issuer_url:
          type: string
          description: URL of the OpenID server to use when setting up a trust relationship
          x-go-name: IssuerURL
        audience:
          type: string
          description: OpenID audience claim for the trust relationship
          x-go-name: Audience
        subject:
          type: string
          description: OpenID subject claim for the trust relationship
          x-go-name: Subject
        sync_role_arn:
          type: string
          description: Role used to access the S3 bucket with CUR reports
          x-go-name: SyncRoleARN
        s3_bucket_name:
          type: string
          description: Name of the S3 bucket containing CUR reports
          x-go-name: S3BucketName
        s3_report_prefix:
          type: string
          description: Prefix path for CUR reports in the S3 bucket
          x-go-name: S3ReportPrefix
        cur_report_name:
          type: string
          description: Name of the CUR report
          x-go-name: CURReportName
        failure_reason:
          type: string
          description: Error details if the onboarding failed
          x-go-name: FailureReason
    PlatformDisplayName:
      description: A human-readable display name
      minLength: 1
      maxLength: 255
      pattern: ^[a-zA-Z\p{L}\p{N}_][a-zA-Z\p{L}\p{N}_ \-'\(\)\[\]]*$
      x-pattern-message: can contain only letters, numbers, spaces, hyphens, underscores, brackets and apostrophes
      type: string
      example: Human Readable Name
    PlatformOnboardingAWSUnifiedAssetInventory:
      type: object
      description: Asset inventory feature status and details
      additionalProperties: false
      required:
      - stage
      properties:
        stage:
          type: string
          description: 'Stage of the asset inventory feature. Values: pending, started, deployed, provisioning, completed, failed, revoked.

            '
        failure_reason:
          type: string
          description: Error details if the feature failed
          x-go-name: FailureReason
        management_role_arn:
          type: string
          x-go-name: ManagementRoleARN
        deployment_mode:
          type: string
        admin_role_arn:
          type: string
          x-go-name: AdminRoleARN
        sync_role_name:
          type: string
          x-go-name: SyncRoleName
          description: Name of the sync role in each onboarded account
        organizational_units:
          type: array
          x-go-name: OrganizationalUnitIDs
          items:
            type: string
        skipped_accounts:
          type: array
          x-go-name: SkippedAccountIDs
          items:
            type: string
        failed_accounts_count:
          type: integer
          x-go-name: FailedAccountsCount
    PlatformBaseNotification:
      type: object
      required:
      - status
      properties:
        status:
          type: string
    PlatformOnboardingAWSUnifiedIntegrationsRequest:
      type: object
      description: Request to create integrations for all enabled features
      additionalProperties: false
      required:
      - name
      - destination_names
      properties:
        name:
          type: string
          description: Base name for the integrations. Sub-integrations derive their names from this value.
        display_name:
          $ref: '#/components/schemas/PlatformDisplayName'
        destination_names:
          type: array
          items:
            type: string
        schedule:
          type: string
          description: Cron schedule for recurring syncs
        asset_inventory:
          $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedIntegrationConfig'
        cost_and_usage:
          $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedIntegrationConfig'
        additional_metadata:
          $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedIntegrationConfig'
    PlatformDeployedCURNotification:
      allOf:
      - $ref: '#/components/schemas/PlatformBaseNotification'
      - type: object
        required:
        - main_role_arn
        - sync_role_arn
        - s3_bucket_name
        - s3_report_prefix
        - cur_report_name
        - stack_id
        properties:
          status:
            enum:
            - deployed_cur
          main_role_arn:
            type: string
          sync_role_arn:
            type: string
          s3_bucket_name:
            type: string
          s3_report_prefix:
            type: string
          cur_report_name:
            type: string
          stack_id:
            type: string
    PlatformDeployedNotification:
      allOf:
      - $ref: '#/components/schemas/PlatformBaseNotification'
      - type: object
        required:
        - management_role_arn
        - deployment_mode
        - stack_id
        properties:
          status:
            enum:
            - deployed
          management_role_arn:
            type: string
          deployment_mode:
            type: string
          stack_id:
            type: string
    PlatformAWSUnifiedIntegrationsRequest:
      type: object
      description: 'Request to create AWS unified integrations from previously created standalone test connections (no onboarding). Sub-integrations derive their names from the base name: asset_inventory creates -asset-inventory and -cloudtrail syncs, additional_metadata creates a -metadata sync, and cost_and_usage creates a -cost-and-usage sync.'
      additionalProperties: false
      required:
      - name
      - destination_names
      properties:
        name:
          type: string
          description: Base name for the integrations. Sub-integrations derive their names from this value.
        display_name:
          $ref: '#/components/schemas/PlatformDisplayName'
        destination_names:
          type: array
          items:
            type: string
        schedule:
          type: string
          description: Cron schedule for recurring syncs
        asset_inventory:
          $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedIntegrationConfig'
        cost_and_usage:
          $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedIntegrationConfig'
        additional_metadata:
          $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedIntegrationConfig'
    PlatformOrganizationalUnitID:
      description: ID of an organizational unit in AWS
      type: string
      example: ou-7f3s-j8zfa1ao
      pattern: ^ou-[a-z0-9]{4,32}-[a-z0-9]{8,32}$
      x-pattern-message: must start with "ou-" followed by 4 to 32 lowercase letters or digits, then a second "-" dash, and finally 8 to 32 additional lowercase letters or digits
      x-go-name: OrganizationalUnitID
    PlatformOnboardingAWS:
      type: object
      description: AWS OpenID onboarding
      additionalProperties: false
      required:
      - id
      - stage
      - created_at
      - updated_at
      - issuer_url
      - audience
      - subject
      properties:
        id:
          $ref: '#/components/schemas/PlatformOnboardingID'
        stage:
          type: string
          description: Stage of the onboarding process
          x-go-name: OnboardingStage
        created_at:
          type: string
          format: date-time
          example: '2017-07-14T16:53:42Z'
        updated_at:
          type: string
          format: date-time
          example: '2017-07-14T16:53:42Z'
        issuer_url:
          type: string
          description: URL of the OpenID server to use when setting up a trust relationship
          x-go-name: IssuerURL
        audience:
          type: string
          description: OpenID audience claim for the trust realshionship
          x-go-name: Audience
        subject:
          type: string
          description: OpenID subject claim for the trust relationship
          x-go-name: Subject
        management_role_arn:
          type: string
          description: Role used to manage the platform onboarding
          x-go-name: ManagementRoleARN
        failure_reason:
          type: string
          description: CloudFormation stack errors
          x-go-name: FailureReason
        sync_role_name:
          type: string
          x-go-name: SyncRoleName
          description: '(organization mode) The name of the sync role used to sync a specific account within the organization.

            Note: This is the role name only, not the full ARN.

            '
        organizational_units:
          type: array
          x-go-name: OrganizationalUnitIDs
          description: '(organization mode) A list of Organizational Unit (OU) IDs included in this onboarding.

            '
          items:
            type: string
    PlatformAWSUnifiedFeatureTestConnectionConfig:
      type: object
      description: Per-feature plugin spec and environment variables for a standalone AWS unified test connection. The spec may contain ${ENV_VAR} placeholders that resolve from the env list at sync time.
      required:
      - spec
      additionalProperties: false
      properties:
        spec:
          type: object
          additionalProperties: true
          description: Plugin spec (regions, accounts, etc.). May reference env vars via ${VAR}.
        env:
          type: array
          description: Environment variables for the plugin. All values are stored as encrypted secrets and substituted into the spec at sync time.
          items:
            $ref: '#/components/schemas/PlatformSyncEnvCreate'
    PlatformRevokedNotification:
      allOf:
      - $ref: '#/components/schemas/PlatformBaseNotification'
      - type: object
        properties:
          status:
            enum:
            - revoked
    PlatformCompletedSingleAccountNotification:
      allOf:
      - $ref: '#/components/schemas/PlatformBaseNotification'
      - type: object
        required:
        - sync_role_arn
        - stack_id
        properties:
          status:
            enum:
            - completed_account
          sync_role_arn:
            type: string
          stack_id:
            type: string
    PlatformOnboardingAWSUnifiedNotification:
      oneOf:
      - $ref: '#/components/schemas/PlatformStartedNotification'
      - $ref: '#/components/schemas/PlatformRevokedNotification'
      - $ref: '#/components/schemas/PlatformFailedNotification'
      - $ref: '#/components/schemas/PlatformDeployedUnifiedNotification'
      - $ref: '#/components/schemas/PlatformCompletedNotification'
      - $ref: '#/components/schemas/PlatformCompletedSingleAccountNotification'
      discriminator:
        propertyName: status
        mapping:
          started: '#/components/schemas/PlatformStartedNotification'
          revoked: '#/components/schemas/PlatformRevokedNotification'
          failed: '#/components/schemas/PlatformFailedNotification'
          deployed_unified: '#/components/schemas/PlatformDeployedUnifiedNotification'
          completed: '#/components/schemas/PlatformCompletedNotification'
          completed_account: '#/components/schemas/PlatformCompletedSingleAccountNotification'
    PlatformOnboardingAWSUnifiedCostAndUsage:
      type: object
      description: Cost and usage feature status and details
      additionalProperties: false
      required:
      - stage
      properties:
        stage:
          type: string
          description: 'Stage of the cost and usage feature. Values: pending, started, deployed, provisioning, verified, failed, revoked.

            '
        failure_reason:
          type: string
          description: Error details if the feature failed
          x-go-name: FailureReason
        sync_role_arn:
          type: string
          x-go-name: SyncRoleARN
        s3_bucket_name:
          type: string
          x-go-name: S3BucketName
        s3_report_prefix:
          type: string
          x-go-name: S3ReportPrefix
        cur_report_name:
          type: string
          x-go-name: CURReportName
    PlatformBasicError:
      additionalProperties: false
      description: Basic Error
      required:
      - message
      - status
      properties:
        message:
          type: string
        status:
          type: integer
      title: Basic Error
      type: object
    PlatformOnboardingAWSUnifiedTestConnectionsResponse:
      type: object
      description: Response with created test connections
      additionalProperties: false
      required:
      - test_connections
      properties:
        test_connections:
          type: array
          items:
            type: object
            additionalProperties: false
            required:
            - feature
            - test_connection_id
            - plugin_path
            properties:
              feature:
                type: string
                enum:
                - asset_inventory
                - cost_and_usage
                - additional_metadata
              test_connection_id:
                type: string
                format: uuid
                x-go-name: TestConnectionID
              plugin_path:
                type: string
    PlatformFailedNotification:
      allOf:
      - $ref: '#/components/schemas/PlatformBaseNotification'
      - type: object
        required:
        - reason
        properties:
          status:
            enum:
            - failed
          reason:
            type: string
    PlatformOnboardingAWSUnified:
      type: object
      description: Unified AWS onboarding status with per-feature stages
      additionalProperties: false
      required:
      - id
      - created_at
      - updated_at
      - issuer_url
      - audience
      - subject
      properties:
        id:
          $ref: '#/components/schemas/PlatformOnboardingID'
        created_at:
          type: string
          format: date-time
          example: '2017-07-14T16:53:42Z'
        updated_at:
          type: string
          format: date-time
          example: '2017-07-14T16:53:42Z'
        issuer_url:
          type: string
          description: URL of the OpenID server
          x-go-name: IssuerURL
        audience:
          type: string
          x-go-name: Audience
        subject:
          type: string
          x-go-name: Subject
        asset_inventory:
          $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedAssetInventory'
        cost_and_usage:
          $ref: '#/components/schemas/PlatformOnboardingAWSUnifiedCostAndUsage'
    PlatformSyncEnvCreate:
      type: object
      description: Environment variable. Environment variables are assumed to be secret.
      required:
      - name
      properties:
        name:
          type: string
          description: Name of the environment variable
        value:
          type: string
          description: Value of the environment variable
  responses:
    PlatformBadRequest:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/PlatformFieldError'
      description: Bad request
    PlatformInternalError:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/PlatformBasicError'
      description: Internal Error
    PlatformNotFound:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/PlatformBasicError'
      description: Resource not found
    PlatformUnprocessableEntity:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/PlatformFieldError'
      description: UnprocessableEntity
    PlatformRequiresAuthentication:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/PlatformBasicError'
      description: Requires authentication
  parameters:
    platform_onboarding_id:
      name: onboarding_id
      in: path
      required: true
      x-go-name: OnboardingID
      schema:
        $ref: '#/components/schemas/PlatformOnboardingID'
    platform_aws_orgunit_id:
      name: aws_orgunit_id
      in: path
      required: true
      x-go-name: OrganizationalUnitID
      schema:
        $ref: '#/components/schemas/PlatformOrganizationalUnitID'
  securitySchemes:
    bearerAuth:
      scheme: bearer
      type: http
    basicAuth:
      scheme: basic
      type: http
    cookieAuth:
      scheme: cookie
      type: http