openapi: 3.1.0
info:
  title: CockroachDB Cloud APIKeys IPAllowlists API
  description: The CockroachDB Cloud API is a REST interface that provides programmatic access to manage the lifecycle of clusters within a CockroachDB Cloud organization. It enables developers and operators to create, configure, scale, and delete CockroachDB Serverless and Dedicated clusters without using the web console. The API supports cluster provisioning, node management, network authorization, customer-managed encryption keys, backup and restore, log and metric export, role management, and folder organization. Authentication is handled via bearer tokens, and the API is rate-limited to 10 requests per second per user.
  version: '2024-09-16'
  contact:
    name: Cockroach Labs Support
    url: https://support.cockroachlabs.com
  termsOfService: https://www.cockroachlabs.com/cloud-terms-and-conditions/
servers:
- url: https://cockroachlabs.cloud
  description: CockroachDB Cloud Production Server
security:
- bearerAuth: []
tags:
- name: IPAllowlists
  description: Configure IP allowlist entries to control network access to a cluster.
paths:
  /api/v1/clusters/{cluster_id}/networking/allowlist:
    get:
      operationId: ListAllowlistEntries
      summary: List IP allowlist entries
      description: Returns a list of IP allowlist entries for the specified cluster. Supports pagination.
      tags:
      - IPAllowlists
      parameters:
      - $ref: '#/components/parameters/clusterId'
      - $ref: '#/components/parameters/paginationPage'
      - $ref: '#/components/parameters/paginationLimit'
      - $ref: '#/components/parameters/paginationAsOfTime'
      - $ref: '#/components/parameters/paginationSortOrder'
      responses:
        '200':
          description: List of allowlist entries returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListAllowlistEntriesResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    post:
      operationId: AddAllowlistEntry
      summary: Add IP allowlist entry
      description: Adds a new CIDR-based IP allowlist entry to the specified cluster to authorize inbound connections from a network range.
      tags:
      - IPAllowlists
      parameters:
      - $ref: '#/components/parameters/clusterId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AllowlistEntry'
      responses:
        '200':
          description: Allowlist entry added successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AllowlistEntry'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /api/v1/clusters/{cluster_id}/networking/allowlist/{cidr_ip}/{cidr_mask}:
    patch:
      operationId: UpdateAllowlistEntry
      summary: Update IP allowlist entry
      description: Updates the properties of an existing IP allowlist entry identified by CIDR IP and mask for the specified cluster.
      tags:
      - IPAllowlists
      parameters:
      - $ref: '#/components/parameters/clusterId'
      - $ref: '#/components/parameters/cidrIp'
      - $ref: '#/components/parameters/cidrMask'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AllowlistEntry'
      responses:
        '200':
          description: Allowlist entry updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AllowlistEntry'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeleteAllowlistEntry
      summary: Delete IP allowlist entry
      description: Removes an IP allowlist entry from the cluster identified by CIDR IP address and mask.
      tags:
      - IPAllowlists
      parameters:
      - $ref: '#/components/parameters/clusterId'
      - $ref: '#/components/parameters/cidrIp'
      - $ref: '#/components/parameters/cidrMask'
      responses:
        '200':
          description: Allowlist entry deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AllowlistEntry'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  parameters:
    cidrMask:
      name: cidr_mask
      in: path
      required: true
      description: Prefix length of the CIDR range (e.g. 24 for /24).
      schema:
        type: integer
        minimum: 0
        maximum: 32
    paginationSortOrder:
      name: pagination.sort_order
      in: query
      description: Sort direction for paginated results. Accepted values are ASC and DESC.
      schema:
        type: string
        enum:
        - ASC
        - DESC
    cidrIp:
      name: cidr_ip
      in: path
      required: true
      description: IPv4 address part of the CIDR range.
      schema:
        type: string
    paginationAsOfTime:
      name: pagination.as_of_time
      in: query
      description: RFC3339 timestamp to return results as they were at a specific point in time (time-travel query).
      schema:
        type: string
        format: date-time
    paginationLimit:
      name: pagination.limit
      in: query
      description: Maximum number of results to return per page.
      schema:
        type: integer
        format: int32
        minimum: 1
        maximum: 500
    clusterId:
      name: cluster_id
      in: path
      required: true
      description: Unique identifier of the CockroachDB Cloud cluster.
      schema:
        type: string
    paginationPage:
      name: pagination.page
      in: query
      description: Page number for paginated results, starting from 1.
      schema:
        type: string
  responses:
    Unauthorized:
      description: Authentication credentials are missing or invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: The request body or parameters are invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    PaginationResponse:
      type: object
      description: Pagination metadata included in list responses.
      properties:
        next:
          type: string
          description: Token or cursor for retrieving the next page of results.
        last:
          type: string
          description: Token or cursor for the last page of results.
        time:
          type: string
          format: date-time
          description: Server time at which the paginated query was executed.
    ListAllowlistEntriesResponse:
      type: object
      description: Paginated list of IP allowlist entries for a cluster.
      properties:
        allowlist:
          type: array
          description: Array of allowlist entry objects.
          items:
            $ref: '#/components/schemas/AllowlistEntry'
        pagination:
          $ref: '#/components/schemas/PaginationResponse'
    AllowlistEntry:
      type: object
      description: An IP allowlist entry representing a CIDR range authorized to connect to a CockroachDB cluster.
      required:
      - cidr_ip
      - cidr_mask
      properties:
        cidr_ip:
          type: string
          description: IPv4 address of the CIDR range.
        cidr_mask:
          type: integer
          description: Prefix length of the CIDR range.
          minimum: 0
          maximum: 32
        name:
          type: string
          description: Human-readable label for this allowlist entry.
        ui:
          type: boolean
          description: Whether this entry grants access to the DB Console (UI), in addition to SQL.
        sql:
          type: boolean
          description: Whether this entry grants SQL access.
    Error:
      type: object
      description: Standard error response returned by the API.
      properties:
        code:
          type: integer
          description: HTTP status code of the error.
        message:
          type: string
          description: Human-readable description of the error.
        details:
          type: array
          description: Additional detail objects providing error context.
          items:
            type: object
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Bearer token authentication. Generate a token in the CockroachDB Cloud Console under Organization Settings > API Access.
externalDocs:
  description: CockroachDB Cloud API Documentation
  url: https://www.cockroachlabs.com/docs/cockroachcloud/cloud-api