openapi: 3.1.0
info:
  title: CockroachDB Cloud APIKeys RoleManagement API
  description: The CockroachDB Cloud API is a REST interface that provides programmatic access to manage the lifecycle of clusters within a CockroachDB Cloud organization. It enables developers and operators to create, configure, scale, and delete CockroachDB Serverless and Dedicated clusters without using the web console. The API supports cluster provisioning, node management, network authorization, customer-managed encryption keys, backup and restore, log and metric export, role management, and folder organization. Authentication is handled via bearer tokens, and the API is rate-limited to 10 requests per second per user.
  version: '2024-09-16'
  contact:
    name: Cockroach Labs Support
    url: https://support.cockroachlabs.com
  termsOfService: https://www.cockroachlabs.com/cloud-terms-and-conditions/
servers:
- url: https://cockroachlabs.cloud
  description: CockroachDB Cloud Production Server
security:
- bearerAuth: []
tags:
- name: RoleManagement
  description: Manage role-based access control, including assigning and removing roles for users across organization, folder, and cluster scopes.
paths:
  /api/v1/roles:
    get:
      operationId: ListRoleGrants
      summary: List role grants
      description: Returns a list of all role grants across the organization. Supports pagination.
      tags:
      - RoleManagement
      parameters:
      - $ref: '#/components/parameters/paginationPage'
      - $ref: '#/components/parameters/paginationLimit'
      - $ref: '#/components/parameters/paginationAsOfTime'
      - $ref: '#/components/parameters/paginationSortOrder'
      responses:
        '200':
          description: List of role grants returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRoleGrantsResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /api/v1/roles/{user_id}:
    get:
      operationId: GetAllRolesForUser
      summary: Get all roles for a user
      description: Returns all role grants assigned to the specified user across all resource scopes.
      tags:
      - RoleManagement
      parameters:
      - $ref: '#/components/parameters/userId'
      responses:
        '200':
          description: User roles retrieved successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetAllRolesForUserResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      operationId: SetRolesForUser
      summary: Set roles for a user
      description: Replaces all role grants for the specified user with the provided set of roles. Requires ORG_ADMIN role.
      tags:
      - RoleManagement
      parameters:
      - $ref: '#/components/parameters/userId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetRolesForUserRequest'
      responses:
        '200':
          description: User roles updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetAllRolesForUserResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /api/v1/roles/{user_id}/{resource_type}/{resource_id}/{role_name}:
    post:
      operationId: AddUserToRole
      summary: Add user to role
      description: Grants a specific role to a user for a particular resource. Requires ORG_ADMIN role.
      tags:
      - RoleManagement
      parameters:
      - $ref: '#/components/parameters/userId'
      - $ref: '#/components/parameters/resourceType'
      - $ref: '#/components/parameters/resourceId'
      - $ref: '#/components/parameters/roleName'
      responses:
        '200':
          description: User added to role successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetAllRolesForUserResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: RemoveUserFromRole
      summary: Remove user from role
      description: Revokes a specific role from a user for a particular resource. Requires ORG_ADMIN role.
      tags:
      - RoleManagement
      parameters:
      - $ref: '#/components/parameters/userId'
      - $ref: '#/components/parameters/resourceType'
      - $ref: '#/components/parameters/resourceId'
      - $ref: '#/components/parameters/roleName'
      responses:
        '200':
          description: User removed from role successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetAllRolesForUserResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /api/v1/users/persons-by-email:
    get:
      operationId: GetPersonUsersByEmail
      summary: Get person users by email
      description: Looks up person (human) user accounts by email address. Useful for resolving user IDs before assigning roles.
      tags:
      - RoleManagement
      parameters:
      - name: email
        in: query
        required: true
        description: Email address to look up.
        schema:
          type: string
          format: email
      responses:
        '200':
          description: User accounts returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetPersonUsersByEmailResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  parameters:
    userId:
      name: user_id
      in: path
      required: true
      description: Unique identifier of the user.
      schema:
        type: string
    roleName:
      name: role_name
      in: path
      required: true
      description: Name of the role to grant or revoke.
      schema:
        type: string
    paginationSortOrder:
      name: pagination.sort_order
      in: query
      description: Sort direction for paginated results. Accepted values are ASC and DESC.
      schema:
        type: string
        enum:
        - ASC
        - DESC
    resourceId:
      name: id
      in: path
      required: true
      description: Unique identifier of the resource.
      schema:
        type: string
    paginationAsOfTime:
      name: pagination.as_of_time
      in: query
      description: RFC3339 timestamp to return results as they were at a specific point in time (time-travel query).
      schema:
        type: string
        format: date-time
    paginationLimit:
      name: pagination.limit
      in: query
      description: Maximum number of results to return per page.
      schema:
        type: integer
        format: int32
        minimum: 1
        maximum: 500
    resourceType:
      name: resource_type
      in: path
      required: true
      description: Type of resource the role is scoped to. Accepted values include ORGANIZATION, FOLDER, CLUSTER.
      schema:
        type: string
        enum:
        - ORGANIZATION
        - FOLDER
        - CLUSTER
    paginationPage:
      name: pagination.page
      in: query
      description: Page number for paginated results, starting from 1.
      schema:
        type: string
  responses:
    Unauthorized:
      description: Authentication credentials are missing or invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: The request body or parameters are invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    ListRoleGrantsResponse:
      type: object
      description: Paginated list of role grants in the organization.
      properties:
        grants:
          type: array
          description: Array of role grant objects.
          items:
            type: object
        pagination:
          $ref: '#/components/schemas/PaginationResponse'
    SetRolesForUserRequest:
      type: object
      description: Request body for setting all roles for a user.
      required:
      - roles
      properties:
        roles:
          type: array
          description: Complete set of role grants to assign to the user.
          items:
            type: object
    GetPersonUsersByEmailResponse:
      type: object
      description: Person user accounts matching the queried email address.
      properties:
        users:
          type: array
          description: Array of user account objects.
          items:
            type: object
    PaginationResponse:
      type: object
      description: Pagination metadata included in list responses.
      properties:
        next:
          type: string
          description: Token or cursor for retrieving the next page of results.
        last:
          type: string
          description: Token or cursor for the last page of results.
        time:
          type: string
          format: date-time
          description: Server time at which the paginated query was executed.
    GetAllRolesForUserResponse:
      type: object
      description: All role grants assigned to a specific user.
      properties:
        roles:
          type: array
          description: Array of role grant objects.
          items:
            type: object
    Error:
      type: object
      description: Standard error response returned by the API.
      properties:
        code:
          type: integer
          description: HTTP status code of the error.
        message:
          type: string
          description: Human-readable description of the error.
        details:
          type: array
          description: Additional detail objects providing error context.
          items:
            type: object
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Bearer token authentication. Generate a token in the CockroachDB Cloud Console under Organization Settings > API Access.
externalDocs:
  description: CockroachDB Cloud API Documentation
  url: https://www.cockroachlabs.com/docs/cockroachcloud/cloud-api