openapi: 3.2.0
info:
  description: '## Confluent Metadata API - Swagger UI

    ---

    This tool (SwaggerUI) and the Open API spec file are provided _for development / test

    purposes only_:


    - **Do _not_ enable in Production.**

    - **This tool only works with HTTP.**


    ### Authenticating

    Authentication is performed by HTTP Basic Auth or by presenting a bearer token.'
  title: MDS RBAC - RoleBinding CRUD API
  version: '1.0'
  x-api-id: 9a0c4222-9190-4816-b872-1a9cf002afab
  x-audience: external-public
servers:
- url: /
security:
- basicAuth: []
- bearerAuth: []
tags:
- description: CRUD rolebindings for users and groups.
  name: RBAC - RoleBinding CRUD
paths:
  /security/1.0/principals/{principal}/roles/{roleName}:
    delete:
      description: 'No-op if the user doesn''t have the role.


        Callable by Admins.'
      operationId: deleteRoleForPrincipal
      parameters:
      - description: Fully-qualified KafkaPrincipal string for a user or group.
        example: User:bob
        explode: false
        in: path
        name: principal
        required: true
        schema:
          pattern: (^User:.+$)|(^Group:.+$)
          type: string
        style: simple
      - description: The name of the role.
        example: DeveloperRead
        explode: false
        in: path
        name: roleName
        required: true
        schema:
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MdsScope'
        required: true
      responses:
        '204':
          description: Role removal processed.
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Error Response
      summary: Remove the role (cluster or resource scoped) from the principal at the given…
      tags:
      - RBAC - RoleBinding CRUD
    post:
      description: Callable by Admins.
      operationId: addRoleForPrincipal
      parameters:
      - description: Fully-qualified KafkaPrincipal string for a user or group.
        example: User:alice
        explode: false
        in: path
        name: principal
        required: true
        schema:
          pattern: (^User:.+$)|(^Group:.+$)
          type: string
        style: simple
      - description: The name of the cluster-scoped role to bind the user to.
        example: UserAdmin
        explode: false
        in: path
        name: roleName
        required: true
        schema:
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MdsScope'
        required: true
      responses:
        '204':
          description: Role Granted
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Error Response
      summary: Binds the principal to a cluster-scoped role for a specific cluster or in the…
      tags:
      - RBAC - RoleBinding CRUD
  /security/1.0/principals/{principal}/roles/{roleName}/resources:
    post:
      description: Callable by Admins.
      operationId: getRoleResourcesForPrincipal
      parameters:
      - description: Fully-qualified KafkaPrincipal string for a user or group.
        example: User:bob
        explode: false
        in: path
        name: principal
        required: true
        schema:
          pattern: (^User:.+$)|(^Group:.+$)
          type: string
        style: simple
      - description: The name of the role.
        example: DeveloperRead
        explode: false
        in: path
        name: roleName
        required: true
        schema:
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MdsScope'
        required: true
      responses:
        '200':
          content:
            application/json:
              example:
              - resourceType: Topic
                name: clicksTopic1
                patternType: LITERAL
              - resourceType: Topic
                name: orders-2019
                patternType: PREFIXED
              schema:
                items:
                  $ref: '#/components/schemas/ResourcePattern'
                type: array
          description: Granted
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Error Response
      summary: Look up the rolebindings for the principal at the given scope/cluster using the…
      tags:
      - RBAC - RoleBinding CRUD
  /security/1.0/principals/{principal}/roles/{roleName}/bindings:
    delete:
      description: Callable by Admins+ResourceOwners.
      operationId: removeRoleResourcesForPrincipal
      parameters:
      - description: Fully-qualified KafkaPrincipal string for a user or group.
        example: User:bob
        explode: false
        in: path
        name: principal
        required: true
        schema:
          pattern: (^User:.+$)|(^Group:.+$)
          type: string
        style: simple
      - description: The name of the role.
        example: DeveloperRead
        explode: false
        in: path
        name: roleName
        required: true
        schema:
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResourcesRequest'
        required: true
      responses:
        '204':
          description: Resources Removed
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Error Response
      summary: Incrementally remove the resources from the principal at the given…
      tags:
      - RBAC - RoleBinding CRUD
    post:
      description: Callable by Admins+ResourceOwners.
      operationId: addRoleResourcesForPrincipal
      parameters:
      - description: Fully-qualified KafkaPrincipal string for a user or group.
        example: User:bob
        explode: false
        in: path
        name: principal
        required: true
        schema:
          pattern: (^User:.+$)|(^Group:.+$)
          type: string
        style: simple
      - description: The name of the role.
        example: DeveloperRead
        explode: false
        in: path
        name: roleName
        required: true
        schema:
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResourcesRequest'
        required: true
      responses:
        '204':
          description: Granted
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Error Response
      summary: Incrementally grant the resources to the principal at the given scope/cluster…
      tags:
      - RBAC - RoleBinding CRUD
    put:
      description: Callable by Admins+ResourceOwners.
      operationId: setRoleResourcesForPrincipal
      parameters:
      - description: Fully-qualified KafkaPrincipal string for a user or group.
        example: User:bob
        explode: false
        in: path
        name: principal
        required: true
        schema:
          pattern: (^User:.+$)|(^Group:.+$)
          type: string
        style: simple
      - description: The name of the role.
        example: DeveloperRead
        explode: false
        in: path
        name: roleName
        required: true
        schema:
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResourcesRequest'
        required: true
      responses:
        '204':
          description: Resources Set
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Error Response
      summary: Overwrite existing resource grants
      tags:
      - RBAC - RoleBinding CRUD
components:
  schemas:
    ResourcePattern:
      example:
        name: clicksTopic1
        patternType: LITERAL
        resourceType: Topic
      properties:
        resourceType:
          example: Topic
          type: string
        name:
          example: clicksTopic1
          type: string
        patternType:
          example: LITERAL
          pattern: (^LITERAL$)|(^PREFIXED$)
          type: string
      required:
      - name
      - patternType
      - resourceType
      type: object
    ResourcesRequest:
      example:
        resourcePatterns:
        - name: clicksTopic1
          patternType: LITERAL
          resourceType: Topic
        - name: clicksTopic1
          patternType: LITERAL
          resourceType: Topic
        scope:
          clusterName: StagingCluster
          clusters:
            kafka-cluster: kafkaClusterId
            schema-registry-cluster: schemaRegistryClusterId
            flink-environment: flinkEnvironmentId
            ksql-cluster: ksqlClusterId
            cmf: cmfId
            connect-cluster: connectClusterId
      properties:
        scope:
          $ref: '#/components/schemas/MdsScope'
        resourcePatterns:
          items:
            $ref: '#/components/schemas/ResourcePattern'
          type: array
      required:
      - resourcePatterns
      - scope
      type: object
    ErrorResponse:
      properties:
        status_code:
          description: Optional - http status code
          example: 400
          type: integer
        error_code:
          description: Optional - Kafka error code (typically 5 digits)
          type: integer
        type:
          description: Optional - Type of error
          example: INVALID REQUEST DATA
          type: string
        message:
          description: Required - Top level error message
          example: Bad request
          type: string
        errors:
          description: Optional - List of errors
          items:
            $ref: '#/components/schemas/ErrorDetail'
          type: array
      required:
      - message
      type: object
    ErrorDetail:
      properties:
        error_type:
          type: string
        message:
          type: string
      required:
      - error_type
      - type
      type: object
    Scope_clusters:
      example:
        kafka-cluster: kafkaClusterId
        schema-registry-cluster: schemaRegistryClusterId
        flink-environment: flinkEnvironmentId
        ksql-cluster: ksqlClusterId
        cmf: cmfId
        connect-cluster: connectClusterId
      properties:
        kafka-cluster:
          example: kafkaClusterId
          type: string
        connect-cluster:
          example: connectClusterId
          type: string
        ksql-cluster:
          example: ksqlClusterId
          type: string
        schema-registry-cluster:
          example: schemaRegistryClusterId
          type: string
        cmf:
          example: cmfId
          type: string
        flink-environment:
          example: flinkEnvironmentId
          type: string
      type: object
    MdsScope:
      example:
        clusterName: StagingCluster
        clusters:
          kafka-cluster: kafkaClusterId
          schema-registry-cluster: schemaRegistryClusterId
          flink-environment: flinkEnvironmentId
          ksql-cluster: ksqlClusterId
          cmf: cmfId
          connect-cluster: connectClusterId
      properties:
        clusterName:
          example: StagingCluster
          type: string
        clusters:
          $ref: '#/components/schemas/Scope_clusters'
      type: object
  securitySchemes:
    basicAuth:
      scheme: basic
      type: http
    bearerAuth:
      bearerFormat: JWT
      scheme: bearer
      type: http