openapi: 3.2.0
info:
  description: '## Confluent Metadata API - Swagger UI

    ---

    This tool (SwaggerUI) and the Open API spec file are provided _for development / test

    purposes only_:


    - **Do _not_ enable in Production.**

    - **This tool only works with HTTP.**


    ### Authenticating

    Authentication is performed by HTTP Basic Auth or by presenting a bearer token.'
  title: MDS RBAC - RoleBinding Summaries API
  version: '1.0'
  x-api-id: 9a0c4222-9190-4816-b872-1a9cf002afab
  x-audience: external-public
servers:
- url: /
security:
- basicAuth: []
- bearerAuth: []
tags:
- description: Endpoints that roll up rolebinding information in various ways.
  name: RBAC - RoleBinding Summaries
paths:
  /security/1.0/lookup/principals/{principal}/roleNames:
    post:
      description: 'For groups, these are the roles that are bound.


        For users, this is the combination of roles granted to the specific user and roles

        granted to the user''s groups.


        Callable by Admins+User.'
      operationId: scopedPrincipalRolenames
      parameters:
      - description: Fully-qualified KafkaPrincipal string for a user or group.
        example: User:bob
        explode: false
        in: path
        name: principal
        required: true
        schema:
          pattern: (^User:.+$)|(^Group:.+$)
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MdsScope'
        required: true
      responses:
        '200':
          content:
            application/json:
              example:
              - Cluster Admin
              - Security Admin
              schema:
                items:
                  type: string
                type: array
          description: List of role names.
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Error Response
      summary: Returns the effective list of role names for a principal
      tags:
      - RBAC - RoleBinding Summaries
  /security/1.0/lookup/principal/{principal}/resources:
    post:
      description: 'Includes bindings from groups that the user belongs to.


        Callable by Admins+User.'
      operationId: lookupResourcesForPrincipal
      parameters:
      - description: Fully-qualified KafkaPrincipal string for a user or group.
        example: User:alice
        explode: false
        in: path
        name: principal
        required: true
        schema:
          pattern: (^User:.+$)|(^Group:.+$)
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MdsScope'
        required: true
      responses:
        '200':
          content:
            application/json:
              example:
                User:alice:
                  DeveloperRead:
                  - resourceType: Topic
                    name: billing-invoices
                    patternType: LITERAL
                Group:Investors:
                  DeveloperRead:
                  - resourceType: Topic
                    name: investing-
                    patternType: PREFIXED
              schema:
                additionalProperties:
                  additionalProperties:
                    items:
                      $ref: '#/components/schemas/ResourcePattern'
                    type: array
                  type: object
                type: object
          description: Nested map of principal-to-role-to-resources.
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Error Response
      summary: Look up the resource bindings for the principal at the given scope/cluster
      tags:
      - RBAC - RoleBinding Summaries
  /security/1.0/lookup/role/{roleName}:
    post:
      description: Callable by Admins.
      operationId: lookupPrincipalsWithRole
      parameters:
      - description: Role name to look up.
        example: DeveloperRead
        explode: false
        in: path
        name: roleName
        required: true
        schema:
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MdsScope'
        required: true
      responses:
        '200':
          content:
            application/json:
              example:
              - User:alice
              - Group:FinanceAdmin
              schema:
                items:
                  type: string
                type: array
          description: List of fully-qualified KafkaPrincipals.
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Error Response
      summary: Look up the KafkaPrincipals who have the given role for the given scope
      tags:
      - RBAC - RoleBinding Summaries
  /security/1.0/lookup/role/{roleName}/resource/{resourceType}/name/{resourceName}:
    post:
      description: Callable by Admins.
      operationId: lookupPrincipalsWithRoleOnResource
      parameters:
      - description: Role name to look up.
        example: DeveloperRead
        explode: false
        in: path
        name: roleName
        required: true
        schema:
          type: string
        style: simple
      - description: Type of resource to look up.
        example: Topic
        explode: false
        in: path
        name: resourceType
        required: true
        schema:
          type: string
        style: simple
      - description: Name of resource to look up.
        example: clicksTopic1
        explode: false
        in: path
        name: resourceName
        required: true
        schema:
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MdsScope'
        required: true
      responses:
        '200':
          content:
            application/json:
              example:
              - User:alice
              - Group:FinanceAdmin
              schema:
                items:
                  type: string
                type: array
          description: List of fully-qualified KafkaPrincipals.
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Error Response
      summary: Look up the KafkaPrincipals who have the given role on the specified resource…
      tags:
      - RBAC - RoleBinding Summaries
components:
  schemas:
    ResourcePattern:
      example:
        name: clicksTopic1
        patternType: LITERAL
        resourceType: Topic
      properties:
        resourceType:
          example: Topic
          type: string
        name:
          example: clicksTopic1
          type: string
        patternType:
          example: LITERAL
          pattern: (^LITERAL$)|(^PREFIXED$)
          type: string
      required:
      - name
      - patternType
      - resourceType
      type: object
    ErrorResponse:
      properties:
        status_code:
          description: Optional - http status code
          example: 400
          type: integer
        error_code:
          description: Optional - Kafka error code (typically 5 digits)
          type: integer
        type:
          description: Optional - Type of error
          example: INVALID REQUEST DATA
          type: string
        message:
          description: Required - Top level error message
          example: Bad request
          type: string
        errors:
          description: Optional - List of errors
          items:
            $ref: '#/components/schemas/ErrorDetail'
          type: array
      required:
      - message
      type: object
    ErrorDetail:
      properties:
        error_type:
          type: string
        message:
          type: string
      required:
      - error_type
      - type
      type: object
    Scope_clusters:
      example:
        kafka-cluster: kafkaClusterId
        schema-registry-cluster: schemaRegistryClusterId
        flink-environment: flinkEnvironmentId
        ksql-cluster: ksqlClusterId
        cmf: cmfId
        connect-cluster: connectClusterId
      properties:
        kafka-cluster:
          example: kafkaClusterId
          type: string
        connect-cluster:
          example: connectClusterId
          type: string
        ksql-cluster:
          example: ksqlClusterId
          type: string
        schema-registry-cluster:
          example: schemaRegistryClusterId
          type: string
        cmf:
          example: cmfId
          type: string
        flink-environment:
          example: flinkEnvironmentId
          type: string
      type: object
    MdsScope:
      example:
        clusterName: StagingCluster
        clusters:
          kafka-cluster: kafkaClusterId
          schema-registry-cluster: schemaRegistryClusterId
          flink-environment: flinkEnvironmentId
          ksql-cluster: ksqlClusterId
          cmf: cmfId
          connect-cluster: connectClusterId
      properties:
        clusterName:
          example: StagingCluster
          type: string
        clusters:
          $ref: '#/components/schemas/Scope_clusters'
      type: object
  securitySchemes:
    basicAuth:
      scheme: basic
      type: http
    bearerAuth:
      bearerFormat: JWT
      scheme: bearer
      type: http