openapi: 3.0.0
info:
  description: Use this REST API to manage your DataStax Astra DB organizations and perform lifecycle actions for your Astra DB databases.</br> </br> To get started, use the /v2/clientIdSecrets endpoints to create a token to authenticate your API calls.
  version: 2.3.0
  title: Astra DevOps Access List Roles API
  contact:
    email: ad-astra@datastax.com
servers:
- url: https://api.astra.datastax.com/
security:
- BearerAuth:
  - org-admin
  - org-db-create
  - org-db-terminate
  - org-db-view
  - org-db-expand
  - org-db-suspend
  - org-db-addpeering
  - org-db-readpeering
  - db-keyspace-create
  - db-cql
  - accesslist-write
  - accesslist-read
  - db-manage-privateendpoint
  - db-manage-telemetry
  - db-manage-backupconfiguration
tags:
- name: Roles
  description: Use the DevOps Roles APIs to manage roles in your Astra organization.
paths:
  /v2/organizations/roles:
    get:
      tags:
      - Roles
      summary: Get all roles for an organization
      operationId: getOrganizationRoles
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/Roles'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
    post:
      tags:
      - Roles
      summary: Create a role in an organization
      operationId: addOrganizationRole
      requestBody:
        description: The model for create role body
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateRoleRequest'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          $ref: '#/components/responses/ServerError'
  /v2/organizations/roles/{roleID}:
    get:
      tags:
      - Roles
      summary: Get a role for an organization
      description: Retrieve the details for a role for a given organization
      operationId: getOrganizationRole
      parameters:
      - $ref: '#/components/parameters/RoleIdParam'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/Role'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
    put:
      tags:
      - Roles
      summary: Update a role within an organization
      description: Update a role within an organization
      operationId: updateRole
      parameters:
      - $ref: '#/components/parameters/RoleIdParam'
      requestBody:
        description: The model for update role body
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRoleRequest'
      responses:
        '200':
          description: successful operation
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
    delete:
      tags:
      - Roles
      summary: Delete a role by ID
      operationId: deleteOrganizationRole
      parameters:
      - $ref: '#/components/parameters/RoleIdParam'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
components:
  schemas:
    Role:
      type: object
      description: Details of a user role and its policy details
      properties:
        id:
          type: string
          description: The unique system generated identifier of the role.
        name:
          type: string
          description: The name of the role.
        policy:
          $ref: '#/components/schemas/Policy'
        last_update_datetime:
          type: string
          description: The date and time of the last update on the role.
          format: date-time
        last_update_userid:
          type: string
          description: The userID of the user who last updated the role.
    Policy:
      type: object
      description: A policy for a role in Astra.
      required:
      - description
      - actions
      - effect
      - resources
      properties:
        description:
          description: A description of this policy
          type: string
        resources:
          type: array
          description: The resources this policy can manipulate.
          items:
            type: string
            example: drn:astra:org:__ORG_ID__
        actions:
          type: array
          description: 'The actions this policy can take. Example Actions: ''org-billing-write'' ''db-keyspace-create'''
          items:
            type: string
            enum:
            - db-all-keyspace-create
            - db-all-keyspace-describe
            - db-cql
            - db-graphql
            - db-keyspace-alter
            - db-keyspace-authorize
            - db-keyspace-create
            - db-keyspace-describe
            - db-keyspace-drop
            - db-keyspace-grant
            - db-keyspace-modify
            - db-rest
            - db-table-alter
            - db-table-authorize
            - db-table-create
            - db-table-describe
            - db-table-drop
            - db-table-grant
            - db-table-modify
            - db-table-select
            - db-manage-thirdpartymetrics
            - org-audits-read
            - org-billing-read
            - org-billing-write
            - org-db-addpeering
            - org-db-create
            - org-db-expand
            - org-db-passwordreset
            - org-db-suspend
            - org-db-terminate
            - org-db-view
            - org-external-auth-read
            - org-external-auth-write
            - org-notification-write
            - org-read
            - org-role-delete
            - org-role-read
            - org-role-write
            - org-token-read
            - org-token-write
            - org-user-read
            - org-user-write
            - org-write
        effect:
          type: string
          description: Effect this policy will have on the provided resource
          enum:
          - allow
    Error:
      description: ModelError information that is returned to users
      type: object
      required:
      - id
      - message
      properties:
        ID:
          type: integer
          example: 123
          description: API specific error code
        message:
          type: string
          example: Something is broken
          description: User-friendly description of error
    UpdateRoleRequest:
      type: object
      description: The updateRole model
      required:
      - name
      - policy
      properties:
        name:
          type: string
        policy:
          $ref: '#/components/schemas/Policy'
    CreateRoleRequest:
      type: object
      description: The createRole model
      required:
      - name
      - policy
      properties:
        name:
          type: string
        policy:
          $ref: '#/components/schemas/Policy'
    Roles:
      type: array
      description: an array of roles
      items:
        $ref: '#/components/schemas/Role'
    Errors:
      description: Errors is a collection of individual Error objects
      type: object
      required:
      - errors
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/Error'
  responses:
    ServerError:
      description: A server error occurred
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Errors'
    Unauthorized:
      description: The user is unauthorized to perform the operation
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Errors'
    Forbidden:
      description: The user is forbidden to perform the operation
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Errors'
    NotFound:
      description: The specified database was not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Errors'
    BadRequest:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Errors'
    NoContent:
      description: The request succeeded and no content is returned in response body
    Conflict:
      description: The database is not in a valid state to perform the operation
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Errors'
  parameters:
    RoleIdParam:
      in: path
      name: roleID
      required: true
      schema:
        type: string
      description: ID for the role
  securitySchemes:
    BearerAuth:
      description: An application token must be passed in header in order to access the API. https://docs.datastax.com/en/astra-db-serverless/administration/manage-application-tokens.html
      type: http
      scheme: bearer