openapi: 3.0.0
info:
  description: The Eon.io REST API
  title: Eon accounts iam API
  version: 1.0.0
servers:
- url: /
security:
- ApiKeyAuth: []
tags:
- name: iam
paths:
  /v1/permissions:
    get:
      description: 'Description: Retrieves a list of user permissions.'
      operationId: listPermissions
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListPermissionsResponse'
          description: Permissions retrieved.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: List Permissions
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions: []
      x-audit-log:
        excluded: true
  /v1/roles:
    post:
      description: 'Description: Creates a custom role.<br/>


        When creating a role, you''ll specify a list of permissions and, optionally, data access conditions.

        Data access conditions let you restrict the resources a permission is granted for.

        For example, for a particular role, you can set data access conditions to allow access only to resources without PII.

        '
      operationId: createRole
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateRoleRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateRoleResponse'
          description: Role created.
        '400':
          description: Validation error.
        '409':
          description: A role with the same name already exists.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Create Role
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - create:account_roles
      x-audit-log:
        action: create
        entityRefs:
        - entityType: role
          in: resBody
          key: id
  /v1/roles/list:
    post:
      description: 'Description: Retrieves a list of user roles.'
      operationId: listRoles
      parameters:
      - allowEmptyValue: true
        description: 'Cursor that points to the first record of the next page of results.

          Get this value from the previous response.

          To preserve the results in the same order, use the same sorting and filters in the first request as all subsequent requests.

          '
        example: Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE=
        explode: true
        in: query
        name: pageToken
        required: false
        schema:
          format: tobedefined
          type: string
        style: form
      - description: Maximum number of items to return in the response.
        example: 10
        explode: true
        in: query
        name: pageSize
        required: false
        schema:
          default: 50
          minimum: 1
          type: integer
        style: form
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRolesResponse'
          description: Roles retrieved.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: List Roles
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions: []
      x-audit-log:
        excluded: true
  /v1/roles/{roleId}:
    delete:
      description: 'Description: Deletes a role.'
      operationId: deleteRole
      parameters:
      - description: Role ID.
        example: ceaf2281-bf04-542d-a801-a6a4865373ad
        explode: false
        in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      responses:
        '204':
          description: Role deleted.
        '404':
          description: Role not found
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Delete Role
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - delete:account_roles
      x-audit-log:
        action: delete
        entityRefs:
        - entityType: role
          in: path
          key: roleId
    get:
      description: 'Description: Retrieves a role.'
      operationId: getRole
      parameters:
      - description: Role ID.
        example: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        explode: false
        in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetRoleResponse'
          description: Role retrieved.
        '404':
          description: Role wasn't found.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Get Role
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions: []
      x-audit-log:
        excluded: true
    put:
      description: 'Description: This API operation updates the details of a role using its unique ID. The request body must contain the updated role details.'
      operationId: updateRole
      parameters:
      - description: ID of the role
        explode: false
        in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRoleRequest'
        description: The request body for updating a user
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateRoleResponse'
          description: Role updated.
        '404':
          description: Role not found
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Update Role
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - update:account_roles
      x-audit-log:
        action: update
        entityRefs:
        - entityType: role
          in: path
          key: roleId
  /v1/idps/list:
    post:
      description: 'Description: Retrieves a list of identity providers for the account.'
      operationId: listIdps
      parameters:
      - allowEmptyValue: true
        description: 'Cursor that points to the first record of the next page of results.

          Get this value from the previous response.

          To preserve the results in the same order, use the same sorting and filters in the first request as all subsequent requests.

          '
        example: Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE=
        explode: true
        in: query
        name: pageToken
        required: false
        schema:
          format: tobedefined
          type: string
        style: form
      - description: Maximum number of items to return in the response.
        example: 10
        explode: true
        in: query
        name: pageSize
        required: false
        schema:
          default: 50
          minimum: 1
          type: integer
        style: form
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListIdpsResponse'
          description: Identity providers retrieved.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: List Identity Providers
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - read:idp_configs
      x-audit-log:
        excluded: true
  /v1/idp-groups:
    post:
      description: 'Description: Maps an identity provider group to one or more Eon roles.<br/>


        When users authenticate via SAML and belong to the specified group, they''re granted the assigned roles.

        '
      operationId: createIdpGroup
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateIdpGroupRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateIdpGroupResponse'
          description: IdP group role assignment created.
        '400':
          description: Validation error.
        '404':
          description: Identity provider not found.
        '409':
          description: A group with the same provider-assigned group ID already exists for the specified identity provider.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Create IdP Group Role Assignment
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        action: create
        entityRefs:
        - entityType: idp_group
          in: resBody
          key: group.id
  /v1/idp-groups/list:
    post:
      description: 'Description: Retrieves a list of IdP group role assignments mapped in your Eon account.'
      operationId: listIdpGroups
      parameters:
      - allowEmptyValue: true
        description: 'Cursor that points to the first record of the next page of results.

          Get this value from the previous response.

          To preserve the results in the same order, use the same sorting and filters in the first request as all subsequent requests.

          '
        example: Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE=
        explode: true
        in: query
        name: pageToken
        required: false
        schema:
          format: tobedefined
          type: string
        style: form
      - description: Maximum number of items to return in the response.
        example: 10
        explode: true
        in: query
        name: pageSize
        required: false
        schema:
          default: 50
          minimum: 1
          type: integer
        style: form
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListIdpGroupsResponse'
          description: IdP group role assignments retrieved.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: List IdP Group Role Assignments
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        excluded: true
  /v1/idp-groups/{groupId}:
    delete:
      description: 'Description: Deletes an IdP group role assignment.<br/>


        After deletion, users are no longer assigned roles from their membership in the specified group.

        '
      operationId: deleteIdpGroup
      parameters:
      - description: Eon-assigned IdP group role assignment ID.
        example: ceaf2281-bf04-542d-a801-a6a4865373ad
        explode: false
        in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      responses:
        '204':
          description: IdP group role assignment deleted.
        '404':
          description: IdP group role assignment wasn't found.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Delete IdP Group Role Assignment
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        action: delete
        entityRefs:
        - entityType: idp_group
          in: path
          key: groupId
    get:
      description: 'Description: Retrieves an IdP group role assignment by ID.'
      operationId: getIdpGroup
      parameters:
      - description: Eon-assigned IdP group role assignment ID.
        example: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        explode: false
        in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetIdpGroupResponse'
          description: IdP group role assignment retrieved.
        '404':
          description: IdP group role assignment wasn't found.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Get IdP Group Role Assignment
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        excluded: true
    put:
      description: 'Description: Updates the roles assigned to an IdP group.<br/>


        This operation replaces all existing role assignments with the provided list.

        To add a role, include all existing roles plus the new one.

        To remove a role, include all roles except the one to remove.

        '
      operationId: updateIdpGroup
      parameters:
      - description: Eon-assigned IdP group role assignment ID.
        explode: false
        in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateIdpGroupRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateIdpGroupResponse'
          description: IdP group role assignment updated.
        '404':
          description: IdP group role assignment wasn't found.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Update IdP Group Role Assignment
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        action: update
        entityRefs:
        - entityType: idp_group
          in: path
          key: groupId
components:
  schemas:
    AccountIdCondition:
      example:
        accountIds:
        - accountIds
        - accountIds
        operator: IN
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ScalarOperators'
        accountIds:
          items:
            type: string
          type: array
      required:
      - accountIds
      - operator
      type: object
    TagKeyValuesCondition:
      example:
        tagKeyValues:
        - value: value
          key: key
        - value: value
          key: key
        operator: CONTAINS_ANY_OF
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ListOperators'
        tagKeyValues:
          items:
            $ref: '#/components/schemas/TagKeyValue'
          type: array
      required:
      - operator
      - tagKeyValues
      type: object
    ListIdpGroupsResponse:
      example:
        nextToken: Y2NiMGYyZmMtYjYyZi00OTc5LTgzNjQtYmQ2YjEyYzdjZTNifDE=
        groups:
        - roleIds:
          - 550e8400-e29b-41d4-a716-446655440000
          - 72bc42a0-e169-533f-b95a-4a434574756b
          providerGroupId: engineering-team
          idpId: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          displayName: Engineering Team
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        - roleIds:
          - 550e8400-e29b-41d4-a716-446655440000
          - 72bc42a0-e169-533f-b95a-4a434574756b
          providerGroupId: engineering-team
          idpId: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          displayName: Engineering Team
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        totalCount: 0
      properties:
        groups:
          description: List of IdP group role assignments.
          items:
            $ref: '#/components/schemas/IdpGroup'
          type: array
        totalCount:
          description: Total number of IdP group role assignments.
          type: integer
        nextToken:
          description: 'Cursor that points to the first record of the next page of results.

            Pass this value in the next request.

            '
          example: Y2NiMGYyZmMtYjYyZi00OTc5LTgzNjQtYmQ2YjEyYzdjZTNifDE=
          type: string
      required:
      - groups
      type: object
    Provider:
      description: 'Cloud provider.

        `PROVIDER_UNSPECIFIED` is supported only in responses.

        '
      enum:
      - AWS
      - AZURE
      - GCP
      - MONGO_ATLAS
      - GOOGLE_WORKSPACE
      - MICROSOFT_365
      - PROVIDER_UNSPECIFIED
      example: AWS
      type: string
      x-docs-internal-enum:
      - GOOGLE_WORKSPACE
      - MICROSOFT_365
    EnvironmentCondition:
      example:
        environments:
        - PROD
        - PROD
        operator: IN
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ScalarOperators'
        environments:
          items:
            $ref: '#/components/schemas/Environment'
          type: array
      required:
      - environments
      - operator
      type: object
    ResourceNameCondition:
      example:
        resourceNames:
        - resourceNames
        - resourceNames
        operator: IN
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ScalarOperators'
        resourceNames:
          items:
            type: string
          type: array
      required:
      - operator
      - resourceNames
      type: object
    UpdateIdpGroupResponse:
      example:
        group:
          roleIds:
          - 550e8400-e29b-41d4-a716-446655440000
          - 72bc42a0-e169-533f-b95a-4a434574756b
          providerGroupId: engineering-team
          idpId: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          displayName: Engineering Team
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
      properties:
        group:
          $ref: '#/components/schemas/IdpGroup'
      required:
      - group
      type: object
    TagKeysCondition:
      example:
        tagKeys:
        - tagKeys
        - tagKeys
        operator: CONTAINS_ANY_OF
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ListOperators'
        tagKeys:
          items:
            type: string
          type: array
      required:
      - operator
      - tagKeys
      type: object
    ListRolesResponse:
      example:
        nextToken: Y2NiMGYyZmMtYjYyZi00OTc5LTgzNjQtYmQ2YjEyYzdjZTNifDE=
        roles:
        - restoreDestinationLimits:
            effect: INCLUSIVE
            restoreAccountProviderIds:
            - restoreAccountProviderIds
            - restoreAccountProviderIds
          permissionGrants:
          - accessConditionId: Non-PII only.
            permission: inventory.view
          - accessConditionId: Non-PII only.
            permission: inventory.view
          sameSourceAccountRestoreLimits:
            dataAccessRuleId: dataAccessRuleId
            enabled: true
          isBuiltInRole: false
          name: My custom role
          accessConditions:
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
                  key: key
                operator: CONTAINS_ANY_OF
              cloudProvider:
                cloudProviders:
                - AWS
                - AWS
                operator: IN
              sourceRegion:
                regions:
                - regions
                - regions
                operator: IN
              subnets:
                subnets:
                - subnets
                - subnets
                operator: CONTAINS_ANY_OF
              group:
                operands:
                - resourceType:
                    operator: IN
                    resourceTypes:
                    - AWS_EC2
                    - AWS_RDS
                - environment:
                    operator: IN
                    environments:
                    - PROD
                    - PROD_INTERNAL
                operator: AND
              resourceType:
                resourceTypes:
                - AWS_EC2
                - AWS_EC2
                operator: IN
              apps:
                operator: CONTAINS_ANY_OF
                apps:
                - apps
                - apps
            effect: INCLUSIVE
            id: Non-PII only
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
                  key: key
                operator: CONTAINS_ANY_OF
              cloudProvider:
                cloudProviders:
                - AWS
                - AWS
                operator: IN
              sourceRegion:
                regions:
                - regions
                - regions
                operator: IN
              subnets:
                subnets:
                - subnets
                - subnets
                operator: CONTAINS_ANY_OF
              group:
                operands:
                - resourceType:
                    operator: IN
                    resourceTypes:
                    - AWS_EC2
                    - AWS_RDS
                - environment:
                    operator: IN
                    environments:
                    - PROD
                    - PROD_INTERNAL
                operator: AND
              resourceType:
                resourceTypes:
                - AWS_EC2
                - AWS_EC2
                operator: IN
              apps:
                operator: CONTAINS_ANY_OF
                apps:
                - apps
                - apps
            effect: INCLUSIVE
            id: Non-PII only
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        - restoreDestinationLimits:
            effect: INCLUSIVE
            restoreAccountProviderIds:
            - restoreAccountProviderIds
            - restoreAccountProviderIds
          permissionGrants:
          - accessConditionId: Non-PII only.
            permission: inventory.view
          - accessConditionId: Non-PII only.
            permission: inventory.view
          sameSourceAccountRestoreLimits:
            dataAccessRuleId: dataAccessRuleId
            enabled: true
          isBuiltInRole: false
          name: My custom role
          accessConditions:
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
                  key: key
                operator: CONTAINS_ANY_OF
              cloudProvider:
                cloudProviders:
                - AWS
                - AWS
                operator: IN
              sourceRegion:
                regions:
                - regions
                - regions
                operator: IN
              subnets:
                subnets:
                - subnets
                - subnets
                operator: CONTAINS_ANY_OF
              group:
                operands:
                - resourceType:
                    operator: IN
                    resourceTypes:
                    - AWS_EC2
                    - AWS_RDS
                - environment:
                    operator: IN
                    environments:
                    - PROD
                    - PROD_INTERNAL
                operator: AND
              resourceType:
                resourceTypes:
                - AWS_EC2
                - AWS_EC2
                operator: IN
              apps:
                operator: CONTAINS_ANY_OF
                apps:
                - apps
                - apps
            effect: INCLUSIVE
            id: Non-PII only
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
                  key: key
                operator: CONTAINS_ANY_OF
              cloudProvider:
                cloudProviders:
                - AWS
                - AWS
                operator: IN
              sourceRegion:
                regions:
                - regions
                - regions
                operator: IN
              subnets:
                subnets:
                - subnets
                - subnets
                operator: CONTAINS_ANY_OF
              group:
                operands:
                - resourceType:
                    operator: IN
                    resourceTypes:
                    - AWS_EC2
                    - AWS_RDS
                - environment:
                    operator: IN
                    environments:
                    - PROD
                    - PROD_INTERNAL
                operator: AND
              resourceType:
                resourceTypes:
                - AWS_EC2
                - AWS_EC2
                operator: IN
              apps:
                operator: CONTAINS_ANY_OF
                apps:
                - apps
                - apps
            effect: INCLUSIVE
            id: Non-PII only
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        totalCount: 0
      properties:
        roles:
          items:
            $ref: '#/components/schemas/Role'
          type: array
        totalCount:
          description: Total number of roles.
          type: integer
        nextToken:
          description: 'Cursor that points to the first record of the next page of results.

            Pass this value in the next request.

            '
          example: Y2NiMGYyZmMtYjYyZi00OTc5LTgzNjQtYmQ2YjEyYzdjZTNifDE=
          type: string
      required:
      - roles
      type: object
    GetRoleResponse:
      example:
        role:
          restoreDestinationLimits:
            effect: INCLUSIVE
            restoreAccountProviderIds:
            - restoreAccountProviderIds
            - restoreAccountProviderIds
          permissionGrants:
          - accessConditionId: Non-PII only.
            permission: inventory.view
          - accessConditionId: Non-PII only.
            permission: inventory.view
          sameSourceAccountRestoreLimits:
            dataAccessRuleId: dataAccessRuleId
            enabled: true
          isBuiltInRole: false
          name: My custom role
          accessConditions:
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
                  key: key
                operator: CONTAINS_ANY_OF
              cloudProvider:
                cloudProviders:
                - AWS
                - AWS
                operator: IN
              sourceRegion:
                regions:
                - regions
                - regions
                operator: IN
              subnets:
                subnets:
                - subnets
                - subnets
                operator: CONTAINS_ANY_OF
              group:
                operands:
                - resourceType:
                    operator: IN
                    resourceTypes:
                    - AWS_EC2
                    - AWS_RDS
                - environment:
                    operator: IN
                    environments:
                    - PROD
                    - PROD_INTERNAL
                operator: AND
              resourceType:
                resourceTypes:
                - AWS_EC2
                - AWS_EC2
                operator: IN
              apps:
                operator: CONTAINS_ANY_OF
                apps:
                - apps
                - apps
            effect: INCLUSIVE
            id: Non-PII only
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
                  key: key
                operator: CONTAINS_ANY_OF
              cloudProvider:
                cloudProviders:
                - AWS
                - AWS
                operator: IN
              sourceRegion:
                regions:
                - regions
                - regions
                operator: IN
              subnets:
                subnets:
                - subnets
                - subnets
                operator: CONTAINS_ANY_OF
              group:
                operands:
                - resourceType:
                    operator: IN
                    resourceTypes:
                    - AWS_EC2
                    - AWS_RDS
                - environment:
                    operator: IN
                    environments:
                    - PROD
                    - PROD_INTERNAL
                operator: AND
              resourceType:
                resourceTypes:
                - AWS_EC2
                - AWS_EC2
                operator: IN
              apps:
                operator: CONTAINS_ANY_OF
                apps:
                - apps
                - apps
            effect: INCLUSIVE
            id: Non-PII only
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
      properties:
        role:
          $ref: '#/components/schemas/Role'
      required:
      - role
      type: object
    AccessConditionalExpression:
      description: 'Conditional expression to evaluate to determine which resources are accessible.


        Only one of the expressions below can be used.

        For multiple conditions using `AND` or `OR` logic, group expressions with `group`.

        You can nest multiple groups to create more complex expressions.

        '
      example:
        resourceId:
          operator: IN
          resourceIds:
          - resourceIds
          - resourceIds
        resourceGroupName:
          resourceGroupNames:
          - resourceGroupNames
          - resourceGroupNames
          operator: IN
        tagKeys:
          tagKeys:
          - tagKeys
          - tagKeys
          operator: CONTAINS_ANY_OF
        vpc:
          vpcs:
          - vpcs
          - vpcs
          operator: IN
        resourceName:
          resourceNames:
          - resourceNames
          - resourceNames
          operator: IN
        dataClasses:
          dataClasses:
          - PII
          - PII
          operator: CONTAINS_ANY_OF
        accountId:
          accountIds:
          - accountIds
          - accountIds
          operator: IN
        environment:
          environments:
          - PROD
          - PROD
          operator: IN
        tagKeyValues:
          tagKeyValues:
          - value: value
            key: key
          - value: value
            key: key
          operator: CONTAINS_ANY_OF
        cloudProvider:
          cloudProviders:
          - AWS
          - AWS
          operator: IN
        sourceRegion:
          regions:
          - regions
          - regions
          operator: IN
        subnets:
          subnets:
          - subnets
          - subnets
          operator: CONTAINS_ANY_OF
        group:
          operands:
          - resourceType:
              operator: IN
              resourceTypes:
              - AWS_EC2
              - AWS_RDS
          - environment:
              operator: IN
              environments:
              - PROD
              - PROD_INTERNAL
          operator: AND
        resourceType:
          resourceTypes:
          - AWS_EC2
          - AWS_EC2
          operator: IN
        apps:
          operator: CONTAINS_ANY_OF
          apps:
          - apps
          - apps
      nullable: true
      properties:
        group:
          $ref: '#/components/schemas/RoleAccessGroupCondition'
        resourceType:
          $ref: '#/components/schemas/ResourceTypeCondition'
        dataClasses:
          $ref: '#/components/schemas/DataClassesCondition'
        environment:
          $ref: '#/components/schemas/EnvironmentCondition'
        apps:
          $ref: '#/components/schemas/AppsCondition'
        cloudProvider:
          $ref: '#/components/schemas/CloudProviderCondition'
        accountId:
          $ref: '#/components/schemas/AccountIdCondition'
        sourceRegion:
          $ref: '#/components/schemas/RegionCondition'
        vpc:
          $ref: '#/components/schemas/VpcCondition'
        subnets:
          $ref: '#/components/schemas/SubnetsCondition'
        resourceGroupName:
          $ref: '#/components/schemas/ResourceGroupNameCondition'
        resourceName:
          $ref: '#/components/schemas/ResourceNameCondition'
        resourceId:
          $ref: '#/components/schemas/ResourceIdCondition'
        tagKeys:
          $ref: '#/components/schemas/TagKeysCondition'
        tagKeyValues:
          $ref: '#/components/schemas/TagKeyValuesCondition'
      type: object
    UpdateIdpGroupRequest:
      example:
        roleIds:
        - 550e8400-e29b-41d4-a716-446655440000
        - 6ba7b810-9dad-11d1-80b4-00c04fd430c8
        displayName: Engineering Team
      properties:
        roleIds:
          description: 'List of [role IDs](../roles/list-roles) to assign to the group.

            This replaces all existing role assignments.

            '
          example:
          - 550e8400-e29b-41d4-a716-446655440000
          - 6ba7b810-9dad-11d1-80b4-00c04fd430c8
          items:
            format: uuid
            type: string
          type: array
        displayName:
          description: 'Optional human-readable label for the group mapping. For display and management only;

            it is not used when matching SAML groups during sign-on.

            Omit (or send null) to leave the existing label unchanged; send an empty string to clear it.

            '
          example: Engineering Team
          nullable: true
          type: string
          x-nullable: true
      required:
      - roleIds
      type: object
    ListOperators:
      description: 'Evaluates whether the original list constains any, all, or none of the values in this list.

        `UNSPECIFIED` is supported only in responses.

        '
      enum:
      - CONTAINS_ANY_OF
      - CONTAINS_NONE_OF
      - CONTAINS_ALL_OF
      - UNSPECIFIED
      example: CONTAINS_ANY_OF
      type: string
      x-enum-varnames:
      - CONTAINS_ANY_OF_OPERATOR
      - CONTAINS_NONE_OF_OPERATOR
      - CONTAINS_ALL_OF_OPERATOR
      - LIST_OPERATOR_UNSPECIFIED
    VpcCondition:
      example:
        vpcs:
        - vpcs
        - vpcs
        operator: IN
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ScalarOperators'
        vpcs:
          items:
            type: string
          type: array
      required:
      - operator
      - vpcs
      type: object
    RestoreDestinationLimits:
      description: 'Limits the restore accounts that can be used as restore destinations for operations granted by the role.

        '
      example:
        effect: INCLUSIVE
        restoreAccountProviderIds:
        - restoreAccountProviderIds
        - restoreAccountProviderIds
      nullable: true
      properties:
        effect:
          $ref: '#/components/schemas/AccessConditionEffect'
        restoreAccountProviderIds:
          description: 'List of cloud-provider-assigned restore account IDs to match against.

            '
          items:
            type: string
          minItems: 1
          type: array
      required:
      - effect
      - restoreAccountProviderIds
      type: object
      x-internal: false
    LogicalOperator:
      description: 'Logical operator to apply to the list of `operands`.

        `UNSPECIFIED` is supported only in responses.

        '
      enum:
      - AND
      - OR
      - UNSPECIFIED
      example: AND
      type: string
      x-enum-varnames:
      - AND_OPERATOR
      - OR_OPERATOR
      - LOGICAL_OPERATOR_UNSPECIFIED
    CreateIdpGroupResponse:
      example:
        group:
          roleIds:
          - 550e8400-e29b-41d4-a716-446655440000
          - 72bc42a0-e169-533f-b95a-4a434574756b
          providerGroupId: engineering-team
          idpId: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          displayName: Engineering Team
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
      properties:
        group:
          $ref: '#/components/schemas/IdpGroup'
      required:
      - group
      type: object
    AccessConditionEffect:
      description: 'Whether the data access condition is an allowlist or blocklist.

        '
      enum:
      - INCLUSIVE
      - EXCLUSIVE
      example: INCLUSIVE
      type: string
      x-enum-varnames:
      - RULE_EFFECT_INCLUSIVE
      - RULE_EFFECT_EXCLUSIVE
      x-fern-enum:
        INCLUSIVE:
          description: 'The permission is granted only to the resources that match the conditions.

            All other resources are excluded from the permission.

            '
        EXCLUSIVE:
          description: 'The permission is granted to all resources except those that match the conditions.

            '
    Permission:
      example:
        permissionType: inventory.view
        allowConditions: false
        description: Can view resource details in the inventory.
      properties:
        permissionType:
          $ref: '#/components/schemas/PermissionType'
        description:
          description: Description of the actions the permission allows.
          example: Can view resource details in the inventory.
          type: string
        allowConditions:
          default: false
          description: 'Whether the permission can be restricted with access conditions.

            Relevant when the permission is used in a user role.

            '
          type: boolean
      required:
      - allowConditions
      - category
      - description
      - name
      - permissionType
      type: object
    DataClassesCondition:
      example:
        dataClasses:
        - PII
        - PII
        operator: CONTAINS_ANY_OF
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ListOperators'
        dataClasses:
          items:
            $ref: '#/components/schemas/DataClass'
          type: array
      required:
      - dataClasses
      - operator
      type: object
    Environment:
      description: 'The resource''s environment: production, internal production, or staging.

        `ENVIRONMENT_UNSPECIFIED` is supported only in responses.

        '
      enum:
      - PROD
      - PROD_INTERNAL
      - STAGE
      - ENVIRONMENT_UNSPECIFIED
      example: PROD
      type: string
    CreateRoleRequest:
      example:
        restoreDestinationLimits:
          effect: INCLUSIVE
          restoreAccountProviderIds:
          - restoreAccountProviderIds
          - restoreAccountProviderIds
        permissionGrants:
        - accessConditionId: Non-PII only.
          permission: inventory.view
        - accessConditionId: Non-PII only.
          permission: inventory.view
        sameSourceAccountRestoreLimits:
          dataAccessRuleId: dataAccessRuleId
          enabled: true
        name: name
        accessConditions:
        - expression:
            resourceId:
              operator: IN
              resourceIds:
              - resourceIds
              - resourceIds
            resourceGroupName:
              resourceGroupNames:
              - resourceGroupNames
              - resourceGroupNames
              operator: IN
            tagKeys:
              tagKeys:
              - tagKeys
              - tagKeys
              operator: CONTAINS_ANY_OF
            vpc:
              vpcs:
              - vpcs
              - vpcs
              operator: IN
            resourceName:
              resourceNames:
              - resourceNames
              - resourceNames
              operator: IN
            dataClasses:
              dataClasses:
              - PII
              - PII
              operator: CONTAINS_ANY_OF
            accountId:
              accountIds:
              - accountIds
              - accountIds
              operator: IN
            environment:
              environments:
              - PROD
              - PROD
              operator: IN
            tagKeyValues:
              tagKeyValues:
              - value: value
                key: key
              - value: value
                key: key
              operator: CONTAINS_ANY_OF
            cloudProvider:
              cloudProviders:
              - AWS
              - AWS
              operator: IN
            sourceRegion:
              regions:
              - regions
              - regions
              operator: IN
            subnets:
              subnets:
              - subnets
              - subnets
              operator: CONTAINS_ANY_OF
            group:
              operands:
              - resourceType:
                  operator: IN
                  resourceTypes:
                  - AWS_EC2
                  - AWS_RDS
              - environment:
                  operator: IN
                  environments:
                  - PROD
                  - PROD_INTERNAL
              operator: AND
            resourceType:
              resourceTypes:
              - AWS_EC2
              - AWS_EC2
              operator: IN
            apps:
              operator: CONTAINS_ANY_OF
              apps:
              - apps
              - apps
          effect: INCLUSIVE
          id: Non-PII only
        - expression:
            resourceId:
              operator: IN
              resourceIds:
              - resourceIds
              - resourceIds
            resourceGroupName:
              resourceGroupNames:
              - resourceGroupNames
              - resourceGroupNames
              operator: IN
            tagKeys:
              tagKeys:
              - tagKeys
              - tagKeys
              operator: CONTAINS_ANY_OF
            vpc:
              vpcs:
              - vpcs
              - vpcs
              operator: IN
            resourceName:
              resourceNames:
              - resourceNames
              - resourceNames
              operator: IN
            dataClasses:
              dataClasses:
              - PII
              - PII
              operator: CONTAINS_ANY_OF
            accountId:
              accountIds:
              - accountIds
              - accountIds
              operator: IN
            environment:
              environments:
              - PROD
              - PROD
              operator: IN
            tagKeyValues:
              tagKeyValues:
              - value: value
                key: key
              - value: value
                key: key
              operator: CONTAINS_ANY_OF
            cloudProvider:
              cloudProviders:
              - AWS
              - AWS
              operator: IN
            sourceRegion:
              regions:
              - regions
              - regions
              operator: IN
            subnets:
              subnets:
              - subnets
              - subnets
              operator: CONTAINS_ANY_OF
            group:
              operands:
              - resourceType:
                  operator: IN
                  resourceTypes:
                  - AWS_EC2
                  - AWS_RDS
              - environment:
                  operator: IN
                  environments:
                  - PROD
                  - PROD_INTERNAL
              operator: AND
            resourceType:
              resourceTypes:
              - AWS_EC2
              - AWS_EC2
              operator: IN
            apps:
              operator: CONTAINS_ANY_OF
              apps:
              - apps
              - apps
          effect: INCLUSIVE
          id: Non-PII only
      properties:
        name:
          description: 'Role display name.

            Must be unique in your Eon account.

            '
          type: string
        permissionGrants:
          description: Permissions granted by the role.
          items:
            $ref: '#/components/schemas/PermissionGrantInput'
          type: array
        accessConditions:
          description: 'If present, the ID of the set of access conditions that restrict the resources the permission is granted for.

            The ID must be present in an entry in `accessConditions`, and the permission itself must support access conditions.

            If omitted, the permission is granted for all resources.

            '
          items:
            $ref: '#/components/schemas/AccessCondition'
          type: array
        restoreDestinationLimits:
          $ref: '#/components/schemas/RestoreDestinationLimits'
        sameSourceAccountRestoreLimits:
          $ref: '#/components/schemas/SameSourceAccountRestoreLimits'
      required:
      - name
      - permissionGrants
      type: object
    ScalarOperators:
      description: 'Evaluates whether the value is in the list.

        `UNSPECIFIED` is supported only in responses.

        '
      enum:
      - IN
      - NOT_IN
      - UNSPECIFIED
      example: IN
      type: string
      x-enum-varnames:
      - IN_OPERATOR
      - NOT_IN_OPERATOR
      - SCALAR_OPERATOR_UNSPECIFIED
    Error:
      example:
        error: error
      properties:
        error:
          type: string
      type: object
    TagKeyValue:
      example:
        value: value
        key: key
      properties:
        key:
          type: string
        value:
          type: string
      required:
      - key
      type: object
    SubnetsCondition:
      example:
        subnets:
        - subnets
        - subnets
        operator: CONTAINS_ANY_OF
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ListOperators'
        subnets:
          items:
            type: string
          type: array
      required:
      - operator
      - subnets
      type: object
    Role:
      description: Role.
      example:
        restoreDestinationLimits:
          effect: INCLUSIVE
          restoreAccountProviderIds:
          - restoreAccountProviderIds
          - restoreAccountProviderIds
        permissionGrants:
        - accessConditionId: Non-PII only.
          permission: inventory.view
        - accessConditionId: Non-PII only.
          permission: inventory.view
        sameSourceAccountRestoreLimits:
          dataAccessRuleId: dataAccessRuleId
          enabled: true
        isBuiltInRole: false
        name: My custom role
        accessConditions:
        - expression:
            resourceId:
              operator: IN
              resourceIds:
              - resourceIds
              - resourceIds
            resourceGroupName:
              resourceGroupNames:
              - resourceGroupNames
              - resourceGroupNames
              operator: IN
            tagKeys:
              tagKeys:
              - tagKeys
              - tagKeys
              operator: CONTAINS_ANY_OF
            vpc:
              vpcs:
              - vpcs
              - vpcs
              operator: IN
            resourceName:
              resourceNames:
              - resourceNames
              - resourceNames
              operator: IN
            dataClasses:
              dataClasses:
              - PII
              - PII
              operator: CONTAINS_ANY_OF
            accountId:
              accountIds:
              - accountIds
              - accountIds
              operator: IN
            environment:
              environments:
              - PROD
              - PROD
              operator: IN
            tagKeyValues:
              tagKeyValues:
              - value: value
                key: key
              - value: value
                key: key
              operator: CONTAINS_ANY_OF
            cloudProvider:
              cloudProviders:
              - AWS
              - AWS
              operator: IN
            sourceRegion:
              regions:
              - regions
              - regions
              operator: IN
            subnets:
              subnets:
              - subnets
              - subnets
              operator: CONTAINS_ANY_OF
            group:
              operands:
              - resourceType:
                  operator: IN
                  resourceTypes:
                  - AWS_EC2
                  - AWS_RDS
              - environment:
                  operator: IN
                  environments:
                  - PROD
                  - PROD_INTERNAL
              operator: AND
            resourceType:
              resourceTypes:
              - AWS_EC2
              - AWS_EC2
              operator: IN
            apps:
              operator: CONTAINS_ANY_OF
              apps:
              - apps
              - apps
          effect: INCLUSIVE
          id: Non-PII only
        - expression:
            resourceId:
              operator: IN
              resourceIds:
              - resourceIds
              - resourceIds
            resourceGroupName:
              resourceGroupNames:
              - resourceGroupNames
              - resourceGroupNames
              operator: IN
            tagKeys:
              tagKeys:
              - tagKeys
              - tagKeys
              operator: CONTAINS_ANY_OF
            vpc:
              vpcs:
              - vpcs
              - vpcs
              operator: IN
            resourceName:
              resourceNames:
              - resourceNames
              - resourceNames
              operator: IN
            dataClasses:
              dataClasses:
              - PII
              - PII
              operator: CONTAINS_ANY_OF
            accountId:
              accountIds:
              - accountIds
              - accountIds
              operator: IN
            environment:
              environments:
              - PROD
              - PROD
              operator: IN
            tagKeyValues:
              tagKeyValues:
              - value: value
                key: key
              - value: value
                key: key
              operator: CONTAINS_ANY_OF
            cloudProvider:
              cloudProviders:
              - AWS
              - AWS
              operator: IN
            sourceRegion:
              regions:
              - regions
              - regions
              operator: IN
            subnets:
              subnets:
              - subnets
              - subnets
              operator: CONTAINS_ANY_OF
            group:
              operands:
              - resourceType:
                  operator: IN
                  resourceTypes:
                  - AWS_EC2
                  - AWS_RDS
              - environment:
                  operator: IN
                  environments:
                  - PROD
                  - PROD_INTERNAL
              operator: AND
            resourceType:
              resourceTypes:
              - AWS_EC2
              - AWS_EC2
              operator: IN
            apps:
              operator: CONTAINS_ANY_OF
              apps:
              - apps
              - apps
          effect: INCLUSIVE
          id: Non-PII only
        id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
      properties:
        id:
          description: Role ID.
          example: daa42222-6ad2-5d37-bb26-4f2a9cba73da
          format: uuid
          type: string
        name:
          description: Role display name.
          example: My custom role
          type: string
        isBuiltInRole:
          description: 'Whether the role is a default role.

            If `true`, the role is a default role provided by Eon and can''t be modified or deleted.

            If `false`, the role is a custom, user-created role.

            '
          example: false
          type: boolean
        permissionGrants:
          description: List of permissions granted by the role.
          items:
            $ref: '#/components/schemas/PermissionGrant'
          type: array
        accessConditions:
          description: 'Sets of access conditions that restrict the resources a permission is granted for.

            IDs are set by you and are applied to the relevant permission in `permissionGrants`.

            An access condition can be applied to more than one permission grant.

            '
          items:
            $ref: '#/components/schemas/AccessCondition'
          type: array
        restoreDestinationLimits:
          $ref: '#/components/schemas/RestoreDestinationLimits'
        sameSourceAccountRestoreLimits:
          $ref: '#/components/schemas/SameSourceAccountRestoreLimits'
      required:
      - id
      - isBuiltInRole
      - name
      - permissionGrants
      - scopes
      type: object
    ResourceTypeCondition:
      example:
        resourceTypes:
        - AWS_EC2
        - AWS_EC2
        operator: IN
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ScalarOperators'
        resourceTypes:
          description: 'Resource types to evaluate.

            `RESOURCE_TYPE_UNSPECIFIED` is supported only in responses.

            '
          items:
            $ref: '#/components/schemas/ResourceType'
          type: array
      required:
      - operator
      - resourceTypes
      type: object
    UpdateRoleRequest:
      example:
        restoreDestinationLimits:
          effect: INCLUSIVE
          restoreAccountProviderIds:
          - restoreAccountProviderIds
          - restoreAccountProviderIds
        permissionGrants:
        - accessConditionId: Non-PII only.
          permission: inventory.view
        - accessConditionId: Non-PII only.
          permission: inventory.view
        sameSourceAccountRestoreLimits:
          dataAccessRuleId: dataAccessRuleId
          enabled: true
        name: name
        accessConditions:
        - expression:
            resourceId:
              operator: IN
              resourceIds:
              - resourceIds
              - resourceIds
            resourceGroupName:
              resourceGroupNames:
              - resourceGroupNames
              - resourceGroupNames
              operator: IN
            tagKeys:
              tagKeys:
              - tagKeys
              - tagKeys
              operator: CONTAINS_ANY_OF
            vpc:
              vpcs:
              - vpcs
              - vpcs
              operator: IN
            resourceName:
              resourceNames:
              - resourceNames
              - resourceNames
              operator: IN
            dataClasses:
              dataClasses:
              - PII
              - PII
              operator: CONTAINS_ANY_OF
            accountId:
              accountIds:
              - accountIds
              - accountIds
              operator: IN
            environment:
              environments:
              - PROD
              - PROD
              operator: IN
            tagKeyValues:
              tagKeyValues:
              - value: value
                key: key
              - value: value
                key: key
              operator: CONTAINS_ANY_OF
            cloudProvider:
              cloudProviders:
              - AWS
              - AWS
              operator: IN
            sourceRegion:
              regions:
              - regions
              - regions
              operator: IN
            subnets:
              subnets:
              - subnets
              - subnets
              operator: CONTAINS_ANY_OF
            group:
              operands:
              - resourceType:
                  operator: IN
                  resourceTypes:
                  - AWS_EC2
                  - AWS_RDS
              - environment:
                  operator: IN
                  environments:
                  - PROD
                  - PROD_INTERNAL
              operator: AND
            resourceType:
              resourceTypes:
              - AWS_EC2
              - AWS_EC2
              operator: IN
            apps:
              operator: CONTAINS_ANY_OF
              apps:
              - apps
              - apps
          effect: INCLUSIVE
          id: Non-PII only
        - expression:
            resourceId:
              operator: IN
              resourceIds:
              - resourceIds
              - resourceIds
            resourceGroupName:
              resourceGroupNames:
              - resourceGroupNames
              - resourceGroupNames
              operator: IN
            tagKeys:
              tagKeys:
              - tagKeys
              - tagKeys
              operator: CONTAINS_ANY_OF
            vpc:
              vpcs:
              - vpcs
              - vpcs
              operator: IN
            resourceName:
              resourceNames:
              - resourceNames
              - resourceNames
              operator: IN
            dataClasses:
              dataClasses:
              - PII
              - PII
              operator: CONTAINS_ANY_OF
            accountId:
              accountIds:
              - accountIds
              - accountIds
              operator: IN
            environment:
              environments:
              - PROD
              - PROD
              operator: IN
            tagKeyValues:
              tagKeyValues:
              - value: value
                key: key
              - value: value
                key: key
              operator: CONTAINS_ANY_OF
            cloudProvider:
              cloudProviders:
              - AWS
              - AWS
              operator: IN
            sourceRegion:
              regions:
              - regions
              - regions
              operator: IN
            subnets:
              subnets:
              - subnets
              - subnets
              operator: CONTAINS_ANY_OF
            group:
              operands:
              - resourceType:
                  operator: IN
                  resourceTypes:
                  - AWS_EC2
                  - AWS_RDS
              - environment:
                  operator: IN
                  environments:
                  - PROD
                  - PROD_INTERNAL
              operator: AND
            resourceType:
              resourceTypes:
              - AWS_EC2
              - AWS_EC2
              operator: IN
            apps:
              operator: CONTAINS_ANY_OF
              apps:
              - apps
              - apps
          effect: INCLUSIVE
          id: Non-PII only
      properties:
        name:
          description: The name of the role
          type: string
        permissionGrants:
          description: The permissions of the role
          items:
            $ref: '#/components/schemas/PermissionGrantInput'
          type: array
        accessConditions:
          description: The condition of the role, keyed by name
          items:
            $ref: '#/components/schemas/AccessCondition'
          type: array
        restoreDestinationLimits:
          $ref: '#/components/schemas/RestoreDestinationLimits'
        sameSourceAccountRestoreLimits:
          $ref: '#/components/schemas/SameSourceAccountRestoreLimits'
      required:
      - name
      - permissionGrants
      type: object
    ListIdpsResponse:
      example:
        nextToken: Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE=
        totalCount: 5
        idps:
        - id: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          providerName: okta-prod
        - id: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          providerName: okta-prod
      properties:
        idps:
          description: List of identity providers.
          items:
            $ref: '#/components/schemas/Idp'
          type: array
        totalCount:
          description: Total number of identity providers.
          example: 5
          type: integer
        nextToken:
          description: 'Cursor that points to the first record of the next page of results.

            Pass this value in the next request.

            '
          example: Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE=
          type: string
      required:
      - idps
      - totalCount
      type: object
    SameSourceAccountRestoreLimits:
      description: 'Restricts restores so a resource may only be restored back to its original source cloud account,

        matched on the cloud-provider account ID (not the Eon account ID). When `dataAccessRuleId` is set

        the restriction applies only to resources matching that access condition; otherwise it applies to

        all resources granted by the role.

        '
      example:
        dataAccessRuleId: dataAccessRuleId
        enabled: true
      nullable: true
      properties:
        enabled:
          description: Whether the same-source-account restore restriction is active.
          type: boolean
        dataAccessRuleId:
          description: 'Optional. The id of an access condition (an entry in `accessConditions`) that scopes which

            resources the restriction applies to. Omit to apply the restriction to all resources.

            '
          type: string
      required:
      - enabled
      type: object
      x-internal: false
    RegionCondition:
      example:
        regions:
        - regions
        - regions
        operator: IN
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ScalarOperators'
        regions:
          items:
            type: string
          type: array
      required:
      - operator
      - regions
      type: object
    PermissionType:
      description: User permission.
      enum:
      - permission_id_unspecified
      - global_settings.view
      - vault_accounts.manage
      - cost_explorer.view
      - user_access.manage
      - saml_group_access.manage
      - api_credentials.manage
      - api_credentials.rotate_secret
      - custom_roles.manage
      - dashboard.view
      - inventory.view
      - jobs.view
      - audit_logs.view
      - backup_settings.view
      - storage_gateway.view
      - database_explorer.search
      - file_explorer.search
      - snapshots.take_or_convert
      - resources.restore
      - configuration.validate
      - files.restore
      - databases.query
      - data_classes.override
      - environments.override
      - detected_apps.override
      - network_classification.override
      - control_violations.mute
      - backup_exclusion.manage
      - vaults.manage
      - source_accounts.manage
      - restore_accounts.manage
      - backup_policies.manage
      - discovery_configuration.manage
      - backup_configuration.manage
      - controls.manage
      - ransomware_detection.manage
      - notification_policies.manage
      - storage_gateway.manage
      - oauth_apps.manage
      - zero_etl_policies.manage
      - action_approval_rules.manage
      - action_approval_rules.view
      - action_approval_requests.manage
      - mpa_policies.manage
      - mpa_policies.view
      - mpa_requests.manage
      - restore_templates.manage
      - datalake.view
      - datalake.operate
      - compliance.view
      - classification_policies.manage
      example: inventory.view
      type: string
      x-docs-internal-enum:
      - zero_etl_policies.manage
      - action_approval_rules.manage
      - action_approval_rules.view
      - action_approval_requests.manage
      - mpa_policies.manage
      - mpa_policies.view
      - mpa_requests.manage
      - restore_templates.manage
      - datalake.view
      - datalake.operate
      - compliance.view
      - classification_policies.manage
    IdpGroup:
      description: IdP group role assignment.
      example:
        roleIds:
        - 550e8400-e29b-41d4-a716-446655440000
        - 72bc42a0-e169-533f-b95a-4a434574756b
        providerGroupId: engineering-team
        idpId: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
        displayName: Engineering Team
        id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
      properties:
        id:
          description: Eon-assigned group ID.
          example: daa42222-6ad2-5d37-bb26-4f2a9cba73da
          format: uuid
          type: string
        idpId:
          description: '[ID of the identity provider](./list-idps) the group belongs to.

            '
          example: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          format: uuid
          type: string
        providerGroupId:
          description: 'Identity-provider-assigned group ID.

            Must match the exact group ID passed by the identity provider to Eon during SAML sign-on.

            '
          example: engineering-team
          type: string
        roleIds:
          description: List of [role IDs](../roles/list-roles) assigned to the group.
          example:
          - 550e8400-e29b-41d4-a716-446655440000
          - 72bc42a0-e169-533f-b95a-4a434574756b
          items:
            format: uuid
            type: string
          type: array
        displayName:
          description: 'Optional human-readable label for the group mapping. For display and management only;

            it is not used when matching SAML groups during sign-on.

            '
          example: Engineering Team
          type: string
      required:
      - id
      - idpId
      - providerGroupId
      - roleIds
      type: object
    DataClass:
      description: 'Data classes.


        Allowed values: `FI`, `PHI`, `PII`

        '
      example: PII
      type: string
    CloudProviderCondition:
      example:
        cloudProviders:
        - AWS
        - AWS
        operator: IN
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ScalarOperators'
        cloudProviders:
          items:
            $ref: '#/components/schemas/Provider'
          type: array
      required:
      - cloudProviders
      - operator
      type: object
    ResourceType:
      description: 'Resource type identifier combining cloud provider and service type.

        `RESOURCE_TYPE_UNSPECIFIED` is supported only in responses.

        '
      enum:
      - AWS_EC2
      - AWS_RDS
      - AWS_S3
      - AWS_EFS
      - AWS_FSX
      - AWS_EKS_NAMESPACE
      - AWS_DYNAMO_DB
      - AWS_EBS_VOLUME
      - AWS_KEYSPACES_TABLE
      - AWS_CASSANDRA_CLUSTER
      - AWS_DOCUMENTDB
      - AWS_NEPTUNE
      - AZURE_VIRTUAL_MACHINE
      - AZURE_FILE_SHARE
      - AZURE_STORAGE_ACCOUNT
      - AZURE_DISK
      - AZURE_SQL_DATABASE
      - AZURE_SQL_MANAGED_INSTANCE
      - AZURE_SQL_VIRTUAL_MACHINE
      - AZURE_SAP_HANA_VM
      - AZURE_MYSQL
      - AZURE_POSTGRESQL
      - AZURE_COSMOSDB_MONGODB
      - AZURE_COSMOSDB_NOSQL
      - AZURE_AKS_NAMESPACE
      - AZURE_CASSANDRA_CLUSTER
      - ATLAS_MONGODB_CLUSTER
      - GCP_COMPUTE_ENGINE_INSTANCE
      - GCP_CLOUD_SQL_INSTANCE
      - GCP_CLOUD_STORAGE_BUCKET
      - GCP_GKE_NAMESPACE
      - GCP_BIG_QUERY
      - GCP_CLOUD_FIRESTORE
      - GCP_DISK
      - GCP_SAP_HANA_VM
      - GCP_CASSANDRA_CLUSTER
      - GOOGLE_WORKSPACE_RESOURCE
      - MICROSOFT_365_RESOURCE
      - RESOURCE_TYPE_UNSPECIFIED
      example: AWS_EC2
      type: string
      x-docs-internal-enum:
      - AWS_EBS_VOLUME
      - AWS_KEYSPACES_TABLE
      - AWS_CASSANDRA_CLUSTER
      - GCP_CASSANDRA_CLUSTER
      - AZURE_CASSANDRA_CLUSTER
      - AWS_DOCUMENTDB
      - AWS_NEPTUNE
      - AZURE_SAP_HANA_VM
      - AZURE_AKS_NAMESPACE
      - GCP_GKE_NAMESPACE
      - GCP_BIG_QUERY
      - GCP_CLOUD_FIRESTORE
      - GCP_DISK
      - GCP_SAP_HANA_VM
      - GOOGLE_WORKSPACE_RESOURCE
      - MICROSOFT_365_RESOURCE
    RoleAccessGroupCondition:
      description: 'Group of expressions to evaluate using the logical operator specified in `operator`.

        Each item in the `operands` list can be either a single expression or a nested `group` expression.

        '
      example:
        operands:
        - resourceType:
            operator: IN
            resourceTypes:
            - AWS_EC2
            - AWS_RDS
        - environment:
            operator: IN
            environments:
            - PROD
            - PROD_INTERNAL
        operator: AND
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/LogicalOperator'
        operands:
          description: 'List of expressions to evaluate using the logical operator specified in `operator`.

            Each item in the list can be either a single expression or a nested `group` expression.


            Must contain at least 2 items.

            '
          example:
          - resourceType:
              operator: IN
              resourceTypes:
              - AWS_EC2
              - AWS_RDS
          - environment:
              operator: IN
              environments:
              - PROD
              - PROD_INTERNAL
          items:
            $ref: '#/components/schemas/AccessConditionalExpression'
          minItems: 2
          type: array
      required:
      - operands
      - operator
      type: object
    Idp:
      description: Identity provider.
      example:
        id: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
        providerName: okta-prod
      properties:
        id:
          description: Eon-assigned identity provider ID.
          example: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          format: uuid
          type: string
        providerName:
          description: Identity provider display name.
          example: okta-prod
          type: string
      required:
      - id
      - providerName
      type: object
    GetIdpGroupResponse:
      example:
        group:
          roleIds:
          - 550e8400-e29b-41d4-a716-446655440000
          - 72bc42a0-e169-533f-b95a-4a434574756b
          providerGroupId: engineering-team
          idpId: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          displayName: Engineering Team
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
      properties:
        group:
          $ref: '#/components/schemas/IdpGroup'
      required:
      - group
      type: object
    ResourceGroupNameCondition:
      example:
        resourceGroupNames:
        - resourceGroupNames
        - resourceGroupNames
        operator: IN
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ScalarOperators'
        resourceGroupNames:
          items:
            type: string
          type: array
      required:
      - operator
      - resourceGroupNames
      type: object
    CreateIdpGroupRequest:
      example:
        roleIds:
        - 550e8400-e29b-41d4-a716-446655440000
        - 72bc42a0-e169-533f-b95a-4a434574756b
        providerGroupId: engineering-team
        idpId: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
        displayName: Engineering Team
      properties:
        idpId:
          description: '[ID of the identity provider](./list-idps) the group belongs to.'
          example: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          format: uuid
          type: string
        providerGroupId:
          description: 'Identity-provider-assigned group ID.

            Must match the exact group ID passed by the identity provider to Eon during SAML sign-on.

            '
          example: engineering-team
          type: string
        roleIds:
          description: List of [role IDs](../roles/list-roles) to assign to the group.
          example:
          - 550e8400-e29b-41d4-a716-446655440000
          - 72bc42a0-e169-533f-b95a-4a434574756b
          items:
            format: uuid
            type: string
          type: array
        displayName:
          description: 'Optional human-readable label for the group mapping. For display and management only;

            it is not used when matching SAML groups during sign-on.

            '
          example: Engineering Team
          nullable: true
          type: string
          x-nullable: true
      required:
      - idpId
      - providerGroupId
      - roleIds
      type: object
    CreateRoleResponse:
      example:
        role:
          restoreDestinationLimits:
            effect: INCLUSIVE
            restoreAccountProviderIds:
            - restoreAccountProviderIds
            - restoreAccountProviderIds
          permissionGrants:
          - accessConditionId: Non-PII only.
            permission: inventory.view
          - accessConditionId: Non-PII only.
            permission: inventory.view
          sameSourceAccountRestoreLimits:
            dataAccessRuleId: dataAccessRuleId
            enabled: true
          isBuiltInRole: false
          name: My custom role
          accessConditions:
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
                  key: key
                operator: CONTAINS_ANY_OF
              cloudProvider:
                cloudProviders:
                - AWS
                - AWS
                operator: IN
              sourceRegion:
                regions:
                - regions
                - regions
                operator: IN
              subnets:
                subnets:
                - subnets
                - subnets
                operator: CONTAINS_ANY_OF
              group:
                operands:
                - resourceType:
                    operator: IN
                    resourceTypes:
                    - AWS_EC2
                    - AWS_RDS
                - environment:
                    operator: IN
                    environments:
                    - PROD
                    - PROD_INTERNAL
                operator: AND
              resourceType:
                resourceTypes:
                - AWS_EC2
                - AWS_EC2
                operator: IN
              apps:
                operator: CONTAINS_ANY_OF
                apps:
                - apps
                - apps
            effect: INCLUSIVE
            id: Non-PII only
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
                  key: key
                operator: CONTAINS_ANY_OF
              cloudProvider:
                cloudProviders:
                - AWS
                - AWS
                operator: IN
              sourceRegion:
                regions:
                - regions
                - regions
                operator: IN
              subnets:
                subnets:
                - subnets
                - subnets
                operator: CONTAINS_ANY_OF
              group:
                operands:
                - resourceType:
                    operator: IN
                    resourceTypes:
                    - AWS_EC2
                    - AWS_RDS
                - environment:
                    operator: IN
                    environments:
                    - PROD
                    - PROD_INTERNAL
                operator: AND
              resourceType:
                resourceTypes:
                - AWS_EC2
                - AWS_EC2
                operator: IN
              apps:
                operator: CONTAINS_ANY_OF
                apps:
                - apps
                - apps
            effect: INCLUSIVE
            id: Non-PII only
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
      properties:
        role:
          $ref: '#/components/schemas/Role'
      required:
      - role
      type: object
    UpdateRoleResponse:
      example:
        role:
          restoreDestinationLimits:
            effect: INCLUSIVE
            restoreAccountProviderIds:
            - restoreAccountProviderIds
            - restoreAccountProviderIds
          permissionGrants:
          - accessConditionId: Non-PII only.
            permission: inventory.view
          - accessConditionId: Non-PII only.
            permission: inventory.view
          sameSourceAccountRestoreLimits:
            dataAccessRuleId: dataAccessRuleId
            enabled: true
          isBuiltInRole: false
          name: My custom role
          accessConditions:
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
                  key: key
                operator: CONTAINS_ANY_OF
              cloudProvider:
                cloudProviders:
                - AWS
                - AWS
                operator: IN
              sourceRegion:
                regions:
                - regions
                - regions
                operator: IN
              subnets:
                subnets:
                - subnets
                - subnets
                operator: CONTAINS_ANY_OF
              group:
                operands:
                - resourceType:
                    operator: IN
                    resourceTypes:
                    - AWS_EC2
                    - AWS_RDS
                - environment:
                    operator: IN
                    environments:
                    - PROD
                    - PROD_INTERNAL
                operator: AND
              resourceType:
                resourceTypes:
                - AWS_EC2
                - AWS_EC2
                operator: IN
              apps:
                operator: CONTAINS_ANY_OF
                apps:
                - apps
                - apps
            effect: INCLUSIVE
            id: Non-PII only
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
                  key: key
                operator: CONTAINS_ANY_OF
              cloudProvider:
                cloudProviders:
                - AWS
                - AWS
                operator: IN
              sourceRegion:
                regions:
                - regions
                - regions
                operator: IN
              subnets:
                subnets:
                - subnets
                - subnets
                operator: CONTAINS_ANY_OF
              group:
                operands:
                - resourceType:
                    operator: IN
                    resourceTypes:
                    - AWS_EC2
                    - AWS_RDS
                - environment:
                    operator: IN
                    environments:
                    - PROD
                    - PROD_INTERNAL
                operator: AND
              resourceType:
                resourceTypes:
                - AWS_EC2
                - AWS_EC2
                operator: IN
              apps:
                operator: CONTAINS_ANY_OF
                apps:
                - apps
                - apps
            effect: INCLUSIVE
            id: Non-PII only
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
      properties:
        role:
          $ref: '#/components/schemas/Role'
      required:
      - role
      type: object
    ResourceIdCondition:
      example:
        operator: IN
        resourceIds:
        - resourceIds
        - resourceIds
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ScalarOperators'
        resourceIds:
          items:
            type: string
          type: array
      required:
      - operator
      - resourceIds
      type: object
    AccessCondition:
      example:
        expression:
          resourceId:
            operator: IN
            resourceIds:
            - resourceIds
            - resourceIds
          resourceGroupName:
            resourceGroupNames:
            - resourceGroupNames
            - resourceGroupNames
            operator: IN
          tagKeys:
            tagKeys:
            - tagKeys
            - tagKeys
            operator: CONTAINS_ANY_OF
          vpc:
            vpcs:
            - vpcs
            - vpcs
            operator: IN
          resourceName:
            resourceNames:
            - resourceNames
            - resourceNames
            operator: IN
          dataClasses:
            dataClasses:
            - PII
            - PII
            operator: CONTAINS_ANY_OF
          accountId:
            accountIds:
            - accountIds
            - accountIds
            operator: IN
          environment:
            environments:
            - PROD
            - PROD
            operator: IN
          tagKeyValues:
            tagKeyValues:
            - value: value
              key: key
            - value: value
              key: key
            operator: CONTAINS_ANY_OF
          cloudProvider:
            cloudProviders:
            - AWS
            - AWS
            operator: IN
          sourceRegion:
            regions:
            - regions
            - regions
            operator: IN
          subnets:
            subnets:
            - subnets
            - subnets
            operator: CONTAINS_ANY_OF
          group:
            operands:
            - resourceType:
                operator: IN
                resourceTypes:
                - AWS_EC2
                - AWS_RDS
            - environment:
                operator: IN
                environments:
                - PROD
                - PROD_INTERNAL
            operator: AND
          resourceType:
            resourceTypes:
            - AWS_EC2
            - AWS_EC2
            operator: IN
          apps:
            operator: CONTAINS_ANY_OF
            apps:
            - apps
            - apps
        effect: INCLUSIVE
        id: Non-PII only
      properties:
        id:
          description: 'Display name for the data access rule, which also serves as its ID for use in `permissionGrants`.

            Valid characters: `[a-zA-Z0-9-_.\s]`.

            '
          example: Non-PII only
          type: string
        effect:
          $ref: '#/components/schemas/AccessConditionEffect'
        expression:
          $ref: '#/components/schemas/AccessConditionalExpression'
      required:
      - effect
      - expression
      - id
      type: object
    PermissionGrant:
      example:
        accessConditionId: Non-PII only.
        permission: inventory.view
      properties:
        permission:
          $ref: '#/components/schemas/PermissionType'
        accessConditionId:
          description: 'If present, the ID of the set of access conditions that restrict the resources the permission is granted for.

            The ID must be present in an entry in `accessConditions`, and the permission itself must support access conditions.

            If omitted, the permission is granted for all resources.

            '
          example: Non-PII only.
          type: string
      required:
      - permission
      type: object
    ListPermissionsResponse:
      example:
        permissions:
        - permissionType: inventory.view
          allowConditions: false
          description: Can view resource details in the inventory.
        - permissionType: inventory.view
          allowConditions: false
          description: Can view resource details in the inventory.
      properties:
        permissions:
          description: List of available user permissions.
          items:
            $ref: '#/components/schemas/Permission'
          type: array
      required:
      - permissions
      type: object
    PermissionGrantInput:
      example:
        accessConditionId: Non-PII only.
        permission: inventory.view
      properties:
        permission:
          $ref: '#/components/schemas/PermissionType'
        accessConditionId:
          description: 'If present, the ID of the set of access conditions that restrict the resources the permission is granted for.

            The ID must be present in an entry in `accessConditions`, and the permission itself must support access conditions.

            If omitted, the permission is granted for all resources.

            '
          example: Non-PII only.
          type: string
      required:
      - permission
      type: object
    AppsCondition:
      example:
        operator: CONTAINS_ANY_OF
        apps:
        - apps
        - apps
      nullable: true
      properties:
        operator:
          $ref: '#/components/schemas/ListOperators'
        apps:
          items:
            type: string
          type: array
      required:
      - apps
      - operator
      type: object
  securitySchemes:
    ApiKeyAuth:
      bearerFormat: JWT
      scheme: bearer
      type: http