openapi: 3.2.0 info: title: Fortanix Users API license: name: Apache 2.0 url: http://www.apache.org/licenses/LICENSE-2.0.html version: '1.0' description: 'Operations tagged Users across 2 of this provider''s published API definitions: fortanix-ccm-openapi-original.json, fortanix-dsm-openapi-original.json. Each path carries the servers of the definition it was published in.' servers: - url: https://ccm.fortanix.com - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) tags: - name: Users paths: /v1/user: get: tags: - Users summary: Get details of the current logged in user. description: Get details of the current logged in user. operationId: getLoggedInUser x-auth-resource: UserAuth,Reader,Writer,Manager responses: '200': description: User Details. content: application/json: schema: $ref: '#/components/schemas/User' security: - bearerToken: [] servers: - url: https://ccm.fortanix.com /v1/users: get: tags: - Users summary: Get all user's information. description: Get user's information with status. operationId: getAllUsers x-auth-resource: Reader,Writer,Manager parameters: - name: all_search in: query description: Search on name or email. required: false schema: type: string - name: limit in: query description: Maximum numbers of users to return. required: false schema: type: integer - name: offset in: query description: Number of users to skip from start. required: false schema: type: integer - name: sort_by in: query description: Sort fields. In the format of key1:ASC,key2:DESC,key3:DESC required: false schema: type: string responses: '200': description: Search result for user's objects. content: application/json: schema: $ref: '#/components/schemas/GetAllUsersResponse' security: - bearerToken: [] post: tags: - Users summary: Create a new user. description: Sign up a new user. operationId: createUser x-auth-resource: NoAuth parameters: - $ref: '#/components/parameters/SignupRequest' responses: '201': description: Created user details. content: application/json: schema: $ref: '#/components/schemas/User' servers: - url: https://ccm.fortanix.com /v1/users/invite: post: tags: - Users summary: Invite a user. description: Invite an existing user or a new user to join an existing account. operationId: inviteUser x-auth-resource: Manager,ManagerInLockedAccount parameters: - $ref: '#/components/parameters/InviteUserRequest' responses: '201': description: Invited User details. content: application/json: schema: $ref: '#/components/schemas/User' security: - bearerToken: [] servers: - url: https://ccm.fortanix.com /v1/users/{user-id}: get: tags: - Users summary: Get details of a particular user. description: Get details of a user. operationId: getUser x-auth-resource: UserAuth,Reader,Writer,Manager parameters: - $ref: '#/components/parameters/UserId' responses: '200': description: User Details. content: application/json: schema: $ref: '#/components/schemas/User' security: - bearerToken: [] patch: tags: - Users summary: Update status, name, and the role of a user. User with MANAGER access role can only update another user. description: Update status, name, and the role of a user. User with MANAGER access role can only update another users. operationId: UpdateUser x-auth-resource: UserAuth,Reader,Writer,Manager,ManagerInLockedAccount,WriterInLockedAccount parameters: - $ref: '#/components/parameters/UserId' - $ref: '#/components/parameters/UpdateUserRequest' responses: '200': description: Updated User status, name, and role. content: application/json: schema: $ref: '#/components/schemas/User' security: - bearerToken: [] delete: tags: - Users summary: Completely delete a user profile from system description: Completely deletes the currently logged in user from the system. operationId: deleteUserAccount x-auth-resource: UserAuth,Reader,Writer,Manager,ManagerInLockedAccount,WriterInLockedAccount parameters: - $ref: '#/components/parameters/UserId' responses: '204': description: Nothing is returned on success. security: - bearerToken: [] servers: - url: https://ccm.fortanix.com /v1/users/{user-id}/accounts: get: tags: - Users summary: Get user accounts description: Get information about the accounts of which the user is a member operationId: getUserAccounts x-auth-resource: UserAuth parameters: - $ref: '#/components/parameters/UserId' responses: '200': description: Information about the accounts of the user content: application/json: schema: $ref: '#/components/schemas/GetUserAccountsResponse' security: - bearerToken: [] delete: tags: - Users summary: Remove user's association with an account. operationId: deleteUserFromAccount x-auth-resource: Reader,Writer,Manager,ManagerInLockedAccount,WriterInLockedAccount parameters: - $ref: '#/components/parameters/UserId' responses: '204': description: Nothing is returned on success. security: - bearerToken: [] servers: - url: https://ccm.fortanix.com /sys/v1/users/change_password: post: operationId: ChangePassword tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Change user's password. description: Change user's password. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PasswordChangeRequest' responses: '204': description: Nothing is returned on success servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) /sys/v1/users/{user_id}/confirm_email: post: operationId: ConfirmEmail tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Confirms user's email address. description: Confirms user's email address. parameters: - name: user_id in: path required: true schema: type: string format: uuid requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ConfirmEmailRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/ConfirmEmailResponse' servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) /sys/v1/users/{user_id}: delete: operationId: DeleteStale tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Delete a stale user (for sysadmins). description: Delete a stale user (for sysadmins). parameters: - name: user_id in: path required: true schema: type: string format: uuid responses: '204': description: Nothing is returned on success get: operationId: GetUser tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Lookup a user. description: Lookup a user. parameters: - name: user_id in: path required: true schema: type: string format: uuid - $ref: '#/components/parameters/GetUserParams' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/User_2' patch: operationId: UpdateUser tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: 'Change a user''s properties like first_name, last_name, description, etc.' description: 'Change a user''s properties like first_name, last_name, description, etc.' parameters: - name: user_id in: path required: true schema: type: string format: uuid requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UserRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/User_2' servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) /sys/v1/users: delete: operationId: DeleteUser tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Delete the currently logged-in user. description: Delete the currently logged-in user. responses: '204': description: Nothing is returned on success get: operationId: ListUsers tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Get all users accessible to the requester. description: Get all users accessible to the requester. parameters: - $ref: '#/components/parameters/ListUsersParams' responses: 2XX: description: Success result content: application/json: schema: type: array items: $ref: '#/components/schemas/User_2' post: operationId: SignupUser tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Create a new user with the given properties. description: Create a new user with the given properties. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SignupRequest_2' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/User_2' servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) /sys/v1/users/{user_id}/accounts: delete: operationId: DeleteUserAccount tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Remove user's association with an account. description: Remove user's association with an account. parameters: - name: user_id in: path required: true schema: type: string format: uuid responses: '204': description: Nothing is returned on success servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) /sys/v1/users/forgot_password: post: operationId: ForgotPassword tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Initiate password reset sequence for a user. description: Initiate password reset sequence for a user. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ForgotPasswordRequest' responses: '204': description: Nothing is returned on success servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) /sys/v1/users/generate_recovery_codes: post: operationId: GenerateRecoveryCodes tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Generate recovery codes for two factor authentication. description: 'Generate backup recovery codes that may be used to complete two factor authentication. Two factor configuration must be unlocked to use this API.' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/RecoveryCodes' servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) /sys/v1/users/accounts: get: operationId: GetUserAccounts tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Get user's accounts. description: Get user's accounts. responses: 2XX: description: Success result content: application/json: schema: type: object additionalProperties: $ref: '#/components/schemas/UserAccountFlags' servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) /sys/v1/users/permissions: get: operationId: GetUserPermissions tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Returns the caller's permissions description: Returns the caller's permissions parameters: - $ref: '#/components/parameters/GetUserPermissionsParams' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/GetUserPermissionsResponse' servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) /sys/v1/users/invite: post: operationId: InviteUser tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Invite an existing user or new user to join an existing account. description: Invite an existing user or new user to join an existing account. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UserRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/User_2' servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) /sys/v1/users/process_invite: post: operationId: ProcessInvite tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Accept or reject pending account invitations. description: Accept or reject pending account invitations. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ProcessInviteRequest' responses: '204': description: Nothing is returned on success servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) /sys/v1/users/resend_confirm_email: post: operationId: ResendConfirmEmail tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Resend email with link to confirm user's email address. description: Resend email with link to confirm user's email address. responses: '204': description: Nothing is returned on success servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) /sys/v1/users/{user_id}/resend_invite: post: operationId: ResendInvite tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Resend invite to the user to join a specific account. description: Resend invite to the user to join a specific account. parameters: - name: user_id in: path required: true schema: type: string format: uuid responses: '204': description: Nothing is returned on success servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) /sys/v1/users/{user_id}/reset_password: post: operationId: ResetPassword tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Reset a user's password. Requires a valid password reset token. description: Reset a user's password. Requires a valid password reset token. parameters: - name: user_id in: path required: true schema: type: string format: uuid requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PasswordResetRequest' responses: '204': description: Nothing is returned on success servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) /sys/v1/users/{user_id}/validate_token: post: operationId: ValidateToken tags: - Users security: - bearerToken: [] - apiKeyAuth: [] summary: Validates password reset token for the user. description: Validates password reset token for the user. parameters: - name: user_id in: path required: true schema: type: string format: uuid requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ValidateTokenRequest' responses: 2XX: description: Success result content: application/json: schema: $ref: '#/components/schemas/ValidateTokenResponse' servers: - url: '{dsmEndpoint}' description: DSM Endpoint variables: dsmEndpoint: default: https://amer.smartkey.io description: Type your DSM server URL here (include https://) components: schemas: User: type: object required: - user_id - user_email properties: user_id: type: string format: uuid description: User Id. first_name: type: string description: First Name. last_name: type: string description: Last Name. user_email: type: string description: User Email. last_logged_in_at: type: integer format: int64 description: Last login time of user. created_at: type: integer format: int64 description: Creation time of user. email_verified: type: boolean description: Whether this user's email has been verified. status: $ref: '#/components/schemas/UserStatus' roles: type: array items: $ref: '#/components/schemas/AccessRoles' user_account_status: $ref: '#/components/schemas/UserAccountStatus' accepted_latest_terms_and_conditions: type: boolean description: Whether this user has accepted latest terms and conditions or not. new_email: type: string description: User’s new email address before it has been confirmed. UserAccountStatus: type: string description: Status of an Account for a user. enum: - ACTIVE - PENDING - DISABLED SignupRequest: type: object required: - user_email - user_password properties: user_email: type: string description: User's email address. user_password: type: string format: password description: The password to assign to this user in Confidential Computing Manager. first_name: type: string last_name: type: string recaptcha_response: type: string AccessRoles: type: string description: Roles of a user. enum: - READER - WRITER - MANAGER InviteUserRequest: type: object required: - user_email - roles properties: user_email: type: string description: User's email address. roles: type: array items: $ref: '#/components/schemas/AccessRoles' first_name: type: string last_name: type: string UpdateUserRequest: type: object properties: first_name: type: string description: First name. last_name: type: string description: Last name. roles: type: array items: $ref: '#/components/schemas/AccessRoles' user_account_status: $ref: '#/components/schemas/UserAccountStatus' user_email: type: string description: User's new email address. UserAccountInfo: type: object required: - roles - status properties: roles: type: array description: Role of the current user in the account. items: $ref: '#/components/schemas/AccessRoles' status: $ref: '#/components/schemas/UserAccountStatus' UserStatus: type: string description: Status of a user. enum: - ACTIVE - PENDING - DISABLED SearchMetadata: type: object required: - total_count - filtered_count - page - pages - limit properties: page: type: integer description: Current page number pages: type: integer description: Total pages as per the item counts and page limit. limit: type: integer description: Number of items to limit in a page. total_count: type: integer description: Total number of unfiltered items. filtered_count: type: integer description: Total number of items as per the current filter. GetAllUsersResponse: type: object required: - items properties: metadata: $ref: '#/components/schemas/SearchMetadata' items: type: array items: $ref: '#/components/schemas/User' GetUserAccountsResponse: type: object description: Application configurations attached to the image. additionalProperties: $ref: '#/components/schemas/UserAccountInfo' GetUserPermissionsResponse: allOf: - type: object properties: account: type: array items: $ref: '#/components/schemas/AccountPermissions' description: User's permissions in the account. all_groups: type: - array - 'null' items: $ref: '#/components/schemas/GroupPermissions' description: 'User''s permissions in all groups. Note that this will only be returned if the user has one or more all-groups roles.' groups: type: object additionalProperties: type: array items: $ref: '#/components/schemas/GroupPermissions' description: User's permissions in groups. required: - account - groups MfaRenameDeviceRequest: allOf: - type: object description: Request to rename a FIDO device. properties: old_name: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: Old name of FIDO device. new_name: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: New name of FIDO device. required: - old_name - new_name UserSort: oneOf: - title: UserSortVariantByUserId type: object properties: sort: type: string pattern: ^user_id:(?:asc|desc)$ example: user_id:asc start: type: string format: uuid required: - sort GetUserPermissionsParams: allOf: - type: object properties: with_implied: type: boolean description: 'If `true`, implied permissions are added in the output. For example, if permission A implies permission B, and the user has permission A, the output will include both A and B if this is set to `true`. If this is set to `false`, B will only be returned if it was assigned to the user directly.' UserGroupRole: description: User's role(s) in a group. allOf: - type: array uniqueItems: true items: $ref: '#/components/schemas/LegacyUserGroupRoleOrRoleId' PasswordResetRequest: allOf: - type: object description: Request to perform a password reset. properties: reset_token: type: string new_password: type: string required: - reset_token - new_password WithGroups: type: string enum: - all - explicit_only - none ForgotPasswordRequest: allOf: - type: object description: Initiate password reset sequence. properties: user_email: type: string format: email recaptcha_response: type: - string - 'null' required: - user_email Base64UrlSafe: type: string format: byte User_2: allOf: - type: object properties: account_role: $ref: '#/components/schemas/UserAccountFlags' created_at: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z dependent_services: type: - array - 'null' uniqueItems: true items: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: type: - string - 'null' email_verified: type: - boolean - 'null' explicit_groups: type: - object - 'null' additionalProperties: $ref: '#/components/schemas/UserGroupRole' description: 'Explicit group assignments. This is similar to `groups` field except that it does not include groups due to all-groups roles. Use this field to find out which group assignments can be changed using `mod_groups` and `del_groups` fields in user update API.' first_name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ groups: type: - object - 'null' additionalProperties: $ref: '#/components/schemas/UserGroupRole' has_account: type: - boolean - 'null' has_password: type: - boolean - 'null' last_logged_in_at: type: string pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$ example: 20170509T070912Z last_name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ mfa_devices: type: array items: $ref: '#/components/schemas/MfaDevice' description: Mfa devices registered with the user new_email: type: string format: email self_provisioned: type: - boolean - 'null' u2f_devices: type: array items: $ref: '#/components/schemas/MfaDevice' user_email: type: string format: email user_id: type: string format: uuid required: - account_role - mfa_devices - u2f_devices - user_email - user_id UserAccountFlags: description: User's role(s) and state in an account. allOf: - type: array uniqueItems: true items: $ref: '#/components/schemas/UserAccountFlagOrRole' PublicKeyCredentialAuthenticatorAttestationResponse: allOf: - type: object description: 'Contains the attributes that are returned to the caller when a new credential is created, or a new assertion is requested.' properties: id: $ref: '#/components/schemas/Base64UrlSafe' description: Credential's identifier. type: $ref: '#/components/schemas/PublicKeyCredentialType' description: Type of credential. response: $ref: '#/components/schemas/AuthenticatorAttestationResponse' get_client_extension_results: $ref: '#/components/schemas/AuthenticationExtensionsClientOutputs' description: 'This field contains client extension output entries produced by the extension’s client extension processing.' ListUsersParams: allOf: - type: object properties: group_id: type: string format: uuid acct_id: type: string format: uuid limit: type: integer offset: type: integer with_groups: $ref: '#/components/schemas/WithGroups' - $ref: '#/components/schemas/UserSort' AuthenticatorAttestationResponse: allOf: - type: object description: 'This represents the authenticator''s response to a client’s request for the creation of a new public key credential. It contains information about the new credential that can be used to identify it for later use, and metadata that can be used by the WebAuthn Relying Party to assess the characteristics of the credential during registration. ' properties: clientDataJSON: $ref: '#/components/schemas/Base64UrlSafe' getTransports: type: - array - 'null' items: $ref: '#/components/schemas/AuthenticatorTransport' description: 'Values obtained from `AuthenticatorAttestationResponse.getTransports()`. Webauthn spec recommends RP to store it and user them along with `allowCredentials` while authentication ceremony.' attestationObject: $ref: '#/components/schemas/Base64UrlSafe' required: - clientDataJSON - attestationObject AuthenticatorTransportInner: description: See [AuthenticatorTransport] type. type: string enum: - usb - nfc - ble - internal PublicKeyCredentialType: description: 'https://www.w3.org/TR/webauthn-2/#enum-credentialType This enum defines valid cred types.' type: string enum: - public-key ValidateTokenRequest: allOf: - type: object properties: reset_token: type: string required: - reset_token UserRequest: allOf: - type: object properties: account_role: $ref: '#/components/schemas/UserAccountFlags' add_groups: type: - object - 'null' additionalProperties: $ref: '#/components/schemas/UserGroupRole' add_mfa_devices: type: - array - 'null' items: $ref: '#/components/schemas/FidoAddDeviceRequest' description: FIDO devices to add. Only one device can be added at present. add_u2f_devices: type: - array - 'null' items: $ref: '#/components/schemas/U2fAddDeviceRequest' del_groups: type: - object - 'null' additionalProperties: $ref: '#/components/schemas/UserGroupRole' del_mfa_devices: type: - array - 'null' items: $ref: '#/components/schemas/MfaDelDeviceRequest' description: Mfa devices to delete del_u2f_devices: type: - array - 'null' items: $ref: '#/components/schemas/MfaDelDeviceRequest' description: type: - string - 'null' enable: type: - boolean - 'null' description: Used to enable or disable a user's membership in an account. Always starts as enabled, regardless of input. Can be changed later by the account admin. first_name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ last_name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ mod_groups: type: - object - 'null' additionalProperties: $ref: '#/components/schemas/UserGroupRole' rename_mfa_devices: type: - array - 'null' items: $ref: '#/components/schemas/MfaRenameDeviceRequest' description: Mfa devices to rename rename_u2f_devices: type: - array - 'null' items: $ref: '#/components/schemas/MfaRenameDeviceRequest' user_email: type: string format: email user_password: type: string SignupRequest_2: allOf: - type: object description: Request to signup a new user. properties: user_email: type: string format: email user_password: type: string recaptcha_response: type: - string - 'null' first_name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ last_name: type: - string - 'null' maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ required: - user_email - user_password LegacyUserGroupRole: description: Legacy user group role type: string enum: - GROUPAUDITOR - GROUPADMINISTRATOR AuthenticationExtensionsClientOutputs: allOf: - type: object description: 'This is the response of extension inputs. For every input, an output must be returned if the input was considered. ' properties: appidExclude: type: - boolean - 'null' description: 'Response of `appidExclude` extension. See [AuthenticationExtensionsClientInputs::appid_exclude].' appid: type: - boolean - 'null' description: 'Response of `appid` extension. See [AuthenticationExtensionsClientInputs::appid].' UserAccountFlagOrRole: description: User account flag or legacy user account role name or custom role id oneOf: - $ref: '#/components/schemas/UserAccountFlag' - $ref: '#/components/schemas/LegacyUserAccountRole' - type: string format: uuid LegacyUserGroupRoleOrRoleId: description: Legacy user group role name or custom role id oneOf: - $ref: '#/components/schemas/LegacyUserGroupRole' - type: string format: uuid MfaDevice: allOf: - type: object description: A FIDO device that may be used for second factor authentication. properties: name: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: Name given to the FIDO device. type: $ref: '#/components/schemas/MfaDeviceType' origin: type: - string - 'null' description: Origin of the FIDO device. required: - name - type ConfirmEmailResponse: allOf: - type: object properties: user_email: type: string format: email required: - user_email U2fAddDeviceRequest: allOf: - type: object description: Description of a U2F device to add for two factor authentication. properties: name: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ registrationData: type: string format: byte clientData: type: string format: byte version: type: string required: - name - registrationData - clientData - version AuthenticatorTransport: description: 'Hints by relying party on how client should communicate with the authenticator. https://www.w3.org/TR/webauthn-2/#enum-transport' oneOf: - $ref: '#/components/schemas/AuthenticatorTransportInner' - type: string description: 'Unknown values are stored as spec asks to do so. As per the spec level 3 (which is draft): "The values SHOULD be members of AuthenticatorTransport but Relying Parties SHOULD accept and store unknown values." See `[[transports]]` in https://w3c.github.io/webauthn/#iface-authenticatorattestationresponse Level 2 also says that but comparitively unclear. "The values SHOULD be members of AuthenticatorTransport but Relying Parties MUST ignore unknown values." See `[[transports]]` in https://www.w3.org/TR/webauthn-2/#iface-authenticatorattestationresponse' GroupPermissions: description: "\n\n\n CREATE_GROUP_APPROVAL_POLICY:\n Permission to create group-level approval policy. Note that\n updating/deleting the approval policy is protected by the approval\n policy itself. Implies `GET_GROUP`.\n\n\n UPDATE_GROUP_EXTERNAL_LINKS:\n Permission to update external HSM/KMS configurations. Note that this\n is only useful for groups backed by external HSM/KMS. Implies\n `GET_GROUP`.\n\n\n MANAGE_GROUP_CLIENT_CONFIGS:\n Permission to manage group-level client configurations. Implies\n `GET_GROUP`.\n\n\n UPDATE_GROUP_PROFILE:\n Permission to update name, description and custom metadata of the\n group. Implies `GET_GROUP`.\n\n\n DELETE_GROUP:\n Permission to delete the group. Implies `GET_GROUP`.\n\n\n MAP_EXTERNAL_ROLES_FOR_APPS:\n Permission to map external roles to DSM groups for apps authorized\n through LDAP. Implies `GET_GROUP`.\n\n\n MAP_EXTERNAL_ROLES_FOR_USERS:\n Permission to map external roles to DSM groups for users authorized\n through LDAP. Implies `GET_GROUP`.\n\n\n MAP_EXTERNAL_ROLES:\n Currently implies `MAP_EXTERNAL_ROLES_FOR_APPS`,\n `MAP_EXTERNAL_ROLES_FOR_USERS`, and `GET_GROUP` permissions.\n\n\n ADD_USERS_TO_GROUP:\n Permission to add users to the group.\n\n\n DELETE_USERS_FROM_GROUP:\n Permission to remove users from the group.\n\n\n UPDATE_USERS_GROUP_ROLE:\n Permission to change users' role in the group.\n\n\n MANAGE_GROUP_USERS:\n Currently implies `ADD_USERS_TO_GROUP`, `DELETE_USERS_FROM_GROUP`,\n and `UPDATE_USERS_GROUP_ROLE` permissions.\n\n\n CREATE_GROUP_SOBJECT_POLICIES:\n Permission to create various group-level security object policies\n including cryptographic policy, key metadata policy and key history\n policy. Implies `GET_GROUP`.\n\n\n UPDATE_GROUP_SOBJECT_POLICIES:\n Permission to update various group-level security object policies\n including cryptographic policy, key metadata policy and key history\n policy. Implies `GET_GROUP`.\n\n\n DELETE_GROUP_SOBJECT_POLICIES:\n Permission to delete various group-level security object policies\n including cryptographic policy, key metadata policy and key history\n policy. Implies `GET_GROUP`.\n\n\n MANAGE_GROUP_SOBJECT_POLICIES:\n Currently implies `CREATE_GROUP_SOBJECT_POLICIES`,\n `UPDATE_GROUP_SOBJECT_POLICIES`, `DELETE_GROUP_SOBJECT_POLICIES`,\n and `GET_GROUP` permissions.\n\n\n CREATE_GROUP_CUSTODIAN_POLICY:\n Permission to create key custodian policy for the group. Implies\n `GET_GROUP`.\n\n\n UPDATE_GROUP_CUSTODIAN_POLICY:\n Permission to update group's key custodian policy. Implies\n `GET_GROUP`.\n\n\n DELETE_GROUP_CUSTODIAN_POLICY:\n Permission to delete group's key custodian policy. Implies\n `GET_GROUP`.\n\n\n MANAGE_GROUP_CUSTODIAN_POLICY:\n Currently implies `CREATE_GROUP_CUSTODIAN_POLICY`,\n `UPDATE_GROUP_CUSTODIAN_POLICY`, `DELETE_GROUP_CUSTODIAN_POLICY`,\n and `GET_GROUP` permissions.\n\n\n CREATE_APPS:\n Permission to create cryptographic apps. Implies `GET_APPS`.\n\n\n UPDATE_APPS:\n Permission to update cryptographic apps. Implies `GET_APPS`.\n\n\n RETRIEVE_APP_SECRETS:\n Permission to retrieve cryptographic apps' secrets. Note that not\n all cryptographic app credentials contain secrets. If a\n cryptographic app's credential does not contain any secrets,\n `GET_APPS` permission is sufficient to call the `GetAppCredential`\n API. Implies `GET_APPS`.\n\n\n DELETE_APPS:\n Permission to delete cryptographic apps. Implies `GET_APPS`.\n\n\n MANAGE_APPS:\n Currently implies `CREATE_APPS`, `UPDATE_APPS`,\n `RETRIEVE_APP_SECRETS`, `DELETE_APPS`, and `GET_APPS` permissions.\n\n\n CREATE_PLUGINS:\n Permission to create plugins. Implies `GET_PLUGINS`.\n For creating a plugin, following group permissions are also required\n in each group plugin is being added, to prevent privilege escalation:\n `CREATE_SOBJECTS`, `EXPORT_SOBJECTS`, `COPY_SOBJECTS`,\n `WRAP_SOBJECTS`, `UNWRAP_SOBJECTS`, `ENCAPSULATE_SOBJECTS`, `DECAPSULATE_SOBJECTS`,\n `DERIVE_SOBJECTS`, `TRANSFORM_SOBJECTS`, `UPDATE_SOBJECTS_ENABLED_STATE`,\n `ROTATE_SOBJECTS`, `DELETE_SOBJECTS`, `REVOKE_SOBJECTS`, `ACTIVATE_SOBJECTS`,\n `MOVE_SOBJECTS`, `UPDATE_KEY_OPS`, `UPDATE_SOBJECT_POLICIES`, `UPDATE_SOBJECTS_PROFILE`,\n `GET_GROUP`, `GET_SOBJECTS`, `GET_APPS`, `GET_PLUGINS`, `GET_AUDIT_LOGS`\n Following account permissions are required as well:\n `GET_ALL_USERS`\n\n\n UPDATE_PLUGINS:\n Permission to update plugins. Implies `GET_PLUGINS`.\n For updating a plugin, following group permissions are also required\n in each group plugin is being added, to prevent privilege escalation:\n `CREATE_SOBJECTS`, `EXPORT_SOBJECTS`, `COPY_SOBJECTS`, `WRAP_SOBJECTS`, `UNWRAP_SOBJECTS`,\n `ENCAPSULATE_SOBJECTS`, `DECAPSULATE_SOBJECTS`, `UPDATE_SOBJECTS_ENABLED_STATE`,\n `ROTATE_SOBJECTS`, `DELETE_SOBJECTS`, `REVOKE_SOBJECTS`, `ACTIVATE_SOBJECTS`,\n `MOVE_SOBJECTS`, `UPDATE_KEY_OPS`, `UPDATE_SOBJECT_POLICIES`, `UPDATE_SOBJECTS_PROFILE`,\n `GET_GROUP`, `GET_SOBJECTS`, `GET_APPS`, `GET_PLUGINS`, `GET_AUDIT_LOGS`\n Following account permissions are required as well while adding\n new groups:\n `GET_ALL_USERS`\n\n\n INVOKE_PLUGINS:\n Permission to invoke plugins. Implies `GET_PLUGINS`.\n\n\n DELETE_PLUGINS:\n Permission to delete plugins. Implies `GET_PLUGINS`.\n\n\n MANAGE_PLUGINS:\n Currently implies `CREATE_PLUGINS`, `UPDATE_PLUGINS`,\n `INVOKE_PLUGINS`, `DELETE_PLUGINS`, and `GET_PLUGINS` permissions.\n\n\n CREATE_SOBJECTS:\n Permission to create security objects. This permission is required\n for APIs that result in creation of a new security object including:\n Generate, Import, Unwrap. Also required in destination group when\n moving a key to a different group or when copying a key. Implies\n `GET_SOBJECTS`.\n\n\n EXPORT_SOBJECTS:\n Permission to export security objects. This permission is required\n for Export, ExportByComponents, Copy (depending on destination\n group), Restore, and Wrap (for wrapped security object) APIs.\n Implies `GET_SOBJECTS`.\n\n\n COPY_SOBJECTS:\n Permission to copy security objects. This permission is required in\n the source group when calling the Copy API. Implies `GET_SOBJECTS`.\n\n\n WRAP_SOBJECTS:\n Permission to wrap security objects. This permission is required in\n the wrapping security object's group. Implies `GET_SOBJECTS`.\n\n\n UNWRAP_SOBJECTS:\n Permission to unwrap security objects. This permission is required\n in the unwrapping security object's group. Implies `GET_SOBJECTS`.\n\n\n DERIVE_SOBJECTS:\n Permission to derive other security objects. Implies `GET_SOBJECTS`.\n\n\n TRANSFORM_SOBJECTS:\n Permission to transform security objects. Implies `GET_SOBJECTS`.\n\n\n UPDATE_SOBJECTS_ENABLED_STATE:\n Permission to enable/disable security objects. Implies\n `GET_SOBJECTS`.\n\n\n ROTATE_SOBJECTS:\n Permission to rotate (a.k.a. \"rekey\") security objects. Implies\n `GET_SOBJECTS`.\n\n\n DELETE_SOBJECTS:\n Permission to delete security objects. Implies `GET_SOBJECTS`.\n\n\n DESTROY_SOBJECTS:\n Permission to destroy security objects. Implies `GET_SOBJECTS`.\n\n\n REVOKE_SOBJECTS:\n Permission to revoke security objects, i.e. mark security objects as\n deactivated or compromised. Implies `GET_SOBJECTS`.\n\n\n ACTIVATE_SOBJECTS:\n Permission to activate security objects. Implies `GET_SOBJECTS`.\n\n\n REVERT_SOBJECTS:\n Permission to revert changes to security objects. Implies\n `GET_SOBJECTS`.\n\n\n DELETE_KEY_MATERIAL:\n Permission to delete key material including removing the private key\n part of an asymmetric key pair and removing key material of security\n objects backed by external HSM/KMS. Implies `GET_SOBJECTS`.\n\n\n MOVE_SOBJECTS:\n Permission to move security objects. This permission is required for\n changing the group of a security object in the source group. Note\n that changing the group of a security object also requires\n `CREATE_SOBJECTS` permission in the destination group. Implies\n `GET_SOBJECTS`.\n\n\n UPDATE_KEY_OPS:\n Permission to update key operations of security objects. Implies\n `GET_SOBJECTS`.\n\n\n UPDATE_SOBJECT_POLICIES:\n Permission to update individual security objects' policies. This\n permission allows updating RSA options, as well as Google access\n reason policy (for use with Google EKM APIs) defined on the security\n object itself. Implies `GET_SOBJECTS`.\n\n\n UPDATE_SOBJECTS_PROFILE:\n Permission to update name, description, custom metadata, key links\n (currently only create parent link), and publish public key settings\n of security objects. Implies `GET_SOBJECTS`.\n\n\n SCAN_EXTERNAL_SOBJECTS:\n Permission to scan for security objects in external HSM/KMS. Implies\n `GET_SOBJECTS`.\n\n\n RESTORE_EXTERNAL_SOBJECTS:\n Permission to restore key material of security objects backed by\n external HSM/KMS. Note that calling the Restore API needs this\n permission in the destination group as well as `EXPORT_SOBJECTS`\n permission in the source group (where the object was copied from\n originally). Implies `GET_SOBJECTS`.\n\n\n WRAP_WORKSPACE_CSE:\n Permission to call Workspace CSE Wrap API.\n\n\n UNWRAP_WORKSPACE_CSE:\n Permission to call Workspace CSE Unwrap API.\n\n\n WORKSPACE_CSE:\n\n\n GET_GROUP:\n Permission to get information about the group.\n\n\n GET_SOBJECTS:\n Permission to get security objects stored in the group.\n\n\n GET_APPS:\n Permission to get cryptographic apps in the group.\n\n\n GET_PLUGINS:\n Permission to get plugin in the group.\n\n\n GET_GROUP_APPROVAL_REQUESTS:\n Permission to get approval requests related to the group.\n\n\n GET_AUDIT_LOGS:\n Permission to get audit logs related to the group.\n\n\n MANAGE_GROUP_WRAPPING_KEY:\n Permission to update or remove wrapping key of the group\n\n\n ENCAPSULATE_SOBJECTS:\n Permission to encapsulate security objects. Implies `CREATE_SOBJECTS`.\n\n\n DECAPSULATE_SOBJECTS:\n Permission to decapsulate security objects. Implies `CREATE_SOBJECTS`.\n\n\n GET_CREDENTIALS:\n Permission to lookup a credential object\n\n\n CREATE_CREDENTIALS:\n Permission to create a credential object (Implies GET_CREDENTIALS)\n\n\n UPDATE_CREDENTIALS:\n Permission to update a credential object (Implies GET_CREDENTIALS)\n\n\n DELETE_CREDENTIALS:\n Permission to delete a credential object (Implies GET_CREDENTIALS)\n\n\n ASSIGN_CREDENTIALS:\n Permission to assign credential objects to integration points (Implies GET_CREDENTIALS)\n\n\n MANAGE_CREDENTIALS:\n Permission to manage credential objects (Currently implies `GET_CREDENTIALS`,\n `CREATE_CREDENTIALS`, `UPDATE_CREDENTIALS`, `DELETE_CREDENTIALS`, and\n `ASSIGN_CREDENTIALS`).\n\n" type: string enum: - CREATE_GROUP_APPROVAL_POLICY - UPDATE_GROUP_EXTERNAL_LINKS - MANAGE_GROUP_CLIENT_CONFIGS - UPDATE_GROUP_PROFILE - DELETE_GROUP - MAP_EXTERNAL_ROLES_FOR_APPS - MAP_EXTERNAL_ROLES_FOR_USERS - MAP_EXTERNAL_ROLES - ADD_USERS_TO_GROUP - DELETE_USERS_FROM_GROUP - UPDATE_USERS_GROUP_ROLE - MANAGE_GROUP_USERS - CREATE_GROUP_SOBJECT_POLICIES - UPDATE_GROUP_SOBJECT_POLICIES - DELETE_GROUP_SOBJECT_POLICIES - MANAGE_GROUP_SOBJECT_POLICIES - CREATE_GROUP_CUSTODIAN_POLICY - UPDATE_GROUP_CUSTODIAN_POLICY - DELETE_GROUP_CUSTODIAN_POLICY - MANAGE_GROUP_CUSTODIAN_POLICY - CREATE_APPS - UPDATE_APPS - RETRIEVE_APP_SECRETS - DELETE_APPS - MANAGE_APPS - CREATE_PLUGINS - UPDATE_PLUGINS - INVOKE_PLUGINS - DELETE_PLUGINS - MANAGE_PLUGINS - CREATE_SOBJECTS - EXPORT_SOBJECTS - COPY_SOBJECTS - WRAP_SOBJECTS - UNWRAP_SOBJECTS - DERIVE_SOBJECTS - TRANSFORM_SOBJECTS - UPDATE_SOBJECTS_ENABLED_STATE - ROTATE_SOBJECTS - DELETE_SOBJECTS - DESTROY_SOBJECTS - REVOKE_SOBJECTS - ACTIVATE_SOBJECTS - REVERT_SOBJECTS - DELETE_KEY_MATERIAL - MOVE_SOBJECTS - UPDATE_KEY_OPS - UPDATE_SOBJECT_POLICIES - UPDATE_SOBJECTS_PROFILE - SCAN_EXTERNAL_SOBJECTS - RESTORE_EXTERNAL_SOBJECTS - WRAP_WORKSPACE_CSE - UNWRAP_WORKSPACE_CSE - WORKSPACE_CSE - GET_GROUP - GET_SOBJECTS - GET_APPS - GET_PLUGINS - GET_GROUP_APPROVAL_REQUESTS - GET_AUDIT_LOGS - MANAGE_GROUP_WRAPPING_KEY - ENCAPSULATE_SOBJECTS - DECAPSULATE_SOBJECTS - GET_CREDENTIALS - CREATE_CREDENTIALS - UPDATE_CREDENTIALS - DELETE_CREDENTIALS - ASSIGN_CREDENTIALS - MANAGE_CREDENTIALS AccountPermissions: description: "\n\n\n MANAGE_LOGGING:\n Permission to manage logging integrations, and enable/disable error\n logging.\n\n\n MANAGE_AUTH:\n Permission to manage SSO and password policy.\n\n\n MANAGE_WORKSPACE_CSE:\n Permission to manage Workspace CSE configuration.\n\n\n UNWRAP_WORKSPACE_CSE_PRIVILEGED:\n Permission required for Workspace CSE PrivilegedUnwrap API. Note\n that `UNWRAP_WORKSPACE_CSE` permission in the group where the key is\n stored is also required.\n\n\n MANAGE_ACCOUNT_CLIENT_CONFIGS:\n Permission to manage account level client configurations.\n\n\n MANAGE_PLUGIN_CODE_SIGNING_POLICY:\n Permission to manage plugin code signing policy.\n\n\n CREATE_ACCOUNT_APPROVAL_POLICY:\n Permission to create account-level approval policy. Note that\n updating/deleting the approval policy is protected by the approval\n policy itself.\n\n\n SET_APPROVAL_REQUEST_EXPIRY:\n Permission to set approval request expiry for all approval requests\n created in the account.\n\n\n MANAGE_APPROVAL_REQUEST_SETTINGS:\n Permission to manage all approval request settings including\n approval request expiry. Implies `SET_APPROVAL_REQUEST_EXPIRY`.\n\n\n UPDATE_ACCOUNT_CUSTOM_METADATA_ATTRIBUTES:\n Permission to update account's custom metadata attributes.\n\n\n MANAGE_ACCOUNT_SUBSCRIPTION:\n Permission to manage account subscription (only relevant for SaaS\n accounts).\n\n\n MANAGE_ACCOUNT_PROFILE:\n Permission to update account name, custom logo, and other profile\n information.\n\n\n DELETE_ACCOUNT:\n Permission to delete the account.\n\n\n CREATE_ADMIN_APPS:\n Permission to create administrative apps. Implies `GET_ADMIN_APPS`.\n\n\n UPDATE_ADMIN_APPS:\n Permission to update administrative apps. Implies `GET_ADMIN_APPS`.\n\n\n DELETE_ADMIN_APPS:\n Permission to delete administrative apps. Implies `GET_ADMIN_APPS`.\n\n\n RETRIEVE_ADMIN_APP_SECRETS:\n Permission to retrieve administrative apps' secrets. Note that not\n all admin app credentials contain secrets. If an admin app's\n credential does not contain any secrets, `GET_ADMIN_APPS` permission\n is sufficient to call the `GetAppCredential` API. Implies\n `GET_ADMIN_APPS`.\n\n\n MANAGE_ADMIN_APPS:\n Currently implies `CREATE_ADMIN_APPS`, `UPDATE_ADMIN_APPS`,\n `DELETE_ADMIN_APPS`, `RETRIEVE_ADMIN_APP_SECRETS` and\n `GET_ADMIN_APPS` permissions.\n\n\n CREATE_CUSTOM_ROLES:\n Permission to create custom user roles. Implies `GET_CUSTOM_ROLES`.\n\n\n UPDATE_CUSTOM_ROLES:\n Permission to update custom user roles. Implies `GET_CUSTOM_ROLES`.\n\n\n DELETE_CUSTOM_ROLES:\n Permission to delete custom user roles. Implies `GET_CUSTOM_ROLES`.\n\n\n MANAGE_CUSTOM_ROLES:\n Currently implies `CREATE_CUSTOM_ROLES`, `UPDATE_CUSTOM_ROLES`,\n `DELETE_CUSTOM_ROLES` and `GET_CUSTOM_ROLES` permissions.\n\n\n INVITE_USERS_TO_ACCOUNT:\n Permission to invite users to the account. Implies `GET_ALL_USERS`.\n\n\n DELETE_USERS_FROM_ACCOUNT:\n Permission to remove users from the account. Implies\n `GET_ALL_USERS`.\n\n\n UPDATE_USERS_ACCOUNT_ROLE:\n Permission to change users' role in the account. Implies\n `GET_ALL_USERS`.\n\n\n UPDATE_USERS_ACCOUNT_ENABLED_STATE:\n Permission to enable/disable users in the account. Implies\n `GET_ALL_USERS`.\n\n\n MANAGE_ACCOUNT_USERS:\n Currently implies `INVITE_USERS_TO_ACCOUNT`,\n `DELETE_USERS_FROM_ACCOUNT`, `UPDATE_USERS_ACCOUNT_ROLE`,\n `UPDATE_USERS_ACCOUNT_ENABLED_STATE` and `GET_ALL_USERS`\n permissions.\n\n\n CREATE_EXTERNAL_ROLES:\n Permission to create external roles. Implies `GET_EXTERNAL_ROLES`.\n\n\n SYNC_EXTERNAL_ROLES:\n Permission to synchronize external roles. Implies\n `GET_EXTERNAL_ROLES`.\n\n\n DELETE_EXTERNAL_ROLES:\n Permission to delete external roles. Implies `GET_EXTERNAL_ROLES`.\n\n\n MANAGE_EXTERNAL_ROLES:\n Currently implies `CREATE_EXTERNAL_ROLES`, `SYNC_EXTERNAL_ROLES`,\n `DELETE_EXTERNAL_ROLES` and `GET_EXTERNAL_ROLES` permissions.\n\n\n CREATE_ACCOUNT_SOBJECT_POLICIES:\n Permission to create various account-level security object policies\n including cryptographic policy, key metadata policy and key history\n policy.\n\n\n UPDATE_ACCOUNT_SOBJECT_POLICIES:\n Permission to update various account-level security object policies\n including cryptographic policy, key metadata policy and key history\n policy.\n\n\n DELETE_ACCOUNT_SOBJECT_POLICIES:\n Permission to delete various account-level security object policies\n including cryptographic policy, key metadata policy and key history\n policy.\n\n\n MANAGE_ACCOUNT_SOBJECT_POLICIES:\n Currently implies `CREATE_ACCOUNT_SOBJECT_POLICIES`,\n `UPDATE_ACCOUNT_SOBJECT_POLICIES`, and\n `DELETE_ACCOUNT_SOBJECT_POLICIES` permissions.\n\n\n CREATE_CHILD_ACCOUNTS:\n Permission to create child accounts. Note that this is only\n applicable to SaaS accounts with reseller subscription. Implies\n `GET_CHILD_ACCOUNTS`.\n\n\n UPDATE_CHILD_ACCOUNTS:\n Permission to update child accounts. Note that this is only\n applicable to SaaS accounts with reseller subscription. Implies\n `GET_CHILD_ACCOUNTS`.\n\n\n DELETE_CHILD_ACCOUNTS:\n Permission to delete child accounts. Note that this is only\n applicable to SaaS accounts with reseller subscription. Implies\n `GET_CHILD_ACCOUNTS`.\n\n\n CREATE_CHILD_ACCOUNT_USERS:\n Permission to create users in child accounts. Note that this is only\n applicable to SaaS accounts with reseller subscription. Implies\n `GET_CHILD_ACCOUNTS` and `GET_CHILD_ACCOUNT_USERS`.\n\n\n GET_CHILD_ACCOUNTS:\n Permission to get child accounts. Note that this is only applicable\n to SaaS accounts with reseller subscription.\n\n\n GET_CHILD_ACCOUNT_USERS:\n Permission to get child account users. Note that this is only\n applicable to SaaS accounts with reseller subscription.\n\n\n MANAGE_CHILD_ACCOUNTS:\n Currently implies `CREATE_CHILD_ACCOUNTS`, `UPDATE_CHILD_ACCOUNTS`,\n `DELETE_CHILD_ACCOUNTS`, `CREATE_CHILD_ACCOUNT_USERS`,\n `GET_CHILD_ACCOUNTS`, and `GET_CHILD_ACCOUNT_USERS` permissions.\n\n\n CREATE_LOCAL_GROUPS:\n Permission to create new local groups.\n\n\n CREATE_EXTERNAL_GROUPS:\n Permission to create new group backed by external HSM/KMS.\n\n\n ALLOW_QUORUM_REVIEWER:\n Controls if the user can act as an approval policy reviewer.\n\n\n ALLOW_KEY_CUSTODIAN:\n Controls if the user can act as a key custodian.\n\n\n GET_ALL_APPROVAL_REQUESTS:\n Grants read access to **all** approval requests in the account. Note\n that there is a related group-level permission that is restricted to\n approval requests related to one group.\n\n\n GET_ADMIN_APPS:\n Permission to get administrative apps.\n\n\n GET_CUSTOM_ROLES:\n Permission to get custom user roles.\n\n\n GET_EXTERNAL_ROLES:\n Permission to get external roles.\n\n\n GET_ALL_USERS:\n Permission to get all users. Note that users can always get\n themselves.\n\n\n GET_ACCOUNT_USAGE:\n Grants access to accounts::GetAccountUsage API.\n\n\n MANAGE_KEY_EXPIRY_ALERTS:\n Permission to manage key expiry alert configurations.\n\n\n MANAGE_REPLICATION:\n Permission to modify an account's `purpose` field (e.g., changing a\n replication account's settings), or to call any APIs involving\n replication credentials. If the account is not a replication account,\n this permission has no effect.\n\n" type: string enum: - MANAGE_LOGGING - MANAGE_AUTH - MANAGE_WORKSPACE_CSE - UNWRAP_WORKSPACE_CSE_PRIVILEGED - MANAGE_ACCOUNT_CLIENT_CONFIGS - MANAGE_PLUGIN_CODE_SIGNING_POLICY - CREATE_ACCOUNT_APPROVAL_POLICY - SET_APPROVAL_REQUEST_EXPIRY - MANAGE_APPROVAL_REQUEST_SETTINGS - UPDATE_ACCOUNT_CUSTOM_METADATA_ATTRIBUTES - MANAGE_ACCOUNT_SUBSCRIPTION - MANAGE_ACCOUNT_PROFILE - DELETE_ACCOUNT - CREATE_ADMIN_APPS - UPDATE_ADMIN_APPS - DELETE_ADMIN_APPS - RETRIEVE_ADMIN_APP_SECRETS - MANAGE_ADMIN_APPS - CREATE_CUSTOM_ROLES - UPDATE_CUSTOM_ROLES - DELETE_CUSTOM_ROLES - MANAGE_CUSTOM_ROLES - INVITE_USERS_TO_ACCOUNT - DELETE_USERS_FROM_ACCOUNT - UPDATE_USERS_ACCOUNT_ROLE - UPDATE_USERS_ACCOUNT_ENABLED_STATE - MANAGE_ACCOUNT_USERS - CREATE_EXTERNAL_ROLES - SYNC_EXTERNAL_ROLES - DELETE_EXTERNAL_ROLES - MANAGE_EXTERNAL_ROLES - CREATE_ACCOUNT_SOBJECT_POLICIES - UPDATE_ACCOUNT_SOBJECT_POLICIES - DELETE_ACCOUNT_SOBJECT_POLICIES - MANAGE_ACCOUNT_SOBJECT_POLICIES - CREATE_CHILD_ACCOUNTS - UPDATE_CHILD_ACCOUNTS - DELETE_CHILD_ACCOUNTS - CREATE_CHILD_ACCOUNT_USERS - GET_CHILD_ACCOUNTS - GET_CHILD_ACCOUNT_USERS - MANAGE_CHILD_ACCOUNTS - CREATE_LOCAL_GROUPS - CREATE_EXTERNAL_GROUPS - ALLOW_QUORUM_REVIEWER - ALLOW_KEY_CUSTODIAN - GET_ALL_APPROVAL_REQUESTS - GET_ADMIN_APPS - GET_CUSTOM_ROLES - GET_EXTERNAL_ROLES - GET_ALL_USERS - GET_ACCOUNT_USAGE - MANAGE_KEY_EXPIRY_ALERTS - MANAGE_REPLICATION ValidateTokenResponse: allOf: - type: object properties: user_email: type: string format: email required: - user_email GetUserParams: allOf: - type: object properties: with_groups: $ref: '#/components/schemas/WithGroups' ConfirmEmailRequest: allOf: - type: object properties: confirm_token: type: string required: - confirm_token ProcessInviteRequest: allOf: - type: object description: Accept/reject invitations to join account. properties: accepts: type: - array - 'null' uniqueItems: true items: type: string format: uuid description: Optional list of account IDs to accept. rejects: type: - array - 'null' uniqueItems: true items: type: string format: uuid description: Optional list of account IDs to reject. FidoAddDeviceRequest: allOf: - type: object description: 'This contains the request for adding a FIDO device to user''s data. Initially, `POST /sys/v1/session/config_2fa/new_challenge` needs to be called with protocol set to `fido2` and using that data, `navigator.credentials.create()` is called in the frontend. The data returned by `create` is sent in this request. The data sent back here creates a new FIDO2 device for the user after the payload is verified as per the rules stated in webauthn doc.' properties: name: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: A user friendly name for the device. attestationResult: $ref: '#/components/schemas/PublicKeyCredentialAuthenticatorAttestationResponse' required: - name - attestationResult PasswordChangeRequest: allOf: - type: object description: Request to change user's password. properties: current_password: type: string new_password: type: string required: - current_password - new_password MfaDelDeviceRequest: allOf: - type: object description: Request to delete a FIDO device. properties: name: type: string maxLength: 4096 pattern: ^[^\n]*[^\s\n][^\n]*$ description: Name of the FIDO device to delete. required: - name RecoveryCodes: allOf: - type: object description: U2F recovery codes. properties: recovery_codes: type: array items: type: string required: - recovery_codes LegacyUserAccountRole: description: Legacy user account role type: string enum: - ACCOUNTADMINISTRATOR - ACCOUNTMEMBER - ACCOUNTAUDITOR MfaDeviceType: description: Type of MFA device type: string enum: - U2f - Fido2 UserAccountFlag: description: User account flag type: string enum: - STATEENABLED - PENDINGINVITE parameters: SignupRequest: name: body in: body required: true description: Request to create a new user. schema: $ref: '#/components/schemas/SignupRequest' UserId: name: user-id in: path required: true description: UUID of a user. schema: type: string format: uuid UpdateUserRequest: name: body in: body required: true description: '' schema: $ref: '#/components/schemas/UpdateUserRequest' InviteUserRequest: name: body in: body required: true description: Request to invite a user. schema: $ref: '#/components/schemas/InviteUserRequest' ListUsersParams: in: query name: ListUsersParams schema: $ref: '#/components/schemas/ListUsersParams' explode: true GetUserPermissionsParams: in: query name: GetUserPermissionsParams schema: $ref: '#/components/schemas/GetUserPermissionsParams' explode: true GetUserParams: in: query name: GetUserParams schema: $ref: '#/components/schemas/GetUserParams' explode: true securitySchemes: bearerToken: type: apiKey in: header name: Authentication description: A JWT bearer token to be passed once authenticated. basicAuth: type: http scheme: basic apiKeyAuth: type: apiKey name: Authorization in: header description: Please enter your token prefixed with 'Basic ' (e.g., 'Basic your_token_here') x-refined-from: - fortanix-ccm-openapi-original.json - fortanix-dsm-openapi-original.json