openapi: 3.2.0
info:
  description: 'The Grafana backend exposes an HTTP API, the same API is used by the frontend to do

    everything from saving dashboards, creating users and updating data sources.'
  title: Grafana HTTP API. Access Control API
  contact:
    name: Grafana Labs
    url: https://grafana.com
    email: hello@grafana.com
  version: 0.0.1
servers:
- url: /api
security:
- basic: []
- api_key: []
tags:
- description: 'The API can be used to create, update, get and list roles, and create or remove built-in role assignments. To use the API, you would need to enable fine-grained access control.

    This only available in Grafana Enterprise.

    The API does not currently work with an API Token. So in order to use these API endpoints you will have to use Basic auth.'
  name: access_control
paths:
  /access-control/roles:
    get:
      description: 'Gets all existing roles. The response contains all global and organization local roles, for the organization which user is signed in.


        You need to have a permission with action `roles:read` and scope `roles:*`.


        The `delegatable` flag reduces the set of roles to only those for which the signed-in user has permissions to assign.'
      tags:
      - access_control
      summary: Get all roles
      operationId: listRoles
      parameters:
      - name: delegatable
        in: query
        schema:
          type: boolean
      - name: includeHidden
        in: query
        schema:
          type: boolean
      - name: targetOrgId
        in: query
        schema:
          type: integer
          format: int64
      responses:
        '200':
          $ref: '#/components/responses/listRolesResponse'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '500':
          $ref: '#/components/responses/internalServerError'
    post:
      description: 'Creates a new custom role and maps given permissions to that role. Note that roles with the same prefix as Fixed Roles can’t be created.


        You need to have a permission with action `roles:write` and scope `permissions:type:delegate`. `permissions:type:delegate` scope ensures that users can only create custom roles with the same, or a subset of permissions which the user has.

        For example, if a user does not have required permissions for creating users, they won’t be able to create a custom role which allows to do that. This is done to prevent escalation of privileges.'
      tags:
      - access_control
      summary: Create a new custom role
      operationId: createRole
      responses:
        '201':
          $ref: '#/components/responses/createRoleResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '500':
          $ref: '#/components/responses/internalServerError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateRoleForm'
        required: true
  /access-control/roles/{roleUID}:
    get:
      description: 'Get a role for the given UID.


        You need to have a permission with action `roles:read` and scope `roles:*`.'
      tags:
      - access_control
      summary: Get a role
      operationId: getRole
      parameters:
      - name: roleUID
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/getRoleResponse'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '500':
          $ref: '#/components/responses/internalServerError'
    put:
      description: You need to have a permission with action `roles:write` and scope `permissions:type:delegate`. `permissions:type:delegate` scope ensures that users can only update custom roles with permissions which the user has.
      tags:
      - access_control
      summary: Update a custom role
      operationId: updateRole
      parameters:
      - name: roleUID
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/getRoleResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRoleCommand'
        required: true
    delete:
      description: 'Delete a role with the given UID, and it’s permissions. If the role is assigned to a built-in role, the deletion operation will fail, unless force query param is set to true, and in that case all assignments will also be deleted.


        You need to have a permission with action `roles:delete` and scope `permissions:type:delegate`.'
      tags:
      - access_control
      summary: Delete a custom role
      operationId: deleteRole
      parameters:
      - name: force
        in: query
        schema:
          type: boolean
      - name: global
        in: query
        schema:
          type: boolean
      - name: roleUID
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/okResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '500':
          $ref: '#/components/responses/internalServerError'
  /access-control/roles/{roleUID}/assignments:
    get:
      description: 'Get role assignments for the role with the given UID.

        Does not include role assignments mapped through group attribute sync.


        You need to have a permission with action `teams.roles:list` and scope `teams:id:*` and `users.roles:list` and scope `users:id:*`.'
      tags:
      - access_control
      summary: Get role assignments
      operationId: getRoleAssignments
      parameters:
      - name: roleUID
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/getRoleAssignmentsResponse'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
    put:
      description: 'Set role assignments for the role with the given UID.


        You need to have a permission with action `teams.roles:add` and `teams.roles:remove` and scope `permissions:type:delegate`, and `users.roles:add` and `users.roles:remove` and scope `permissions:type:delegate`.'
      tags:
      - access_control
      summary: Set role assignments
      operationId: setRoleAssignments
      parameters:
      - name: roleUID
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/setRoleAssignmentsResponse'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetRoleAssignmentsCommand'
        required: true
  /access-control/status:
    get:
      description: 'Returns an indicator to check if fine-grained access control is enabled or not.


        You need to have a permission with action `status:accesscontrol` and scope `services:accesscontrol`.'
      tags:
      - access_control
      summary: Get status
      operationId: getAccessControlStatus
      responses:
        '200':
          $ref: '#/components/responses/getAccessControlStatusResponse'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
  /access-control/teams/roles/search:
    post:
      description: 'Lists the roles that have been directly assigned to the given teams.


        You need to have a permission with action `teams.roles:read` and scope `teams:id:*`.'
      tags:
      - access_control
      summary: List roles assigned to multiple teams
      operationId: listTeamsRoles
      responses:
        '200':
          $ref: '#/components/responses/listTeamsRolesResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '500':
          $ref: '#/components/responses/internalServerError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RolesSearchQuery'
        required: true
  /access-control/teams/{teamId}/roles:
    get:
      description: You need to have a permission with action `teams.roles:read` and scope `teams:id:`.
      tags:
      - access_control
      summary: Get team roles
      operationId: listTeamRoles
      parameters:
      - name: teamId
        in: path
        required: true
        schema:
          type: integer
          format: int64
      - name: targetOrgId
        in: query
        schema:
          type: integer
          format: int64
      responses:
        '200':
          $ref: '#/components/responses/okResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '500':
          $ref: '#/components/responses/internalServerError'
    put:
      description: You need to have a permission with action `teams.roles:add` and `teams.roles:remove` and scope `permissions:type:delegate` for each. The delegate scope is required for permissions on roles being added.
      tags:
      - access_control
      summary: Update team role
      operationId: setTeamRoles
      parameters:
      - name: teamId
        in: path
        required: true
        schema:
          type: integer
          format: int64
      - name: targetOrgId
        in: query
        schema:
          type: integer
          format: int64
      responses:
        '200':
          $ref: '#/components/responses/okResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetTeamRolesCommand'
        required: true
    post:
      description: You need to have a permission with action `teams.roles:add` and scope `permissions:type:delegate`.
      tags:
      - access_control
      summary: Add team role
      operationId: addTeamRole
      parameters:
      - name: teamId
        in: path
        required: true
        schema:
          type: integer
          format: int64
      responses:
        '200':
          $ref: '#/components/responses/okResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddTeamRoleCommand'
        required: true
  /access-control/teams/{teamId}/roles/{roleUID}:
    delete:
      description: You need to have a permission with action `teams.roles:remove` and scope `permissions:type:delegate`.
      tags:
      - access_control
      summary: Remove team role
      operationId: removeTeamRole
      parameters:
      - name: roleUID
        in: path
        required: true
        schema:
          type: string
      - name: teamId
        in: path
        required: true
        schema:
          type: integer
          format: int64
      responses:
        '200':
          $ref: '#/components/responses/okResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
  /access-control/users/roles/search:
    post:
      description: 'Lists the roles that have been directly assigned to the given users. The list does not include built-in roles (Viewer, Editor, Admin or Grafana Admin), and it does not include roles that have been inherited from a team.


        You need to have a permission with action `users.roles:read` and scope `users:id:*`.'
      tags:
      - access_control
      summary: List roles assigned to multiple users
      operationId: listUsersRoles
      responses:
        '200':
          $ref: '#/components/responses/listUsersRolesResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '500':
          $ref: '#/components/responses/internalServerError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RolesSearchQuery'
        required: true
  /access-control/users/{userId}/roles:
    get:
      description: 'Lists the roles that have been directly assigned to a given user. The list does not include built-in roles (Viewer, Editor, Admin or Grafana Admin), and it does not include roles that have been inherited from a team.


        You need to have a permission with action `users.roles:read` and scope `users:id:`.'
      tags:
      - access_control
      summary: List roles assigned to a user
      operationId: listUserRoles
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: integer
          format: int64
      - name: includeHidden
        in: query
        schema:
          type: boolean
      - name: targetOrgId
        in: query
        schema:
          type: integer
          format: int64
      responses:
        '200':
          $ref: '#/components/responses/getAllRolesResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '500':
          $ref: '#/components/responses/internalServerError'
    put:
      description: 'Update the user’s role assignments to match the provided set of UIDs. This will remove any assigned roles that aren’t in the request and add roles that are in the set but are not already assigned to the user.

        Roles mapped through group attribute sync are not impacted.

        If you want to add or remove a single role, consider using Add a user role assignment or Remove a user role assignment instead.


        You need to have a permission with action `users.roles:add` and `users.roles:remove` and scope `permissions:type:delegate` for each. The delegate scope is required for permissions on roles being added.'
      tags:
      - access_control
      summary: Set user role assignments
      operationId: setUserRoles
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: integer
          format: int64
      - name: targetOrgId
        in: query
        schema:
          type: integer
          format: int64
      responses:
        '200':
          $ref: '#/components/responses/okResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetUserRolesCommand'
        required: true
    post:
      description: 'Assign a role to a specific user. For bulk updates consider Set user role assignments.


        You need to have a permission with action `users.roles:add` and scope `permissions:type:delegate`. `permissions:type:delegate` scope ensures that users can only assign roles which have same, or a subset of permissions which the user has. For example, if a user does not have required permissions for creating users, they won’t be able to assign a role which will allow to do that. This is done to prevent escalation of privileges.'
      tags:
      - access_control
      summary: Add a user role assignment
      operationId: addUserRole
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: integer
          format: int64
      responses:
        '200':
          $ref: '#/components/responses/okResponse'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddUserRoleCommand'
        required: true
  /access-control/users/{userId}/roles/{roleUID}:
    delete:
      description: 'Revoke a role from a user. For bulk updates consider Set user role assignments.


        You need to have a permission with action `users.roles:remove` and scope `permissions:type:delegate`.'
      tags:
      - access_control
      summary: Remove a user role assignment
      operationId: removeUserRole
      parameters:
      - description: A flag indicating if the assignment is global or not. If set to false, the default org ID of the authenticated user will be used from the request to remove assignment.
        name: global
        in: query
        schema:
          type: boolean
      - name: roleUID
        in: path
        required: true
        schema:
          type: string
      - name: userId
        in: path
        required: true
        schema:
          type: integer
          format: int64
      responses:
        '200':
          $ref: '#/components/responses/okResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
  /access-control/{resource}/description:
    get:
      tags:
      - access_control
      summary: Get a description of a resource's access control properties
      operationId: getResourceDescription
      parameters:
      - name: resource
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/resourcePermissionsDescription'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '500':
          $ref: '#/components/responses/internalServerError'
  /access-control/{resource}/{resourceID}:
    get:
      tags:
      - access_control
      summary: Get permissions for a resource
      operationId: getResourcePermissions
      parameters:
      - name: resource
        in: path
        required: true
        schema:
          type: string
      - name: resourceID
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/getResourcePermissionsResponse'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
    post:
      description: 'Assigns permissions for a resource by a given type (`:resource`) and `:resourceID` to one or many

        assignment types. Allowed resources are `datasources`, `teams`, `dashboards`, `folders`, and `serviceaccounts`.

        Refer to the `/access-control/{resource}/description` endpoint for allowed Permissions.'
      tags:
      - access_control
      summary: Set resource permissions
      operationId: setResourcePermissions
      parameters:
      - name: resource
        in: path
        required: true
        schema:
          type: string
      - name: resourceID
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/okResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/setPermissionsCommand'
        required: true
  /access-control/{resource}/{resourceID}/builtInRoles/{builtInRole}:
    post:
      description: 'Assigns permissions for a resource by a given type (`:resource`) and `:resourceID` to a built-in role.

        Allowed resources are `datasources`, `teams`, `dashboards`, `folders`, and `serviceaccounts`.

        Refer to the `/access-control/{resource}/description` endpoint for allowed Permissions.'
      tags:
      - access_control
      summary: Set resource permissions for a built-in role
      operationId: setResourcePermissionsForBuiltInRole
      parameters:
      - name: resource
        in: path
        required: true
        schema:
          type: string
      - name: resourceID
        in: path
        required: true
        schema:
          type: string
      - name: builtInRole
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/okResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/setPermissionCommand'
        required: true
  /access-control/{resource}/{resourceID}/teams/{teamID}:
    post:
      description: 'Assigns permissions for a resource by a given type (`:resource`) and `:resourceID` to a team.

        Allowed resources are `datasources`, `teams`, `dashboards`, `folders`, and `serviceaccounts`.

        Refer to the `/access-control/{resource}/description` endpoint for allowed Permissions.'
      tags:
      - access_control
      summary: Set resource permissions for a team
      operationId: setResourcePermissionsForTeam
      parameters:
      - name: resource
        in: path
        required: true
        schema:
          type: string
      - name: resourceID
        in: path
        required: true
        schema:
          type: string
      - name: teamID
        in: path
        required: true
        schema:
          type: integer
          format: int64
      responses:
        '200':
          $ref: '#/components/responses/okResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/setPermissionCommand'
        required: true
  /access-control/{resource}/{resourceID}/users/{userID}:
    post:
      description: 'Assigns permissions for a resource by a given type (`:resource`) and `:resourceID` to a user or a service account.

        Allowed resources are `datasources`, `teams`, `dashboards`, `folders`, and `serviceaccounts`.

        Refer to the `/access-control/{resource}/description` endpoint for allowed Permissions.'
      tags:
      - access_control
      summary: Set resource permissions for a user
      operationId: setResourcePermissionsForUser
      parameters:
      - name: resource
        in: path
        required: true
        schema:
          type: string
      - name: resourceID
        in: path
        required: true
        schema:
          type: string
      - name: userID
        in: path
        required: true
        schema:
          type: integer
          format: int64
      responses:
        '200':
          $ref: '#/components/responses/okResponse'
        '400':
          $ref: '#/components/responses/badRequestError'
        '403':
          $ref: '#/components/responses/forbiddenError'
        '404':
          $ref: '#/components/responses/notFoundError'
        '500':
          $ref: '#/components/responses/internalServerError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/setPermissionCommand'
        required: true
  /admin/provisioning/access-control/reload:
    post:
      tags:
      - access_control
      summary: You need to have a permission with action `provisioning:reload` with scope…
      operationId: adminProvisioningReloadAccessControl
      responses:
        '202':
          $ref: '#/components/responses/acceptedResponse'
        '401':
          $ref: '#/components/responses/unauthorisedError'
        '403':
          $ref: '#/components/responses/forbiddenError'
components:
  schemas:
    Permission:
      description: Permission is the model for access control permissions
      type: object
      properties:
        action:
          type: string
        created:
          type: string
          format: date-time
        scope:
          type: string
        updated:
          type: string
          format: date-time
    SetResourcePermissionCommand:
      type: object
      properties:
        builtInRole:
          type: string
        permission:
          type: string
        teamId:
          type: integer
          format: int64
        userId:
          type: integer
          format: int64
    Assignments:
      type: object
      properties:
        builtInRoles:
          type: boolean
        serviceAccounts:
          type: boolean
        teams:
          type: boolean
        users:
          type: boolean
    SetUserRolesCommand:
      type: object
      properties:
        global:
          type: boolean
        includeHidden:
          type: boolean
        roleUids:
          type: array
          items:
            type: string
    ErrorResponseBody:
      type: object
      required:
      - message
      properties:
        error:
          description: Error An optional detailed description of the actual error. Only included if running in developer mode.
          type: string
        message:
          description: a human readable version of the error
          type: string
        status:
          description: 'Status An optional status to denote the cause of the error.


            For example, a 412 Precondition Failed error may include additional information of why that error happened.'
          type: string
    RoleAssignmentsDTO:
      type: object
      properties:
        role_uid:
          type: string
        service_accounts:
          type: array
          items:
            type: integer
            format: int64
        teams:
          type: array
          items:
            type: integer
            format: int64
        users:
          type: array
          items:
            type: integer
            format: int64
    resourcePermissionDTO:
      type: object
      properties:
        actions:
          type: array
          items:
            type: string
        builtInRole:
          type: string
        id:
          type: integer
          format: int64
        isInherited:
          type: boolean
        isManaged:
          type: boolean
        isServiceAccount:
          type: boolean
        permission:
          type: string
        roleName:
          type: string
        team:
          type: string
        teamAvatarUrl:
          type: string
        teamId:
          type: integer
          format: int64
        teamUid:
          type: string
        userAvatarUrl:
          type: string
        userId:
          type: integer
          format: int64
        userLogin:
          type: string
        userUid:
          type: string
    setPermissionCommand:
      type: object
      properties:
        permission:
          type: string
    CreateRoleForm:
      type: object
      properties:
        description:
          type: string
        displayName:
          type: string
        global:
          type: boolean
        group:
          type: string
        hidden:
          type: boolean
        name:
          type: string
        permissions:
          type: array
          items:
            $ref: '#/components/schemas/Permission'
        uid:
          type: string
    RoleDTO:
      type: object
      required:
      - version
      - uid
      - name
      - displayName
      - description
      - group
      - updated
      - created
      properties:
        created:
          type: string
          format: date-time
        delegatable:
          type: boolean
        description:
          type: string
        displayName:
          type: string
        global:
          type: boolean
        group:
          type: string
        hidden:
          type: boolean
        mapped:
          type: boolean
        name:
          type: string
        permissions:
          type: array
          items:
            $ref: '#/components/schemas/Permission'
        uid:
          type: string
        updated:
          type: string
          format: date-time
        version:
          type: integer
          format: int64
    SetTeamRolesCommand:
      type: object
      properties:
        includeHidden:
          type: boolean
        roleUids:
          type: array
          items:
            type: string
    AccessControlStatus:
      type: object
      properties:
        enabled:
          type: boolean
    setPermissionsCommand:
      type: object
      properties:
        permissions:
          type: array
          items:
            $ref: '#/components/schemas/SetResourcePermissionCommand'
    AddTeamRoleCommand:
      type: object
      properties:
        roleUid:
          type: string
    AddUserRoleCommand:
      type: object
      properties:
        global:
          type: boolean
        roleUid:
          type: string
    UpdateRoleCommand:
      type: object
      required:
      - displayName
      - description
      - group
      properties:
        description:
          type: string
        displayName:
          type: string
        global:
          type: boolean
        group:
          type: string
        hidden:
          type: boolean
        name:
          type: string
        permissions:
          type: array
          items:
            $ref: '#/components/schemas/Permission'
    Description:
      type: object
      properties:
        assignments:
          $ref: '#/components/schemas/Assignments'
        permissions:
          type: array
          items:
            type: string
    SetRoleAssignmentsCommand:
      type: object
      properties:
        service_accounts:
          type: array
          items:
            type: integer
            format: int64
        teams:
          type: array
          items:
            type: integer
            format: int64
        users:
          type: array
          items:
            type: integer
            format: int64
    RolesSearchQuery:
      type: object
      properties:
        includeHidden:
          type: boolean
        orgId:
          type: integer
          format: int64
        teamIds:
          type: array
          items:
            type: integer
            format: int64
        userIds:
          type: array
          items:
            type: integer
            format: int64
    SuccessResponseBody:
      type: object
      properties:
        message:
          type: string
  responses:
    unauthorisedError:
      description: UnauthorizedError is returned when the request is not authenticated.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseBody'
    createRoleResponse:
      description: (empty)
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/RoleDTO'
    getAllRolesResponse:
      description: (empty)
      content:
        application/json:
          schema:
            type: array
            items:
              $ref: '#/components/schemas/RoleDTO'
    getRoleAssignmentsResponse:
      description: (empty)
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/RoleAssignmentsDTO'
    listUsersRolesResponse:
      description: (empty)
      content:
        application/json:
          schema:
            type: object
            additionalProperties:
              type: array
              items:
                $ref: '#/components/schemas/RoleDTO'
    internalServerError:
      description: InternalServerError is a general error indicating something went wrong internally.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseBody'
    getResourcePermissionsResponse:
      description: (empty)
      content:
        application/json:
          schema:
            type: array
            items:
              $ref: '#/components/schemas/resourcePermissionDTO'
    badRequestError:
      description: BadRequestError is returned when the request is invalid and it cannot be processed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseBody'
    getAccessControlStatusResponse:
      description: (empty)
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AccessControlStatus'
    acceptedResponse:
      description: AcceptedResponse
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseBody'
    listRolesResponse:
      description: (empty)
      content:
        application/json:
          schema:
            type: array
            items:
              $ref: '#/components/schemas/RoleDTO'
    getRoleResponse:
      description: (empty)
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/RoleDTO'
    listTeamsRolesResponse:
      description: (empty)
      content:
        application/json:
          schema:
            type: object
            additionalProperties:
              type: array
              items:
                $ref: '#/components/schemas/RoleDTO'
    okResponse:
      description: An OKResponse is returned if the request was successful.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/SuccessResponseBody'
    forbiddenError:
      description: ForbiddenError is returned if the user/token has insufficient permissions to access the requested resource.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseBody'
    resourcePermissionsDescription:
      description: (empty)
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Description'
    setRoleAssignmentsResponse:
      description: (empty)
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/RoleAssignmentsDTO'
    notFoundError:
      description: NotFoundError is returned when the requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseBody'
  securitySchemes:
    api_key:
      type: apiKey
      name: Authorization
      in: header
    basic:
      type: http
      scheme: basic