{"openapi":"3.0.2","info":{"title":"Authentication API v1.1","version":"1.1.x","description":"\nThis specification describes the Authentication v1.1 APIs.\nNOTE: Swagger UI automatically URL encodes parameters when required.\nIf/when the APIs are called elsewhere make sure to URL encode the parameters when required.\n"},"externalDocs":{"description":"The developer guide and related API references are available here.","url":"https://www.here.com/docs/category/identity-and-access-management"},"servers":[{"url":"Use API Lookup for a base URL"}],"tags":[{"name":"Application Management","description":"Application Management APIs enable HERE users to create applications and authorized identities (user/another app) to manage such applications."},{"name":"Application Access Key Management","description":"These APIs enable authorized identities (user/another app) to manage access key credentials for the applications."},{"name":"API Key Management","description":"API Key Management APIs enable identities authorized to manage an application to create and maintain API keys. API Keys can be used to simplify the usage of HLS services by insecure clients."},{"name":"App Code Management","description":"For deprecated Applications, App Codes are available to authorized identities to via read-only APIs. App Codes can be used to access limited HLS services that still support them."},{"name":"Trusted Domain Management","description":"Trusted Domain Management APIs enable authorized identities to manage URIs to register with an appliication"},{"name":"Secret Management","description":"Secret Management APIs enable authorized identities to securely upload and manage third-party credentials for use in the platform."},{"name":"User Account Management","description":"User Account Management APIs"},{"name":"Platform Service Terms","description":"Platform Service Terms APIs"},{"name":"Platform Pricing Terms","description":"Platform Pricing Terms APIs"},{"name":"Manage Identity Providers for a Realm","description":"APIs to manage Identity Providers trusted in a Realm."},{"name":"List Apps for an Identity Provider","description":"List the Apps that have the specified Identity Provider attached."},{"name":"Manage Identity Providers for an App","description":"APIs to manage Identity Providers attached to an App."},{"name":"Manage Device Accounts","description":"APIs to Manage Device Accounts."},{"name":"Manage SAML identity providers","description":"APIs to manage SAML Identity Providers for a Realm."},{"name":"SAML Identity Provider Templates","description":"List of supported SAML Identity Provider templates."},{"name":"Manage mTLS Identity Providers","description":"APIs to manage mTLS Identity Provider Certificate Authorities in a Realm."},{"name":"Support Access","description":"Manage Account Executive support access"}],"components":{"securitySchemes":{"UserOrClientBearerToken":{"type":"http","scheme":"bearer","description":"Bearer Token issued to either User or Client."},"Bearer":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"A HERE access token obtained from one of the supported OAuth 2.0 authorization flows.\nFor more information on how to get a bearer token, see the\n[https://www.here.com/docs/bundle/identity-and-access-management-developer-guide/page/README.html](Identity & Access Management Guide).\n"}},"parameters":{"App":{"in":"path","required":true,"name":"app","schema":{"type":"string"},"description":"HRN identifying the application. Must be URL-encoded, if reserved characters \":/?#[]@!$&'()*+,;=\" are used. see https://tools.ietf.org/html/rfc3986#section-2.2.\n"},"AccessKey":{"in":"path","required":true,"name":"accessKey","schema":{"type":"string"},"description":"HRN identifying the access key. Must be URL-encoded, if reserved characters \":/?#[]@!$&'()*+,;=\" are used. see https://tools.ietf.org/html/rfc3986#section-2.2.\n"},"ApiKey":{"in":"path","required":true,"name":"apiKey","schema":{"type":"string"},"description":"HRN with obfuscated apiKeyId. Must be URL-encoded, if reserved characters \":/?#[]@!$&'()*+,;=\" are used. see https://tools.ietf.org/html/rfc3986#section-2.2.\n","example":"hrn:here:account::myrealm:apikey/ygfDVbZc7vJQTRGjC5-YXZbuwWwxFu4FxD5SsWbp-no"},"Secret":{"in":"path","required":true,"name":"secret","schema":{"type":"string"},"description":"HRN for a Secret.\n","example":"hrn:here:account::myrealm:secret/abc-123"},"User":{"in":"path","required":true,"name":"user","schema":{"type":"string"},"description":"HRN identifying the user account"},"Limit":{"in":"query","name":"limit","required":false,"description":"Number of records to return. Default is 100 records. Maximum is 100 records.","schema":{"type":"integer","minimum":0,"maximum":100,"default":100}},"Limit10":{"in":"query","name":"limit","required":false,"description":"Number of records to return. Default is 10 records. Maximum is 100 records.","schema":{"type":"integer","minimum":0,"maximum":100,"default":10}},"PageToken":{"name":"pageToken","in":"query","required":false,"description":"If there are more records than 'limit' (between 1 and 100), and there are multiple pages of records, 'pageToken' allows for retrieval of individual pages. In order to retrieve subsequent pages, the client should provide the pageToken returned in the result from the previous API call as input to the following API call.\n\nExample: If the result for a call to GET /items returns *{..., \"pageToken\": \"abcdefg\"}*, in order  to retrieve the next page of 'items' the client should call GET /items?pageToken=abcdefg\n","schema":{"type":"string"}},"Action":{"in":"query","required":true,"name":"action","schema":{"type":"string","enum":["read","write","manage","share"]},"description":"Action contained in the permission on which the result set should be filtered"},"ActionParam":{"in":"query","required":false,"name":"action","schema":{"type":"string","enum":["read","write","manage","share"]},"description":"Optionally filters the list of returned applications based on the caller having the provided permission action over the returned applications."},"XCorrelationId":{"in":"header","name":"X-Correlation-ID","schema":{"type":"string"},"required":false,"description":"Correlates HTTP requests between a client and server. If not present in the incoming request, it will be generated. This header and value will be included in all loglines including access logs. It will also be propagated to downstream services and returned in the response.\n"},"XRequestId":{"in":"header","name":"X-Request-ID","schema":{"type":"string"},"required":false,"description":"The unique for the request, used to track this request within the service. X-Request-ID value is NOT propagated to the downstream services.\n"},"TrustedDomainUri":{"in":"path","required":true,"name":"trustedDomainUri","schema":{"type":"string"},"description":"URI for a Trusted Domain. A Trusted Domain must conform to the follow validation rules:\n  * entries must include a domain name (e.g. example.com)\n  * no longer than 2048 characters\n  * use correct URI format\n  * IPv4 addresses are permitted (e.g. 192.168.1.1 or 192.168.1.1:1080)\n  * protocol is optional (e.g. https://example.com)\n  * port is optional (e.g. example.com:1080)\n","example":"https://example.com:1080"},"ListParam":{"in":"query","name":"list","required":true,"description":"Comma separated list of Trusted Domain URIs. Maximum of 10. Must be URL-encoded, if reserved characters \":/?#[]@!$&'()*+,;=\" are used. see https://tools.ietf.org/html/rfc3986#section-2.2.","example":"2MZr9AInTFk45NAU8ClIza2Yw7w_AXyUyM4ChvtO7bY","schema":{"type":"string"}},"RealmHrn":{"in":"path","name":"realmHrn","required":true,"schema":{"type":"string"},"description":"Realm is the HRN of the realm.\n"},"RealmHrnOrMe":{"in":"path","name":"realmHrnOrMe","required":true,"description":"HRN of the realm, or \"me\". If \"me\" the \"rlm\" claim from the access token is used.","schema":{"type":"string"}},"Realm":{"in":"path","required":true,"name":"realm","schema":{"type":"string"},"description":"HRN identifying the Realm.  You can also use the shorthand \"me\" to refer to the Realm HRN indicated by your \naccess token context.\n","example":"hrn:here:account::org123456789:realm/org123456789"},"SamlIdentityProviderHrn":{"in":"path","name":"samlIdentityProvider","required":true,"description":"HRN for the specific SAML IdP configuration with a realm","schema":{"type":"string"},"example":"hrn:here:account::myRealm:samlIdentityProvider/IDP-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d"},"MtlsIdentityProviderHrn":{"in":"path","name":"mtlsIdentityProvider","required":true,"description":"HRN for the specific mTLS IdentityProvider with a realm","schema":{"type":"string"},"example":"hrn:here:account::myRealm:mtlsIdentityProvider/IDP-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d"},"MtlsAuthenticatorHrn":{"in":"path","name":"mtlsAuthenticator","required":true,"description":"HRN for the specific mTLS Authenticator","schema":{"type":"string"},"example":"hrn:here:account::myRealm:mtlsAuthenticator/IDP-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d"},"RealmQuery":{"in":"query","required":false,"name":"realm","schema":{"type":"string"},"description":"HRN identifying the Realm.  If neither `identityProvider` nor `realm` is specified, defaults to the realm \nidentified in your access token context.\n","example":"hrn:here:account::org123456789:realm/org123456789"},"Project":{"in":"path","required":true,"name":"project","schema":{"type":"string"},"description":"HRN identifying the Project.\n","example":"hrn:here:authorization::org123456789:project/proj-123456"},"IdentityProvider":{"in":"path","required":true,"name":"identityProvider","schema":{"type":"string"},"description":"HRN identifying the IdentityProvider.\n","example":"hrn:here:account::org123456789:identityProvider/example-op"},"IdentityProviderQuery":{"in":"query","required":false,"name":"identityProvider","schema":{"type":"string"},"description":"HRN identifying the IdentityProvider.  Ignored if `externalId` is not specified in the request.\n","example":"hrn:here:account::org123456789:identityProvider/example-op"},"Issuer":{"in":"path","required":true,"name":"issuer","schema":{"type":"string"},"description":"OIDC Issuer URL.\n","example":"https://op.example.com"},"ExternalId":{"in":"query","required":false,"name":"externalId","schema":{"type":"string"},"description":"External identifier for the Device under a third-party Identity Provider.  \nIf OpenID Connect Token Exchange was used to create this Device identity, the \nExternalId matches the value of the \"sub\" claim in the OP's access tokens.  \nExternal IDs are considered unique for a given an Identity Provider.  \nIgnored if `identityProvider` is not specified in the request.\n","example":"vtWk4eNAlYLi2UHJGNONTAM5Q7WV4nxHTZGiyfgpFbQ="},"RequiredIdentityProvider":{"in":"query","required":true,"name":"identityProvider","schema":{"type":"string"},"description":"HRN identifying the IdentityProvider.\n","example":"hrn:here:account::org123456789:identityProvider/example-op"},"RequiredExternalId":{"in":"query","required":true,"name":"externalId","schema":{"type":"string"},"description":"External identifier for the Device under a third-party Identity Provider.  \nIf OpenID Connect Token Exchange was used to create this Device identity, the \nExternalId matches the value of the \"sub\" claim in the OP's access tokens.  \nExternal IDs are considered unique for a given an Identity Provider.\n","example":"vtWk4eNAlYLi2UHJGNONTAM5Q7WV4nxHTZGiyfgpFbQ="},"Device":{"in":"path","required":true,"name":"device","schema":{"type":"string"},"description":"HRN of the Device.\n","example":"hrn:here:account::org123456789:identityProvider/example-op"},"SupportEmail":{"in":"query","required":false,"name":"emailAddress","schema":{"type":"string"},"description":"Email address of the authorizedUser entry to delete.  If omitted, all authorizedUser entries **and** the entire\nauthorizedUsers list itself will be deleted.  The authorizedUsers list will not appear in subsequent GET calls\nuntil a new authorizedUser entry is added back.\n"},"AllowPasswordLogin":{"in":"query","required":false,"name":"allowPasswordLogin","schema":{"type":"boolean"},"description":"Flag indicating if password login should be allowed after enabling identity provider for the realm. \nIf omitted, the value is defaulted to false.\n\ntrue - both 'password' and 'saml' login methods are allowed\nfalse - 'saml' is the only allowed login method for the realm\n"}},"headers":{"XCorrelationId":{"schema":{"type":"string"},"required":false,"description":"The X-Correlation-ID for the request, used to track this request in the platform. X-Correlation-ID value is propagated throughout the platform."},"XRequestId":{"schema":{"type":"string"},"required":false,"description":"The unique id for the request, used to track this request within the service. X-Request-ID value is NOT propagated to the downstream services."},"WWWAuthenticate":{"schema":{"type":"string"},"required":true,"description":"Must be included If the protected resource request does not include authentication credentials or does not contain an access token that enables access to the protected resource. The value must have at least one challenge and must be followed by a comma separated list having one or more authentication param values. In case of OAuth2.0, the challenge must use the auth-scheme value \"Bearer\"."}},"schemas":{"CreateAppRequest":{"type":"object","required":["name"],"properties":{"clientId":{"$ref":"#/components/schemas/ClientId"},"name":{"$ref":"#/components/schemas/Name"},"description":{"$ref":"#/components/schemas/Description"},"redirectUris":{"$ref":"#/components/schemas/RedirectUris"},"allowedScopes":{"$ref":"#/components/schemas/AllowedScopes"},"tokenEndpointAuthMethod":{"$ref":"#/components/schemas/TokenEndpointAuthMethod"},"tokenEndpointAuthMethodReason":{"$ref":"#/components/schemas/TokenEndpointAuthMethodReason"},"dobRequired":{"$ref":"#/components/schemas/DobRequired"},"tokenDuration":{"$ref":"#/components/schemas/TokenDuration"},"responseTypes":{"$ref":"#/components/schemas/ResponseTypes"},"referrers":{"$ref":"#/components/schemas/Referrers"},"allowedRealmTypes":{"$ref":"#/components/schemas/AllowedRealmTypes"},"deviceTokenCreationEnabled":{"$ref":"#/components/schemas/DeviceTokenCreationEnabled"},"deviceApiCallRateLimitPer15Minutes":{"$ref":"#/components/schemas/DeviceApiCallRateLimitPer15Minutes"}}},"DeviceApiCallRateLimitPer15Minutes":{"type":"integer","minimum":1,"maximum":1000,"example":10,"description":"The rate limit per 15 minutes for linked anonymous devices. Property deviceTokenCreationEnabled needs to be true and a value needs to be set for property deviceApiCallRateLimitPer15Minutes to enable this rate limit. Otherwise the rate limit defaults to the client level rate limit."},"DeviceTokenCreationEnabled":{"type":"boolean","example":false,"description":"If the application allows token creation for linked anonymous devices."},"AppCreationEnabled":{"type":"boolean","example":true,"description":"If the application is allowed to create an App."},"App":{"type":"object","allOf":[{"$ref":"#/components/schemas/CreateAppRequest"},{"type":"object","properties":{"appCreationEnabled":{"$ref":"#/components/schemas/AppCreationEnabled"},"platformTier":{"$ref":"#/components/schemas/PlatformTier"},"hrn":{"$ref":"#/components/schemas/HRN"},"status":{"$ref":"#/components/schemas/Status"},"appCodeEnabled":{"$ref":"#/components/schemas/AppCodeEnabled"},"appCodeVisible":{"$ref":"#/components/schemas/AppCodeVisible"},"applicationType":{"$ref":"#/components/schemas/ApplicationType"},"createdTime":{"$ref":"#/components/schemas/CreatedTime"},"realm":{"$ref":"#/components/schemas/Realm"},"rateLimitTier":{"$ref":"#/components/schemas/RateLimitTier"}}}]},"PatchAppRequest":{"type":"object","allOf":[{"$ref":"#/components/schemas/CreateAppRequest"},{"type":"object","properties":{"clientId":{"type":"string","readOnly":true}}}]},"PageWithToken":{"type":"object","required":["limit","total","items"],"properties":{"limit":{"type":"integer","example":1,"description":"number of entries in the response."},"pageToken":{"type":"string","example":"KuMvTQrdHVVKuMDDdcIvTQrdci1FWdcIHVVci1FW","description":"The cursor for pagination. Present only if there is an additional page of data to view."},"total":{"type":"integer","example":1,"description":"The number of federations matching the search criteria."}}},"AppPageWithToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/AppInfo"},"description":"List of apps."}}}]},"CreateAccessKeyResponse":{"type":"object","properties":{"accessKeyId":{"type":"string","example":"846ee567-7806-403a-97b6-6cf0b6ffa897"},"accessKeyHrn":{"type":"string","example":"hrn:here:account::myrealm:accesskey/846ee567-7806-403a-97b6-6cf0b6ffa897"},"accessKeySecret":{"type":"string","example":"KuMvTQrdHVVKuMDDdcIvTQrdci1FWdcIHVVci1FW"},"clientId":{"type":"string","example":"uIkGzYShLKtQQAimXzvV","readOnly":true},"clientHrn":{"type":"string","example":"hrn:here:account::myrealm:app/uIkGzYShLKtQQAimXzvV"},"tokenEndpointUrl":{"type":"string","example":"https://account.api.here.com/oauth2/token"},"enabled":{"type":"boolean","example":true},"createdTime":{"type":"integer","format":"int64","example":1545041748000}}},"AccessKey":{"type":"object","properties":{"accessKeyId":{"type":"string","example":"846ee567-7806-403a-97b6-6cf0b6ffa897","readOnly":true},"accessKeyHrn":{"type":"string","example":"hrn:here:account::myrealm:accesskey/846ee567-7806-403a-97b6-6cf0b6ffa897","readOnly":true},"clientId":{"type":"string","example":"uIkGzYShLKtQQAimXzvV","readOnly":true},"clientHrn":{"type":"string","example":"hrn:here:account::myrealm:app/uIkGzYShLKtQQAimXzvV","readOnly":true},"enabled":{"type":"boolean","example":true},"createdTime":{"type":"integer","format":"int64","example":1545041748000,"readOnly":true},"lastTimeUsed":{"type":"integer","format":"int64","description":"The timestamp that this Access Key was last used within one minute precision.","example":1545041748000,"readOnly":true}}},"AccessKeyPageWithToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/AccessKey"},"description":"List of access keys."}}}]},"ClientId":{"type":"string","example":"uIkGzYShLKtQQAimXzvV","description":"Identifier for the client/application. If provided, identifier should be present and active in Druid."},"Name":{"type":"string","example":"My Application","description":"Human readable name of the client.  This field is required unless a clientId is provided."},"Description":{"type":"string","example":"This is a description of my application.","description":"Prose description of the client"},"RedirectUris":{"type":"array","items":{"type":"string","format":"uri"},"example":["https://www.example.com","https://qa.example.com"],"description":"List of redirect Uris. should be fully qualified HTTPS URIs without any fragments (HTTP is only supported for localhost development). At least one Redirect URI should be registered if the response types is non-empty.\nRedirect URI as defined in OAuth2 specification: [https://tools.ietf.org/html/rfc6749#section-3.1.2](https://tools.ietf.org/html/rfc6749#section-3.1.2)"},"AllowedScopes":{"type":"array","items":{"type":"string","enum":["openid","email","profile","phone"]},"example":["email","profile"],"description":"List of Strings representing the scopes. This field is required when the response types is non-empty. For more details [see here](http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims)."},"TokenEndpointAuthMethod":{"type":"string","enum":["client_secret_basic","client_secret_post","client_secret_jwt"],"example":"client_secret_jwt","description":"The default value will be \"client_secret_jwt\" if the field is not included in the request body.Please check [here](http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication) for further details."},"TokenEndpointAuthMethodReason":{"type":"string","minLength":20,"example":"Here's the reason why client_secret_jwt was not used.","description":"This needs to be included only if  \"tokenEndpointAuthMethod\" is not equal to client_secret_jwt. The reason for choosing a less secure tokenEndpoint auth method needs to be provided here. Minimum 20 characters required."},"DobRequired":{"type":"boolean","example":false,"description":"Flag indicating whether or not application users are required to provide their date of birth.\n\ntrue - the user must supply their DOB\nfalse - the user can use self-service and indicate \"yes I am over age X\"\n\nCollection of users date of birth is required for compliance with Article 8 of the General Data Protection Regulation. For more details [see here](https://gdpr-info.eu/art-8-gdpr/)"},"TokenDuration":{"type":"integer","example":3600,"description":"default duration in seconds for the token issued to this application. It has be a non-zero value, less than or equal to 24 hours (86400) or the max allowed for the realm via the realm setting."},"Status":{"type":"string","enum":["active","expired","blacklisted","deactivated"],"example":"active","description":"Status of the application.","readOnly":true},"AppCodeEnabled":{"type":"boolean","example":true,"description":"Identifies if app codes are enabled.","readOnly":true},"AppCodeVisible":{"type":"boolean","example":true,"description":"Identifies if app code is available via the /apps/{app}/appCode API.","readOnly":true},"ApplicationType":{"type":"string","enum":["application","service"],"example":"application","description":"Whether it's an application or a trusted back-end service.","readOnly":true},"CreatedTime":{"type":"integer","format":"int64","example":1432216394712,"description":"Timestamp (milliseconds since the Unix epoch) of when the app was created.","readOnly":true},"Realm":{"type":"string","example":"HERE","description":"Realm the application belongs to.","readOnly":true},"ResponseTypes":{"type":"array","items":{"type":"string","enum":["code","token","id_token"]},"example":["code"],"description":"Valid value is \"code\". If the responseTypes value is \"id_token\" or [\"token\", \"id_token\"], then the allowedScopes value must contain \"openid\". For more details see [here](http://openid.net/specs/openid-connect-core-1_0.html#Authentication) and [here](https://tools.ietf.org/html/rfc6749#section-3.1.1)."},"RateLimitTier":{"type":"string","example":"olp_tier_50k","description":"Rate limit tier to configure application for. If no rate limit tier is specified, created application will be configured with 'global' rate limit tier.","readOnly":true},"PlatformTier":{"type":"integer","example":1,"description":"The platform rate limit tier assigned to this realm.  Must be an integer > 0.  All identities in the realm are associated with this\ntier unless otherwise individually overridden.  This tier applies to calls against all Platform APIs excluding HERE Account APIs.\nThe rate limiting rules for each tier are dynamically configured.\n"},"HRN":{"type":"string","example":"hrn:here:account::HERE:app/uIkGzYShLKtQQAimXzvV","description":"HRN of the application.","readOnly":true},"Referrers":{"type":"array","items":{"type":"string","minLength":1,"maxLength":255,"example":"api.here.com/api"},"maxItems":20,"example":["localhost","127.0.0.1","www.example.com/hello/world/"],"description":"List Referrer URLs to register/registered with Application\n  * On create/update: if the parameter is not present, the current value(s) are unchanged. If empty list specified, current value(s) will be reset to empty list.\n  * Value has a min length of 1 char and max of 255 chars.\n  * Wildcards are NOT allowed. The only valid characters`:` alphanumerics, '-', '_', '.', '/'\n  * The protocol is NOT specified, i.e. no http:// or https://\n  * Some examples`:` here.com, localhost, 127.0.0.1, www.example.com/hello/world/\n  * A port may be specified. Ex. localhost:1234\n  * Maximum of 20 Referrer URLs are allowed per application.\n"},"AllowedRealmTypes":{"type":"array","items":{"type":"string","enum":["olp","auto","consumer","all"]},"example":["olp"],"description":"List of realmTypes from which this client is allowed to request user access tokens when using either the OAuth2 or OpenID protocols.\n"},"DefaultScope":{"type":"string","description":"The default requested scope for the given application.","example":"hrn:here:authorization::myrealm:project/my-project-0000"},"IsRestrictedScope":{"type":"boolean","example":true,"default":false,"description":"Boolean value indicating whether or not the given application should be restricted\nfrom requesting a client token with a different scope from the default value.\nAccess tokens with NO scope are allowed with this value set to true unless\nthe 'alwaysProjectScope' setting is also true.  This value has no effect on the scope\nof API Keys which are assigned no scope unless 'alwaysProjectScope' is set to true.\n"},"AlwaysProjectScope":{"type":"boolean","example":true,"default":false,"description":"Indicates whether or not the given application is locked to the default scope.\nWhen this value is set to true, both API Keys and Access Tokens for this app are\nalways assigned the default project.  In addition, the given application cannot\nbe added to any additional projects or groups.  Any attempt to get an unscoped access token\nfor the given application will fail.  Any API Keys associated with the given\napplication are assigned the default scope.\n"},"ErrorDetail":{"type":"object","properties":{"title":{"type":"string","description":"Error message","example":"Invalid size value"},"source":{"type":"string","description":"Reference to JSON path","example":"$.data.attributes[0].size"},"message":{"type":"string","description":"Detailed error message","example":"Size must be between 3 and 64"},"messageTemplate":{"type":"string","description":"Optional error template","example":"validation.constraint.between"},"messagePlaceholders":{"type":"object","additionalProperties":{},"example":{"field":"size","min":3,"max":64}}}},"IdpTemplateResponseWithPageToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/IdentityProviderTemplate"},"description":"List of IDP templates."}}}]},"IdentityProviderTemplate":{"type":"object","properties":{"id":{"type":"string","description":"Identity provider template id","example":"okta"},"name":{"type":"string","description":"Name of the identity provider template.","example":"okta"}}},"SamlIdpConfigValidateOnlyResponse":{"type":"object","properties":{"name":{"type":"string","description":"IdP's display name.","example":"Okta Login!"},"identityProviderTemplateId":{"type":"string","description":"Identity provider (okta/entra/generic).","example":"okta"},"entityId":{"type":"string","description":"IdP entity Id.","example":"https://www.example.com/mySso"},"ssoLoginUrl":{"type":"string","description":"The login url for IdP","example":"https://here.example.com/sso/saml"}}},"SamlIdpConfigResponse":{"type":"object","properties":{"samlIdentityProviderHrn":{"type":"string","description":"HRN of the IdP","example":"hrn:here:account::myRealm:samlIdentityProvider/IDP-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d"},"name":{"type":"string","description":"IdP's display name.","example":"Okta Login!"},"identityProviderTemplateId":{"type":"string","description":"Identity provider (okta/entra/generic).","example":"okta"},"entityId":{"type":"string","description":"IdP entity Id.","example":"https://www.example.com/mySso"},"ssoLoginUrl":{"type":"string","description":"The login url for IdP","example":"https://here.example.com/sso/saml"},"created":{"type":"string","format":"date-time","example":"2023-01-21T17:32:28Z"},"enabled":{"type":"boolean","description":"Whether the IdP config is enabled or not","example":true},"callback":{"type":"string","description":"Service provider's callback url.","example":"https://account.here.com/saml/callback"},"spMetadataUrl":{"type":"string","description":"Url to get service provider metadata.xml file content.","example":"https://account.here.com/identityProvider/aHJuOmhlcmU6YWNjb3VudDo6bXlSZWFs/metadata"},"spCertificateUrl":{"type":"string","description":"Url to get service provider public key certificate.","example":"https://account.here.com/identityProvider/aHJuOmhlcmU6YWNjb3VudDo6bXlSZWFs/cert"}}},"SamlIdpConfigResponseWithPageToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/SamlIdpConfigResponse"},"description":"List of IdP configurations."}}}]},"SamlIdpUpdateRequest":{"type":"object","properties":{"name":{"type":"string","description":"Idp's display name.","example":"Okta Login!"},"identityProviderTemplateId":{"type":"string","description":"Identity provider (okta/entra/generic).","example":"okta"},"entityId":{"type":"string","description":"Issuer Id provided for the IDP","example":"https://www.example.com/mySso"},"ssoLoginUrl":{"type":"string","description":"Login url for the IDP","example":"https://here.example.com/sso/saml"},"metadataSource":{"type":"string","description":"Path to the IdP metadata file (file path or URL).","example":"File"},"metadataContent":{"type":"string","description":"Base-64 encrypted metadata xml content.","example":"PG1kOkVudGl0eURlc2NyaXB0b3IKCXhtbG5zOm1kPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLj=="}}},"SamlIdpConfigRequest":{"type":"object","required":["name","identityProviderTemplateId","metadataContent"],"properties":{"name":{"type":"string","description":"IdP's display name.","example":"Okta Login!"},"identityProviderTemplateId":{"type":"string","description":"Identity provider (okta/entra/generic).","example":"okta"},"metadataContent":{"type":"string","description":"Base-64 encoded metadata xml content.","example":"PG1kOkVudGl0eURlc2NyaXB0b3IKCXhtbG5zOm1kPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLj=="},"metadataSource":{"type":"string","description":"Path to the IdP metadata file (file path or URL).","example":"/root/meta.xml"},"entityId":{"type":"string","description":"Issuer Id provided for the IdP. This will be extracted from the metadata if not provided.","example":"https://www.example.com/mySso"},"ssoLoginUrl":{"type":"string","description":"Login url for the IdP. This will be extracted from the metadata if not provided.","example":"https://here.example.com/sso/saml"}}},"MtlsCARequest":{"type":"object","required":["name","certificateChainPemContent"],"properties":{"name":{"type":"string","description":"IdP's display name.","example":"My Certificate Authority"},"certificateChainPemContent":{"type":"string","description":"PEM encoded certificate chain","example":"-----BEGIN CERTIFICATE-----\\nMIIF7TCCBNWgAwIBAgIQJ1J...\\n-----END CERTIFICATE-----"}}},"MtlsCAResponse":{"type":"object","required":["hrn","name","certificates"],"properties":{"hrn":{"type":"string","description":"HRN of the mTLS Identity Provider","example":"hrn:here:account::myRealm:mtlsIdentityProvider/IDP-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d"},"name":{"type":"string","description":"IdP's display name.","example":"My Certificate Authority"},"certificates":{"type":"array","description":"Details about each certificate in the chain","items":{"type":"object","properties":{"subject":{"type":"string","description":"The subject field of the certificate","example":"C=DE, O=Company Name, CN=Company Intermediate CA v1"},"fingerprint":{"type":"string","description":"The SHA-1 encoded fingerprint the certificate","example":123456789},"serialNumber":{"type":"string","description":"The serial number of the certificate","example":"43:40:44:51:3a:80:2a:a1:9c:97:a2:d0:41:47:74:5a:e1:b0:48:48"}}}}}},"MtlsCAResponseWithPageToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/MtlsCAResponse"},"description":"List of mTLS Certificate Authorities"}}}]},"AddIdentityProviderRequest":{"type":"object","required":["id"],"properties":{"id":{"type":"string","description":"Unique identifier the Identity Provider within a Realm","example":"widgets-op"},"name":{"type":"string","description":"User-friendly name for the Identity Provider","example":"Widgets Provider"},"description":{"type":"string","description":"Detailed text description of the Identity Provider","example":"The Widgets Provider is used with vehicles shipped in the Whatzit market."},"issuers":{"type":"array","minLength":1,"maxLength":2,"items":{"type":"object","required":["issuer"],"properties":{"issuer":{"type":"string","description":"OpenID Connect Provider Issuer URL.","example":"https://op.example.com"}}}},"accountType":{"type":"string","description":"Always \"device\" for now.  Reserved for future use, new account types may be added in the future.","enum":["device"],"default":"device","example":"device"},"enabled":{"type":"boolean","description":"Defines if the Identity Provider is enabled","example":true}}},"UpdateIdentityProviderRequest":{"type":"object","properties":{"name":{"type":"string","description":"User-friendly name for the Identity Provider","example":"Widgets Provider"},"description":{"type":"string","description":"Detailed text description of the Identity Provider","example":"The Widgets Provider is used with vehicles shipped in the Whatzit market."}}},"IdentityProvider":{"type":"object","required":["id","accountType","realm"],"properties":{"id":{"type":"string","description":"Unique identifier the OpenID Connect Provider within the Realm.","example":"example-op"},"hrn":{"type":"string","description":"HRN for the Realm Provider","example":"hrn:here:account::org123456789:identityProviders/example-op"},"name":{"type":"string","description":"User-friendly name for the OpenID Connect Provider","example":"Example OP"},"description":{"type":"string","description":"Detailed text description of the Identity Provider","example":"The Widgets Provider is used with vehicles shipped in the Whatzit market."},"accountType":{"type":"string","description":"Always \"device\" for now.  Reserved for future use, new account types may be added in the future.","enum":["device"],"default":"device","example":"device"},"realm":{"type":"string","description":"HRN of the Realm within which the OpenID Connect Provider is trusted."},"created":{"type":"string","format":"date-time","example":"2023-01-21T17:32:28Z"},"issuers":{"type":"array","maxLength":2,"items":{"type":"object","required":["issuer"],"properties":{"issuer":{"type":"string","description":"OpenID Connect Provider Issuer URL.","example":"https://op.example.com"},"enabled":{"type":"boolean","description":"true to enable an individual issuer URL.","default":true}}}}}},"IdentityProviderList":{"type":"object","required":["count","total","items"],"properties":{"count":{"type":"integer","description":"The number of IdentityProviders in this page of the List."},"total":{"type":"integer","description":"The total number of IdentityProviders in the List."},"items":{"type":"array","items":{"$ref":"#/components/schemas/IdentityProvider"},"description":"List of IdentityProviders."},"pageToken":{"type":"string","description":"A pointer to the next page of results, if any.  \nNot present if there are no more results after the current page.\n"}}},"IdentityProviderIssuerAttachmentList":{"type":"object","required":["count","total","items"],"properties":{"count":{"type":"integer","description":"The number of IdentityProviderIssuerAttachments in this page of the List."},"total":{"type":"integer","description":"The total number of IdentityProviderIssuerAttachments in the List."},"items":{"type":"array","items":{"$ref":"#/components/schemas/IdentityProviderIssuerAttachment"},"description":"List of IdentityProvider Issuer Attachments.","maxItems":2},"pageToken":{"type":"string","description":"A pointer to the next page of results, if any.\nNot present if there are no more results after the current page.\n"}}},"IdentityProviderIssuerAttachment":{"type":"object","required":["identityProvider","issuer","enabled"],"properties":{"identityProvider":{"type":"string","description":"IdentityProvider HRN","example":"hrn:here:account::org123456789:identityProviders/example-op"},"issuer":{"type":"string","description":"OIDC Issuer URL","example":"https://op.example.com"},"enabled":{"type":"boolean","description":"indicates whether the configured OpenID Connect Provider is enabled for use in the Realm","default":true,"example":true}}},"CreateIdentityProviderIssuerAttachment":{"type":"object","properties":{"enabled":{"type":"boolean","description":"indicates whether the configured OpenID Connect Provider is enabled for use in the Realm","default":true,"example":true}}},"UpdateIdentityProviderIssuerAttachmentRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"indicates whether the configured OpenID Connect Provider is enabled for use in the Realm","default":true,"example":true}}},"App1":{"type":"object","properties":{"hrn":{"type":"string","description":"HRN for the App","example":"hrn:here:account::org123456789:app/AfRcv675i2zYubYTe17D"},"id":{"type":"string","description":"ID for the App","example":"AfRcv675i2zYubYTe17D"},"name":{"type":"string","description":"Human readable name of the client. This field is required unless a clientId is provided.","example":"My IdP Federation Application"}}},"AppList":{"type":"object","required":["count","total","items"],"properties":{"count":{"type":"integer","description":"The number of Apps in this page of the List."},"total":{"type":"integer","description":"The total number of Apps in the List."},"items":{"type":"array","items":{"$ref":"#/components/schemas/App1"},"description":"List of Apps."},"pageToken":{"type":"string","description":"A pointer to the next page of results, if any.  \nNot present if there are no more results after the current page.\n"}}},"MtlsAuthenticator":{"type":"object","properties":{"hrn":{"type":"string","description":"HRN for the mTLS Authenticator","example":"hrn:here:account::myRealm:mtlsAuthenticator/IDP-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d"},"accountType":{"type":"string","description":"The type of account from the realm that may authenticate with a valid certificate issued from the\nmTLS Identity Provider with this mTLS Authenticator.  Always \"car\" for now. Reserved for future use.\n","enum":["car"],"example":"car"},"mtlsIdentityProviderHrn":{"type":"string","description":"HRN for the mTLS Identity Provider","example":"hrn:here:account::myRealm:mtlsIdentityProvider/IDP-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d"},"mtlsIdentityProviderName":{"type":"string","description":"Name of the mTLS Identity Provider","example":"OEM Certificate Authority"},"appHrn":{"type":"string","description":"HRN for the App that will be used for all access tokens provided by this authenticator","example":"hrn:here:account::org123456789:app/AfRcv675i2zYubYTe17D"},"enabled":{"type":"boolean","description":"Indicates whether or not the app is enabled for authenticating certificates from the mTLS Identity Provider","example":true}}},"MtlsAuthenticatorPageWithToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/MtlsAuthenticator"}}}}]},"MtlsAuthenticatorRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Indicates whether or not this authenticator is enabled for authenticating client certificates.","default":true,"example":true}}},"CreateAppIdentityProviderAttachmentRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Indicates whether or not this AppIdentityProviderAttachment is enabled.","default":true,"example":true}}},"AppIdentityProviderAttachment":{"type":"object","properties":{"identityProviderId":{"type":"string","description":"Unique identifier the OpenID Connect Provider within the Realm.","example":"example-op"},"identityProviderHrn":{"type":"string","description":"HRN for the Realm Provider","example":"hrn:here:account::org123456789:identityProviders/example-op"},"identityProviderName":{"type":"string","description":"User-friendly name for the OpenID Connect Provider","example":"Example OP"},"identityProviderDescription":{"type":"string","description":"Detailed text description of the Identity Provider","example":"The Widgets Provider is used with vehicles shipped in the Whatzit market."},"identityProviderAccountType":{"type":"string","description":"Always \"device\" for now.  Reserved for future use, new account types may be added in the future.","enum":["device"],"default":"device","example":"device"},"identityProviderRealm":{"type":"string","description":"HRN of the Realm within which the OpenID Connect Provider is trusted."},"identityProviderIssuers":{"type":"array","maxLength":2,"items":{"type":"object","required":["issuer"],"properties":{"issuer":{"type":"string","description":"OpenID Connect Provider Issuer URL.","example":"https://op.example.com"},"enabled":{"type":"boolean","description":"true to enable an individual issuer URL.","default":true}}}},"appHrn":{"type":"string","description":"HRN for the App","example":"hrn:here:account::org123456789:app/uIkGzYShLKtQQAimXzvV"},"enabled":{"type":"boolean","description":"Indicates whether or not this AppIdentityProviderAttachment is enabled.","default":true,"example":true}}},"UpdateAppIdentityProviderAttachmentRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Indicates whether or not this AppIdentityProviderAttachment is enabled.","default":true,"example":true}}},"AppIdentityProviderAttachmentList":{"type":"object","required":["count","total","items"],"properties":{"count":{"type":"integer","description":"The number of AppIdentityProviderAttachments in this page of the List."},"total":{"type":"integer","description":"The total number of AppIdentityProviderAttachments in the List."},"items":{"type":"array","items":{"$ref":"#/components/schemas/AppIdentityProviderAttachment"},"minItems":0,"maxItems":2},"pageToken":{"type":"string","description":"A pointer to the next page of results, if any.  \nNot present if there are no more results after the current page.\n"}}},"Device":{"type":"object","required":["id","hrn","realm","project"],"properties":{"id":{"type":"string","description":"Unique identifier for the Device within the Realm.","example":"DEVICE-16835a01-7546-4c1c-9894-5f837f854f83"},"hrn":{"type":"string","description":"HRN for the Device","example":"hrn:here:account::org123456789:devices/DEVICE-16835a01-7546-4c1c-9894-5f837f854f83"},"realm":{"type":"string","description":"The HRN for the Realm of the Device.","example":"hrn:here:account::org123456789:realm/org123456789"},"project":{"type":"string","description":"The HRN for the Project of the Device.","example":"hrn:here:account::org123456789:project/my-project-0000"},"identityProvider":{"type":"string","description":"HRN of the IdentityProvider for the Device, if the Device was created from an identity in third-party \nIdentity Provider.\n","example":"hrn:here:account::org123456789:identityProviders/example-op"},"externalId":{"type":"string","description":"External identifier for the Device under a third-party Identity Provider.\nAn example External ID is a Pseudo-VIN representing a stable hashed VIN identifying \nthe Subject vehicle at the Identity Provider.\nIf OpenID Connect Token Exchange was used to create this Device identity, the\nExternalId matches the value of the \"sub\" claim in the OP's access tokens.\nExternal IDs are considered unique for a given a Identity Provider.\n\nTODO: should we expose this in our APIs, or does it raise Privacy concerns?\n","example":"vtWk4eNAlYLi2UHJGNONTAM5Q7WV4nxHTZGiyfgpFbQ="},"enabled":{"type":"boolean","description":"true if the Device is enabled for use in the platform, false if disabled for use.","example":true}}},"UpdateDevice":{"type":"object","properties":{"enabled":{"type":"boolean","description":"true if the Device is enabled for use in the platform, false if disabled for use.","example":true}}},"DeviceList":{"type":"object","required":["count","items"],"properties":{"count":{"type":"integer","description":"The number of Devices in this page of the List."},"items":{"type":"array","items":{"$ref":"#/components/schemas/Device"},"description":"List of Devices."},"pageToken":{"type":"string","description":"A pointer to the next page of results, if any.  \nNot present if there are no more results after the current page.\n"}}},"ErrorMessage":{"type":"object","required":["title","status","code","cause","action","correlationId"],"example":{"title":"Input data failed validation","status":400,"code":"E110000","cause":"The input data in question does not meet validation rules","action":"Actionable instructions for the user.","correlationId":"6c1bce6d-d31f-4275-9d9f-6832d8ba2377"},"properties":{"title":{"type":"string","description":"Title of the error."},"status":{"type":"integer","minimum":0,"maximum":999,"description":"HTTP status code of error message."},"code":{"type":"string","description":"Identifier for the detailed error code for programmatic error handling."},"cause":{"type":"string","description":"The cause of the error."},"action":{"type":"string","description":"Actionable instructions for the user."},"correlationId":{"type":"string","description":"The Correlation ID for the request for tracking purposes."}}},"ErrorResponse":{"type":"object","required":["title","status","code","cause","action","errorId"],"properties":{"title":{"description":"Error title","type":"string","example":"Input data failed validation"},"errorId":{"type":"string","example":"ERROR-9d862c5a-4cfd-4780-8be4-2728b42849e1","description":"Unique id for the error. This is searchable from HERE Account logs."},"status":{"description":"HTTP Status Code","type":"integer","example":400},"code":{"description":"Service specific error code","type":"string","example":"E202101"},"cause":{"description":"The cause of the error","type":"string","example":"The input data in question does not meet validation rules"},"action":{"description":"Actionable instructions for the API consumer","type":"string","example":"Correct input data and retry request"},"correlationId":{"description":"Trace ID associated with this request, for future use","type":"string","example":"4199533b-6290-41db-8d79-edf4f4019a74"},"details":{"type":"array","description":"Collection of error details","items":{"$ref":"#/components/schemas/ErrorDetail"}}}},"Error401Response":{"type":"object","required":["title","status","code","cause","action","correlationId"],"properties":{"title":{"type":"string","example":"","description":""},"status":{"description":"HTTP Status Code","type":"integer","example":401},"code":{"description":"Service specific error code","type":"string","example":"E202101"},"cause":{"description":"The cause of the error","type":"string","example":"The input data in question does not meet validation rules"},"action":{"description":"Actionable instructions for the API consumer","type":"string","example":"Correct input data and retry request"},"correlationId":{"description":"Trace ID associated with this request.","type":"string","example":"4199533b-6290-41db-8d79-edf4f4019a74"},"errorId":{"type":"string","example":"ERROR-9d862c5a-4cfd-4780-8be4-2728b42849e1","description":"Unique id for the error. This is searchable from HERE Account logs."},"message":{"description":"Authorization error message","type":"string","example":"Unauthorized to perform this operation."}}},"Error403Response":{"type":"object","required":["title","status","code","cause","action","correlationId"],"properties":{"title":{"description":"Error title","type":"string","example":"These credentials do not authorize access for this operation."},"status":{"description":"HTTP Status Code","type":"integer","example":403},"code":{"description":"Service specific error code","type":"string","example":"E202101"},"cause":{"description":"The cause of the error","type":"string","example":"App/User WgxjTzUL8sTbq5fMDPDg/HERE-f7ef7b16-6deb-4b44-986f-d86deed59980 credentials do not authorize access to perform manage action on hrn:here:authorization::HERE:serviceDescriptor/SERVICE-00000000-0000-0000-0000-000000000000 via SERVICE-00000000-0000-0000-0000-000000000000 because No matching permissions found for the identity, its groups and roles, or the realm."},"action":{"description":"Actionable instructions for the API consumer","type":"string","example":"Add/Share the necessary permissions to the identity."},"correlationId":{"description":"Trace ID associated with this request.","type":"string","example":"4199533b-6290-41db-8d79-edf4f4019a74"},"errorId":{"type":"string","example":"ERROR-9d862c5a-4cfd-4780-8be4-2728b42849e1","description":"Unique id for the error. This is searchable from HERE Account logs."},"error":{"type":"string","description":"Human-readable error","example":"invalid_request"},"error_description":{"type":"string","description":"Human-readable error description","example":"errorCode: 403403. These credentials do not authorize access for this operation."}}},"GenericError404Response":{"type":"object","required":["title","status","code","cause","action","correlationId"],"properties":{"title":{"description":"Error title","type":"string","example":"Resource not found."},"status":{"description":"HTTP Status Code","type":"integer","example":404},"code":{"description":"Service specific error code","type":"string","example":"E202101"},"cause":{"description":"The cause of the error","type":"string","example":"Resource not found."},"action":{"description":"Actionable instructions for the API consumer","type":"string","example":"Validate input parameters and retry."},"correlationId":{"description":"Trace ID associated with this request.","type":"string","example":"4199533b-6290-41db-8d79-edf4f4019a74"},"errorId":{"type":"string","example":"ERROR-3c7cae72-f407-4d75-807d-bc1689fbbd4d","description":"Unique id for the error. This is searchable from HERE Account logs."},"error":{"type":"string","description":"Human-readable error","example":"invalid_request"},"error_description":{"type":"string","description":"Human-readable error description","example":"Resource not found."}}},"APIKeyName":{"type":"string","description":"Creator-defined name or short description for the API key.\n","example":"API Key for test app"},"APIKeyExpiresAt":{"type":"integer","format":"int64","description":"Timestamp (milliseconds since the Unix epoch) of when the API key will expire.\nIf expiresAt is not provided on creation, it will default to '-1', i.e. API key does NOT expire\n","default":-1,"example":1545041748000},"APIKeyEnabled":{"type":"boolean","description":"Whether API key is enabled or disabled.\n","default":true,"example":true},"APIKeyGenerateRequest":{"type":"object","required":["name"],"properties":{"name":{"$ref":"#/components/schemas/APIKeyName"},"expiresAt":{"$ref":"#/components/schemas/APIKeyExpiresAt"},"enabled":{"$ref":"#/components/schemas/APIKeyEnabled"}}},"APIKeyUpdateRequest":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/APIKeyName"},"expiresAt":{"$ref":"#/components/schemas/APIKeyExpiresAt"}}},"ApiKey":{"type":"object","properties":{"apiKeyId":{"type":"string","description":"Plaintext query string argument used to authenticate requests to HERE Services using this API Key.\n","example":"2MZr9AInTFk45NAU8ClIza2Yw7w_AXyUyM4ChvtO7bY"},"apiKey":{"type":"string","description":"HRN with obfuscated apiKeyId.\n","example":"hrn:here:account::myrealm:apikey/ygfDVbZc7vJQTRGjC5-YXZbuwWwxFu4FxD5SsWbp-no"},"identity":{"type":"string","description":"HRN identifying an identity to which this API key associated with.\n","example":"hrn:here:account::myrealm:app/lACE8kgYxsahjbXnvy8w"},"realm":{"type":"string","description":"The HRN of the realm of API key.\n","example":"hrn:here:account::myrealm:realm/myrealm"},"name":{"$ref":"#/components/schemas/APIKeyName"},"enabled":{"$ref":"#/components/schemas/APIKeyEnabled"},"createdTime":{"type":"integer","format":"int64","description":"Timestamp (milliseconds since the Unix epoch) of when the API key was created.\n","example":1545041748000},"expiresAt":{"$ref":"#/components/schemas/APIKeyExpiresAt"}}},"ApiKeyPageWToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ApiKey"}}},"example":{"total":2,"pageToken":"7afd7f8e94eb4844ba45","limit":1,"items":[{"apiKeyId":"2MZr9AInTFk45NAU8ClIza2Yw7w_AXyUyM4ChvtO7bY","apiKey":"hrn:here:account::myrealm:apikey/ygfDVbZc7vJQTRGjC5-YXZbuwWwxFu4FxD5SsWbp-no","identity":"hrn:here:account::myrealm:app/lACE8kgYxsahjbXnvy8w","realm":"hrn:here:account::myrealm:realm/myrealm","name":"First API key for ABC app","enabled":true,"createdTime":1545041748000,"expiresAt":1545041748456}]}}]},"AppCode":{"deprecated":true,"type":"object","properties":{"appCode":{"type":"string","description":"Plaintext query string argument used to authenticate requests to classic HERE Services that still support the app_code query string.\n","example":"2MZr9AInTFk45"},"appId":{"type":"string","description":"App ID used to authenticate requests to classic HERE Services that still support the app_id query string.\n","example":"lACE8kgYxsahjbXnvy8w"},"identity":{"type":"string","description":"HRN identifying an identity to which this App Code is associated.\n","example":"hrn:here:account::myrealm:app/lACE8kgYxsahjbXnvy8w"},"realm":{"type":"string","description":"The HRN of the realm of the App Code.\n","example":"hrn:here:account::myrealm:realm/myrealm"},"createdTime":{"type":"integer","format":"int64","description":"Timestamp (milliseconds since the Unix epoch) of when the App Code was created.\n","example":1545041748000}}},"CreateSecretRequest":{"type":"object","required":["id","secret","type"],"properties":{"id":{"type":"string","description":"ID for the Secret.  ID must contain 4 and 16 lowercase alphanumeric characters [a-z0-9] plus the hyphen character [-].\n","example":"my-secret-1"},"secret":{"type":"string","description":"Web-safe-base64-encoded secret file contents.\nThis property is redacted from the Retrieve Secret and List Secrets APIs,\nbut is securely delivered to Platform Runtimes, as long as the Secret is enabled and not expired.\nThe 'sha256' property in the Retrieve Secret and List Secrets APIs response provides the ability to validate\nthe stored value, but since sha-256 is a one-way hash, the underlying 'secret' remains hidden from view.\n","example":"bXktc2VjcmV0PWZvby1iYXI="},"type":{"type":"string","enum":["aws","custom"],"description":"\"aws\" or \"custom\".  For \"aws\", the platform will place the file in ~/.aws/<file>.  For \"custom\", the\nplatform will place the file in ~/.here/<file>.\n","example":"aws"},"filename":{"type":"string","pattern":"^[A-Za-z0-9_\\-][A-Za-z0-9_\\.\\-]*$","description":"A relative filename for the platform to use to write the secret in plaintext on the filesystem.\nThe file will be placed in the directory as specified by the 'type' property.\nDefaults to \"credentials\".\n","example":"credentials"},"name":{"type":"string","description":"a descriptive name for the secret","example":"my favorite secret"},"enabled":{"type":"boolean","description":"true for enabled, false for disabled.\nAn enabled=false (disabled) secret is not delivered to Platform Runtimes.\n","example":true},"expires":{"type":"string","description":"Date-time formatted time this Secret expires.\nA null value or missing property means there is no end time at which the secret expires.\nThis property has no effect if enabled=false.\nAn expired secret is not delivered to Platform Runtimes.\n","example":"2020-12-28T02:24:00.000Z"}}},"UpdateSecretRequest":{"type":"object","properties":{"secret":{"type":"string","description":"Web-safe-base64-encoded secret file contents.\n","example":"bXktc2VjcmV0PWZvby1iYXI="},"type":{"type":"string","enum":["aws","custom"],"description":"\"aws\" or \"custom\".  For \"aws\", the platform will place the file in ~/.aws/<file>.  For \"custom\", the platform will place the file in ~/.here/<file>.\n","example":"aws"},"filename":{"type":"string","pattern":"^[A-Za-z0-9_\\-][A-Za-z0-9_\\.\\-]*$","description":"A relative filename for the platform to use to write the secret in plaintext on the filesystem.\nThe file will be placed in the directory as specified by the 'type' property.\nDefaults to \"credentials\".\n","example":"credentials"},"name":{"type":"string","description":"a descriptive name for the secret","example":"my favorite secret"},"enabled":{"type":"boolean","description":"true for enabled, false for disabled.\nAn enabled=false (disabled) secret is not delivered to Platform Runtimes.\n","example":true},"expires":{"type":"string","description":"Date-time formatted time this Secret expires.\nA null value or missing property means there is no end time at which the Secret expires.\nThis property has no effect if enabled=false.\nAn expired secret is not delivered to Platform Runtimes.\n","example":"2020-12-28T02:24:00.000Z"}}},"Secret":{"type":"object","properties":{"id":{"type":"string","description":"ID for the Secret.  ID must contain 4 and 16 lowercase alphanumeric characters [a-z0-9] plus the hyphen character [-].\n","example":"my-secret-1"},"type":{"type":"string","enum":["aws","custom"],"description":"\"aws\" or \"custom\".  For \"aws\", the platform will place the file in ~/.aws/<file>.  For \"custom\", the\nplatform will place the file in ~/.here/<file>.\n","example":"aws"},"filename":{"type":"string","pattern":"^[A-Za-z0-9_\\-][A-Za-z0-9_\\.\\-]*$","description":"A relative filename for the platform to use to write the secret in plaintext on the filesystem.\nThe file will be placed in the directory as specified by the 'type' property.\nDefaults to \"credentials\".\n","example":"credentials"},"name":{"type":"string","description":"a descriptive name for the Secret","example":"my favorite secret"},"hrn":{"type":"string","description":"The HRN for the Secret.\n","example":"hrn:here:account::myrealm:secret/abc-123"},"sha256":{"type":"string","description":"The SHA-256 hash of the 'secret' input.  (could also do SHA-256 hash of the base64-decoded secret input).\n","example":"C01DCECC41CA1E27BB0D41B089528D6D15443AF24E710A005BB2372CD107474E"},"enabled":{"type":"boolean","description":"true for enabled, false for disabled.\nAn enabled=false (disabled) secret is not delivered to Platform Runtimes.\n","example":true},"created":{"type":"string","description":"date-time formatted time of creation of this Secret object.","example":"2020-12-23T02:24:00.000Z"},"modified":{"type":"string","description":"date-time formatted time this Secret object was last modified.","example":"2020-12-23T02:24:00.000Z"},"expires":{"type":"string","description":"Date-time formatted time this Secret expires.\nA null value or missing property means there is no end time at which the Secret expires.\nThis property has no effect if enabled=false.\nAn expired secret is not delivered to Platform Runtimes.\n","example":"2020-12-28T02:24:00.000Z"}}},"SecretPageWToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Secret"}}},"example":{"total":2,"pageToken":"7afd7f8e94eb4844ba45","limit":1,"items":[{"id":"my-cred-1","type":"aws","filename":"credentials","name":"my favorite secret","hrn":"hrn:here:account::myrealm:secret/abc-123","sha256":"C01DCECC41CA1E27BB0D41B089528D6D15443AF24E710A005BB2372CD107474E","enabled":true,"created":"2020-12-23T02:24:00.000Z","modified":"2020-12-23T02:24:00.000Z"}]}}]},"AppInfo":{"type":"object","properties":{"id":{"type":"string","readOnly":true,"example":"0123456789ABCDEFGHHIJKLM","description":"Identifier for the client/application."},"hrn":{"type":"string","readOnly":true,"example":"hrn:here:account::myrealm:app/0123456789ABCDEFGHHIJKLM","description":"HRN for the client/application."},"realm":{"type":"string","readOnly":true,"example":"myrealm","description":"The realm to which the app belongs."},"name":{"type":"string","readOnly":true,"example":"Some Application","description":"Human readable name of the client."},"description":{"type":"string","readOnly":true,"example":"Application for doing something.","description":"Prose description of the client."},"status":{"type":"string","readOnly":true,"example":"active","description":"Status of the client."},"appCreationEnabled":{"$ref":"#/components/schemas/AppCreationEnabled"},"deviceTokenCreationEnabled":{"$ref":"#/components/schemas/DeviceTokenCreationEnabled"},"deviceApiCallRateLimitPer15Minutes":{"$ref":"#/components/schemas/DeviceApiCallRateLimitPer15Minutes"},"applicationType":{"$ref":"#/components/schemas/ApplicationType"},"createdTime":{"$ref":"#/components/schemas/CreatedTime"}}},"AppDefaultScope":{"type":"object","required":["scope"],"properties":{"scope":{"$ref":"#/components/schemas/DefaultScope"},"isRestricted":{"$ref":"#/components/schemas/IsRestrictedScope"},"alwaysProjectScope":{"$ref":"#/components/schemas/AlwaysProjectScope"}}},"AppDefaultScopeResponse":{"type":"object","properties":{"defaultScope":{"$ref":"#/components/schemas/DefaultScope"},"isRestrictedScope":{"$ref":"#/components/schemas/IsRestrictedScope"},"alwaysProjectScope":{"$ref":"#/components/schemas/AlwaysProjectScope"},"scope":{"allOf":[{"$ref":"#/components/schemas/DefaultScope"},{"deprecated":true},{"description":"Use `defaultScope` property instead."}]},"isRestricted":{"allOf":[{"$ref":"#/components/schemas/IsRestrictedScope"},{"deprecated":true},{"description":"Use `isRestrictedScope` property instead."}]}}},"TrustedDomainsRequestItem":{"type":"string","description":"URI for a Trusted Domain.\n\nA Trusted Domain must conform to the follow validation rules:\n  * entries must include a domain name (e.g. example.com)\n  * no longer than 2048 characters\n  * use correct URI format\n  * IPv4 addresses are permitted (e.g. 192.168.1.1 or 192.168.1.1:1080)\n  * protocol is optional (e.g. https://example.com)\n  * port is optional (e.g. example.com:1080)\n"},"TrustedDomainsRequest":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/TrustedDomainsRequestItem"},"minItems":1,"maxItems":10,"example":["https://www.example.com:1080","www.example.com"]}}},"TrustedDomainError":{"type":"object","required":["trustedDomain","status"],"properties":{"trustedDomain":{"type":"string","example":"https://www.example.com","description":"A Trusted Domain URI."},"status":{"type":"integer","example":400367,"description":"204 if successfully added/deleted, else a Here Account error code."}}},"TrustedDomainPartialSuccessResponse":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/TrustedDomainError"}}},"example":{"total":2,"pageToken":"7afd7f8e94eb4844ba45","limit":1,"items":[{"trustedDomain":"https://www.example.com","status":204}]}}]},"TrustedDomainPageWToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"type":"string","example":"https://www.example.com","description":"A Trusted Domain URI."}}},"example":{"total":5,"pageToken":"7afd7f8e94eb4844ba45","limit":2,"items":["https://www.example.com","127.0.0.1"]}}]},"GetEnableTrustedDomainsResponse":{"type":"object","required":["trustedDomainsEnabled"],"properties":{"trustedDomainsEnabled":{"type":"boolean","example":true,"description":"If Trusted Domains are enabled for the App."}}},"PlatformServiceTermsResponse":{"type":"object","required":["link","effectiveDate","acceptDueDate"],"properties":{"link":{"type":"string","description":"URL of Platform Service Terms after redirections to a fully resolved URL.","example":"https://legal.here.com/en-gb/terms-2015"},"effectiveDate":{"type":"string","description":"Date Platform Service Terms goes live, in \"yyyy-MM-dd\" format.","example":"2021-05-10"},"acceptDueDate":{"type":"string","description":"Data Platform Service Terms should be accepted by in \"yyyy-MM-dd\" format.","example":"2021-06-10"}}},"AcceptPlatformServiceTermsResponse":{"type":"object","required":["acceptedByIdentity","acceptedTime","termsReacceptanceRequired","acceptServiceTermsAllowed"],"properties":{"acceptedByName":{"type":"string","description":"User's name.","example":"Jack Sparrow"},"acceptedByEmail":{"type":"string","description":"User's email.","example":"jsparrow@example.com"},"acceptedByIdentity":{"type":"string","description":"The principal (user or app) who accepted the realm terms.","example":"hrn:here:account::olp-here:app/jergfg2ejkvnvnkjfjh47i"},"acceptedTime":{"type":"string","description":"Time of acceptance.","example":"2021-05-17T02:24:00.000Z"},"ipAddress":{"type":"string","description":"IP address","example":"192.168.0.2"},"linkToAcceptedTerms":{"type":"string","description":"URL of Platform Service Terms. This will be unavailable if the realm has an offline contract signed.","example":"https://legal.here.com/en-gb/terms-2015"},"acceptedEffectiveDate":{"type":"string","description":"Platform Service Terms version at time of acceptance. This will be unavailable if the realm has an offline contract signed.","example":"2021-05-10"},"termsReacceptanceRequired":{"type":"boolean","description":"Whether the termsAcceptanceRequired User Experience must be shown","example":false},"acceptServiceTermsAllowed":{"type":"boolean","description":"Whether the principle has the necessary permission for the realm.","example":true},"offlineContractAcceptance":{"type":"boolean","description":"Whether the realm has an offline contract signed.","example":false},"externalEulaAcceptance":{"type":"boolean","description":"True if registration channel required EULA acceptance, false otherwise. External EULA acceptance means\nthat this realm doesn't require platform terms acceptance (for example: realm with 'aws' channel).\n","example":false}}},"AcceptPlatformPricingTermsResponse":{"type":"object","required":["acceptedByIdentity","acceptedTime"],"properties":{"acceptedByName":{"type":"string","description":"User's name.","example":"Jack Sparrow"},"acceptedByEmail":{"type":"string","description":"User's email.","example":"jsparrow@example.com"},"acceptedByIdentity":{"type":"string","description":"The principal (user or app) who accepted the platform pricing terms for this realm.","example":"hrn:here:account::myrealm:user/HERE-e1e824d6-f3ba-4a8f-b1d6-6991ccd89b62"},"acceptedTime":{"type":"string","description":"Time of acceptance.","example":"2021-05-17T02:24:00.000Z"},"ipAddress":{"type":"string","description":"IP address","example":"192.168.0.2"}}},"AcceptPlatformServiceTermsHistory":{"type":"object","required":["acceptedByIdentity","acceptedTime"],"properties":{"acceptedByName":{"type":"string","description":"User's name.","example":"Jack Sparrow"},"acceptedByEmail":{"type":"string","description":"User's email.","example":"jsparrow@example.com"},"acceptedTime":{"type":"string","description":"Time of acceptance.","example":"2021-05-17T02:24:00.000Z"},"ipAddress":{"type":"string","description":"IP address","example":"192.168.0.2"},"linkToAcceptedTerms":{"type":"string","description":"URL of Platform Service Terms. This will be unavailable if the realm has an offline contract signed or the realm channel is 'aws'.","example":"https://legal.here.com/en-gb/terms-2015"},"acceptedEffectiveDate":{"type":"string","description":"Platform Service Terms version at time of acceptance. This will be unavailable if the realm has an offline contract signed or the realm channel is 'aws'.","example":"2021-05-10"},"offlineContractAcceptance":{"type":"boolean","description":"Whether the realm has an offline contract signed.","example":false},"externalEulaAcceptance":{"type":"boolean","description":"True if registration channel required EULA acceptance, false otherwise. External EULA acceptance means\nthat this realm doesn't require platform terms acceptance (for example: realm with 'aws' channel).\n","example":false}}},"AcceptPlatformServiceTermsPageWToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/AcceptPlatformServiceTermsHistory"}}},"example":{"total":2,"pageToken":"7afd7f8e94eb4844ba45","limit":1,"items":[{"acceptedByName":"Jack Sparrow","acceptedByEmail":"jsparrow@example.com","acceptedTime":"2021-05-17T02:24:00.000Z","ipAddress":"192.168.0.2","linkToAcceptedTerms":"https://legal.here.com/en-gb/terms-2015","acceptedEffectiveDate":"2021-05-10","offlineContractAcceptance":false}]}}]},"SupportAccess":{"type":"object","properties":{"hrn":{"type":"string","description":"HRN of the registered support access entry","example":"hrn:here:account::rlm12345:support/SUPPORT-c57f1bd6-d4aa-11ed-afa1-0242ac120002"},"authorizedUsers":{"type":"array","items":{"type":"object","properties":{"emailAddress":{"type":"string","description":"Email address of user authorized for support access in this realm or '*' to represent any @here.com email address.","example":"john.doe@here.com"},"expiresAt":{"type":"string","description":"Time that this user's access expires","format":"date-time","example":"2023-01-21T17:32:28Z"}}},"description":"List of users authorized for support access in this realm","maxItems":6}}},"SupportAccessUserRequest":{"type":"object","required":["emailAddress"],"properties":{"emailAddress":{"type":"string","description":"Email address of user being authorized for support access in this realm.  Must end in @here.com or equal '*' to represent any @here.com email address.","example":"john.doe@here.com"},"expiresAt":{"type":"string","description":"Time that this user's access expires. Must be in yyyy-MM-ddTHH:mm:ss(.NNN)Z format. If omitted, this user's access does not expire.","format":"date-time","example":"2023-01-21T17:32:28.152Z"}}}},"responses":{"Unauthorized":{"description":"Access is denied due to invalid credentials","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"},"WWW-Authenticate":{"$ref":"#/components/headers/WWWAuthenticate"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error401Response"}}}},"Forbidden":{"description":"You do not have permission to perform this action","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error403Response"}}}},"NotFound":{"description":"The requested resource was not found, see error response for details","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenericError404Response"}}}},"BadRequest":{"description":"Invalid input provided, see error response for details","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"TooManyRequests":{"description":"User or Client has sent too many requests in a given amount of time (\"rate limiting\")., see error response for details","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"NoContent":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"Conflict":{"description":"There was a conflict, see error response for details","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"paths":{"/apps":{"parameters":[{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"get":{"parameters":[{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/PageToken"},{"$ref":"#/components/parameters/ActionParam"}],"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Management"],"summary":"Get Applications","description":"List applications over which the calling party OR one of the groups the calling party is a member of has an exact match permission on as defined below.\n\nExact match permissions include: service = **\"account\"** and action = **\"read\"**, **\"write\"**, or **\"manage\"** and service = **\"authorization\"** and action = **\"share\"**.\n\n</br>Access Control:\n  * The calling principal MUST NOT include a project scope.\n","operationId":"listApplications","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}},"post":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Management"],"summary":"Create Application","description":"Create a new application.\n* A new app will be created and a clientId will be automatically generated and assigned to it.\n* The application will be created in the same realm the user/app belongs to. This information is obtained from the User/Client Access Token.\n* The user/app creating the app will be granted permission to 'manage' and delegate application management ('share'). This user/app can now delegate access to the application in more granular fashion (all sharable actions - read, write, manage, share) to another identity in his realm via the share/grants APIs.\n* The app created by an app will inherit the creator user id of the caller app. The creator user id does not get permissions to the new app.\n\n* Any authenticated user has access to create an application.\n* Any authenticated app that has the 'appCreationEnabled' property enabled by any of its managers has access to create an application.\n\n</br>Access Control:\n  * The calling principal must be in a realm of type **\"olp\"**.\n  * The calling principal must have **\"createApp\"** action permission in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"createApplication","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAppRequest"},"example":{"name":"My Application","description":"This is a description of My Application"}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/App"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}}},"/apps/{app}":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"get":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Management"],"summary":"Get Application","description":"Retrieve the application identified by the provided HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getApplication","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/App"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"patch":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Management"],"summary":"Update Application","description":"Update the application identified by the provided HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"updateApplication","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PatchAppRequest"},"example":{"name":"My Updated Application","description":"This is a new description of My Application","deviceTokenCreationEnabled":true,"deviceApiCallRateLimitPer15Minutes":10}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/App"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"delete":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Management"],"summary":"Delete Application","description":"Delete the application identified by the provided HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"deleteApplication","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/apps/{app}/accessKeys":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"post":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Access Key Management"],"summary":"Create Access Key","description":"Create a new access key for the requested application.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"createAccessKey","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAccessKeyResponse"}},"text/plain":{"schema":{"$ref":"#/components/schemas/CreateAccessKeyResponse"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"get":{"parameters":[{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/PageToken"}],"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Access Key Management"],"summary":"Get Access Keys","description":"Retrieve the list of access keys associated with the requested application.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getAccessKeys","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessKeyPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/apps/{app}/accessKeys/{accessKey}":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/AccessKey"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"delete":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Access Key Management"],"summary":"Delete Access Key","description":"Delete the requested access key for the requested application.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"deleteAccessKey","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/apps/{app}/accessKeys/{accessKey}/enable":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/AccessKey"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"post":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Access Key Management"],"summary":"Enable Access Key","description":"Enable the requested access key for the given application.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"enableAccessKey","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/apps/{app}/accessKeys/{accessKey}/disable":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/AccessKey"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"post":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Access Key Management"],"summary":"Disable Access Key","description":"Disable the requested access key for the given application.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"disableAccessKey","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/apps/{app}/defaultScope":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"get":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Management"],"summary":"Get application default scope","description":"Get the default scope for the application identified by the provided HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"read\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n","operationId":"getApplicationDefaultScope","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppDefaultScopeResponse"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"put":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Management"],"summary":"Create or update application default scope","description":"Create or update the default scope for the application identified by the provided HRN.\n\nApplication Default Scope Management APIs enabled authorized identities to manage the the default scope for a given application.\nThe default scope represents the default value for the \"scope\" parameter when requesting a client_credentials OAuth2 token if no\n\"scope\" parameter is specified. If a \"scope\" parameter is specified when requesting a client_credentials OAuth2 token, the default\nscope value will be disregarded.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n","operationId":"setApplicationDefaultScope","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppDefaultScope"}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppDefaultScopeResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"delete":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Management"],"summary":"Delete application default scope","description":"Delete the default scope for the application identified by the provided HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"deleteApplicationDefaultScope","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/apps/{app}/appCreationEnabled":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"get":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Management"],"summary":"Verify the app's ability to create another app.","description":"Verify if the property \"appCreationEnabled\" for the application is enabled.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getAppCreationEnabled","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"put":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Management"],"summary":"Enables the app's ability to create another app.","description":"Enable the property \"appCreationEnabled\" for the application.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"enableAppCreation","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"delete":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Application Management"],"summary":"Disables the app's ability to create another app.","description":"Disable the property \"appCreationEnabled\" for the application.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"disableAppCreation","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/users/{user}/activate":{"parameters":[{"$ref":"#/components/parameters/User"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"post":{"security":[{"UserOrClientBearerToken":[]}],"tags":["User Account Management"],"summary":"Activate User Account","description":"Activate the provided user account.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{user}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"activateUserAccount","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/users/{user}/deactivate":{"parameters":[{"$ref":"#/components/parameters/User"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"post":{"security":[{"UserOrClientBearerToken":[]}],"tags":["User Account Management"],"summary":"Deactivate User Account","description":"Deactivate the provided user account. All access tokens will be invalidated.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{user}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"deactivateUserAccount","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/users/{user}":{"parameters":[{"$ref":"#/components/parameters/User"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"delete":{"security":[{"UserOrClientBearerToken":[]}],"tags":["User Account Management"],"summary":"Delete User Account","description":"Delete the provided user account.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{user}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"deleteUserAccount","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/users/{user}/apps":{"parameters":[{"$ref":"#/components/parameters/User"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"get":{"security":[{"UserOrClientBearerToken":[]}],"parameters":[{"$ref":"#/components/parameters/Action"},{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/PageToken"}],"tags":["User Account Management"],"summary":"Get Accessible Applications of a User","description":"List the applications which the provided user has been assigned an exact matching permission over OR a group the provided user is a member of has been assigned an exact match permission.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{user}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getUserManagedApps","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/apps/{app}/apiKeys":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"post":{"tags":["API Key Management"],"summary":"Generate API Key","operationId":"generateAPIKey","description":"This generates a new API key that you use for authenticating an application. Note that the API key is contained in the field named `apiKeyId`. \nThe value in the field `apiKey` is the HERE Resource Name (HRN) prefixed with “hrn\" followed by the API key, and is not usable as an API key in the request. \nA maximum of two API keys can be maintained per application.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIKeyGenerateRequest"}}}},"responses":{"201":{"description":"Created","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKey"}}}},"400":{"description":"* 400337 - API Key cannot be generated for client with issuer(s).\n"},"401":{"description":"* 401300 - Access is denied due to invalid credentials.\n"},"404":{"description":"* 404660 - No app exists with the given id.\n"},"409":{"description":"* 409303 - Reached allowed maximum number of active API keys per application. Delete an API key to generate another one.\n"},"429":{"description":"* 429003 - Request blocked because of too many requests made. Wait for a while before making a new request.\n"}}},"get":{"parameters":[{"$ref":"#/components/parameters/PageToken"},{"$ref":"#/components/parameters/Limit"}],"tags":["API Key Management"],"summary":"Get API Keys","operationId":"getAPIKeys","description":"Lists the API keys generated for an application.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKeyPageWToken"}}}},"404":{"description":"* 404660 - No app exists with the given id.\n"},"429":{"description":"* 429003 - Request blocked because of too many requests made. Wait for a while before making a new request.\n"}}}},"/apps/{app}/apiKeys/{apiKey}":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/ApiKey"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"delete":{"tags":["API Key Management"],"summary":"Delete API Key","operationId":"deleteAPIKey","description":"Deletes API key of the application. This API key can no longer be used for authentication or authorization.\n\nSince API key cannot be recovered once deleted, it is recommended that the client application calling this\nend-point should enforce a confirmation of delete action (Example: Confirm box saying: Are you sure you want to delete this API Key?).\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"* 401300 - Access is denied due to invalid credentials.\n"},"404":{"description":"* 404660 - No app exists with the given id.\n* 404666 - The API key does not exist.\n"},"429":{"description":"* 429003 - Request blocked because of too many requests made. Wait for a while before making a new request.\n"}}},"get":{"tags":["API Key Management"],"summary":"Retrieve API Key by user","operationId":"getAPIKeyByUser","description":"Retrieves API key of the application.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKey"}}}},"401":{"description":"* 401300 - Access is denied due to invalid credentials.\n"},"404":{"description":"* 404660 - No app exists with the given id.\n* 404666 - The API key does not exist\n"},"429":{"description":"* 429003 - Request blocked because of too many requests made. Wait for a while before making a new request.\n"}}},"patch":{"tags":["API Key Management"],"summary":"Update API Key","operationId":"updateAPIKey","description":"Updates API key of the application.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIKeyUpdateRequest"}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKey"}}}},"401":{"description":"* 401300 - Access is denied due to invalid credentials.\n"},"404":{"description":"* 404660 - No app exists with the given id.\n* 404666 - The API key does not exist.\n"},"429":{"description":"* 429003 - Request blocked because of too many requests made. Wait for a while before making a new request.\n"}}}},"/apps/{app}/apiKeys/{apiKey}/enable":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/ApiKey"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"post":{"security":[{"UserOrClientBearerToken":[]}],"tags":["API Key Management"],"summary":"Enable API Key","description":"Enables API key of the application.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"enableAPIKey","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"* 401300 - Access is denied due to invalid credentials.\n"},"404":{"description":"* 404660 - No app exists with the given id.\n* 404666 - The API key does not exist.\n"},"429":{"description":"* 429003 - Request blocked because of too many requests made. Wait for a while before making a new request.\n"}}}},"/apps/{app}/apiKeys/{apiKey}/disable":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/ApiKey"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"post":{"security":[{"UserOrClientBearerToken":[]}],"tags":["API Key Management"],"summary":"Disable API Key","description":"Disables API key of the application.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"disableAPIKey","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"* 401300 - Access is denied due to invalid credentials.\n"},"404":{"description":"* 404660 - No app exists with the given id.\n* 404666 - The API key does not exist.\n"},"429":{"description":"* 429003 - Request blocked because of too many requests made. Wait for a while before making a new request.\n"}}}},"/apps/{app}/appCode":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"get":{"deprecated":true,"tags":["App Code Management"],"summary":"Get App Code","operationId":"getAppCode","description":"Get the App Code configured for an application.\nApp Codes are deprecated and in a read-only state.\nAn App can either have 0 or 1 App Code, depending whether they have appCodeEnabled or not.\nTo retrieve the appCode via this endpoint the App needs to have appCodeEnabled=true and appCodeVisible=true.\n\n</br>\nAn App Code can be used with certain classic HLS Services that still support app_id and app_code values\nin the query string for authentication.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppCode"}}}},"404":{"description":"* E202404 - No app exists with the given id.\n"},"409":{"description":"* E202102 - The specified App does not support App Codes.\n"},"429":{"description":"* E202429 - Request blocked because of too many requests made. Wait for a while before making a new request.\n"}}}},"/apps/{app}/trustedDomainsEnabled":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"put":{"tags":["Trusted Domain Management"],"summary":"Enable Trusted Domains for an application","operationId":"enableTrustedDomains","description":"Enables Trusted Domains for the application. A maximum of 3000 Trusted Domains per application are allowed.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"* 400288 - Invalid app HRN.\n"},"404":{"description":"* 404660 - No app exists with the given HRN.\n"}}},"delete":{"tags":["Trusted Domain Management"],"summary":"Disable Trusted Domains for an application","operationId":"disableTrustedDomains","description":"Disables Trusted Domains for the application.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"* 400288 - Invalid app HRN.\n"},"404":{"description":"* 404660 - No app exists with the given HRN.\n"}}},"get":{"tags":["Trusted Domain Management"],"summary":"Retrieve whether Trusted Domains is enabled/disabled for an application","operationId":"getTrustedDomainsEnabled","description":"Whether Trusted Domains is enabled, or disabled, for the application.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetEnableTrustedDomainsResponse"}}}},"400":{"description":"* 400288 - Invalid app HRN.\n"},"404":{"description":"* 404660 - No app exists with the given HRN.\n"}}}},"/apps/{app}/trustedDomains/{trustedDomainUri}":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/TrustedDomainUri"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"put":{"tags":["Trusted Domain Management"],"summary":"Add a Trusted Domain to an application","operationId":"addTrustedDomain","description":"Add a Trusted Domain to an application. A maximum of 3000 Trusted Domains per application are allowed.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"* 400288 - Invalid app HRN.\n* 400203 - Invalid Trusted Domain URI.\n* 400368 - Trusted Domain URI too long.\n"},"404":{"description":"* 404660 - No app exists with the given HRN.\n"},"422":{"description":"* 422000 - Maximum number of Trusted Domains reached\n"},"429":{"description":"* 429003 - Request blocked because of too many Trusted Domains being added or deleted. Wait for a while before retrying the request.\n"}}},"get":{"tags":["Trusted Domain Management"],"summary":"Retrieve a Trusted Domain associated with an application","operationId":"getTrustedDomain","description":"Retrieve a Trusted Domain associated with an application.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"* 400288 - Invalid app HRN.\n* 400203 - Invalid Trusted Domain URI.\n* 400368 - Trusted Domain URI too long.\n"},"404":{"description":"* 404660 - No app exists with the given HRN.\n* 404922 - No Trusted Domain exists with the given URI.\n"}}},"delete":{"tags":["Trusted Domain Management"],"summary":"Delete a Trusted Domain associated with an application","operationId":"deleteTrustedDomain","description":"Delete a Trusted Domain associated with an application.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"* 400288 - Invalid app HRN.\n* 400203 - Invalid Trusted Domain URI.\n* 400368 - Trusted Domain URI too long.\n"},"404":{"description":"* 404660 - No app exists with the given HRN.\n* 404922 - No Trusted Domain exists with the given URI.\n"}}}},"/apps/{app}/trustedDomains":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"post":{"tags":["Trusted Domain Management"],"summary":"Add multiple Trusted Domains to an application","operationId":"addManyTrustedDomains","description":"Add Trusted Domains to an application. A maximum of 3000 Trusted Domains per application are allowed.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TrustedDomainsRequest"}}}},"responses":{"204":{"description":"No Content. If all Trusted Domains were added.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"207":{"description":"Partial success. Response body contains additional information.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TrustedDomainPartialSuccessResponse"}}}},"400":{"description":"* 400367 - At least one of the Trusted Domain URIs is invalid.\n* 400368 - At least one of the Trusted Domain URIs too long.\n* 400288 - Invalid app HRN.\n"},"404":{"description":"* 404660 - No app exists with the given HRN.\n"},"422":{"description":"* 422000 - Maximum number of Trusted Domains reached\n"},"429":{"description":"* 429003 - Request blocked because of too many Trusted Domains being added or deleted. Wait for a while before retrying the request.\n"}}},"get":{"parameters":[{"$ref":"#/components/parameters/PageToken"},{"$ref":"#/components/parameters/Limit10"}],"tags":["Trusted Domain Management"],"summary":"Retrieve a list of Trusted Domains associated with an application","operationId":"listTrustedDomains","description":"Retrieve a list of Trusted Domains associated with an application.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TrustedDomainPageWToken"}}}},"400":{"description":"* 400288 - Invalid app HRN.\n"},"404":{"description":"* 404660 - No app exists with the given HRN.\n"}}},"delete":{"tags":["Trusted Domain Management"],"summary":"Delete multiple Trusted Domains associated with an application","operationId":"deleteManyTrustedDomains","description":"Delete many Trusted Domains associated with an application.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** or **\"write\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"parameters":[{"$ref":"#/components/parameters/ListParam"}],"responses":{"204":{"description":"No Content. If all Trusted Domains were deleted.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"207":{"description":"Partial success. Response body contains additional information.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TrustedDomainPartialSuccessResponse"}}}},"400":{"description":"* 400367 - At least one of the Trusted Domain URI is invalid.\n* 400368 - At least one of the Trusted Domain URI too long.\n* 400288 - Invalid app HRN.\n"},"404":{"description":"* 404660 - No app exists with the given HRN.\n"},"429":{"description":"* 429003 - Request blocked because of too many Trusted Domains being added or deleted. Wait for a while before retrying the request.\n"}}}},"/secrets":{"parameters":[{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"post":{"tags":["Secret Management"],"summary":"Create Secret","operationId":"createSecret","description":"Creates a new Secret for use in Platform runtimes.\nThe Secret will be enabled on creation.\nA maximum of 5 Secrets are maintained per User or App at any given point.\nA Secret can be used to store third-party credentials for use in Platform runtimes.\n\n<br/>\nAssigns \"read\", \"manage\", \"addGrant:read\", and \"addGrant:manage\" rights to the caller.\nThe calling User or App can now delegate access to the Secret in more granular fashion,\nusing 'read' or 'manage' to another identity in its Realm using the grants APIs.\nFor secure Production systems, HERE recommends creating a delegate App in your Realm,\ngranting only the 'read' permission to that App via the 'grantReadTo' query string parameter,\nand using that App as RunAsId in your Platform runtime.\n\n</br>Access Control:\n  * The calling principal must be in a realm of type **\"olp\"**.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"parameters":[{"in":"query","name":"grantReadTo","schema":{"type":"string"},"required":false,"description":"HRN of the identity to whom to also grant read access.\nFor a secure production system using Application delegates, this is a convenience API that can be used to\ncreate a Secret and grant read access in one step.\nWhen used with a delegate App and the RunAsId feature, the target App's background runtimes will\nreceive the decoded secret in a file.\n\n</br>You can also omit this parameter, and optionally invoke the Grants API at a later time, to achieve\nthe same effect.\n","example":"hrn:here:account::myrealm:app/CUtxqFuI0bprujcvO3h8"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSecretRequest"}}}},"responses":{"201":{"description":"Created","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}}},"400":{"description":"* E110100 - Secret cannot be stored based on client input.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"* E110001 - Unauthorized due to invalid credentials.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"* E110102 - No app exists with the specified HRN.\n* E110106 - No user exists with the specified HRN.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"409":{"description":"* E110002 - Reached allowed maximum number of Secrets per user or app. Delete a Secret to store another one.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"429":{"description":"* E110003 - Request blocked because of too many requests made. Wait for a while before making a new request.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"get":{"parameters":[{"$ref":"#/components/parameters/PageToken"},{"$ref":"#/components/parameters/Limit"}],"tags":["Secret Management"],"summary":"List Secrets","operationId":"listSecrets","description":"Lists the secrets stored for the calling user or app.\n\n</br>Access Control:\n  * The calling principal must be in a realm of type **\"olp\"**.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SecretPageWToken"}}}},"401":{"description":"* E110001 - Unauthorized due to invalid credentials.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"429":{"description":"* E110003 - Request blocked because of too many requests made. Wait for a while before making a new request.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}},"/secrets/{secret}":{"parameters":[{"$ref":"#/components/parameters/Secret"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"get":{"tags":["Secret Management"],"summary":"Retrieve Secret","operationId":"getSecret","description":"Retrieves the specified Secret.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{secret}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}}},"401":{"description":"* E110001 - Unauthorized due to invalid credentials.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"* E110103 - The secret does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"429":{"description":"* E110003 - Request blocked because of too many requests made. Wait for a while before making a new request.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"patch":{"tags":["Secret Management"],"summary":"Update Secret","operationId":"updateSecret","description":"Updates a Secret.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{secret}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateSecretRequest"}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Secret"}}}},"401":{"description":"* E110001 - Unauthorized due to invalid credentials.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"* E110103 - The Secret does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"429":{"description":"* E110003 - Request blocked because of too many requests made. Wait for a while before making a new request.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"delete":{"tags":["Secret Management"],"summary":"Delete Secret","operationId":"deleteSecret","description":"Deletes the Secret. This Secret is no longer available for authentication or authorization.\n\nSince the Secret cannot be recovered once deleted, it is recommended that the caller of this\nend-point should enforce a confirmation of delete action (Example: Confirm box saying: Are you sure you want to\ndelete this Secret?).\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{secret}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"UserOrClientBearerToken":[]}],"responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"* E110001 - Unauthorized due to invalid credentials.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"* E110103 - The Secret does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"429":{"description":"* E110003 - Request blocked because of too many requests made. Wait for a while before making a new request.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}},"/secrets/{secret}/enable":{"parameters":[{"$ref":"#/components/parameters/Secret"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"post":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Secret Management"],"summary":"Enable Secret","description":"Enables the Secret.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{secret}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"enableSecret","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"* E110001 - Unauthorized due to invalid credentials.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"* E110103 - The Secret does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"429":{"description":"* E110003 - Request blocked because of too many requests made. Wait for a while before making a new request.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}},"/secrets/{secret}/disable":{"parameters":[{"$ref":"#/components/parameters/Secret"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"post":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Secret Management"],"summary":"Disable Secret","description":"Disables the Secret.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{secret}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"disableSecret","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"* E110001 - Unauthorized due to invalid credentials.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"* E110103 - The Secret does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"429":{"description":"* E110003 - Request blocked because of too many requests made. Wait for a while before making a new request.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}},"/serviceTerms":{"get":{"summary":"Retrieve Platform Service Terms","description":"Retrieves the Platform Service Terms. The response of this API endpoint may not be applicable to the realms with offline contract signed.","operationId":"getPlatformServiceTerms","tags":["Platform Service Terms"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlatformServiceTermsResponse"}}}}}}},"/realms/{realmHrnOrMe}/serviceTermsAcceptance":{"post":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Platform Service Terms"],"description":"Accept the Platform Service Terms.\n\n</br>Access Control:\n  * The calling principal must have either **\"realmAcceptServiceTerms\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"acceptRealmPlatformServiceTerms","parameters":[{"$ref":"#/components/parameters/RealmHrnOrMe"}],"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptPlatformServiceTermsResponse"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"An error has occurred.\n* 400361: Realm of the resource does not match the realm of the caller.\n"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"An error has occurred.\n* 404800: Realm not found.\n"}}},"get":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Platform Service Terms"],"description":"Get the realm's Platform Service Terms.\n\n</br>Access Control:\n  * The calling principal must have **\"realmAcceptServiceTerms\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getRealmPlatformServiceTerms","parameters":[{"$ref":"#/components/parameters/RealmHrnOrMe"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptPlatformServiceTermsResponse"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"An error has occurred.\n* 400361: Realm of the resource does not match the realm of the caller.\n"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"An error has occurred.\n* 404800: Realm not found.\n"}}}},"/realms/{realmHrnOrMe}/pricingTermsAcceptance":{"post":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Platform Pricing Terms"],"description":"Accept the Platform Pricing Terms.\n\n</br>Access Control:\n* The calling principal must have **\"realmAcceptServiceTerms\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"acceptRealmPlatformPricingTerms","parameters":[{"$ref":"#/components/parameters/RealmHrnOrMe"},{"$ref":"#/components/parameters/XRequestId"},{"$ref":"#/components/parameters/XCorrelationId"}],"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptPlatformPricingTermsResponse"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/Conflict"}}},"get":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Platform Pricing Terms"],"description":"Get the organization's Pricing Terms acceptance details.\n\n</br>Access Control:\n  * The calling principal must have either **\"readServiceTerms\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getRealmPlatformPricingTerms","parameters":[{"$ref":"#/components/parameters/RealmHrnOrMe"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptPlatformPricingTermsResponse"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realmHrn}/serviceTermsAcceptanceHistory":{"get":{"security":[{"UserOrClientBearerToken":[]}],"tags":["Platform Service Terms"],"description":"Get the realm's Platform Service Terms history.\n\n</br>Access Control:\n  * The calling principal must have either **\"readServiceTerms\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getRealmPlatformServiceTermsHistory","parameters":[{"$ref":"#/components/parameters/RealmHrn"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptPlatformServiceTermsPageWToken"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"An error has occurred.\n* 400361: Realm of the resource does not match the realm of the caller.\n"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"An error has occurred.\n* 404800: Realm not found.\n* 404923: Realm Platform Service Terms have not been accepted.\n"}}}},"/realms/{realm}/identityProviders":{"parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/XRequestId"},{"$ref":"#/components/parameters/XCorrelationId"}],"post":{"tags":["Manage Identity Providers for a Realm"],"summary":"Add a new trusted OpenID Connect Identity Provider to a Realm","operationId":"addIdentityProvider","description":"Add a new trusted Identity Provider to a Realm.  \nCurrently, only OAuth 2.0/OpenID Connect Providers can be used.\n\n**NOTE:** You can create a maximum of 5 Identity Providers in a Realm.\n\n</br>Access Control:\n  * The calling principal must have either **\"manageIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AddIdentityProviderRequest"},"example":{"id":"example-op","name":"Example OP","issuers":[{"issuer":"https://op.example.com"}],"accountType":"device"}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdentityProvider"},"example":{"id":"example-op","name":"Example OP","hrn":"hrn:here:account::org123456789:identityProviders/example-op","issuers":[{"issuer":"https://op.example.com","enabled":true}],"accountType":"device","realm":"hrn:here:account::org123456789:realm/org123456789","created":"2023-01-21T17:32:28Z"}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing or invalid Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required \"manageIdentityProviders\" access to the Realm.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"422":{"description":"An error has occurred.\n* E110000 - Maximum number of Identity Providers exceeded for the Realm.  The maximum is 10.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]},"get":{"tags":["Manage Identity Providers for a Realm"],"summary":"List trusted OpenID Connect Identity Providers for a Realm","operationId":"listIdentityProviders","description":"List trusted OpenID Connect Providers for a Realm.\n\n</br>Access Control:\n  * The calling principal must have either **\"readIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","parameters":[{"$ref":"#/components/parameters/PageToken"},{"$ref":"#/components/parameters/Limit"}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdentityProviderList"},"example":{"count":1,"total":1,"items":[{"id":"example-op","hrn":"hrn:here:account::org123456789:identityProviders/example-op","name":"Example OP","description":"Use the Example OP when integrating new cars.","accountType":"device","realm":"hrn:here:account::org123456789:realm/org123456789","created":"2023-01-21T17:32:28Z","issuers":[{"issuer":"https://op.example.com","enabled":true}]}]}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing or invalid Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required \"readIdentityProviders\" access to the Realm.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]}},"/realms/{realm}/identityProviders/{identityProvider}":{"parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/IdentityProvider"},{"$ref":"#/components/parameters/XRequestId"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Manage Identity Providers for a Realm"],"summary":"Get a trusted Identity Provider for a Realm","operationId":"getIdentityProvider","description":"Get a trusted Identity Provider for a Realm.  \n\n</br>Access Control:\n  * The calling principal must have either **\"readIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdentityProvider"},"example":{"id":"example-op","hrn":"hrn:here:account::org123456789:identityProviders/example-op","name":"Example OP","description":"Use the Example OP when integrating new cars.","accountType":"device","realm":"hrn:here:account::org123456789:realm/org123456789","created":"2023-01-21T17:32:28Z"}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing or invalid Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required \"readIdentityProviders\" access to the Realm.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"404":{"description":"An error has occurred.\n* E110000 - The requested Realm or IdentityProvider does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]},"patch":{"tags":["Manage Identity Providers for a Realm"],"summary":"Update a trusted Identity Provider for a Realm","operationId":"updateIdentityProvider","description":"Update a trusted Identity Provider for a Realm.\n\n</br>Access Control:\n  * The calling principal must have either **\"manageIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateIdentityProviderRequest"},"example":{"name":"Updated OP","description":"Update to the Example OP when integrating new cars."}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdentityProvider"},"example":{"id":"example-op","hrn":"hrn:here:account::org123456789:identityProviders/example-op","name":"Updated OP","description":"Update to the Example OP when integrating new cars.","accountType":"device","realm":"hrn:here:account::org123456789:realm/org123456789","created":"2023-01-21T17:32:28Z"}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing or invalid Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required \"manage\" access to the Realm.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]},"delete":{"tags":["Manage Identity Providers for a Realm"],"summary":"Delete a trusted Identity Provider for a Realm","operationId":"deleteIdentityProvider","description":"Delete a trusted Identity Provider for a Realm.\n\n</br>Access Control:\n  * The calling principal must have either **\"manageIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing or invalid Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required \"manageIdentityProviders\" access to the Realm.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"404":{"description":"An error has occurred.\n* E110000 - The requested Realm or IdentityProvider does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"409":{"description":"An error has occurred.\n* E110000 - The specified Identity Provider still has Apps attached to it.  \n    See [List Apps for an Identity Provider](#/List%20Apps%20for%20an%20Identity%20Provider) for more details.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]}},"/realms/{realm}/identityProviders/{identityProvider}/issuers":{"parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/IdentityProvider"},{"$ref":"#/components/parameters/XRequestId"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/PageToken"},{"$ref":"#/components/parameters/Limit"}],"get":{"tags":["Manage Identity Providers for a Realm"],"summary":"List Issuers for an Identity Provider","operationId":"listIdentityProviderIssuerAttachments","description":"Get a list of Issuers for an Identity Provider.\n\n</br>Access Control:\n  * The calling principal must have either **\"readIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdentityProviderIssuerAttachmentList"},"example":{"count":1,"total":1,"items":[{"identityProvider":"hrn:here:account::org123456789:identityProviders/example-op","issuer":"https://op.example.com","enabled":true}]}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required *\"readIdentityProviders\"* access to the *realm*.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"404":{"description":"An error has occurred.\n* E110000 - The requested Issuer Attachment and/or Identity Provider does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]}},"/realms/{realm}/identityProviders/{identityProvider}/issuers/{issuer}":{"parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/IdentityProvider"},{"$ref":"#/components/parameters/Issuer"},{"$ref":"#/components/parameters/XRequestId"},{"$ref":"#/components/parameters/XCorrelationId"}],"post":{"tags":["Manage Identity Providers for a Realm"],"summary":"Attach an Issuer URL to an Identity Provider","operationId":"createIdentityProviderIssuerAttachment","description":"Attach a new Issuer URL to an Identity Provider.\n\n**NOTE:** The maximum number of Issuers for an Identity Provider is 2.\n\n</br>Access Control:\n  * The calling principal must have either **\"manageIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateIdentityProviderIssuerAttachment"},"example":{"enabled":true}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdentityProviderIssuerAttachment"},"example":{"identityProvider":"hrn:here:account::org123456789:identityProviders/example-op","issuer":"https://op.example.com","enabled":true}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n* E110000 - Maximum number of Issuers configured per IdentityProvider was exceeded.  The maximum is 2.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required *\"manageIdentityProviders\"* access to the *realm*.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]},"get":{"tags":["Manage Identity Providers for a Realm"],"summary":"Get an Issuer URL for an Identity Provider","operationId":"getIdentityProviderIssuerAttachment","description":"Get an Issuer URL to an Identity Provider.\n\n**NOTE:** The maximum number of Issuers for an Identity Provider is 2.\n\n</br>Access Control:\n  * The calling principal must have either **\"readIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdentityProviderIssuerAttachment"},"example":{"identityProvider":"hrn:here:account::org123456789:identityProviders/example-op","issuer":"https://op.example.com","enabled":true}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n* E110000 - Maximum number of Issuers configured per IdentityProvider was exceeded.  The maximum is 2.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required *\"manageIdentityProviders\"* access to the *realm*.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]},"patch":{"tags":["Manage Identity Providers for a Realm"],"summary":"Update an Issuer for an App","operationId":"updateIdentityProviderIssuerAttachment","description":"Update an Issuer for an Identity Provider.\n\n</br>Access Control:\n  * The calling principal must have either **\"manageIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateIdentityProviderIssuerAttachmentRequest"},"example":{"enabled":true}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdentityProviderIssuerAttachment"},"example":{"identityProvider":"hrn:here:account::org123456789:identityProviders/example-op","issuer":"https://op.example.com","enabled":true}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required *\"manageIdentityProviders\"* access to the *realm*.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]},"delete":{"tags":["Manage Identity Providers for a Realm"],"summary":"Detach an Issuer from an Identity Provider","operationId":"deleteIdentityProviderIssuerAttachment","description":"Detaches an Issuer from an Identity Provider.\n\n</br>Access Control:\n  * The calling principal must have either **\"manageIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required *\"manageIdentityProviders\"* access to the *realm*.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"404":{"description":"An error has occurred.\n* E110000 - The requested Identity Provider and/or Identity Provider Issuer Attachment does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]}},"/realms/{realm}/samlIdentityProviders":{"post":{"tags":["Manage SAML identity providers"],"summary":"Create a SAML identity provider","description":"Create an identity provider\n  * Supports the creation of SAML identity providers.\n  * Addition of identity providers will not enable them by default, it needs to be enabled explicitly.\n\n</br>Access Control:\n  * The calling principal must have **\"manageSamlIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"createIdpConfig","parameters":[{"$ref":"#/components/parameters/Realm"},{"name":"validateOnly","description":"If set to true, only metadata content will be validated and SAML identity provider creation will be skipped. By default, false.","in":"query","schema":{"type":"boolean"}},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SamlIdpConfigRequest"}}},"required":true},"responses":{"200":{"description":"Ok. When validateOnly query parameter is set to true.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SamlIdpConfigValidateOnlyResponse"}}}},"201":{"description":"Created","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SamlIdpConfigResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"get":{"tags":["Manage SAML identity providers"],"summary":"Get the list of SAML identity providers","description":"Get the list of SAML identity providers configured with the realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readSamlIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getIdpConfigs","parameters":[{"$ref":"#/components/parameters/Realm"},{"name":"enabled","description":"If true, returns only enabled SAML identity providers. If false, returns only those that are not enabled. Returns all SAML identity providers if not included in request.","in":"query","schema":{"type":"boolean"}},{"$ref":"#/components/parameters/PageToken"},{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SamlIdpConfigResponseWithPageToken"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/samlIdentityProviders/{samlIdentityProvider}/enable":{"post":{"tags":["Manage SAML identity providers"],"summary":"Enable identity provider","description":"Enables a SAML identity provider for a realm. If there is any other enabled SAML identity provider, it will be disabled. \nThe realm's login method will be changed to 'saml'. 'password' logins can also be allowed, if the 'allowPasswordLogin'\nparameter was provided.\n\n</br>Access Control:\n  * The calling principal must have **\"manageSamlIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"enableIdpConfig","parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/SamlIdentityProviderHrn"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"},{"$ref":"#/components/parameters/AllowPasswordLogin"}],"security":[{"Bearer":[]}],"responses":{"204":{"$ref":"#/components/responses/NoContent"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/samlIdentityProviders/{samlIdentityProvider}/disable":{"post":{"tags":["Manage SAML identity providers"],"summary":"Disable identity provider","description":"Disables a SAML identity provider for a realm. If no other enabled SAML identity provider exists, the realm login method will be changed to 'password'.\n\n</br>Access Control:\n  * The calling principal must have **\"manageSamlIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"disableIdpConfig","parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/SamlIdentityProviderHrn"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"responses":{"204":{"$ref":"#/components/responses/NoContent"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/samlIdentityProviders/{samlIdentityProvider}":{"get":{"tags":["Manage SAML identity providers"],"summary":"Get a SAML identity provider","description":"Get a SAML identity provider configuration for a realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readSamlIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getIdpConfig","parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/SamlIdentityProviderHrn"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SamlIdpConfigResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"patch":{"tags":["Manage SAML identity providers"],"summary":"Update SAML identity provider","description":"Update a SAML identity provider for a realm.\n\n</br>Access Control:\n  * The calling principal must have **\"manageSamlIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"updateIdpConfig","parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/SamlIdentityProviderHrn"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SamlIdpUpdateRequest"}}},"required":true},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SamlIdpConfigResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"delete":{"tags":["Manage SAML identity providers"],"summary":"Remove SAML identity provider","description":"Deletes a SAML identity provider for a realm.\n\n</br>Access Control:\n  * The calling principal must have **\"manageSamlIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"deleteIdpConfig","parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/SamlIdentityProviderHrn"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"responses":{"204":{"$ref":"#/components/responses/NoContent"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"Unable to delete, Identity provider in use.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}}}},"/samlIdentityProvidersTemplates":{"get":{"tags":["SAML Identity Provider Templates"],"summary":"List of supported SAML Identity Provider templates","description":"List of supported SAML Identity Provider templates.\n\n </br>Access Control:\n  * The calling principal must have **\"readIdpTemplates\"** action permission in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"listOfIdpTemplates","parameters":[{"$ref":"#/components/parameters/PageToken"},{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdpTemplateResponseWithPageToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}}},"/realms/{realm}/mtlsIdentityProviders":{"post":{"tags":["Manage mTLS Identity Providers"],"summary":"Create an mTLS Identity Provider","description":"Create an mTLS Identity Provider and define the Certificate Authority.</br>\n  * The provided Certificate Authority will be installed as a trusted mTLS Identity Provider and bound to the given realm\n  * A single Certificate Authority can be bound to one and only one realm at any one point in time.\n  * Certificates issued by the Certificate Authority can be used to authenticate identities in the realm via the /mtls/token endpoint\n\nCertificate Revocation:\n  * If the provided Certificate Authority contains a CRL Distribution Point URL, this URL will be used to periodically retrieve\n    revoked certificates and prevent such certificates from authenticating to the platform.\n  * If the provided Certificate Authority contains an OCSP responder URL, this URL will be used to check the status\n    of individual certificates to determine if they are revoked.\n  * The timeliness between a certificate being revoked by the Certificate Authority and the same revoked certificate\n    being denied by an mTLS Authenticator in the platform is not defined by this specification.\n\n**NOTE:** A maximum of 10 mTLS Identity Providers can be created per realm.\n\n</br>Access Control:\n  * The calling principal must have **\"manageMtlsIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"createMtlsIdentityProvider","parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MtlsCARequest"}}},"required":true},"responses":{"201":{"description":"Created","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MtlsCAResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"Unable to create, Certificate Authority already bound to another realm.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}}},"get":{"tags":["Manage mTLS Identity Providers"],"summary":"Get the list of mTLS Identity Providers","description":"Get the list of mTLS Identity Providers configured for the realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readMtlsIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getMtlsIdentityProviders","parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/PageToken"},{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MtlsCAResponseWithPageToken"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/mtlsIdentityProviders/{mtlsIdentityProvider}":{"get":{"tags":["Manage mTLS Identity Providers"],"summary":"Get an mTLS Identity Provider","description":"Get an mTLS Identity Provider configured for the realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readMtlsIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getMtlsIdentityProvider","parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/MtlsIdentityProviderHrn"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MtlsCAResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"patch":{"tags":["Manage mTLS Identity Providers"],"summary":"Update mTLS Identity Provider","description":"Update an mTLS Identity Provider configured for the realm.\n\n</br>Access Control:\n  * The calling principal must have **\"manageMtlsIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"updateMtlsIdentityProvider","parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/MtlsIdentityProviderHrn"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MtlsCARequest"}}},"required":true},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MtlsCAResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"Unable to update, Certificate Authority already bound to another realm.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}}},"delete":{"tags":["Manage mTLS Identity Providers"],"summary":"Remove mTLS Identity Provider","description":"Delete an mTLS Identity Provider configured for the realm.\n\n</br>Access Control:\n  * The calling principal must have **\"manageMtlsIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"deleteMtlsIdentityProvider","parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/MtlsIdentityProviderHrn"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"responses":{"204":{"$ref":"#/components/responses/NoContent"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"Unable to delete, Identity provider in use.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}}}},"/realms/{realm}/mtlsIdentityProviders/{mtlsIdentityProvider}/authenticators":{"get":{"tags":["Manage mTLS Identity Providers"],"summary":"List the mTLS Authenticators configured for the specified mTLS Identity Provider","description":"Get the list of mTLS Authenticators that are configured to authenticate certificates for the specified mTLS Identity Provider.</br>\n\nAn mTLS Identity Provider always has **1** mTLS Authenticator configured automatically by default:\n  * The Default Authenticator is capable of authenticating certificates issued by the Certificate Authority of the mTLS Identity Provider.\n  * The Default Authenticator maps each authenticating certificate to an identity of **accountType** __car__ in the realm\n  * The Default Authenticator uses the Subject.CN field from the certificate to identify and map to the **carId** field of the car\n  * The Default Authenticator is automatically created with a new app in the realm that is included in all access tokens provided by the authenticator\n  * The Default Authenticator is enabled by default when it is created\n  * The Default Authenticator and its corresponding app is automatically deleted when its mTLS Identity Provider is deleted\n\n</br>Access Control:\n  * The calling principal must have **\"readMtlsIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"listMtlsAuthenticatorsForIdp","parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/MtlsIdentityProviderHrn"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MtlsAuthenticatorPageWithToken"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/mtlsIdentityProviders/{mtlsIdentityProvider}/authenticators/{mtlsAuthenticator}":{"get":{"tags":["Manage mTLS Identity Providers"],"summary":"Get an mTLS Authenticator","description":"Get an mTLS Authenticator configured to authenticate certificates for the specified mTLS Identity Provider.\n\n</br>Access Control:\n  * The calling principal must have **\"readMtlsIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getMtlsAuthenticatorForIdp","parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/MtlsIdentityProviderHrn"},{"$ref":"#/components/parameters/MtlsAuthenticatorHrn"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MtlsAuthenticator"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"patch":{"tags":["Manage mTLS Identity Providers"],"summary":"Update an mTLS Authenticator","description":"Update an mTLS Authenticator configured to authenticate certificates for the specified mTLS Identity Provider.\n\n</br>Access Control:\n  * The calling principal must have **\"manageMtlsIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"updateMtlsAuthenticatorForIdp","parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/MtlsIdentityProviderHrn"},{"$ref":"#/components/parameters/MtlsAuthenticatorHrn"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MtlsAuthenticatorRequest"},"example":{"enabled":true}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MtlsAuthenticator"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/apps/{app}/mtlsAuthenticators":{"get":{"tags":["Manage mTLS Identity Providers"],"summary":"List the mTLS Authenticators configured for an App","description":"Get the list of mTLS Authenticators that the app is configured to authenticate certificates for the associated\nmTLS Identity Provider.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{app}\"** in the **\"account\"** service and **\"readMtlsIdentityProviders\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"listMtlsAuthenticatorsForApp","parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MtlsAuthenticatorPageWithToken"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/identityProviders/{identityProvider}/apps":{"parameters":[{"$ref":"#/components/parameters/Realm"},{"$ref":"#/components/parameters/IdentityProvider"},{"$ref":"#/components/parameters/XRequestId"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/PageToken"},{"$ref":"#/components/parameters/Limit"}],"get":{"tags":["List Apps for an Identity Provider"],"summary":"List the Apps which have attached the specified Identity Provider","operationId":"listAppsForProvider","description":"List the Apps that have attached the specified Identity Provider.\n\n</br>Access Control:\n  * The calling principal must have either **\"read\"** or **\"readIdentityProviders\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","parameters":[{"in":"query","required":false,"name":"fields","schema":{"type":"string"},"description":"Comma-separated list of fields to return, for each App.  \nBy default, only the App \"hrn\" is returned for each App. \nAdditional supported fields also include \"id\" and \"name\".\n","example":"hrn,id,name"}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppList"},"example":{"count":1,"total":1,"items":[{"hrn":"hrn:here:account::org123456789:app/AfRcv675i2zYubYTe17D","id":"AfRcv675i2zYubYTe17D","name":"My IdP Federation Application"}]}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing or invalid Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required \"manageIdentityProviders\" access to the Realm.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]}},"/apps/{app}/identityProviders":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/XRequestId"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Manage Identity Providers for an App"],"summary":"List trusted OpenID Connect Identity Providers for an App","operationId":"listAppIdentityProviders","description":"List trusted OpenID Connect Identity Providers for an App.\n\n</br>Access Control:\n  * The calling principal must have either **\"read\"** or **\"readIdentityProviders\"** action permission for the resource **\"{app}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","parameters":[{"$ref":"#/components/parameters/PageToken"},{"$ref":"#/components/parameters/Limit"},{"in":"query","required":false,"name":"fields","schema":{"type":"string"},"description":"Comma-separated list of fields to return, for each AppIdentityProviderAttachment.  \nBy default, the \"identityProviderHrn\", \"appHrn\", and \"enabled\" properties are returned.\nAdditional supported fields also include \"identityProviderId\", \"identityProviderName\", \n\"identityProviderDescription\", \"identityProviderAccountType\", \"identityProviderRealm\", \nand \"identityProviderIssuers\".\n","example":"identityProviderHrn,identityProviderName,appHrn,enabled"}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppIdentityProviderAttachmentList"},"example":{"count":1,"total":1,"items":[{"identityProviderHrn":"hrn:here:account::org123456789:identityProviders/example-op","identityProviderName":"Example OP","appHrn":"hrn:here:account::org123456789:app/AfRcv675i2zYubYTe17D","enabled":true}]}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required *\"read\"* access to the *app* , \nor *\"readIdentityProviders\"* access to the Realm of the App.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"404":{"description":"An error has occurred.\n* E110000 - The requested App does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]}},"/apps/{app}/identityProviders/{identityProvider}":{"parameters":[{"$ref":"#/components/parameters/App"},{"$ref":"#/components/parameters/IdentityProvider"},{"$ref":"#/components/parameters/XRequestId"},{"$ref":"#/components/parameters/XCorrelationId"}],"post":{"tags":["Manage Identity Providers for an App"],"summary":"Attach a trusted OpenID Connect Identity Provider to an App","operationId":"createAppIdentityProviderAttachment","description":"Attach a new trusted OpenID Connect Identity Provider to an App.\n\nThe App must be constrained to a Project.  To constrain an App to a Project, use the Access Manager -> \nApps -> My Apps -> Edit app -> specify \"DEFAULT ACCESS TO A PROJECT\", \nand check \"Allow access only in this project\".\n\nAn App may have at most 2 IdentityProviders attached to it.\n\n</br>Access Control:\n  * The calling principal must have either **\"manage\"** action permission for the resource **\"{app}\"** in the \n    **\"account\"** service or **\"readIdentityProviders\"** action permission for the callers **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","parameters":[{"in":"query","required":false,"name":"fields","schema":{"type":"string"},"description":"Comma-separated list of fields to return, for the created AppIdentityProviderAttachment.  \nBy default, the \"identityProviderHrn\", \"appHrn\", and \"enabled\" properties are returned.\nAdditional supported fields also include \"identityProviderId\", \"identityProviderName\", \n\"identityProviderDescription\", \"identityProviderAccountType\", \"identityProviderRealm\", \nand \"identityProviderIssuerAttachments\".\n","example":"identityProviderHrn,identityProviderName,appHrn,enabled"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAppIdentityProviderAttachmentRequest"},"example":{"enabled":true}}}},"responses":{"201":{"description":"Created","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppIdentityProviderAttachment"},"example":{"identityProviderHrn":"hrn:here:account::org123456789:identityProviders/example-op","identityProviderName":"Example OP","appHrn":"hrn:here:account::org123456789:app/AfRcv675i2zYubYTe17D","enabled":true}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n* E110000 - Maximum number of Identity Providers configured per App was exceeded.  The maximum is 2.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required *\"manage\"* access to the *app* , \n  or does not have the required *\"readIdentityProviders\"* access to the *realm*.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]},"get":{"tags":["Manage Identity Providers for an App"],"summary":"Gets a trusted OpenID Connect Identity Provider for an App","operationId":"getAppIdentityProviderAttachment","description":"Gets a trusted OpenID Connect Identity Provider configured for an App.\n\n</br>Access Control:\n  * The calling principal must either have **\"read\"** action permission for the resource **\"{app}\"** \n    in the **\"account\"** service and that the App is constrained to a Project or have \n    **\"readIdentityProviders\"** action permission for the callers **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","parameters":[{"in":"query","required":false,"name":"fields","schema":{"type":"string"},"description":"Comma-separated list of fields to return, for the specified AppIdentityProviderAttachment.  \nBy default, the \"identityProviderHrn\", \"appHrn\", and \"enabled\" properties are returned.\nAdditional supported fields also include \"identityProviderId\", \"identityProviderName\", \n\"identityProviderDescription\", \"identityProviderAccountType\", \"identityProviderRealm\", \nand \"identityProviderIssuers\".\n","example":"identityProviderHrn,identityProviderName,appHrn,enabled"}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppIdentityProviderAttachment"},"example":{"identityProviderHrn":"hrn:here:account::org123456789:identityProviders/example-op","identityProviderName":"Example OP","appHrn":"hrn:here:account::org123456789:app/AfRcv675i2zYubYTe17D","enabled":true}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required *\"read\"* access to the *app*,\n  or does not have the required *\"readIdentityProviders\"* access to the Realm.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"404":{"description":"An error has occurred.\n* E110000 - The requested App and/or Identity Provider and/or Identity Provider Attachment does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]},"patch":{"tags":["Manage Identity Providers for an App"],"summary":"Update a trusted OpenID Connect Identity Provider for an App","operationId":"updateAppIdentityProviderAttachment","description":"Update a trusted OpenID Connect Identity Provider for an App.\n\n</br>Access Control:\n  * The calling principal must either have **\"manage\"** action permission for the resource **\"{app}\"** \n    in the **\"account\"** service, and that the App is constrained to a Project or have \n    **\"readIdentityProviders\"** action permission for the callers **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","parameters":[{"in":"query","required":false,"name":"fields","schema":{"type":"string"},"description":"Comma-separated list of fields to return, for each AppIdentityProviderAttachment.  \nBy default, the \"identityProviderHrn\", \"appHrn\", and \"enabled\" properties are returned.\nAdditional supported fields also include \"identityProviderId\", \"identityProviderName\", \n\"identityProviderDescription\", \"identityProviderAccountType\", \"identityProviderRealm\", \nand \"identityProviderIssuers\".\n","example":"identityProviderHrn,identityProviderName,appHrn,enabled"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateAppIdentityProviderAttachmentRequest"},"example":{"enabled":true}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppIdentityProviderAttachment"},"example":{"identityProviderHrn":"hrn:here:account::org123456789:identityProviders/example-op","identityProviderName":"Example OP","appHrn":"hrn:here:account::org123456789:app/AfRcv675i2zYubYTe17D","enabled":true}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required *\"manage\"* access to the *app*,\n  or does not have the required *\"readIdentityProviders\"* access to the *realm*.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]},"delete":{"tags":["Manage Identity Providers for an App"],"summary":"Detach a trusted OpenID Connect Identity Provider for an App","operationId":"deleteAppIdentityProviderAttachment","description":"Detaches a trusted OpenID Connect Identity Provider from an App.\n\n</br>Access Control:\n  * The calling principal must either have **\"manage\"** action permission for the resource **\"{app}\"** \n    in the **\"account\"** service, and that the App is constrained to a Project or have \n    **\"readIdentityProviders\"** action permission for the callers **\"{realm}\"** in the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required *\"manage\"* access to the *app* identified in the path,\n  or does not have the required *\"readIdentityProviders\"* access to the *realm*.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"404":{"description":"An error has occurred.\n* E110000 - The requested App and/or Identity Provider and/or Identity Provider Attachment does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]}},"/devices":{"parameters":[{"$ref":"#/components/parameters/XRequestId"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"parameters":[{"$ref":"#/components/parameters/RealmQuery"},{"$ref":"#/components/parameters/IdentityProviderQuery"},{"$ref":"#/components/parameters/ExternalId"},{"$ref":"#/components/parameters/PageToken"},{"$ref":"#/components/parameters/Limit"}],"tags":["Manage Device Accounts"],"summary":"List Devices","operationId":"listDevices","description":"List Devices.\n\n</br>Access Control:\n  * The calling principal must have **\"readDevices\"** action permission for the resource **\"{realm}\"** in \n    the **\"account\"** service. The *realm* is either taken from the query string parameters, or if absent \n    defaults to the *realm* in the request access token.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeviceList"},"example":{"count":1,"items":[{"id":"DEVICE-16835a01-7546-4c1c-9894-5f837f854f83","hrn":"hrn:here:account::org123456789:devices/DEVICE-16835a01-7546-4c1c-9894-5f837f854f83","realm":"hrn:here:account::org123456789:realm/org123456789","project":"hrn:here:account::org123456789:project/my-project-0000","identityProvider":"hrn:here:account::org123456789:identityProviders/example-op","externalId":"vtWk4eNAlYLi2UHJGNONTAM5Q7WV4nxHTZGiyfgpFbQ=","enabled":true}]}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required \"readDevices\" access to the Realm.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"404":{"description":"An error has occurred.\n* E110000 - The requested Realm, or Device with specified Provider and ExternalId, does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]},"delete":{"parameters":[{"$ref":"#/components/parameters/RequiredIdentityProvider"},{"$ref":"#/components/parameters/RequiredExternalId"}],"tags":["Manage Device Accounts"],"summary":"Delete Devices","operationId":"deleteDevices","description":"Delete a Device by its Identity Provider and ExternalId.\nDeleting multiple Devices at a time is not currently supported.\n\n</br>Access Control:\n  * The calling principal must have **\"manageDevices\"** action permission for the resource **\"{realm}\"** in \n    the **\"account\"** service. The *realm* is realm of the device.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required \"readDevices\" access to the Realm.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"404":{"description":"An error has occurred.\n* E110000 - The requested Identity Provider, or Device with specified Identity Provider and ExternalId, \n  does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]}},"/devices/{device}":{"parameters":[{"$ref":"#/components/parameters/Device"},{"$ref":"#/components/parameters/XRequestId"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Manage Device Accounts"],"summary":"Get a Device by HRN","operationId":"getDevice","description":"Get the Device specified by HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"readDevices\"** action permission for the resource **\"{realm}\"** in \n    the **\"account\"** service. The *realm* is identified in the **\"{device}\"**.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Device"},"example":{"id":"DEVICE-16835a01-7546-4c1c-9894-5f837f854f83","hrn":"hrn:here:account::org123456789:devices/DEVICE-16835a01-7546-4c1c-9894-5f837f854f83","realm":"hrn:here:account::org123456789:realm/org123456789","project":"hrn:here:account::org123456789:project/my-project-0000","identityProvider":"hrn:here:account::org123456789:identityProviders/example-op","externalId":"vtWk4eNAlYLi2UHJGNONTAM5Q7WV4nxHTZGiyfgpFbQ=","enabled":true}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required *\"readDevices\"* access to the *realm*.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"404":{"description":"An error has occurred.\n* E110000 - The requested Project or Device does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]},"patch":{"tags":["Manage Device Accounts"],"summary":"Update a Device by HRN","operationId":"updateDevice","description":"Update the Device specified by HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"manageDevices\"** action permission for the resource **\"{realm}\"** in \n    the **\"account\"** service. The *realm* is identified in the **\"{device}\"**.\n  * The calling principal MUST NOT include a project scope.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDevice"},"example":{"enabled":true}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Device"},"example":{"id":"DEVICE-16835a01-7546-4c1c-9894-5f837f854f83","hrn":"hrn:here:account::org123456789:devices/DEVICE-16835a01-7546-4c1c-9894-5f837f854f83","realm":"hrn:here:account::org123456789:realm/org123456789","project":"hrn:here:account::org123456789:project/my-project-0000","identityProvider":"hrn:here:account::org123456789:identityProviders/example-op","externalId":"vtWk4eNAlYLi2UHJGNONTAM5Q7WV4nxHTZGiyfgpFbQ=","enabled":true}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required *\"manageDevices\"* access to the *realm*.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"404":{"description":"An error has occurred.\n* E110000 - The requested Project or Device does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]},"delete":{"tags":["Manage Device Accounts"],"summary":"Delete a Device by HRN","operationId":"deleteDevice","description":"Delete the Device specified by HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"manageDevices\"** action permission for the resource **\"{realm}\"** in \n    the **\"account\"** service. The *realm* is identified in the **\"{device}\"**.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required \"manageDevices\" access to the Realm.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"404":{"description":"An error has occurred.\n* E110000 - The requested Device does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]}},"/projects/{project}/devices":{"get":{"parameters":[{"$ref":"#/components/parameters/Project"},{"$ref":"#/components/parameters/IdentityProviderQuery"},{"$ref":"#/components/parameters/ExternalId"},{"$ref":"#/components/parameters/XRequestId"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/PageToken"},{"$ref":"#/components/parameters/Limit"}],"tags":["Manage Device Accounts"],"summary":"List Project Devices","operationId":"listProjectDevices","description":"List Devices in the specified Project.\n\n</br>Access Control:\n  * The calling principal must have **\"readDevices\"** action permission for the resource **\"{project}\"** in \n    the **\"account\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeviceList"},"example":{"count":1,"items":[{"id":"DEVICE-16835a01-7546-4c1c-9894-5f837f854f83","hrn":"hrn:here:account::org123456789:devices/DEVICE-16835a01-7546-4c1c-9894-5f837f854f83","realm":"hrn:here:account::org123456789:realm/org123456789","project":"hrn:here:account::org123456789:project/my-project-0000","identityProvider":"hrn:here:account::org123456789:identityProviders/example-op","externalId":"vtWk4eNAlYLi2UHJGNONTAM5Q7WV4nxHTZGiyfgpFbQ=","enabled":true}]}}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Subject does not have the required \"readDevices\" access to the Realm.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"404":{"description":"An error has occurred.\n* E110000 - The requested Realm, or Device with specified Provider and ExternalId, does not exist.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}},"security":[{"Bearer":[]}]}},"/support":{"parameters":[{"$ref":"#/components/parameters/XRequestId"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"security":[{"Bearer":[]}],"tags":["Support Access"],"description":"Get the support access entry that enables AccountExecutive logins for the calling principal's realm.\n\n</br>NOTE: This API will return 404 if Account Executive support access is not enabled for the realm.\n\n</br>Access Control:\n* The calling principal must have **\"readAccountExecutives\"** permission in the **\"account\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getSupportAccess","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SupportAccess"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"An error has occurred.\n* 404000: Resource not found. Account executive support access not enabled for this realm.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}}},"post":{"security":[{"Bearer":[]}],"tags":["Support Access"],"description":"Register support access for an authorized user or users to enable AccountExecutive logins to the\ncalling principal's realm.  The registered authorized user(s) will be allowed to login as Account Executives\nto the realm.\n* If the registered authorized user's emailAddress is not the wildcard value '*', an email notification will be\nsent indicating that the user has been invited as an AccountExecutive to the realm.\n* If the registered authorized user's emailAddress is the wildcard value '*', no email notification will be sent\n\n</br>**NOTE:** A maximum of 5 individual email addresses and/or a single wildcard entry '*' may be registered for\nAccountExecutive access.  This API is idempotent and may be called repeatedly with the same request parameters.\nIf an already registered email address is provided, a duplicate email notification will be sent.\n\n</br>**NOTE:** This API will return 404 if Account Executive support access is not enabled for the realm.\n\n</br>Access Control:\n* The calling principal must have **\"manageAccountExecutives\"** permission in the **\"account\"** service.\n* This API is rate limited to a maximum of **6** calls per minute per realm\n* The calling principal MUST NOT include a project scope.\n","operationId":"registerSupportAccessUser","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SupportAccessUserRequest"}}}},"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SupportAccess"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"An error has occurred.\n* 400201: This field is required.\n* 400202: Value cannot be empty.\n* 400233: Invalid 'expiresAt' format.\n* 400240: Illegal email.\n* 400390: Value for 'expiresAt' must be in the future.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"An error has occurred.\n* 404000: Resource not found. Account executive support access not enabled for this realm.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}}},"delete":{"parameters":[{"$ref":"#/components/parameters/SupportEmail"}],"security":[{"Bearer":[]}],"tags":["Support Access"],"description":"Delete the support access entry.\n  * Invalidate any existing logins associated with the deleted support entry\n  * Delete any AccountExecutive user accounts that have been created in the realm that are associated with the deleted support entry\n\n</br>**NOTE:** This API will return 404 if Account Executive support access is not enabled for the realm.\n\n</br>Access Control:\n* The calling principal must have **\"manageAccountExecutives\"** permission in the **\"account\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"deleteSupportAccess","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"An error has occurred.\n* 404000: Resource not found. Account executive support access not enabled for this realm.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}}}}}}