{"openapi":"3.0.0","info":{"title":"Authorization API v1.1","version":"1.1.0","description":"\nThis specification is intended to describe the Authorization v1.1 APIs\n## Roles\n### **OrgAdmin** - An entity which has administrative authority over an organization.\n  + Administrative rights include authority to:\n    + Promote realm members to the **OrgAdmin** role\n    + Promote realm members to the **OrgInviter** role\n    + Promote realm members to the **GroupAdmin** role within all groups\n    + Promote project members to the **ProjectAdmin** role\n    + Promote realm members to the **CrossRealmTrustManager** role\n    + All rights associated with the **OrgInviter** role\n    + All rights associated with the **CrossRealmTrustManager** role\n    + Create groups\n    + Delete groups\n    + Modify groups\n    + Add/remove group members for all groups\n    + Add/remove project members for all projects\n    + Read/List project members for all projects\n    + List their projects\n    + List all projects in the Org\n    + Read all projects\n    + Update all projects\n    + Delete all projects\n\n### **OrgInviter** - An entity which has elevated permissions within an organization.\n  + Administrative rights include the authority to:\n    + Create and send an invitation to the organization and optionally add the invitee to a group if the **OrgInviter** is also a **GroupAdmin** for that group\n    + Resend an invitation to the organization\n    + Search for pending invitations of the organization\n    + Cancel invitations sent to members of that organization\n\n### **ResourceManager** - An entity which has elevated permissions within an organization.\n  + Administrative rights include the authority to:\n    + Management permissions on all applications within the realm\n    + Management permissions on all schemas and artifacts within the realm\n    + Management permissions on all catalogs and layers within the realm\n    + Management permissions on all projects within the realm\n\n### **GroupAdmin** - An entity which has administrative authority over groups in which they have been assigned this role.\n  + Administrative rights include the authority to:\n    + Add/remove group members for their groups\n    + Promote realm members to the **GroupAdmin** role for their groups\n    + Modify their groups\n    + Delete their groups\n\n### **ProjectAdmin** - Entities that have administrative authority over projects in which they have been assigned this role.\n  + Administrative rights include the authority to:\n    + Add/remove project members for their projects\n    + Read/List project members for their projects\n    + Promote members to the **ProjectAdmin** role for their projects\n    + List their projects\n    + Read their projects\n    + Update their projects\n    + Delete their projects\n\n### **MonitoringDashboardEditor** - An entity which has role defined within an organization.\n  + No additional Administrative rights included\n  + This role maps to the Grafana 'Editor' role when interacting with Grafana\n\n### **LicensingAdmin** - An entity which has elevated permissions within an organization.\n  + Administrative rights include the authority to:\n    + \"manageLicenses\" access for all resources within the realm for BAM Config Service\n\n### **CrossRealmTrustManager** - An entity which has elevated permissions within an organization.\n  + Administrative rights include the authority to:\n    + Create/update/delete cross realm trusts\n    + Read/list cross realm trusts\n\n## Project scoped token\n  + Project scoped token contains an \"scp\" (scope) claim of value \"project hrn\"\n"},"externalDocs":{"description":"The developer guide and related API references are available here.","url":"https://www.here.com/docs/category/identity-and-access-management"},"servers":[{"url":"Use API Lookup for a base URL"}],"security":[{"Bearer":[]}],"tags":[{"name":"Realms","description":"Realms and Realm Membership Management"},{"name":"Roles","description":"Role and Role Membership Management"},{"name":"Groups","description":"Group and Group Membership Management"},{"name":"Grants","description":"Manage resource access by external users"},{"name":"Access Filters","description":"Manage access control boundaries for identities"},{"name":"Resource Info and Management","description":"Resource Management and Information"},{"name":"Resource Policies","description":"Resource Policy Management"},{"name":"Project Management","description":"Project Management"},{"name":"Project Access Management","description":"Project Access and Membership Management"},{"name":"Project Resource Management","description":"Project Resource Management"},{"name":"Cross Realm Trusts","description":"Cross Realm Trusts"},{"name":"Services","description":"Service discovery and management"}],"paths":{"/roles":{"get":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"},{"$ref":"#/components/parameters/roleName"},{"$ref":"#/components/parameters/resourceHrn"}],"tags":["Roles"],"summary":"Get Roles","description":"Retrieve the list of roles within the context of the provided realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readRoles\"** action permission for the callers **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getRoles","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RolePageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}}},"/roles/me":{"get":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"}],"tags":["Roles"],"summary":"Get My Roles","description":"Retrieve the list of roles which have been assigned to the calling party.\n\n</br>Access Control:\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getMyRoles","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RolePageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}}},"/roles/{role}":{"parameters":[{"$ref":"#/components/parameters/role"}],"get":{"tags":["Roles"],"summary":"Get Role","operationId":"getRole","description":"Get the role identified by the provided Role HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"readRoles\"** action permission for the callers **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Role"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Role not found"}}}},"/roles/{role}/permissions":{"parameters":[{"$ref":"#/components/parameters/role"}],"get":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"}],"tags":["Roles"],"summary":"Get Role Permissions","operationId":"getRolePermissions","description":"Get the **unscoped** permissions associated with the role identified by the provided Role HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"readPermissions\"** action permission for the resource **\"{role}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Role not found"}}}},"/roles/{role}/permissions/{permission}":{"parameters":[{"$ref":"#/components/parameters/role"},{"$ref":"#/components/parameters/permission"}],"get":{"tags":["Roles"],"summary":"Get Role Permission","operationId":"getRolePermission","description":"Get a single permission associated with the role identified by the provided Role HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"readPermissions\"** action permission for the resource **\"{role}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActivePermission"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Role or permission not found"}}}},"/roles/{role}/filter":{"get":{"parameters":[{"$ref":"#/components/parameters/role"}],"tags":["Roles"],"summary":"Get Role Access Filter","description":"Retrieve the Access Filter attached to this role if there is one.\n\n</br>Access Control:\n* The calling principal must have **\"readFilter\"** action permission for the resource **\"{role}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getRoleAccessFilter","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilter"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Role or access filter not found."}}}},"/realms/{realm}/invites/{invite}":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/invite"}],"post":{"tags":["Realms"],"summary":"Resend an invitation to a user in a realm","description":"Resend an invitation to a new member to the realm.\n\n</br>Access Control:\n  * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * This API is rate limited to a maximum of **6** invites per realm per minute.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"resendRealmMemberInvite","responses":{"204":{"$ref":"#/components/responses/NoContent"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or invite not found."},"429":{"description":"Realm invitation is temporarily suspended due to repeated requests. Wait for a while before making a new request."}}},"put":{"tags":["Realms"],"summary":"Update and send an invitation to a user in a realm","description":"Update and resend an invitation to add a new member to the realm,\noptionally assign membership to one or more groups if the Inviter is\nalso a **GroupAdmin** for the group and optionally invite with one or\nmore roles assigned.\n\n</br>Access Control:\n  * In order to invite a new user to the **\"{realm}\"**:\n    * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * In order to invite a new user to the **\"{realm}\"** as a member of the **\"{group}\"**:\n    * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** **AND** \n      **\"manageMembers\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service.\n  * In order to invite a new user to the **\"{realm}\"** to have roles. For each **\"{role}\"**:\n    * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** **AND** \n      **\"manageEntities\"** action permission for the resource **\"{role}\"** in the **\"authorization\"** service.\n  * This API is rate limited to a maximum of **6** invites per realm per minute.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"sendUpdatedRealmMemberInvite","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RealmAuthorizationInvite"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RealmAuthInviteResponse"}}}},"400":{"description":"Invalid name or role."},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or group or role not found."},"422":{"description":"Group size limit exceeded."},"429":{"description":"Realm invitation is temporarily suspended due to repeated requests. Wait for a while before making a new request."}}},"delete":{"tags":["Realms"],"summary":"Cancel a user invitation to a realm","description":"Cancel an invitation to the realm.\n\n</br>Access Control:\n  * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"cancelRealmMemberInvite","responses":{"204":{"$ref":"#/components/responses/NoContent"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or invite not found."}}}},"/realms/{realm}/invites":{"get":{"tags":["Realms"],"summary":"Search for invitations in a realm","description":"Search for invitations in the realm, optionally providing a group.\n\n</br>Access Control:\n  * The calling principal must have either **\"manageInvites\"** or **\"readMembers\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"searchRealmMemberInvites","parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/groupQuery"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"},{"$ref":"#/components/parameters/invitesSearch"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitePageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or group not found."}}},"post":{"tags":["Realms"],"summary":"Create and send a user invitation for a realm","description":"Create and send an invitation to add a new member to the realm,optionally assign membership to one or more groups\nif the Inviter is also a **GroupAdmin** for the group and optionally invite with one or more roles assigned.\n\n</br>Access Control:\n  * In order to invite a new user to the **\"{realm}\"**:\n    * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * In order to invite a new user to the **\"{realm}\"** as a member of the **\"{group}\"**:\n    * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** **AND** \n      **\"manageMembers\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service.\n  * In order to invite a new user to the **\"{realm}\"** to have roles. For each **\"{role}\"**:\n    * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** **AND** \n      **\"manageEntities\"** action permission for the resource **\"{role}\"** in the **\"authorization\"** service.\n  * This API is rate limited to a maximum of **6** invites per realm per minute.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"createRealmMemberInvite","parameters":[{"$ref":"#/components/parameters/realm"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RealmAuthorizationInvite"}}},"required":true},"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RealmAuthInviteResponse"}}}},"400":{"description":"Invalid email or name or role."},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or group or role not found."},"422":{"description":"Group size limit exceeded."},"429":{"description":"Realm invitation is temporarily suspended due to repeated requests. Wait for a while before making a new request."}}}},"/realms/{realm}/invites/targets":{"get":{"tags":["Realms"],"summary":"Get list of supported invite targets for the realm","description":"Get the list of supported invite targets for the realm.  An invite target determines what application a\nuser is directed to use in the invitation email.  The value **\"platform\"** is available by default in every\nrealm.  Additional supported values are available depending on the realm's configuration.\n\n</br>Access Control:\n* The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getRealmMemberInviteTargets","parameters":[{"$ref":"#/components/parameters/realm"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InviteTargets"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or group not found."}}}},"/realms/{realm}/limits":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"get":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/limitType"}],"tags":["Realms"],"summary":"Get Realm limits","description":"Retrieve the list of limits associated with this realm.  A limit with the same **\"type\"** __may__ appear in the list\nmultiple times.  In this case, the actual limit that is enforced by the same is the highest of all configured values.\n\n</br>Access Control:\n* The calling principal must have **\"readLimits\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getRealmLimits","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RealmLimitPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members":{"parameters":[{"$ref":"#/components/parameters/realm"}],"get":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"},{"$ref":"#/components/parameters/realmEntityType"},{"$ref":"#/components/parameters/realmMembersSearch"},{"$ref":"#/components/parameters/realmMembersState"},{"$ref":"#/components/parameters/vehicleContractId"}],"tags":["Realms"],"summary":"Get realm members","description":"Retrieve the list of members within the realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readMembers\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getRealmMembers","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RealmMemberPageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"}],"get":{"tags":["Realms"],"summary":"Get realm member","description":"Retrieve the user or application details of the member defined by member HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"readMembers\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getRealmMember","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RealmMember"},"examples":{"user":{"value":{"memberHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899","entityType":"user","info":{"userId":"HERE-64badba9-4242-4859-88d5-74563a8f0899","userHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899","realm":"myrealm","firstname":"John","lastname":"Williams","email":"john.williams@example.com","roles":["OrgAdmin","GroupAdmin"],"state":"enabled","createdTime":1432216394712}}},"vehicle":{"value":{"memberHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0890","entityType":"car","info":{"userId":"HERE-64badba9-4242-4859-88d5-74563a8f0890","userHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0890","realm":"myrealm","carId":"HashedVehicleVIN","vehicleContractId":"XY/1234","roles":["OrgAdmin","GroupAdmin"],"state":"enabled","createdTime":1432216394712}}},"app":{"value":{"memberHrn":"hrn:here:account::myrealm:app/0123456789ABCDEFGHHIJKLM","entityType":"app","info":{"clientId":"0123456789ABCDEFGHHIJKLM","clientHrn":"hrn:here:account::myrealm:app/0123456789ABCDEFGHHIJKLM","realm":"myrealm","name":"Some Application","description":"Application for doing something.","ownerId":"HERE-00000000-0000-0000-0000-000000000000","ownerHrn":"hrn:here:account::myrealm:user/HERE-00000000-0000-0000-0000-000000000000","defaultScope":"hrn:here:authorization::myrealm:project/my-project-0000","isRestrictedScope":"true","appCreationEnabled":"true","alwaysProjectScope":"true","status":"active","roles":["OrgAdmin","GroupAdmin"],"state":"enabled","createdTime":1432216394712}}}}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or realm member not found"}}}},"/realms/{realm}/members/{member}/roles":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"}],"get":{"tags":["Realms"],"summary":"Get entity roles","description":"Retrieve the roles a given entity has been assigned.\n\n</br>Access Control:\n  * The calling principal must have **\"readRoles\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getEntityRoleAssignments","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RolePageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or realm member not found"}}}},"/realms/{realm}/members/{member}/groups":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"}],"get":{"tags":["Realms"],"summary":"Get entity group membership","description":"Retrieve the groups a given entity is a member of.\n\n</br>Access Control:\n  * The calling principal must have **\"readGroups\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getEntityGroupMembership","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupPageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or realm member not found"}}}},"/realms/{realm}/members/{member}/managedGroups":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/count"},{"$ref":"#/components/parameters/pageToken"}],"get":{"tags":["Realms"],"summary":"Get entity managed group","description":"Retrieve the list of groups over which the provided entity has been\ngranted the role of GroupAdmin.\n\n</br>Access Control:\n  * The calling principal must have **\"readGroups\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getEntityManagedGroups","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupPageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or realm member not found"}}}},"/realms/{realm}/members/{member}/projects":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"}],"get":{"tags":["Realms"],"summary":"Get entity project membership","description":"Retrieve the projects a given entity is a member of.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n","operationId":"getEntityProjectMembership","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectListWithPageToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}/plans":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Entity Plans","operationId":"getEntityPlans","description":"Get all plans attached to the requested entity.\n\n**Note:** Plans can only be attached to apps. Requesting plans attached to a user will return 404.\n\n</br>Access Control:\n  * The calling principal must have **\"readPlans\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedUnscopedPlanPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}/plans/{plan}/policies":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/planHrn"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Entity Plan Policies","operationId":"getEntityPlanPolicies","description":"Get all policies associated with a plan attached to the requested entity.\n\n</br>Access Control:\n  * The calling principal must have **\"readPlans\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedUnscopedPolicyPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}/plans/{plan}/policies/{policy}/permissions":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/planHrn"},{"$ref":"#/components/parameters/policyHrn"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Entity Plan Policy Permissions","operationId":"getEntityPlanPolicyPermissions","description":"Get all **unscoped** permissions that are in a policy associated with a plan attached to the requested entity.\n\n</br>Access Control:\n  * The calling principal must have **\"readPlans\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}/policies":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Entity Policies","operationId":"getEntityPolicies","description":"Get all policies attached to the requested entity.\n\n**Note:** Policies can only be attached to apps. Requesting policies attached to a user will return 404.\n\n</br>Access Control:\n  * The calling principal must have **\"readPolicies\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedUnscopedPolicyPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}/policies/{policy}/permissions":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/policyHrn"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Entity Policy Permissions","operationId":"getEntityPolicyPermissions","description":"Get all **unscoped** permissions that are in a policy attached to the requested entity.\n\n</br>Access Control:\n  * The calling principal must have **\"readPolicies\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}/permissions":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/permissionServiceId"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"}],"get":{"tags":["Realms"],"summary":"Get entity permissions","description":"Retrieve the **unscoped** permissions a given entity has been assigned.\n\n</br>Access Control:\n  * The calling principal must have **\"readPermissions\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getEntityPermissions","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or realm member not found"}}}},"/realms/{realm}/members/{member}/filters":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Entity Access Filters","description":"Retrieve the Access Filters attached to this entity.\n\n</br>Access Control:\n* The calling principal must have **\"readAccessFilter\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getEntityAccessFilters","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilterAttachmentPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}/filters/{filterHrn}":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/filterHrn"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Entity Access Filter","description":"Retrieve an Access Filter attached to this entity.\n\n</br>Access Control:\n* The calling principal must have **\"readAccessFilter\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getEntityAccessFilter","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilterAttachment"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"put":{"tags":["Realms"],"summary":"Attach Entity Access Filter","description":"Attach an Access Filter to this entity.  A maximum of **5** Access Filters may be attached to a single entity.\n\n</br>Access Control:\n* The calling principal must have **\"manageAccessFilter\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"attachEntityAccessFilter","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilterAttachment"}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilterAttachment"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"delete":{"tags":["Realms"],"summary":"Detach Entity Access Filter","description":"Remove the Access Filter attached to this entity.\n\n</br>Access Control:\n* The calling principal must have **\"manageAccessFilter\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"detachEntityAccessFilter","responses":{"204":{"$ref":"#/components/responses/NoContent"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/plans":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/planServiceId"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Realm Plans","operationId":"getRealmPlans","description":"Get all plans attached to the requested realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readPlans\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedUnscopedPlanPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/plans/{plan}/policies":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/planHrn"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Realm Plan Policies","operationId":"getRealmPlanPolicies","description":"Get all policies associated with a plan attached to a realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readPlans\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedUnscopedPolicyPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/plans/{plan}/policies/{policy}/permissions":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/planHrn"},{"$ref":"#/components/parameters/policyHrn"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Realm Plan Policy Permissions","operationId":"getRealmPlanPolicyPolicies","description":"Get all **unscoped** permissions associated with a policy that is in a plan that is attached to a realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readPlans\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/policies":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/policyServiceId"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Realm Policies","operationId":"getRealmPolicies","description":"Get all policies attached to the requested realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readPolicies\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedUnscopedPolicyPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/policies/{policy}/permissions":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/policyHrn"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Policy Permissions","operationId":"getPolicyPermissions","description":"Get all **unscoped** permissions associated with a policy that is attached to a realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readPolicies\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/resourcePlans":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Realm Resource Plans","operationId":"getRealmResourcePlans","description":"Get all resource plans attached to the requested realm.\n\n</br>Access Control:\n* The calling principal must have **\"readPlans\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedResourcePlanPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/resourcePlans/{resourcePlan}/resourcePolicies":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/resourcePlanHrn"},{"$ref":"#/components/parameters/externalIdAttachment"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Realm Resource Plan Resource Policies","operationId":"getRealmResourcePlanResourcePolicies","description":"Get all resource policies associated with a resource plan attached to a realm.\n\n</br>Access Control:\n* The calling principal must have **\"readPlans\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedResourcePolicyPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/resourcePlans/{resourcePlan}/resourcePolicies/{resourcePolicy}/permissions":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/resourcePlanHrn"},{"$ref":"#/components/parameters/resourcePolicy"},{"$ref":"#/components/parameters/externalIdAttachment"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Realm Resource Plan Resource Policy Permissions","operationId":"getRealmResourcePlanResourcePolicyPermissions","description":"Get all **linkable** permissions associated with a resource policy that is in a resource plan that is attached to a realm.\n\n</br>Access Control:\n* The calling principal must have **\"readPlans\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionWithSubresourcesPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/resourcePlans/{resourcePlan}/actionPolicies":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/resourcePlanHrn"},{"$ref":"#/components/parameters/externalIdAttachment"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Realm Resource Plan Action Policies","operationId":"getRealmResourcePlanActionPolicies","description":"Get all service action policies associated with a resource plan attached to a realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readPlans\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourcePlanPolicyList"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/resourcePlans/{resourcePlan}/actionPolicies/{actionPolicy}/permissions":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/resourcePlanHrn"},{"$ref":"#/components/parameters/actionPolicy"},{"$ref":"#/components/parameters/externalIdAttachment"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Realm Resource Plan Action Policy Permissions","operationId":"getRealmResourcePlanActionPolicyPermissions","description":"Get all permissions associated with a service action policy that is in a resource plan that is attached to a realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readPlans\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActionPolicyPermissionList"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/linkable/permissions":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/linkablePermissionResourceType"},{"$ref":"#/components/parameters/permissionServiceId"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"}],"get":{"tags":["Realms"],"summary":"Get realm linkable permissions","description":"Get the list of **linkable** permissions that are associated with all resources in this realm that have\nspecifically been made available to be linked to any project in the realm.  Note this list does NOT include\nlinkable permissions associated with resource plans attached to the realm.\n\n</br>Access Control:\n* The calling principal must have **\"readPermissions\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getRealmLinkablePermissions","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or realm member not found"}}}},"/realms/{realm}/filter":{"parameters":[{"$ref":"#/components/parameters/realm"}],"get":{"tags":["Realms"],"summary":"Get Realm Access Filter","description":"Retrieve the Access Filter attached to this realm.\n\n</br>Access Control:\n* The calling principal must have **\"readAccessFilter\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getRealmAccessFilter","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilter"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm not found"}}},"post":{"tags":["Realms"],"summary":"Attach Realm Access Filter","description":"Update the Access Filter attached to this realm.  Only a single access filter may be attached to a realm.\nIf an Access Filter is already attached to the realm, this operation will replace it with a new one.\n\n</br>Access Control:\n* The calling principal must have **\"manageAccessFilter\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"attachRealmAccessFilter","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilterIdentifier"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilter"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm not found"}}}},"/realms/{realm}/permissions":{"parameters":[{"$ref":"#/components/parameters/realm"}],"get":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"}],"tags":["Realms"],"summary":"Get realm permissions","deprecated":true,"description":"Retrieve the effective permissions associated with the realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readPermissions\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getRealmPermissions","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/roles/{role}/entities":{"parameters":[{"$ref":"#/components/parameters/role"}],"get":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"}],"tags":["Roles"],"summary":"Get role entities","description":"Retrieve the list of entities which have been assigned the role as\nidentified by the provided role HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"readEntities\"** action permission for the resource **\"{role}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getRoleEntities","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RoleEntityPageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Role not found"}}}},"/roles/{role}/entities/{entity}":{"parameters":[{"$ref":"#/components/parameters/role"},{"$ref":"#/components/parameters/entity"}],"get":{"tags":["Roles"],"summary":"Get a single role entity","description":"Retrieve a single entity which has been assigned the role as identified\nby the provided role HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"readEntities\"** action permission for the resource **\"{role}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getRoleEntity","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RoleEntity"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Role or entity not found"},"422":{"description":"A defined system limit would be violated if this action was completed.\nExample: 'MaxEntityRoles limit reached. Current value: 100. Maximum value: 100'\n* 422000 - LimitReached\n"}}},"post":{"tags":["Roles"],"summary":"Assign a role to an entity","description":"Assign the role provided to the given entity. If the provided role is\nassociated with a group, the entity being assigned the role must be a\nmember of the associated group.\n\n</br>Access Control:\n  * The calling principal must have **\"manageEntities\"** action permission for the resource **\"{role}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"addRoleEntity","responses":{"204":{"$ref":"#/components/responses/NoContent"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Role or entity not found"}}},"delete":{"tags":["Roles"],"summary":"Revoke a role from an entity","operationId":"deleteRoleEntity","description":"Remove the role provided to from the given member.\n\n</br>Access Control:\n  * The calling principal must have **\"manageEntities\"** action permission for the resource **\"{role}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"204":{"$ref":"#/components/responses/NoContent"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Role or entity not found"}}}},"/groups/{groupId}/roles":{"parameters":[{"$ref":"#/components/parameters/groupId"}],"get":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"}],"tags":["Groups"],"summary":"Get group roles","description":"List the roles which are associated with the provided group.\n\n</br>Access Control:\n  * The calling principal must have **\"readRoles\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service. Here **group** is the group identified by the provided group HRN.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getGroupRoles","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RolePageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Group not found"}}}},"/groups":{"get":{"tags":["Groups"],"summary":"Get groups","operationId":"getGroups","description":"Retrieve the list of groups within the realm associated with the calling party.\n\n</br>Access Control:\n  * The calling principal must have **\"readMembers\"** action permission for the calling party **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"},{"$ref":"#/components/parameters/groupsSearch"}],"responses":{"200":{"description":"List of group members that match all the search criteria.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupPageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}},"post":{"tags":["Groups"],"summary":"Create group","operationId":"createGroup","description":"Create a group within the realm that is associated with the calling\nparty. The calling party will be made a member and an administrator of\nthe created group.\n\n</br>Access Control:\n  * The calling principal must have **\"createGroup\"** action permission for the calling party **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","requestBody":{"$ref":"#/components/requestBodies/Group"},"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Group"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"422":{"description":"A defined system limit would be violated if this action was completed.\nExample: 'MaxEntityRoles limit reached. Current value: 100. Maximum value: 100'\n* 422000 - LimitReached\n* This API works only with tokens that are not scoped to a project.\n"}}}},"/groups/{groupId}":{"parameters":[{"$ref":"#/components/parameters/groupId"}],"get":{"tags":["Groups"],"summary":"Get single group","operationId":"getGroup","description":"Retrieve the group identified by the provided group HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"readMembers\"** action permission for the calling party **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Group"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Group not found"}}},"post":{"tags":["Groups"],"summary":"Update group","operationId":"updateGroup","description":"Update the group identified by the provided group HRN by updating all\nwritable group fields including name and description.\n\n</br>Access Control:\n  * The calling principal must have **\"updateGroup\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service. Here **group** is the group identified by the provided group HRN.\n  * The calling principal MUST NOT include a project scope.\n","requestBody":{"$ref":"#/components/requestBodies/Group"},"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Group"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Group not found"}}},"delete":{"tags":["Groups"],"summary":"delete group","operationId":"deleteGroup","description":"Delete the group identified by the provided group HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"deleteGroup\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service. Here **group** is the group identified by the provided group HRN.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"204":{"$ref":"#/components/responses/NoContent"},"400":{"description":"An error has occurred.\n* 404780 - Authorization Group not found\n"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Group not found"}}}},"/groups/{groupId}/policies":{"parameters":[{"$ref":"#/components/parameters/groupId"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Groups"],"summary":"Get Group Policies","operationId":"getGroupPolicies","description":"Get all policies attached to the requested group.\n\n</br>Access Control:\n  * The calling principal must have **\"readPolicies\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service. Here **group** is the group identified by the provided group HRN.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedUnscopedPolicyPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/groups/{groupId}/policies/{policy}/permissions":{"parameters":[{"$ref":"#/components/parameters/groupId"},{"$ref":"#/components/parameters/policyHrn"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Groups"],"summary":"Get Group Policy Permissions","operationId":"getGroupPolicyPermissions","description":"Get all **unscoped** permissions that are in a policy attached to the requested group.\n\n</br>Access Control:\n  * The calling principal must have **\"readPolicies\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service. Here **group** is the group identified by the provided group HRN.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/groups/{groupId}/permissions":{"parameters":[{"$ref":"#/components/parameters/groupId"},{"$ref":"#/components/parameters/permissionServiceId"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"}],"get":{"tags":["Groups"],"summary":"Get group permissions","description":"Retrieve the **unscoped** permissions a given group has been assigned.\n\n</br>Access Control:\n  * The calling principal must have **\"readPermissions\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service. Here **group** is the group identified by the provided group HRN.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getGroupPermissions","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Group not found"}}}},"/groups/{groupId}/members":{"parameters":[{"$ref":"#/components/parameters/groupId"}],"get":{"tags":["Groups"],"summary":"Get Group members","description":"Retrieve the list of members of the group identified by the provided group HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"readMembers\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service. Here **group** is the group identified by the provided group HRN.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getGroupMembers","parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"},{"$ref":"#/components/parameters/groupEntityType"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupMemberPageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Group not found"}}}},"/groups/{groupId}/members/me":{"parameters":[{"$ref":"#/components/parameters/groupId"}],"delete":{"tags":["Groups"],"summary":"Removes the calling party from a group","operationId":"leaveGroup","description":"Remove the calling party from the group. This operation will also remove\nadministrative roles from this member.\n\n</br>Access Control:\n  * The calling principal must have **\"manageMembers\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service. Here **group** is the group identified by the provided group HRN.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"204":{"$ref":"#/components/responses/NoContent"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"description":"Group not found or calling party is not a member of the group"}}}},"/groups/{groupId}/members/{member}":{"parameters":[{"$ref":"#/components/parameters/groupId"},{"$ref":"#/components/parameters/member"}],"post":{"tags":["Groups"],"summary":"Add a member to a group","description":"Add a single member to a group.\n\n</br>Access Control:\n  * The calling principal must have **\"manageMembers\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service. Here **group** is the group identified by the provided group HRN.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"addGroupMember","responses":{"204":{"$ref":"#/components/responses/NoContent"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Group or group member not found"},"422":{"description":"A defined system limit would be violated if this action was completed.\nExample: 'MaxEntityGroups limit reached. Current value: 50. Maximum value: 50'\n* 422000 - LimitReached\n"}}},"get":{"tags":["Groups"],"summary":"Get single Group member","description":"Retrieve a single group member.\n\n</br>Access Control:\n  * The calling principal must have **\"readMembers\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service. Here **group** is the group identified by the provided group HRN.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getGroupMember","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupMember"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Group or group member not found"}}},"delete":{"tags":["Groups"],"summary":"Remove a member from the group.","operationId":"removeGroupMember","description":"Remove a member from the group. This operation will also remove\nadministrative roles from this member.\n\n</br>Access Control:\n  * The calling principal must have **\"manageMembers\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service. Here **group** is the group identified by the provided group HRN.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"204":{"$ref":"#/components/responses/NoContent"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Group or group member not found"}}}},"/groups/me":{"get":{"tags":["Groups"],"summary":"Get My Groups","description":"Retrieve a list of groups of a member.\n\n</br>Access Control:\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getMyGroups","parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupPageWToken"}}}},"400":{"description":"An error has occurred.\n* 500100 - Unexpected exception\n"}}}},"/grants/resources/{resourceHrn}/entities":{"get":{"operationId":"listGrants","summary":"List grants on users, apps, or groups","description":"List grants on user, apps, or groups. This call describes the\npermissions assigned to any user, app, or group **in the same realm as\nthe calling principal unless includeCrossRealmGrants is true** that has been granted access to the specified\nresource through an exact matching permission. Permissions granted\nthrough policies and roles are not included.\n\n</br>Access Control:\n  * The calling principal must have either **\"listGrants\"** or **\"share\"** action permission for the resource **\"{resourceHrn}\"** in the **\"authorization\"** service.\n  * The realm of the calling principal MUST match the realm of the requested app.\n  * The calling principal MUST NOT include a project scope.\n","tags":["Grants"],"parameters":[{"name":"resourceHrn","required":true,"description":"The hrn that identifies the resource","in":"path","schema":{"type":"string"}},{"name":"entityType","description":"Restrict to only this type of entity  in the response.  Must be one of user, app, or group","in":"query","schema":{"type":"string"}},{"name":"includeCrossRealmGrants","description":"List grants on user, app, or group that have been shared across all realms. Only entityId and permissions will be included in the response. The default value is false.","in":"query","schema":{"type":"boolean"}},{"name":"pageToken","description":"When there are more than 'count' total records, use the pageToken from the previous page to retrieve the next page","in":"query","schema":{"type":"string"}},{"name":"count","description":"Number of records to return.","in":"query","schema":{"type":"integer"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EntityGrantsList"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/grants/resources/{resourceHrn}/entities/{entityId}":{"get":{"operationId":"getGrants","summary":"Get grants given to a user, app, or group","description":"Get grants. This call describes the permissions assigned to the\nspecified entity that grant access to the specified\nresource. Empty list is returned if no permissions are found for\nthe resource hrn provided regardless of the resource being present or not\n\n</br>Access Control:\n  * The calling principal must have either **\"listGrants\"** or **\"share\"** action permission for the resource **\"{resourceHrn}\"** in the **\"authorization\"** service.\n  * The realm of the calling principal MUST match the realm of the requested app.\n  * The calling principal MUST NOT include a project scope.\n","tags":["Grants"],"parameters":[{"name":"resourceHrn","required":true,"description":"The hrn that identifies the resource","in":"path","schema":{"type":"string"}},{"name":"entityId","required":true,"description":"The entityId to get the grants of","in":"path","schema":{"type":"string"}},{"name":"entityType","required":true,"description":"The type of the entity requested.  Must be one of user, app, or group","in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EntityGrant"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Resource or App not found"}}}},"/grants/resources/{resourceHrn}/entities/{entityId}/actions/{actionId}":{"get":{"operationId":"getGrant","summary":"Get a single grant given to an entity","description":"Get a single grant given to an entity. This calls returns any permission\nto take the specified action against the specified resource on the\nrequested entity.\n\n</br>Access Control:\n  * The calling principal must have either **\"listGrants\"** or **\"share\"** action permission for the resource **\"{resourceHrn}\"** in the **\"authorization\"** service.\n  * The realm of the calling principal MUST match the realm of the requested app.\n  * The calling principal MUST NOT include a project scope.\n","tags":["Grants"],"parameters":[{"name":"resourceHrn","required":true,"description":"The hrn that identifies the resource","in":"path","schema":{"type":"string"}},{"name":"entityId","required":true,"description":"The target entityId to get the grant of","in":"path","schema":{"type":"string"}},{"name":"actionId","required":true,"description":"The action of the grant","in":"path","schema":{"type":"string"}},{"name":"entityType","required":true,"description":"The type of the entity to get the grant of.  Must be one of user, app, or group","in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EntityGrant"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Resource or App not found"}}},"post":{"operationId":"addGrant","summary":"Grant access to a resource to an entity.","description":"Grant access to a resource to an entity. The result of this call is that\nthe specified entity will have permission to take the specified action\nagainst the specified resource.\n\n</br>Access Control:\n  * The calling principal must have either **\"addGrant:{actionId}\"** or **\"share\"** action permission for the resource **\"{resourceHrn}\"** in the **\"authorization\"** service.\n  * The realm of the calling principal MUST match the realm of the requested app.\n  * The calling principal MUST NOT include a project scope.\n","tags":["Grants"],"parameters":[{"name":"resourceHrn","required":true,"description":"The hrn that identifies the resource","in":"path","schema":{"type":"string"}},{"name":"entityId","required":true,"description":"The target entityId to grant access to","in":"path","schema":{"type":"string"}},{"name":"actionId","required":true,"description":"The action to assign as allowed against the resource","in":"path","schema":{"type":"string"}},{"name":"entityType","required":true,"description":"The type of the entity to grant access to.  Must be one of user, app, or group","in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EntityGrant"}}}},"400":{"description":"Illegal entity ID.\\\n Illegal action value.\\\n Invalid HERE Resource Name format.\\\n Entity type is required.\\\n Illegal entity type."},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"description":"You do not have permission to perform this action.\\\n Reserved resource prefix is required for this action.\\\n Realm of the entity does not match the realm of the caller.\\\n Realm not found."},"404":{"description":"Resource or App not found"}}},"delete":{"operationId":"removeGrant","summary":"Revoke access to a resource from an entity","description":"Revoke access to a resource from an entity. The result of this call is\nthat the specified entity will have any directly assigned permission to\ntake the specified action against the specified resource removed.\n\n</br>Access Control:\n  * The calling principal must have either **\"removeGrant:{actionId}\"** or **\"share\"** action permission for the resource **\"{resourceHrn}\"** in the **\"authorization\"** service.\n  * The realm of the calling principal MUST match the realm of the requested entity.\n  * The calling principal MUST NOT include a project scope.\n","tags":["Grants"],"parameters":[{"name":"resourceHrn","required":true,"description":"The hrn that identifies the resource","in":"path","schema":{"type":"string"}},{"name":"entityId","required":true,"description":"The target entityId to revoke access from","in":"path","schema":{"type":"string"}},{"name":"actionId","required":true,"description":"The action against the resource to revoke access from","in":"path","schema":{"type":"string"}},{"name":"entityType","required":true,"description":"The type of the entity to revoke access from.  Must be one of user, app, or group","in":"query","schema":{"type":"string"}}],"responses":{"204":{"$ref":"#/components/responses/NoContent"},"400":{"description":"Illegal entity ID.\\\n Illegal action value.\\\n Invalid HERE Resource Name format.\\\n Entity type is required.\\\n Illegal entity type."},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"description":"You do not have permission to perform this action.\\\n Reserved resource prefix is required for this action.\\\n Realm of the entity does not match the realm of the caller.\\\n Realm not found."},"404":{"description":"Resource or App not found"}}}},"/filters":{"parameters":[{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"parameters":[{"$ref":"#/components/parameters/realmFilters"},{"$ref":"#/components/parameters/projectFilters"},{"$ref":"#/components/parameters/typeFilters"},{"$ref":"#/components/parameters/externalIdFilters"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"}],"tags":["Access Filters"],"summary":"Get Access Filters","description":"Retrieve the list of Access Filters available.\n\n</br>Access Control:\n* The calling principal must have **\"readAccessFilters\"** action permission in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getAccessFilters","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilterPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}},"post":{"tags":["Access Filters"],"summary":"Create Access Filter","description":"Create an Access Filter available to be attached to a user or app to control access.\nA maximum of 100 Access Filters may be created in a realm.\n\n</br>Access Control:\n* The calling principal must have **\"manageAccessFilters\"** action permission in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"createAccessFilter","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilterRequest"}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilter"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}}},"/filters/{filterHrn}":{"parameters":[{"$ref":"#/components/parameters/filterHrn"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Access Filters"],"summary":"Get Access Filter","description":"Get the details of an Access Filter.\n\n</br>Access Control:\n* The calling principal must have **\"readAccessFilters\"** action permission in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getAccessFilter","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilter"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"post":{"tags":["Access Filters"],"summary":"Update Access Filter","description":"Update an Access Filter.\n\n</br>Access Control:\n* The calling principal must have **\"manageAccessFilters\"** action permission in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"updateAccessFilter","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilterRequest"}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilter"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"delete":{"tags":["Access Filters"],"summary":"Delete Access Filter","description":"Delete an Access Filter.\n\n</br>Access Control:\n* The calling principal must have **\"manageAccessFilters\"** action permission in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"deleteAccessFilter","responses":{"204":{"$ref":"#/components/responses/NoContent"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/filters/{filterHrn}/members":{"parameters":[{"$ref":"#/components/parameters/filterHrn"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"},{"$ref":"#/components/parameters/realmEntityType"}],"tags":["Access Filters"],"summary":"Get Access Filter Members","description":"Get the list of realm members that are assigned this Access Filter.\n\n</br>Access Control:\n* The calling principal must have **\"readAccessFilters\"** action permission in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getAccessFilterMembers","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilterMemberPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/resources":{"parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/ResourceType"},{"$ref":"#/components/parameters/Access"},{"$ref":"#/components/parameters/Referenceable"},{"$ref":"#/components/parameters/Linkable"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Resource Info and Management"],"summary":"Get a list of resources","operationId":"getResources","description":"Get a list of Resources that the caller is allowed to see based on the input query parameters.\n\n**Note:**\n  - If the presented access token has **a project scope**:\n    - The response will only include resources from that project or,\n    - If **referenceable=true** or **linkable=true**, the response will ONLY include the resources that are available to the caller to\n      link to the project in the token's project scope.\n  - If the presented access token has **no scope**:\n    - For access=**default** or access=**manage**:\n      - The response will include resources from all projects that the caller has access to.\n      - For raiEnabled types, the response will also include resources that exist outside of any project.\n      - For all other types, the response will NOT include resources that exist outside of any project.\n    - For access=**readOutsideProject**:\n      - For raiEnabled types, the response will ONLY include resources that exist outside of a project.\n      - For all other types, the response will be empty.\n    - For **referenceable=true** or **linkable=true**, the response will include the HERE public resources that are available\n      to the caller to link to ANY project and all resources available to be linked to ANY project via \n      Resource Plan Attachments or by virtue of being a Linkable resource to the realm\n  - raiEnabled types = [catalog, service, schema, artifact]\n\n</br>Access Control:\n  * This API works for tokens with or without a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceListDetailedWithPageToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realm/resources":{"parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/Type"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Resource Info and Management"],"summary":"Get List of all the resources in the realm of the caller","operationId":"listRealmResources","description":"Get List of all the resources in the realm of the caller.\n\n</br>Access Control:\n  * The calling principal must have **\"listRealmResources\"** action permission in the **\"authorization\"** service.\n  * This API works only with tokens that are scoped to a project.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceListDetailedWithPageToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realm/externalResources":{"parameters":[{"$ref":"#/components/parameters/externalResourcesResourceType"},{"$ref":"#/components/parameters/externalResourcesAction"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"}],"get":{"tags":["Resource Info and Management"],"summary":"Get external resources available in the realm to the caller.","description":"Get the list of resources that have been made specifically available in the caller's realm via\ndirect Plan, Policy, or ResourcePlan attachments and are accessible to the caller according to the caller's\nAccess Filters.</br>\n\n</br>This will specifically include:</br>\n * Any resource that is accessible in the realm via a Plan attachment to the realm and is an exact match in a permission.\n * Any resource that is accessible in the realm via a Policy attachment to the realm and is an exact match in a permission.\n * Any resource that is accessible in the realm via a ResourcePlan attachment to the realm.\n\n</br>The returned list will ONLY include the above.  In addition, it will be further filtered according to the following:\n * If the caller contains NO project scope, the returned list will ONLY include resources accessible to the\n   caller for **unscoped** access according to the Access Filters associated with the caller.\n * If the caller contains a project scope, the returned list will ONLY include resources accessible to the\n   caller for **scoped** access according to the Access Filters associated with the caller.\n * The returned list WILL NOT contain resources that are only available via wildcard permissions specified\n   in an attached Plan or Policy on the realm.\n\n</br>Access Control:\n  * The calling principal MAY include a project scope.\n","operationId":"getRealmExternalResources","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalResourcePageWithTokenNoTotal"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm not found"}}}},"/resourceTypes/{resourceType}/actions":{"get":{"tags":["Resource Info and Management"],"summary":"Get a list of actions for the resource type","parameters":[{"$ref":"#/components/parameters/ResourceTypePath"},{"$ref":"#/components/parameters/actionType"},{"$ref":"#/components/parameters/XCorrelationId"}],"operationId":"getResourceTypeActionList","description":"Gets the actions list for the resource type based on the query parameters.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ServiceActionsList"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/resources/{resource}":{"parameters":[{"$ref":"#/components/parameters/resource"},{"$ref":"#/components/parameters/ReferenceableSingle"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Resource Info and Management"],"summary":"Get a single resource","operationId":"getResource","description":"Get the Resource that the caller is allowed to see based on\nthe input query parameters\n\n**Note:**\n  - If the presented access token has **a project scope**:\n    - If **referenceable=true**, the response will ONLY return the resource if it is available to the caller to\n      link to the project in the token's project scope.\n  - If the presented access token has **no scope**:\n    - For **referenceable=true**, the response will ONLY return the resource if it is a HERE public resource that is available\n      to the caller to link to ANY project or available to be linked to ANY project via \n      Resource Plan Attachments or by virtue of being a Linkable resource to the realm\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceResponseDetailed"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/resources/{resource}/settings":{"parameters":[{"$ref":"#/components/parameters/resource"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Resource Info and Management"],"summary":"Get the resource settings","operationId":"getResourceSettings","description":"Get the settings of a resource. By default, all resources are available to be added to a resource policy by\nentities that have permission to take the \"requiredToMakeLinkable\" actions against the resource service.\n\n</br>Access Control:\n  * The calling principal must have permission to take all the **\"requiredToMakeLinkable\"** actions against\n    the service inferred via the reserved resource prefix of the resource in the path in the scope of the\n    home project of the resource.\n  * This API works only with tokens that are scoped to the home project of the resource.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceSetting"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"put":{"tags":["Resource Info and Management"],"summary":"Set or update the resource setting","operationId":"updateResourceSettings","description":"Set or update the resource setting. By default, all resources are available to be added to a resource policy by\nentities that have permission to take the \"requiredToMakeLinkable\" actions against the resource service.\nOptionally a developer managing a resource can mark the resource as available to be added to a resource policy\nby any entity within its home realm and choose one or more \"projectLinkingEnabled\" allowed actions for this setting\n\n</br>Access Control:\n  * The calling principal must have permission to take all the **\"requiredToMakeLinkable\"** actions against\n    the service inferred via the reserved resource prefix of the resource in the path in the scope of the\n    home project of the resource.\n  * This API works only with tokens that are scoped to the home project of the resource.\n","security":[{"Bearer":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceSetting"}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceSetting"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/resources/{resource}/projects":{"parameters":[{"$ref":"#/components/parameters/resource"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/Relation"},{"$ref":"#/components/parameters/includeNonMemberProjects"},{"$ref":"#/components/parameters/includeCrossRealmProjects"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Resource Info and Management"],"summary":"Get the requested Projects that the resource belongs to or is referenced in(linked to)","operationId":"getResourceProjects","description":"Get the list of Projects that the resource belongs to or is referenced in(linked to).\nWhen includeCrossRealmProjects=true and a cross-realm trust is established between home project or realm\nof the resource and a project or realm that resource is linked to, then returned list will also include that project.\nIn other cases the returned list will only include projects that are in the caller's realm.\n\n**Note:**\n  - If the presented access token has **a project scope**, the response will include:\n    - The home project of the resource\n    - The list of Projects that the resource has been linked to\n  - If the presented access token has **no scope**, the response will include:\n    - The list of Projects filtered out based on the membership of the caller unless includeNonMemberProjects=true.\n\n</br>Access Control for project scoped call:\n  * The calling principal must have permission to take all the **\"requiredToMakeLinkable\"** actions against\n    the service inferred via the reserved resource prefix of the resource in the path in the scope of the\n    home project of the resource.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceProjectListWithPageToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/resources/{resource}/linkable":{"parameters":[{"$ref":"#/components/parameters/resource"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Resource Info and Management"],"summary":"Get a list of ways the resource has been made linkable","operationId":"getListOfWaysResourceIsLinkable","description":"Get a list of ways this resource has been made linkable.\n\n</br>Access Control:\n  * The calling principal must have permission to take all the **\"requiredToMakeLinkable\"** actions against\n    the service inferred via the reserved resource prefix of the resource in the path in the scope of the\n    home project of the resource.\n  * This API works only with tokens that are scoped to the home project of the resource.\n","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/pageToken"}],"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LinkableResourceList"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"post":{"tags":["Resource Info and Management"],"summary":"Make a resource Linkable","operationId":"makeResourceLinkable","description":"Adds a listing to make this resource linkable to either a project or entire realm. The resource must belong to\na project to be made linkable. Either projectHrn or realmHrn must be provided to make the resource linkable to.\n\n</br>Access Control:\n  * The calling principal must have permission to take all the **\"requiredToMakeLinkable\"** actions against\n    the service inferred via the reserved resource prefix of the resource in the path in the scope of the\n    home project of the resource.\n  * This API works only with tokens that are scoped to the home project of the resource.\n  * This API does not support the resources of type **\"pipeline\"**.\n","security":[{"Bearer":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LinkableResource"}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DetailedLinkableResource"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/resources/{resource}/linkable/{linkableToHrn}":{"parameters":[{"$ref":"#/components/parameters/resource"},{"$ref":"#/components/parameters/linkableToHrn"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Resource Info and Management"],"summary":"Get the linkability of a resource","operationId":"getResourceLinkability","description":"Get the availability for linking this resource to either a project or realm.\n\n</br>Access Control:\n  * The calling principal must have permission to take all the **\"requiredToMakeLinkable\"** actions against\n    the service inferred via the reserved resource prefix of the resource in the path in the scope of the\n    home project of the resource.\n  * This API works only with tokens that are scoped to the home project of the resource.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DetailedLinkableResource"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"put":{"tags":["Resource Info and Management"],"summary":"Update the linkability of a resource","operationId":"updateResourceLinkability","description":"Update the linkability of this resource against the requested project or realm.\n\n</br>Access Control:\n  * The calling principal must have permission to take all the **\"requiredToMakeLinkable\"** actions against\n    the service inferred via the reserved resource prefix of the resource in the path in the scope of the\n    home project of the resource.\n  * This API works only with tokens that are scoped to the home project of the resource.\n  * This API does not support the resources of type **\"pipeline\"**.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LinkableResource"}}}},"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DetailedLinkableResource"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"delete":{"tags":["Resource Info and Management"],"summary":"Remove the linkability of a resource","operationId":"removeResourceLinkability","description":"Remove the linkability of this resource against the requested project or realm.\n**Note:** This action does not have any impact on pre-existing links.\n\n</br>Access Control:\n  * The calling principal must have permission to take all the **\"requiredToMakeLinkable\"** actions against\n    the service inferred via the reserved resource prefix of the resource in the path in the scope of the\n    home project of the resource.\n  * This API works only with tokens that are scoped to the home project of the resource.\n","security":[{"Bearer":[]}],"responses":{"204":{"$ref":"#/components/responses/NoContent"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/resourcePolicies":{"parameters":[{"$ref":"#/components/parameters/XCorrelationId"}],"post":{"tags":["Resource Policies"],"summary":"Create a resource policy","operationId":"createResourcePolicy","description":"Create a resource policy. A resource policy packages resources that are to be made linkable to realms.\nA resource policy can be homed to a project or created outside of the context of a project. Once a resource\nhome is created for the resource policy, all access to the resource policy would need to be in the context of\nthe project scope.\n\nFor an unscoped resource policy, the creator is granted \"manageResourcePolicy\", \"addGrant:manageResourcePolicy\"\naccess on the resource policy HRN. For a resource policy scoped to a project all members of the home project\nget the \"projectEnabled\" action \"manageResourcePolicy\" access on the resource policy.\n\n</br>Access Control:\n  * The calling principal must have **\"createResourcePolicy\"** action permission in the **\"authorization\"** service.\n  * The unscoped access to this api is granted via the default authorization policy.\n  * The scoped access to this api is granted via the default \"projectEnabled\" action for members of the project.\n  * This API works for tokens with or without a project scope.\n","security":[{"Bearer":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourcePolicyRequest"}}}},"responses":{"201":{"description":"Created","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourcePolicy"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}},"get":{"tags":["Resource Policies"],"summary":"Get a list of Resource Policies","operationId":"getResourcePolicies","description":"Get a list of Resource Policies.\nIf an unscoped access token is used, all resource policies(unscoped and scoped) within the realm of the caller are returned.\nIf a project scoped access token is used, resource policies within the project are returned.\n\n</br>Access Control:\n  * The calling principal must have **\"readResourcePolicies\"** action permission in the **\"authorization\"** service.\n  * The unscoped access to this api is granted via the default authorization policy.\n  * The scoped access to this api is granted via the default \"projectEnabled\" action for members of the project.\n  * This API works for tokens with or without a project scope.\n","security":[{"Bearer":[]}],"parameters":[{"$ref":"#/components/parameters/resourceQuery"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/pageToken"}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourcePolicyList"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}}},"/resourcePolicies/{resourcePolicy}":{"parameters":[{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/resourcePolicy"}],"get":{"tags":["Resource Policies"],"summary":"Get a resource policy","operationId":"getResourcePolicy","description":"Get details of a Resource Policy.\n\n</br>Access Control:\n  * The calling principal must have **\"readResourcePolicies\"** action permission in the **\"authorization\"** service.\n  * The unscoped access to this api is granted via the default authorization policy.\n  * The scoped access to this api is granted via the default \"projectEnabled\" action for members of the project.\n  * This API works for tokens with or without a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourcePolicy"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}},"delete":{"tags":["Resource Policies"],"summary":"Delete a resource policy","operationId":"deleteResourcePolicy","description":"Delete a resource policy.\n\n</br>Access Control:\n  * The calling principal must have **\"manageResourcePolicy\"** action permission for the resource **\"{resourcePolicy}\"** in the **\"authorization\"** service.\n  * This API works for tokens with or without a project scope.\n","security":[{"Bearer":[]}],"responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}},"patch":{"tags":["Resource Policies"],"summary":"Update a resource policy","operationId":"updateResourcePolicy","description":"Update a resource policy.\n\n</br>Access Control:\n  * The calling principal must have **\"manageResourcePolicy\"** action permission for the resource **\"{resourcePolicy}\"** in the **\"authorization\"** service.\n  * This API works for tokens with or without a project scope.\n","security":[{"Bearer":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourcePolicyPatchRequest"}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourcePolicy"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}}},"/resourcePolicies/{resourcePolicy}/resources":{"parameters":[{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/resourcePolicy"}],"post":{"tags":["Resource Policies"],"summary":"Add resources to a resource policy","operationId":"addResourcesToResourcePolicy","description":"Add the specified list of resources to the Resource Policy with allowedActions in a batch.\nA maximum of 100 resources may be contained in a single Resource Policy. If a batch would push the\nResourcePolicy over-limit, the entire batch fails with an error code indicating available capacity.\nNote: The allowed actions list must match the Resource's resource setting allowed actions available\nfor resource policy. By default all \"projectLinkingEnabled\" are allowed to be added for a resource\nin a resource policy.\nAdding a resource to a resource policy enables the ability of the resource to be made linkable to other realms.\nThis batch API response returns a status that can be polled to get information about the batch request.\n\n</br>Access Control:\n  * The calling principal must have **\"manageResourcePolicy\"** action permission for the resource **\"{resourcePolicy}\"** in the **\"authorization\"** service.\n    **AND**\n  * According to the resource setting, The calling principal **must either** have permission to take all the \"requiredToMakeLinkable\" actions against\n    the service inferred via the reserved resource prefix of the resource in the path in the scope of the\n    home project of the resource **or** the Resource's resource setting is configured to allow anyone within the\n    home realm of the resource to create a resource policy.\n  * When the access token is project scoped, all the resources added to a resource policy must either be homed or\n    referenced in the project.\n  * This API works for tokens with or without a project scope.\n","security":[{"Bearer":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourcePolicyResourcesPayload"}}}},"responses":{"202":{"description":"Accepted","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourcePolicyResourcesResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}},"get":{"tags":["Resource Policies"],"summary":"Get all resources in a resource policy","operationId":"getAllResourcesInResourcePolicy","description":"Get a list of resources in a Resource Policy.\n\n</br>Access Control:\n  * The calling principal must have **\"readResourcePolicies\"** action permission in the **\"authorization\"** service.\n  * The unscoped access to this api is granted via the default authorization policy.\n  * The scoped access to this api is granted via the default \"projectEnabled\" action for members of the project.\n  * This API works for tokens with or without a project scope.\n","security":[{"Bearer":[]}],"parameters":[{"$ref":"#/components/parameters/Type"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/pageToken"}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourcePolicyResourceList"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}}},"/resourcePolicies/{resourcePolicy}/resources/status/{statusId}":{"get":{"tags":["Resource Policies"],"summary":"Get the status of resource policy resources batch addition","operationId":"getResourcePolicyResourcesStatus","parameters":[{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/resourcePolicy"},{"$ref":"#/components/parameters/statusId"}],"description":"Get the status of resource policy resources batch addition.\n\n</br>Access Control:\n  * The calling principal must have **\"manageResourcePolicy\"** action permission for the resource **\"{resourcePolicy}\"** in the **\"authorization\"** service.\n  * The unscoped access to this api is granted via the default authorization policy.\n  * The scoped access to this api is granted via the default \"projectEnabled\" action for members of the project.\n  * This API works for tokens with or without a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourcePolicyResourcePartialSuccessList"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}}},"/resourcePolicies/{resourcePolicy}/resources/{resource}":{"parameters":[{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/resourcePolicy"},{"$ref":"#/components/parameters/resource"}],"put":{"tags":["Resource Policies"],"summary":"Add a resource to a resource policy","operationId":"addResourceToResourcePolicy","description":"Add a resource to the Resource Policy with allowedActions.\nA maximum of 100 resources may be contained in a single Resource Policy.\nNote: The allowed actions list must match the Resource's resource setting allowed actions available\nfor resource policy. By default all \"projectLinkingEnabled\" are allowed to be added for a resource\nin a resource policy.\nAdding a resource to a resource policy enables the ability of the resource to be made linkable to other realms.\n\n</br>Access Control:\n  * The calling principal must have **\"manageResourcePolicy\"** action permission for the resource **\"{resourcePolicy}\"** in the **\"authorization\"** service.\n    **AND**\n  * According to the resource setting, The calling principal **must either** have permission to take all the \"requiredToMakeLinkable\" actions against\n    the service inferred via the reserved resource prefix of the resource in the path in the scope of the\n    home project of the resource **or** the Resource's resource setting is configured to allow anyone within the\n    home realm of the resource to create a resource policy.\n  * When the access token is project scoped, all the resources added to a resource policy must either be homed or\n    referenced in the project.\n  * This API works for tokens with or without a project scope.\n","security":[{"Bearer":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourcePolicyResource"}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourcePolicyResource"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}},"get":{"tags":["Resource Policies"],"summary":"Get a resource in a resource policy","operationId":"getResourceInResourcePolicy","description":"Get resource in a Resource Policy.\n\n</br>Access Control:\n  * The calling principal must have **\"readResourcePolicies\"** action permission in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n  * The unscoped access to this api is granted via the default authorization policy.\n  * The scoped access to this api is granted via the default \"projectEnabled\" action for members of the project.\n  * This API works for tokens with or without a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourcePolicyResource"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}},"delete":{"tags":["Resource Policies"],"summary":"Delete resource from a resource policy","operationId":"deleteResourceFromResourcePolicy","description":"Delete a resource from a Resource Policy. Also supports comma-separated list of resources in the path for batch\ndelete operation.\n\n</br>Access Control:\n  * The calling principal must have **manageResourcePolicy** action permission for the resource **\"{resourcePolicy}\"** in the **\"{authorization}\"** service.\n    **OR**\n  * The calling principal **must** have permission to take all the \"requiredToMakeLinkable\" actions against\n    the service inferred via the reserved resource prefix of the resource in the path in the scope of the\n    home project of the resource.\n  * This API works for tokens with or without a project scope.\n","security":[{"Bearer":[]}],"responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}}},"/projects":{"post":{"tags":["Project Management"],"summary":"Create the requested Project","operationId":"createProject","description":"Create the requested Project in the callers realm\n\n</br>Access Control:\n  * The calling principal must have **\"createProject\"** action permission in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","parameters":[{"$ref":"#/components/parameters/XCorrelationId"}],"security":[{"Bearer":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectRequest"}}}},"responses":{"201":{"description":"Created","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}},"get":{"tags":["Project Management"],"summary":"Get the list of all Projects in the Org","operationId":"getAllProjectList","description":"Get the list of all Projects in the Organization.\n\n</br>Access Control:\n  * The calling principal must have **\"listAllProjects\"** action permission in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","parameters":[{"$ref":"#/components/parameters/realmProjectSearch"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/XCorrelationId"}],"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectListWithPageToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}}},"/projects/me":{"parameters":[{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/canManage"},{"$ref":"#/components/parameters/isMember"}],"get":{"tags":["Project Management"],"summary":"Get the list of Projects that you are a project admin or a member based on the \"canManage\" or \"isMember\" parameter's value","operationId":"getProjectList","description":"Get the list of Projects you are a  project admin or a member based on the \"canManage\" or \"isMember\" parameter's value.\n\n</br>**Note:** If neither \"canManage\" nor \"isMember\" is specified, \"isMember=true\" projects are returned. Supported values for \"canManage\" / \"isMember\" is : [true]\n\n</br>Access Control:\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectListWithPageToken"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"}}}},"/projects/{project}":{"parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Project Management"],"summary":"Get the requested Project","operationId":"getProject","description":"Get the requested Project.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectResponse"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"head":{"tags":["Project Management"],"summary":"Checks the existance of a project in caller realm.","operationId":"checkProjectExistance","description":"Checks whether a project exists with requested project hrn in caller realm. If project does not exist in the same realm it will return 404.\n\n</br>Access Control:\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK - project exists","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}},"patch":{"tags":["Project Management"],"summary":"Update the specified Project","operationId":"patchProject","description":"Update the specified Project.\n\n</br>Access Control:\n  * The calling principal must have **\"write\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PatchProject"}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"delete":{"tags":["Project Management"],"summary":"Delete the specified Project","operationId":"deleteProject","description":"Delete the specified Project.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"202":{"description":"Accepted","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/projects/{project}/resources":{"get":{"parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/Type"},{"$ref":"#/components/parameters/Relation"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/XCorrelationId"}],"tags":["Project Resource Management"],"summary":"Get the list of resources in the requested Project & referenced in(linked to) the Project","operationId":"listProjectResources","description":"Get the list of resources in the requested Project & referenced in(linked to) the Project.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceInProjectListWithPageToken"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"post":{"tags":["Project Resource Management"],"summary":"Add resources to the requested Project as a Resource Home or Resource Reference(Link)","operationId":"addProjectResourceRelations","parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/ResourceRelation"},{"$ref":"#/components/parameters/ProjectResourceType"},{"$ref":"#/components/parameters/XCorrelationId"}],"description":"Add a list of resources to the requested Project as a home or a reference(link).\n\n</br>Access Control:\n  * **When relation=home**,\n\n    The requested resources will be assigned to the requested project as their resource home. This API is idempotent.\n    Any preexisting resources that already are homed to the specified project, will be silently ignored.\n    Resource type must be specified either in query parameter or for individual resources.\n    When resource type is specified in individual resources, it will take precedence over resource type specified as query parameter.\n\n    * The calling principal must have **manageResourceHome** action permission for the resource **\"{project}\"** **AND** the **share** action for the resource **\"{resource}\"** in the **\"{authorization}\"** service.\n    * The calling principal must have **manageResourceHome** action permission for the specified project in the **\"{authorization}\"** service **AND** all **requiredToAddToProjects** actions defined by the service for the resource **\"{resource}\"**.\n    * The calling principal MUST NOT include a project scope.\n  * **When relation=reference**,\n\n    Link the resource to the requested Project as a reference(link). The requested resources will be assigned to the requested\n    project as reference(link). The resources **MUST** be available to the caller to attach as a resource reference(link).\n    A resource is referenceable if it has been marked as referenceable and the caller has permission to all\n    reference enabled actions against the resource OR The resource has been made linkable to the project/realm for\n    the project linking enabled action.\n\n    The exclusive list of resources available to the caller to attach as a resource reference(link) is accessible\n    via a call to /resources?referenceable=true or /resources?linkable=true\n\n    * The calling principal must have **manageResourceReferences** action permission for the resource **\"{project}\"** in the **\"{authorization}\"** service.\n    * The calling principal is a **member** of the specified project.\n    * The calling principal must have permission to attach the resource as a referenceable resource. A resource is referenceable to the caller if:\n      * It has been marked as referenceable and The caller has permission to all reference enabled actions against the resource. OR\n      * The resource has been made linkable to the project/realm for the project linking enabled action\n    * This API works for tokens with or without a project scope.\n","requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceRelationList"}}}},"security":[{"Bearer":[]}],"responses":{"201":{"description":"Created","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceRelationResponseList"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/projects/{project}/resources/{resource}":{"get":{"tags":["Project Resource Management"],"summary":"Get a resource that is linked to a Project as either a Resource Home or Resource Reference(Link)","parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/resource"},{"$ref":"#/components/parameters/Relation"},{"$ref":"#/components/parameters/XCorrelationId"}],"operationId":"getProjectResource","description":"Get the resource that is linked to the requested Project. The requested resource\nmay be linked as either a home or a reference(link).\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceInProjectResponse"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"post":{"tags":["Project Resource Management"],"summary":"Add a resource to the requested Project as a Resource Home or Resource Reference(Link)","operationId":"addProjectResourceRelation","parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/resource"},{"$ref":"#/components/parameters/ResourceRelation"},{"$ref":"#/components/parameters/externalId"},{"$ref":"#/components/parameters/ProjectResourceType"},{"$ref":"#/components/parameters/XCorrelationId"}],"description":"Add the resource to the requested Project as a home or a reference(link).\n\n</br>Access Control:\n  * **When relation=home**,\n\n    The requested resource will be assigned the requested project as its resource home.\n    The resource **MUST NOT** already have an existing resource home.\n\n    * The calling principal must have **manageResourceHome** action permission for the resource **\"{project}\"** **AND** the **share** action for the resource **\"{resource}\"** in the **\"{authorization}\"** service.\n    * The calling principal must have **manageResourceHome** action permission for the specified project in the **\"{authorization}\"** service **AND** all **requiredToAddToProjects** actions defined by the service for the resource **\"{resource}\"**.\n    * The calling principal MUST NOT include a project scope.\n  * **When relation=reference**,\n\n    Link the resource to the requested Project as a reference(link).  The requested resource will be assigned to the requested\n    project as reference(link). The resource **MUST** be available to the caller to attach as a resource reference(link).\n    A resource is referenceable if it has been marked as referenceable and the caller has permission to all\n    reference enabled actions against the resource OR The resource has been made linkable to the project/realm for\n    the project linking enabled action.\n\n    The exclusive list of resources available to the caller to attach as a resource reference(link) is accessible\n    via a call to /resources?referenceable=true or /resources?linkable=true\n\n    * The calling principal must have **manageResourceReferences** action permission for the resource **\"{project}\"** in the **\"{authorization}\"** service.\n    * The calling principal is a **member** of the specified project.\n    * The calling principal must have permission to attach the resource as a referenceable resource. A resource is referenceable to the caller if:\n      * It has been marked as referenceable and The caller has permission to all reference enabled actions against the resource. OR\n      * The resource has been made linkable to the project/realm for the project linking enabled action\n    * This API works for tokens with or without a project scope.\n","requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceLinkActionBody"}}}},"security":[{"Bearer":[]}],"responses":{"201":{"description":"Created\n\n* Note: When a resource that has been marked available for linking via the \"Availability\" tab is already linked as a reference, \n        the API will return 201 and update the allowedActions.\n","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceRelationResponse"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"Resource already exists.\n\n* Note: When a resource (service or catalog) is made available for linking via resource plans associated with a realm, \n        the API for linking will return a 409 if the exact configuration that is being linked is already linked. \n        Also, there is a scenario in which a same resource can be linked multiple times with different subresource configurations.\n","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"delete":{"tags":["Project Resource Management"],"summary":"Remove a Resource Relation(Home or Link) from a project","operationId":"deleteProjectResourceReference","parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/resource"},{"$ref":"#/components/parameters/externalIdDelete"},{"$ref":"#/components/parameters/ResourceRelation"},{"$ref":"#/components/parameters/XCorrelationId"}],"description":"Remove the resource from the project.  The requested resource\nmay only be linked as a reference, or added as a home from outside of Projects. Removing other home resource requires\ndeleting the resource from the resource service.\nWhen relation=home, A resource cannot be removed from a project if it belongs to a Resource Policy. Managers of the resource need to remove any\nResourcePolicyAttachments before removing the home.\n\n</br>Access Control:\n  * **When relation=home**,\n    * The calling principal must have **\"manageResourceHome\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service **AND** all **requiredToAddToProjects** actions defined by the service for the specified resource.\n  * **When relation=reference**,\n    * The calling principal must have **\"manageResourceReferences\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service. If not, check if caller is a project member, otherwise check if calling principal can effectively manage the resource.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"204":{"$ref":"#/components/responses/NoContent"},"400":{"$ref":"#/components/responses/BadRequestForDeleteProjectResourceReference"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/projects/{project}/members/{member}":{"parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/projectMember"},{"$ref":"#/components/parameters/XCorrelationId"}],"post":{"tags":["Project Access Management"],"summary":"Add the member to the requested Project","operationId":"addProjectMember","description":"Add the member to the requested Project.\n\n</br>Access Control:\n  * The calling principal must have **\"manageMembers\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK. Project Member already exists","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}}},"201":{"description":"Created","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"get":{"tags":["Project Access Management"],"summary":"Get the requested Project Member","operationId":"getProjectMember","description":"Get the requested Project Member.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectMember"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"delete":{"tags":["Project Access Management"],"summary":"Remove the member from the specified Project","operationId":"deleteProjectMember","description":"Remove the member from the specified Project.\n\n</br>Access Control:\n  * The calling principal must have **\"manageMembers\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"204":{"$ref":"#/components/responses/NoContent"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}}},"/projects/{project}/members/me":{"parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/XCorrelationId"}],"delete":{"tags":["Project Access Management"],"summary":"Remove the caller from the specified Project","operationId":"leaveProject","description":"Remove the caller from the specified Project.\n\n</br>Access Control:\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"204":{"$ref":"#/components/responses/NoContent"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/projects/{project}/members":{"parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/onlyIncludeIdentities"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/limit10"},{"$ref":"#/components/parameters/pageToken"}],"get":{"tags":["Project Access Management"],"summary":"Get the list of members of the Project","operationId":"listProjectMembers","description":"Get the list of members of the Project.\n\n**Note:** If 'onlyIncludeIdentities' query parameter is set to true, 'total' is NOT returned in Response.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Members, Project Admins, Org Admins.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectMemberListWithPageToken"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/projects/{project}/policies":{"parameters":[{"$ref":"#/components/parameters/project"}],"post":{"tags":["Project Access Management"],"summary":"Create the requested Project Policy","operationId":"createProjectPolicy","description":"Create the requested custom policy in the Project.\n\n</br>Access Control:\n  * The calling principal must have **\"managePolicies\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Admins and Resource Managers.\n  * The calling principal MUST NOT include a project scope.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectPolicyRequestBody"}}}},"security":[{"Bearer":[]}],"responses":{"201":{"description":"Created","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectPolicyResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"get":{"tags":["Project Access Management"],"parameters":[{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/ProjectPolicyType"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/pageToken"}],"summary":"List the Policies in a Project","operationId":"getProjectPolicyList","description":"List the Policies that can be attached to members of the Project.\nThis list will contain all the HERE provided policies and any custom user defined policies created in the Project.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Members, Project Admins, Org Admins.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectPolicyListResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/projects/{project}/policies/{policy}":{"parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/projectPolicy"}],"put":{"tags":["Project Access Management"],"summary":"Update the requested Project Policy","operationId":"updateProjectPolicy","description":"Update the requested custom policy in the Project.\n\n</br>Access Control:\n  * The calling principal must have **\"managePolicies\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Admins and Resource Managers.\n  * The calling principal MUST NOT include a project scope.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectPolicyRequestBody"}}}},"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectPolicyResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"get":{"tags":["Project Access Management"],"summary":"Get the Project Policy","operationId":"getProjectPolicy","description":"Get the requested Project Policy.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Members, Project Admins, Org Admins.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectPolicyResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"delete":{"tags":["Project Access Management"],"summary":"Delete the custom Project Policy","operationId":"deleteProjectPolicy","description":"Delete the custom policy in the Project.\n\n</br>Access Control:\n  * The calling principal must have **\"managePolicies\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Admins and Resource Managers.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"204":{"$ref":"#/components/responses/NoContent"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/projects/{project}/policies/{policy}/members":{"parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/projectPolicy"}],"get":{"tags":["Project Access Management"],"parameters":[{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/pageToken"}],"summary":"Get the list of all Project Members with the attached Policy","operationId":"getAllProjectMembersWithAttachedPolicy","description":"Get the list of all Project Members with the attached Policy.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Members, Project Admins, Org Admins.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectMemberListWithPageToken"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/projects/{project}/settings":{"parameters":[{"$ref":"#/components/parameters/project"}],"patch":{"tags":["Project Access Management"],"summary":"Update the ProjectSettings for a Project.","operationId":"updateProjectSettings","description":"Update the Project Settings.\n\n</br>\nThe setting *defaultNewMemberProjectPolicies* defines the default ProjectPolicy(ies) that are applied to \nnew Project members when they are added to the Project.\nFor a newly-created Project, there are two *defaultNewMemberProjectPolicies* set: \n* all-access-all-project-resources\n* resource-creation-access-all-project-resources\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Admins and Resource Managers.\n  * The calling principal MUST NOT include a project scope.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectSettings"}}}},"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectSettings"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"get":{"tags":["Project Access Management"],"summary":"Get the Project Settings.","operationId":"getProjectSettings","description":"Get the Project Settings for the specified Project.\n\nThe setting *defaultNewMemberProjectPolicies* defines the default ProjectPolicy(ies) that are applied to \nnew Project members when they are added to the Project.\nFor a newly-created Project, there are two *defaultNewMemberProjectPolicies* set: \n* all-access-all-project-resources\n* resource-creation-access-all-project-resources\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Members, Project Admins, Org Admins.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectSettings"}}}},"204":{"$ref":"#/components/responses/NoContent"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/projects/{project}/attachedPolicies":{"parameters":[{"$ref":"#/components/parameters/project"}],"post":{"tags":["Project Access Management"],"summary":"Set Attached Policies for all Members","operationId":"setAttachedProjectPoliciesToProject","description":"Sets the Attached Policies list for all Project Members, overwriting any pre-existing Attached Policies at the Project-level.\nSetting these ProjectPolicies as Attached at the Project-level means their permissions will be applied for all Project members.\nProject Policies attached at the Project-level will be added to any Project Policies that have been directly attached to any Member Group, User, App, or Device.\nThe request body will replace any pre-existing Policy attachment(s), and replace that list with those Policies identified in the request body.\n\n</br>**Note:** The maximum number of ProjectPolicies attached at the Project-level is 5.\n\n</br>Access Control:\n  * The calling principal must have both **\"manageMembers\"** and **\"managePolicies\"** action permissions for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Admins and Resource Managers.\n  * The calling principal MUST NOT include a project scope.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedPolicies"}}}},"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedPolicies"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"get":{"tags":["Project Access Management"],"parameters":[{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/pageToken"}],"summary":"Get the list of Attached Project Policies For all Members of a Project","operationId":"getAttachedProjectPoliciesForProject","description":"Get the list of Attached Project Policies For all Members of a Project.\n\n</br>**Note:** The maximum number of ProjectPolicies attached at the Project-level is 5.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Members, Project Admins, Org Admins.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectPolicyListResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/projects/{project}/attachedPolicies/{policy}":{"parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/projectPolicy"}],"post":{"tags":["Project Access Management"],"summary":"Attach a single Project Policy to all Members of a Project","operationId":"attachProjectPolicyToProject","description":"Attaches the Project Policy to all members of the specified Project.\nAttaching a ProjectPolicy at the Project-level means its permissions will be applied for all Project members.\n\n</br>**Note:** The maximum number of ProjectPolicies attached at the Project-level is 5.\n\n</br>Access Control:\n  * The calling principal must have both **\"manageMembers\"** and **\"managePolicies\"** action permissions for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Admins and Resource Managers.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"204":{"$ref":"#/components/responses/NoContent"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"get":{"tags":["Project Access Management"],"summary":"Get the attached Project Policy at the Project-level.","operationId":"getAttachedProjectPolicyForProject","description":"Get the attached Project Policy at the Project-level.\n\n</br>**Note:** The maximum number of ProjectPolicies attached at the Project-level is **5**.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Members, Project Admins, Org Admins.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedPolicy"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"delete":{"tags":["Project Access Management"],"summary":"Detach the Project Policy from the Project-level for all Members","operationId":"detachProjectPolicyFromProject","description":"Detached the requested custom Project Policy from the Project.  \nThe specified ProjectPolicy will no longer be applied to all Project members, \nunless attached to them individually or through their group membership.\n\n</br>The ProjectPolicy is still available to attach to individual members.\n\n</br>Access Control:\n  * The calling principal must have both **\"manageMembers\"** and **\"managePolicies\"** action permissions for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Admins and Resource Managers.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"204":{"$ref":"#/components/responses/NoContent"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/projects/{project}/members/{member}/policies":{"parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/projectMember"}],"post":{"tags":["Project Access Management"],"summary":"Set Attached Policies for Member","operationId":"setAttachedProjectPoliciesToMember","description":"Sets the Attached Policies list for the specified Project Member, overwriting any pre-existing Attached Policies.\nThe request body will replace any pre-existing Policy attachment(s), and replace that list with those Policies identified in the request body.\n\n</br>Access Control:\n  * The calling principal must have both **\"manageMembers\"** and **\"managePolicies\"** action permissions for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Admins and Resource Managers.\n  * The calling principal MUST NOT include a project scope.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedPolicies"}}}},"security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedPolicies"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"get":{"tags":["Project Access Management"],"parameters":[{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/pageToken"}],"summary":"Get the list of Attached Project Policies For a Member","operationId":"getAttachedProjectPoliciesForMember","description":"Get the list of Attached Project Policies For a Member.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Members, Project Admins, Org Admins.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectPolicyListResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/projects/{project}/members/{member}/policies/{policy}":{"parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/projectMember"},{"$ref":"#/components/parameters/projectPolicy"}],"post":{"tags":["Project Access Management"],"summary":"Attach Project Policy to Member","operationId":"attachProjectPolicyToMember","description":"Attaches the Project Policy to the member of the Project.\n\n</br>Access Control:\n  * The calling principal must have both **\"manageMembers\"** and **\"managePolicies\"** action permissions for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Admins and Resource Managers.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"204":{"$ref":"#/components/responses/NoContent"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"get":{"tags":["Project Access Management"],"summary":"Get the attached Project Policy for a Member","operationId":"getAttachedProjectPolicyForMember","description":"Get the attached Project Policy For a Member.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Members, Project Admins, Org Admins.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedPolicy"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"delete":{"tags":["Project Access Management"],"summary":"Detach the Project Policy from a Member","operationId":"detachProjectPolicyFromMember","description":"Detached the requested custom Project Policy from a Member.\n\n</br>Access Control:\n  * The calling principal must have both **\"manageMembers\"** and **\"managePolicies\"** action permissions for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Admins and Resource Managers.\n  * The calling principal MUST NOT include a project scope.\n","security":[{"Bearer":[]}],"responses":{"204":{"$ref":"#/components/responses/NoContent"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/projects/{project}/members/{member}/permissions":{"parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/projectMember"},{"$ref":"#/components/parameters/permissionServiceId"},{"$ref":"#/components/parameters/permissionResourceHrn"},{"$ref":"#/components/parameters/permissionResourceType"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"}],"get":{"tags":["Project Access Management"],"summary":"Get Effective Permissions for Member","description":"Get the list of **scoped** permissions that are effective for this member when operating in the project scope.\n\n</br>Access Control:\n  * The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n  * In the Project workflow, the above permission is granted to all Project Members, Project Admins, Org Admins.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getEffectiveProjectPermissionsForMember","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWithTokenNoTotal"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or realm member not found"}}}},"/projects/{project}/members/{member}/linkable/permissions":{"parameters":[{"$ref":"#/components/parameters/project"},{"$ref":"#/components/parameters/projectMember"},{"$ref":"#/components/parameters/linkablePermissionResourceType"},{"$ref":"#/components/parameters/permissionServiceId"},{"$ref":"#/components/parameters/permissionResourceHrn"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"}],"get":{"tags":["Project Access Management"],"summary":"Get project linkable permissions","description":"Get the list of **linkable** permissions that are associated with resources in the realm that have been\nspecifically made available to be linked to the requested project and can be done so by the requested member.\nNote this list does NOT include linkable permissions associated with resource plans attached to the realm.\n\n</br>Access Control:\n* The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getProjectLinkablePermissions","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or realm member not found"}}}},"/projects/{project}/filter":{"parameters":[{"$ref":"#/components/parameters/project"}],"get":{"tags":["Project Access Management"],"summary":"Get Project Access Filter","description":"Retrieve the Access Filter attached to this project.\n\n</br>Access Control:\n* The calling principal must have **\"read\"** action permission for the resource **\"{project}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getProjectAccessFilter","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilter"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Project not found or no filter attached"}}}},"/crossRealmTrusts":{"get":{"tags":["Cross Realm Trusts"],"parameters":[{"$ref":"#/components/parameters/sourceRealm"},{"$ref":"#/components/parameters/targetRealm"},{"$ref":"#/components/parameters/sourceProject"},{"$ref":"#/components/parameters/targetProject"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"summary":"Get a list of cross realm trusts","operationId":"getCrossRealmTrusts","description":"Get a list of CrossRealmTrusts established for the Realm or Project of the requesting User or App,\nwhere the realm/project is either source or target.\nAn entity can get the CrossRealmTrusts created for its realm/project or granted from its realm/project to other realms/projects\nbased on the \"rlm\" claim in the access token.\nAmong query parameters sourceRealm, sourceProject, targetProject and targetRealm supports only one filter at a time.\nCaller entity's realm must match realm specified in sourceProject or targetProject query parameter.\n\n</br>Access Control:\n  * The calling principal must have **\"readCrossRealmTrust\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service. The **\"{realm}\"** here represents the HRN of the target realm. \n  * This permission is granted to all entities by default policy. This permission is also explicitly granted to all entities with roles OrgAdmin or CrossRealmTrustManager.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CrossRealmTrustListWithPageToken"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/crossRealmTrusts/sources/{sourceProjectOrRealm}/targets/{targetProjectOrRealm}":{"parameters":[{"$ref":"#/components/parameters/sourceProjectOrRealm"},{"$ref":"#/components/parameters/targetProjectOrRealm"},{"$ref":"#/components/parameters/XCorrelationId"}],"post":{"tags":["Cross Realm Trusts"],"summary":"Create or update a cross realm trust","operationId":"createCrossRealmTrust","description":"Create or update a CrossRealmTrust that allows LinkableResources to be received from the source of the resource.\nThe source HRN is defined by either the home project or the realm of the resource.\nThe CrossRealmTrust is established with a target specified in the path which could either be a specific project or the entire realm.\nAn access token from an identity with appropriate privileges in the target realm should be used to create/update the CrossRealmTrust.\n\n</br>Access Control:\n  * The calling principal must have **\"manageCrossRealmTrust\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service. The **\"{realm}\"** here represents the HRN of represent the target realm.\n  * This permission is granted to all entities with roles OrgAdmin or CrossRealmTrustManager.\n  * The calling principal MUST NOT include a project scope.\n","requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CrossRealmTrustRequest"}}}},"responses":{"201":{"description":"Created","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CrossRealmTrust"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"get":{"tags":["Cross Realm Trusts"],"summary":"Get a cross realm trust","operationId":"getCrossRealmTrust","description":"Get a single CrossRealmTrust object identified by source and target realms or projects.\nAn entity can get the CrossRealmTrust created for its realm or granted from its realm to other realms\nbased on the \"rlm\" claim in the access token.\n\n</br>Access Control:\n  * The calling principal must have **\"readCrossRealmTrust\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service. The **\"{realm}\"** here represents the HRN of the target realm. \n  * This permission is granted to all entities by default policy. This permission is also explicitly granted to all entities with roles OrgAdmin or CrossRealmTrustManager.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CrossRealmTrust"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"delete":{"tags":["Cross Realm Trusts"],"summary":"Delete a cross realm trust","operationId":"deleteCrossRealmTrust","description":"Delete an existing CrossRealmTrust to no longer allow LinkableResources to be offered\nby the source Project or Realm into the context of the target Realm or a Project therein.\nDeleting an existing CrossRealmTrust will disable the accessibility of any resources already linked\nto the projects of the target realm. It will also hide any resources already made available to the target realm.\nAn access token from an identity with appropriate privileges in the target realm should be used to delete the CrossRealmTrust.\n\n</br>Access Control:\n  * The calling principal must have **\"manageCrossRealmTrust\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service. The **\"{realm}\"** here represents the HRN of represent the target realm. \n  * This permission is granted to all entities with roles OrgAdmin or CrossRealmTrustManager.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"204":{"description":"No content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/services/{serviceId}":{"parameters":[{"$ref":"#/components/parameters/serviceId"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Services"],"summary":"Get Service Information by service id","operationId":"getServiceInfoById","description":"Get service information by service id.\n\n</br>Access Control:\n  * The calling principal must have **\"readServices\"** action permission in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ServiceInformation"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/services":{"parameters":[{"$ref":"#/components/parameters/serviceIdAlias"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Services"],"summary":"Get Service Information","operationId":"getServiceInfo","description":"Get service information. \n\n</br>Access Control:\n  * The calling principal must have **\"readServices\"** action permission in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ServiceInformationWithPageToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/services/resourceTypes":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Services"],"summary":"Get Resource Types","operationId":"getResourceTypes","description":"Get resource types for all services.\n\n</br>Access Control:\n  * The calling principal must have **\"readServices\"** action permission in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceTypesWithPageToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}}},"components":{"parameters":{"realmEntityType":{"in":"query","name":"entityType","required":false,"description":"The type of members to return in the result. One of 'user', 'app', or 'car'. If this parameter is omitted, all entity types will be returned.","schema":{"type":"string","enum":["user","app","car"]}},"realmMembersSearch":{"in":"query","name":"q","required":false,"description":"A free text query string used to filter the results. A search against members in the realm will consider the 'userId', 'firstname', 'lastname', 'email', 'clientId', 'name', 'roles', and 'carId' fields of the members. The precise search algorithm used to match members is not specified, but generally any member where one of the considered fields has a full or partial match should be included in the results.","schema":{"type":"string"}},"realmMembersState":{"in":"query","name":"state","required":false,"description":"Only return user members with the given 'state' in the results.","schema":{"type":"string","enum":["enabled","disabled"]}},"realmProjectSearch":{"in":"query","name":"q","required":false,"description":"A free text query string used to filter the results.  A search against projects in the realm will consider the 'id', 'name', 'description', fields of the projects. The precise search algorithm used to match projects is not specified, but generally any projects where one of the considered fields has a full or partial match should be included in the results.","schema":{"type":"string"}},"groupsSearch":{"in":"query","name":"q","required":false,"description":"A free text query string used to filter the results.  A search against groups in the realm will consider the 'id', 'name', and 'description' fields of the groups.  The precise search algorithm used to match groups is not specified, but generally any member where one of the considered fields has a full or partial match should be included in the results.","schema":{"type":"string"}},"groupEntityType":{"in":"query","name":"entityType","required":false,"description":"The type of members to return in the result.  One of 'user', 'app', or 'invite'.  If this parameter is omitted, all entity types will be returned. ","schema":{"type":"string","enum":["user","app","invite"]}},"invitesSearch":{"in":"query","name":"q","required":false,"description":"A free text query string used to filter the results.  A search against invites in the realm will consider the 'firstName', 'lastName', and 'emailAddress' fields of the invites.  The precise search algorithm used to match invites is not specified, but generally any invite where one of the considered fields has a full or partial match should be included in the results.","schema":{"type":"string"}},"member":{"in":"path","name":"member","required":true,"description":"HRN identifying member","schema":{"type":"string"},"example":"hrn:here:account::myrealm:user/HERE-00000000-0000-0000-0000-000000000000"},"entity":{"in":"path","name":"entity","required":true,"description":"HRN identifying a given entity","schema":{"type":"string"}},"externalId":{"in":"query","name":"externalId","example":"A-S00001234","required":false,"description":"For external resource this ID needs to be provided.","schema":{"type":"string"}},"externalIdDelete":{"in":"query","name":"externalId","example":"A-S00001234","required":false,"description":"Delete only the linkedOption with this matching externalId. Note an empty string value for this parameter matches the linkedOption with no externalId value.  If this parameter is omitted, the entire relation and all linkedOptions are removed.  Only relevant when relation=reference.","schema":{"type":"string"}},"externalIdAttachment":{"in":"query","name":"externalId","example":"A-S00001234","required":false,"description":"ExternalId of the attached ResourcePlan to select a specific one. If not set the one with empty externalId is selected.","schema":{"type":"string"}},"externalResourcesResourceType":{"in":"query","name":"type","required":true,"description":"Only include resources of the requested resource type.\n","schema":{"type":"string"}},"externalResourcesAction":{"in":"query","name":"action","required":true,"description":"Only include resources accessible with the requested action via the registered serviceId of the resource's\nresource type.\n","schema":{"type":"string"}},"realm":{"in":"path","name":"realm","required":true,"description":"HRN identifying the realm","schema":{"type":"string"}},"role":{"in":"path","name":"role","required":true,"description":"HRN identifying a given role","schema":{"type":"string"}},"roleName":{"in":"query","name":"roleName","required":false,"description":"The name of the role to be returned in the result set.","schema":{"type":"string"}},"resourceHrn":{"in":"query","name":"resource","required":false,"description":"The hrn of the resource which the roles returned in the result set should be\nassociated with.\n","schema":{"type":"string"}},"roleQuery":{"in":"query","name":"role","required":false,"description":"The HRN of the role the invited user should be assigned.","schema":{"type":"string"}},"groupQuery":{"in":"query","name":"group","required":false,"description":"HRN idenitifying the group to search.\n","schema":{"type":"string"}},"permission":{"in":"path","name":"permission","required":true,"description":"Permission identifier","schema":{"type":"string"}},"count":{"in":"query","name":"count","description":"Number of records to return. Default is 100 records. Maximum is 100 records.","schema":{"type":"integer","minimum":0,"maximum":100,"default":100}},"pageToken":{"name":"pageToken","in":"query","description":"The cursor for pagination. Present only if there is an additional page of data to view.","schema":{"type":"string"},"example":"KuMvTQrdHVVKuMDDdcIvTQrdci1FWdcIHVVci1FW"},"groupId":{"name":"groupId","in":"path","required":true,"description":"HRN identifying a group.","schema":{"type":"string"}},"permissionIdPathParam":{"name":"permissionId","in":"path","required":true,"description":"Permission identifier.","schema":{"type":"string"}},"invite":{"in":"path","name":"invite","required":true,"description":"HRN identifying a given invite.","schema":{"type":"string"}},"resource":{"in":"path","name":"resource","schema":{"type":"string"},"required":true,"description":"The hrn that identifies the resource.\n","example":"hrn:here:data::myrealm:my-catalog"},"linkableToHrn":{"in":"path","name":"linkableToHrn","schema":{"type":"string"},"required":true,"description":"The HRN of the project that the resource is made linkable to or\nthe HRN of the realm that the resource is made linkable to.\nThis property can be used for cross-realm sharing only if cross-realm trust is established.\nIf there is no cross-realm trust established, the linkableToHrn value must be either a project in the same realm as the resource's home project,\nor must be the resource's home project's realm.\n","example":"hrn:here:authorization::myrealm:project/Project-00000"},"project":{"in":"path","name":"project","required":true,"description":"HRN identifying the project","schema":{"type":"string"},"example":"hrn:here:authorization::myrealm:project/my-project-0000"},"projectMember":{"in":"path","name":"member","required":true,"description":"HRN identifying the project member. Either user, app or group","schema":{"type":"string"},"example":"hrn:here:account::myrealm:user/HERE-00000000-0000-0000-0000-000000000000"},"Type":{"in":"query","name":"type","required":false,"description":"The type of the resource.","schema":{"$ref":"#/components/schemas/Type"}},"ProjectResourceType":{"in":"query","name":"type","required":false,"description":"The type of the resource. Required for resource=home. For adding resources of multiple types, use the type property in the request body instead.","schema":{"$ref":"#/components/schemas/Type"}},"resourcePolicy":{"in":"path","name":"resourcePolicy","required":true,"description":"The HRN of the resource policy","schema":{"type":"string"},"example":"hrn:here:authorization::myrealm:resourcePolicy/my-policy-0000"},"resourceQuery":{"in":"query","name":"resource","schema":{"type":"string"},"required":false,"description":"The hrn that identifies the resource.\n","example":"hrn:here:data::myrealm:my-catalog"},"ResourceType":{"in":"query","name":"type","required":true,"description":"The type of the resource.","schema":{"$ref":"#/components/schemas/Type"}},"ResourceTypePath":{"in":"path","name":"resourceType","required":true,"description":"The type of the resource.","schema":{"$ref":"#/components/schemas/Type"}},"Relation":{"in":"query","name":"relation","required":false,"description":"The relation of the resource. A resource is only returned in the response if it matches the requested relation.","schema":{"$ref":"#/components/schemas/Relation"}},"ResourceRelation":{"in":"query","name":"relation","required":true,"description":"The relation of the resource. Must be home or reference(link)","schema":{"$ref":"#/components/schemas/ResourceRelation"}},"RelationResourceReference":{"in":"query","name":"relation","required":true,"description":"The relation of the resource. Must be reference(link)","schema":{"$ref":"#/components/schemas/RelationResourceReference"}},"Referenceable":{"in":"query","name":"referenceable","required":false,"description":"Get all referenceable(linkable) resources available to the caller to attach as a reference(link) to projects. Only supported value is true.\nNote - Can be used as a synonym for linkable\n\nA resource is referenceable(linkable) if it is marked as referenceable:\n  - and the caller has permission to all reference enabled actions against the resource or,\n  - in case of a project scoped token, the caller has effective membership on the projects to attach resources\n    as a reference(link) to the Project.\n","schema":{"type":"boolean"}},"Linkable":{"in":"query","name":"linkable","required":false,"description":"Get all linkable resources available to the caller to attach as a link to project. Only supported value is true.\nNote - Can be used as a synonym for referenceable\n","schema":{"type":"boolean"}},"Access":{"in":"query","name":"access","required":false,"description":"Filter the resources accessible to the caller based on the access types.\nThe default value is 'default'. Not applicable to use along with the query parameter 'referenceable=true' or 'linkable=true'\n\n- If 'default' includes resources where:\n  - The user has access to the resource's home project OR\n  - The user has access to a project that the resource is linked to as a reference OR\n  - The type is raiEnabled and the resource is not in any project and the user has 'read' access to it OR\n  - The type is raiEnabled and the resource is not in any project and the user has 'write' access to it OR\n  - The type is raiEnabled and the resource is not in any project and the user has 'manage' access to it.\n- If 'manage' includes resources where:\n  - The user has access to the resource's home project OR\n  - The type is raiEnabled and the resource is not in any project and the user has 'manage' access to it.\n- If 'readOutsideProject' includes resources where:\n  - The type is raiEnabled and the resource is not in any project and the user has 'read' access to it.\n\nraiEnabled types = [catalog, service, schema, artifact]\n","schema":{"type":"string","enum":["default","manage"]}},"ReferenceableSingle":{"in":"query","name":"referenceable","required":true,"description":"Get the resource only if it is available to the caller to attach as a reference to projects.  A resource is referenceable if it is marked as referenceable and the caller has permission to all reference enabled actions against the resource.  Otherwise 404.  Only supported value is true.","schema":{"type":"boolean"}},"limit":{"in":"query","name":"limit","required":false,"description":"Number of records to return. Default is 100 records. Maximum is 100 records.","schema":{"type":"integer","minimum":0,"maximum":100,"default":100}},"limit10":{"in":"query","name":"limit","required":false,"description":"Number of records to return. Default is 10 records. Maximum is 100 records.","schema":{"type":"integer","minimum":0,"maximum":100,"default":10}},"XCorrelationId":{"in":"header","name":"X-Correlation-ID","schema":{"type":"string"},"required":false,"description":"Correlates HTTP requests between a client and server. If not present in the incoming request, it will be generated.\n"},"XRequestId":{"in":"header","name":"X-Request-ID","schema":{"type":"string"},"required":false,"description":"The unique for the request, used to track this request within the service.  X-Request-ID value is NOT propagated to the downstream services.\n"},"canManage":{"in":"query","name":"canManage","required":false,"description":"if true returns all projects of which the caller(user/app) is a project admin.","schema":{"type":"boolean"}},"isMember":{"in":"query","name":"isMember","required":false,"description":"if true returns all projects of which the caller(user/app) is a member.","schema":{"type":"boolean"}},"onlyIncludeIdentities":{"in":"query","name":"onlyIncludeIdentities","required":false,"description":"If true, returns an effective project members list containing only user and app identities, including those\nthat are members of the project indirectly via a group. It will also return users who are project admins of\nthe specified project, and Resource Managers for the realm. Response will NOT include total number of\nidentities. If false, returns users, apps, and groups that are direct members of the project, excluding any\nusers and apps that only have membership via a group.\nDefaults to false.\n\nSuppose there are a user U and a group G with app A in it.  Suppose user U and group G are the members of the project, then\n* onlyIncludeIdentities=true will return U and A\n* onlyIncludeIdentities=false or absent will return U and G\n","schema":{"type":"boolean"}},"includeNonMemberProjects":{"in":"query","name":"includeNonMemberProjects","required":false,"description":"If true, the list of Projects is **not** filtered out based on the membership of the caller. Defaults to false.","schema":{"type":"boolean"}},"includeCrossRealmProjects":{"in":"query","name":"includeCrossRealmProjects","required":false,"description":"If true, the list of Projects will include projects that resource is linked too across realms, if a valid cross-realm trust is established. Defaults to false.","schema":{"type":"boolean"}},"projectPolicy":{"in":"path","name":"policy","required":true,"description":"HRN identifying the project policy. For HERE provided policies, the HRN format would be - hrn:here:authorization::HERE:platform:policy/read-only-access-to-all-catalogs\n","schema":{"type":"string"},"example":"hrn:here:authorization::myrealm:project/my-project-0000:policy/all-access-catalog-1"},"ProjectPolicyType":{"in":"query","name":"projectPolicyType","required":false,"description":"The type of the Project Policy","schema":{"type":"string","enum":["custom","here-platform"]}},"statusId":{"in":"path","name":"statusId","required":true,"description":"The status id of the resource policy resources batch request\n","schema":{"type":"string"},"example":"STATUS-5161feb8-5bc4-4e1c-a023-f343d6e5c94f"},"actionType":{"in":"query","name":"type","required":true,"description":"The type of action for the resource type.\n\n- projectEnabled : Actions that are enabled for Project access\n- projectLinkingEnabled : Actions that are allowed to be linked\n- projectReferenceEnabled : Actions that are allowed for Project references\n- requiredToMakeLinkable : Actions that are required when an identity is making a resource linkable to a realm or other projects\n- sharingEnabled : Actions that are allowed to be shared\n- projectResourceCreationEnabled : Actions that are marked as resource creation actions for Projects\n","schema":{"type":"string","enum":["projectEnabled","projectLinkingEnabled","projectReferenceEnabled","requiredToMakeLinkable","sharingEnabled","projectResourceCreationEnabled"]}},"sourceProjectOrRealm":{"in":"path","name":"sourceProjectOrRealm","required":true,"description":"HRN identifying the source realm or project","schema":{"type":"string"},"example":"hrn:here:account::rlm-a:project/Project-A"},"targetProjectOrRealm":{"in":"path","name":"targetProjectOrRealm","required":true,"description":"HRN identifying the target realm or project","schema":{"type":"string"},"example":"hrn:here:account::rlm-b:project/Project-B"},"sourceProject":{"in":"query","name":"sourceProject","required":false,"description":"HRN identifying the source project","schema":{"type":"string"},"example":"hrn:here:account::rlm-a:project/Project-A"},"targetProject":{"in":"query","name":"targetProject","required":false,"description":"HRN identifying the target project","schema":{"type":"string"},"example":"hrn:here:account::rlm-b:project/Project-B"},"sourceRealm":{"in":"query","name":"sourceRealm","required":false,"description":"HRN identifying the source realm","schema":{"type":"string"},"example":"hrn:here:account::rlm-a:realm/rlm-a"},"targetRealm":{"in":"query","name":"targetRealm","required":false,"description":"HRN identifying the target realm","schema":{"type":"string"},"example":"hrn:here:account::rlm-b:realm/rlm-b"},"permissionServiceId":{"in":"query","name":"serviceId","required":false,"description":"Only include permissions associated with the requested service","schema":{"type":"string"},"example":"SERVICE-00000000-0000-0000-0000-000000000000"},"policyServiceId":{"in":"query","name":"serviceId","required":false,"description":"Only include policies associated with the requested service","schema":{"type":"string"},"example":"SERVICE-00000000-0000-0000-0000-000000000000"},"planServiceId":{"in":"query","name":"serviceId","required":false,"description":"Only include plans that contain a policy associated with the requested service","schema":{"type":"string"},"example":"SERVICE-00000000-0000-0000-0000-000000000000"},"policyHrn":{"in":"path","name":"policy","required":true,"description":"HRN identifying the policy.\n","schema":{"type":"string"},"example":"hrn:here:authorization::HERE:policy/POLICY-99b7c7d7-867a-4573-8730-4689be1718c9"},"planHrn":{"in":"path","name":"plan","required":true,"description":"HRN identifying the plan.\n","schema":{"type":"string"},"example":"hrn:here:authorization::HERE:plan/PLAN-7316c7e6-9e05-4086-aef3-cd7240e3c92b"},"resourcePlanHrn":{"in":"path","name":"resourcePlan","required":true,"description":"HRN identifying the resource plan.\n","schema":{"type":"string"},"example":"hrn:here:authorization::myrealm:resourcePlan/my-plan-000"},"permissionResourceHrn":{"in":"query","name":"resource","required":false,"description":"Only include permissions effective against the requested resource.\n","schema":{"type":"string"}},"permissionResourceType":{"in":"query","name":"resourceType","required":false,"description":"Only include permissions effective against the requested resource type.\n","schema":{"type":"string"}},"linkablePermissionResourceType":{"in":"query","name":"resourceType","required":true,"description":"Only include permissions effective against the requested resource type.\n","schema":{"type":"string"}},"serviceIdAlias":{"in":"query","name":"serviceIdAlias","required":true,"description":"The alias for the service id. eg. data, pipeline","schema":{"type":"string"}},"serviceId":{"in":"path","name":"serviceId","required":true,"description":"The ID of the service to look up the information","schema":{"type":"string"},"example":"SERVICE-00000000-0000-0000-0000-000000000000"},"limitType":{"in":"query","name":"type","required":false,"description":"The type of the limit.","schema":{"type":"string"},"example":"MaxEntityApps"},"filterHrn":{"in":"path","name":"filterHrn","required":true,"description":"HRN identifying the filter.","schema":{"type":"string"},"example":"hrn:here:authorization::HERE:filter/FILTER-7316c7e6-9e05-4086-aef3-cd7240e3c92b"},"actionPolicy":{"name":"actionPolicy","in":"path","description":"HRN identifying the service action policy","required":true,"example":"hrn:here:authorization::HERE:actionpolicy/ACTIONPOLICY-0000","schema":{"type":"string"}},"realmFilters":{"in":"query","name":"realm","required":false,"description":"If true, only include Access Filters that could be attached to a realm","schema":{"type":"boolean"}},"projectFilters":{"in":"query","name":"project","required":false,"description":"If true, only include Access Filters that could be attached to a project","schema":{"type":"boolean"}},"typeFilters":{"in":"query","name":"type","required":false,"description":"Only include Access Filters of the specified type.","schema":{"type":"string","enum":["here-platform","custom","virtual"]}},"externalIdFilters":{"in":"query","name":"externalId","required":false,"description":"Only include virtual Access Filters that are associated with the specific externalId.","schema":{"type":"string"}},"vehicleContractId":{"in":"query","name":"vehicleContractId","required":false,"description":"Only return user members with matching vehicleContractId. Works only when entityType=car","schema":{"type":"string"}}},"requestBodies":{"Group":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Group"}}},"required":true}},"securitySchemes":{"Bearer":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Bearer Access Token issued to either the User or Client."}},"headers":{"XCorrelationId":{"schema":{"type":"string"},"required":false,"description":"Correlates HTTP requests between a client and server. If not present in the incoming request, it will be generated.\n"},"XRequestId":{"schema":{"type":"string"},"required":false,"description":"The unique id for the request, used to track this request within the service. X-Request-ID value is NOT propagated to the downstream services."}},"schemas":{"ActivePermission":{"allOf":[{"$ref":"#/components/schemas/ActivePermissionNoResource"},{"type":"object","properties":{"resource":{"readOnly":true,"type":"string","description":"The resource identifier that this permission is controlling access to for the given action.","example":"hrn:here:data:::service-catalog"}}}]},"ActivePermissionNoResource":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier of the permission in the context of the client.  Begins with \"PERM-\".","readOnly":true,"example":"PERM-00000000-0000-0000-0000-000000000000"},"action":{"type":"string","description":"The specific action identifier that this permission is controlling access to for the specific associated service.","readOnly":true,"example":"read"},"effect":{"readOnly":true,"type":"string","description":"One of \"allow\" or \"deny\"","enum":["allow","deny"],"example":"allow"},"serviceId":{"readOnly":true,"type":"string","description":"Identifies the service that this permission is associated with.","example":"SERVICE-00000000-0000-0000-0000-000000000000"}}},"PermissionWithSubresources":{"allOf":[{"$ref":"#/components/schemas/ActivePermission"},{"type":"object","properties":{"subresources":{"$ref":"#/components/schemas/subresources"},"expiresAt":{"type":"string","example":"2030-05-26T19:30:00Z","format":"date-time","description":"The UTC time when the permission expires.\n"}}}]},"AppInfo":{"type":"object","properties":{"clientId":{"readOnly":true,"type":"string","description":"Identifier for the client/application.","example":"0123456789ABCDEFGHHIJKLM"},"clientHrn":{"readOnly":true,"type":"string","description":"HRN for the client/application.","example":"hrn:here:account::myrealm:app/0123456789ABCDEFGHHIJKLM"},"realm":{"readOnly":true,"type":"string","description":"A realm to which app belongs to.","example":"myrealm"},"name":{"readOnly":true,"type":"string","description":"Human readable name of the client.","example":"Some Application"},"description":{"readOnly":true,"type":"string","description":"Prose description of the client.","example":"Application for doing something."},"ownerId":{"readOnly":true,"type":"string","description":"The id of the user that owns this client.","example":"HERE-00000000-0000-0000-0000-000000000000"},"ownerHrn":{"readOnly":true,"type":"string","description":"The hrn of the user that owns this client.","example":"hrn:here:account::myrealm:user/HERE-00000000-0000-0000-0000-000000000000"},"defaultScope":{"readOnly":true,"type":"string","description":"The default value for the \"scope\" parameter when requesting a client_credentials OAuth2 token if no \"scope\" parameter is specified.","example":"hrn:here:authorization::myrealm:project/my-project-0000"},"isRestrictedScope":{"readOnly":true,"type":"boolean","description":"If true, the app cannot request a token with a scope different from defaultScope.","example":true},"appCreationEnabled":{"readOnly":true,"type":"boolean","description":"If true, the app can create apps.","example":true},"alwaysProjectScope":{"readOnly":true,"type":"boolean","description":"Indicates whether or not the given application is locked to the default scope. The given application cannot be added to any additional projects or groups when this value is set to true.","example":true},"status":{"readOnly":true,"type":"string","enum":["active","expired","blacklisted","deactivated","monitoring","quota_exceeded"],"description":"Status of the application","example":"active"},"roles":{"type":"array","items":{"type":"string"},"maxItems":100,"description":"The list of roles assigned to the app.\n","example":["OrgAdmin","GroupAdmin"]}}},"CompactRealmInfo":{"type":"object","required":["realmId","realm","name","inviteOnly","enabled"],"properties":{"realmId":{"readOnly":true,"type":"string","description":"The unique identifier of the realm.","example":"myrealm"},"realm":{"readOnly":true,"type":"string","description":"HRN for the realm.","example":"hrn:here:account::myrealm:realm/myrealm"},"name":{"readOnly":true,"type":"string","description":"HERE realm for OLP."},"realmType":{"type":"string","description":"Realm type of the realm.","example":"olp","enum":["olp","auto","consumer"]},"inviteOnly":{"type":"boolean","description":"Whether the realm can be joined with an invitation only.","example":false},"enabled":{"type":"boolean","description":"The realm status.","example":true},"allowedLogins":{"type":"array","description":"allowed authentication methods for this realm","items":{"type":"object","description":"Authentication methods allowed for this realm","required":["method"],"properties":{"method":{"type":"string","description":"the authentication method.","example":"saml","enum":["password","saml","mtls"]},"url":{"type":"string","description":"Https URL callback function required when method is saml","example":"https://api.example.com/saml/"}}}}}},"GroupInfo":{"type":"object","properties":{"id":{"readOnly":true,"type":"string","description":"The id of the group..","example":"GROUP-00000000-0000-0000-0000-000000000000"},"hrn":{"readOnly":true,"type":"string","description":"The hrn of the group..","example":"hrn:here:authorization::myrealm:group/GROUP-00000000-0000-0000-0000-000000000000"},"name":{"readOnly":true,"type":"string","description":"A user assigned name for the group.","example":"Group  name"}}},"ProjectMemberGroupInfo":{"type":"object","properties":{"groupId":{"readOnly":true,"type":"string","description":"The id of the group..","example":"GROUP-00000000-0000-0000-0000-000000000000"},"groupHrn":{"readOnly":true,"type":"string","description":"The hrn of the group..","example":"hrn:here:authorization::myrealm:group/GROUP-00000000-0000-0000-0000-000000000000"},"name":{"readOnly":true,"type":"string","description":"A user assigned name for the group.","example":"Group  name"}}},"UserInfo":{"type":"object","properties":{"userId":{"readOnly":true,"type":"string","description":"The unique identifier of the user.","example":"HERE-00000000-0000-0000-0000-000000000000"},"userHrn":{"readOnly":true,"type":"string","description":"The HRN of the user.","example":"hrn:here:account::myrealm:user/HERE-00000000-0000-0000-0000-000000000000"},"realm":{"readOnly":true,"type":"string","description":"A realm which the user belongs to.","example":"myrealm"},"firstname":{"readOnly":true,"type":"string","description":"The first name of the user. Only included if entityType is user","example":"John"},"lastname":{"readOnly":true,"type":"string","description":"The lastname of the user.  Only included if entityType is user","example":"Williams"},"email":{"readOnly":true,"type":"string","description":"Email address of the user.  Only included if entityType is user","example":"john.williams@example.com"},"state":{"readOnly":true,"type":"string","description":"The status of this user.","example":"enabled","enum":["deleted","disabled","locked","enabled"]},"realmInfo":{"$ref":"#/components/schemas/CompactRealmInfo"},"roles":{"type":"array","items":{"type":"string"},"maxItems":100,"description":"The list of roles assigned to the user.\n","example":["OrgAdmin","GroupAdmin"]}}},"VehicleInfo":{"type":"object","properties":{"userId":{"readOnly":true,"type":"string","description":"The unique identifier of the vehicle.","example":"HERE-00000000-0000-0000-0000-000000000000"},"userHrn":{"readOnly":true,"type":"string","description":"The HRN of the vehicle.","example":"hrn:here:account::myrealm:user/HERE-00000000-0000-0000-0000-000000000000"},"realm":{"readOnly":true,"type":"string","description":"A realm which the vehicle belongs to.","example":"myrealm"},"carId":{"type":"string","description":"CarId representing an external unique identifier of the vehicle.\n","example":"HashedVehicleVIN"},"vehicleContractId":{"type":"string","description":"Contract identifier specified by OEM.\n","example":"XY/1234"},"state":{"readOnly":true,"type":"string","description":"The status of this user.","example":"enabled","enum":["deleted","disabled","locked","enabled"]},"realmInfo":{"$ref":"#/components/schemas/CompactRealmInfo"},"roles":{"type":"array","items":{"type":"string"},"maxItems":100,"description":"The list of roles assigned to the user.\n","example":["OrgAdmin","GroupAdmin"]}}},"RealmMemberUserInfo":{"allOf":[{"$ref":"#/components/schemas/UserInfo"},{"$ref":"#/components/schemas/VehicleInfo"},{"type":"object","properties":{"createdTime":{"type":"integer","format":"int64","description":"Timestamp (milliseconds since the Unix epoch) when the user was created.","example":1432216394712}}}]},"RealmMemberAppInfo":{"allOf":[{"$ref":"#/components/schemas/AppInfo"},{"type":"object","properties":{"createdTime":{"type":"integer","format":"int64","description":"Timestamp (milliseconds since the Unix epoch) when the app was created.","example":1432216394712}}}]},"InviteInfo":{"type":"object","properties":{"inviteId":{"readOnly":true,"type":"string","description":"The unique identifier of the invite","example":"AUTHINVITE-bd1d1f02-c8f3-4a20-ba57-49b7ddcd9b33"},"inviteHrn":{"readOnly":true,"type":"string","description":"The HRN of the invite","example":"hrn:here:account::myrealm:invite/AUTHINVITE-bd1d1f02-c8f3-4a20-ba57-49b7ddcd9b33"},"realm":{"readOnly":true,"type":"string","description":"The realm which the invite is associated with","example":"myrealm"},"firstname":{"readOnly":true,"type":"string","description":"The first name of the user this invite is for.","example":"John"},"lastname":{"readOnly":true,"type":"string","description":"The last name of the user this invite is for.","example":"Williams"},"email":{"readOnly":true,"type":"string","description":"Email address of the user this invite is for.","example":"john.williams@example.com"}}},"EntityId":{"type":"object","properties":{"id":{"readOnly":true,"type":"string","description":"The unique identifier of the user, app, or group.","example":"HERE-00000000-0000-0000-0000-000000000000"},"hrn":{"readOnly":true,"type":"string","description":"The HRN of the user, app, or group.","example":"hrn:here:account::myrealm:user/HERE-00000000-0000-0000-0000-000000000000"},"realmHrn":{"readOnly":true,"type":"string","description":"The realm HRN of this entity.","example":"hrn:here:account::myrealm:realm/myrealm"},"type":{"readOnly":true,"type":"string","description":"The type of this entity. One of user, app, or group","example":"user"}}},"EntityGrant":{"type":"object","properties":{"entityId":{"$ref":"#/components/schemas/EntityId"},"user":{"$ref":"#/components/schemas/UserInfo"},"app":{"$ref":"#/components/schemas/AppInfo"},"group":{"$ref":"#/components/schemas/GroupInfo"},"permissions":{"readOnly":true,"type":"array","description":"List of permissions","items":{"$ref":"#/components/schemas/ActivePermission"}}}},"EntityGrantCrossRealm":{"type":"object","properties":{"entityId":{"$ref":"#/components/schemas/EntityId"},"permissions":{"readOnly":true,"type":"array","description":"List of permissions","items":{"$ref":"#/components/schemas/ActivePermission"}}}},"EntityGrantsList":{"type":"object","description":"If includeCrossRealmGrants is true then EntityGrantsCrossRealm will be returned.","oneOf":[{"$ref":"#/components/schemas/EntityGrants"},{"$ref":"#/components/schemas/EntityGrantsCrossRealm"}]},"EntityGrants":{"type":"object","properties":{"total":{"readOnly":true,"type":"integer","description":"Total entities"},"pageToken":{"readOnly":true,"type":"string","description":"The pageToken used to retrieve the next page of entities"},"count":{"readOnly":true,"type":"integer","description":"count of page"},"data":{"readOnly":true,"type":"array","description":"List of users, apps, or groups and their associated permissions.","items":{"$ref":"#/components/schemas/EntityGrant"}}}},"EntityGrantsCrossRealm":{"type":"object","properties":{"total":{"readOnly":true,"type":"integer","description":"Total entities"},"pageToken":{"readOnly":true,"type":"string","description":"The pageToken used to retrieve the next page of entities"},"count":{"readOnly":true,"type":"integer","description":"count of page"},"data":{"readOnly":true,"type":"array","description":"List of entity ids and their associated permissions.","items":{"$ref":"#/components/schemas/EntityGrantCrossRealm"}}}},"PageWToken":{"type":"object","properties":{"total":{"readOnly":true,"example":10,"type":"integer","description":"Total entities"},"pageToken":{"readOnly":true,"example":"7afd7f8e94eb4844ba45","type":"string","description":"The pageToken used to retrieve the next page of entities"},"count":{"readOnly":true,"example":2,"type":"integer","description":"number of items returned"}}},"GroupPageWToken":{"allOf":[{"$ref":"#/components/schemas/PageWToken"},{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Group"}}},"example":{"total":10,"pageToken":"7afd7f8e94eb4844ba45","count":2,"data":[{"id":"GROUP-99b7c7d7-867a-4573-8730-4689be1718c9","hrn":"hrn:here:authorization::myrealm:group/GROUP-99b7c7d7-867a-4573-8730-4689be1718c9","name":"Power Users","description":"This is the Power Users group"},{"id":"GROUP-85e5c3f7-a866-1248-3690-18c94689be17","hrn":"hrn:here:authorization::myrealm:group/GROUP-85e5c3f7-a866-1248-3690-18c94689be17","name":"Data scientist","description":"This is the Data scientist group"}]}}]},"Group":{"type":"object","required":["name"],"properties":{"id":{"type":"string","example":"GROUP-99b7c7d7-867a-4573-8730-4689be1718c9","readOnly":true},"hrn":{"type":"string","example":"hrn:here:authorization::myrealm:group/GROUP-99b7c7d7-867a-4573-8730-4689be1718c9","readOnly":true},"name":{"type":"string","description":"A user defined name for the group.\nThe following characters are not allowed in the group name: control characters, non-breaking space, and * / < > \\  |\n","example":"Power Users"},"realm":{"type":"string","example":"HERE","readOnly":true},"description":{"type":"string","maxLength":500,"description":"An optional user defined description for the group.\n\nThe following characters are not allowed in the group name: control\ncharacters, non-breaking space, and * / < > \\  |\n","example":"This is the power users group"}}},"PermissionPageWToken":{"allOf":[{"$ref":"#/components/schemas/PageWToken"},{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ActivePermission"}}}}]},"PermissionPageWithToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ActivePermission"}}}}]},"PermissionPageWithTokenNoTotal":{"allOf":[{"$ref":"#/components/schemas/PageWithTokenNoTotal"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ActivePermission"}}}}]},"PermissionWithSubresourcesPageWithToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PermissionWithSubresources"}}}}]},"RealmMember":{"type":"object","properties":{"memberHrn":{"type":"string","example":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899"},"entityType":{"type":"string","enum":["user","app","car"]},"info":{"$ref":"#/components/schemas/RealmMemberInfo"}}},"GroupMember":{"type":"object","properties":{"memberHrn":{"type":"string","example":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899"},"entityType":{"type":"string","enum":["user","app","invite"]},"info":{"$ref":"#/components/schemas/GroupMemberInfo"}}},"RealmMemberPageWToken":{"allOf":[{"$ref":"#/components/schemas/PageWToken"},{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/RealmMember"},"example":[{"memberHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899","entityType":"user","info":{"userId":"HERE-64badba9-4242-4859-88d5-74563a8f0899","userHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899","realm":"myrealm","firstname":"John","lastname":"Williams","email":"john.williams@example.com","roles":["OrgAdmin","GroupAdmin"],"state":"enabled","createdTime":1432216394712}},{"memberHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0890","entityType":"car","info":{"userId":"HERE-64badba9-4242-4859-88d5-74563a8f0890","userHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0890","realm":"myrealm","carId":"HashedVehicleVIN","vehicleContractId":"XY/1234","roles":["OrgAdmin","GroupAdmin"],"state":"enabled","createdTime":1432216394712}},{"memberHrn":"hrn:here:account::myrealm:app/0123456789ABCDEFGHHIJKLM","entityType":"app","info":{"clientId":"0123456789ABCDEFGHHIJKLM","clientHrn":"hrn:here:account::myrealm:app/0123456789ABCDEFGHHIJKLM","realm":"myrealm","name":"Some Application","description":"Application for doing something.","ownerId":"HERE-00000000-0000-0000-0000-000000000000","ownerHrn":"hrn:here:account::myrealm:user/HERE-00000000-0000-0000-0000-000000000000","defaultScope":"hrn:here:authorization::myrealm:project/my-project-0000","isRestrictedScope":"true","appCreationEnabled":"true","alwaysProjectScope":"true","status":"active","roles":["OrgAdmin","GroupAdmin"],"state":"enabled","createdTime":1432216394712}}]}}}]},"AccessFilterMember":{"type":"object","properties":{"memberHrn":{"type":"string","example":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899"},"entityType":{"type":"string","enum":["user","app","car"]}}},"AccessFilterMemberPageWithToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/AccessFilterMember"}}}}]},"RealmLimitPageWithToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/RealmLimit"}}}}]},"RealmLimit":{"type":"object","properties":{"hrn":{"type":"string","description":"The hrn identifying the limit configuration","example":"hrn:here:authorization::HERE:limit/LIMIT-829fe129-f508-487e-9418-2272b6c565fc"},"type":{"type":"string","description":"The type of limit","example":"MaxEntityApps"},"maximum":{"type":"integer","description":"The maximum value allowed for this limit in this realm","example":100}}},"GroupMemberPageWToken":{"allOf":[{"$ref":"#/components/schemas/PageWToken"},{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/GroupMember"}}}}]},"RoleEntity":{"type":"object","properties":{"entityHrn":{"type":"string","example":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899"},"entityType":{"type":"string","enum":["user","app"]},"info":{"$ref":"#/components/schemas/RoleEntityInfo"}}},"RoleEntityPageWToken":{"allOf":[{"$ref":"#/components/schemas/PageWToken"},{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/RoleEntity"},"example":[{"entityHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899","entityType":"user","info":{"userId":"HERE-64badba9-4242-4859-88d5-74563a8f0899","userHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899","realm":"myrealm","firstname":"John","lastname":"Williams","email":"john.williams@example.com","state":"enabled"}},{"entityHrn":"hrn:here:account::myrealm:app/0123456789ABCDEFGHHIJKLM","entityType":"app","info":{"clientId":"0123456789ABCDEFGHHIJKLM","clientHrn":"hrn:here:account::myrealm:app/0123456789ABCDEFGHHIJKLM","realm":"myrealm","name":"Some Application","description":"Application for doing something.","ownerId":"HERE-00000000-0000-0000-0000-000000000000","ownerHrn":"hrn:here:account::myrealm:user/HERE-00000000-0000-0000-0000-000000000000"}}]}}}]},"RoleShort":{"type":"object","properties":{"hrn":{"type":"string","description":"Unique identifier for this role with partition/realm/etc, an HRN","example":"hrn:here:authorization::myrealm:role/ROLE-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d"},"name":{"type":"string","description":"System defined name for the role","example":"OrgAdmin"}}},"Role":{"type":"object","properties":{"id":{"type":"string","description":"Unique identifier for the role","example":"ROLE-c1662138-a170-4264-ba18-7b506a708c37"},"hrn":{"type":"string","description":"Unique identifier for this role with partition/realm/etc, an HRN","example":"hrn:here:authorization::myrealm:role/ROLE-c1662138-a170-4264-ba18-7b506a708c37"},"name":{"type":"string","description":"System defined name for the role","example":"GroupAdmin"},"resource":{"type":"string","description":"Represents either Group or Realm HRN for which object is scoped for","example":"hrn:here:authorization::myrealm:group/GROUP-8e270653-f592-45a8-88d7-46d409ccfa8a"}}},"RolePageWToken":{"allOf":[{"$ref":"#/components/schemas/PageWToken"},{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Role"}}}}]},"RolePageWithToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Role"}}}}]},"RealmAuthorizationInvite":{"type":"object","required":["emailAddress"],"properties":{"emailAddress":{"type":"string","description":"The email address to send the invitation to.","example":"Steven@example.com"},"firstName":{"type":"string","description":"The first name of the invitee.","example":"Steven"},"lastName":{"type":"string","description":"The last name of the invitee.","example":"Smith"},"roles":{"type":"array","description":"HRNs of the roles to be assigned to the invitee upon invite accepted.","items":{"type":"string"},"example":["hrn:here:authorization::myrealm:role/ROLE-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d","hrn:here:authorization::myrealm:role/ROLE-9dee6088-3684-47d3-a9ca-fc8004ee51c1"]},"groupHrns":{"type":"array","items":{"type":"string"},"description":"The group memberships to create for this invitation.","example":["hrn:here:authorization::myrealm:group/GROUP-8e270653-f592-45a8-88d7-46d409ccfa8a"]},"allowPasswordLogin":{"type":"boolean","description":"If the realm is configured to support both 'saml' and 'password' logins, allow the user to\nactivate this invite by setting up 'password' credentials. Otherwise, use the default login\nmethod of the realm when activating this invite.\n","example":false}}},"RealmAuthInviteResponse":{"type":"object","properties":{"hrn":{"type":"string","description":"The hrn of the authorization invite.","example":"hrn:here:authorization::myrealm:invite/AUTHINVITE-84477c71-d0ab-451b-bd61-e3c47c16c80b"},"emailAddress":{"type":"string","description":"The email address of the user.","example":"Suzanne@example.com"},"firstName":{"type":"string","description":"The first name of the invitee.","example":"Suzanne"},"lastName":{"type":"string","description":"The last name of the invitee.","example":"Smith"},"roles":{"type":"array","description":"The roles to be assigned to the invitee upon invite accepted.","items":{"$ref":"#/components/schemas/RoleShort"},"example":[{"hrn":"hrn:here:authorization::myrealm:role/ROLE-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d","name":"OrgAdmin"},{"hrn":"hrn:here:authorization::myrealm:role/ROLE-9dee6088-3684-47d3-a9ca-fc8004ee51c1","name":"MonitoringDashboardEditor"}]},"groupHrns":{"type":"array","items":{"type":"string"},"description":"The HRNs of the groups the invitee was added to during invite creation.","example":["hrn:here:authorization::myrealm:group/GROUP-8e270653-f592-45a8-88d7-46d409ccfa8a"]},"creatorHrn":{"type":"string","description":"The HRN of the entity that created the authorization.","example":"hrn:here:account::myrealm:user/HERE-fa438f6e-b41c-479a-bdab-c722feca11d9"},"realmHrn":{"type":"string","description":"The HRN of the realm of the invitation.","example":"hrn:here:account::myrealm:realm/myrealm"},"createdTime":{"type":"integer","format":"int64","description":"Timestamp (milliseconds since the Unix epoch) when the authorization was created.","example":1432216394712},"updatedTime":{"type":"integer","format":"int64","description":"Timestamp (milliseconds since the Unix epoch) when the invite was last sent.","example":1432216437420},"allowPasswordLogin":{"type":"boolean","description":"If the realm is configured to support both 'saml' and 'password' logins, allow the user to\nactivate this invite by setting up 'password' credentials. Otherwise, use the default login\nmethod of the realm when activating this invite.\n","example":false}}},"InviteTargets":{"type":"object","properties":{"targets":{"type":"array","items":{"type":"object","required":["target"],"properties":{"target":{"type":"string","enum":["wegopro"],"description":"An invite target which is supported in the realm.\n","example":"wegopro"},"roleName":{"type":"string","enum":["OrgAdmin","OrgInviter","ResourceManager","CrossRealmTrustManager","LicensingAdmin","MarketplaceConsumer","MarketplaceProvider","MonitoringDashboardEditor","RestrictedAccess"],"description":"An optional roleName that this invite target is mapped to.  If an invite target is mapped to a role,\nan invite with that role sent to a user will by default use the requested invite target in the\ninvite. This value must be unique among all invite targets configured for a realm.\n","example":"RestrictedAccess"}}},"description":"The list of target applications supported in invitations in this realm.\n","example":[{"target":"platform"},{"target":"wegopro","roleName":"RestrictedAccess"}]}}},"InvitePageWToken":{"allOf":[{"$ref":"#/components/schemas/PageWToken"},{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ListInviteResponse"}}}}]},"ListInviteResponse":{"type":"object","properties":{"hrn":{"type":"string","description":"The hrn of the authorization invite.","example":"hrn:here:authorization::myrealm:invite/AUTHINVITE-84477c71-d0ab-451b-bd61-e3c47c16c80b"},"emailAddress":{"type":"string","description":"The email address of the user.","example":"Steven@example.com"},"firstName":{"type":"string","description":"The first name of the invitee.","example":"Steven"},"lastName":{"type":"string","description":"The last name of the invitee.","example":"Smith"},"creatorHrn":{"type":"string","description":"The HRN of the entity that created the authorization.","example":"hrn:here:account::myrealm:user/HERE-fa438f6e-b41c-479a-bdab-c722feca11d9"},"realmHrn":{"type":"string","description":"The HRN of the realm of the invitation.","example":"hrn:here:account::myrealm:realm/myrealm"},"roles":{"type":"array","description":"The roles to be assigned to the invitee upon invite accepted.","items":{"$ref":"#/components/schemas/RoleShort"},"example":[{"hrn":"hrn:here:authorization::myrealm:role/ROLE-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d","name":"OrgAdmin"},{"hrn":"hrn:here:authorization::myrealm:role/ROLE-9dee6088-3684-47d3-a9ca-fc8004ee51c1","name":"MonitoringDashboardEditor"}]},"createdTime":{"type":"integer","format":"int64","description":"Timestamp (milliseconds since the Unix epoch) when the authorization was created.","example":1432216394712},"updatedTime":{"type":"integer","format":"int64","description":"Timestamp (milliseconds since the Unix epoch) when the invite was last sent.","example":1432216437420},"allowPasswordLogin":{"type":"boolean","description":"If the realm is configured to support both 'saml' and 'password' logins, allow the user to\nactivate this invite by setting up 'password' credentials. Otherwise, use the default login\nmethod of the realm when activating this invite.\n","example":false}}},"ResourceHome":{"type":"object","properties":{"type":{"$ref":"#/components/schemas/Type"},"project":{"type":"string","example":"hrn:here:authorization::myrealm:project/Project-00000","description":"The hrn of the project that the resource belongs to\n"}}},"ResourceResponseDetailed":{"type":"object","properties":{"hrn":{"type":"string","example":"hrn:here:data::myrealm:my-catalog","description":"The hrn of the resource\n"},"type":{"$ref":"#/components/schemas/Type"},"home":{"type":"string","example":"hrn:here:authorization::myrealm:project/Project-00000","description":"The hrn of the home project that the resource belongs to\n"},"relation":{"$ref":"#/components/schemas/Relation"},"allowedActions":{"$ref":"#/components/schemas/allowedActions"},"active":{"type":"boolean","example":true,"description":"Indicates whether this resource is active or not for the caller. For\nresources with a relation of type 'home', it is always active.\nIf a reference is not active, the caller may not access the resource via\nproject scope.\n"},"linkOptions":{"$ref":"#/components/schemas/linkOptions"}}},"allowedActions":{"type":"array","items":{"type":"string","example":"readResource"},"description":"The list of actions made available for referencing for the resourceType.\nThese actions must be one of the \"projectLinkingEnabled\" actions of the service inferred via the\nreserved resource prefix of the resource in the path.\n"},"externalId":{"type":"string","maxLength":80,"example":"A-S0001234","description":"ID provided by an external system. For every resource in a target realm this must be unique.\nTypically, this holds the subscription ID used to license the resource. You can have the same\nresource with different external IDs in a target realm. The empty value is valid, and is the\nimplicit value used for resource made explicitly linkable.\n"},"linkOption":{"type":"object","properties":{"externalId":{"$ref":"#/components/schemas/externalId"},"allowedActions":{"$ref":"#/components/schemas/allowedActions"},"subresources":{"$ref":"#/components/schemas/subresources"}}},"linkOptions":{"type":"array","maxItems":50,"description":"This list contains all possible link options for the given resource in the realm.\nIt will repeat the main entry (with an empty `externalId`), as well as any\nadditional entries with unique `externalId` values.\n","example":[{"allowedActions":["readResource"]},{"externalId":"A-S0001234","allowedActions":["readResource"],"subresources":["usa-il-chicago","deu"]}],"items":{"$ref":"#/components/schemas/linkOption"}},"linkedOption":{"type":"object","properties":{"externalId":{"$ref":"#/components/schemas/externalId"},"allowedActions":{"$ref":"#/components/schemas/allowedActions"},"subresources":{"$ref":"#/components/schemas/subresources"},"active":{"type":"boolean","example":true,"description":"For resources with a relation of type 'reference', indicates whether this\nreference is active or not for the caller. If a reference is not active,\nthe caller may not access the resource via project scope.\n\nIf there are multiple link options for a single resource, only some of them might\nbe active. As long as there is at least one active link option, the caller will\nhave access to the resource, but limited to the subresources of the active link options.\n\nA reference is not active, if the relevant ResourcePlan with the associated externalId of\nthe resource link is detached from the realm.\n"}}},"linkedOptions":{"type":"array","maxItems":50,"description":"This list contains all links for the given resource in the project. It\nwill repeat the main entry (with an empty `externalId`), as well as any\nadditional entries with unique `externalId` values.\n","example":[{"allowedActions":["readResource"],"active":true},{"externalId":"A-S0001234","allowedActions":["readResource"],"subresources":["usa-il-chicago","deu"],"active":true}],"items":{"$ref":"#/components/schemas/linkedOption"}},"subresources":{"type":"array","maxItems":10,"items":{"type":"string","maxLength":24},"example":["usa-il-chicago","deu"],"description":"The list of associated subresource identifiers.\n"},"InactiveReason":{"type":"array","items":{"type":"string","enum":["linkableResourceMissing","crossRealmTrustMissing","resourceHomeNotFound","actionNotPermitted","resourceHomeNotReferencable","resourceLinkInactive"]},"example":["linkableResourceMissing"],"description":"Diagnostics information which gives description of reasons in case of active property is 'false'. Developers can always choose to ignore the `InactiveReason` and take no action.\nHowever, the InactiveReason gives a hint as to how the `ResourceLink` could become active again.\n* linkableResourceMissing: the grantor removed the linkable resource.  Developers can either ask the grantor to add the LinkableResource again, or remove this ResourceLink as clean-up.\n* crossRealmTrustMissing: either the grantor's or the grantee's Project/Realm, or both, must complete the Cross-Realm Trust.  Alternatively, remove this ResourceLink as clean-up.\n* resourceHomeNotFound: indicates the ResourceHome no longer exists, which indicates the Resource has been deleted from its home catalog.  Remove this ResourceLink to clean-up.\n* actionNotPermitted: the service's authorizationDescriptor no longer supports the action identified in this ResourceLink.  Either contact the service developer to add support for the action back to the linkable actions, or remove this ResourceLink as clean-up.\n* resourceHomeNotReferenceable: the owner of the Resource has marked the Resource to no longer be referenceable.  Either contact the owner to mark it as referenceable again, or remove this ResourceLink as clean-up.\n* resourceLinkInactive: the ProjectAdmin has marked this ResourceLink as inactive.  Either ask the ProjectAdmin to make it active again, remove the ResourceLink.\n"},"ResourceResponse":{"type":"object","properties":{"hrn":{"type":"string","example":"hrn:here:data::myrealm:my-catalog","description":"The hrn of the resource\n"},"type":{"$ref":"#/components/schemas/Type"},"home":{"type":"string","example":"hrn:here:authorization::myrealm:project/Project-00000","description":"The hrn of the home project that the resource belongs to\n"}}},"ResourceSetting":{"type":"object","required":["resourcePolicyAvailability"],"properties":{"resourcePolicyAvailability":{"type":"object","required":["authorizedTo","allowedActions"],"properties":{"authorizedTo":{"type":"string","enum":["requiredToMakeLinkable","realm"],"example":"requiredToMakeLinkable","description":"The authorization required to add the resource to a resource policy. By default a resource\nis allowed to be added to a resource policy for principals who have the permission to take the\n\"requiredToMakeLinkable\" actions against the resource service. Set to \"realm\" to allow the resource to\nbe added to a resource policy by anyone in the realm with sufficient privileges to create the resource policy.\n"},"allowedActions":{"type":"array","items":{"type":"string","example":"readResource"},"description":"The actions allowed for a resource to be added to a resource policy. By default all \"projectLinkingEnabled\"\nactions can be added as allowed actions for a resource policy. Optionally a developer can also limit the\nactions to be one of any \"projectLinkingEnabled\" actions defined by the service\n"}}}}},"ResourcePolicyRequest":{"type":"object","required":["id","name"],"properties":{"id":{"type":"string","example":"my-vanity-id","description":"The id of the resource policy. The ID must comply to the regex - (^[a-zA-Z0-9][a-zA-Z0-9\\-:]{2,61}[a-zA-Z0-9]$)\n"},"name":{"type":"string","example":"My resource policy","description":"The name of the resource policy\n"},"description":{"type":"string","example":"This is my resource policy","description":"The description of the resource policy\n"}}},"ResourcePolicyPatchRequest":{"type":"object","properties":{"name":{"type":"string","example":"My resource policy","description":"The name of the resource policy\n"},"description":{"type":"string","example":"This is my resource policy","description":"The description of the resource policy\n"}}},"ResourcePolicy":{"type":"object","properties":{"hrn":{"type":"string","example":"hrn:here:authorization::myrealm:resourcePolicy/my-policy-000","description":"The hrn of the resource policy\n"},"id":{"type":"string","example":"my-vanity-id","description":"The id of the resource policy\n"},"name":{"type":"string","example":"My resource policy","description":"The name of the resource policy\n"},"description":{"type":"string","example":"This is my resource policy","description":"The description of the resource policy\n"}}},"ResourcePolicyList":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ResourcePolicy"},"description":"List of resource policies in the realm"}}}]},"ResourcePolicyResource":{"type":"object","properties":{"resource":{"type":"string","example":"hrn:here:data::myrealm:my-catalog","description":"The hrn of the resource\n"},"allowedActions":{"$ref":"#/components/schemas/allowedActions"},"subresources":{"$ref":"#/components/schemas/subresources"}}},"ResourcePolicyResourcesPayload":{"type":"object","properties":{"items":{"type":"array","description":"List of resource policy resources","items":{"$ref":"#/components/schemas/ResourcePolicyResource"}}}},"ResourcePolicyResourceList":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","description":"List of resource policy resources","items":{"$ref":"#/components/schemas/ResourcePolicyResource"}}}}]},"ResourcePolicyResourcesResponse":{"type":"object","properties":{"statusId":{"type":"string","example":"STATUS-5161feb8-5bc4-4e1c-a023-f343d6e5c94f","description":"The status id of the resource policy resources batch request\n"},"href":{"type":"string","example":"https://account.api.here.com/authorization/v1.1/resourcePolicies/hrn:here:authorization::myrealm:resourcePolicy%2Fmy-policy-000/resources/status/STATUS-5161feb8-5bc4-4e1c-a023-f343d6e5c94f","description":"The status url of the resource policy resources batch request\n"}}},"ResourcePolicyResourcePartialSuccessList":{"type":"object","properties":{"status":{"type":"string","enum":["pending","inProgress","failure","success","partialSuccess"],"example":"partialSuccess","description":"The status of the batch call for adding resources to a resource policy\n"},"resource":{"type":"object","properties":{"href":{"type":"string","example":"https://account.api.here.com/authorization/v1.1/resourcePolicies/hrn:here:authorization::myrealm:resourcePolicy%2Fmy-policy-000/resources","description":"Get the resources in the resource policy\n"}}},"items":{"type":"array","description":"List of resource policy resources","items":{"type":"object","properties":{"resource":{"type":"string","example":"hrn:here:data::myrealm:my-catalog","description":"The hrn of the resource\n"},"status":{"type":"integer","example":403,"description":"Status code for the resource add request\n"},"code":{"description":"Service specific error code","type":"string","example":"EXXXYYY"}}}}}},"LinkableResource":{"type":"object","required":["resource","allowedActions"],"properties":{"resource":{"type":"string","example":"hrn:here:data::myrealm:my-catalog","description":"The hrn of the resource\n"},"projectHrn":{"type":"string","example":"hrn:here:authorization::myrealm:project/Project-00000","description":"The hrn of the project that the resource is made linkable to\n"},"realmHrn":{"type":"string","example":"hrn:here:account::myrealm:realm/myrealm","description":"The hrn of the project that the resource is made linkable to\n"},"allowedActions":{"$ref":"#/components/schemas/allowedActions"}}},"DetailedLinkableResource":{"type":"object","allOf":[{"$ref":"#/components/schemas/LinkableResource"},{"type":"object","properties":{"projectId":{"type":"string","example":"my-project-0000","description":"The id of the Project\n"},"projectName":{"type":"string","example":"My Project","description":"The name of the Project\n"},"projectDescription":{"type":"string","example":"This is my demo Project","description":"The description of the Project\n"}}}]},"LinkableResourceList":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/DetailedLinkableResource"},"description":"List of ways the resource has been made linkable"}}}]},"ResourceInProjectResponse":{"type":"object","properties":{"resource":{"type":"string","example":"hrn:here:data::myrealm:my-catalog","description":"The hrn of the resource\n"},"project":{"type":"string","example":"hrn:here:authorization::myrealm:project/my-project-0000","description":"The hrn of the project\n"},"type":{"$ref":"#/components/schemas/Type"},"relation":{"$ref":"#/components/schemas/Relation"},"allowedActions":{"$ref":"#/components/schemas/allowedActions"},"active":{"type":"boolean","example":true,"description":"Indicates whether this resource is active or not for the caller. For\nresources with a relation of type 'home', it is always active.\nIf a reference is not active, the caller may not access the resource via\nproject scope.\n"},"inactiveReason":{"$ref":"#/components/schemas/InactiveReason"},"linkedOptions":{"$ref":"#/components/schemas/linkedOptions"},"forwardPolicyServiceHrn":{"type":"string","description":"The hrn of the service used when the forwardPolicyNames feature is\nrequested in the Decision API for any Resource Links of this Resource Home.\nWhen a Decision API request is made against a Resource Link of this\nResource Home, all of the policies associated with the Realm of the calling identity\n(via either a Plan attached to the Realm or a Policy attached to the Realm)\nthat are associated with this given service will be used to construct the\nX-Policy-Names header in the response if applicable.\n","example":"hrn:here:authorization::HERE:serviceDescriptor/SERVICE-00000000-0000-0000-0000-000000000000"}}},"ResourceRelationResponse":{"type":"object","properties":{"resource":{"type":"string","example":"hrn:here:data::myrealm:my-catalog","description":"The hrn of the resource\n"},"externalId":{"$ref":"#/components/schemas/externalId"},"project":{"type":"string","example":"hrn:here:authorization::olp-here:project/PROJECT-00000000-0000-0000-0000-000000000000","description":"The hrn of the project\n"},"type":{"$ref":"#/components/schemas/Type"},"relation":{"$ref":"#/components/schemas/ResourceRelation"},"allowedActions":{"$ref":"#/components/schemas/allowedActions"},"subresources":{"$ref":"#/components/schemas/subresources"},"createdOutsideProjects":{"type":"boolean","description":"Signifies if a resource was created outside of projects and then moved to a project\n","example":true},"forwardPolicyServiceHrn":{"type":"string","description":"The hrn of the service used when the forwardPolicyNames feature is\nrequested in the Decision API for any Resource Links of this Resource Home.\nWhen a Decision API request is made against a Resource Link of this\nResource Home, all of the policies associated with the Realm of the calling identity\n(via either a Plan attached to the Realm or a Policy attached to the Realm)\nthat are associated with this given service will be used to construct the\nX-Policy-Names header in the response if applicable.\n","example":"hrn:here:authorization::HERE:serviceDescriptor/SERVICE-00000000-0000-0000-0000-000000000000"}}},"ResourceRelationResponseList":{"type":"object","required":["resources"],"properties":{"items":{"type":"array","description":"The list of resource relations created","items":{"$ref":"#/components/schemas/ResourceRelationResponse"}}}},"ResourceLinkActionBody":{"type":"object","properties":{"allowedActions":{"type":"array","items":{"type":"string","example":"readResource"},"description":"The list of actions to add as a link to the project. The actions must be one of the 'projectLinkingEnabled'\naction of the service and must be made linkable to the project or the realm via the\n'/resources/{resource}/linkable' API\n"}}},"ResourceRelationRequest":{"type":"object","required":["resource"],"properties":{"resource":{"type":"string","example":"hrn:here:data::myrealm:my-catalog","description":"The hrn of the resource\n"},"externalId":{"$ref":"#/components/schemas/externalId"},"type":{"$ref":"#/components/schemas/Type"},"allowedActions":{"type":"array","items":{"type":"string","example":"readResource"},"description":"The list of actions to add as a link to the project. The actions must be one of the 'projectLinkingEnabled'\naction of the service and must be made linkable to the project or the realm via the\n'/resources/{resource}/linkable' API\nNote: Resource Relation of type Home by default allows access to all 'projectEnabled' actions unless otherwise specified via a Project Policy.\n"}}},"ResourceRelationList":{"type":"object","required":["resources"],"properties":{"items":{"type":"array","description":"The list of resource relations to create. A max of 20 Resource Relation create requests accepted at a time.","items":{"$ref":"#/components/schemas/ResourceRelationRequest"}}}},"Type":{"type":"string","example":"catalog","description":"The type of the resource.\neg - catalog, pipeline, pipeline-template, schema, artifact, flow, flow-pattern, service, resource-policy, \nconnector, routing-customization, search-customization, lastmile, tracking, adminportal\n"},"Relation":{"type":"string","enum":["home","reference"],"example":"home","description":"The relation of the resource with the Project.\n"},"ResourceRelation":{"type":"string","enum":["home","reference"],"example":"home","description":"The relation of the resource with the Project\n"},"RelationResourceReference":{"type":"string","enum":["reference"],"example":"reference","description":"The relation of the resource with the Project\n"},"ProjectRequest":{"type":"object","required":["id","name"],"properties":{"id":{"type":"string","example":"my-project-0000","description":"The id of the Project\n"},"name":{"type":"string","example":"My Project","description":"The name of the Project\n"},"description":{"type":"string","example":"This is my demo Project","description":"The description of the Project\n"}}},"ProjectResponse":{"type":"object","properties":{"id":{"type":"string","example":"my-project-0000","description":"The id of the Project\n"},"hrn":{"type":"string","example":"hrn:here:authorization::myrealm:project/my-project-0000","description":"The hrn of the Project\n"},"name":{"type":"string","example":"My Project","description":"The name of the Project\n"},"description":{"type":"string","example":"This is my demo Project","description":"The description of the Project\n"}}},"ResourceProjectResponse":{"type":"object","allOf":[{"$ref":"#/components/schemas/ProjectResponse"},{"type":"object","properties":{"relation":{"allOf":[{"$ref":"#/components/schemas/Relation"},{"description":"The relation of the resource with the Project. The absense of relation implies the\nresource has not been linked to the Project.\n"}]}}},{"type":"object","properties":{"allowedActions":{"allOf":[{"$ref":"#/components/schemas/allowedActions"}]}}}]},"PatchProject":{"type":"object","properties":{"name":{"type":"string","example":"My Project","description":"The name of the Project\n"},"description":{"type":"string","example":"This is my demo Project","description":"The description of the Project\n"}}},"ProjectMember":{"type":"object","properties":{"project":{"type":"string","example":"hrn:here:authorization::myrealm:project/my-project-0000","description":"The hrn of the Project\n"},"member":{"type":"string","example":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899"},"identityType":{"type":"string","enum":["user","app","group"]},"info":{"description":"Details about the project member. The provided fields are dependent on the entity type<p> User: userId, userHrn, realm, firstname, lastname, email, state<p> App: clientId, clientHrn, realm, name, description, ownerId, ownerHrn, defaultScope, isRestrictedScope, appCreationEnabled<p> Group: groupId, groupHrn, name\n","allOf":[{"$ref":"#/components/schemas/UserInfo"},{"$ref":"#/components/schemas/AppInfo"},{"$ref":"#/components/schemas/ProjectMemberGroupInfo"}],"example":{"userId":"HERE-64badba9-4242-4859-88d5-74563a8f0899","userHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899","realm":"myrealm","firstname":"John","lastname":"Williams","email":"john.williams@example.com","state":"enabled"}}}},"ProjectPolicyRequestBody":{"type":"object","required":["id","name","permissions"],"properties":{"id":{"type":"string","example":"read-access-for-catalog-1","description":"The Identifier for the Project Policy.\n","minLength":4,"maxLength":16,"pattern":"^[a-z0-9][a-z0-9\\-]{2,14}[a-z0-9]$"},"name":{"type":"string","example":"Read access for catalog 1","description":"The name for the Project Policy\n"},"description":{"type":"string","example":"This is a custom Project Policy that grants read access to catalog 1","description":"The description for the Project Policy\n"},"permissions":{"type":"array","items":{"type":"object","required":["allowedActions"],"properties":{"resource":{"type":"string","example":"hrn:here:data::myrealm:my-catalog","description":"The hrn of the resource. One of resource or the resourceType must be defined\n"},"resourceType":{"$ref":"#/components/schemas/Type"},"allowedActions":{"type":"array","items":{"type":"string","example":"readResource"},"description":"The list of actions allowed to be taken against either the resource or the resource type defined in the Project Policy in the context of the Project\n"}}}}}},"ProjectPolicyResponse":{"type":"object","properties":{"id":{"type":"string","example":"all-access-for-catalog-1","description":"The Identifier for the Project Policy\n"},"hrn":{"type":"string","example":"hrn:here:authorization::myrealm:project/my-project-0000:policy/all-access-for-catalog-1","description":"The HRN for the Project Policy\n"},"name":{"type":"string","example":"All access for catalog 1","description":"The name for the Project Policy\n"},"description":{"type":"string","example":"All access for catalog 1","description":"The description for the Project Policy\n"},"type":{"type":"string","enum":["custom","here-platform"]},"permissions":{"type":"array","description":"The permissions that apply for the policy. Limited to a maximum of 100","items":{"type":"object","properties":{"resource":{"type":"string","example":"hrn:here:data::myrealm:my-catalog","description":"The hrn of the resource\n"},"resourceType":{"$ref":"#/components/schemas/Type"},"allowedActions":{"type":"array","items":{"type":"string","example":"readResource"},"description":"The list of allowed actions for this Project Policy Permission\n"}}}},"nonHrnPermissions":{"type":"array","description":"The permissions for actions with no allowedResourceTypes that apply for the policy.","items":{"type":"object","properties":{"resourceType":{"$ref":"#/components/schemas/Type"},"allowedActions":{"type":"array","items":{"type":"string","example":"create"},"description":"The list of allowed actions for this Project Policy Permission\n"}}}}}},"ProjectPolicyListResponse":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithTokenNoTotal"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ProjectPolicyResponse"},"description":"List of Project Policies"}}}]},"AttachedPolicies":{"type":"object","properties":{"policies":{"type":"array","description":"The list of project policy hrns to attach.","maxItems":5,"items":{"$ref":"#/components/schemas/AttachedPolicy"}}}},"AttachedPolicy":{"type":"object","properties":{"policy":{"type":"string","example":"hrn:here:authorization::myrealm:project/my-project-0000:policy/all-access-catalog-1","description":"The hrn of the project policy\nNote - For HERE provided policies, the HRN format would be - hrn:here:authorization::olp-here:here-platform:policy/read-only-access-to-all-catalogs\n"}}},"ServiceActionsList":{"type":"object","properties":{"allowedActions":{"type":"array","items":{"type":"string"},"example":["readResource","writeResource"],"description":"List of allowed actions"}}},"ProjectListWithPageToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ProjectResponse"},"description":"List of Projects."}}}]},"ResourceProjectListWithPageToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ResourceProjectResponse"},"description":"List of Projects associated with a given resource."}}}]},"ResourceListDetailedWithPageToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithTokenNoTotal"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ResourceResponseDetailed"},"description":"List of Resources."}}}]},"ResourceInProjectListWithPageToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ResourceInProjectResponse"},"description":"List of Resources."}}}]},"ProjectMemberListWithPageToken":{"type":"object","description":"\\'total\\' will not be returned when onlyIncludeIdentities query parameter is set to 'true'","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ProjectMember"},"description":"List of Project Members."}}}]},"ProjectSettings":{"type":"object","properties":{"scopeAccess":{"type":"string","enum":["thisProjectOnly","thisProjectOrNoProject"],"description":"The scope of access that is allowed when operating within this project's scope (i.e. using a project scoped token).\nAvailable options include:\n- thisProjectOnly - Requests scoped to this project can only access resources and API calls available within this project's scope\n                    Unscoped and Linkable permissions are not blocked and MAY be granted via a realm level access filter.\n                    (When this option is selected, NO AccessFilter is attached to the project)\n- thisProjectOrNoProject - Requests scoped to this project can access resources and API calls available within this project's\n                           scope in addition to resources and API calls associated with no project at all that the calling identity has access to.\n                           (When this option is selected, the project-eval-unscoped AccessFilter is attached to the project)\n","default":"thisProjectOnly","example":"thisProjectOnly"},"defaultNewMemberProjectPolicies":{"type":"array","description":"The default Project Policies to apply to new Members in the project.","minItems":1,"maxItems":5,"items":{"type":"string","description":"a Project Policy HRN"},"example":["hrn:here:authorization::myrealm:project/my-project-0000:policy/resource-creation-access-all-project-resources","hrn:here:authorization::myrealm:project/my-project-0000:policy/all-access-all-project-resources"]}}},"DefaultProjectPolicyRequest":{"type":"object","properties":{"defaultNewMemberProjectPolicies":{"type":"array","description":"The default Project Policies to apply to new Members in the project.","minItems":1,"maxItems":5,"items":{"type":"string","description":"a Project Policy HRN"},"example":["hrn:here:authorization::myrealm:project/my-project-0000:policy/all-access-catalog-1"]}}},"PageWithToken":{"type":"object","required":["limit","total","items"],"properties":{"limit":{"type":"integer","example":1,"description":"Maximum number of items to return."},"pageToken":{"type":"string","example":"KuMvTQrdHVVKuMDDdcIvTQrdci1FWdcIHVVci1FW","description":"The cursor for pagination. Present only if there is an additional page of data to view."},"total":{"type":"integer","example":1,"description":"Total number of items matching the search criteria."}}},"PageWithTokenNoTotal":{"type":"object","required":["limit","items"],"properties":{"limit":{"type":"integer","example":1,"description":"Maximum number of items to return."},"pageToken":{"type":"string","example":"KuMvTQrdHVVKuMDDdcIvTQrdci1FWdcIHVVci1FW","description":"The cursor for pagination. Present only if there is an additional page of data to view."}}},"ExternalResource":{"type":"object","properties":{"hrn":{"type":"string","example":"hrn:here:data::myrealm:my-catalog","description":"The hrn of the resource\n"},"type":{"$ref":"#/components/schemas/Type"},"subresources":{"type":"array","items":{"type":"string","maxLength":24},"example":["usa-il-chicago","deu"]},"expiresAt":{"type":"integer","format":"int64","example":1735689600000,"description":"The timestamp in milliseconds when the resource access expires\n"}}},"ExternalResourcePageWithTokenNoTotal":{"allOf":[{"$ref":"#/components/schemas/PageWithTokenNoTotal"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ExternalResource"}}}}]},"ErrorResponse":{"type":"object","required":["title","status","code","cause","action","errorId"],"properties":{"title":{"description":"Error title","type":"string","example":"Input data failed validation"},"errorId":{"type":"string","example":"ERROR-9d862c5a-4cfd-4780-8be4-2728b42849e1","description":"Unique id for the error. This is searchable from HERE Account logs."},"status":{"description":"HTTP Status Code","type":"integer","example":400},"code":{"description":"Service specific error code","type":"string","example":"E202101"},"cause":{"description":"The cause of the error","type":"string","example":"The input data in question does not meet validation rules"},"action":{"description":"Actionable instructions for the API consumer","type":"string","example":"Correct input data and retry request"},"correlationId":{"description":"Trace ID associated with this request, for future use","type":"string","example":"4199533b-6290-41db-8d79-edf4f4019a74"},"details":{"type":"array","description":"Collection of error details","items":{"$ref":"#/components/schemas/ErrorDetail"}}}},"ErrorDetail":{"type":"object","properties":{"title":{"type":"string","description":"Error message","example":"Invalid size value"},"source":{"type":"string","description":"Reference to JSON path","example":"$.data.attributes[0].size"},"message":{"type":"string","description":"Detailed error message","example":"Size must be between 3 and 64"},"messageTemplate":{"type":"string","description":"Optional error template","example":"validation.constraint.between"},"messagePlaceholders":{"type":"object","additionalProperties":{},"example":{"field":"size","min":3,"max":64}}}},"RealmMemberInfo":{"description":"Details about the member of organization (realm). The provided fields are dependent on the entityType as provided.<p> User: userId, userHrn, realm, firstname, lastname, email, roles, state, createdTime<p> App: clientId, clientHrn, realm, name, description, roles, ownerId, ownerHrn, defaultScope, isRestrictedScope, appCreationEnabled, alwaysProjectScope, status, createdTime<p> Car: userId, userHrn, realm, carId, roles, state\n","allOf":[{"$ref":"#/components/schemas/RealmMemberUserInfo"},{"$ref":"#/components/schemas/RealmMemberAppInfo"},{"type":"object","properties":{"roles":{"type":"array","items":{"type":"string"},"description":"A list of roles assigned to the member. Each entry in the list will be equal to the 'name' of the role.\n"},"carId":{"type":"string","description":"The unique identifier of the car. Only included if entityType is car","example":"VIN123456"}}}],"example":{"userId":"HERE-64badba9-4242-4859-88d5-74563a8f0899","userHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899","realm":"myrealm","firstname":"John","lastname":"Williams","email":"john.williams@example.com","roles":["OrgAdmin","GroupAdmin"],"state":"enabled","createdTime":1432216394712}},"GroupMemberInfo":{"description":"Details about the group member. The provided fields are dependent on the entityType as provided.<p> User: userId, userHrn, realm, firstname, lastname, email, state<p> App: clientId, clientHrn, realm, name, description, ownerId, ownerHrn, defaultScope, isRestrictedScope<p> Invite: inviteId, inviteHrn, realm, email\n","allOf":[{"$ref":"#/components/schemas/UserInfo"},{"$ref":"#/components/schemas/AppInfo"},{"$ref":"#/components/schemas/InviteInfo"}],"example":{"userId":"HERE-64badba9-4242-4859-88d5-74563a8f0899","userHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899","realm":"myrealm","firstname":"John","lastname":"Williams","email":"john.williams@example.com","state":"enabled"}},"RoleEntityInfo":{"description":"Details about the role entity. The provided fields are dependent on the entityType as provided.<p> User: userId, userHrn, realm, firstname, lastname, email, state<p> App: clientId, clientHrn, realm, name, description, ownerId, ownerHrn, defaultScope, isRestrictedScope, appCreationEnabled\n","allOf":[{"$ref":"#/components/schemas/UserInfo"},{"$ref":"#/components/schemas/AppInfo"}],"example":{"userId":"HERE-64badba9-4242-4859-88d5-74563a8f0899","userHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899","realm":"myrealm","firstname":"John","lastname":"Williams","email":"john.williams@example.com","state":"enabled"}},"CrossRealmTrustRequest":{"type":"object","properties":{"requiresLinkableResourceWithTargetProject":{"type":"boolean","example":true,"description":"Indicate whether or not an actor in the source Realm must always specify a project in the target Realm\nwhen offering a LinkableResource.\nWhen this is set to true, the User or App in the source realm cannot offer the LinkableResource broadly\nin the target Realm such that it could be added to any Project in the target Realm.\nDefaults to false, which allows the User or App in the source Realm to create LinkableResources identifying\nthe target Realm, such that the ResourceLink can be added to any Project in the target Realm.\n"}}},"CrossRealmTrust":{"description":"CrossRealmTrust allows LinkableResources to be offered by the source realm HRN or project HRN\ninto the context of the target Realm or target Project in that Realm.\nCrossRealmTrust optionally identifies both the source and the target Project.\n","type":"object","required":["sourceRealm","targetRealm"],"properties":{"sourceRealm":{"type":"string","example":"hrn:here:account::rlm-a:realm/rlm-a","description":"The hrn of the source realm\n"},"targetRealm":{"type":"string","example":"hrn:here:account::rlm-b:realm/rlm-b","description":"The hrn of the target realm\n"},"sourceProject":{"type":"string","example":"hrn:here:account::rlm-a:project/project-a","description":"The hrn of the source project\n"},"targetProject":{"type":"string","example":"hrn:here:account::rlm-b:project/project-b","description":"The hrn of the target project\n"},"requiresLinkableResourceWithTargetProject":{"type":"boolean","example":true,"default":false,"description":"Indicate whether or not an actor in the source Realm must always specify a project in the target Realm\nwhen offering a LinkableResource.\nWhen this is set to true, the User or App in the source realm cannot offer the LinkableResource broadly\nin the target Realm such that it could be added to any Project in the target Realm.\nDefaults to false, which allows the User or App in the source Realm to create LinkableResources identifying\nthe target Realm, such that the ResourceLink can be added to any Project in the target Realm.\n"}}},"CrossRealmTrustListWithPageToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/CrossRealmTrust"},"description":"List of CrossRealmTrusts."}}}]},"AttachedUnscopedPolicyPageWithToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/AttachedUnscopedPolicy"}}}}]},"AttachedUnscopedPolicy":{"type":"object","properties":{"hrn":{"type":"string","description":"The hrn of the policy\n","example":"hrn:here:authorization::HERE:policy/POLICY-99b7c7d7-867a-4573-8730-4689be1718c9"},"serviceId":{"type":"string","description":"The id of the service associated with the policy\n","example":"SERVICE-00000000-0000-0000-0000-000000000000"}}},"AttachedUnscopedPlanPageWithToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/AttachedUnscopedPlan"}}}}]},"AttachedUnscopedPlan":{"type":"object","properties":{"hrn":{"type":"string","description":"The hrn of the plan\n","example":"hrn:here:authorization::HERE:plan/PLAN-99b7c7d7-867a-4573-8730-4689be1718c9"},"externalIds":{"type":"array","description":"List of all external ids for this plan attachment.\nNo external ids for the attachment if it is missing.\n","items":{"type":"string"},"example":["A-S0001234","A-S0001235"]}}},"AttachedResourcePlanPageWithToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/AttachedResourcePlan"}}}}]},"AttachedResourcePlan":{"type":"object","properties":{"hrn":{"type":"string","description":"The hrn of the resource plan\n","example":"hrn:here:authorization::myrealm:resourcePlan/my-plan-000"},"externalId":{"$ref":"#/components/schemas/externalId"},"subresources":{"type":"object","additionalProperties":{"type":"array","maxItems":10,"items":{"type":"string","maxLength":24},"example":["usa-il-chicago","deu"],"description":"The list of associated subresource identifiers.\n"},"example":{"hrn:here:authorization::myrealm:resourcePolicy/my-policy-000":["usa-il-chicago","deu"]},"description":"Provides the subresources per included Resource Policy (HRN as key). You can only\nset subresources with the attached plan if the subresources are not set in\nthe Resource Policy. This shows the effective setting, either from the\nResource Policy or as specified in the attachment. Setting it on attachment\nhas a higher priority than setting it on the Resource Policy and will override\nany values set at the Resource Policy.\n"},"expiresAt":{"type":"string","example":"2030-05-26T19:30:00Z","format":"date-time","description":"The UTC time when the resource plan attachment expires.\n"}}},"AttachedResourcePolicyPageWithToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/AttachedResourcePolicy"}}}}]},"AttachedResourcePolicy":{"type":"object","properties":{"hrn":{"type":"string","description":"The hrn of the policy\n","example":"hrn:here:authorization::myrealm:resourcePolicy/my-policy-0000"}}},"ServiceInformationWithPageToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ServiceInformation"},"description":"Service information list."}}}]},"ServiceInformation":{"type":"object","properties":{"serviceId":{"type":"string","example":"SERVICE-00000000-0000-0000-0000-000000000000","description":"The service descriptor id"},"serviceIdAlias":{"type":"string","example":"foo","description":"The alias for the service id"},"allowedActions":{"type":"array","description":"List of allowed actions","items":{"type":"object","properties":{"action":{"type":"string","example":"readResource","description":"The action string"},"resourceRequired":{"type":"boolean","description":"Defines if the action requires use with a resource","example":false}}}},"resourceTypes":{"type":"array","description":"List of resource types","items":{"type":"string","example":"footype","description":"The resource type owned by the service. eg catalog, pipeline, pipeline-template"}}}},"ResourceTypesWithPageToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ResourceTypeInfo"},"description":"List of resource types."}}}]},"ResourceTypeInfo":{"type":"object","properties":{"resourceType":{"type":"string","example":"footype","description":"The resource type owned by the service. eg catalog, pipeline, pipeline-template"},"serviceIdAlias":{"type":"string","example":"foo","description":"The alias for the service id"},"serviceId":{"type":"string","example":"SERVICE-00000000-0000-0000-0000-000000000000","description":"The service descriptor id"}}},"AccessFilterPageWithToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/AccessFilter"}}}}]},"AccessFilterAttachmentPageWithToken":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/AccessFilterAttachment"}}}}]},"AccessFilter":{"type":"object","description":"An Access Filter defines a permission boundary for an access request.  When any access request is made,\nif an Access Filter is applicable to the requesting identity, the request must \"pass\" the filter in order for\nit to continue with the rest of the access evaluation.\n\n</br>Any Access Filter attached to the requester, the requester's realm, or any of the requester's roles is\nconsidered applicable and consulted for an access request.\n\n</br>For all consulted Access Filters and each category of permissions:\n* Each statement in the Access Filters that match the permissions category and the access request's service,\n  action, resource, and scope is collected and sorted according to priority\n* The statement with the highest priority is matched\n* If there is a matched statement with **evaluate=true**, that category of permissions is evaluated in the\n  access request, otherwise they are skipped\n* If there are multiple matched statements with the same highest priority and they have different values for\n  **evaluate**, **evaluate=true** wins and that category of permissions are evaluated\n* If the access request results in **evaluate=true** and the response is **allow** with subresources, the\n  subresources in the response are filtered according to the matching statements' subresources properties.\n","allOf":[{"$ref":"#/components/schemas/AccessFilterIdentifier"},{"$ref":"#/components/schemas/AccessFilterCommonProperties"},{"$ref":"#/components/schemas/AccessFilterVirtualProperties"},{"$ref":"#/components/schemas/AccessFilterStatements"}]},"AccessFilterCustomRequest":{"allOf":[{"$ref":"#/components/schemas/AccessFilterCommonProperties"},{"$ref":"#/components/schemas/AccessFilterStatements"},{"type":"object","properties":{"type":{"type":"string","enum":["custom"],"description":"Identifies this request as a **custom** Access Filter.  Must be **custom**.\n","example":"custom"}}}]},"AccessFilterVirtualRequest":{"allOf":[{"$ref":"#/components/schemas/AccessFilterCommonProperties"},{"$ref":"#/components/schemas/AccessFilterVirtualProperties"},{"type":"object","properties":{"type":{"type":"string","enum":["virtual"],"description":"Identifies this request as a **virtual** Access Filter.  Must be **virtual**.\n","example":"virtual"}}}]},"AccessFilterRequest":{"oneOf":[{"$ref":"#/components/schemas/AccessFilterCustomRequest"},{"$ref":"#/components/schemas/AccessFilterVirtualRequest"}]},"AccessFilterIdentifier":{"type":"object","properties":{"hrn":{"type":"string","description":"The hrn of the filter","example":"hrn:here:authorization::HERE:filter/FILTER-99b7c7d7-867a-4573-8730-4689be1718c9"}}},"AccessFilterCommonProperties":{"type":"object","properties":{"type":{"type":"string","enum":["here-platform","custom","virtual"],"description":"The type of the Access Filter.\n* **here-platform** - A system defined filter.  Cannot be deleted or modified.\n* **custom** - A user defined filter with user defined statements.\n* **virtual** - A user defined filter with automatically generated statements that are associated with plans\n  and resourcePlans attached to the realm with specific externalIds.\n","example":"here-platform"},"name":{"type":"string","description":"The name of the filter","example":"Strict Projects"}}},"AccessFilterVirtualProperties":{"type":"object","properties":{"externalIds":{"type":"array","items":{"type":"string"},"description":"Only included in virtual Access Filters.  The list of externalIds that this virtual Access Filter is linked\nto.  Plans and ResourcePlans attached to this realm with one of the externalIds in this list are used as\nthe basis of this filter.  The list of Plans and ResourcePlans used may be further filtered **if** the\nplanAttachments or resourcePlanAttachments properties are also defined.  The statements in this filter are\nautomatically generated to allow access to each of the permissions and resources defined in those included\nplans.\n","example":["A-12345","A-67890"]},"planAttachments":{"type":"array","items":{"type":"object","properties":{"externalId":{"type":"string","description":"The externalId of plan attachments to filter.  Must match one of the top level externalIds specified\nfor this virtual Access Filter.\n","example":"A-12345"},"planHrns":{"type":"array","items":{"type":"string"},"description":"The list of planHrns that may be used as the basis of this virtual Access Filter's statements for\nany plans that are attached to this realm with the given externalId.\n","example":["hrn:here:authorization::HERE:plan/PLAN-7316c7e6-9e05-4086-aef3-cd7240e3c92b","hrn:here:authorization::HERE:plan/PLAN-457c91d8-f67e-49e6-b629-e72c2f5b1036"]}}},"description":"Only included in virtual Access Filters.  The list of planAttachments that this virtual Access Filter is\nlinked to.  If this field is included, for the externalId of each list entry, **only** Plans that are\nattached to this realm with the defined externalId **and** one of the defined planHrns will be used as the\nbasis of statements in this filter.  Any Plans attached to this realm with the given externalId that are\n**not** in the list of defined planHrns will be excluded from the basis of this filter.  If this field is\nomitted, or there is no entry for any one of the externalIds defined for this virtual Access Filter,\n**all** of the Plans attached with the externalId will be used as the basis of statements in this filter.\n"},"resourcePlanAttachments":{"type":"array","items":{"type":"object","properties":{"externalId":{"type":"string","description":"The externalId of resource plan attachments to filter.  Must match one of the top level externalIds\nspecified for this virtual Access Filter.\n","example":"A-12345"},"resourcePlanHrns":{"type":"array","items":{"type":"string"},"description":"The list of resourcePlanHrns that may be used as the basis of this virtual Access Filter's statements \nfor any resource plans that are attached to this realm with the given externalId.\n","example":["hrn:here:authorization::myrealm:resourcePlan/my-plan-0000","hrn:here:authorization::myrealm:resourcePlan/my-plan-0001"]}}},"description":"Only included in virtual Access Filters.  The list of resourcePlanAttachments that this virtual Access\nFilter is linked to.  If this field is included, for the externalId of each list entry, **only** Resource\nPlans that are attached to this realm with the defined externalId **and** one of the defined\nresourcePlanHrns will be used as the basis of statements in this filter.  Any Resource Plans attached to\nthis realm with the given externalId that are **not** in the list of defined resourcePlanHrns will be\nexcluded from the basis of this filter.  If this field is omitted, or there is no entry for any one of the\nexternalIds defined for this virtual Access Filter, **all** of the Plans attached with the externalId will\nbe used as the basis of statements in this filter.\n"},"mode":{"type":"string","enum":["open","strict"],"description":"Only included in virtual Access Filters.  The pattern of filter statements used in this virtual Access Filter.\n* **open** - All permissions and resources specified in both Plans and ResourcePlans attached to this realm\n  with the relevant externalIds are available via this filter with both scoped and unscoped access.  In\n  addition, all linkable resources are available in both scoped and unscoped access.\n* **strict** - All permissions specified in Plans attached to this realm with the relevant externalIds are\n  ONLY available via this filter with unscoped access.  All resources specified in ResourcePlans attached\n  to this realm with the relevant externalIds are ONLY available via this filter with scoped access.\n","example":"open"},"priority":{"type":"integer","description":"Only included in virtual Access Filters.  The priority assigned to each filter statement in this virtual\nAccess Filter.\n","minimum":0,"maximum":1000,"example":100}}},"AccessFilterStatements":{"type":"object","properties":{"statements":{"type":"array","items":{"$ref":"#/components/schemas/AccessFilterStatement"},"description":"List of statements in this filter."}}},"AccessFilterStatement":{"type":"object","properties":{"description":{"type":"string","description":"Prose description of what this filter statement does.","example":"Block evaluation of all unscoped permissions for any project scoped request."},"permissions":{"type":"string","enum":["unscoped","scoped","linkable"],"description":"The type of permissions that apply to this filter statement.\n* **unscoped** - Applies to all access control via the \"unscoped\" path.  This includes Plans, Policies,\n  Permissions, Groups, and Roles\n* **scoped** - Applies to all access control via the \"scoped\" path.  This includes resources associated\n  with projects and other __projectEnabled__ actions\n* **linkable** - Applies to all access control via the \"linkable\" path.  This includes resources made\n  available to be linked to a project via a directly created __linkable__ resource or a __resourcePlan__\n  attached to the realm\n","example":"unscoped"},"subresources":{"type":"array","items":{"type":"string","maxLength":24},"example":["usa-il-chicago","deu"],"description":"In the case of **scoped** or **linkable** filter statements, the list of subresources that MAY be included\nas part of an allow decision response.\n* If more than one matching filter statement contains a subresources property, the aggregate of all\n  subresources in all matching statements MAY be included as part of an allow decision response.  An allow\n  decision response that contains subresources will be filtered and WILL NOT contain any subresources not\n  part of this aggregate set.\n* If NONE of the matching filter statements contain a subresources property, NO subresources filtering\n  is applied.\n"},"service":{"type":"string","description":"The service of the access request that will match this statement.  This value may match the **serviceId**\nor the **serviceIdAlias** of the service.\n","example":"SERVICE-00000000-0000-0000-0000-000000000000"},"actions":{"type":"array","description":"The specific action identifiers of the access request that will match this statement","items":{"type":"string"},"example":["read"]},"actionAccessLevel":{"type":"string","description":"The access level of the action of the access request that will match this statement. Default represents actions that are granted by default on subscription of the service.","enum":["read","write","default","internal"],"example":"read"},"resource":{"type":"string","description":"The resource identifier of the access request that will match this statement","example":"hrn:here:data::my-realm:service-catalog"},"scope":{"type":"string","description":"The scope of the access request with possible values being a project HRN or a \"*\"(wildcard) representing any project scope. The lack of the scope property matches the statement to unscoped requests","example":"hrn:here:authorization::myrealm:project/my-project-0000"},"evaluate":{"type":"boolean","description":"Whether or not to evaluate the permissions identified by the permissions type of this statement","example":true},"priority":{"type":"integer","description":"An integer representing the statement priority","minimum":0,"maximum":1000,"example":1}}},"AccessFilterAttachment":{"type":"object","allOf":[{"$ref":"#/components/schemas/AccessFilterIdentifier"}],"properties":{"expiresAt":{"type":"string","example":"2030-05-26T19:30:00Z","format":"date-time","description":"The UTC time when the access filter attachment expires.\n"}}},"ActionPolicy":{"type":"object","properties":{"hrn":{"type":"string","example":"hrn:here:authorization::HERE:actionpolicy/ACTIONPOLICY-0000"}}},"ResourcePlanPolicyList":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ActionPolicy"},"description":"List of Service Action Policies."}}}]},"ActionPolicyPermissionList":{"allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ActivePermissionNoResource"},"description":"List of Service Action Policy Permissions."}}}]}},"responses":{"Unauthorized":{"description":"Access is denied due to invalid credentials","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"Forbidden":{"description":"You do not have permission to perform this action","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"NotFound":{"description":"The requested resource was not found, see error response for details","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"BadRequest":{"description":"Invalid input provided, see error response for details","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"BadRequestForDeleteProjectResourceReference":{"description":"An error has occurred.\n* 404903: No resource home exists with the given Id.\n","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"NoContent":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}}}}}}