openapi: 3.2.0
info:
  title: Authorization API v1.1 Groups API
  version: 1.1.0
  description: 'This specification is intended to describe the Authorization v1.1 APIs

    ## Roles

    ### **OrgAdmin** - An entity which has administrative authority over an organization.'
servers:
- url: Use API Lookup for a base URL
security:
- Bearer: []
tags:
- name: Groups
  description: Group and Group Membership Management
paths:
  /groups/{groupId}/roles:
    parameters:
    - $ref: '#/components/parameters/groupId'
    get:
      parameters:
      - $ref: '#/components/parameters/pageToken'
      - $ref: '#/components/parameters/count'
      tags:
      - Groups
      summary: Get group roles
      description: 'List the roles which are associated with the provided group.


        Access Control:

        * The calling principal must have **"readRoles"** action permission for the resource **"{group}"** in the **"authorization"** service. Here **group** is the group identified by the provided group HRN.

        * The calling principal MUST NOT include a project scope.'
      operationId: getGroupRoles
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RolePageWToken'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Group not found
  /groups:
    get:
      tags:
      - Groups
      summary: Get groups
      operationId: getGroups
      description: 'Retrieve the list of groups within the realm associated with the calling party.


        Access Control:

        * The calling principal must have **"readMembers"** action permission for the calling party **"{realm}"** in the **"authorization"** service.

        * The calling principal MUST NOT include a project scope.'
      parameters:
      - $ref: '#/components/parameters/pageToken'
      - $ref: '#/components/parameters/count'
      - $ref: '#/components/parameters/groupsSearch'
      responses:
        '200':
          description: List of group members that match all the search criteria.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GroupPageWToken'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
    post:
      tags:
      - Groups
      summary: Create group
      operationId: createGroup
      description: 'Create a group within the realm that is associated with the calling

        party. The calling party will be made a member and an administrator of

        the created group.


        Access Control:

        * The calling principal must have **"createGroup"** action permission for the calling party **"{realm}"** in the **"authorization"** service.

        * The calling principal MUST NOT include a project scope.'
      requestBody:
        $ref: '#/components/requestBodies/Group'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Group'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '422':
          description: 'A defined system limit would be violated if this action was completed.

            Example: ''MaxEntityRoles limit reached. Current value: 100. Maximum value: 100''

            * 422000 - LimitReached

            * This API works only with tokens that are not scoped to a project.

            '
  /groups/{groupId}:
    parameters:
    - $ref: '#/components/parameters/groupId'
    get:
      tags:
      - Groups
      summary: Get single group
      operationId: getGroup
      description: 'Retrieve the group identified by the provided group HRN.


        Access Control:

        * The calling principal must have **"readMembers"** action permission for the calling party **"{realm}"** in the **"authorization"** service.

        * The calling principal MUST NOT include a project scope.'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Group'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Group not found
    post:
      tags:
      - Groups
      summary: Update group
      operationId: updateGroup
      description: 'Update the group identified by the provided group HRN by updating all

        writable group fields including name and description.


        Access Control:

        * The calling principal must have **"updateGroup"** action permission for the resource **"{group}"** in the **"authorization"** service. Here **group** is the group identified by the provided group HRN.

        * The calling principal MUST NOT include a project scope.'
      requestBody:
        $ref: '#/components/requestBodies/Group'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Group'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Group not found
    delete:
      tags:
      - Groups
      summary: delete group
      operationId: deleteGroup
      description: 'Delete the group identified by the provided group HRN.


        Access Control:

        * The calling principal must have **"deleteGroup"** action permission for the resource **"{group}"** in the **"authorization"** service. Here **group** is the group identified by the provided group HRN.

        * The calling principal MUST NOT include a project scope.'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          description: 'An error has occurred.

            * 404780 - Authorization Group not found

            '
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Group not found
  /groups/{groupId}/policies:
    parameters:
    - $ref: '#/components/parameters/groupId'
    - $ref: '#/components/parameters/pageToken'
    - $ref: '#/components/parameters/limit'
    - $ref: '#/components/parameters/XCorrelationId'
    get:
      tags:
      - Groups
      summary: Get Group Policies
      operationId: getGroupPolicies
      description: 'Get all policies attached to the requested group.


        Access Control:

        * The calling principal must have **"readPolicies"** action permission for the resource **"{group}"** in the **"authorization"** service. Here **group** is the group identified by the provided group HRN.'
      responses:
        '200':
          description: OK.
          headers:
            X-Correlation-ID:
              $ref: '#/components/headers/XCorrelationId'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttachedUnscopedPolicyPageWithToken'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /groups/{groupId}/policies/{policy}/permissions:
    parameters:
    - $ref: '#/components/parameters/groupId'
    - $ref: '#/components/parameters/policyHrn'
    - $ref: '#/components/parameters/pageToken'
    - $ref: '#/components/parameters/limit'
    - $ref: '#/components/parameters/XCorrelationId'
    get:
      tags:
      - Groups
      summary: Get Group Policy Permissions
      operationId: getGroupPolicyPermissions
      description: 'Get all **unscoped** permissions that are in a policy attached to the requested group.


        Access Control:

        * The calling principal must have **"readPolicies"** action permission for the resource **"{group}"** in the **"authorization"** service. Here **group** is the group identified by the provided group HRN.'
      responses:
        '200':
          description: OK.
          headers:
            X-Correlation-ID:
              $ref: '#/components/headers/XCorrelationId'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionPageWithToken'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /groups/{groupId}/permissions:
    parameters:
    - $ref: '#/components/parameters/groupId'
    - $ref: '#/components/parameters/permissionServiceId'
    - $ref: '#/components/parameters/pageToken'
    - $ref: '#/components/parameters/limit'
    get:
      tags:
      - Groups
      summary: Get group permissions
      description: 'Retrieve the **unscoped** permissions a given group has been assigned.


        Access Control:

        * The calling principal must have **"readPermissions"** action permission for the resource **"{group}"** in the **"authorization"** service. Here **group** is the group identified by the provided group HRN.

        * The calling principal MUST NOT include a project scope.'
      operationId: getGroupPermissions
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionPageWithToken'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Group not found
  /groups/{groupId}/members:
    parameters:
    - $ref: '#/components/parameters/groupId'
    get:
      tags:
      - Groups
      summary: Get Group members
      description: 'Retrieve the list of members of the group identified by the provided group HRN.


        Access Control:

        * The calling principal must have **"readMembers"** action permission for the resource **"{group}"** in the **"authorization"** service. Here **group** is the group identified by the provided group HRN.

        * The calling principal MUST NOT include a project scope.'
      operationId: getGroupMembers
      parameters:
      - $ref: '#/components/parameters/pageToken'
      - $ref: '#/components/parameters/count'
      - $ref: '#/components/parameters/groupEntityType'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GroupMemberPageWToken'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Group not found
  /groups/{groupId}/members/me:
    parameters:
    - $ref: '#/components/parameters/groupId'
    delete:
      tags:
      - Groups
      summary: Removes the calling party from a group
      operationId: leaveGroup
      description: 'Remove the calling party from the group. This operation will also remove

        administrative roles from this member.


        Access Control:

        * The calling principal must have **"manageMembers"** action permission for the resource **"{group}"** in the **"authorization"** service. Here **group** is the group identified by the provided group HRN.

        * The calling principal MUST NOT include a project scope.'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          description: Group not found or calling party is not a member of the group
  /groups/{groupId}/members/{member}:
    parameters:
    - $ref: '#/components/parameters/groupId'
    - $ref: '#/components/parameters/member'
    post:
      tags:
      - Groups
      summary: Add a member to a group
      description: 'Add a single member to a group.


        Access Control:

        * The calling principal must have **"manageMembers"** action permission for the resource **"{group}"** in the **"authorization"** service. Here **group** is the group identified by the provided group HRN.

        * The calling principal MUST NOT include a project scope.'
      operationId: addGroupMember
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Group or group member not found
        '422':
          description: 'A defined system limit would be violated if this action was completed.

            Example: ''MaxEntityGroups limit reached. Current value: 50. Maximum value: 50''

            * 422000 - LimitReached

            '
    get:
      tags:
      - Groups
      summary: Get single Group member
      description: 'Retrieve a single group member.


        Access Control:

        * The calling principal must have **"readMembers"** action permission for the resource **"{group}"** in the **"authorization"** service. Here **group** is the group identified by the provided group HRN.

        * The calling principal MUST NOT include a project scope.'
      operationId: getGroupMember
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GroupMember'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Group or group member not found
    delete:
      tags:
      - Groups
      summary: Remove a member from the group
      operationId: removeGroupMember
      description: 'Remove a member from the group. This operation will also remove

        administrative roles from this member.


        Access Control:

        * The calling principal must have **"manageMembers"** action permission for the resource **"{group}"** in the **"authorization"** service. Here **group** is the group identified by the provided group HRN.

        * The calling principal MUST NOT include a project scope.'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Group or group member not found
  /groups/me:
    get:
      tags:
      - Groups
      summary: Get My Groups
      description: 'Retrieve a list of groups of a member.


        Access Control:

        * The calling principal MUST NOT include a project scope.'
      operationId: getMyGroups
      parameters:
      - $ref: '#/components/parameters/pageToken'
      - $ref: '#/components/parameters/count'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GroupPageWToken'
        '400':
          description: 'An error has occurred.

            * 500100 - Unexpected exception

            '
components:
  schemas:
    Group:
      type: object
      required:
      - name
      properties:
        id:
          type: string
          example: GROUP-99b7c7d7-867a-4573-8730-4689be1718c9
          readOnly: true
        hrn:
          type: string
          example: hrn:here:authorization::myrealm:group/GROUP-99b7c7d7-867a-4573-8730-4689be1718c9
          readOnly: true
        name:
          type: string
          description: 'A user defined name for the group.

            The following characters are not allowed in the group name: control characters, non-breaking space, and * / < > \  |

            '
          example: Power Users
        realm:
          type: string
          example: HERE
          readOnly: true
        description:
          type: string
          maxLength: 500
          description: 'An optional user defined description for the group.


            The following characters are not allowed in the group name: control

            characters, non-breaking space, and * / < > \  |

            '
          example: This is the power users group
    ErrorDetail:
      type: object
      properties:
        title:
          type: string
          description: Error message
          example: Invalid size value
        source:
          type: string
          description: Reference to JSON path
          example: $.data.attributes[0].size
        message:
          type: string
          description: Detailed error message
          example: Size must be between 3 and 64
        messageTemplate:
          type: string
          description: Optional error template
          example: validation.constraint.between
        messagePlaceholders:
          type: object
          additionalProperties: {}
          example:
            field: size
            min: 3
            max: 64
    ErrorResponse:
      type: object
      required:
      - title
      - status
      - code
      - cause
      - action
      - errorId
      properties:
        title:
          description: Error title
          type: string
          example: Input data failed validation
        errorId:
          type: string
          example: ERROR-9d862c5a-4cfd-4780-8be4-2728b42849e1
          description: Unique id for the error. This is searchable from HERE Account logs.
        status:
          description: HTTP Status Code
          type: integer
          example: 400
        code:
          description: Service specific error code
          type: string
          example: E202101
        cause:
          description: The cause of the error
          type: string
          example: The input data in question does not meet validation rules
        action:
          description: Actionable instructions for the API consumer
          type: string
          example: Correct input data and retry request
        correlationId:
          description: Trace ID associated with this request, for future use
          type: string
          example: 4199533b-6290-41db-8d79-edf4f4019a74
        details:
          type: array
          description: Collection of error details
          items:
            $ref: '#/components/schemas/ErrorDetail'
    PageWToken:
      type: object
      properties:
        total:
          readOnly: true
          example: 10
          type: integer
          description: Total entities
        pageToken:
          readOnly: true
          example: 7afd7f8e94eb4844ba45
          type: string
          description: The pageToken used to retrieve the next page of entities
        count:
          readOnly: true
          example: 2
          type: integer
          description: number of items returned
    Role:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the role
          example: ROLE-c1662138-a170-4264-ba18-7b506a708c37
        hrn:
          type: string
          description: Unique identifier for this role with partition/realm/etc, an HRN
          example: hrn:here:authorization::myrealm:role/ROLE-c1662138-a170-4264-ba18-7b506a708c37
        name:
          type: string
          description: System defined name for the role
          example: GroupAdmin
        resource:
          type: string
          description: Represents either Group or Realm HRN for which object is scoped for
          example: hrn:here:authorization::myrealm:group/GROUP-8e270653-f592-45a8-88d7-46d409ccfa8a
    GroupMemberInfo:
      description: 'Details about the group member. The provided fields are dependent on the entityType as provided.<p> User: userId, userHrn, realm, firstname, lastname, email, state<p> App: clientId, clientHrn, realm, name, description, ownerId, ownerHrn, defaultScope, isRestrictedScope<p> Invite: inviteId, inviteHrn, realm, email

        '
      allOf:
      - $ref: '#/components/schemas/UserInfo'
      - $ref: '#/components/schemas/AppInfo'
      - $ref: '#/components/schemas/InviteInfo'
      example:
        userId: HERE-64badba9-4242-4859-88d5-74563a8f0899
        userHrn: hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899
        realm: myrealm
        firstname: John
        lastname: Williams
        email: john.williams@example.com
        state: enabled
    UserInfo:
      type: object
      properties:
        userId:
          readOnly: true
          type: string
          description: The unique identifier of the user.
          example: HERE-00000000-0000-0000-0000-000000000000
        userHrn:
          readOnly: true
          type: string
          description: The HRN of the user.
          example: hrn:here:account::myrealm:user/HERE-00000000-0000-0000-0000-000000000000
        realm:
          readOnly: true
          type: string
          description: A realm which the user belongs to.
          example: myrealm
        firstname:
          readOnly: true
          type: string
          description: The first name of the user. Only included if entityType is user
          example: John
        lastname:
          readOnly: true
          type: string
          description: The lastname of the user.  Only included if entityType is user
          example: Williams
        email:
          readOnly: true
          type: string
          description: Email address of the user.  Only included if entityType is user
          example: john.williams@example.com
        state:
          readOnly: true
          type: string
          description: The status of this user.
          example: enabled
          enum:
          - deleted
          - disabled
          - locked
          - enabled
        realmInfo:
          $ref: '#/components/schemas/CompactRealmInfo'
        roles:
          type: array
          items:
            type: string
          maxItems: 100
          description: 'The list of roles assigned to the user.

            '
          example:
          - OrgAdmin
          - GroupAdmin
    AttachedUnscopedPolicyPageWithToken:
      allOf:
      - $ref: '#/components/schemas/PageWithToken'
      - type: object
        properties:
          items:
            type: array
            items:
              $ref: '#/components/schemas/AttachedUnscopedPolicy'
    CompactRealmInfo:
      type: object
      required:
      - realmId
      - realm
      - name
      - inviteOnly
      - enabled
      properties:
        realmId:
          readOnly: true
          type: string
          description: The unique identifier of the realm.
          example: myrealm
        realm:
          readOnly: true
          type: string
          description: HRN for the realm.
          example: hrn:here:account::myrealm:realm/myrealm
        name:
          readOnly: true
          type: string
          description: HERE realm for OLP.
        realmType:
          type: string
          description: Realm type of the realm.
          example: olp
          enum:
          - olp
          - auto
          - consumer
        inviteOnly:
          type: boolean
          description: Whether the realm can be joined with an invitation only.
          example: false
        enabled:
          type: boolean
          description: The realm status.
          example: true
        allowedLogins:
          type: array
          description: allowed authentication methods for this realm
          items:
            type: object
            description: Authentication methods allowed for this realm
            required:
            - method
            properties:
              method:
                type: string
                description: the authentication method.
                example: saml
                enum:
                - password
                - saml
                - mtls
              url:
                type: string
                description: Https URL callback function required when method is saml
                example: https://api.example.com/saml/
    AttachedUnscopedPolicy:
      type: object
      properties:
        hrn:
          type: string
          description: 'The hrn of the policy

            '
          example: hrn:here:authorization::HERE:policy/POLICY-99b7c7d7-867a-4573-8730-4689be1718c9
        serviceId:
          type: string
          description: 'The id of the service associated with the policy

            '
          example: SERVICE-00000000-0000-0000-0000-000000000000
    InviteInfo:
      type: object
      properties:
        inviteId:
          readOnly: true
          type: string
          description: The unique identifier of the invite
          example: AUTHINVITE-bd1d1f02-c8f3-4a20-ba57-49b7ddcd9b33
        inviteHrn:
          readOnly: true
          type: string
          description: The HRN of the invite
          example: hrn:here:account::myrealm:invite/AUTHINVITE-bd1d1f02-c8f3-4a20-ba57-49b7ddcd9b33
        realm:
          readOnly: true
          type: string
          description: The realm which the invite is associated with
          example: myrealm
        firstname:
          readOnly: true
          type: string
          description: The first name of the user this invite is for.
          example: John
        lastname:
          readOnly: true
          type: string
          description: The last name of the user this invite is for.
          example: Williams
        email:
          readOnly: true
          type: string
          description: Email address of the user this invite is for.
          example: john.williams@example.com
    GroupPageWToken:
      allOf:
      - $ref: '#/components/schemas/PageWToken'
      - type: object
        properties:
          data:
            type: array
            items:
              $ref: '#/components/schemas/Group'
        example:
          total: 10
          pageToken: 7afd7f8e94eb4844ba45
          count: 2
          data:
          - id: GROUP-99b7c7d7-867a-4573-8730-4689be1718c9
            hrn: hrn:here:authorization::myrealm:group/GROUP-99b7c7d7-867a-4573-8730-4689be1718c9
            name: Power Users
            description: This is the Power Users group
          - id: GROUP-85e5c3f7-a866-1248-3690-18c94689be17
            hrn: hrn:here:authorization::myrealm:group/GROUP-85e5c3f7-a866-1248-3690-18c94689be17
            name: Data scientist
            description: This is the Data scientist group
    RolePageWToken:
      allOf:
      - $ref: '#/components/schemas/PageWToken'
      - type: object
        properties:
          data:
            type: array
            items:
              $ref: '#/components/schemas/Role'
    AppInfo:
      type: object
      properties:
        clientId:
          readOnly: true
          type: string
          description: Identifier for the client/application.
          example: 0123456789ABCDEFGHHIJKLM
        clientHrn:
          readOnly: true
          type: string
          description: HRN for the client/application.
          example: hrn:here:account::myrealm:app/0123456789ABCDEFGHHIJKLM
        realm:
          readOnly: true
          type: string
          description: A realm to which app belongs to.
          example: myrealm
        name:
          readOnly: true
          type: string
          description: Human readable name of the client.
          example: Some Application
        description:
          readOnly: true
          type: string
          description: Prose description of the client.
          example: Application for doing something.
        ownerId:
          readOnly: true
          type: string
          description: The id of the user that owns this client.
          example: HERE-00000000-0000-0000-0000-000000000000
        ownerHrn:
          readOnly: true
          type: string
          description: The hrn of the user that owns this client.
          example: hrn:here:account::myrealm:user/HERE-00000000-0000-0000-0000-000000000000
        defaultScope:
          readOnly: true
          type: string
          description: The default value for the "scope" parameter when requesting a client_credentials OAuth2 token if no "scope" parameter is specified.
          example: hrn:here:authorization::myrealm:project/my-project-0000
        isRestrictedScope:
          readOnly: true
          type: boolean
          description: If true, the app cannot request a token with a scope different from defaultScope.
          example: true
        appCreationEnabled:
          readOnly: true
          type: boolean
          description: If true, the app can create apps.
          example: true
        alwaysProjectScope:
          readOnly: true
          type: boolean
          description: Indicates whether or not the given application is locked to the default scope. The given application cannot be added to any additional projects or groups when this value is set to true.
          example: true
        status:
          readOnly: true
          type: string
          enum:
          - active
          - expired
          - blacklisted
          - deactivated
          - monitoring
          - quota_exceeded
          description: Status of the application
          example: active
        roles:
          type: array
          items:
            type: string
          maxItems: 100
          description: 'The list of roles assigned to the app.

            '
          example:
          - OrgAdmin
          - GroupAdmin
    PermissionPageWithToken:
      allOf:
      - $ref: '#/components/schemas/PageWithToken'
      - type: object
        properties:
          items:
            type: array
            items:
              $ref: '#/components/schemas/ActivePermission'
    PageWithToken:
      type: object
      required:
      - limit
      - total
      - items
      properties:
        limit:
          type: integer
          example: 1
          description: Maximum number of items to return.
        pageToken:
          type: string
          example: KuMvTQrdHVVKuMDDdcIvTQrdci1FWdcIHVVci1FW
          description: The cursor for pagination. Present only if there is an additional page of data to view.
        total:
          type: integer
          example: 1
          description: Total number of items matching the search criteria.
    ActivePermissionNoResource:
      type: object
      properties:
        id:
          type: string
          description: The unique identifier of the permission in the context of the client.  Begins with "PERM-".
          readOnly: true
          example: PERM-00000000-0000-0000-0000-000000000000
        action:
          type: string
          description: The specific action identifier that this permission is controlling access to for the specific associated service.
          readOnly: true
          example: read
        effect:
          readOnly: true
          type: string
          description: One of "allow" or "deny"
          enum:
          - allow
          - deny
          example: allow
        serviceId:
          readOnly: true
          type: string
          description: Identifies the service that this permission is associated with.
          example: SERVICE-00000000-0000-0000-0000-000000000000
    GroupMember:
      type: object
      properties:
        memberHrn:
          type: string
          example: hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899
        entityType:
          type: string
          enum:
          - user
          - app
          - invite
        info:
          $ref: '#/components/schemas/GroupMemberInfo'
    ActivePermission:
      allOf:
      - $ref: '#/components/schemas/ActivePermissionNoResource'
      - type: object
        properties:
          resource:
            readOnly: true
            type: string
            description: The resource identifier that this permission is controlling access to for the given action.
            example: hrn:here:data:::service-catalog
    GroupMemberPageWToken:
      allOf:
      - $ref: '#/components/schemas/PageWToken'
      - type: object
        properties:
          data:
            type: array
            items:
              $ref: '#/components/schemas/GroupMember'
  requestBodies:
    Group:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Group'
      required: true
  parameters:
    groupEntityType:
      in: query
      name: entityType
      required: false
      description: 'The type of members to return in the result.  One of ''user'', ''app'', or ''invite''.  If this parameter is omitted, all entity types will be returned. '
      schema:
        type: string
        enum:
        - user
        - app
        - invite
    limit:
      in: query
      name: limit
      required: false
      description: Number of records to return. Default is 100 records. Maximum is 100 records.
      schema:
        type: integer
        minimum: 0
        maximum: 100
        default: 100
    XCorrelationId:
      in: header
      name: X-Correlation-ID
      schema:
        type: string
      required: false
      description: 'Correlates HTTP requests between a client and server. If not present in the incoming request, it will be generated.

        '
    groupId:
      name: groupId
      in: path
      required: true
      description: HRN identifying a group.
      schema:
        type: string
    count:
      in: query
      name: count
      description: Number of records to return. Default is 100 records. Maximum is 100 records.
      schema:
        type: integer
        minimum: 0
        maximum: 100
        default: 100
    pageToken:
      name: pageToken
      in: query
      description: The cursor for pagination. Present only if there is an additional page of data to view.
      schema:
        type: string
      example: KuMvTQrdHVVKuMDDdcIvTQrdci1FWdcIHVVci1FW
    member:
      in: path
      name: member
      required: true
      description: HRN identifying member
      schema:
        type: string
      example: hrn:here:account::myrealm:user/HERE-00000000-0000-0000-0000-000000000000
    groupsSearch:
      in: query
      name: q
      required: false
      description: A free text query string used to filter the results.  A search against groups in the realm will consider the 'id', 'name', and 'description' fields of the groups.  The precise search algorithm used to match groups is not specified, but generally any member where one of the considered fields has a full or partial match should be included in the results.
      schema:
        type: string
    permissionServiceId:
      in: query
      name: serviceId
      required: false
      description: Only include permissions associated with the requested service
      schema:
        type: string
      example: SERVICE-00000000-0000-0000-0000-000000000000
    policyHrn:
      in: path
      name: policy
      required: true
      description: 'HRN identifying the policy.

        '
      schema:
        type: string
      example: hrn:here:authorization::HERE:policy/POLICY-99b7c7d7-867a-4573-8730-4689be1718c9
  headers:
    XCorrelationId:
      schema:
        type: string
      required: false
      description: 'Correlates HTTP requests between a client and server. If not present in the incoming request, it will be generated.

        '
  responses:
    NotFound:
      description: The requested resource was not found, see error response for details
      headers:
        X-Correlation-ID:
          $ref: '#/components/headers/XCorrelationId'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NoContent:
      description: No Content
      headers:
        X-Correlation-ID:
          $ref: '#/components/headers/XCorrelationId'
    Forbidden:
      description: You do not have permission to perform this action
      headers:
        X-Correlation-ID:
          $ref: '#/components/headers/XCorrelationId'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Access is denied due to invalid credentials
      headers:
        X-Correlation-ID:
          $ref: '#/components/headers/XCorrelationId'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer Access Token issued to either the User or Client.
externalDocs:
  description: The developer guide and related API references are available here.
  url: https://www.here.com/docs/category/identity-and-access-management