swagger: '2.0'
info:
  contact:
    email: lxc-devel@lists.linuxcontainers.org
    name: Incus upstream
    url: https://github.com/lxc/incus
  description: 'This is the REST API used by all Incus clients.

    Internal endpoints aren''t included in this documentation.


    The Incus API is available over both a local unix+http and remote https API.

    Authentication for local users relies on group membership and access to the unix socket.

    For remote users, the default authentication method is TLS client

    certificates.'
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
  title: Incus external REST certificates network-acls API
  version: '1.0'
tags:
- name: network-acls
paths:
  /1.0/network-acls:
    get:
      description: Returns a list of network ACLs (URLs).
      operationId: network_acls_get
      parameters:
      - description: Project name
        example: default
        in: query
        name: project
        type: string
      - description: Retrieve network ACLs from all projects
        example: true
        in: query
        name: all-projects
        type: boolean
      - description: Collection filter
        example: default
        in: query
        name: filter
        type: string
      produces:
      - application/json
      responses:
        '200':
          description: API endpoints
          schema:
            description: Sync response
            properties:
              metadata:
                description: List of endpoints
                example: "[\n  \"/1.0/network-acls/foo\",\n  \"/1.0/network-acls/bar\"\n]"
                items:
                  type: string
                type: array
              status:
                description: Status description
                example: Success
                type: string
              status_code:
                description: Status code
                example: 200
                type: integer
              type:
                description: Response type
                example: sync
                type: string
            type: object
        '403':
          $ref: '#/responses/Forbidden'
        '500':
          $ref: '#/responses/InternalServerError'
      summary: Get the network ACLs
      tags:
      - network-acls
    post:
      consumes:
      - application/json
      description: Creates a new network ACL.
      operationId: network_acls_post
      parameters:
      - description: Project name
        example: default
        in: query
        name: project
        type: string
      - description: ACL
        in: body
        name: acl
        required: true
        schema:
          $ref: '#/definitions/NetworkACLsPost'
      produces:
      - application/json
      responses:
        '200':
          $ref: '#/responses/EmptySyncResponse'
        '400':
          $ref: '#/responses/BadRequest'
        '403':
          $ref: '#/responses/Forbidden'
        '500':
          $ref: '#/responses/InternalServerError'
      summary: Add a network ACL
      tags:
      - network-acls
  /1.0/network-acls/{name}:
    delete:
      description: Removes the network ACL.
      operationId: network_acl_delete
      parameters:
      - description: ACL name
        in: path
        name: name
        required: true
        type: string
      - description: Project name
        example: default
        in: query
        name: project
        type: string
      produces:
      - application/json
      responses:
        '200':
          $ref: '#/responses/EmptySyncResponse'
        '400':
          $ref: '#/responses/BadRequest'
        '403':
          $ref: '#/responses/Forbidden'
        '500':
          $ref: '#/responses/InternalServerError'
      summary: Delete the network ACL
      tags:
      - network-acls
    get:
      description: Gets a specific network ACL.
      operationId: network_acl_get
      parameters:
      - description: ACL name
        in: path
        name: name
        required: true
        type: string
      - description: Project name
        example: default
        in: query
        name: project
        type: string
      produces:
      - application/json
      responses:
        '200':
          description: ACL
          schema:
            description: Sync response
            properties:
              metadata:
                $ref: '#/definitions/NetworkACL'
              status:
                description: Status description
                example: Success
                type: string
              status_code:
                description: Status code
                example: 200
                type: integer
              type:
                description: Response type
                example: sync
                type: string
            type: object
        '403':
          $ref: '#/responses/Forbidden'
        '500':
          $ref: '#/responses/InternalServerError'
      summary: Get the network ACL
      tags:
      - network-acls
    patch:
      consumes:
      - application/json
      description: Updates a subset of the network ACL configuration.
      operationId: network_acl_patch
      parameters:
      - description: ACL name
        in: path
        name: name
        required: true
        type: string
      - description: Project name
        example: default
        in: query
        name: project
        type: string
      - description: ACL configuration
        in: body
        name: acl
        required: true
        schema:
          $ref: '#/definitions/NetworkACLPut'
      produces:
      - application/json
      responses:
        '200':
          $ref: '#/responses/EmptySyncResponse'
        '400':
          $ref: '#/responses/BadRequest'
        '403':
          $ref: '#/responses/Forbidden'
        '412':
          $ref: '#/responses/PreconditionFailed'
        '500':
          $ref: '#/responses/InternalServerError'
      summary: Partially update the network ACL
      tags:
      - network-acls
    post:
      consumes:
      - application/json
      description: Renames an existing network ACL.
      operationId: network_acl_post
      parameters:
      - description: ACL name
        in: path
        name: name
        required: true
        type: string
      - description: Project name
        example: default
        in: query
        name: project
        type: string
      - description: ACL rename request
        in: body
        name: acl
        required: true
        schema:
          $ref: '#/definitions/NetworkACLPost'
      produces:
      - application/json
      responses:
        '200':
          $ref: '#/responses/EmptySyncResponse'
        '400':
          $ref: '#/responses/BadRequest'
        '403':
          $ref: '#/responses/Forbidden'
        '500':
          $ref: '#/responses/InternalServerError'
      summary: Rename the network ACL
      tags:
      - network-acls
    put:
      consumes:
      - application/json
      description: Updates the entire network ACL configuration.
      operationId: network_acl_put
      parameters:
      - description: ACL name
        in: path
        name: name
        required: true
        type: string
      - description: Project name
        example: default
        in: query
        name: project
        type: string
      - description: ACL configuration
        in: body
        name: acl
        required: true
        schema:
          $ref: '#/definitions/NetworkACLPut'
      produces:
      - application/json
      responses:
        '200':
          $ref: '#/responses/EmptySyncResponse'
        '400':
          $ref: '#/responses/BadRequest'
        '403':
          $ref: '#/responses/Forbidden'
        '412':
          $ref: '#/responses/PreconditionFailed'
        '500':
          $ref: '#/responses/InternalServerError'
      summary: Update the network ACL
      tags:
      - network-acls
  /1.0/network-acls/{name}/log:
    get:
      description: Gets a specific network ACL log entries.
      operationId: network_acl_log_get
      parameters:
      - description: ACL name
        in: path
        name: name
        required: true
        type: string
      - description: Project name
        example: default
        in: query
        name: project
        type: string
      produces:
      - application/octet-stream
      responses:
        '200':
          description: Raw log file
        '403':
          $ref: '#/responses/Forbidden'
        '500':
          $ref: '#/responses/InternalServerError'
      summary: Get the network ACL log
      tags:
      - network-acls
  /1.0/network-acls?recursion=1:
    get:
      description: Returns a list of network ACLs (structs).
      operationId: network_acls_get_recursion1
      parameters:
      - description: Project name
        example: default
        in: query
        name: project
        type: string
      - description: Retrieve network ACLs from all projects
        example: true
        in: query
        name: all-projects
        type: boolean
      - description: Collection filter
        example: default
        in: query
        name: filter
        type: string
      produces:
      - application/json
      responses:
        '200':
          description: API endpoints
          schema:
            description: Sync response
            properties:
              metadata:
                description: List of network ACLs
                items:
                  $ref: '#/definitions/NetworkACL'
                type: array
              status:
                description: Status description
                example: Success
                type: string
              status_code:
                description: Status code
                example: 200
                type: integer
              type:
                description: Response type
                example: sync
                type: string
            type: object
        '403':
          $ref: '#/responses/Forbidden'
        '500':
          $ref: '#/responses/InternalServerError'
      summary: Get the network ACLs
      tags:
      - network-acls
definitions:
  NetworkACLPost:
    properties:
      name:
        description: The new name for the ACL
        example: bar
        type: string
        x-go-name: Name
    title: NetworkACLPost used for renaming an ACL.
    type: object
    x-go-package: github.com/lxc/incus/v7/shared/api
  NetworkACLRule:
    description: Refer to doc/network-acls.md for details.
    properties:
      action:
        description: Action to perform on rule match
        example: allow
        type: string
        x-go-name: Action
      description:
        description: Description of the rule
        example: Allow DNS queries to Google DNS
        type: string
        x-go-name: Description
      destination:
        description: Destination address
        example: 8.8.8.8/32,8.8.4.4/32
        type: string
        x-go-name: Destination
      destination_port:
        description: Destination port
        example: '53'
        type: string
        x-go-name: DestinationPort
      icmp_code:
        description: ICMP message code (for ICMP protocol)
        example: '0'
        type: string
        x-go-name: ICMPCode
      icmp_type:
        description: Type of ICMP message (for ICMP protocol)
        example: '8'
        type: string
        x-go-name: ICMPType
      protocol:
        description: Protocol
        example: udp
        type: string
        x-go-name: Protocol
      source:
        description: Source address
        example: '@internal'
        type: string
        x-go-name: Source
      source_port:
        description: Source port
        example: '1234'
        type: string
        x-go-name: SourcePort
      state:
        description: State of the rule
        example: enabled
        type: string
        x-go-name: State
    title: NetworkACLRule represents a single rule in an ACL ruleset.
    type: object
    x-go-package: github.com/lxc/incus/v7/shared/api
  NetworkACL:
    properties:
      config:
        description: ACL configuration map (refer to doc/network-acls.md)
        example:
          user.mykey: foo
        type: object
        x-go-name: Config
      description:
        description: Description of the ACL
        example: Web servers
        type: string
        x-go-name: Description
      egress:
        description: List of egress rules (order independent)
        items:
          $ref: '#/definitions/NetworkACLRule'
        type: array
        x-go-name: Egress
      ingress:
        description: List of ingress rules (order independent)
        items:
          $ref: '#/definitions/NetworkACLRule'
        type: array
        x-go-name: Ingress
      name:
        description: The new name for the ACL
        example: bar
        type: string
        x-go-name: Name
      project:
        description: Project name
        example: project1
        type: string
        x-go-name: Project
      used_by:
        description: List of URLs of objects using this profile
        example:
        - /1.0/instances/c1
        - /1.0/instances/v1
        - /1.0/networks/mybr0
        items:
          type: string
        readOnly: true
        type: array
        x-go-name: UsedBy
    title: NetworkACL used for displaying an ACL.
    type: object
    x-go-package: github.com/lxc/incus/v7/shared/api
  NetworkACLsPost:
    properties:
      config:
        description: ACL configuration map (refer to doc/network-acls.md)
        example:
          user.mykey: foo
        type: object
        x-go-name: Config
      description:
        description: Description of the ACL
        example: Web servers
        type: string
        x-go-name: Description
      egress:
        description: List of egress rules (order independent)
        items:
          $ref: '#/definitions/NetworkACLRule'
        type: array
        x-go-name: Egress
      ingress:
        description: List of ingress rules (order independent)
        items:
          $ref: '#/definitions/NetworkACLRule'
        type: array
        x-go-name: Ingress
      name:
        description: The new name for the ACL
        example: bar
        type: string
        x-go-name: Name
    title: NetworkACLsPost used for creating an ACL.
    type: object
    x-go-package: github.com/lxc/incus/v7/shared/api
  NetworkACLPut:
    properties:
      config:
        description: ACL configuration map (refer to doc/network-acls.md)
        example:
          user.mykey: foo
        type: object
        x-go-name: Config
      description:
        description: Description of the ACL
        example: Web servers
        type: string
        x-go-name: Description
      egress:
        description: List of egress rules (order independent)
        items:
          $ref: '#/definitions/NetworkACLRule'
        type: array
        x-go-name: Egress
      ingress:
        description: List of ingress rules (order independent)
        items:
          $ref: '#/definitions/NetworkACLRule'
        type: array
        x-go-name: Ingress
    title: NetworkACLPut used for updating an ACL.
    type: object
    x-go-package: github.com/lxc/incus/v7/shared/api
responses:
  Forbidden:
    description: Forbidden
    schema:
      properties:
        error:
          example: not authorized
          type: string
          x-go-name: Error
        error_code:
          example: 403
          format: int64
          type: integer
          x-go-name: ErrorCode
        type:
          example: error
          type: string
          x-go-name: Type
      type: object
  BadRequest:
    description: Bad Request
    schema:
      properties:
        error:
          example: bad request
          type: string
          x-go-name: Error
        error_code:
          example: 400
          format: int64
          type: integer
          x-go-name: ErrorCode
        type:
          example: error
          type: string
          x-go-name: Type
      type: object
  EmptySyncResponse:
    description: Empty sync response
    schema:
      properties:
        status:
          example: Success
          type: string
          x-go-name: Status
        status_code:
          example: 200
          format: int64
          type: integer
          x-go-name: StatusCode
        type:
          example: sync
          type: string
          x-go-name: Type
      type: object
  PreconditionFailed:
    description: Precondition Failed
    schema:
      properties:
        error:
          example: precondition failed
          type: string
          x-go-name: Error
        error_code:
          example: 412
          format: int64
          type: integer
          x-go-name: ErrorCode
        type:
          example: error
          type: string
          x-go-name: Type
      type: object
  InternalServerError:
    description: Internal Server Error
    schema:
      properties:
        error:
          example: internal server error
          type: string
          x-go-name: Error
        error_code:
          example: 500
          format: int64
          type: integer
          x-go-name: ErrorCode
        type:
          example: error
          type: string
          x-go-name: Type
      type: object