openapi: 3.0.3 info: title: Infisical Admin Identity Specific Privileges V2 API description: List of all available APIs that can be consumed version: 0.0.1 servers: - url: https://us.infisical.com description: Production server (US) - url: https://eu.infisical.com description: Production server (EU) - url: http://localhost:8080 description: Local server tags: - name: Identity Specific Privileges V2 paths: /api/v2/identity-project-additional-privilege: post: operationId: createIdentityProjectAdditionalPrivilege tags: - Identity Specific Privileges V2 description: Add an additional privilege for identity. requestBody: required: true content: application/json: schema: type: object properties: identityId: type: string minLength: 1 description: The ID of the machine identity to create the privilege for. projectId: type: string minLength: 1 description: The ID of the project of the identity in. slug: type: string minLength: 1 maxLength: 60 description: The slug of the privilege to create. permissions: type: array items: anyOf: - type: object properties: subject: type: string enum: - secrets description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - describeSecret - readValue - create - edit - delete - type: array items: type: string enum: - read - describeSecret - readValue - create - edit - delete minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretTags: type: object properties: $in: type: array items: type: string minLength: 1 $all: type: array items: type: string minLength: 1 additionalProperties: false eventType: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-folders description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-imports description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - dynamic-secrets description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read-root-credential - create-root-credential - edit-root-credential - delete-root-credential - lease - type: array items: type: string enum: - read-root-credential - create-root-credential - edit-root-credential - delete-root-credential - lease minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false metadata: type: object properties: $elemMatch: type: object properties: key: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false value: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false required: - $elemMatch additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - identity description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - grant-privileges - assign-role - assign-additional-privileges - assume-privileges - revoke-auth - create-token - get-token - delete-token - type: array items: type: string enum: - read - create - edit - delete - grant-privileges - assign-role - assign-additional-privileges - assume-privileges - revoke-auth - create-token - get-token - delete-token minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: identityId: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false assignableRole: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false assignableSubject: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false assignableAction: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - ssh-hosts description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - issue-host-cert - type: array items: type: string enum: - read - create - edit - delete - issue-host-cert minItems: 1 description: Describe what action an entity can take. inverted: type: boolean description: Whether rule allows or forbids. conditions: type: object properties: hostname: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $glob: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pki-subscribers description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - issue-cert - list-certs - type: array items: type: string enum: - read - create - edit - delete - issue-cert - list-certs minItems: 1 description: Describe what action an entity can take. inverted: type: boolean description: Whether rule allows or forbids. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $glob: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - certificate-templates description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - issue-cert - list-certs - type: array items: type: string enum: - read - create - edit - delete - issue-cert - list-certs minItems: 1 description: Describe what action an entity can take. inverted: type: boolean description: Whether rule allows or forbids. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $glob: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-rotation description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - read-generated-credentials - create - edit - delete - rotate-secrets - type: array items: type: string enum: - read - read-generated-credentials - create - edit - delete - rotate-secrets minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false connectionId: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-syncs description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - sync-secrets - import-secrets - remove-secrets - type: array items: type: string enum: - read - create - edit - delete - sync-secrets - import-secrets - remove-secrets minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false connectionId: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pki-syncs description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - sync-certificates - import-certificates - remove-certificates - type: array items: type: string enum: - read - create - edit - delete - sync-certificates - import-certificates - remove-certificates minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false subscriberName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-event-subscriptions description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - subscribe-to-creation-events - subscribe-to-update-events - subscribe-to-deletion-events - subscribe-to-import-mutation-events - type: array items: type: string enum: - subscribe-to-creation-events - subscribe-to-update-events - subscribe-to-deletion-events - subscribe-to-import-mutation-events minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false connectionId: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - certificate-profiles description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - issue-cert - reveal-acme-eab-secret - rotate-acme-eab-secret - manage-application-attachments - type: array items: type: string enum: - read - create - edit - delete - issue-cert - reveal-acme-eab-secret - rotate-acme-eab-secret - manage-application-attachments minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: slug: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - certificate-policies description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $glob: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - certificate-authorities description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - issue-ca-certificate - sign-intermediate - type: array items: type: string enum: - read - create - edit - delete - issue-ca-certificate - sign-intermediate minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - certificates description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - read-private-key - import - type: array items: type: string enum: - read - create - edit - delete - read-private-key - import minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: commonName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false altNames: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false serialNumber: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false friendlyName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false status: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false metadata: type: object properties: $elemMatch: type: object properties: key: type: object properties: $eq: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false value: type: object properties: $eq: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false required: - $elemMatch additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-approval description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-rollback description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - type: array items: type: string enum: - read - create minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - member description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - grant-privileges - assign-role - assign-additional-privileges - assume-privileges - type: array items: type: string enum: - read - create - edit - delete - grant-privileges - assign-role - assign-additional-privileges - assume-privileges minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: userEmail: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false assignableRole: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false assignableSubject: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false assignableAction: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - groups description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - grant-privileges - assign-role - type: array items: type: string enum: - read - create - edit - delete - grant-privileges - assign-role minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: groupName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false assignableRole: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - role description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - integrations description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - webhooks description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - service-tokens description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - settings description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - environments description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - tags description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - audit-logs description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - type: array items: type: string enum: - read minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - insights description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - type: array items: type: string enum: - read minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - ip-allowlist description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - ssh-certificate-authorities description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - ssh-certificates description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - ssh-certificate-templates description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - ssh-host-groups description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pki-alerts description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pki-collections description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - certificate-inventory-views description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pki-discovery description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - run-scan - type: array items: type: string enum: - read - create - edit - delete - run-scan minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pki-certificate-installations description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - edit - delete - type: array items: type: string enum: - read - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - code-signers description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - sign - type: array items: type: string enum: - read - create - edit - delete - sign minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - workspace description: The entity this permission pertains to. action: anyOf: - type: string enum: - edit - delete - type: array items: type: string enum: - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - kms description: The entity this permission pertains to. action: anyOf: - type: string enum: - edit - type: array items: type: string enum: - edit minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - cmek description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - encrypt - decrypt - sign - verify - export-private-key - type: array items: type: string enum: - read - create - edit - delete - encrypt - decrypt - sign - verify - export-private-key minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - kmip description: The entity this permission pertains to. action: anyOf: - type: string enum: - create-clients - update-clients - delete-clients - read-clients - generate-client-certificates - type: array items: type: string enum: - create-clients - update-clients - delete-clients - read-clients - generate-client-certificates minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - commits description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - perform-rollback - type: array items: type: string enum: - read - perform-rollback minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-scanning-data-sources description: The entity this permission pertains to. action: anyOf: - type: string enum: - read-data-sources - create-data-sources - edit-data-sources - delete-data-sources - trigger-data-source-scans - read-data-source-scans - read-data-source-resources - type: array items: type: string enum: - read-data-sources - create-data-sources - edit-data-sources - delete-data-sources - trigger-data-source-scans - read-data-source-scans - read-data-source-resources minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-scanning-findings description: The entity this permission pertains to. action: anyOf: - type: string enum: - read-findings - update-findings - type: array items: type: string enum: - read-findings - update-findings minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-scanning-configs description: The entity this permission pertains to. action: anyOf: - type: string enum: - read-configs - update-configs - type: array items: type: string enum: - read-configs - update-configs minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - app-connections description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read-app-connections - create-app-connections - edit-app-connections - delete-app-connections - connect-app-connections - rotate-credentials - type: array items: type: string enum: - read-app-connections - create-app-connections - edit-app-connections - delete-app-connections - connect-app-connections - rotate-credentials minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: connectionId: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-folders description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-resources description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false resourceType: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false metadata: type: object properties: $elemMatch: type: object properties: key: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false value: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false required: - $elemMatch additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-domains description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false domainType: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false metadata: type: object properties: $elemMatch: type: object properties: key: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false value: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false required: - $elemMatch additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given domain. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-accounts description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - access - read - create - edit - delete - trigger-rotation - read-credentials - type: array items: type: string enum: - access - read - create - edit - delete - trigger-rotation - read-credentials minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: resourceName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false accountName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false resourceType: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false domainName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false domainType: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false metadata: type: object properties: $elemMatch: type: object properties: key: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false value: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false required: - $elemMatch additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-sessions description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - terminate - type: array items: type: string enum: - read - terminate minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-account-policies description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-discovery description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - run-scan - type: array items: type: string enum: - read - create - edit - delete - run-scan minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-insights description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - type: array items: type: string enum: - read minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - mcp-endpoints description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - connect - type: array items: type: string enum: - read - create - edit - delete - connect minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $glob: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - mcp-servers description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - mcp-activity-logs description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - honey-tokens description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - read-credentials - create - edit - reset - revoke - type: array items: type: string enum: - read - read-credentials - create - edit - reset - revoke minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - approval-requests description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - type: array items: type: string enum: - read - create minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - approval-request-grants description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - revoke - type: array items: type: string enum: - read - revoke minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-approval-request description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - type: array items: type: string enum: - read minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false description: The permission for the privilege. type: anyOf: - type: object properties: isTemporary: type: boolean enum: - false required: - isTemporary additionalProperties: false - type: object properties: isTemporary: type: boolean enum: - true temporaryMode: type: string enum: - relative description: 'Type of temporary access given. Types: relative.' temporaryRange: type: string description: 'The TTL for the temporary access given. Eg: 1m, 1h, 1d.' temporaryAccessStartTime: type: string format: date-time description: The start time in ISO format when the temporary access should begin. required: - isTemporary - temporaryMode - temporaryRange - temporaryAccessStartTime additionalProperties: false required: - identityId - projectId - permissions - type additionalProperties: false security: - bearerAuth: [] responses: '200': description: Default Response content: application/json: schema: type: object properties: privilege: type: object properties: id: type: string format: uuid slug: type: string isTemporary: type: boolean default: false temporaryMode: type: string nullable: true temporaryRange: type: string nullable: true temporaryAccessStartTime: type: string format: date-time nullable: true temporaryAccessEndTime: type: string format: date-time nullable: true permissions: type: array items: type: object properties: subject: anyOf: - type: string minLength: 1 - type: array items: type: string action: anyOf: - type: string minLength: 1 - type: array items: type: string conditions: {} inverted: type: boolean required: - action additionalProperties: false createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - slug - permissions - createdAt - updatedAt additionalProperties: false required: - privilege additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false get: operationId: listIdentityProjectAdditionalPrivileges tags: - Identity Specific Privileges V2 description: List privileges for the specified identity by project. parameters: - schema: type: string minLength: 1 in: query name: identityId required: true description: The ID of the machine identity to list. - schema: type: string minLength: 1 in: query name: projectId required: true description: The ID of the project that the identity is in. security: - bearerAuth: [] responses: '200': description: Default Response content: application/json: schema: type: object properties: privileges: type: array items: type: object properties: id: type: string format: uuid slug: type: string isTemporary: type: boolean default: false temporaryMode: type: string nullable: true temporaryRange: type: string nullable: true temporaryAccessStartTime: type: string format: date-time nullable: true temporaryAccessEndTime: type: string format: date-time nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - slug - createdAt - updatedAt additionalProperties: false required: - privileges additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v2/identity-project-additional-privilege/{id}: patch: operationId: updateIdentityProjectAdditionalPrivilege tags: - Identity Specific Privileges V2 description: Update a specific identity privilege. requestBody: required: true content: application/json: schema: type: object properties: slug: type: string minLength: 1 maxLength: 60 description: The slug of the privilege to update. permissions: type: array items: anyOf: - type: object properties: subject: type: string enum: - secrets description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - describeSecret - readValue - create - edit - delete - type: array items: type: string enum: - read - describeSecret - readValue - create - edit - delete minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretTags: type: object properties: $in: type: array items: type: string minLength: 1 $all: type: array items: type: string minLength: 1 additionalProperties: false eventType: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-folders description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-imports description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - dynamic-secrets description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read-root-credential - create-root-credential - edit-root-credential - delete-root-credential - lease - type: array items: type: string enum: - read-root-credential - create-root-credential - edit-root-credential - delete-root-credential - lease minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false metadata: type: object properties: $elemMatch: type: object properties: key: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false value: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false required: - $elemMatch additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - identity description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - grant-privileges - assign-role - assign-additional-privileges - assume-privileges - revoke-auth - create-token - get-token - delete-token - type: array items: type: string enum: - read - create - edit - delete - grant-privileges - assign-role - assign-additional-privileges - assume-privileges - revoke-auth - create-token - get-token - delete-token minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: identityId: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false assignableRole: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false assignableSubject: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false assignableAction: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - ssh-hosts description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - issue-host-cert - type: array items: type: string enum: - read - create - edit - delete - issue-host-cert minItems: 1 description: Describe what action an entity can take. inverted: type: boolean description: Whether rule allows or forbids. conditions: type: object properties: hostname: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $glob: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pki-subscribers description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - issue-cert - list-certs - type: array items: type: string enum: - read - create - edit - delete - issue-cert - list-certs minItems: 1 description: Describe what action an entity can take. inverted: type: boolean description: Whether rule allows or forbids. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $glob: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - certificate-templates description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - issue-cert - list-certs - type: array items: type: string enum: - read - create - edit - delete - issue-cert - list-certs minItems: 1 description: Describe what action an entity can take. inverted: type: boolean description: Whether rule allows or forbids. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $glob: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-rotation description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - read-generated-credentials - create - edit - delete - rotate-secrets - type: array items: type: string enum: - read - read-generated-credentials - create - edit - delete - rotate-secrets minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false connectionId: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-syncs description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - sync-secrets - import-secrets - remove-secrets - type: array items: type: string enum: - read - create - edit - delete - sync-secrets - import-secrets - remove-secrets minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false connectionId: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pki-syncs description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - sync-certificates - import-certificates - remove-certificates - type: array items: type: string enum: - read - create - edit - delete - sync-certificates - import-certificates - remove-certificates minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false subscriberName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-event-subscriptions description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - subscribe-to-creation-events - subscribe-to-update-events - subscribe-to-deletion-events - subscribe-to-import-mutation-events - type: array items: type: string enum: - subscribe-to-creation-events - subscribe-to-update-events - subscribe-to-deletion-events - subscribe-to-import-mutation-events minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false connectionId: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - certificate-profiles description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - issue-cert - reveal-acme-eab-secret - rotate-acme-eab-secret - manage-application-attachments - type: array items: type: string enum: - read - create - edit - delete - issue-cert - reveal-acme-eab-secret - rotate-acme-eab-secret - manage-application-attachments minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: slug: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - certificate-policies description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $glob: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - certificate-authorities description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - issue-ca-certificate - sign-intermediate - type: array items: type: string enum: - read - create - edit - delete - issue-ca-certificate - sign-intermediate minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - certificates description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - read-private-key - import - type: array items: type: string enum: - read - create - edit - delete - read-private-key - import minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: commonName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false altNames: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false serialNumber: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false friendlyName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false status: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false metadata: type: object properties: $elemMatch: type: object properties: key: type: object properties: $eq: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false value: type: object properties: $eq: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false required: - $elemMatch additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-approval description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-rollback description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - type: array items: type: string enum: - read - create minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - member description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - grant-privileges - assign-role - assign-additional-privileges - assume-privileges - type: array items: type: string enum: - read - create - edit - delete - grant-privileges - assign-role - assign-additional-privileges - assume-privileges minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: userEmail: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false assignableRole: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false assignableSubject: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false assignableAction: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - groups description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - grant-privileges - assign-role - type: array items: type: string enum: - read - create - edit - delete - grant-privileges - assign-role minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: groupName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false assignableRole: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - role description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - integrations description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - webhooks description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - service-tokens description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - settings description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - environments description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - tags description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - audit-logs description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - type: array items: type: string enum: - read minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - insights description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - type: array items: type: string enum: - read minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - ip-allowlist description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - ssh-certificate-authorities description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - ssh-certificates description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - ssh-certificate-templates description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - ssh-host-groups description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pki-alerts description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pki-collections description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - certificate-inventory-views description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pki-discovery description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - run-scan - type: array items: type: string enum: - read - create - edit - delete - run-scan minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pki-certificate-installations description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - edit - delete - type: array items: type: string enum: - read - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - code-signers description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - sign - type: array items: type: string enum: - read - create - edit - delete - sign minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - workspace description: The entity this permission pertains to. action: anyOf: - type: string enum: - edit - delete - type: array items: type: string enum: - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - kms description: The entity this permission pertains to. action: anyOf: - type: string enum: - edit - type: array items: type: string enum: - edit minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - cmek description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - encrypt - decrypt - sign - verify - export-private-key - type: array items: type: string enum: - read - create - edit - delete - encrypt - decrypt - sign - verify - export-private-key minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - kmip description: The entity this permission pertains to. action: anyOf: - type: string enum: - create-clients - update-clients - delete-clients - read-clients - generate-client-certificates - type: array items: type: string enum: - create-clients - update-clients - delete-clients - read-clients - generate-client-certificates minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - commits description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - perform-rollback - type: array items: type: string enum: - read - perform-rollback minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-scanning-data-sources description: The entity this permission pertains to. action: anyOf: - type: string enum: - read-data-sources - create-data-sources - edit-data-sources - delete-data-sources - trigger-data-source-scans - read-data-source-scans - read-data-source-resources - type: array items: type: string enum: - read-data-sources - create-data-sources - edit-data-sources - delete-data-sources - trigger-data-source-scans - read-data-source-scans - read-data-source-resources minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-scanning-findings description: The entity this permission pertains to. action: anyOf: - type: string enum: - read-findings - update-findings - type: array items: type: string enum: - read-findings - update-findings minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-scanning-configs description: The entity this permission pertains to. action: anyOf: - type: string enum: - read-configs - update-configs - type: array items: type: string enum: - read-configs - update-configs minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - app-connections description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read-app-connections - create-app-connections - edit-app-connections - delete-app-connections - connect-app-connections - rotate-credentials - type: array items: type: string enum: - read-app-connections - create-app-connections - edit-app-connections - delete-app-connections - connect-app-connections - rotate-credentials minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: connectionId: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-folders description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-resources description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false resourceType: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false metadata: type: object properties: $elemMatch: type: object properties: key: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false value: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false required: - $elemMatch additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-domains description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false domainType: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false metadata: type: object properties: $elemMatch: type: object properties: key: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false value: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false required: - $elemMatch additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given domain. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-accounts description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - access - read - create - edit - delete - trigger-rotation - read-credentials - type: array items: type: string enum: - access - read - create - edit - delete - trigger-rotation - read-credentials minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: resourceName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false accountName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false resourceType: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false domainName: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false domainType: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false metadata: type: object properties: $elemMatch: type: object properties: key: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false value: type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false required: - $elemMatch additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-sessions description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - terminate - type: array items: type: string enum: - read - terminate minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-account-policies description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-discovery description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - run-scan - type: array items: type: string enum: - read - create - edit - delete - run-scan minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - pam-insights description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - type: array items: type: string enum: - read minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - mcp-endpoints description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - create - edit - delete - connect - type: array items: type: string enum: - read - create - edit - delete - connect minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: name: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $glob: type: string minLength: 1 $in: type: array items: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - mcp-servers description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - mcp-activity-logs description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - edit - delete - type: array items: type: string enum: - read - create - edit - delete minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - honey-tokens description: The entity this permission pertains to. inverted: type: boolean description: Whether rule allows or forbids. action: anyOf: - type: string enum: - read - read-credentials - create - edit - reset - revoke - type: array items: type: string enum: - read - read-credentials - create - edit - reset - revoke minItems: 1 description: Describe what action an entity can take. conditions: type: object properties: environment: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false secretPath: anyOf: - type: string - type: object properties: $eq: type: string minLength: 1 $ne: type: string minLength: 1 $in: type: array items: type: string minLength: 1 $glob: type: string minLength: 1 additionalProperties: false additionalProperties: false description: When specified, only matching conditions will be allowed to access given resource. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - approval-requests description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - create - type: array items: type: string enum: - read - create minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - approval-request-grants description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - revoke - type: array items: type: string enum: - read - revoke minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false - type: object properties: subject: type: string enum: - secret-approval-request description: The entity this permission pertains to. action: anyOf: - type: string enum: - read - type: array items: type: string enum: - read minItems: 1 description: Describe what action an entity can take. required: - subject - action additionalProperties: false description: The permission for the privilege. type: anyOf: - type: object properties: isTemporary: type: boolean enum: - false description: Whether the privilege is temporary. required: - isTemporary additionalProperties: false - type: object properties: isTemporary: type: boolean enum: - true description: Whether the privilege is temporary. temporaryMode: type: string enum: - relative description: 'Type of temporary access given. Types: relative.' temporaryRange: type: string description: 'The TTL for the temporary access given. Eg: 1m, 1h, 1d.' temporaryAccessStartTime: type: string format: date-time description: The start time in ISO format when the temporary access should begin. required: - isTemporary - temporaryMode - temporaryRange - temporaryAccessStartTime additionalProperties: false required: - slug - permissions - type additionalProperties: false parameters: - schema: type: string in: path name: id required: true description: The ID of the identity privilege. security: - bearerAuth: [] responses: '200': description: Default Response content: application/json: schema: type: object properties: privilege: type: object properties: id: type: string format: uuid slug: type: string isTemporary: type: boolean default: false temporaryMode: type: string nullable: true temporaryRange: type: string nullable: true temporaryAccessStartTime: type: string format: date-time nullable: true temporaryAccessEndTime: type: string format: date-time nullable: true permissions: type: array items: type: object properties: subject: anyOf: - type: string minLength: 1 - type: array items: type: string action: anyOf: - type: string minLength: 1 - type: array items: type: string conditions: {} inverted: type: boolean required: - action additionalProperties: false createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - slug - permissions - createdAt - updatedAt additionalProperties: false required: - privilege additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false delete: operationId: deleteIdentityProjectAdditionalPrivilege tags: - Identity Specific Privileges V2 description: Delete the specified identity privilege. parameters: - schema: type: string in: path name: id required: true description: The ID of the identity privilege. security: - bearerAuth: [] responses: '200': description: Default Response content: application/json: schema: type: object properties: privilege: type: object properties: id: type: string format: uuid slug: type: string isTemporary: type: boolean default: false temporaryMode: type: string nullable: true temporaryRange: type: string nullable: true temporaryAccessStartTime: type: string format: date-time nullable: true temporaryAccessEndTime: type: string format: date-time nullable: true permissions: type: array items: type: object properties: subject: anyOf: - type: string minLength: 1 - type: array items: type: string action: anyOf: - type: string minLength: 1 - type: array items: type: string conditions: {} inverted: type: boolean required: - action additionalProperties: false createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - slug - permissions - createdAt - updatedAt additionalProperties: false required: - privilege additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false get: operationId: getIdentityProjectAdditionalPrivilege tags: - Identity Specific Privileges V2 description: Retrieve details of a specific privilege by id. parameters: - schema: type: string minLength: 1 in: path name: id required: true description: The ID of the identity privilege. security: - bearerAuth: [] responses: '200': description: Default Response content: application/json: schema: type: object properties: privilege: type: object properties: id: type: string format: uuid slug: type: string isTemporary: type: boolean default: false temporaryMode: type: string nullable: true temporaryRange: type: string nullable: true temporaryAccessStartTime: type: string format: date-time nullable: true temporaryAccessEndTime: type: string format: date-time nullable: true permissions: type: array items: type: object properties: subject: anyOf: - type: string minLength: 1 - type: array items: type: string action: anyOf: - type: string minLength: 1 - type: array items: type: string conditions: {} inverted: type: boolean required: - action additionalProperties: false createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - slug - permissions - createdAt - updatedAt additionalProperties: false required: - privilege additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v2/identity-project-additional-privilege/slug/{privilegeSlug}: get: operationId: getIdentityProjectAdditionalPrivilegeBySlug tags: - Identity Specific Privileges V2 description: Retrieve details of a specific privilege by slug. parameters: - schema: type: string minLength: 1 in: query name: identityId required: true description: The ID of the machine identity to list. - schema: type: string minLength: 1 in: query name: projectSlug required: true description: The slug of the project of the identity in. - schema: type: string minLength: 1 in: path name: privilegeSlug required: true description: The slug of the privilege. security: - bearerAuth: [] responses: '200': description: Default Response content: application/json: schema: type: object properties: privilege: type: object properties: id: type: string format: uuid slug: type: string isTemporary: type: boolean default: false temporaryMode: type: string nullable: true temporaryRange: type: string nullable: true temporaryAccessStartTime: type: string format: date-time nullable: true temporaryAccessEndTime: type: string format: date-time nullable: true permissions: type: array items: type: object properties: subject: anyOf: - type: string minLength: 1 - type: array items: type: string action: anyOf: - type: string minLength: 1 - type: array items: type: string conditions: {} inverted: type: boolean required: - action additionalProperties: false createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - slug - permissions - createdAt - updatedAt additionalProperties: false required: - privilege additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: An access token in Infisical