openapi: 3.0.3 info: title: Infisical Admin LDAP Auth API description: List of all available APIs that can be consumed version: 0.0.1 servers: - url: https://us.infisical.com description: Production server (US) - url: https://eu.infisical.com description: Production server (EU) - url: http://localhost:8080 description: Local server tags: - name: LDAP Auth paths: /api/v1/auth/ldap-auth/login: post: operationId: loginWithLdapAuth tags: - LDAP Auth description: Login with LDAP Auth for machine identity requestBody: required: true content: application/json: schema: type: object properties: identityId: type: string format: uuid description: The ID of the machine identity to login. username: type: string minLength: 1 description: The username of the LDAP user to login. password: type: string minLength: 1 description: The password of the LDAP user to login. organizationSlug: type: string minLength: 1 maxLength: 64 description: When set, this will scope the login session to the specified organization the machine identity has access to. If omitted, the session defaults to the organization where the machine identity was created in. required: - identityId - username - password additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: accessToken: type: string expiresIn: type: number accessTokenMaxTTL: type: number tokenType: type: string enum: - Bearer required: - accessToken - expiresIn - accessTokenMaxTTL - tokenType additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/auth/ldap-auth/identities/{identityId}: post: operationId: attachLdapAuth tags: - LDAP Auth description: Attach LDAP Auth configuration onto machine identity requestBody: required: true content: application/json: schema: anyOf: - type: object properties: templateId: type: string description: The ID of the identity auth template to attach the configuration onto. searchFilter: type: string minLength: 1 default: (uid={{username}}) description: The filter to use to search for the LDAP user. allowedFields: type: array items: type: object properties: key: type: string value: type: string required: - key - value additionalProperties: false description: The comma-separated array of key/value pairs of required fields that the LDAP entry must have in order to authenticate. ldapCaCertificate: type: string description: The PEM-encoded CA certificate for the LDAP server. accessTokenTrustedIps: type: array items: type: object properties: ipAddress: type: string required: - ipAddress additionalProperties: false minItems: 1 default: - ipAddress: 0.0.0.0/0 - ipAddress: ::/0 description: The IPs or CIDR ranges that access tokens can be used from. accessTokenTTL: type: integer minimum: 0 maximum: 315360000 default: 2592000 description: The lifetime for an access token in seconds. accessTokenMaxTTL: type: integer minimum: 1 maximum: 315360000 default: 2592000 description: The maximum lifetime for an access token in seconds. accessTokenNumUsesLimit: type: integer minimum: 0 default: 0 description: The maximum number of times that an access token can be used. lockoutEnabled: type: boolean default: true description: Whether the lockout feature is enabled. lockoutThreshold: type: number minimum: 1 maximum: 30 default: 3 description: The amount of times login must fail before locking the identity auth method. lockoutDurationSeconds: type: number minimum: 30 maximum: 86400 default: 300 description: How long an identity auth method lockout lasts. lockoutCounterResetSeconds: type: number minimum: 5 maximum: 3600 default: 30 description: How long to wait from the most recent failed login until resetting the lockout counter. required: - templateId additionalProperties: false - type: object properties: url: type: string description: The URL of the LDAP server. bindDN: type: string description: The DN of the user to bind to the LDAP server. bindPass: type: string description: The password of the user to bind to the LDAP server. searchBase: type: string description: The base DN to search for the LDAP user. searchFilter: type: string minLength: 1 default: (uid={{username}}) description: The filter to use to search for the LDAP user. allowedFields: type: array items: type: object properties: key: type: string value: type: string required: - key - value additionalProperties: false description: The comma-separated array of key/value pairs of required fields that the LDAP entry must have in order to authenticate. ldapCaCertificate: type: string description: The PEM-encoded CA certificate for the LDAP server. accessTokenTrustedIps: type: array items: type: object properties: ipAddress: type: string required: - ipAddress additionalProperties: false minItems: 1 default: - ipAddress: 0.0.0.0/0 - ipAddress: ::/0 description: The IPs or CIDR ranges that access tokens can be used from. accessTokenTTL: type: integer minimum: 0 maximum: 315360000 default: 2592000 description: The lifetime for an access token in seconds. accessTokenMaxTTL: type: integer minimum: 1 maximum: 315360000 default: 2592000 description: The maximum lifetime for an access token in seconds. accessTokenNumUsesLimit: type: integer minimum: 0 default: 0 description: The maximum number of times that an access token can be used. lockoutEnabled: type: boolean default: true description: Whether the lockout feature is enabled. lockoutThreshold: type: number minimum: 1 maximum: 30 default: 3 description: The amount of times login must fail before locking the identity auth method. lockoutDurationSeconds: type: number minimum: 30 maximum: 86400 default: 300 description: How long an identity auth method lockout lasts. lockoutCounterResetSeconds: type: number minimum: 5 maximum: 3600 default: 30 description: How long to wait from the most recent failed login until resetting the lockout counter. required: - url - bindDN - bindPass - searchBase additionalProperties: false parameters: - schema: type: string in: path name: identityId required: true description: The ID of the machine identity to attach the configuration onto. security: - bearerAuth: [] responses: '200': description: Default Response content: application/json: schema: type: object properties: identityLdapAuth: type: object properties: id: type: string format: uuid accessTokenTTL: type: number default: 7200 accessTokenMaxTTL: type: number default: 7200 accessTokenNumUsesLimit: type: number default: 0 accessTokenTrustedIps: {} identityId: type: string format: uuid url: type: string searchBase: type: string searchFilter: type: string allowedFields: nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time accessTokenPeriod: type: number default: 0 templateId: type: string format: uuid nullable: true lockoutEnabled: type: boolean default: true lockoutThreshold: type: number default: 3 lockoutDurationSeconds: type: number default: 300 lockoutCounterResetSeconds: type: number default: 30 required: - id - identityId - url - searchBase - searchFilter - createdAt - updatedAt additionalProperties: false required: - identityLdapAuth additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false patch: operationId: updateLdapAuth tags: - LDAP Auth description: Update LDAP Auth configuration on machine identity requestBody: required: true content: application/json: schema: type: object properties: url: type: string minLength: 1 description: The new URL of the LDAP server. bindDN: type: string minLength: 1 description: The new DN of the user to bind to the LDAP server. bindPass: type: string minLength: 1 description: The new password of the user to bind to the LDAP server. searchBase: type: string minLength: 1 description: The new base DN to search for the LDAP user. templateId: type: string description: The ID of the identity auth template to update the configuration to. searchFilter: type: string minLength: 1 description: The new filter to use to search for the LDAP user. allowedFields: type: array items: type: object properties: key: type: string value: type: string required: - key - value additionalProperties: false description: The comma-separated list of allowed fields to return from the LDAP user. accessTokenTrustedIps: type: array items: type: object properties: ipAddress: type: string required: - ipAddress additionalProperties: false minItems: 1 description: The new IPs or CIDR ranges that access tokens can be used from. accessTokenTTL: type: integer minimum: 0 maximum: 315360000 description: The new lifetime for an access token in seconds. accessTokenNumUsesLimit: type: integer minimum: 0 description: The new maximum number of times that an access token can be used. accessTokenMaxTTL: type: integer maximum: 315360000 minimum: 0 description: The new maximum lifetime for an access token in seconds. lockoutEnabled: type: boolean description: Whether the lockout feature is enabled. lockoutThreshold: type: number minimum: 1 maximum: 30 description: The amount of times login must fail before locking the identity auth method. lockoutDurationSeconds: type: number minimum: 30 maximum: 86400 description: How long an identity auth method lockout lasts. lockoutCounterResetSeconds: type: number minimum: 5 maximum: 3600 description: How long to wait from the most recent failed login until resetting the lockout counter. additionalProperties: false parameters: - schema: type: string in: path name: identityId required: true description: The ID of the machine identity to update the configuration for. security: - bearerAuth: [] responses: '200': description: Default Response content: application/json: schema: type: object properties: identityLdapAuth: type: object properties: id: type: string format: uuid accessTokenTTL: type: number default: 7200 accessTokenMaxTTL: type: number default: 7200 accessTokenNumUsesLimit: type: number default: 0 accessTokenTrustedIps: {} identityId: type: string format: uuid url: type: string searchBase: type: string searchFilter: type: string allowedFields: nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time accessTokenPeriod: type: number default: 0 templateId: type: string format: uuid nullable: true lockoutEnabled: type: boolean default: true lockoutThreshold: type: number default: 3 lockoutDurationSeconds: type: number default: 300 lockoutCounterResetSeconds: type: number default: 30 required: - id - identityId - url - searchBase - searchFilter - createdAt - updatedAt additionalProperties: false required: - identityLdapAuth additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false get: operationId: getLdapAuth tags: - LDAP Auth description: Retrieve LDAP Auth configuration on machine identity parameters: - schema: type: string in: path name: identityId required: true description: The ID of the machine identity to retrieve the configuration for. security: - bearerAuth: [] responses: '200': description: Default Response content: application/json: schema: type: object properties: identityLdapAuth: type: object properties: id: type: string format: uuid accessTokenTTL: type: number default: 7200 accessTokenMaxTTL: type: number default: 7200 accessTokenNumUsesLimit: type: number default: 0 accessTokenTrustedIps: {} identityId: type: string format: uuid url: type: string searchBase: type: string searchFilter: type: string allowedFields: nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time accessTokenPeriod: type: number default: 0 templateId: type: string nullable: true lockoutEnabled: type: boolean default: true lockoutThreshold: type: number default: 3 lockoutDurationSeconds: type: number default: 300 lockoutCounterResetSeconds: type: number default: 30 bindDN: type: string bindPass: type: string ldapCaCertificate: type: string required: - id - identityId - url - searchBase - searchFilter - createdAt - updatedAt - bindDN - bindPass additionalProperties: false required: - identityLdapAuth additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false delete: operationId: deleteLdapAuth tags: - LDAP Auth description: Delete LDAP Auth configuration on machine identity parameters: - schema: type: string in: path name: identityId required: true description: The ID of the machine identity to revoke the configuration for. security: - bearerAuth: [] responses: '200': description: Default Response content: application/json: schema: type: object properties: identityLdapAuth: type: object properties: id: type: string format: uuid accessTokenTTL: type: number default: 7200 accessTokenMaxTTL: type: number default: 7200 accessTokenNumUsesLimit: type: number default: 0 accessTokenTrustedIps: {} identityId: type: string format: uuid url: type: string searchBase: type: string searchFilter: type: string allowedFields: nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time accessTokenPeriod: type: number default: 0 templateId: type: string format: uuid nullable: true lockoutEnabled: type: boolean default: true lockoutThreshold: type: number default: 3 lockoutDurationSeconds: type: number default: 300 lockoutCounterResetSeconds: type: number default: 30 required: - id - identityId - url - searchBase - searchFilter - createdAt - updatedAt additionalProperties: false required: - identityLdapAuth additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false /api/v1/auth/ldap-auth/identities/{identityId}/clear-lockouts: post: operationId: clearLdapAuthLockouts tags: - LDAP Auth description: Clear LDAP Auth Lockouts for machine identity parameters: - schema: type: string in: path name: identityId required: true description: The ID of the machine identity to clear the client lockouts from. security: - bearerAuth: [] responses: '200': description: Default Response content: application/json: schema: type: object properties: deleted: type: number required: - deleted additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: An access token in Infisical