openapi: 3.0.0 info: title: Complete InfluxDB Cloud Authorizations (API tokens) Authorizations (API tokens) Setup API description: 'Create and manage authorizations (API tokens). An _authorization_ contains a list of `read` and `write` permissions for organization resources and provides an API token for authentication. An authorization belongs to an organization and only contains permissions for that organization. We recommend the following for managing your tokens: - Create a generic user to create and manage tokens for writing data. - Store your tokens in a secure password vault for future access. ### User sessions with authorizations Optionally, when creating an authorization, you can scope it to a specific user. If the user signs in with username and password, creating a _user session_, the session carries the permissions granted by all the user''s authorizations. For more information, see [how to assign a token to a specific user](https://docs.influxdata.com/influxdb/cloud/security/tokens/create-token/). To create a user session, use the [`POST /api/v2/signin` endpoint](#operation/PostSignin). ### Related endpoints - [Signin](#tag/Signin) - [Signout](#tag/Signout) ### Related guides - [Authorize API requests](https://docs.influxdata.com/influxdb/cloud/api-guide/api_intro/#authentication) - [Manage API tokens](https://docs.influxdata.com/influxdb/cloud/security/tokens/) - [Assign a token to a specific user](https://docs.influxdata.com/influxdb/cloud/security/tokens/create-token/) ' servers: - url: '' security: - TokenAuthentication: [] tags: - name: Setup paths: /api/v2/setup: get: description: Check if setup is allowed. Returns `true` if no default user, organization, or bucket have been created. operationId: GetSetup parameters: - $ref: '#/components/parameters/TraceSpan' responses: '200': content: application/json: schema: $ref: '#/components/schemas/IsOnboarding' description: Setup is allowed, true or false summary: Retrieve setup status tags: - Setup post: description: Post an onboarding request to create an initial user, organization, and bucket. operationId: PostSetup parameters: - $ref: '#/components/parameters/TraceSpan' requestBody: content: application/json: schema: $ref: '#/components/schemas/OnboardingRequest' description: Source to create required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/OnboardingResponse' description: The created default user, bucket, and organization default: $ref: '#/components/responses/GeneralServerError' description: Unexpected error summary: Create an initial user, organization, and bucket tags: - Setup /api/v2/setup/user: post: description: Post an onboarding request to create a new user, organization, and bucket. operationId: PostSetupUser requestBody: content: application/json: schema: $ref: '#/components/schemas/OnboardingRequest' description: Source to create required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/OnboardingResponse' description: The created default user, bucket, and organization. default: $ref: '#/components/responses/GeneralServerError' description: Unexpected error summary: Create a new user, organization, and bucket tags: - Setup components: schemas: IsOnboarding: properties: allowed: description: 'If `true`, the InfluxDB instance hasn''t had initial setup; `false` otherwise. ' type: boolean type: object Resource: properties: id: description: 'A resource ID. Identifies a specific resource. ' type: string name: description: 'The name of the resource. _Note: not all resource types have a `name` property_. ' type: string org: description: 'An organization name. The organization that owns the resource. ' type: string orgID: description: 'An organization ID. Identifies the organization that owns the resource. ' type: string type: description: 'A resource type. Identifies the API resource''s type (or _kind_). ' enum: - authorizations - buckets - dashboards - orgs - tasks - telegrafs - users - variables - secrets - labels - views - documents - notificationRules - notificationEndpoints - checks - dbrp - annotations - sources - scrapers - notebooks - remotes - replications - instance - flows - functions - subscriptions type: string required: - type type: object Link: description: URI of resource. format: uri readOnly: true type: string ErrorCode: description: code is the machine-readable error code. enum: - internal error - not implemented - not found - conflict - invalid - unprocessable entity - empty value - unavailable - forbidden - too many requests - unauthorized - method not allowed - request too large - unsupported media type readOnly: true type: string RetentionRule: properties: everySeconds: default: 2592000 description: 'The duration in seconds for how long data will be kept in the database. The default duration is 2592000 (30 days). 0 represents infinite retention. ' example: 86400 format: int64 minimum: 0 type: integer shardGroupDurationSeconds: description: 'The shard group duration. The duration or interval (in seconds) that each shard group covers. #### InfluxDB Cloud - Does not use `shardGroupDurationsSeconds`. #### InfluxDB OSS - Default value depends on the [bucket retention period](https://docs.influxdata.com/influxdb/cloud/reference/internals/shards/#shard-group-duration). ' format: int64 type: integer type: default: expire enum: - expire type: string required: - everySeconds type: object UserResponse: properties: id: description: 'The user ID. ' readOnly: true type: string links: example: self: /api/v2/users/1 properties: self: format: uri type: string readOnly: true type: object name: description: 'The user name. ' type: string status: default: active description: 'The status of a user. An inactive user can''t read or write resources. ' enum: - active - inactive type: string required: - name SchemaType: enum: - implicit - explicit type: string Limit: description: These are org limits similar to those configured in/by quartz. properties: bucket: properties: maxBuckets: type: integer maxRetentionDuration: description: Max bucket retention duration in nanoseconds. 0 is unlimited. type: integer required: - maxBuckets - maxRetentionDuration type: object check: properties: maxChecks: type: integer required: - maxChecks type: object dashboard: properties: maxDashboards: type: integer required: - maxDashboards type: object features: properties: allowDelete: description: allow delete predicate endpoint type: boolean type: object ioxQuery: properties: parquetFiles: type: integer partitions: type: integer required: - partitions - parquetFiles type: object notificationEndpoint: properties: blockedNotificationEndpoints: description: comma separated list of notification endpoints example: http,pagerduty type: string required: - blockNotificationEndpoints type: object notificationRule: properties: blockedNotificationRules: description: comma separated list of notification rules example: http,pagerduty type: string maxNotifications: type: integer required: - maxNotifications - blockNotificationRules type: object orgID: type: string rate: properties: cardinality: description: Allowed organization total cardinality. 0 is unlimited. type: integer concurrentDeleteRequests: description: Allowed organization concurrent outstanding delete requests. type: integer concurrentReadRequests: description: Allowed concurrent queries. 0 is unlimited. type: integer concurrentWriteRequests: description: Allowed concurrent writes. 0 is unlimited. type: integer deleteRequestsPerSecond: description: Allowed organization delete request rate. type: integer queryTime: description: Query Time in nanoseconds type: integer readKBs: description: Query limit in kb/sec. 0 is unlimited. type: integer writeKBs: description: Write limit in kb/sec. 0 is unlimited. type: integer required: - readKBs - queryTime - concurrentReadRequests - writeKBs - concurrentWriteRequests - cardinality type: object stack: properties: enabled: type: boolean required: - enabled type: object task: properties: maxTasks: type: integer required: - maxTasks type: object timeout: properties: queryUnconditionalTimeoutSeconds: type: integer queryidleWriteTimeoutSeconds: type: integer required: - queryUnconditionalTimeoutSeconds - queryidleWriteTimeoutSeconds type: object required: - rate - bucket - task - dashboard - check - notificationRule - notificationEndpoint type: object Label: properties: id: readOnly: true type: string name: type: string orgID: readOnly: true type: string properties: additionalProperties: type: string description: 'Key-value pairs associated with this label. To remove a property, send an update with an empty value (`""`) for the key. ' example: color: ffb3b3 description: this is a description type: object type: object Labels: items: $ref: '#/components/schemas/Label' type: array Error: properties: code: $ref: '#/components/schemas/ErrorCode' description: code is the machine-readable error code. enum: - internal error - not implemented - not found - conflict - invalid - unprocessable entity - empty value - unavailable - forbidden - too many requests - unauthorized - method not allowed - request too large - unsupported media type readOnly: true type: string err: description: Stack of errors that occurred during processing of the request. Useful for debugging. readOnly: true type: string message: description: Human-readable message. readOnly: true type: string op: description: Describes the logical code operation when the error occurred. Useful for debugging. readOnly: true type: string required: - code RetentionRules: description: 'Retention rules to expire or retain data. The InfluxDB `/api/v2` API uses `RetentionRules` to configure the [retention period](https://docs.influxdata.com/influxdb/cloud/reference/glossary/#retention-period). #### InfluxDB Cloud - `retentionRules` is required. #### InfluxDB OSS - `retentionRules` isn''t required. ' items: $ref: '#/components/schemas/RetentionRule' type: array OnboardingResponse: properties: auth: $ref: '#/components/schemas/Authorization' bucket: $ref: '#/components/schemas/Bucket' org: $ref: '#/components/schemas/Organization' user: $ref: '#/components/schemas/UserResponse' type: object AuthorizationUpdateRequest: properties: description: description: A description of the token. type: string status: default: active description: Status of the token. If `inactive`, InfluxDB rejects requests that use the token. enum: - active - inactive type: string Bucket: properties: createdAt: format: date-time readOnly: true type: string description: type: string id: readOnly: true type: string labels: $ref: '#/components/schemas/Labels' links: example: labels: /api/v2/buckets/1/labels members: /api/v2/buckets/1/members org: /api/v2/orgs/2 owners: /api/v2/buckets/1/owners self: /api/v2/buckets/1 write: /api/v2/write?org=2&bucket=1 properties: labels: $ref: '#/components/schemas/Link' description: The URL to retrieve labels for this bucket. members: $ref: '#/components/schemas/Link' description: The URL to retrieve members that can read this bucket. org: $ref: '#/components/schemas/Link' description: The URL to retrieve parent organization for this bucket. owners: $ref: '#/components/schemas/Link' description: The URL to retrieve owners that can read and write to this bucket. self: $ref: '#/components/schemas/Link' description: The URL for this bucket. write: $ref: '#/components/schemas/Link' description: The URL to write line protocol to this bucket. readOnly: true type: object name: type: string orgID: type: string retentionRules: $ref: '#/components/schemas/RetentionRules' rp: type: string schemaType: $ref: '#/components/schemas/SchemaType' default: implicit type: default: user enum: - user - system readOnly: true type: string updatedAt: format: date-time readOnly: true type: string required: - name - retentionRules Permission: properties: action: enum: - read - write type: string resource: $ref: '#/components/schemas/Resource' properties: id: description: 'A resource ID. Identifies a specific resource. ' type: string name: description: 'The name of the resource. _Note: not all resource types have a `name` property_. ' type: string org: description: 'An organization name. The organization that owns the resource. ' type: string orgID: description: 'An organization ID. Identifies the organization that owns the resource. ' type: string type: description: 'A resource type. Identifies the API resource''s type (or _kind_). ' enum: - authorizations - buckets - dashboards - orgs - tasks - telegrafs - users - variables - secrets - labels - views - documents - notificationRules - notificationEndpoints - checks - dbrp - annotations - sources - scrapers - notebooks - remotes - replications - instance - flows - functions - subscriptions type: string required: - type type: object required: - action - resource OnboardingRequest: properties: bucket: type: string limit: $ref: '#/components/schemas/Limit' org: type: string password: type: string retentionPeriodHrs: deprecated: true type: integer retentionPeriodSeconds: type: integer username: type: string required: - username - org - bucket type: object Authorization: allOf: - $ref: '#/components/schemas/AuthorizationUpdateRequest' - properties: createdAt: format: date-time readOnly: true type: string id: description: The authorization ID. readOnly: true type: string links: example: self: /api/v2/authorizations/1 user: /api/v2/users/12 properties: self: $ref: '#/components/schemas/Link' readOnly: true user: $ref: '#/components/schemas/Link' readOnly: true readOnly: true type: object org: description: 'The organization name. Specifies the [organization]({{% INFLUXDB_DOCS_URL %}}/reference/glossary/#organization) that the token is scoped to. ' readOnly: true type: string orgID: description: 'The organization ID. Specifies the [organization]({{% INFLUXDB_DOCS_URL %}}/reference/glossary/#organization) that the authorization is scoped to. ' type: string permissions: description: 'The list of permissions. An authorization must have at least one permission. ' items: $ref: '#/components/schemas/Permission' minItems: 1 type: array token: description: 'The API token. The token value is unique to the authorization. [API tokens]({{% INFLUXDB_DOCS_URL %}}/reference/glossary/#token) are used to authenticate and authorize InfluxDB API requests and `influx` CLI commands--after receiving the request, InfluxDB checks that the token is valid and that the `permissions` allow the requested action(s). ' readOnly: true type: string updatedAt: format: date-time readOnly: true type: string user: description: 'The user name. Specifies the [user]({{% INFLUXDB_DOCS_URL %}}/reference/glossary/#user) that owns the authorization. If the authorization is _scoped_ to a user, the user; otherwise, the creator of the authorization. ' readOnly: true type: string userID: description: The user ID. Specifies the [user]({{% INFLUXDB_DOCS_URL %}}/reference/glossary/#user) that owns the authorization. If _scoped_, the user that the authorization is scoped to; otherwise, the creator of the authorization. readOnly: true type: string type: object required: - orgID - permissions Organization: properties: createdAt: format: date-time readOnly: true type: string defaultStorageType: description: Discloses whether the organization uses TSM or IOx. enum: - tsm - iox type: string description: type: string id: readOnly: true type: string links: example: buckets: /api/v2/buckets?org=myorg dashboards: /api/v2/dashboards?org=myorg labels: /api/v2/orgs/1/labels members: /api/v2/orgs/1/members owners: /api/v2/orgs/1/owners secrets: /api/v2/orgs/1/secrets self: /api/v2/orgs/1 tasks: /api/v2/tasks?org=myorg properties: buckets: $ref: '#/components/schemas/Link' dashboards: $ref: '#/components/schemas/Link' labels: $ref: '#/components/schemas/Link' members: $ref: '#/components/schemas/Link' owners: $ref: '#/components/schemas/Link' secrets: $ref: '#/components/schemas/Link' self: $ref: '#/components/schemas/Link' tasks: $ref: '#/components/schemas/Link' readOnly: true type: object name: type: string status: default: active description: If inactive, the organization is inactive. enum: - active - inactive type: string updatedAt: format: date-time readOnly: true type: string required: - name responses: GeneralServerError: content: application/json: schema: $ref: '#/components/schemas/Error' description: Non 2XX error response from server. parameters: TraceSpan: description: OpenTracing span context example: baggage: key: value span_id: '1' trace_id: '1' in: header name: Zap-Trace-Span required: false schema: type: string securitySchemes: BasicAuthentication: description: "### Basic authentication scheme\n\nUse the HTTP Basic authentication scheme for InfluxDB `/api/v2` API operations that support it:\n\n### Syntax\n\n`Authorization: Basic BASE64_ENCODED_CREDENTIALS`\n\nTo construct the `BASE64_ENCODED_CREDENTIALS`, combine the username and\nthe password with a colon (`USERNAME:PASSWORD`), and then encode the\nresulting string in [base64](https://developer.mozilla.org/en-US/docs/Glossary/Base64).\nMany HTTP clients encode the credentials for you before sending the\nrequest.\n\n_**Warning**: Base64-encoding can easily be reversed to obtain the original\nusername and password. It is used to keep the data intact and does not provide\nsecurity. You should always use HTTPS when authenticating or sending a request with\nsensitive information._\n\n### Examples\n\nIn the examples, replace the following:\n\n- **`EMAIL_ADDRESS`**: InfluxDB Cloud username (the email address the user signed up with)\n- **`PASSWORD`**: InfluxDB Cloud [API token](https://docs.influxdata.com/influxdb/cloud/reference/glossary/#token)\n- **`INFLUX_URL`**: your InfluxDB Cloud URL\n\n#### Encode credentials with cURL\n\nThe following example shows how to use cURL to send an API request that uses Basic authentication.\nWith the `--user` option, cURL encodes the credentials and passes them\nin the `Authorization: Basic` header.\n\n```sh\ncurl --get \"INFLUX_URL/api/v2/signin\"\n --user \"EMAIL_ADDRESS\":\"PASSWORD\"\n```\n\n#### Encode credentials with Flux\n\nThe Flux [`http.basicAuth()` function](https://docs.influxdata.com/flux/v0.x/stdlib/http/basicauth/) returns a Base64-encoded\nbasic authentication header using a specified username and password combination.\n\n#### Encode credentials with JavaScript\n\nThe following example shows how to use the JavaScript `btoa()` function\nto create a Base64-encoded string:\n\n```js\nbtoa('EMAIL_ADDRESS:PASSWORD')\n```\n\nThe output is the following:\n\n```js\n'VVNFUk5BTUU6UEFTU1dPUkQ='\n```\n\nOnce you have the Base64-encoded credentials, you can pass them in the\n`Authorization` header--for example:\n\n```sh\ncurl --get \"INFLUX_URL/api/v2/signin\"\n --header \"Authorization: Basic VVNFUk5BTUU6UEFTU1dPUkQ=\"\n```\n\nTo learn more about HTTP authentication, see\n[Mozilla Developer Network (MDN) Web Docs, HTTP authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication)._\n" scheme: basic type: http TokenAuthentication: description: "Use the [Token authentication](#section/Authentication/TokenAuthentication)\nscheme to authenticate to the InfluxDB API.\n\nIn your API requests, send an `Authorization` header.\nFor the header value, provide the word `Token` followed by a space and an InfluxDB API token.\nThe word `Token` is case-sensitive.\n\n### Syntax\n\n`Authorization: Token INFLUX_API_TOKEN`\n\n### Example\n\n#### Use Token authentication with cURL\n\nThe following example shows how to use cURL to send an API request that uses Token authentication:\n\n```sh\ncurl --request GET \"INFLUX_URL/api/v2/buckets\" \\\n --header \"Authorization: Token INFLUX_API_TOKEN\"\n```\n\nReplace the following:\n\n - *`INFLUX_URL`*: your InfluxDB Cloud URL\n - *`INFLUX_API_TOKEN`*: your [InfluxDB API token](https://docs.influxdata.com/influxdb/cloud/reference/glossary/#token)\n\n### Related endpoints\n\n- [`/authorizations` endpoints](#tag/Authorizations-(API-tokens))\n\n### Related guides\n\n- [Authorize API requests](https://docs.influxdata.com/influxdb/cloud/api-guide/api_intro/#authentication)\n- [Manage API tokens](https://docs.influxdata.com/influxdb/cloud/security/tokens/)\n" in: header name: Authorization type: apiKey x-tagGroups: - name: Overview tags: - Quick start - Authentication - Supported operations - Headers - Pagination - Response codes - name: Popular endpoints tags: - Data I/O endpoints - Security and access endpoints - System information endpoints - name: All endpoints tags: []