openapi: 3.1.0
info:
  title: JFrog Access REST Access Tokens Policies API
  description: API for managing users, groups, permissions, projects, and access tokens across the JFrog Platform. JFrog Access handles identity management, role-based access control, federated identity, and scoped token creation for authentication and authorization across all JFrog services.
  version: 2.x
  contact:
    name: JFrog
    url: https://jfrog.com
  license:
    name: Proprietary
    url: https://jfrog.com/terms-of-service/
  termsOfService: https://jfrog.com/terms-of-service/
servers:
- url: https://{server}.jfrog.io/access
  description: JFrog Cloud
  variables:
    server:
      default: myserver
      description: Your JFrog server name
- url: https://{host}/access
  description: Self-hosted JFrog instance
  variables:
    host:
      default: localhost:8082
      description: Your self-hosted JFrog server host
security:
- bearerAuth: []
- basicAuth: []
tags:
- name: Policies
  description: Curation policy management
paths:
  /v1/policies:
    get:
      operationId: listPolicies
      summary: JFrog List Curation Policies
      description: Returns a list of all curation policies.
      tags:
      - Policies
      responses:
        '200':
          description: Policies list retrieved
          content:
            application/json:
              schema:
                type: object
                properties:
                  policies:
                    type: array
                    items:
                      $ref: '#/components/schemas/CurationPolicy'
    post:
      operationId: createPolicy
      summary: JFrog Create Curation Policy
      description: Creates a new curation policy for blocking or allowing packages.
      tags:
      - Policies
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CurationPolicyRequest'
      responses:
        '201':
          description: Policy created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CurationPolicy'
        '400':
          description: Invalid policy configuration
  /v1/policies/{policyName}:
    get:
      operationId: getPolicy
      summary: JFrog Get Curation Policy
      description: Returns details for a specific curation policy.
      tags:
      - Policies
      parameters:
      - name: policyName
        in: path
        required: true
        schema:
          type: string
        description: Policy name
      responses:
        '200':
          description: Policy details retrieved
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CurationPolicy'
        '404':
          description: Policy not found
    put:
      operationId: updatePolicy
      summary: JFrog Update Curation Policy
      description: Updates an existing curation policy.
      tags:
      - Policies
      parameters:
      - name: policyName
        in: path
        required: true
        schema:
          type: string
        description: Policy name
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CurationPolicyRequest'
      responses:
        '200':
          description: Policy updated
    delete:
      operationId: deletePolicy
      summary: JFrog Delete Curation Policy
      description: Deletes a curation policy.
      tags:
      - Policies
      parameters:
      - name: policyName
        in: path
        required: true
        schema:
          type: string
        description: Policy name
      responses:
        '204':
          description: Policy deleted
  /v2/policies:
    get:
      operationId: listPolicies
      summary: JFrog List Policies
      description: Returns a list of all security and license policies.
      tags:
      - Policies
      responses:
        '200':
          description: Policies list retrieved
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Policy'
    post:
      operationId: createPolicy
      summary: JFrog Create Policy
      description: Creates a new security or license compliance policy.
      tags:
      - Policies
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Policy'
      responses:
        '201':
          description: Policy created
        '400':
          description: Invalid policy configuration
  /v2/policies/{policyName}:
    get:
      operationId: getPolicy
      summary: JFrog Get Policy
      description: Returns details of a specific policy.
      tags:
      - Policies
      parameters:
      - name: policyName
        in: path
        required: true
        schema:
          type: string
        description: Policy name
      responses:
        '200':
          description: Policy details retrieved
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
    put:
      operationId: updatePolicy
      summary: JFrog Update Policy
      description: Updates an existing policy.
      tags:
      - Policies
      parameters:
      - name: policyName
        in: path
        required: true
        schema:
          type: string
        description: Policy name
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Policy'
      responses:
        '200':
          description: Policy updated
    delete:
      operationId: deletePolicy
      summary: JFrog Delete Policy
      description: Removes a policy.
      tags:
      - Policies
      parameters:
      - name: policyName
        in: path
        required: true
        schema:
          type: string
        description: Policy name
      responses:
        '200':
          description: Policy deleted
components:
  schemas:
    CurationPolicy:
      type: object
      properties:
        policy_name:
          type: string
        description:
          type: string
        enabled:
          type: boolean
        policy_type:
          type: string
          enum:
          - block_malicious_packages
          - block_packages_with_vulnerabilities
          - block_packages_without_license
          - block_packages_by_name
          - block_packages_by_age
          - allow_only_approved_packages
          - custom
        repositories:
          type: array
          items:
            type: string
        package_types:
          type: array
          items:
            type: string
        conditions:
          type: object
          properties:
            min_severity:
              type: string
              enum:
              - Low
              - Medium
              - High
              - Critical
            max_age_days:
              type: integer
            banned_package_names:
              type: array
              items:
                type: string
            banned_licenses:
              type: array
              items:
                type: string
            approved_packages:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                  version:
                    type: string
        actions:
          type: object
          properties:
            block:
              type: boolean
            notify:
              type: boolean
            notify_emails:
              type: array
              items:
                type: string
                format: email
            custom_message:
              type: string
        created:
          type: string
          format: date-time
        modified:
          type: string
          format: date-time
    CurationPolicyRequest:
      type: object
      properties:
        policy_name:
          type: string
        description:
          type: string
        enabled:
          type: boolean
        policy_type:
          type: string
        repositories:
          type: array
          items:
            type: string
        package_types:
          type: array
          items:
            type: string
        conditions:
          type: object
        actions:
          type: object
      required:
      - policy_name
      - policy_type
    Policy:
      type: object
      properties:
        name:
          type: string
        description:
          type: string
        type:
          type: string
          enum:
          - security
          - license
          - operational_risk
        rules:
          type: array
          items:
            type: object
            properties:
              name:
                type: string
              priority:
                type: integer
              criteria:
                type: object
                properties:
                  min_severity:
                    type: string
                    enum:
                    - Low
                    - Medium
                    - High
                    - Critical
                  cvss_range:
                    type: object
                    properties:
                      from:
                        type: number
                      to:
                        type: number
                  allow_unknown:
                    type: boolean
                  banned_licenses:
                    type: array
                    items:
                      type: string
                  allowed_licenses:
                    type: array
                    items:
                      type: string
              actions:
                type: object
                properties:
                  webhooks:
                    type: array
                    items:
                      type: string
                  mails:
                    type: array
                    items:
                      type: string
                  block_download:
                    type: object
                    properties:
                      unscanned:
                        type: boolean
                      active:
                        type: boolean
                  block_release_bundle_distribution:
                    type: boolean
                  fail_build:
                    type: boolean
                  notify_deployer:
                    type: boolean
                  notify_watch_recipients:
                    type: boolean
                  create_ticket_enabled:
                    type: boolean
      required:
      - name
      - type
      - rules
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Access token authentication
    basicAuth:
      type: http
      scheme: basic
      description: Basic username/password authentication
externalDocs:
  description: JFrog Access REST API Documentation
  url: https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-token-rest-api