openapi: 3.1.0
info:
  contact:
    email: support@konghq.com
    name: Kong Inc
    url: https://konghq.com
  description: 'OpenAPI 3.0 spec for Kong Gateway''s Admin API.


    You can learn more about Kong Gateway at [developer.konghq.com](https://developer.konghq.com).

    Give Kong a star at the [Kong/kong](https://github.com/kong/kong) repository.'
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  title: Kong Enterprise Admin ACLs Integration Instance Auth Credentials API
  version: 3.14.0
servers:
- description: Default Admin API URL
  url: '{protocol}://{hostname}:{port}{path}'
  variables:
    hostname:
      default: localhost
      description: Hostname for Kong's Admin API
    path:
      default: /
      description: Base path for Kong's Admin API
    port:
      default: '8001'
      description: Port for Kong's Admin API
    protocol:
      default: http
      description: Protocol for requests to Kong's Admin API
      enum:
      - http
      - https
security:
- adminToken: []
tags:
- name: Integration Instance Auth Credentials
  description: 'Represents the credentials use to authorize an integration instance.

    You will want to configure the integration instance settings and authorization configuration before authorizing the instance.

    This will inform the authorization process on how to reach and authorize the account.

    Once the integration instance is authorized, the system will automatically discover all the relevant resources from the account.

    The integration instance''s auth credentials can be removed or updated while retaining all resources which have already been discovered.

    '
paths:
  /v1/integration-instances/{integrationInstanceId}/auth-credential:
    parameters:
    - name: integrationInstanceId
      in: path
      description: The `id` of the integration instance.
      required: true
      schema:
        type: string
        example: 3f51fa25-310a-421d-bd1a-007f859021a3
    post:
      x-speakeasy-entity-operation: IntegrationInstanceAuthCredential#create
      operationId: create-integration-instance-auth-credential
      summary: Create Integration Instance Auth Credential
      description: 'Creates an auth credential scoped to the given integration instance.

        Auth credentials are singleton resources that have a 1-to-1 relationship with

        an integration instance.


        An attempt to create subsequent auth credentials for an instance will result in a 409 response.

        '
      requestBody:
        $ref: '#/components/requestBodies/CreateIntegrationInstanceAuthCredentialRequest'
      responses:
        '201':
          $ref: '#/components/responses/IntegrationInstanceAuthCredentialResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
      tags:
      - Integration Instance Auth Credentials
    get:
      x-speakeasy-entity-operation:
        terraform-resource: IntegrationInstanceAuthCredential#read
        terraform-datasource: null
      operationId: get-integration-instance-auth-credential
      summary: Get Integration Instance Auth Credential
      description: Fetches the auth credential scoped to the given integration instance.
      responses:
        '200':
          $ref: '#/components/responses/IntegrationInstanceAuthCredentialResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
      tags:
      - Integration Instance Auth Credentials
    delete:
      x-speakeasy-entity-operation: IntegrationInstanceAuthCredential#delete
      operationId: delete-integration-instance-auth-credential
      summary: Delete Integration Instance Auth Credential
      description: Deletes the auth credential scoped to the given integration instance.
      responses:
        '204':
          description: Integration Instance Auth Credential was deleted successfully.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
      tags:
      - Integration Instance Auth Credentials
components:
  schemas:
    OAuthCredential:
      description: Represents a credential scoped to an integration instance that supports the `OAuth` authorization strategy.
      type: object
      properties:
        id:
          type: string
          format: uuid
          example: 4f535923-ec24-456c-b4e5-e67f65c8c208
        integration_instance:
          $ref: '#/components/schemas/IntegrationInstanceRef'
        missing_permissions:
          description: List of detected missing permissions required to enable the full functionality of the given integration instance.
          type: array
          items:
            $ref: '#/components/schemas/MissingPermission'
        tainted:
          description: Indicates that the credential is no longer valid and must be replaced with a new valid credential.
          type: boolean
          example: false
        expires_at:
          description: 'Timestamp denoting when the when the credential will expire in RFC-3339 format with a "T" character separating date from time within the field value.

            When expired, the credential must be replaced with a new valid credential to re-enable full functionality for the given integration instance.


            A `null` value indicates no known expiration time.

            '
          type: string
          format: date-time
          example: '2025-04-01T07:20:50Z'
          nullable: true
        created_at:
          $ref: '#/components/schemas/CreatedAt'
        type:
          type: string
          const: oauth
      required:
      - id
      - integration_instance
      - missing_permissions
      - tainted
      - expires_at
      - created_at
      - type
      title: OAuthCredential
      x-speakeasy-name-override: Oauth
      x-speakeasy-param-suppress-computed-diff: true
    InvalidParameterMinimumLength:
      type: object
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          description: invalid parameters rules
          type: string
          enum:
          - min_length
          - min_digits
          - min_lowercase
          - min_uppercase
          - min_symbols
          - min_items
          - min
          nullable: false
          readOnly: true
          x-speakeasy-unknown-values: allow
        minimum:
          type: integer
          example: 8
        source:
          type: string
          example: body
        reason:
          type: string
          example: must have at least 8 characters
          readOnly: true
      additionalProperties: false
      required:
      - field
      - reason
      - rule
      - minimum
    MultiKeyAuthCredential:
      description: Represents a credential scoped to an integration instance that supports the `Multi Key` authorization strategy.
      type: object
      properties:
        id:
          type: string
          format: uuid
          example: 4f535923-ec24-456c-b4e5-e67f65c8c208
        integration_instance:
          $ref: '#/components/schemas/IntegrationInstanceRef'
        missing_permissions:
          description: List of detected missing permissions required to enable the full functionality of the given integration instance.
          type: array
          items:
            $ref: '#/components/schemas/MissingPermission'
        tainted:
          description: Indicates that the credential is no longer valid and must be replaced with a new valid credential.
          type: boolean
          example: false
        expires_at:
          description: 'Timestamp denoting when the when the credential will expire in RFC-3339 format with a "T" character separating date from time within the field value.

            When expired, the credential must be replaced with a new valid credential to re-enable full functionality for the given integration instance.


            A `null` value indicates no known expiration time.

            '
          type: string
          format: date-time
          example: '2025-04-01T07:20:50Z'
          nullable: true
        created_at:
          $ref: '#/components/schemas/CreatedAt'
        type:
          type: string
          const: multi_key_auth
      required:
      - id
      - integration_instance
      - missing_permissions
      - tainted
      - expires_at
      - created_at
      - type
      title: MultiKeyAuthCredential
      x-speakeasy-param-suppress-computed-diff: true
    InvalidParameterChoiceItem:
      type: object
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          description: invalid parameters rules
          type: string
          enum:
          - enum
          nullable: false
          readOnly: true
        reason:
          type: string
          example: is a required field
          readOnly: true
        choices:
          type: array
          items: {}
          minItems: 1
          nullable: false
          readOnly: true
          uniqueItems: true
        source:
          type: string
          example: body
      additionalProperties: false
      required:
      - field
      - reason
      - rule
      - choices
    ConflictError:
      allOf:
      - $ref: '#/components/schemas/BaseError'
      - type: object
        properties:
          status:
            example: 409
          title:
            example: Conflict
          type:
            example: https://httpstatuses.com/409
          instance:
            example: kong:trace:1234567890
          detail:
            example: Conflict
    InvalidParameterMaximumLength:
      type: object
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          description: invalid parameters rules
          type: string
          enum:
          - max_length
          - max_items
          - max
          nullable: false
          readOnly: true
          x-speakeasy-unknown-values: allow
        maximum:
          type: integer
          example: 8
        source:
          type: string
          example: body
        reason:
          type: string
          example: must not have more than 8 characters
          readOnly: true
      additionalProperties: false
      required:
      - field
      - reason
      - rule
      - maximum
    IntegrationInstanceRef:
      description: Short-hand descriptor of an integration instance.
      type: object
      properties:
        id:
          description: The integration instance ID.
          type: string
          format: uuid
          example: 772b9caf-ddbc-4f4f-8aa4-8dfbbe420351
        name:
          description: 'The machine name of the integration instance that uniquely identifies it within the catalog.

            '
          type: string
          example: aws-lambda-prod
          pattern: ^[0-9a-z.-]+$
        display_name:
          description: The display name of the integration instance.
          type: string
          example: AWS (prod)
      required:
      - id
      - name
      - display_name
    MissingPermission:
      type: object
      properties:
        scopes:
          type: array
          items:
            type: string
            nullable: true
          example:
          - incident:read
        message:
          description: 'Describes the degraded experience of the integration instance due to the missing permission.

            May also include a message on how to resolve the missing permission.

            '
          type: string
      required:
      - scopes
      - message
    CreateOAuthCredential:
      description: Payload used to create an `OAuth` credential for an integration instance.
      type: object
      properties:
        type:
          type: string
          const: oauth
        config:
          type: object
          additionalProperties: false
          properties:
            grant_type:
              description: The OAuth 2.0 grant type used for authorization (e.g., `authorization_code`).
              type: string
              enum:
              - authorization_code
            code:
              description: The authorization code used to exchange for an access token with the identity server.
              type: string
              example: Yzk5ZDczMzRlNDEwY
            redirect_uri:
              description: 'The redirect URI submitted to the authorization server during the authentication request

                to retrieve the authorization code.

                '
              type: string
              format: uri
              example: https://cloud.konghq.com/us/service-catalog/integrations/pagerduty/oauth
          required:
          - grant_type
          - code
          - redirect_uri
          title: CreateOAuthCredentialConfig
      additionalProperties: false
      required:
      - type
      - config
    ForbiddenError:
      allOf:
      - $ref: '#/components/schemas/BaseError'
      - type: object
        properties:
          status:
            example: 403
          title:
            example: Forbidden
          type:
            example: https://httpstatuses.com/403
          instance:
            example: kong:trace:1234567890
          detail:
            example: Forbidden
    UnauthorizedError:
      allOf:
      - $ref: '#/components/schemas/BaseError'
      - type: object
        properties:
          status:
            example: 401
          title:
            example: Unauthorized
          type:
            example: https://httpstatuses.com/401
          instance:
            example: kong:trace:1234567890
          detail:
            example: Invalid credentials
    CreateMultiKeyAuthCredential:
      description: Payload used to create an `Multi Key` credential for an integration instance.
      type: object
      properties:
        type:
          type: string
          const: multi_key_auth
        config:
          type: object
          additionalProperties: false
          properties:
            headers:
              description: 'A list of header key/value pairs used to transmit API credentials to the integration''s external API.

                Header names are defined by the integration within its `Multi Key` authorization strategy definition.

                '
              type: array
              items:
                type: object
                required:
                - name
                - key
                properties:
                  name:
                    description: Name of the request header
                    type: string
                  key:
                    description: The key used to populate the request header
                    type: string
              example:
              - name: x-api-key
                key: 9f2a3b4c8d6e7f00112233445566778899aabbccddeeff001122334455667788
          required:
          - headers
          title: CreateMultiKeyAuthCredentialConfig
          x-speakeasy-param-force-new: true
          x-speakeasy-param-suppress-computed-diff: true
      additionalProperties: false
      required:
      - type
      - config
      writeOnly: true
      x-speakeasy-name-override: multi_key_auth
    CreateIntegrationInstanceAuthCredential:
      oneOf:
      - $ref: '#/components/schemas/CreateOAuthCredential'
      - $ref: '#/components/schemas/CreateGitHubAppInstallationCredential'
      - $ref: '#/components/schemas/CreateMultiKeyAuthCredential'
      - $ref: '#/components/schemas/CreateAWSRoleDelegationAuthCredential'
      title: CreateIntegrationInstanceAuthCredential
    CreatedAt:
      description: An ISO-8601 timestamp representation of entity creation date.
      type: string
      format: date-time
      example: '2022-11-04T20:10:06.927Z'
      readOnly: true
      x-speakeasy-param-suppress-computed-diff: true
    BaseError:
      description: standard error
      type: object
      properties:
        status:
          description: 'The HTTP status code of the error. Useful when passing the response

            body to child properties in a frontend UI. Must be returned as an integer.

            '
          type: integer
          readOnly: true
        title:
          description: 'A short, human-readable summary of the problem. It should not

            change between occurences of a problem, except for localization.

            Should be provided as "Sentence case" for direct use in the UI.

            '
          type: string
          readOnly: true
        type:
          description: The error type.
          type: string
          readOnly: true
        instance:
          description: 'Used to return the correlation ID back to the user, in the format

            kong:trace:<correlation_id>. This helps us find the relevant logs

            when a customer reports an issue.

            '
          type: string
          readOnly: true
        detail:
          description: 'A human readable explanation specific to this occurence of the problem.

            This field may contain request/entity data to help the user understand

            what went wrong. Enclose variable values in square brackets. Should be

            provided as "Sentence case" for direct use in the UI.

            '
          type: string
          readOnly: true
      required:
      - status
      - title
      - instance
      - detail
      title: Error
    IntegrationInstanceAuthCredential:
      description: Object containing metadata for an integration instance auth credential.
      oneOf:
      - $ref: '#/components/schemas/OAuthCredential'
      - $ref: '#/components/schemas/GitHubAppInstallationCredential'
      - $ref: '#/components/schemas/MultiKeyAuthCredential'
      - $ref: '#/components/schemas/AWSRoleDelegationAuthCredential'
      title: IntegrationInstanceAuthCredential
    InvalidParameterDependentItem:
      type: object
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          description: invalid parameters rules
          type: string
          enum:
          - dependent_fields
          nullable: true
          readOnly: true
        reason:
          type: string
          example: is a required field
          readOnly: true
        dependents:
          type: array
          items: {}
          nullable: true
          readOnly: true
          uniqueItems: true
        source:
          type: string
          example: body
      additionalProperties: false
      required:
      - field
      - rule
      - reason
      - dependents
    InvalidRules:
      description: invalid parameters rules
      type: string
      enum:
      - required
      - is_array
      - is_base64
      - is_boolean
      - is_date_time
      - is_integer
      - is_null
      - is_number
      - is_object
      - is_string
      - is_uuid
      - is_fqdn
      - is_arn
      - unknown_property
      - missing_reference
      - is_label
      - matches_regex
      - invalid
      - is_supported_network_availability_zone_list
      - is_supported_network_cidr_block
      - is_supported_provider_region
      - type
      nullable: true
      readOnly: true
      x-speakeasy-unknown-values: allow
    InvalidParameters:
      description: invalid parameters
      type: array
      items:
        oneOf:
        - $ref: '#/components/schemas/InvalidParameterStandard'
        - $ref: '#/components/schemas/InvalidParameterMinimumLength'
        - $ref: '#/components/schemas/InvalidParameterMaximumLength'
        - $ref: '#/components/schemas/InvalidParameterChoiceItem'
        - $ref: '#/components/schemas/InvalidParameterDependentItem'
      minItems: 1
      nullable: false
      uniqueItems: true
    BadRequestError:
      allOf:
      - $ref: '#/components/schemas/BaseError'
      - type: object
        required:
        - invalid_parameters
        properties:
          invalid_parameters:
            $ref: '#/components/schemas/InvalidParameters'
    InvalidParameterStandard:
      type: object
      properties:
        field:
          type: string
          example: name
          readOnly: true
        rule:
          $ref: '#/components/schemas/InvalidRules'
        source:
          type: string
          example: body
        reason:
          type: string
          example: is a required field
          readOnly: true
      additionalProperties: false
      required:
      - field
      - reason
    GitHubAppInstallationCredential:
      description: Represents a credential scoped to an integration instance that supports the `GitHub App Installation` authorization strategy.
      type: object
      properties:
        id:
          type: string
          format: uuid
          example: 4f535923-ec24-456c-b4e5-e67f65c8c208
        integration_instance:
          $ref: '#/components/schemas/IntegrationInstanceRef'
        missing_permissions:
          description: List of detected missing permissions required to enable the full functionality of the given integration instance.
          type: array
          items:
            $ref: '#/components/schemas/MissingPermission'
        tainted:
          description: Indicates that the credential is no longer valid and must be replaced with a new valid credential.
          type: boolean
          example: false
        expires_at:
          description: 'Timestamp denoting when the when the credential will expire in RFC-3339 format with a "T" character separating date from time within the field value.

            When expired, the credential must be replaced with a new valid credential to re-enable full functionality for the given integration instance.


            A `null` value indicates no known expiration time.

            '
          type: string
          format: date-time
          example: '2025-04-01T07:20:50Z'
          nullable: true
        created_at:
          $ref: '#/components/schemas/CreatedAt'
        type:
          type: string
          const: github_app_installation
        config:
          type: object
          properties:
            installation_id:
              description: The GitHub App installation ID
              type: string
            app_installed_by:
              description: The GitHub user who installed the app.
              type: string
              nullable: true
          required:
          - installation_id
          - app_installed_by
          title: GitHubAppInstallationCredentialConfig
      required:
      - id
      - integration_instance
      - missing_permissions
      - tainted
      - expires_at
      - created_at
      - type
      - config
      title: GitHubAppInstallationCredential
      x-speakeasy-name-override: GithubAppInstallation
      x-speakeasy-param-suppress-computed-diff: true
    CreateAWSRoleDelegationAuthCredential:
      description: Payload used to create an `AWS Role Delegation` credential for an integration instance.
      type: object
      properties:
        type:
          type: string
          enum:
          - aws_role_delegation
        config:
          type: object
          additionalProperties: false
          properties:
            role_arn:
              description: 'The AWS Role ARN string

                '
              type: string
              example: arn:aws:iam::084735895545:role/KonnectServiceCatalogRole
          required:
          - role_arn
          title: CreateAWSRoleDelegationAuthCredentialConfig
      additionalProperties: false
      required:
      - type
      - config
    CreateGitHubAppInstallationCredential:
      description: Payload used to create an `GitHub App Installation` credential for an integration instance.
      type: object
      properties:
        type:
          type: string
          const: github_app_installation
        config:
          type: object
          additionalProperties: false
          properties:
            installation_id:
              description: The GitHub App installation ID.
              type: string
              example: '46952218'
            code:
              description: The authorization code used to exchange for a GitHub user-scoped access token.
              type: string
              example: Yzk5ZDczMzRlNDEwY
            app_installed_by:
              description: The GitHub user who installed the app
              type: string
          required:
          - installation_id
          - code
          title: CreateGitHubAppInstallationCredentialConfig
      additionalProperties: false
      required:
      - type
      - config
    NotFoundError:
      allOf:
      - $ref: '#/components/schemas/BaseError'
      - type: object
        properties:
          status:
            example: 404
          title:
            example: Not Found
          type:
            example: https://httpstatuses.com/404
          instance:
            example: kong:trace:1234567890
          detail:
            example: Not found
    AWSRoleDelegationAuthCredential:
      description: Represents a credential scoped to an integration instance that supports the `AWS Role Delegation` authorization strategy.
      type: object
      properties:
        id:
          type: string
          format: uuid
          example: 4f535923-ec24-456c-b4e5-e67f65c8c208
        integration_instance:
          $ref: '#/components/schemas/IntegrationInstanceRef'
        missing_permissions:
          description: List of detected missing permissions required to enable the full functionality of the given integration instance.
          type: array
          items:
            $ref: '#/components/schemas/MissingPermission'
        tainted:
          description: Indicates that the credential is no longer valid and must be replaced with a new valid credential.
          type: boolean
          example: false
        expires_at:
          description: 'Timestamp denoting when the when the credential will expire in RFC-3339 format with a "T" character separating date from time within the field value.

            When expired, the credential must be replaced with a new valid credential to re-enable full functionality for the given integration instance.


            A `null` value indicates no known expiration time.

            '
          type: string
          format: date-time
          example: '2025-04-01T07:20:50Z'
          nullable: true
        created_at:
          $ref: '#/components/schemas/CreatedAt'
        type:
          type: string
          enum:
          - aws_role_delegation
        config:
          type: object
          properties:
            role_arn:
              description: The Role ARN use for AWS Assume Role.
              type: string
          required:
          - role_arn
          title: AWSRoleDelegationAuthCredentialConfig
      required:
      - id
      - integration_instance
      - missing_permissions
      - tainted
      - expires_at
      - created_at
      - type
      - config
      title: AWSRoleDelegationAuthCredential
      x-speakeasy-param-suppress-computed-diff: true
  responses:
    BadRequest:
      description: Bad Request
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/BadRequestError'
    NotFound:
      description: Not Found
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/NotFoundError'
    Conflict:
      description: Conflict
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ConflictError'
    IntegrationInstanceAuthCredentialResponse:
      description: A response containing an integration instance auth credential.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/IntegrationInstanceAuthCredential'
    Unauthorized:
      description: Unauthorized
      content:
        application/problem+json:
          schema:
            description: The error response object.
            type: object
            properties:
              status:
                description: The HTTP status code.
                type: integer
                example: 403
              title:
                description: The Error Response.
                type: string
                example: Unauthorized
              instance:
                description: The Konnect traceback code.
                type: string
                example: konnect:trace:952172606039454040
              detail:
                description: Details about the error response.
                type: string
                example: You do not have permission to perform this action
            $ref: '#/components/schemas/UnauthorizedError'
            title: Unauthorized Response
    Forbidden:
      description: Forbidden
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ForbiddenError'
  requestBodies:
    CreateIntegrationInstanceAuthCredentialRequest:
      required: true
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CreateIntegrationInstanceAuthCredential'
  securitySchemes:
    adminToken:
      in: header
      name: Kong-Admin-Token
      type: apiKey
externalDocs:
  description: Documentation for Kong Gateway and its APIs
  url: https://developer.konghq.com