openapi: 3.0.0
info:
  description: lakeFS HTTP API
  title: lakeFS actions external API
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  version: 1.0.0
servers:
- url: /api/v1
  description: lakeFS server endpoint
security:
- jwt_token: []
- basic_auth: []
- cookie_auth: []
- oidc_auth: []
- saml_auth: []
tags:
- name: external
paths:
  /auth/external/principal/login:
    post:
      tags:
      - external
      operationId: externalPrincipalLogin
      summary: perform a login using an external authenticator
      security: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalLoginInformation'
      responses:
        200:
          description: successful external login
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationToken'
        400:
          $ref: '#/components/responses/BadRequest'
        401:
          $ref: '#/components/responses/Unauthorized'
        403:
          $ref: '#/components/responses/Forbidden'
        404:
          $ref: '#/components/responses/NotFound'
        429:
          description: too many requests
        default:
          $ref: '#/components/responses/ServerError'
  /auth/users/{userId}/external/principals:
    parameters:
    - in: path
      name: userId
      required: true
      schema:
        type: string
    - in: query
      name: principalId
      required: true
      schema:
        type: string
    post:
      tags:
      - external
      operationId: createUserExternalPrincipal
      summary: attach external principal to user
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalPrincipalCreation'
      responses:
        201:
          description: external principal attached successfully
        400:
          $ref: '#/components/responses/BadRequest'
        401:
          $ref: '#/components/responses/Unauthorized'
        404:
          $ref: '#/components/responses/NotFound'
        409:
          $ref: '#/components/responses/Conflict'
        429:
          description: too many requests
        default:
          $ref: '#/components/responses/ServerError'
    delete:
      tags:
      - external
      operationId: deleteUserExternalPrincipal
      summary: delete external principal from user
      responses:
        204:
          description: external principal detached successfully
        400:
          $ref: '#/components/responses/BadRequest'
        401:
          $ref: '#/components/responses/Unauthorized'
        404:
          $ref: '#/components/responses/NotFound'
        429:
          description: too many requests
        default:
          $ref: '#/components/responses/ServerError'
  /auth/users/{userId}/external/principals/ls:
    parameters:
    - in: path
      name: userId
      required: true
      schema:
        type: string
    get:
      tags:
      - external
      parameters:
      - $ref: '#/components/parameters/PaginationPrefix'
      - $ref: '#/components/parameters/PaginationAfter'
      - $ref: '#/components/parameters/PaginationAmount'
      operationId: listUserExternalPrincipals
      summary: list user external policies attached to a user
      responses:
        200:
          description: external principals list
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalPrincipalList'
        400:
          $ref: '#/components/responses/BadRequest'
        401:
          $ref: '#/components/responses/Unauthorized'
        404:
          $ref: '#/components/responses/NotFound'
        429:
          description: too many requests
        default:
          $ref: '#/components/responses/ServerError'
  /auth/external/principals:
    parameters:
    - in: query
      name: principalId
      required: true
      schema:
        type: string
    get:
      tags:
      - external
      operationId: getExternalPrincipal
      summary: describe external principal by id
      responses:
        200:
          description: external principal
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalPrincipal'
        400:
          $ref: '#/components/responses/BadRequest'
        401:
          $ref: '#/components/responses/Unauthorized'
        404:
          $ref: '#/components/responses/NotFound'
        429:
          description: too many requests
        default:
          $ref: '#/components/responses/ServerError'
components:
  responses:
    Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    ServerError:
      description: Internal Server Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: Resource Not Found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Conflict:
      description: Resource Conflicts With Target
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  parameters:
    PaginationAfter:
      in: query
      name: after
      description: return items after this value
      allowEmptyValue: true
      schema:
        type: string
    PaginationPrefix:
      in: query
      name: prefix
      allowEmptyValue: true
      description: return items prefixed with this value
      schema:
        type: string
    PaginationAmount:
      in: query
      name: amount
      description: how many items to return
      schema:
        type: integer
        minimum: -1
        maximum: 1000
        default: 100
  schemas:
    ExternalPrincipalCreation:
      type: object
      properties:
        settings:
          type: object
          items:
            $ref: '#/components/schemas/ExternalPrincipalSettings'
    ExternalPrincipalList:
      type: object
      required:
      - pagination
      - results
      properties:
        pagination:
          $ref: '#/components/schemas/Pagination'
        results:
          type: array
          items:
            $ref: '#/components/schemas/ExternalPrincipal'
    ExternalPrincipal:
      type: object
      required:
      - user_id
      - id
      properties:
        id:
          type: string
          description: A unique identifier for the external principal i.e aws:sts::123:assumed-role/role-name
        user_id:
          type: string
          description: 'lakeFS user ID to associate with an external principal.

            '
        settings:
          type: object
          items:
            $ref: '#/components/schemas/ExternalPrincipalSettings'
    AuthenticationToken:
      type: object
      required:
      - token
      properties:
        token:
          description: a JWT token that could be used to authenticate requests
          type: string
        token_expiration:
          type: integer
          format: int64
          description: Unix Epoch in seconds
    ExternalPrincipalSettings:
      type: object
      additionalProperties:
        type: string
      description: Additional settings to be consumed by the remote authenticator
    ExternalLoginInformation:
      type: object
      required:
      - identityRequest
      properties:
        token_expiration_duration:
          type: integer
        identityRequest:
          type: object
    Pagination:
      type: object
      required:
      - has_more
      - max_per_page
      - results
      - next_offset
      properties:
        has_more:
          type: boolean
          description: Next page is available
        next_offset:
          type: string
          description: Token used to retrieve the next page
        results:
          type: integer
          minimum: 0
          description: Number of values found in the results
        max_per_page:
          type: integer
          minimum: 0
          description: Maximal number of entries per page
    Error:
      type: object
      required:
      - message
      properties:
        message:
          description: short message explaining the error
          type: string
  securitySchemes:
    basic_auth:
      type: http
      scheme: basic
    jwt_token:
      type: http
      scheme: bearer
      bearerFormat: JWT
    cookie_auth:
      type: apiKey
      in: cookie
      name: internal_auth_session
    oidc_auth:
      type: apiKey
      in: cookie
      name: oidc_auth_session
    saml_auth:
      type: apiKey
      in: cookie
      name: saml_auth_session