swagger: '2.0'
info:
  description: Secure Docker and Kubernetes based container deployments with the NeuVector run-time security solution.
  version: 5.6.0
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  title: NeuVector User API
  contact:
    email: support@neuvector.com
schemes:
- https
tags:
- name: User
  description: Operations about User
paths:
  /v1/password_profile:
    get:
      tags:
      - User
      summary: Get password profile list
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTPwdProfilesData'
  /v1/password_profile/{name}:
    get:
      tags:
      - User
      summary: Get password profile
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      parameters:
      - in: path
        name: name
        description: Password profile name
        required: true
        type: string
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTPwdProfileData'
    patch:
      tags:
      - User
      summary: Configure password profile
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      consumes:
      - application/json
      parameters:
      - in: path
        name: name
        description: Password profile name
        required: true
        type: string
      - in: body
        name: body
        description: Password profile data
        required: true
        schema:
          $ref: '#/definitions/RESTPwdProfileConfigData'
      responses:
        '200':
          description: Success
  /v1/user:
    get:
      tags:
      - User
      summary: Gets a list of users
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTUsersData'
    post:
      tags:
      - User
      summary: Creates a user
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      consumes:
      - application/json
      parameters:
      - in: body
        name: body
        description: User information
        required: true
        schema:
          $ref: '#/definitions/RESTUserData'
      responses:
        '200':
          description: Success
  /v1/user/{fullname}:
    get:
      tags:
      - User
      summary: Gets a user
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      parameters:
      - in: path
        name: fullname
        description: User name
        required: true
        type: string
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTUserData'
    patch:
      tags:
      - User
      summary: Update user
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      consumes:
      - application/json
      parameters:
      - in: path
        name: fullname
        description: User name
        required: true
        type: string
      - in: body
        name: body
        description: User update data
        required: true
        schema:
          $ref: '#/definitions/RESTUserConfigData'
      responses:
        '200':
          description: Success
        '403':
          description: Error
          schema:
            $ref: '#/definitions/RESTError'
    delete:
      tags:
      - User
      summary: Delete user
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      parameters:
      - in: path
        name: fullname
        description: User name
        required: true
        type: string
      responses:
        '200':
          description: Success
  /v1/user/{fullname}/password:
    post:
      tags:
      - User
      summary: Configure user login
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      consumes:
      - application/json
      parameters:
      - in: path
        name: fullname
        description: User name
        required: true
        type: string
      - in: body
        name: body
        description: User password configuration data
        required: true
        schema:
          $ref: '#/definitions/RESTUserPwdConfigData'
      responses:
        '200':
          description: Success
  /v1/user/{fullname}/role/{role}:
    patch:
      tags:
      - User
      summary: For CLI to modify one role
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      consumes:
      - application/json
      parameters:
      - in: path
        name: fullname
        description: User name
        required: true
        type: string
      - in: path
        name: role
        description: Role name
        required: true
        type: string
      - in: body
        name: body
        description: User role domain update data
        required: true
        schema:
          $ref: '#/definitions/RESTUserRoleDomainsConfigData'
      responses:
        '200':
          description: Success
  /v1/user_role:
    get:
      tags:
      - User
      summary: Get role list
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTUserRolesData'
    post:
      tags:
      - User
      summary: Creates a role
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      consumes:
      - application/json
      parameters:
      - in: body
        name: body
        description: Role information
        required: true
        schema:
          $ref: '#/definitions/RESTUserRoleConfigData'
      responses:
        '200':
          description: Success
  /v1/user_role/{name}:
    get:
      tags:
      - User
      summary: Get role details
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      parameters:
      - in: path
        name: name
        description: User role name
        required: true
        type: string
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTUserRoleData'
    patch:
      tags:
      - User
      summary: Config a user role
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      consumes:
      - application/json
      parameters:
      - in: path
        name: name
        description: User role name
        required: true
        type: string
      - in: body
        name: body
        description: User role update data
        required: true
        schema:
          $ref: '#/definitions/RESTUserRoleConfigData'
      responses:
        '200':
          description: Success
    delete:
      tags:
      - User
      summary: Delete a user role
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      parameters:
      - in: path
        name: name
        description: User role name
        required: true
        type: string
      responses:
        '200':
          description: Success
definitions:
  RESTUserRoleConfig:
    type: object
    required:
    - name
    - comment
    - permissions
    properties:
      name:
        type: string
        example: customadmin
      comment:
        type: string
        example: ''
      permissions:
        type: array
        items:
          $ref: '#/definitions/RESTRolePermission'
  RESTUserPwdConfigData:
    type: object
    required:
    - config
    properties:
      config:
        $ref: '#/definitions/RESTUserPwdConfig'
  RESTUserPwdConfig:
    type: object
    required:
    - fullname
    properties:
      fullname:
        type: string
        example: admin
      clear_failed_login:
        type: boolean
        example: true
      new_password:
        type: string
        example: ''
      force_reset_password:
        type: boolean
        description: whether to reset password even it's not expired yet
        example: false
      reset_password_in_next_login:
        type: boolean
        description: whether the target user needs ti reset password in the next login
        example: true
  RESTUserRoleData:
    type: object
    required:
    - role
    properties:
      role:
        $ref: '#/definitions/RESTUserRole'
  RESTUserRoleDomainsConfigData:
    type: object
    required:
    - config
    properties:
      config:
        $ref: '#/definitions/RESTUserRoleDomainsConfig'
  RESTPwdProfileBasic:
    type: object
    required:
    - min_len
    - min_uppercase_count
    - min_lowercase_count
    - min_digit_count
    - min_special_count
    properties:
      min_len:
        type: integer
        example: 6
      min_uppercase_count:
        type: integer
        example: 0
      min_lowercase_count:
        type: integer
        example: 0
      min_digit_count:
        type: integer
        example: 0
      min_special_count:
        type: integer
        example: 0
  RESTUserRolesData:
    type: object
    required:
    - roles
    properties:
      roles:
        type: array
        items:
          $ref: '#/definitions/RESTUserRole'
  RESTImportTaskData:
    type: object
    required:
    - data
    properties:
      data:
        $ref: '#/definitions/RESTImportTask'
  RESTPermitsAssigned:
    type: object
    properties:
      permissions:
        type: array
        description: array of permissions
        items:
          $ref: '#/definitions/RESTRolePermission'
      domains:
        type: array
        description: array of domains that have the same permissions
        items:
          type: string
        example:
        - domain1
        - domain2
  RESTImportTask:
    type: object
    required:
    - tid
    - ctrler_id
    - percentage
    properties:
      tid:
        type: string
        example: c5af897b62a258212ece91c0551d3a4a
      ctrler_id:
        type: string
        example: 6e60452b244b90456f3450c9fed0a50f57f4b849dcb74a5fad289e8116f32f36
      last_update_time:
        type: string
        format: date-time
        example: '2022-03-17T17:31:55.832768041Z'
      percentage:
        type: integer
        example: 100
      triggered_by:
        type: string
        example: admin
      status:
        type: string
        example: done
      temp_token:
        type: string
        example: ''
      fail_to_decrypt_key_fields:
        type: object
        description: Object key is kv key and value is array of cloaked fields that cannot be decrypted
        additionalProperties:
          type: array
          items:
            type: string
          example:
          - x509_cert
          - signing_cert
  RESTUserConfigData:
    type: object
    required:
    - config
    properties:
      config:
        $ref: '#/definitions/RESTUserConfig'
  RESTUserData:
    type: object
    required:
    - user
    properties:
      user:
        $ref: '#/definitions/RESTUser'
  RESTUserRoleDomainsConfig:
    type: object
    required:
    - fullname
    - role
    - domains
    properties:
      fullname:
        type: string
        example: name
      role:
        type: string
        example: myrole
      domains:
        type: array
        items:
          type: string
          example: ''
  RESTUserConfig:
    type: object
    required:
    - fullname
    - pwd_profile
    properties:
      fullname:
        type: string
        example: name
      password:
        type: string
        format: password
        example: mypassword
      new_password:
        type: string
        example: newpassword
      pwd_profile:
        type: string
        example: null
      email:
        type: string
        format: email
        example: user@mail.com
      role:
        type: string
        example: admin
      timeout:
        type: integer
        format: uint32
        example: 300
      locale:
        type: string
        example: en
      role_domains:
        type: object
        description: Object key is role and value is array of domains
        additionalProperties:
          type: array
          items:
            type: string
          example:
          - domain1
          - domain2
  RESTPwdProfileConfig:
    type: object
    required:
    - name
    properties:
      name:
        type: string
        example: default
      active:
        type: boolean
        example: true
      comment:
        type: string
        example: ''
      min_len:
        type: integer
        example: 6
      min_uppercase_count:
        type: integer
        example: 0
      min_lowercase_count:
        type: integer
        example: 0
      min_digit_count:
        type: integer
        example: 0
      min_special_count:
        type: integer
        example: 0
      enable_password_expiration:
        type: boolean
        example: false
      password_expire_after_days:
        type: integer
        example: 0
      enable_password_history:
        type: boolean
        example: true
      password_keep_history_count:
        type: integer
        example: 0
      enable_block_after_failed_login:
        type: boolean
        example: false
      block_after_failed_login_count:
        type: integer
        example: 0
      block_minutes:
        type: integer
        example: 0
      session_timeout:
        type: integer
        example: 300
  RESTPwdProfileData:
    type: object
    required:
    - pwd_profile
    properties:
      pwd_profile:
        $ref: '#/definitions/RESTPwdProfile'
  RESTUser:
    type: object
    required:
    - fullname
    - server
    - username
    - email
    - role
    - timeout
    - locale
    - default_password
    - modify_password
    - last_login_timestamp
    - last_login_at
    - login_count
    - blocked_for_failed_login
    - blocked_for_password_expired
    - password_resettable
    properties:
      fullname:
        type: string
        example: admin
      server:
        type: string
        example: server1
      username:
        type: string
        example: admin
      password:
        type: string
        format: password
        example: mypassword
      email:
        type: string
        format: email
        example: user@mail.com
      role:
        type: string
        description: role on global domain
        example: admin
      extra_permissions:
        description: extra permissions(other than 'role') extra permissions(other than 'Role') on global domain. only for Rancher SSO
        type: array
        items:
          $ref: '#/definitions/RESTRolePermission'
      timeout:
        type: integer
        format: uint32
        example: 300
      locale:
        type: string
        example: en
      default_password:
        type: boolean
        description: If the user is using default password
      modify_password:
        type: boolean
        default: false
        description: If the password should be modified
      role_domains:
        type: object
        description: map of roles on namespaces
        properties:
          key:
            description: role
            type: string
          value:
            type: object
            description: array of domains
            additionalProperties:
              type: array
              items:
                type: string
              example:
              - domain1
              - domain2
      extra_permissions_domains:
        type: array
        description: list of extra permissions(other than 'role_domains') for namespaces on managed clusters in fed. only for Rancher SSO
        items:
          $ref: '#/definitions/RESTPermitsAssigned'
      remote_role_permissions:
        type: object
        description: role/permissions on managed clusters in fed. only for Rancher SSO
        properties:
          user:
            $ref: '#/definitions/RESTRemoteRolePermits'
      last_login_timestamp:
        type: integer
        format: int64
        example: 1505755716
      last_login_at:
        type: string
        example: ''
      login_count:
        type: integer
        format: uint32
        example: 1
      blocked_for_failed_login:
        type: boolean
        example: false
      blocked_for_password_expired:
        type: boolean
        example: false
      password_resettable:
        type: boolean
        description: whether the user's password can be reset by the current login user
        example: false
  RESTPwdProfileConfigData:
    type: object
    required:
    - config
    properties:
      config:
        $ref: '#/definitions/RESTPwdProfileConfig'
  RESTRemoteRolePermits:
    type: object
    required:
    - role
    properties:
      role:
        type: string
        description: global role on managed clusters in fed
        example: admin
      role_domains:
        type: object
        description: role -> domains on managed clusters in fed
        properties:
          key:
            description: role
            type: string
          value:
            type: object
            description: array of domains
            additionalProperties:
              type: array
              items:
                type: string
              example:
              - domain1
              - domain2
      extra_permissions:
        description: extra permissions(other than 'role') for global domain on managed clusters in fed. only for Rancher SSO
        type: array
        items:
          $ref: '#/definitions/RESTRolePermission'
      extra_permissions_domains:
        type: array
        description: list of extra permissions(other than 'role_domains') for namespaces on managed clusters in fed. only for Rancher SSO
        items:
          $ref: '#/definitions/RESTPermitsAssigned'
  RESTError:
    type: object
    required:
    - code
    - error
    - message
    properties:
      code:
        type: integer
        example: 3
      error:
        type: string
        example: Request failed
      message:
        type: string
        example: Invalid format
      password_profile_basic:
        $ref: '#/definitions/RESTPwdProfileBasic'
      import_task_data:
        $ref: '#/definitions/RESTImportTaskData'
  RESTPwdProfile:
    type: object
    required:
    - name
    - comment
    - min_len
    - min_uppercase_count
    - min_lowercase_count
    - min_digit_count
    - min_special_count
    - enable_password_expiration
    - password_expire_after_days
    - enable_password_history
    - password_keep_history_count
    - enable_block_after_failed_login
    - block_after_failed_login_count
    - block_minutes
    - session_timeout
    properties:
      name:
        type: string
        example: default
      comment:
        type: string
        example: default
      min_len:
        type: integer
        example: 6
      min_uppercase_count:
        type: integer
        example: 0
      min_lowercase_count:
        type: integer
        example: 0
      min_digit_count:
        type: integer
        example: 0
      min_special_count:
        type: integer
        example: 0
      enable_password_expiration:
        type: boolean
        example: false
      password_expire_after_days:
        type: integer
        example: 0
      enable_password_history:
        type: integer
        example: 0
      password_keep_history_count:
        type: integer
        example: 0
      enable_block_after_failed_login:
        type: boolean
        example: false
      block_after_failed_login_count:
        type: integer
        example: 0
      block_minutes:
        type: integer
        example: 0
      session_timeout:
        type: integer
        example: 300
  RESTUserRoleConfigData:
    type: object
    required:
    - config
    properties:
      config:
        $ref: '#/definitions/RESTUserRoleConfig'
  RESTRolePermission:
    type: object
    required:
    - id
    - read
    - write
    properties:
      id:
        type: string
        example: ci_scan
      read:
        type: boolean
        example: false
      write:
        type: boolean
        example: true
  RESTUserRole:
    type: object
    required:
    - name
    - comment
    - reserved
    - permissions
    properties:
      name:
        type: string
        example: ciops
      comment:
        type: string
        example: CI Integration role
      reserved:
        type: boolean
        example: true
      permissions:
        type: array
        items:
          $ref: '#/definitions/RESTRolePermission'
  RESTPwdProfilesData:
    type: object
    required:
    - pwd_profiles
    - active_profile_name
    properties:
      pwd_profiles:
        type: array
        items:
          $ref: '#/definitions/RESTPwdProfile'
      active_profile_name:
        type: string
        example: default
  RESTUsersData:
    type: object
    required:
    - users
    - global_roles
    - domain_roles
    properties:
      users:
        type: array
        items:
          $ref: '#/definitions/RESTUser'
      global_roles:
        type: array
        items:
          type: string
        example:
        - admin
        - reader
      domain_roles:
        type: array
        items:
          type: string
        example:
        - role1
        - role2
securityDefinitions:
  ApiKeyAuth:
    type: apiKey
    in: header
    name: X-Auth-Apikey
  TokenAuth:
    type: apiKey
    in: header
    name: X-Auth-Token
externalDocs:
  description: Find out more about NeuVector
  url: https://www.suse.com/products/neuvector/