openapi: 3.1.0
info:
  title: Permit.io Access Requests (EAP) Access Requests (EAP) API Keys API
  description: '

    Authorization as a service

    '
  version: 2.0.0
tags:
- name: API Keys
paths:
  /v2/api-key/{proj_id}/{env_id}:
    get:
      tags:
      - API Keys
      summary: Get Environment Api Key
      operationId: get_environment_api_key
      parameters:
      - description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
        required: true
        schema:
          type: string
          title: Proj Id
          description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").'
        example: my_project
        name: proj_id
        in: path
      - description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
        required: true
        schema:
          type: string
          title: Env Id
          description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").'
        example: my_environment
        name: env_id
        in: path
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIKeyRead'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - HTTPBearer: []
  /v2/api-key/scope:
    get:
      tags:
      - API Keys
      summary: Get Api Key Scope
      operationId: get_api_key_scope
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIKeyScopeRead'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - HTTPBearer: []
  /v2/api-key:
    get:
      tags:
      - API Keys
      summary: List Api Keys
      description: Lists all the api_keys under the active organization.
      operationId: list_api_keys
      parameters:
      - required: false
        schema:
          $ref: '#/components/schemas/MemberAccessObj'
        name: object_type
        in: query
      - description: Optional project filter by project id or key
        required: false
        schema:
          type: string
          title: Proj Id
          description: Optional project filter by project id or key
        name: proj_id
        in: query
      - description: Page number of the results to fetch, starting at 1.
        required: false
        schema:
          type: integer
          minimum: 1.0
          title: Page
          description: Page number of the results to fetch, starting at 1.
          default: 1
        name: page
        in: query
      - description: The number of results per page (max 100).
        required: false
        schema:
          type: integer
          maximum: 100.0
          minimum: 1.0
          title: Per Page
          description: The number of results per page (max 100).
          default: 30
        name: per_page
        in: query
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResult_APIKeyRead_'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - HTTPBearer: []
    post:
      tags:
      - API Keys
      summary: Create Api Key
      description: Creates a new api_key under the active organization.
      operationId: create_api_key
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/APIKeyCreate'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIKeyRead'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - HTTPBearer: []
  /v2/api-key/{api_key_id}:
    get:
      tags:
      - API Keys
      summary: Get Api Key
      description: Gets a single api_key matching the given api_key_id, if such api_key exists.
      operationId: get_api_key
      parameters:
      - description: The unique id of the API key
        required: true
        schema:
          type: string
          title: Api Key Id
          description: The unique id of the API key
        example: 42f0e113-219b-4bb9-ba90-e2c904761ce1
        name: api_key_id
        in: path
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIKeyRead'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - HTTPBearer: []
    delete:
      tags:
      - API Keys
      summary: Delete Api Key
      description: Deletes the api_key and all its related data.
      operationId: delete_api_key
      parameters:
      - description: The unique id of the API key
        required: true
        schema:
          type: string
          title: Api Key Id
          description: The unique id of the API key
        example: 42f0e113-219b-4bb9-ba90-e2c904761ce1
        name: api_key_id
        in: path
      responses:
        '204':
          description: Successful Response
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - HTTPBearer: []
  /v2/api-key/{api_key_id}/rotate-secret:
    post:
      tags:
      - API Keys
      summary: Rotate API Key
      description: 'Rotates the API key of the PDP container with id `pdp_id`.


        The rotation of the API key revokes the old API key and issues a new API key to the PDP.'
      operationId: rotate_api_key
      parameters:
      - description: The unique id of the API key
        required: true
        schema:
          type: string
          format: uuid
          title: Api Key Id
          description: The unique id of the API key
        example: 42f0e113-219b-4bb9-ba90-e2c904761ce1
        name: api_key_id
        in: path
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIKeyRead'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - HTTPBearer: []
components:
  schemas:
    MemberAccessLevel:
      type: string
      enum:
      - admin
      - write
      - read
      - no_access
      title: MemberAccessLevel
      description: An enumeration.
    JwksConfig:
      properties:
        ttl:
          type: integer
          title: Ttl
          description: JWKS cache TTL (in seconds)
          default: 600
        url:
          type: string
          pattern: ^https://[a-zA-Z0-9\-\.]+\.[a-zA-Z]{2,3}(/\S*)?$
          title: Url
          description: '...'
        jwks:
          allOf:
          - $ref: '#/components/schemas/JwksObj'
          title: Jwks
          description: '...'
      additionalProperties: false
      type: object
      title: JwksConfig
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    APIKeyCreate:
      properties:
        organization_id:
          type: string
          format: uuid
          title: Organization Id
        project_id:
          type: string
          format: uuid
          title: Project Id
        environment_id:
          type: string
          format: uuid
          title: Environment Id
        object_type:
          allOf:
          - $ref: '#/components/schemas/MemberAccessObj'
          default: env
        access_level:
          allOf:
          - $ref: '#/components/schemas/MemberAccessLevel'
          default: admin
        owner_type:
          allOf:
          - $ref: '#/components/schemas/APIKeyOwnerType'
          default: member
        name:
          type: string
          title: Name
      additionalProperties: false
      type: object
      required:
      - organization_id
      title: APIKeyCreate
    APIKeyScopeRead:
      properties:
        organization_id:
          type: string
          format: uuid
          title: Organization Id
          description: Unique id of the organization that the api_key belongs to.
        project_id:
          type: string
          format: uuid
          title: Project Id
          description: Unique id of the project that the api_key belongs to.
        environment_id:
          type: string
          format: uuid
          title: Environment Id
          description: Unique id of the environment that the api_key belongs to.
      additionalProperties: false
      type: object
      required:
      - organization_id
      title: APIKeyScopeRead
    InviteRead:
      properties:
        member_id:
          type: string
          format: uuid
          title: Member Id
          description: Unique id of the invite
        email:
          type: string
          format: email
          title: Email
          description: The invited member's email address
        role:
          allOf:
          - $ref: '#/components/schemas/MemberAccessLevel'
          description: The role the member will be assigned with
          default: admin
        id:
          type: string
          format: uuid
          title: Id
          description: Unique id of the invite
        organization_id:
          type: string
          format: uuid
          title: Organization Id
          description: Unique id of the organization that the invite belongs to.
        invite_code:
          type: string
          format: uuid
          title: Invite Code
          description: The invite code that is sent to the member's email
        created_at:
          type: string
          format: date-time
          title: Created At
          description: Date and time when the invite was created (ISO_8601 format).
        status:
          allOf:
          - $ref: '#/components/schemas/InviteStatus'
          description: The status of the invite (pending, failed, etc)
        failed_reason:
          type: string
          title: Failed Reason
          description: if failed, the reason the invitation failed
      additionalProperties: false
      type: object
      required:
      - email
      - id
      - organization_id
      - invite_code
      - created_at
      - status
      title: InviteRead
      example:
        id: 497f6eca-6276-4993-bfeb-53cbbbba6f08
        organization_id: 7c60d51f-b44e-4682-87d6-449835ea4de6
        invite_code: 40ef0e48-a11f-4963-a229-e396c9eeefff
        email: jane@coolcompany.com
        role: admin
        created_at: '2019-08-24T14:15:22Z'
        status: pending
        failed_reason: ''
    OnboardingStep:
      type: string
      enum:
      - create_organization
      - create_project
      - create_resource
      - create_actions
      - assign_permissions
      - assign_user_roles
      - connect_sdk
      - done
      title: OnboardingStep
      description: An enumeration.
    APIKeyRead:
      properties:
        organization_id:
          type: string
          format: uuid
          title: Organization Id
        project_id:
          type: string
          format: uuid
          title: Project Id
        environment_id:
          type: string
          format: uuid
          title: Environment Id
        object_type:
          allOf:
          - $ref: '#/components/schemas/MemberAccessObj'
          default: env
        access_level:
          allOf:
          - $ref: '#/components/schemas/MemberAccessLevel'
          default: admin
        owner_type:
          $ref: '#/components/schemas/APIKeyOwnerType'
        name:
          type: string
          title: Name
        id:
          type: string
          format: uuid
          title: Id
        secret:
          type: string
          title: Secret
        created_at:
          type: string
          format: date-time
          title: Created At
        created_by_member:
          $ref: '#/components/schemas/OrgMemberRead'
        last_used_at:
          type: string
          format: date-time
          title: Last Used At
        env:
          $ref: '#/components/schemas/EnvironmentRead'
        project:
          $ref: '#/components/schemas/ProjectRead'
      additionalProperties: false
      type: object
      required:
      - organization_id
      - owner_type
      - id
      - created_at
      title: APIKeyRead
    IdentityRead:
      properties:
        user_id:
          type: string
          title: User Id
          description: Unique User Id of this identity in the identity provider (including the provider type)
        provider:
          type: string
          title: Provider
          description: The identity provider type this identity came from
        sub:
          type: string
          title: Sub
          description: Unique User Id of this identity in the identity provider (NOT including the provider type)
        email:
          type: string
          format: email
          title: Email
          description: Email connected to this account identity
        email_verified:
          type: boolean
          title: Email Verified
          description: Whether this email address connected to this account identity is verified or not. For social providers like 'Login with Google' this is done automatically, otherwise we will send the user a verification link in email.
        auth0_info:
          type: object
          title: Auth0 Info
          description: Raw user info json coming from our identity provider and matching a specific account identity
      additionalProperties: false
      type: object
      required:
      - user_id
      - provider
      - sub
      - email
      - email_verified
      - auth0_info
      title: IdentityRead
    MemberAccessObj:
      type: string
      enum:
      - org
      - project
      - env
      title: MemberAccessObj
      description: An enumeration.
    JwksObj:
      properties:
        keys:
          items:
            type: object
          type: array
          title: Keys
          description: The keys to match against the request headers
      additionalProperties: false
      type: object
      required:
      - keys
      title: JwksObj
    OrgMemberRead:
      properties:
        id:
          type: string
          format: uuid
          title: Id
          description: Unique id of the account member
        email:
          type: string
          format: email
          title: Email
          description: Email of the user controlling this account
        email_verified:
          type: boolean
          title: Email Verified
          description: Whether this email address is verified or not. For social providers like 'Login with Google' this is done automatically, otherwise we will send the user a verification link in email.
        name:
          type: string
          title: Name
          description: Name of this user
        given_name:
          type: string
          title: Given Name
          description: First name of the user
        family_name:
          type: string
          title: Family Name
          description: Last name of the user
        picture:
          type: string
          title: Picture
          description: URL to picture, photo, or avatar of the user that controls this account.
        is_superuser:
          type: boolean
          title: Is Superuser
          description: Whether or not this user has special access to permit.io organizations
        is_onboarding:
          type: boolean
          title: Is Onboarding
          description: Whether or not this user is currently onboarding, needs to be replaced by a user journey object
        onboarding_step:
          allOf:
          - $ref: '#/components/schemas/OnboardingStep'
          description: the step the user is currently going through in onboarding
        created_at:
          type: string
          format: date-time
          title: Created At
          description: Date and time when the account member was created (ISO_8601 format).
        last_login:
          type: string
          format: date-time
          title: Last Login
          description: Last date and time this user logged in (ISO_8601 format).
        last_ip:
          type: string
          title: Last Ip
          description: Last IP address from which this user logged in.
          default: 0.0.0.0
        logins_count:
          type: integer
          title: Logins Count
          description: Total number of logins this user has performed.
          default: 0
        identities:
          items:
            $ref: '#/components/schemas/IdentityRead'
          type: array
          title: Identities
        invite:
          $ref: '#/components/schemas/InviteRead'
        settings:
          type: object
          title: Settings
          description: Custom permit.io dashboard settings, such as preferred theme, etc.
      additionalProperties: false
      type: object
      required:
      - id
      - email
      - email_verified
      - is_superuser
      - is_onboarding
      - onboarding_step
      - created_at
      - identities
      - settings
      title: OrgMemberRead
      example:
        id: 497f6eca-6276-4993-bfeb-53cbbbba6f08
        email: janedoe@permituser.com
        email_verified: true
        given_name: Jane
        family_name: Doe
        name: Jane Josephine Doe
        picture: http://permituser.com/janedoe/me.jpg
        settings:
          option: value
          another-option: another-value
        is_superuser: false
        is_onboarding: true
        onboarding_step: done
        created_at: '2019-08-20T14:15:22Z'
        last_login: '2019-08-24T14:15:22Z'
        last_ip: 1.2.3.4
        logins_count: 2
        identities:
        - user_id: google-oauth2|000000000000000000001
          provider: google-oauth2
          sub: '000000000000000000001'
          email: Jane@permituser.com
          email_verified: true
          user_info:
            sub: '000000000000000000001'
            name: Jane Josephine Doe
            given_name: Jane
            family_name: Doe
            middle_name: Josephine
            nickname: JJ
            preferred_username: j.doe
            profile: http://permituser.com/janedoe
            picture: http://permituser.com/janedoe/me.jpg
            website: http://permituser.com
            email: janedoe@permituser.com
            email_verified: true
            gender: female
            birthdate: '1972-03-31'
            zoneinfo: America/Los_Angeles
            locale: en-US
            phone_number: +1 (111) 222-3434
            phone_number_verified: false
            address:
              country: us
            updated_at: '1556845729'
        invite:
          id: 497f6eca-6276-4993-bfeb-53cbbbba6f08
          organization_id: 7c60d51f-b44e-4682-87d6-449835ea4de6
          invite_code: 40ef0e48-a11f-4963-a229-e396c9eeefff
          email: Jane@permituser.com
          role: admin
          created_at: '2019-08-24T14:15:22Z'
          status: pending
          failed_reason: ''
    ProjectRead:
      properties:
        key:
          type: string
          title: Key
          description: 'A URL-friendly name of the project (i.e: slug). You will be able to query later using this key instead of the id (UUID) of the project.'
        urn_namespace:
          type: string
          pattern: '[a-z0-9-]{2,}'
          title: Urn Namespace
          description: Optional namespace for URNs. If empty, URNs will be generated from project key.
        id:
          type: string
          format: uuid
          title: Id
          description: Unique id of the project
        organization_id:
          type: string
          format: uuid
          title: Organization Id
          description: Unique id of the organization that the project belongs to.
        created_at:
          type: string
          format: date-time
          title: Created At
          description: Date and time when the project was created (ISO_8601 format).
        updated_at:
          type: string
          format: date-time
          title: Updated At
          description: Date and time when the project was last updated/modified (ISO_8601 format).
        name:
          type: string
          title: Name
          description: The name of the project
        description:
          type: string
          title: Description
          description: a longer description outlining the project objectives
        settings:
          type: object
          title: Settings
          description: the settings for this project
        active_policy_repo_id:
          type: string
          format: uuid
          title: Active Policy Repo Id
          description: the id of the policy repo to use for this project
      additionalProperties: false
      type: object
      required:
      - key
      - id
      - organization_id
      - created_at
      - updated_at
      - name
      title: ProjectRead
    InviteStatus:
      type: string
      enum:
      - pending
      - accepted
      - failed
      - canceled
      title: InviteStatus
      description: An enumeration.
    PaginatedResult_APIKeyRead_:
      properties:
        data:
          items:
            $ref: '#/components/schemas/APIKeyRead'
          type: array
          title: Data
          description: List of Api Keys
        total_count:
          type: integer
          minimum: 0.0
          title: Total Count
        page_count:
          type: integer
          minimum: 0.0
          title: Page Count
          default: 0
      additionalProperties: false
      type: object
      required:
      - data
      - total_count
      title: PaginatedResult[APIKeyRead]
    EnvironmentRead:
      properties:
        key:
          type: string
          title: Key
          description: 'A URL-friendly name of the environment (i.e: slug). You will be able to query later using this key instead of the id (UUID) of the environment.'
        id:
          type: string
          format: uuid
          title: Id
          description: Unique id of the environment
        organization_id:
          type: string
          format: uuid
          title: Organization Id
          description: Unique id of the organization that the environment belongs to.
        project_id:
          type: string
          format: uuid
          title: Project Id
          description: Unique id of the project that the environment belongs to.
        created_at:
          type: string
          format: date-time
          title: Created At
          description: Date and time when the environment was created (ISO_8601 format).
        updated_at:
          type: string
          format: date-time
          title: Updated At
          description: Date and time when the environment was last updated/modified (ISO_8601 format).
        avp_policy_store_id:
          type: string
          title: Avp Policy Store Id
          hidden_from_schema: true
        name:
          type: string
          title: Name
          description: The name of the environment
        description:
          type: string
          title: Description
          description: an optional longer description of the environment
        custom_branch_name:
          type: string
          title: Custom Branch Name
          description: when using gitops feature, an optional branch name for the environment
        jwks:
          allOf:
          - $ref: '#/components/schemas/JwksConfig'
          title: Jwks
          description: jwks for element frontend only login
        settings:
          type: object
          title: Settings
          description: the settings for this environment
      additionalProperties: false
      type: object
      required:
      - key
      - id
      - organization_id
      - project_id
      - created_at
      - updated_at
      - name
      title: EnvironmentRead
    APIKeyOwnerType:
      type: string
      enum:
      - pdp_config
      - member
      - elements
      title: APIKeyOwnerType
      description: An enumeration.
  securitySchemes:
    HTTPBearer:
      type: http
      description: 'Authorization header, we support the bearer authentication scheme (see: RFC 6750)'
      scheme: bearer
      bearerFormat: JWT