openapi: 3.1.0 info: title: Permit.io Access Requests (EAP) Access Requests (EAP) Condition Set Rules API description: ' Authorization as a service ' version: 2.0.0 tags: - name: Condition Set Rules description: ' Represents a "mini" ABAC rule comprised of (UserSet, Action, ResourceSet). If such tuple exists, it means all users matching the UserSet can perform the Action on the resources matching ResourceSet. Example: (`us_based_employees`, `repository:clone`, `private_repos`) where: - `us_based_employees` is a user set - `repository:clone` is an action - `private_repos` is a resource set ' paths: /v2/facts/{proj_id}/{env_id}/set_rules: get: tags: - Condition Set Rules summary: List Set Permissions description: 'Lists the condition set rules matching the filter. - If the `user_set` filter is present, will only return the permissions set of that user set. - If the `permission` filter is present, will only return the permissions sets that equals to the queried permission. - If the `resource_set` filter is present, will only return the permissions set of that resource set.' operationId: list_set_permissions parameters: - description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").' required: true schema: type: string title: Proj Id description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").' example: my_project name: proj_id in: path - description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").' required: true schema: type: string title: Env Id description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").' example: my_environment name: env_id in: path - description: optional user set filter, will only return rules where the permission is granted to this user set required: false schema: type: string title: User Set description: optional user set filter, will only return rules where the permission is granted to this user set name: user_set in: query - description: optional permission filter, will only return condition set rules granting this permission required: false schema: type: string title: Permission description: optional permission filter, will only return condition set rules granting this permission name: permission in: query - description: optional resource set filter, will only return rules where the permission is granted on this resource set required: false schema: type: string title: Resource Set description: optional resource set filter, will only return rules where the permission is granted on this resource set name: resource_set in: query - description: Page number of the results to fetch, starting at 1. required: false schema: type: integer minimum: 1.0 title: Page description: Page number of the results to fetch, starting at 1. default: 1 name: page in: query - description: The number of results per page (max 100). required: false schema: type: integer maximum: 100.0 minimum: 1.0 title: Per Page description: The number of results per page (max 100). default: 30 name: per_page in: query responses: '200': description: Successful Response content: application/json: schema: items: $ref: '#/components/schemas/ConditionSetRuleRead' type: array title: Response List Set Permissions V2 Facts Proj Id Env Id Set Rules Get '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - HTTPBearer: [] post: tags: - Condition Set Rules summary: Assign Set Permissions description: 'Grant permissions to a user set *on* a resource set. If the permission is already granted, it is skipped.' operationId: assign_set_permissions parameters: - description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").' required: true schema: type: string title: Proj Id description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").' example: my_project name: proj_id in: path - description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").' required: true schema: type: string title: Env Id description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").' example: my_environment name: env_id in: path requestBody: content: application/json: schema: $ref: '#/components/schemas/ConditionSetRuleCreate' required: true responses: '200': description: Successful Response content: application/json: schema: items: $ref: '#/components/schemas/ConditionSetRuleRead' type: array title: Response Assign Set Permissions V2 Facts Proj Id Env Id Set Rules Post '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - HTTPBearer: [] delete: tags: - Condition Set Rules summary: Unassign Set Permissions description: 'Revokes permissions to a user set *on* a resource set. If the permission is not granted, it is skipped.' operationId: unassign_set_permissions parameters: - description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").' required: true schema: type: string title: Proj Id description: 'Either the unique id of the project, or the URL-friendly key of the project (i.e: the "slug").' example: my_project name: proj_id in: path - description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").' required: true schema: type: string title: Env Id description: 'Either the unique id of the environment, or the URL-friendly key of the environment (i.e: the "slug").' example: my_environment name: env_id in: path requestBody: content: application/json: schema: $ref: '#/components/schemas/ConditionSetRuleRemove' required: true responses: '204': description: Successful Response '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - HTTPBearer: [] components: schemas: ConditionSetRuleCreate: properties: user_set: type: string title: User Set description: 'The userset that will be given permission, i.e: all the users matching this rule will be given the specified permission' permission: type: string title: Permission description: 'The permission that will be granted to the userset *on* the resourceset. The permission can be either a resource action id, or `{resource_key}:{action_key}`, i.e: the "permission name".' resource_set: type: string title: Resource Set description: 'The resourceset that represents the resources that are granted for access, i.e: all the resources matching this rule can be accessed by the userset to perform the granted *permission*' is_role: type: boolean title: Is Role description: if True, will set the condition set rule to the role's autogen user-set. default: false is_resource: type: boolean title: Is Resource description: if True, will set the condition set rule to the resource's autogen resource-set. default: false additionalProperties: false type: object required: - user_set - permission - resource_set title: ConditionSetRuleCreate example: user_set: us_based_employees permission: repository:clone resource_set: private_repos HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError ConditionSetRuleRemove: properties: user_set: type: string title: User Set description: 'The userset that will be unassigned these permission, i.e: all the users matching this rule will lose the specified permission' permission: type: string title: Permission description: 'The permission that will be removed from the userset *on* the resourceset. The permission can be either a resource action id, or `{resource_key}:{action_key}`, i.e: the "permission name".' resource_set: type: string title: Resource Set description: 'The resourceset that represents the resources that are no longer granted for access, i.e: all the resources matching this rule can no longer be accessed by the userset, and will be revoked the specified *permission*' is_role: type: boolean title: Is Role description: if True, will set the condition set rule to the role's autogen user-set. default: false is_resource: type: boolean title: Is Resource description: if True, will set the condition set rule to the resource's autogen resource-set. default: false additionalProperties: false type: object required: - user_set - permission - resource_set title: ConditionSetRuleRemove example: user_set: us_based_employees permission: repository:clone resource_set: private_repos ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type type: object required: - loc - msg - type title: ValidationError ConditionSetRuleRead: properties: id: type: string format: uuid title: Id description: Unique id of the condition set rule key: type: string title: Key description: A unique id by which Permit will identify this condition set rule. user_set: type: string title: User Set description: 'the userset that is currently granted permissions, i.e: all the users matching this rule are granted the permission on the resourceset' permission: type: string title: Permission description: a permission that is currently granted to the userset *on* the resourceset. resource_set: type: string title: Resource Set description: 'the resourceset that represents the resources that are currently granted for access, i.e: all the resources matching this rule can be accessed by the userset to perform the granted *permission*' organization_id: type: string format: uuid title: Organization Id description: Unique id of the organization that the condition set rule belongs to. project_id: type: string format: uuid title: Project Id description: Unique id of the project that the condition set rule belongs to. environment_id: type: string format: uuid title: Environment Id description: Unique id of the environment that the condition set rule belongs to. created_at: type: string format: date-time title: Created At description: Date and time when the condition set rule was created (ISO_8601 format). updated_at: type: string format: date-time title: Updated At description: Date and time when the condition set rule was last updated/modified (ISO_8601 format). additionalProperties: false type: object required: - id - key - user_set - permission - resource_set - organization_id - project_id - environment_id - created_at - updated_at title: ConditionSetRuleRead example: id: 497f6eca-6276-4993-bfeb-53cbbbba6f08 key: us_based_employees_can_repository_clone_private_repos user_set: us_based_employees permission: repository:clone resource_set: private_repos organization_id: 7c60d51f-b44e-4682-87d6-449835ea4de6 project_id: 405d8375-3514-403b-8c43-83ae74cfe0e9 environment_id: 40ef0e48-a11f-4963-a229-e396c9f7e7c4 created_at: '2019-08-24T14:15:22Z' updated_at: '2019-08-24T14:16:22Z' securitySchemes: HTTPBearer: type: http description: 'Authorization header, we support the bearer authentication scheme (see: RFC 6750)' scheme: bearer bearerFormat: JWT