openapi: 3.0.1 info: title: FlashArray REST Active Directory Policies - TLS API version: '2.52' description: 'Active Directory configuration authenticates users for NFS using Kerberos or SMB using Kerberos or New Technology LAN Manager (NTLM). Active Directory is also used to authorize users by mapping identities across the NFS and SMB protocols by using LDAP queries. ' servers: - url: / tags: - name: Policies - TLS description: A TLS policy manages the allowed TLS versions and ciphers for incoming network traffic to the system. These policies can be applied at the array level, or to individual network IPs. paths: /api/2.26/network-interfaces/tls-policies: get: tags: - Policies - TLS summary: Pure Storage GET Network-interfaces/tls-policies description: List network interface TLS policies. parameters: - $ref: '#/components/parameters/XRequestId' - $ref: '#/components/parameters/Continuation_token' - $ref: '#/components/parameters/Filter' - $ref: '#/components/parameters/Limit' - $ref: '#/components/parameters/Member_ids' - $ref: '#/components/parameters/Member_names' - $ref: '#/components/parameters/Offset' - $ref: '#/components/parameters/Policy_ids' - $ref: '#/components/parameters/Policy_names' - $ref: '#/components/parameters/Sort' responses: '200': description: OK headers: X-Request-ID: description: Supplied by client during request or generated by server. schema: type: string content: application/json: schema: $ref: '#/components/schemas/PolicyMemberGetResponse' post: tags: - Policies - TLS summary: Pure Storage POST Network-interfaces/tls-policies description: Apply a TLS policy to a specific network interface. A given network interface may only have 1 TLS policy applied to it at any given time. parameters: - $ref: '#/components/parameters/XRequestId' - $ref: '#/components/parameters/Member_ids' - $ref: '#/components/parameters/Member_names' - $ref: '#/components/parameters/Policy_ids' - $ref: '#/components/parameters/Policy_names' responses: '200': description: OK headers: X-Request-ID: description: Supplied by client during request or generated by server. schema: type: string content: application/json: schema: $ref: '#/components/schemas/PolicyMemberResponse' delete: tags: - Policies - TLS summary: Pure Storage DELETE Network-interfaces/tls-policies description: Remove a TLS policy from a network interface. parameters: - $ref: '#/components/parameters/XRequestId' - $ref: '#/components/parameters/Member_ids' - $ref: '#/components/parameters/Member_names' - $ref: '#/components/parameters/Policy_ids' - $ref: '#/components/parameters/Policy_names' responses: '200': description: OK headers: X-Request-ID: description: Supplied by client during request or generated by server. schema: type: string content: {} /api/2.26/tls-policies: get: tags: - Policies - TLS summary: Pure Storage List TLS Policies description: List TLS policies parameters: - $ref: '#/components/parameters/XRequestId' - $ref: '#/components/parameters/Continuation_token' - $ref: '#/components/parameters/Effective_tls_policy' - $ref: '#/components/parameters/Filter' - $ref: '#/components/parameters/Ids' - $ref: '#/components/parameters/Limit' - $ref: '#/components/parameters/Names' - $ref: '#/components/parameters/Offset' - $ref: '#/components/parameters/Purity_defined' - $ref: '#/components/parameters/Sort' responses: '200': description: OK headers: X-Request-ID: description: Supplied by client during request or generated by server. schema: type: string content: application/json: schema: $ref: '#/components/schemas/TlsPolicyGetResponse' post: tags: - Policies - TLS summary: Pure Storage Create TLS Policies description: Creates TLS policies. parameters: - $ref: '#/components/parameters/XRequestId' - $ref: '#/components/parameters/Names_required' requestBody: content: application/json: schema: $ref: '#/components/schemas/TlsPolicyPost' required: true x-codegen-request-body-name: policy responses: '200': description: OK headers: X-Request-ID: description: Supplied by client during request or generated by server. schema: type: string content: application/json: schema: $ref: '#/components/schemas/TlsPolicyResponse' x-codegen-request-body-name: policy delete: tags: - Policies - TLS summary: Pure Storage Delete TLS Policies description: Deletes TLS policies. parameters: - $ref: '#/components/parameters/XRequestId' - $ref: '#/components/parameters/Ids' - $ref: '#/components/parameters/Names' responses: '200': description: OK headers: X-Request-ID: description: Supplied by client during request or generated by server. schema: type: string content: {} patch: tags: - Policies - TLS summary: Pure Storage Modify TLS Policies description: Modifies one or more attributes of TLS policies. parameters: - $ref: '#/components/parameters/XRequestId' - $ref: '#/components/parameters/Ids' - $ref: '#/components/parameters/Names' requestBody: content: application/json: schema: $ref: '#/components/schemas/TlsPolicy' required: true x-codegen-request-body-name: policy responses: '200': description: OK headers: X-Request-ID: description: Supplied by client during request or generated by server. schema: type: string content: application/json: schema: $ref: '#/components/schemas/TlsPolicyResponse' x-codegen-request-body-name: policy /api/2.26/tls-policies/members: get: tags: - Policies - TLS summary: Pure Storage GET Tls-policies/members description: List TLS policies mapped to the array as a whole, or to one or more specific objects on the array (such as network interfaces). parameters: - $ref: '#/components/parameters/XRequestId' - $ref: '#/components/parameters/Continuation_token' - $ref: '#/components/parameters/Filter' - $ref: '#/components/parameters/Limit' - $ref: '#/components/parameters/Member_ids' - $ref: '#/components/parameters/Member_names' - $ref: '#/components/parameters/Offset' - $ref: '#/components/parameters/Policy_ids' - $ref: '#/components/parameters/Policy_names' - $ref: '#/components/parameters/Sort' responses: '200': description: OK headers: X-Request-ID: description: Supplied by client during request or generated by server. schema: type: string content: application/json: schema: $ref: '#/components/schemas/PolicyMemberGetResponse' /api/2.26/tls-policies/network-interfaces: get: tags: - Policies - TLS summary: Pure Storage GET Tls-policies/network-interfaces description: List network interface TLS policies. parameters: - $ref: '#/components/parameters/XRequestId' - $ref: '#/components/parameters/Continuation_token' - $ref: '#/components/parameters/Filter' - $ref: '#/components/parameters/Limit' - $ref: '#/components/parameters/Member_ids' - $ref: '#/components/parameters/Member_names' - $ref: '#/components/parameters/Offset' - $ref: '#/components/parameters/Policy_ids' - $ref: '#/components/parameters/Policy_names' - $ref: '#/components/parameters/Sort' responses: '200': description: OK headers: X-Request-ID: description: Supplied by client during request or generated by server. schema: type: string content: application/json: schema: $ref: '#/components/schemas/PolicyMemberGetResponse' post: tags: - Policies - TLS summary: Pure Storage POST Tls-policies/network-interfaces description: Apply a TLS policy to a specific network interface. A given network interface may only have 1 TLS policy applied to it at any given time. parameters: - $ref: '#/components/parameters/XRequestId' - $ref: '#/components/parameters/Member_ids' - $ref: '#/components/parameters/Member_names' - $ref: '#/components/parameters/Policy_ids' - $ref: '#/components/parameters/Policy_names' responses: '200': description: OK headers: X-Request-ID: description: Supplied by client during request or generated by server. schema: type: string content: application/json: schema: $ref: '#/components/schemas/PolicyMemberResponse' delete: tags: - Policies - TLS summary: Pure Storage DELETE Tls-policies/network-interfaces description: Remove a TLS policy from a network interface. parameters: - $ref: '#/components/parameters/XRequestId' - $ref: '#/components/parameters/Member_ids' - $ref: '#/components/parameters/Member_names' - $ref: '#/components/parameters/Policy_ids' - $ref: '#/components/parameters/Policy_names' responses: '200': description: OK headers: X-Request-ID: description: Supplied by client during request or generated by server. schema: type: string content: {} components: schemas: TlsPolicy: allOf: - $ref: '#/components/schemas/TlsPolicyPost' - $ref: '#/components/schemas/PolicyBaseRenameable' _referenceWithoutType: type: object properties: id: description: 'A globally unique, system-generated ID. The ID cannot be modified. ' type: string name: description: 'The resource name, such as volume name, pod name, snapshot name, and so on. ' type: string PolicyBase: allOf: - $ref: '#/components/schemas/PolicyBaseRenameable' _resource: description: 'An ordinary (as opposed to built-in) resource that can be created, named, renamed or deleted by the user. This might be a virtual resource (e.g., a file system), or correspond to something in the environment, like a host or a server. ' type: object properties: id: description: 'A globally unique, system-generated ID. The ID cannot be modified and cannot refer to another resource. ' type: string readOnly: true name: description: 'A user-specified name. The name must be locally unique and can be changed. ' type: string _fixedReferenceWithoutType: type: object properties: id: description: 'A globally unique, system-generated ID. The ID cannot be modified. ' type: string readOnly: true name: description: 'The resource name, such as volume name, file system name, snapshot name, and so on. ' type: string readOnly: true x-readOnly: true _referenceWritable: allOf: - $ref: '#/components/schemas/_referenceWithoutType' - type: object properties: resource_type: description: 'Type of the object (full name of the endpoint). Valid values are `hosts`, `host-groups`, `network-interfaces`, `pods`, `ports`, `pod-replica-links`, `subnets`, `volumes`, `volume-snapshots`, `volume-groups`, `directories`, `policies/nfs`, `policies/smb`, `policies/snapshot`, etc. ' type: string x-aliases: - _reference TlsPolicyResponse: type: object properties: items: description: A list of TLS policy objects. type: array items: $ref: '#/components/schemas/TlsPolicy' TlsPolicyPost: allOf: - $ref: '#/components/schemas/PolicyBase' - type: object properties: appliance_certificate: description: 'A reference to a certificate that will be presented as the server certificate in TLS negotiations with any clients that connect to appliance network addresses to which this policy applies. ' title: ReferenceWritable allOf: - $ref: '#/components/schemas/_referenceWritable' client_certificates_required: description: 'If `true`, then all clients negotiating TLS connections with network interfaces to which this policy applies will be required to provide their client certificates during TLS negotiation. Any client''s failure to provide a certificate will cause the TLS negotiation to be rejected. If `false`, then providing a client certificate in TLS negotiation is not mandatory, and TLS negotiation can succeed when none is provided. If not specified, defaults to `false`. ' type: boolean disabled_tls_ciphers: description: 'If specified, disables the specific TLS ciphers. If all TLS ciphers that are available for a specific TLS version on the system are disabled, then client access over that TLS version is not possible. As such, disabled ciphers must still result in at least one cipher being available for each enabled TLS version. Changes to this setting can disrupt traffic for any clients relying on disabled ciphers. ' type: array maxItems: 16 items: maxLength: 128 type: string description: 'A specific TLS cipher or TLS cipher component to disable, in openssl format. For example, `AES128` would disable all TLS ciphers that utilize the `AES128` algorithm for encryption, while `ECDHE-ECDSA-AES256-CCM` would disable that specific cipher. ' enabled_tls_ciphers: description: 'If specified, enables only the specified TLS ciphers. If all TLS ciphers that are available for a specific TLS version on the system are disabled, then client access over that TLS version is not possible. As such, the enabled ciphers must always contain at least one cipher for each enabled TLS version. Changes to this setting can disrupt traffic for any clients relying on ciphers that are removed. If set to `default`, then the enabled ciphers may be automatically adjusted upon upgrade to newer software in order to align with the best known practices at the time of software release. ' type: array maxItems: 16 items: maxLength: 128 type: string description: 'A specific TLS cipher or TLS cipher component to enable, in openssl format. For example, `AES128` would enable all strong TLS ciphers that utilize the `AES128` algorithm for encryption, while `AES128-SHA` would enable that specific cipher. ' min_tls_version: description: 'The minimum TLS version that will be allowed for inbound connections on IPs to which this policy applies. Changing this setting can disrupt connections for any clients relying on older TLS versions that are disabled. If set to `default`, then the lowest TLS version permitted may be automatically raised upon upgrade to newer software in order to align with the best known practices at the time of software release. Configuring an explicit, low value can prevent upgrades to newer software versions that no longer support older TLS versions. Valid values include `default`, `TLSv1.1`, `TLSv1.0`, `TLSv1.2`, and `TLSv1.3`. ' type: string trusted_client_certificate_authority: description: 'A reference to a certificate or certificate group. The certificate referenced, or the certificates in the referenced group, will be used to verify the certificates presented by clients when `verify_client_certificate_trust` is `true`. ' title: ReferenceWritable allOf: - $ref: '#/components/schemas/_referenceWritable' verify_client_certificate_trust: description: 'If `true`, then any certificate presented by a client in TLS negotiation will undergo strict trust verification using the certificate(s) referenced by `trusted_client_certificate_authority`. If `false`, then certificates presented by clients in TLS negotiation will only be checked to ensure they''re properly constructed and non-expired, and the certificates specified by `trusted_client_certificate_authority` will not be used. Details of client certificates may still be recorded for certain audit purposes, even if they do not undergo trust verification. If `client_certificates_required` is `false`, and no client certificate is provided during TLS negotiation, then no trust verification will be performed; if a client chooses to provide a certificate, even when not required, and this field is `true`, then the certificate will undergo trust verification. If not specified, defaults to `false`. ' type: boolean PolicyMemberResponse: type: object properties: items: description: A list of members for policies. type: array items: $ref: '#/components/schemas/PolicyMember' PolicyMemberGetResponse: allOf: - $ref: '#/components/schemas/PageInfo' - $ref: '#/components/schemas/PolicyMemberResponse' PolicyBaseRenameable: allOf: - $ref: '#/components/schemas/_resource' - $ref: '#/components/schemas/_realmsReference' - type: object properties: enabled: description: 'If `true`, the policy is enabled. If not specified, defaults to `true`. ' type: boolean is_local: description: Whether the policy is defined on the local array. type: boolean readOnly: true location: description: Reference to the array where the policy is defined. title: FixedReference allOf: - $ref: '#/components/schemas/_fixedReference' policy_type: description: 'Type of the policy. Valid values include `alert`, `audit`, `bucket-access`, `cross-origin-resource-sharing`, `network-access`, `nfs`, `object-access`, `s3-export`, smb-client`, `smb-share`, `ssh-certificate-authority`, and `telemetry-metrics`. ' type: string readOnly: true TlsPolicyGetResponse: allOf: - $ref: '#/components/schemas/PageInfo' - $ref: '#/components/schemas/TlsPolicyResponse' _realmsReference: type: object properties: realms: description: 'Reference to the realms this resource belongs to. The value is set to empty array when the resource lives outside of a realm. ' type: array readOnly: true items: $ref: '#/components/schemas/_fixedReference' _fixedReference: allOf: - $ref: '#/components/schemas/_fixedReferenceWithoutType' - type: object properties: resource_type: description: 'Type of the object (full name of the endpoint). Valid values are the unique part of the resource''s REST endpoint. For example, a reference to a file system would have a `resource_type` of `file-systems`. ' type: string readOnly: true PageInfo: type: object properties: continuation_token: description: 'Continuation token that can be provided in the `continuation_token` query param to get the next page of data. If you use the `continuation_token` to page through data you are guaranteed to get all items exactly once regardless of how items are modified. If an item is added or deleted during the pagination then it may or may not be returned. The `continuation_token` is generated if the `limit` is less than the remaining number of items, and the default sort is used (no sort is specified). ' type: string total_item_count: description: Total number of items after applying `filter` params. type: integer format: int32 PolicyMember: type: object properties: member: description: Reference to the resource the policy is applied to. title: FixedReference allOf: - $ref: '#/components/schemas/_fixedReference' policy: description: Reference to the policy. title: FixedReference allOf: - $ref: '#/components/schemas/_fixedReference' parameters: Offset: name: offset in: query description: 'The offset of the first resource to return from a collection. ' schema: type: integer format: int32 minimum: 0 example: 10 Filter: name: filter in: query description: 'Narrows down the results to only the response objects that satisfy the filter criteria. ' schema: type: string Purity_defined: name: purity_defined in: query description: 'If `true`, then the results returned will be include the specification for purity-defined values on the current purity version. These values may be used in configurations in order to dynamically adopt new behavior across upgrades, and this option allows the exact behavior for the current version to be returned. Defaults to `false`. ' schema: type: boolean Policy_ids: name: policy_ids in: query description: 'A comma-separated list of policy IDs. If after filtering, there is not at least one resource that matches each of the elements of `policy_ids`, then an error is returned. This cannot be provided together with the `policy_names` query parameter. ' style: form explode: false schema: type: array items: type: string Continuation_token: name: continuation_token in: query description: 'A token used to retrieve the next page of data with some consistency guaranteed. The token is a Base64 encoded value. Set `continuation_token` to the system-generated token taken from the `x-next-token` header field of the response. A query has reached its last page when the response does not include a token. Pagination requires the `limit` and `continuation_token` query parameters. ' schema: type: string Policy_names: name: policy_names in: query description: 'A comma-separated list of policy names. ' style: form explode: false schema: type: array items: type: string XRequestId: name: X-Request-ID in: header description: 'Supplied by client during request or generated by server. ' schema: type: string Limit: name: limit in: query description: 'Limits the size of the response to the specified number of objects on each page. To return the total number of resources, set `limit=0`. The total number of resources is returned as a `total_item_count` value. If the page size requested is larger than the system maximum limit, the server returns the maximum limit, disregarding the requested page size. ' schema: type: integer format: int32 minimum: 0 example: 10 Names: name: names in: query description: 'Performs the operation on the unique names specified. Enter multiple names in comma-separated format. For example, `name01,name02`. If there is not at least one resource that matches each of the elements of `names`, then an error is returned, except when creating new resources. ' style: form explode: false schema: type: array items: type: string Effective_tls_policy: name: effective in: query description: 'If `true`, then the TLS policies returned will be fully evaluated. This involves expanding shortened TLS ciphers, removing disabled TLS ciphers from the list of expanded enabled TLS ciphers, and converting values such as `default` and `legacy` into concrete values, in order to return the discrete effective TLS settings that the policies encode. Defaults to `false`. ' schema: type: boolean Member_ids: name: member_ids in: query description: 'A comma-separated list of member IDs. If after filtering, there is not at least one resource that matches each of the elements of `member_ids`, then an error is returned. This cannot be provided together with the `member_names` query parameter. ' style: form explode: false schema: type: array items: type: string Member_names: name: member_names in: query description: 'A comma-separated list of member names. ' style: form explode: false schema: type: array items: type: string Ids: name: ids in: query description: 'A comma-separated list of resource IDs. If after filtering, there is not at least one resource that matches each of the elements of `ids`, then an error is returned. This cannot be provided together with the `name` or `names` query parameters. ' style: form explode: false schema: type: array items: type: string Sort: name: sort in: query description: 'Sort the response by the specified fields (in descending order if ''-'' is appended to the field name). NOTE: If you provide a sort you will not get a `continuation_token` in the response. ' style: form explode: false schema: type: array items: pattern: ^[a-z]+(_[a-z]+)*-? type: string Names_required: name: names in: query description: 'A comma-separated list of resource names. ' required: true style: form explode: false schema: type: array items: type: string