openapi: 3.2.0
info:
  title: Palette APIs - 4.9 Datasinks API
  version: v1
servers:
- url: https://api.spectrocloud.com
tags:
- name: Data Sinks
  x-displayName: Datasinks
paths:
  /v1/datasinks/cloudwatch:
    post:
      description: Sync data to cloud watch
      operationId: V1DataSinksCloudWatchSink
      parameters:
      - description: A project UID is required for project-scoped resources and should be omitted when targeting tenant-scoped resources
        in: header
        name: ProjectUid
        schema:
          type: string
      responses:
        '204':
          description: Ok response without content
          headers:
            AuditUid:
              description: Audit uid for the request
              schema:
                type: string
      security:
      - ApiKey: []
      - Authorization: []
      summary: sync data to cloud watch
      tags:
      - Data Sinks
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v1.DataSinkCloudWatchConfig'
        description: Request payload for cloud watch config
        required: true
components:
  schemas:
    v1AwsCloudAccountCredentialType:
      default: secret
      description: Allowed Values [secret, sts, pod-identity]. STS type will be used for role assumption for sts type, accessKey/secretKey contains the source account, Arn is the target account. Pod Identity type will be used for EKS Pod Identity authentication with roleArn as the target account.
      enum:
      - secret
      - sts
      - pod-identity
      type: string
    v1AwsSecretSpec:
      description: AWS cloud account which includes access key and secret key in case of 'secret' credentials type. It includes policyARNS, ARN and externalId in case of sts. Partition is a group of AWS Region and Service objects
      properties:
        accountName:
          description: AWS secret accountName; only for aws-iso-b environment
          type: string
        agency:
          description: AWS secret agency
          type: string
        isCapValidationEnabled:
          description: Flag to rotate the secret region credentials
          type: boolean
        mission:
          description: AWS secret mission; only for aws-iso environment
          type: string
        namePrefix:
          description: Policy Boundary
          type: string
        permissionBoundary:
          description: Role or Policy Prefix
          type: string
        policy:
          description: AWS secret policy; JSON string
          type: string
        role:
          description: AWS secret role
          type: string
        tls:
          $ref: '#/components/schemas/v1AwsSecretTlsConfig'
          description: TLS configuration for the AWS secret
      type: object
    v1Time:
      description: Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON.  Wrappers are provided for many of the factory methods that the time package offers.
      format: date-time
      type: string
    v1.DataSinkCloudWatchConfig:
      description: Data sink cloud watch config
      properties:
        payload:
          $ref: '#/components/schemas/v1.DataSinkPayloads'
        spec:
          $ref: '#/components/schemas/v1.CloudWatchConfig'
      type: object
    v1AwsSecretTlsConfig:
      description: TLS configuration for the AWS secret
      properties:
        ca:
          description: CA certificate
          type: string
        cert:
          description: Certificate
          type: string
        key:
          description: Key
          type: string
      type: object
    v1AwsPodIdentityCredentials:
      description: AWS EKS Pod Identity credentials for role assumption
      properties:
        permissionBoundaryArn:
          description: Optional Permission Boundary ARN to limit the maximum permissions for roles created by Hubble
          type: string
        roleArn:
          description: IAM Role ARN for the AWS EKS Pod Identity in cloud account
          type: string
      type: object
    v1AwsCloudAccount:
      description: AWS cloud account which includes access key and secret key in case of 'secret' credentials type. It includes policyARNS, ARN and externalId in case of sts. It includes roleArn and permissionBoundaryArn in case of podIdentity. Partition is a group of AWS Region and Service objects
      properties:
        accessKey:
          description: AWS account access key
          type: string
        credentialType:
          $ref: '#/components/schemas/v1AwsCloudAccountCredentialType'
        partition:
          default: aws
          description: AWS accounts are scoped to a single partition. Allowed values [aws, aws-us-gov], Default values
          enum:
          - aws
          - aws-us-gov
          - aws-iso
          - aws-iso-b
          type: string
        podIdentity:
          $ref: '#/components/schemas/v1AwsPodIdentityCredentials'
          description: AWS EKS Pod Identity credentials in case of credentialType podIdentity, will be empty in case of other credential types
        policyARNs:
          description: List of policy ARNs required in case of credentialType sts.
          items:
            type: string
          type: array
        secretKey:
          description: AWS account secret key
          type: string
        secretSpec:
          $ref: '#/components/schemas/v1AwsSecretSpec'
        secretToken:
          description: AWS account secret token; in case of aws-iso and aws-iso-b
          type: string
        sts:
          $ref: '#/components/schemas/v1AwsStsCredentials'
          description: AWS STS credentials in case of credentialType sts, will be empty in case of credential type secret
      type: object
    v1AwsStsCredentials:
      description: Aws sts credentials
      properties:
        arn:
          description: Arn for the aws sts credentials in cloud account
          type: string
        externalId:
          description: ExternalId for the aws sts credentials in cloud account
          type: string
      type: object
    v1.DataSinkPayload:
      additionalProperties:
        type: object
      description: Data sink payload entity
      properties:
        refUid:
          description: RefUid of the data sink payload
          type: string
        timestamp:
          $ref: '#/components/schemas/v1Time'
      type: object
    v1.CloudWatchConfig:
      description: Cloud watch config entity
      properties:
        credentials:
          $ref: '#/components/schemas/v1AwsCloudAccount'
        group:
          description: Name of the group
          type: string
        region:
          description: Name of the region
          type: string
        stream:
          description: Name of the stream
          type: string
      type: object
    v1.DataSinkPayloads:
      description: List of data sink payload entities
      items:
        $ref: '#/components/schemas/v1.DataSinkPayload'
      type: array
      uniqueItems: true
  securitySchemes:
    ApiKey:
      description: API key authorization where API key can be generated from Palette console under Profile > My API Keys
      in: header
      name: ApiKey
      type: apiKey
    Authorization:
      description: JWT token authorization obtained using /v1/auth/authenticate api
      in: header
      name: Authorization
      type: apiKey