openapi: 3.0.0
info:
  title: API Reference AlertService DeploymentService API
  version: '1'
  description: API reference for the StackRox Kubernetes Security Platform (upstream of Red Hat Advanced Cluster Security). Provides risk analysis, visibility, runtime alerts, policy management, compliance checking, and vulnerability management for containerized workloads. Authentication uses API tokens generated via /v1/apitokens/generate and passed as Bearer tokens.
  contact:
    email: support@stackrox.com
    url: https://www.stackrox.io/
  license:
    name: All Rights Reserved
    url: https://www.stackrox.com/
servers:
- url: https://{central-host}
  description: StackRox Central API server
  variables:
    central-host:
      default: stackrox.localhost
      description: StackRox Central hostname or IP
security:
- ApiToken: []
tags:
- name: DeploymentService
paths:
  /v1/deployments:
    get:
      summary: ListDeployments returns the list of deployments.
      operationId: ListDeployments
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1ListDeploymentsResponse'
      parameters:
      - name: query
        in: query
        required: false
        schema:
          type: string
      - name: pagination.limit
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.offset
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.sort_option.field
        in: query
        required: false
        schema:
          type: string
      - name: pagination.sort_option.reversed
        in: query
        required: false
        schema:
          type: boolean
          format: boolean
      tags:
      - DeploymentService
  /v1/deployments/metadata/labels:
    get:
      summary: GetLabels returns the labels used by deployments.
      operationId: GetLabels
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1DeploymentLabelsResponse'
      tags:
      - DeploymentService
  /v1/deployments/{id}:
    get:
      summary: GetDeployment returns a deployment given its ID.
      operationId: GetDeployment
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/storageDeployment'
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      tags:
      - DeploymentService
  /v1/deploymentscount:
    get:
      summary: CountDeployments returns the list of deployments.
      operationId: CountDeployments
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1CountDeploymentsResponse'
      parameters:
      - name: query
        in: query
        required: false
        schema:
          type: string
      - name: pagination.limit
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.offset
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.sort_option.field
        in: query
        required: false
        schema:
          type: string
      - name: pagination.sort_option.reversed
        in: query
        required: false
        schema:
          type: boolean
          format: boolean
      tags:
      - DeploymentService
  /v1/deploymentswithprocessinfo:
    get:
      summary: ListDeploymentsWithProcessInfo returns the list of deployments with process information.
      operationId: ListDeploymentsWithProcessInfo
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1ListDeploymentsWithProcessInfoResponse'
      parameters:
      - name: query
        in: query
        required: false
        schema:
          type: string
      - name: pagination.limit
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.offset
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.sort_option.field
        in: query
        required: false
        schema:
          type: string
      - name: pagination.sort_option.reversed
        in: query
        required: false
        schema:
          type: boolean
          format: boolean
      tags:
      - DeploymentService
  /v1/deploymentswithrisk/{id}:
    get:
      summary: GetDeploymentWithRisk returns a deployment and its risk given its ID.
      operationId: GetDeploymentWithRisk
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1GetDeploymentWithRiskResponse'
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      tags:
      - DeploymentService
components:
  schemas:
    ListDeploymentsWithProcessInfoResponseDeploymentWithProcessInfo:
      type: object
      properties:
        deployment:
          $ref: '#/components/schemas/storageListDeployment'
        whitelistStatuses:
          type: array
          items:
            $ref: '#/components/schemas/storageContainerNameAndWhitelistStatus'
    SecurityContextSELinux:
      type: object
      properties:
        user:
          type: string
        role:
          type: string
        type:
          type: string
        level:
          type: string
    v1ListDeploymentsResponse:
      type: object
      properties:
        deployments:
          type: array
          items:
            $ref: '#/components/schemas/storageListDeployment'
    storageImageName:
      type: object
      properties:
        registry:
          type: string
        remote:
          type: string
        tag:
          type: string
        fullName:
          type: string
    DeploymentLabelsResponseLabelValues:
      type: object
      properties:
        values:
          type: array
          items:
            type: string
    storageEmbeddedSecret:
      type: object
      properties:
        name:
          type: string
        path:
          type: string
    v1DeploymentLabelsResponse:
      type: object
      properties:
        labels:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/DeploymentLabelsResponseLabelValues'
        values:
          type: array
          items:
            type: string
    storagePortConfig:
      type: object
      properties:
        name:
          type: string
        containerPort:
          type: integer
          format: int32
        protocol:
          type: string
        exposure:
          $ref: '#/components/schemas/PortConfigExposureLevel'
        exposedPort:
          type: integer
          format: int32
        exposureInfos:
          type: array
          items:
            $ref: '#/components/schemas/PortConfigExposureInfo'
      title: 'Next Available Tag: 6'
    storageContainerInstance:
      type: object
      properties:
        instanceId:
          $ref: '#/components/schemas/storageContainerInstanceID'
        containingPodId:
          type: string
          description: The pod containing this container instance (kubernetes only).
        containerIps:
          type: array
          items:
            type: string
          description: The IP addresses of this container.
        started:
          type: string
          format: date-time
          title: The start time of the container
      description: ContainerInstanceID allows to uniquely identify a container within a cluster.
    EnvironmentConfigEnvVarSource:
      type: string
      enum:
      - UNSET
      - RAW
      - SECRET_KEY
      - CONFIG_MAP_KEY
      - FIELD
      - RESOURCE_FIELD
      - UNKNOWN
      default: UNSET
      title: For any update to EnvVarSource, please also update 'ui/src/messages/common.js'
    storageRiskResult:
      type: object
      properties:
        name:
          type: string
        factors:
          type: array
          items:
            $ref: '#/components/schemas/ResultFactor'
        score:
          type: number
          format: float
    storageRiskSubject:
      type: object
      properties:
        id:
          type: string
        namespace:
          type: string
        clusterId:
          type: string
        type:
          $ref: '#/components/schemas/storageRiskSubjectType'
    storageTolerationOperator:
      type: string
      enum:
      - TOLERATION_OPERATION_UNKNOWN
      - TOLERATION_OPERATOR_EXISTS
      - TOLERATION_OPERATOR_EQUAL
      default: TOLERATION_OPERATION_UNKNOWN
    storageContainerInstanceID:
      type: object
      properties:
        containerRuntime:
          $ref: '#/components/schemas/storageContainerRuntime'
        id:
          type: string
          description: The ID of the container, specific to the given runtime.
        node:
          type: string
          description: The node on which this container runs.
    storageContainerNameAndWhitelistStatus:
      type: object
      properties:
        containerName:
          type: string
        whitelistStatus:
          $ref: '#/components/schemas/ContainerNameAndWhitelistStatusWhitelistStatus'
        anomalousProcessesExecuted:
          type: boolean
          format: boolean
      description: ContainerNameAndWhitelistStatus represents a cached result of process evaluation on a specific container name.
    PortConfigExposureInfo:
      type: object
      properties:
        level:
          $ref: '#/components/schemas/PortConfigExposureLevel'
        serviceName:
          type: string
          title: only set if level is not HOST
        serviceId:
          type: string
        serviceClusterIp:
          type: string
        servicePort:
          type: integer
          format: int32
        nodePort:
          type: integer
          format: int32
          title: only set if level is HOST, NODE, or EXTERNAL
        externalIps:
          type: array
          items:
            type: string
          title: only set if level is EXTERNAL
        externalHostnames:
          type: array
          items:
            type: string
    storageContainer:
      type: object
      properties:
        id:
          type: string
        config:
          $ref: '#/components/schemas/storageContainerConfig'
        image:
          $ref: '#/components/schemas/storageContainerImage'
        securityContext:
          $ref: '#/components/schemas/storageSecurityContext'
        volumes:
          type: array
          items:
            $ref: '#/components/schemas/storageVolume'
        ports:
          type: array
          items:
            $ref: '#/components/schemas/storagePortConfig'
        secrets:
          type: array
          items:
            $ref: '#/components/schemas/storageEmbeddedSecret'
        resources:
          $ref: '#/components/schemas/storageResources'
        instances:
          type: array
          items:
            $ref: '#/components/schemas/storageContainerInstance'
        name:
          type: string
    storageResources:
      type: object
      properties:
        cpuCoresRequest:
          type: number
          format: float
        cpuCoresLimit:
          type: number
          format: float
        memoryMbRequest:
          type: number
          format: float
        memoryMbLimit:
          type: number
          format: float
    LabelSelectorRequirement:
      type: object
      properties:
        key:
          type: string
        op:
          $ref: '#/components/schemas/storageLabelSelectorOperator'
        values:
          type: array
          items:
            type: string
      title: 'Next available tag: 4'
    storageSecurityContext:
      type: object
      properties:
        privileged:
          type: boolean
          format: boolean
        selinux:
          $ref: '#/components/schemas/SecurityContextSELinux'
        dropCapabilities:
          type: array
          items:
            type: string
        addCapabilities:
          type: array
          items:
            type: string
        readOnlyRootFilesystem:
          type: boolean
          format: boolean
    storageVolume:
      type: object
      properties:
        name:
          type: string
        source:
          type: string
        destination:
          type: string
        readOnly:
          type: boolean
          format: boolean
        type:
          type: string
    storageContainerRuntime:
      type: string
      enum:
      - UNKNOWN_CONTAINER_RUNTIME
      - DOCKER_CONTAINER_RUNTIME
      - CRIO_CONTAINER_RUNTIME
      default: UNKNOWN_CONTAINER_RUNTIME
    PortConfigExposureLevel:
      type: string
      enum:
      - UNSET
      - EXTERNAL
      - NODE
      - INTERNAL
      - HOST
      default: UNSET
    ResultFactor:
      type: object
      properties:
        message:
          type: string
        url:
          type: string
    v1ListDeploymentsWithProcessInfoResponse:
      type: object
      properties:
        deployments:
          type: array
          items:
            $ref: '#/components/schemas/ListDeploymentsWithProcessInfoResponseDeploymentWithProcessInfo'
    ContainerConfigEnvironmentConfig:
      type: object
      properties:
        key:
          type: string
        value:
          type: string
        envVarSource:
          $ref: '#/components/schemas/EnvironmentConfigEnvVarSource'
    ContainerNameAndWhitelistStatusWhitelistStatus:
      type: string
      enum:
      - INVALID
      - NOT_GENERATED
      - UNLOCKED
      - LOCKED
      default: INVALID
    storageContainerConfig:
      type: object
      properties:
        env:
          type: array
          items:
            $ref: '#/components/schemas/ContainerConfigEnvironmentConfig'
        command:
          type: array
          items:
            type: string
        args:
          type: array
          items:
            type: string
        directory:
          type: string
        user:
          type: string
        uid:
          type: string
          format: int64
    storageListDeployment:
      type: object
      properties:
        id:
          type: string
        hash:
          type: string
          format: uint64
        name:
          type: string
        cluster:
          type: string
        clusterId:
          type: string
        namespace:
          type: string
        created:
          type: string
          format: date-time
        priority:
          type: string
          format: int64
      title: 'Next available tag: 9'
    storageToleration:
      type: object
      properties:
        key:
          type: string
        operator:
          $ref: '#/components/schemas/storageTolerationOperator'
        value:
          type: string
        taintEffect:
          $ref: '#/components/schemas/storageTaintEffect'
    v1GetDeploymentWithRiskResponse:
      type: object
      properties:
        deployment:
          $ref: '#/components/schemas/storageDeployment'
        risk:
          $ref: '#/components/schemas/storageRisk'
    storageRisk:
      type: object
      properties:
        id:
          type: string
        subject:
          $ref: '#/components/schemas/storageRiskSubject'
        score:
          type: number
          format: float
        results:
          type: array
          items:
            $ref: '#/components/schemas/storageRiskResult'
    storageRiskSubjectType:
      type: string
      enum:
      - UNKNOWN
      - DEPLOYMENT
      - NAMESPACE
      - CLUSTER
      - IMAGE
      - IMAGE_COMPONENT
      - SERVICEACCOUNT
      default: UNKNOWN
    v1CountDeploymentsResponse:
      type: object
      properties:
        count:
          type: integer
          format: int32
    storageLabelSelectorOperator:
      type: string
      enum:
      - UNKNOWN
      - IN
      - NOT_IN
      - EXISTS
      - NOT_EXISTS
      default: UNKNOWN
    storageTaintEffect:
      type: string
      enum:
      - UNKNOWN_TAINT_EFFECT
      - NO_SCHEDULE_TAINT_EFFECT
      - PREFER_NO_SCHEDULE_TAINT_EFFECT
      - NO_EXECUTE_TAINT_EFFECT
      default: UNKNOWN_TAINT_EFFECT
    storageLabelSelector:
      type: object
      properties:
        matchLabels:
          type: object
          additionalProperties:
            type: string
          description: This is actually a oneof, but we can't make it one due to backwards compatibility constraints.
        requirements:
          type: array
          items:
            $ref: '#/components/schemas/LabelSelectorRequirement'
      title: 'Next available tag: 3'
    storageContainerImage:
      type: object
      properties:
        id:
          type: string
          title: These tags maintain backwards compatibiltiy with the previously embedded storage.Image
        name:
          $ref: '#/components/schemas/storageImageName'
        notPullable:
          type: boolean
          format: boolean
    storageDeployment:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        hash:
          type: string
          format: uint64
        type:
          type: string
        namespace:
          type: string
        namespaceId:
          type: string
        replicas:
          type: string
          format: int64
        labels:
          type: object
          additionalProperties:
            type: string
        podLabels:
          type: object
          additionalProperties:
            type: string
        labelSelector:
          $ref: '#/components/schemas/storageLabelSelector'
        created:
          type: string
          format: date-time
        clusterId:
          type: string
        clusterName:
          type: string
        containers:
          type: array
          items:
            $ref: '#/components/schemas/storageContainer'
        annotations:
          type: object
          additionalProperties:
            type: string
        priority:
          type: string
          format: int64
        inactive:
          type: boolean
          format: boolean
        imagePullSecrets:
          type: array
          items:
            type: string
        serviceAccount:
          type: string
        automountServiceAccountToken:
          type: boolean
          format: boolean
        hostNetwork:
          type: boolean
          format: boolean
        tolerations:
          type: array
          items:
            $ref: '#/components/schemas/storageToleration'
        ports:
          type: array
          items:
            $ref: '#/components/schemas/storagePortConfig'
        stateTimestamp:
          type: string
          format: int64
      title: 'Next available tag: 28'
  securitySchemes:
    ApiToken:
      type: apiKey
      in: header
      name: Authorization
      description: 'StackRox API token. Format: Bearer {token}'