openapi: 3.0.0
info:
  title: ThoughtSpot Public REST 10.1.0.cl 26.3.0.cl API
  version: '2.0'
servers:
- url: '{base-url}'
  variables:
    base-url:
      default: https://localhost:443
security:
- bearerAuth: []
tags:
- name: 26.3.0.cl
paths:
  /api/rest/2.0/security/metadata/fetch-object-privileges:
    post:
      operationId: fetchObjectPrivileges
      description: "\n <span class=\"since-beta-tag\">Version: 26.3.0.cl or later</span>\n\nThis API fetches the object privileges present for the given list of principals (user or group), on the given set of objects. It supports pagination, which can be enabled and configured using the request parameters. It provides users access to certain features based on privilege based access control.\n\n#### Usage guidelines\n\n- Specify the `type` (`USER` or `USER_GROUP`) and `identifier` (either GUID or name) of the principals for which you want to retrieve object privilege information in the `principals` array.\n- Specify the `type`  (`LOGICAL_TABLE`)  and `identifier` (either GUID or name) of the metadata objects for which you want to retrieve object privilege information in the `metadata` array. Only `LOGICAL_TABLE` metadata type is supported for now. It may be extended for other metadata types in future.\n- To control the offset from where principals have to be fetched, use `record_offset`. When `record_offset` is 0, information is fetched from the beginning.\n- To control the number of principals to be fetched, use `record_size`. Default `record_size` is 20.\n- Ensure `record_offset` for a subsequent request is one more than the value of `record_size` of the previous request.\n- Ensure using correct Authorization Bearer Token corresponding to specific user & org. \n\n#### Example request\n\n```json\n{\n  \"principals\": [\n    {\n      \"type\": \"type-1\",\n      \"identifier\": \"principal-guid-or-name-1\"\n    },\n    {\n      \"type\": \"type-2\",\n      \"identifier\": \"principal-guid-or-name-2\"\n    }\n  ],\n  \"metadata\": [\n    {\n      \"type\": \"metadata-type-1\",\n      \"identifier\": \"metadata-guid-or-name-1\"\n    },\n    {\n      \"type\": \"metadata-type-2\",\n      \"identifier\": \"metadata-guid-or-name-2\"\n    }\n  ],\n  \"record_offset\": 0,\n  \"record_size\": 20\n}\n```\n\n\n#### Response format\n\nThe API returns an array of `metadata_object_privileges` objects wrapped in JSON. Each `metadata_object_privileges` object contains:\n- Metadata information (GUID, name and type)\n- Array of `principal_object_privilege_info`.\n- Each `principal_object_privilege_info` contains:\n  - Principal type. All principals of this type are listed as described below.\n  - Array of `principal_object_privileges`.\n  - Each `principal_object_privileges` contains:\n    - Principal information (GUID, name, subtype)\n    - List of applied object level privileges.\n\n#### Example response\n\n```json\n{\n    \"metadata_object_privileges\": [\n      {\n        \"metadata_id\": \"metadata-guid-1\",\n        \"metadata_name\": \"metadata-name-1\",\n        \"metadata_type\": \"metadata-type-1\",\n        \"principal_object_privilege_info\": [\n          {\n            \"principal_type\": \"principal-type-1\",\n            \"principal_object_privileges\": [\n              {\n                \"principal_id\": \"principal-guid-1\",\n                \"principal_name\": \"principal-name-1\",\n                \"principal_sub_type\": \"principal-sub-type-1\",\n                \"object_privileges\": \"[object-privilege-1, object-privilege-2]\"\n              },\n              {\n                \"principal_id\": \"principal-guid-2\",\n                \"principal_name\": \"principal-name-2\",\n                \"principal_sub_type\": \"principal-sub-type-2\",\n                \"object_privileges\": \"[object-privilege-1, object-privilege-2]\"\n              }\n            ]\n          },\n          {\n            \"principal_type\": \"principal-type-2\",\n            \"principal_object_privileges\": [\n              {\n                \"principal_id\": \"principal-guid-3\",\n                \"principal_name\": \"principal-guid-4\",\n                \"principal_sub_type\": \"principal-sub-type-4\",\n                \"object_privileges\": \"[object-privilege-1]\"\n              }\n            ]\n          }\n        ]\n      },\n      {\n        \"metadata_id\": \"metadata-guid-2\",\n        \"metadata_name\": \"metadata-name-2\",\n        \"metadata_type\": \"metadata-type-2\",\n        \"principal_object_privilege_info\": [\n          {\n            \"principal_type\": \"principal-type-1\",\n            \"principal_object_privileges\": [\n              {\n                \"principal_id\": \"principal-guid-1\",\n                \"principal_name\": \"principal-name-1\",\n                \"principal_sub_type\": \"principal-sub-type-1\",\n                \"object_privileges\": \"[object-privilege-3, object-privilege-4]\"\n              },\n              {\n                \"principal_id\": \"principal-guid-2\",\n                \"principal_name\": \"principal-name-2\",\n                \"principal_sub_type\": \"principal-sub-type-2\",\n                \"object_privileges\": \"[object-privilege-4]\"\n              }\n            ]\n          }\n        ]\n      }\n    ]\n}\n```\n\n\n\n#### Endpoint URL\n"
      tags:
      - 26.3.0.cl
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FetchObjectPrivilegesRequest'
        required: true
      parameters: []
      responses:
        '200':
          description: Fetching defined object privileges of metadata objects is successful.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ObjectPrivilegesOfMetadataResponse'
        '400':
          description: Invalid request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized access.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden access.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /api/rest/2.0/security/metadata/manage-object-privilege:
    post:
      operationId: manageObjectPrivilege
      description: "\n <span class=\"since-beta-tag\">Version: 26.3.0.cl or later</span>\n\nThis API allows the addition or deletion of object level privileges for a set of users and groups, on a set of metadata objects. It provides users to access certain features based on privilege based access control.\n\n#### Usage guidelines\n\n- Specify the `operation`. The supported operations are: `ADD`, `REMOVE`.\n- Specify the type of the objects on which the object privileges are being provided in `metadata_type`. Only `LOGICAL_TABLE` metadata type is supported for now. It may be extended for other metadata types in future.\n- Specify the list of object privilege types in the `object_privilege_types` array. The supported object privilege types are: `SPOTTER_COACHING_PRIVILEGE`.\n- Specify the identifiers (either GUID or name) for the metadata objects in the `metadata_identifiers` array.\n- Specify the `type` (`USER` or `USER_GROUP`) and `identifier` (either GUID or name) of the principals to which you want to apply the given operation and given object privileges in the `principals` array.\n- Ensure using correct Authorization Bearer Token corresponding to specific user & org.\n\n#### Example request\n\n```json\n{\n  \"operation\": \"operation-type\",\n  \"metadata_type\": \"metadata-type\",\n  \"object_privilege_types\": [\"privilege-type-1\", \"privilege-type-2\"],\n  \"metadata_identifiers\": [\"metadata-guid-or-name-1\", \"metadata-guid-or-name-1\"],\n  \"principals\": [\n    {\n      \"type\": \"type-1\", \n      \"identifier\": \"principal-guid-or-name-1\"\n    },\n    {\n      \"type\": \"type-2\",\n      \"identifier\": \"principal-guid-or-name-2\"\n    }\n  ]\n}\n```\n\n> ###### Note:\n> * Only admin users, users with edit access and users with coaching privilege on a given data-model can add or remove principals related to SPOTTER_COACHING_PRIVILEGE  \n\n\n\n#### Endpoint URL\n"
      tags:
      - 26.3.0.cl
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ManageObjectPrivilegeRequest'
        required: true
      parameters: []
      responses:
        '204':
          description: Object privileges added/removed successfully
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized access
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden access
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    FetchObjectPrivilegesRequest:
      type: object
      properties:
        metadata:
          description: Metadata objects for which you want to fetch object privileges. For now only LOGICAL_TABLE is supported. It may be extended to other metadata types in the future.
          type: array
          items:
            $ref: '#/components/schemas/ObjectPrivilegesMetadataInput'
        principals:
          description: 'User or group objects for which you want to fetch object privileges.

            If not specified, the API returns all users and groups that

            have object privileges on the specified metadata objects.'
          type: array
          items:
            $ref: '#/components/schemas/PrincipalsInput'
        record_offset:
          description: The starting record number from where the records should be included for each metadata type.
          default: 0
          type: integer
          format: int32
        record_size:
          description: The number of records that should be included for each metadata type.
          default: 20
          type: integer
          format: int32
      required:
      - metadata
    PrincipalsInput:
      type: object
      required:
      - identifier
      properties:
        identifier:
          type: string
          description: Unique ID or name of the principal object such as a user or group.
        type:
          type: string
          enum:
          - USER
          - USER_GROUP
          description: Principal type.
          nullable: true
    ObjectPrivilegesMetadataInput:
      type: object
      required:
      - identifier
      properties:
        type:
          type: string
          enum:
          - LOGICAL_TABLE
          description: 'Type of metadata object.

            Required if the name of the object is set as the identifier. This attribute is optional when the object GUID is specified as the identifier.'
          nullable: true
        identifier:
          type: string
          description: Unique ID or name of the metadata object.
    ManageObjectPrivilegeRequest:
      type: object
      properties:
        operation:
          description: 'Operation to perform to manage object privileges. Available operations are: `ADD`, `REMOVE`.'
          type: string
          enum:
          - ADD
          - REMOVE
        metadata_type:
          description: Type of metadata objects on which you want to perform the operation. For now only LOGICAL_TABLE is supported. It may be extended to other metadata types in the future.
          type: string
          enum:
          - LOGICAL_TABLE
        object_privilege_types:
          description: List of object privilege types on which you want to perform the operation.
          type: array
          items:
            type: string
            enum:
            - SPOTTER_COACHING_PRIVILEGE
        metadata_identifiers:
          description: List of metadata identifiers (GUID or name) on which you want to perform the operation.
          type: array
          items:
            type: string
        principals:
          description: User or group objects (GUID or name) to which you want to apply the given operation and given object privileges.
          type: array
          items:
            $ref: '#/components/schemas/PrincipalsInput'
      required:
      - operation
      - metadata_type
      - object_privilege_types
      - metadata_identifiers
      - principals
    ObjectPrivilegesOfMetadataResponse:
      type: object
      properties:
        metadata_object_privileges:
          type: object
          nullable: true
    ErrorResponse:
      type: object
      properties:
        error:
          type: object
          nullable: true
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
x-roles:
- name: 26.2.0.cl
  id: 26.2.0.cl
  tags:
  - 26.2.0.cl
  description: Roles for version 26.2.0.cl
- name: 10.4.0.cl
  id: 10.4.0.cl
  tags:
  - 10.4.0.cl
  description: Roles for version 10.4.0.cl
- name: 26.7.0.cl
  id: 26.7.0.cl
  tags:
  - 26.7.0.cl
  description: Roles for version 26.7.0.cl
- name: 26.8.0.cl
  id: 26.8.0.cl
  tags:
  - 26.8.0.cl
  description: Roles for version 26.8.0.cl
- name: 26.6.0.cl
  id: 26.6.0.cl
  tags:
  - 26.6.0.cl
  description: Roles for version 26.6.0.cl
- name: 10.15.0.cl
  id: 10.15.0.cl
  tags:
  - 10.15.0.cl
  description: Roles for version 10.15.0.cl
- name: 10.13.0.cl
  id: 10.13.0.cl
  tags:
  - 10.13.0.cl
  description: Roles for version 10.13.0.cl
- name: 26.9.0.cl
  id: 26.9.0.cl
  tags:
  - 26.9.0.cl
  description: Roles for version 26.9.0.cl
- name: 10.7.0.cl
  id: 10.7.0.cl
  tags:
  - 10.7.0.cl
  description: Roles for version 10.7.0.cl
- name: 26.5.0.cl
  id: 26.5.0.cl
  tags:
  - 26.5.0.cl
  description: Roles for version 26.5.0.cl
- name: 9.0.0.cl
  id: 9.0.0.cl
  tags:
  - 9.0.0.cl
  description: Roles for version 9.0.0.cl
- name: 9.4.0.cl
  id: 9.4.0.cl
  tags:
  - 9.4.0.cl
  description: Roles for version 9.4.0.cl
- name: 9.12.0.cl
  id: 9.12.0.cl
  tags:
  - 9.12.0.cl
  description: Roles for version 9.12.0.cl
- name: 26.4.0.cl
  id: 26.4.0.cl
  tags:
  - 26.4.0.cl
  description: Roles for version 26.4.0.cl
- name: 10.12.0.cl
  id: 10.12.0.cl
  tags:
  - 10.12.0.cl
  description: Roles for version 10.12.0.cl
- name: 9.2.0.cl
  id: 9.2.0.cl
  tags:
  - 9.2.0.cl
  description: Roles for version 9.2.0.cl
- name: 9.9.0.cl
  id: 9.9.0.cl
  tags:
  - 9.9.0.cl
  description: Roles for version 9.9.0.cl
- name: 9.6.0.cl
  id: 9.6.0.cl
  tags:
  - 9.6.0.cl
  description: Roles for version 9.6.0.cl
- name: 10.10.0.cl
  id: 10.10.0.cl
  tags:
  - 10.10.0.cl
  description: Roles for version 10.10.0.cl
- name: 10.6.0.cl
  id: 10.6.0.cl
  tags:
  - 10.6.0.cl
  description: Roles for version 10.6.0.cl
- name: 10.3.0.cl
  id: 10.3.0.cl
  tags:
  - 10.3.0.cl
  description: Roles for version 10.3.0.cl
- name: 10.1.0.cl
  id: 10.1.0.cl
  tags:
  - 10.1.0.cl
  description: Roles for version 10.1.0.cl
- name: 10.9.0.cl
  id: 10.9.0.cl
  tags:
  - 10.9.0.cl
  description: Roles for version 10.9.0.cl
- name: 10.8.0.cl
  id: 10.8.0.cl
  tags:
  - 10.8.0.cl
  description: Roles for version 10.8.0.cl
- name: 9.5.0.cl
  id: 9.5.0.cl
  tags:
  - 9.5.0.cl
  description: Roles for version 9.5.0.cl
- name: 26.3.0.cl
  id: 26.3.0.cl
  tags:
  - 26.3.0.cl
  description: Roles for version 26.3.0.cl
- name: 10.14.0.cl
  id: 10.14.0.cl
  tags:
  - 10.14.0.cl
  description: Roles for version 10.14.0.cl
- name: 9.7.0.cl
  id: 9.7.0.cl
  tags:
  - 9.7.0.cl
  description: Roles for version 9.7.0.cl