{ "opencollection": "1.0.0", "info": { "name": "@weka-api Active Directory Security API", "version": "5.1" }, "request": { "auth": { "type": "bearer", "token": "{{bearerToken}}" } }, "items": [ { "info": { "name": "Security", "type": "folder" }, "items": [ { "info": { "name": "Get token expiration configuration", "type": "http" }, "http": { "method": "GET", "url": "/api/v2/security/defaultTokensExpiry" }, "docs": "Returns the configured default and maximum expiration times for access and refresh tokens. Token expiration ensures authentication credentials remain valid for a limited time, reducing risks such as unauthorized access and token misuse." }, { "info": { "name": "Configure token expiration settings", "type": "http" }, "http": { "method": "POST", "url": "/api/v2/security/defaultTokensExpiry", "body": { "type": "json", "data": "{}" } }, "docs": "Configures the default and maximum expiration times for access and refresh tokens to maintain a secure, policy-aligned authentication environment. Best practices recommend setting access tokens to 5 minutes and refresh tokens to 2 weeks to balance security and usability." }, { "info": { "name": "Get login banner configuration", "type": "http" }, "http": { "method": "GET", "url": "/api/v2/security/banner" }, "docs": "Returns the current login banner text and enabled status. The login banner displays a customizable legal or security message on the GUI sign-in page to warn against unauthorized access and inform authorized users of their responsibilities and acceptable use policies." }, { "info": { "name": "Set or update the login banner", "type": "http" }, "http": { "method": "PUT", "url": "/api/v2/security/banner", "body": { "type": "json", "data": "{}" } }, "docs": "Creates or modifies the login banner containing a security statement or legal message displayed on the sign-in page. The statement can warn potential intruders about illegal activities while advising authorized users of their obligations regarding acceptable system use." }, { "info": { "name": "Enable the login banner", "type": "http" }, "http": { "method": "POST", "url": "/api/v2/security/banner/enable" }, "docs": "Activates the login banner so it displays on the GUI sign-in page, presenting the configured security or legal message to all users attempting to access the system." }, { "info": { "name": "Disable the login banner", "type": "http" }, "http": { "method": "POST", "url": "/api/v2/security/banner/disable" }, "docs": "Deactivates the login banner so it no longer displays on the GUI sign-in page. The banner text is preserved and can be re-enabled at any time." }, { "info": { "name": "Get token expiration times (deprecated)", "type": "http" }, "http": { "method": "GET", "url": "/api/v2/security/tokensExpiry" }, "docs": "This endpoint is deprecated. Use /security/defaultTokensExpiry instead." }, { "info": { "name": "Get cluster join token", "type": "http" }, "http": { "method": "POST", "url": "/api/v2/security/joinToken", "body": { "type": "json", "data": "{}" } }, "docs": "Get a cluster join token, used by clients to join the cluster." }, { "info": { "name": "Get CA certificate details and status", "type": "http" }, "http": { "method": "GET", "url": "/api/v2/security/caCert" }, "docs": "Returns comprehensive information about the cluster's currently configured CA certificate, including its status, certificate metadata, and content. Use this endpoint to verify certificate configuration and expiration dates." }, { "info": { "name": "Upload custom CA certificate for cluster authentication", "type": "http" }, "http": { "method": "PUT", "url": "/api/v2/security/caCert", "body": { "type": "json", "data": "{}" } }, "docs": "Uploads a custom Certificate Authority (CA) certificate to be used for secure cluster authentication with external services such as Vault. This certificate enables the cluster to verify the identity of external systems using TLS/SSL. If a certificate is already configured, this operation replaces it." }, { "info": { "name": "Remove custom CA certificate from cluster", "type": "http" }, "http": { "method": "DELETE", "url": "/api/v2/security/caCert" }, "docs": "Removes the configured custom CA certificate from the cluster. After removal, the cluster will revert to using the default certificate validation mechanism." }, { "info": { "name": "List all security policies", "type": "http" }, "http": { "method": "GET", "url": "/api/v2/security/policies" }, "docs": "Returns a comprehensive list of all CIDR-based security policies defined in the cluster. These policies control access to cluster management and POSIX data services based on client IP ranges." }, { "info": { "name": "Create a CIDR-based security policy", "type": "http" }, "http": { "method": "POST", "url": "/api/v2/security/policies", "body": { "type": "json", "data": "{}" } }, "docs": "Creates a new security policy to regulate access to cluster management and POSIX data services. These policies strengthen security by permitting or blocking connections from specific client IP address ranges without requiring user authentication. Policies are evaluated in order of attachment, and updates do not affect active connections." }, { "info": { "name": "Get a specific security policy", "type": "http" }, "http": { "method": "GET", "url": "/api/v2/security/policies/:policy", "params": [ { "name": "policy", "value": "", "type": "path", "description": "Unique identifier (UUID) of the security policy to retrieve." } ] }, "docs": "Returns detailed configuration information for a specific security policy identified by its UUID. This includes the policy's name, description, action, roles, IP ranges, and read-only status." }, { "info": { "name": "Update an existing security policy", "type": "http" }, "http": { "method": "PATCH", "url": "/api/v2/security/policies/:policy", "params": [ { "name": "policy", "value": "", "type": "path", "description": "Unique identifier (UUID) of the security policy to update." } ], "body": { "type": "json", "data": "{}" } }, "docs": "Modifies the configuration of an existing security policy. You can replace entire role or IP lists, or incrementally add/remove specific entries. Changes take effect immediately for new connections but do not impact existing active sessions." }, { "info": { "name": "Delete a security policy", "type": "http" }, "http": { "method": "DELETE", "url": "/api/v2/security/policies/:policy", "params": [ { "name": "policy", "value": "", "type": "path", "description": "Unique identifier (UUID) of the security policy to delete." } ] }, "docs": "Permanently removes a security policy from the system. This operation does not affect currently active connections. The policy will no longer be evaluated for new connection attempts." }, { "info": { "name": "Duplicate an existing security policy", "type": "http" }, "http": { "method": "POST", "url": "/api/v2/security/policies/:policy/duplicate", "params": [ { "name": "policy", "value": "", "type": "path", "description": "Unique identifier (UUID) of the security policy to duplicate." } ], "body": { "type": "json", "data": "{}" } }, "docs": "Creates a new security policy by copying all configuration settings from an existing policy. The new policy requires a unique name but inherits all other properties including description, action, roles, IP ranges, and read-only status." }, { "info": { "name": "Test security policy evaluation", "type": "http" }, "http": { "method": "GET", "url": "/api/v2/security/policies/test", "params": [ { "name": "policies", "value": "", "type": "query", "description": "List of security policy UUIDs to evaluate in the test." }, { "name": "ip", "value": "", "type": "query", "description": "IP address to simulate the connection from (IPv4 or IPv6)." }, { "name": "role", "value": "", "type": "query", "description": "User role to simulate for API access evaluation." }, { "name": "join", "value": "", "type": "query", "description": "When true, simulates a cluster join scenario instead of API access." } ] }, "docs": "Simulates how one or more security policies would evaluate a connection attempt for API access or cluster joining. Returns the resulting action (Allow/Deny), whether it was explicitly matched, and details of the matched policy. Use this endpoint to validate policy configurations before deployment." }, { "info": { "name": "Get security policies for cluster joining", "type": "http" }, "http": { "method": "GET", "url": "/api/v2/security/join/:mode/securityPolicy", "params": [ { "name": "mode", "value": "", "type": "path", "description": "Cluster join mode - backend for server containers, client for POSIX clients." } ] }, "docs": "Returns the list of security policies currently applied when containers or clients attempt to join the cluster for the specified mode. These policies work in conjunction with join secret authentication to secure cluster membership." }, { "info": { "name": "Set cluster join security policies", "type": "http" }, "http": { "method": "PUT", "url": "/api/v2/security/join/:mode/securityPolicy", "params": [ { "name": "mode", "value": "", "type": "path", "description": "Cluster join mode - backend for server containers, client for POSIX clients." } ], "body": { "type": "json", "data": "{}" } }, "docs": "Configures the complete set of security policies for containers or clients joining the cluster, replacing any existing policy configuration. These policies are evaluated to determine whether a join attempt from a specific IP address should be allowed or denied. Works in conjunction with join secret authentication." }, { "info": { "name": "Remove all security policies from cluster join configuration", "type": "http" }, "http": { "method": "DELETE", "url": "/api/v2/security/join/:mode/securityPolicy", "params": [ { "name": "mode", "value": "", "type": "path", "description": "Cluster join mode - backend for server containers, client for POSIX clients." } ] }, "docs": "Removes all security policies currently applied to the cluster join process for the specified mode (backend or client). This allows any container to join the cluster without IP-based security policy restrictions. The join secret authentication, if configured, remains active." }, { "info": { "name": "Attach security policies to cluster join configuration", "type": "http" }, "http": { "method": "POST", "url": "/api/v2/security/join/:mode/securityPolicy/attach", "params": [ { "name": "mode", "value": "", "type": "path", "description": "Cluster join mode - backend for server containers, client for POSIX clients." } ], "body": { "type": "json", "data": "{}" } }, "docs": "Adds one or more security policies to the existing list of policies applied during cluster joining for the specified mode. The new policies are appended to the end of the evaluation order. Use this endpoint to incrementally build up join security without replacing the entire policy set." }, { "info": { "name": "Detach security policies from cluster join configuration", "type": "http" }, "http": { "method": "POST", "url": "/api/v2/security/join/:mode/securityPolicy/detach", "params": [ { "name": "mode", "value": "", "type": "path", "description": "Cluster join mode - backend for server containers, client for POSIX clients." } ], "body": { "type": "json", "data": "{}" } }, "docs": "Removes specific security policies from the list of policies applied during cluster joining for the specified mode. Other policies in the join configuration remain active and continue to be evaluated in their original order." }, { "info": { "name": "Get GUI idle timeout configuration", "type": "http" }, "http": { "method": "GET", "url": "/api/v2/security/guiIdleTimeout" }, "docs": "Returns the currently configured idle timeout duration for the graphical user interface. The GUI idle timeout automatically logs out users after a specified period of inactivity, reducing the risk of unauthorized access from unattended sessions." }, { "info": { "name": "Configure GUI idle timeout", "type": "http" }, "http": { "method": "PUT", "url": "/api/v2/security/guiIdleTimeout", "body": { "type": "json", "data": "{}" } }, "docs": "Sets the duration after which inactive GUI sessions are automatically terminated. This security feature helps protect against unauthorized access by logging out users who leave their sessions unattended. The timeout value must be between 60 seconds (1 minute) and 86400 seconds (24 hours)." }, { "info": { "name": "Reset GUI idle timeout to default", "type": "http" }, "http": { "method": "DELETE", "url": "/api/v2/security/guiIdleTimeout" }, "docs": "Restores the GUI idle timeout setting to its default system value, removing any custom configuration. This returns the timeout duration to the standard recommended setting for automatic session termination." } ] } ], "bundled": true }