openapi: 3.2.0
info:
  contact:
    name: https://docs.yugabyte.com
  description: ALPHA - NOT FOR EXTERNAL USE
  license:
    name: Polyform Free Trial License 1.0.0
    url: https://github.com/yugabyte/yugabyte-db/blob/master/licenses/POLYFORM-FREE-TRIAL-LICENSE-1.0.0.txt
  termsOfService: TODO(chirag)
  title: YugabyteDB Anywhere RBAC management API
  version: v1
servers:
- url: /
tags:
- name: RBAC management
paths:
  /api/v1/customers/{cUUID}/rbac/permissions:
    get:
      description: 'WARNING: This is a preview API that could change.'
      operationId: listPermissions
      parameters:
      - in: path
        name: cUUID
        required: true
        schema:
          format: uuid
          type: string
      - description: Optional resource type to filter permission list
        in: query
        name: resourceType
        schema:
          default: 'null'
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/PermissionInfo'
                type: array
          description: successful operation
      security:
      - apiKeyAuth: []
      summary: List all the permissions available
      tags:
      - RBAC management
  /api/v1/customers/{cUUID}/rbac/role:
    get:
      description: 'WARNING: This is a preview API that could change.'
      operationId: listRoles
      parameters:
      - in: path
        name: cUUID
        required: true
        schema:
          format: uuid
          type: string
      - description: Optional role type to filter roles list
        in: query
        name: roleType
        schema:
          default: 'null'
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/Role'
                type: array
          description: successful operation
      security:
      - apiKeyAuth: []
      summary: List all the roles available
      tags:
      - RBAC management
    post:
      description: 'WARNING: This is a preview API that could change.'
      operationId: createRole
      parameters:
      - in: path
        name: cUUID
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: request
        schema: {}
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleFormData'
        description: create role form data
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
          description: successful operation
      security:
      - apiKeyAuth: []
      summary: Create a custom role
      tags:
      - RBAC management
      x-codegen-request-body-name: RoleFormData
  /api/v1/customers/{cUUID}/rbac/role/{rUUID}:
    delete:
      description: 'WARNING: This is a preview API that could change.'
      operationId: deleteRole
      parameters:
      - in: path
        name: cUUID
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: rUUID
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: request
        schema: {}
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/YBPSuccess'
          description: successful operation
      security:
      - apiKeyAuth: []
      summary: Delete a custom role
      tags:
      - RBAC management
    get:
      description: 'WARNING: This is a preview API that could change.'
      operationId: getRole
      parameters:
      - in: path
        name: cUUID
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: rUUID
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
          description: successful operation
      security:
      - apiKeyAuth: []
      summary: Get a role's information
      tags:
      - RBAC management
    put:
      description: 'WARNING: This is a preview API that could change.'
      operationId: editRole
      parameters:
      - in: path
        name: cUUID
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: rUUID
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: request
        schema: {}
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleFormData'
        description: edit role form data
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
          description: successful operation
      security:
      - apiKeyAuth: []
      summary: Edit a custom role
      tags:
      - RBAC management
      x-codegen-request-body-name: RoleFormData
  /api/v1/customers/{cUUID}/rbac/role_binding:
    get:
      description: 'WARNING: This is a preview API that could change.'
      operationId: getRoleBindings
      parameters:
      - in: path
        name: cUUID
        required: true
        schema:
          format: uuid
          type: string
      - description: Optional user UUID to filter role binding map
        in: query
        name: userUUID
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                additionalProperties:
                  $ref: '#/components/schemas/RoleBinding'
                type: object
          description: successful operation
      security:
      - apiKeyAuth: []
      summary: Get all the role bindings available
      tags:
      - RBAC management
  /api/v1/customers/{cUUID}/rbac/role_binding/{userUUID}:
    post:
      description: 'WARNING: This is a preview API that could change.'
      operationId: setRoleBinding
      parameters:
      - in: path
        name: cUUID
        required: true
        schema:
          format: uuid
          type: string
      - in: path
        name: userUUID
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: request
        schema: {}
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleBindingFormData'
        description: set role bindings form data
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/RoleBinding'
                type: array
          description: successful operation
      security:
      - apiKeyAuth: []
      summary: Set the role bindings of a user
      tags:
      - RBAC management
      x-codegen-request-body-name: RoleBindingFormData
components:
  schemas:
    RoleResourceDefinition:
      description: Defines the association of Role to Resource Groups.
      example:
        resourceGroup:
          resourceDefinitionSet:
          - allowAll: true
            resourceUUIDSet:
            - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
            - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
            resourceType: UNIVERSE
          - allowAll: true
            resourceUUIDSet:
            - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
            - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
            resourceType: UNIVERSE
        roleUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
      properties:
        resourceGroup:
          $ref: '#/components/schemas/ResourceGroup'
        roleUUID:
          description: UUID of the role to attach resource group to.
          format: uuid
          type: string
      required:
      - roleUUID
      type: object
    Permission:
      example:
        action: CREATE
        resourceType: UNIVERSE
      properties:
        action:
          enum:
          - CREATE
          - READ
          - UPDATE
          - DELETE
          - PAUSE_RESUME
          - BACKUP_RESTORE
          - UPDATE_ROLE_BINDINGS
          - UPDATE_PROFILE
          - SUPER_ADMIN_ACTIONS
          - XCLUSTER
          - DEBUG
          - TROUBLESHOOT
          type: string
        resourceType:
          enum:
          - UNIVERSE
          - ROLE
          - USER
          - OTHER
          type: string
      type: object
    ResourceDefinition:
      example:
        allowAll: true
        resourceUUIDSet:
        - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        resourceType: UNIVERSE
      properties:
        allowAll:
          description: Select all resources (including future resources)
          type: boolean
        resourceType:
          description: Resource Type
          enum:
          - UNIVERSE
          - ROLE
          - USER
          - OTHER
          type: string
        resourceUUIDSet:
          description: Set of resource uuids
          items:
            format: uuid
            type: string
          type: array
          uniqueItems: true
      type: object
    Principal:
      example:
        groupUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        userUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        type: USER
        uuid: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
      properties:
        groupUUID:
          format: uuid
          type: string
        type:
          enum:
          - USER
          - LDAP_GROUP
          - OIDC_GROUP
          type: string
        userUUID:
          format: uuid
          type: string
        uuid:
          format: uuid
          type: string
      required:
      - groupUUID
      - type
      - userUUID
      - uuid
      type: object
    Role:
      example:
        customerUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        permissionDetails:
          permissionList:
          - action: CREATE
            resourceType: UNIVERSE
          - action: CREATE
            resourceType: UNIVERSE
        name: name
        description: description
        updatedOn: 2022-12-12 13:07:18+00:00
        roleType: System
        createdOn: 2022-12-12 13:07:18+00:00
        roleUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
      properties:
        createdOn:
          description: Role create time
          example: 2022-12-12 13:07:18+00:00
          format: date-time
          type: string
        customerUUID:
          description: Customer UUID
          format: uuid
          type: string
        description:
          description: Role description
          type: string
        name:
          description: Role name
          type: string
        permissionDetails:
          $ref: '#/components/schemas/PermissionDetails'
        roleType:
          description: Type of the role
          enum:
          - System
          - Custom
          type: string
        roleUUID:
          description: Role UUID
          format: uuid
          readOnly: true
          type: string
        updatedOn:
          description: Role last updated time
          example: 2022-12-12 13:07:18+00:00
          format: date-time
          type: string
      type: object
    GroupMappingInfo:
      example:
        groupUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        identifier: identifier
        customerUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        creationDate: 2022-12-12 13:07:18+00:00
        type: LDAP
        roleUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
      properties:
        creationDate:
          description: Group mapping creation time
          example: 2022-12-12 13:07:18+00:00
          format: date-time
          type: string
        customerUUID:
          format: uuid
          type: string
        groupUUID:
          format: uuid
          type: string
        identifier:
          type: string
        roleUUID:
          format: uuid
          type: string
        type:
          enum:
          - LDAP
          - OIDC
          type: string
      required:
      - customerUUID
      - groupUUID
      - identifier
      - roleUUID
      - type
      type: object
    RoleBinding:
      example:
        principal:
          groupUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          userUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          type: USER
          uuid: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        resourceGroup:
          resourceDefinitionSet:
          - allowAll: true
            resourceUUIDSet:
            - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
            - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
            resourceType: UNIVERSE
          - allowAll: true
            resourceUUIDSet:
            - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
            - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
            resourceType: UNIVERSE
        role:
          customerUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          permissionDetails:
            permissionList:
            - action: CREATE
              resourceType: UNIVERSE
            - action: CREATE
              resourceType: UNIVERSE
          name: name
          description: description
          updatedOn: 2022-12-12 13:07:18+00:00
          roleType: System
          createdOn: 2022-12-12 13:07:18+00:00
          roleUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        createTime: 2022-12-12 13:07:18+00:00
        updateTime: 2022-12-12 13:07:18+00:00
        groupInfo:
          groupUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          identifier: identifier
          customerUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          creationDate: 2022-12-12 13:07:18+00:00
          type: LDAP
          roleUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        type: System
        user:
          ldapSpecifiedRole: true
          customerUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          role: Admin
          authTokenIssueDate: 2021-06-17 15:00:05+00:00
          timezone: timezone
          oidcJwtAuthToken: oidcJwtAuthToken
          groupMemberships:
          - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          userType: local
          creationDate: 2022-12-12 13:07:18+00:00
          uuid: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          email: username1@example.com
          primary: true
        uuid: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
      properties:
        createTime:
          description: RoleBinding create time
          example: 2022-12-12 13:07:18+00:00
          format: date-time
          type: string
        groupInfo:
          $ref: '#/components/schemas/GroupMappingInfo'
        principal:
          $ref: '#/components/schemas/Principal'
        resourceGroup:
          $ref: '#/components/schemas/ResourceGroup'
        role:
          $ref: '#/components/schemas/Role'
        type:
          description: Role binding type
          enum:
          - System
          - Custom
          type: string
        updateTime:
          description: RoleBinding last updated time
          example: 2022-12-12 13:07:18+00:00
          format: date-time
          type: string
        user:
          $ref: '#/components/schemas/Users'
        uuid:
          description: UUID
          format: uuid
          readOnly: true
          type: string
      required:
      - principal
      type: object
    PermissionInfo:
      example:
        permissionValidOnResource: true
        prerequisitePermissions:
        - action: CREATE
          resourceType: UNIVERSE
        - action: CREATE
          resourceType: UNIVERSE
        name: name
        action: CREATE
        description: description
        resourceType: UNIVERSE
      properties:
        action:
          enum:
          - CREATE
          - READ
          - UPDATE
          - DELETE
          - PAUSE_RESUME
          - BACKUP_RESTORE
          - UPDATE_ROLE_BINDINGS
          - UPDATE_PROFILE
          - SUPER_ADMIN_ACTIONS
          - XCLUSTER
          - DEBUG
          - TROUBLESHOOT
          type: string
        description:
          type: string
        name:
          type: string
        permissionValidOnResource:
          type: boolean
        prerequisitePermissions:
          items:
            $ref: '#/components/schemas/Permission'
          type: array
          uniqueItems: true
        resourceType:
          enum:
          - UNIVERSE
          - ROLE
          - USER
          - OTHER
          type: string
      type: object
    YBPSuccess:
      example:
        success: true
        message: message
      properties:
        message:
          description: API response message.
          readOnly: true
          type: string
        success:
          description: API operation status. A value of true indicates the operation was successful.
          readOnly: true
          type: boolean
      type: object
    RoleBindingFormData:
      description: Role Binding form metadata
      example:
        roleResourceDefinitions:
        - resourceGroup:
            resourceDefinitionSet:
            - allowAll: true
              resourceUUIDSet:
              - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
              - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
              resourceType: UNIVERSE
            - allowAll: true
              resourceUUIDSet:
              - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
              - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
              resourceType: UNIVERSE
          roleUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        - resourceGroup:
            resourceDefinitionSet:
            - allowAll: true
              resourceUUIDSet:
              - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
              - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
              resourceType: UNIVERSE
            - allowAll: true
              resourceUUIDSet:
              - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
              - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
              resourceType: UNIVERSE
          roleUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
      properties:
        roleResourceDefinitions:
          description: List of roles and resource groups defined.
          items:
            $ref: '#/components/schemas/RoleResourceDefinition'
          type: array
      required:
      - roleResourceDefinitions
      type: object
    Users:
      description: A user associated with a customer
      example:
        ldapSpecifiedRole: true
        customerUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        role: Admin
        authTokenIssueDate: 2021-06-17 15:00:05+00:00
        timezone: timezone
        oidcJwtAuthToken: oidcJwtAuthToken
        groupMemberships:
        - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        userType: local
        creationDate: 2022-12-12 13:07:18+00:00
        uuid: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        email: username1@example.com
        primary: true
      properties:
        authTokenIssueDate:
          description: UI session token creation date
          example: 2021-06-17 15:00:05+00:00
          format: date-time
          readOnly: true
          type: string
        creationDate:
          description: User creation date
          example: 2022-12-12 13:07:18+00:00
          format: date-time
          readOnly: true
          type: string
        customerUUID:
          description: Customer UUID
          format: uuid
          readOnly: true
          type: string
        email:
          description: User email address
          example: username1@example.com
          type: string
        groupMemberships:
          items:
            format: uuid
            type: string
          type: array
          uniqueItems: true
        ldapSpecifiedRole:
          description: LDAP Specified Role
          type: boolean
        oidcJwtAuthToken:
          readOnly: true
          type: string
        primary:
          type: boolean
        role:
          description: <b style="color:#ff0000">Deprecated since YBA version 2.19.3.0.</b> Use  getRoleBindings instead.
          enum:
          - ConnectOnly
          - ReadOnly
          - BackupAdmin
          - Admin
          - SuperAdmin
          example: Admin
          type: string
        timezone:
          description: User timezone
          type: string
        userType:
          description: User Type
          enum:
          - local
          - ldap
          - oidc
          type: string
        uuid:
          description: User UUID
          format: uuid
          readOnly: true
          type: string
      required:
      - email
      - groupMemberships
      - primary
      type: object
    RoleFormData:
      description: Role form metadata
      example:
        name: name
        description: description
        permissionList:
        - action: CREATE
          resourceType: UNIVERSE
        - action: CREATE
          resourceType: UNIVERSE
      properties:
        description:
          description: Description of the role to be created
          type: string
        name:
          description: Name of the role to be created
          type: string
        permissionList:
          description: List of permissions given to the role
          items:
            $ref: '#/components/schemas/Permission'
          type: array
          uniqueItems: true
      required:
      - description
      - name
      - permissionList
      type: object
    ResourceGroup:
      example:
        resourceDefinitionSet:
        - allowAll: true
          resourceUUIDSet:
          - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          resourceType: UNIVERSE
        - allowAll: true
          resourceUUIDSet:
          - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          - 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          resourceType: UNIVERSE
      properties:
        resourceDefinitionSet:
          items:
            $ref: '#/components/schemas/ResourceDefinition'
          type: array
          uniqueItems: true
      required:
      - resourceDefinitionSet
      type: object
    PermissionDetails:
      example:
        permissionList:
        - action: CREATE
          resourceType: UNIVERSE
        - action: CREATE
          resourceType: UNIVERSE
      properties:
        permissionList:
          description: Set of permissions
          items:
            $ref: '#/components/schemas/Permission'
          type: array
          uniqueItems: true
      type: object
  securitySchemes:
    apiKeyAuth:
      description: API token passed as header
      in: header
      name: X-AUTH-YW-API-TOKEN
      type: apiKey
externalDocs:
  description: About YugabyteDB Anywhere
  url: https://docs.yugabyte.com/latest/yugabyte-platform/
x-original-swagger-version: '2.0'