openapi: 3.1.0
info:
  title: YugabyteDB Aeon REST Access Keys LDAP Role management API
  description: The YugabyteDB Aeon REST API provides programmatic access to YugabyteDB's fully managed cloud database service. Developers and operators can use it to deploy and manage database clusters, configure read replicas, schedule and execute on-demand backups and restores, manage IP allow lists, and set up monitoring and alerts. Authentication is performed using API keys passed as bearer tokens in the Authorization header. All paths are scoped to an account and project, which can be obtained from the YugabyteDB Aeon UI profile page.
  version: v1
  contact:
    name: Yugabyte Support
    url: https://support.yugabyte.com
  termsOfService: https://www.yugabyte.com/yugabytedb-managed-service-terms/
  x-generated-from: documentation
  x-source-url: https://api-docs.yugabyte.com/docs/managed-apis/
  x-last-validated: '2026-05-03'
servers:
- url: https://cloud.yugabyte.com/api/public/v1
  description: YugabyteDB Aeon Production Server
security:
- bearerAuth: []
tags:
- name: LDAP Role management
paths:
  /api/v1/customers/{cUUID}/universes/{univUUID}/ldap_roles_sync:
    post:
      description: 'WARNING: This is a preview API that could change.'
      operationId: syncLdapUniverse
      parameters:
      - in: path
        name: cUUID
        required: true
        schema:
          format: uuid
          type: string
        example: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
      - in: path
        name: univUUID
        required: true
        schema:
          format: uuid
          type: string
        example: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
      - in: query
        name: request
        schema: {}
        example: example-request
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LdapUnivSyncFormData'
            examples:
              SyncLdapUniverseRequestExample:
                summary: Default syncLdapUniverse request
                x-microcks-default: true
                value:
                  ldapServer: ldapServer
                  createGroups: true
                  ldapSearchFilter: (objectclass=person)
                  useLdapTls: true
                  ldapUserfield: cn, sAMAccountName
                  dbuserPassword: dbuserPassword
                  excludeUsers:
                  - excludeUsers
                  - excludeUsers
                  targetApi: ysql
                  ldapPort: 0
                  ldapBasedn: dc=example,dc=org
                  ldapGroupMemberOfAttribute: ldapGroupMemberOfAttribute
                  groupsToSync:
                  - groupsToSync
                  - groupsToSync
                  ldapBindDn: cn=user,dc=example,dc=com
                  useLdapSsl: true
                  ldapTlsProtocol: TLSv1
                  dbUser: dbUser
                  ldapBindPassword: ldapBindPassword
                  ldapGroupfield: cn
        description: config to sync universe roles with ldap users
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/YBPTask'
              examples:
                SyncLdapUniverse200Example:
                  summary: Default syncLdapUniverse 200 response
                  x-microcks-default: true
                  value:
                    taskUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
                    resourceUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          description: successful operation
      security:
      - apiKeyAuth: []
      summary: YugabyteDB Anywhere Perform an LDAP Users Sync on the Universe
      tags:
      - LDAP Role management
      x-codegen-request-body-name: syncLdapUniverse
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    LdapUnivSyncFormData:
      description: Config to sync universe roles with ldap users
      example:
        ldapServer: ldapServer
        createGroups: true
        ldapSearchFilter: (objectclass=person)
        useLdapTls: true
        ldapUserfield: cn, sAMAccountName
        dbuserPassword: dbuserPassword
        excludeUsers:
        - excludeUsers
        - excludeUsers
        targetApi: ysql
        ldapPort: 0
        ldapBasedn: dc=example,dc=org
        ldapGroupMemberOfAttribute: ldapGroupMemberOfAttribute
        groupsToSync:
        - groupsToSync
        - groupsToSync
        ldapBindDn: cn=user,dc=example,dc=com
        useLdapSsl: true
        ldapTlsProtocol: TLSv1
        dbUser: dbUser
        ldapBindPassword: ldapBindPassword
        ldapGroupfield: cn
      properties:
        createGroups:
          description: Allow the API to create the LDAP groups as DB superusers
          type: boolean
          example: true
        dbUser:
          description: 'Database user to connect: yugabyte for ysql, cassandra for ycql'
          type: string
          example: example-dbUser
        dbuserPassword:
          type: string
          example: REDACTED
        excludeUsers:
          description: List of users to exclude while revoking and dropping
          items:
            type: string
          type: array
          example:
          - example-excludeUsers
        groupsToSync:
          description: LDAP groups to sync. In case user belongs to multiple groups & we don't want to sync all of them to DB
          items:
            type: string
          type: array
          example:
          - example-groupsToSync
        ldapBasedn:
          description: Dn of the search starting point.
          example: dc=example,dc=org
          type: string
        ldapBindDn:
          description: Dn of the user authenticating to LDAP.
          example: cn=user,dc=example,dc=com
          type: string
        ldapBindPassword:
          description: Password of the user authenticating to LDAP.
          type: string
          example: REDACTED
        ldapGroupMemberOfAttribute:
          description: LDAP group dn attribute to which the user belongs
          type: string
          example: example-ldapGroupMemberOfAttribute
        ldapGroupfield:
          description: LDAP field to get the group information
          example: cn
          type: string
        ldapPort:
          description: 'Port of the ldap server : 389 or 636(tls)'
          format: int32
          type: integer
          example: 5433
        ldapSearchFilter:
          description: LDAP search filter to get the user entries
          example: (objectclass=person)
          type: string
        ldapServer:
          description: IP address of the LDAP server
          type: string
          example: example-ldapServer
        ldapTlsProtocol:
          description: 'TLS versions for LDAPS : TLSv1, TLSv1_1, TLSv1_2'
          enum:
          - TLSv1
          - TLSv1_1
          - TLSv1_2
          type: string
          example: TLSv1
        ldapUserfield:
          description: Dn/Attribute field to get the user's name from
          example: cn, sAMAccountName
          type: string
        targetApi:
          enum:
          - ysql
          - ycql
          type: string
          example: ysql
        useLdapSsl:
          description: Use LDAP SSL
          type: boolean
          example: true
        useLdapTls:
          description: Use LDAP TLS
          type: boolean
          example: true
      required:
      - dbuserPassword
      - ldapGroupfield
      - ldapUserfield
      - targetApi
      type: object
    YBPTask:
      example:
        taskUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        resourceUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
      properties:
        resourceUUID:
          description: UUID of the resource being modified by the task
          format: uuid
          readOnly: true
          type: string
          example: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        taskUUID:
          description: Task UUID
          format: uuid
          readOnly: true
          type: string
          example: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
      type: object
    LdapUnivSyncFormData_2:
      description: Config to sync universe roles with ldap users
      example:
        ldapServer: ldapServer
        createGroups: true
        ldapSearchFilter: (objectclass=person)
        useLdapTls: true
        ldapUserfield: cn, sAMAccountName
        dbuserPassword: dbuserPassword
        excludeUsers:
        - excludeUsers
        - excludeUsers
        targetApi: ysql
        ldapPort: 0
        ldapBasedn: dc=example,dc=org
        ldapGroupMemberOfAttribute: ldapGroupMemberOfAttribute
        groupsToSync:
        - groupsToSync
        - groupsToSync
        ldapBindDn: cn=user,dc=example,dc=com
        useLdapSsl: true
        ldapTlsProtocol: TLSv1
        dbUser: dbUser
        ldapBindPassword: ldapBindPassword
        ldapGroupfield: cn
      properties:
        createGroups:
          description: Allow the API to create the LDAP groups as DB superusers
          type: boolean
        dbUser:
          description: 'Database user to connect: yugabyte for ysql, cassandra for ycql'
          type: string
        dbuserPassword:
          type: string
        excludeUsers:
          description: List of users to exclude while revoking and dropping
          items:
            type: string
          type: array
        groupsToSync:
          description: LDAP groups to sync. In case user belongs to multiple groups & we don't want to sync all of them to DB
          items:
            type: string
          type: array
        ldapBasedn:
          description: Dn of the search starting point.
          example: dc=example,dc=org
          type: string
        ldapBindDn:
          description: Dn of the user authenticating to LDAP.
          example: cn=user,dc=example,dc=com
          type: string
        ldapBindPassword:
          description: Password of the user authenticating to LDAP.
          type: string
        ldapGroupMemberOfAttribute:
          description: LDAP group dn attribute to which the user belongs
          type: string
        ldapGroupfield:
          description: LDAP field to get the group information
          example: cn
          type: string
        ldapPort:
          description: 'Port of the ldap server : 389 or 636(tls)'
          format: int32
          type: integer
        ldapSearchFilter:
          description: LDAP search filter to get the user entries
          example: (objectclass=person)
          type: string
        ldapServer:
          description: IP address of the LDAP server
          type: string
        ldapTlsProtocol:
          description: 'TLS versions for LDAPS : TLSv1, TLSv1_1, TLSv1_2'
          enum:
          - TLSv1
          - TLSv1_1
          - TLSv1_2
          type: string
        ldapUserfield:
          description: Dn/Attribute field to get the user's name from
          example: cn, sAMAccountName
          type: string
        targetApi:
          enum:
          - ysql
          - ycql
          type: string
        useLdapSsl:
          description: Use LDAP SSL
          type: boolean
        useLdapTls:
          description: Use LDAP TLS
          type: boolean
      required:
      - dbuserPassword
      - ldapGroupfield
      - ldapUserfield
      - targetApi
      type: object
    YBPTask_2:
      example:
        taskUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        resourceUUID: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
      properties:
        resourceUUID:
          description: UUID of the resource being modified by the task
          format: uuid
          readOnly: true
          type: string
        taskUUID:
          description: Task UUID
          format: uuid
          readOnly: true
          type: string
      type: object
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: API key obtained from the YugabyteDB Aeon UI under User Profile > API Keys. Pass the key as a Bearer token in the Authorization header.
externalDocs:
  description: YugabyteDB Aeon REST API Documentation
  url: https://docs.yugabyte.com/stable/yugabyte-cloud/managed-automation/managed-api/