openapi: 3.0.0
info:
  title: Conjur
  description: >-
    This is an API definition for CyberArk Conjur Open Source. You can find out
    more at [Conjur.org](https://www.conjur.org/).
  version: 5.3.1
  contact:
    email: conj_maintainers@cyberark.com
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  x-api-status-urls: false
  x-konfig-ignore:
    object-with-no-properties: true
servers:
  - url: ''
tags:
  - description: Authentication
    name: authentication
  - description: Server status
    name: status
  - description: Resources
    name: resources
  - description: Secrets
    name: secrets
  - description: Policies
    name: policies
  - description: RBAC
    name: roles
  - description: Host factories
    name: host factory
  - description: SSH keys
    name: public keys
  - description: Certificate authority
    name: certificate authority
paths:
  /authn/{account}/login:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    get:
      tags:
        - authentication
      summary: |
        Gets the API key of a user given the username and password
        via HTTP Basic Authentication.
      operationId: Authentication_getUserApiKey
      description: >
        Passwords are stored in the Conjur database using `bcrypt`

        with a work factor of 12. Therefore, login is a fairly expensive
        operation.

        However, once the API key is obtained, it may be used to inexpensively

        obtain access tokens by calling the Authenticate method. An access token

        is required to use most other parts of the Conjur API.


        The Basic authentication-compliant header is formed by:

        1. Concatenating the role's name, a literal colon character ':',
           and the password or API key to create the authentication string.
        2. Base64-encoding the authentication string.

        3. Prefixing the authentication string with the scheme: `Basic `
           (note the required space).
        4. Providing the result as the value of the `Authorization` HTTP header:
           `Authorization: Basic <authentication string>`.

        Your HTTP/REST client probably provides HTTP basic authentication
        support.

        For example, `curl` and all of the Conjur client libraries provide this.


        Note that machine roles (Hosts) do not have passwords and do not need to

        use this endpoint.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
      responses:
        '200':
          description: The response body is the API key
          content:
            text/plain:
              schema:
                $ref: >-
                  #/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/requestBody/content/text~1plain/schema
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /authn-k8s/{service_id}/inject_client_cert:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    post:
      tags:
        - authentication
      summary: |
        For applications running in Kubernetes; sends Conjur a certificate
        signing request (CSR) and requests a client certificate injected into
        the application's Kubernetes pod.
      operationId: Authentication_sendCsrForClientCertInjection
      description: >
        This request sends a Certificate Signing Request to Conjur,

        which uses the Kubernetes API to inject a client certificate into the

        application pod.


        This endpoint requires a properly configured Conjur Certificate
        Authority

        service alongside a properly configured and enabled Kubernetes
        authenticator.

        For detailed instructions,

        see [the
        documentation](https://docs.conjur.org/Latest/en/Content/Integrations/kubernetes.htm).
      parameters:
        - $ref: '#/components/parameters/ServiceID'
        - description: >-
            Dot-separated policy tree, prefixed by `host.`, where the
            application identity is defined
          name: Host-Id-Prefix
          in: header
          schema:
            type: string
          example: host/conjur/authn-k8s/my-authenticator-id/apps
      requestBody:
        description: |
          Valid certificate signing request that includes the host
          identity suffix as the CSR common name
        required: true
        content:
          text/plain:
            schema:
              $ref: >-
                #/components/schemas/AuthenticationSendCsrForClientCertInjectionRequest
      responses:
        '202':
          description: The injected certificate was accepted.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
  /authn-ldap/{service_id}/{account}/login:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    get:
      tags:
        - authentication
      summary: |
        Gets the Conjur API key of a user given the LDAP username and
        password via HTTP Basic Authentication.
      operationId: Authentication_exchangeLdapCredentialsForApiKey
      description: >
        Exchange your LDAP credentials for a Conjur API key. Once the

        API key is obtained, it may be used to inexpensively obtain access

        tokens by calling the Authenticate method. An access token

        is required to use most other parts of the Conjur API.


        The Basic authentication-compliant header is formed by:

        1. Concatenating the LDAP username, a literal colon character ':',
           and the password to create the authentication string.
        2. Base64-encoding the authentication string.

        3. Prefixing the authentication string with the scheme: `Basic `
           (note the required space).
        4. Providing the result as the value of the `Authorization` HTTP header:
           `Authorization: Basic <authentication string>`.

        Your HTTP/REST client probably provides HTTP basic authentication
        support.
      parameters:
        - $ref: '#/components/parameters/ServiceID'
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
      responses:
        '200':
          $ref: '#/paths/~1authn~1%7Baccount%7D~1login/get/responses/200'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /authn/{account}/{login}/authenticate:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    post:
      tags:
        - authentication
      summary: |
        Gets a short-lived access token, which is required in the header
        of most subsequent API requests.
      operationId: Authentication_obtainAccessToken
      security: []
      description: >
        A client can obtain an access token by presenting a valid

        login name and API key.


        The access token is used to communicate to the REST API that the bearer

        of the token has been authorized to access the API and perform specific

        actions specified by the scope that was granted during authorization.


        The `login` must be URL encoded. For example, `alice@devops` must be

        encoded as `alice%40devops`.


        The `service_id`, if given, must be URL encoded. For example,

        `prod/gke` must be encoded as `prod%2Fgke`.


        For host authentication, the `login` is the host ID with the prefix

        `host/`. For example, the host webserver would login as
        `host/webserver`,

        and would be encoded as `host%2Fwebserver`.


        For API usage, the base64-encoded access token is ordinarily passed as
        an HTTP

        Authorization header as `Authorization: Token token=<base64-encoded
        token>`.


        This is the default authentication endpoint only. See other endpoints
        for

        details on authenticating to Conjur using another method, e.g. for

        applications running in Azure or Kubernetes.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: >-
            URL-encoded login name. For users, it’s the user ID. For hosts, the
            login name is `host/<host-id>`
          name: login
          in: path
          required: true
          schema:
            type: string
            minLength: 1
            example: admin
        - description: >-
            Setting the Accept-Encoding header to base64 will return a
            pre-encoded access token
          name: Accept-Encoding
          in: header
          schema:
            type: string
            enum:
              - application/json
              - base64
            default: application/json
      requestBody:
        description: API Key
        required: true
        content:
          text/plain:
            schema:
              $ref: '#/components/schemas/AuthenticationObtainAccessTokenRequest'
      responses:
        '200':
          description: The response is an access token for conjur
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/AuthenticationObtainAccessTokenResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /authn-iam/{service_id}/{account}/{login}/authenticate:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    post:
      tags:
        - authentication
      summary: Get a short-lived access token for applications running in AWS.
      operationId: Authentication_getShortLivedToken
      security: []
      description: >
        The access token is used to communicate to the REST API that

        the bearer of the token has been authorized to access the API and
        perform

        specific actions specified by the scope that was granted during
        authorization.


        For API usage, the base64-encoded access token is ordinarily passed as
        an HTTP

        Authorization header as `Authorization: Token token=<base64-encoded
        token>`.


        The `login` must be URL encoded and the host ID must have the prefix

        `host/`. For example, the host webserver would login as
        `host/webserver`,

        and would be encoded as `host%2Fwebserver`.


        The `service_id`, if given, must be URL encoded. For example,

        `prod/gke` must be encoded as `prod%2Fgke`.


        For detailed instructions on authenticating to Conjur using this
        endpoint,

        reference the documentation:

        [AWS IAM
        Authenticator](https://docs.conjur.org/Latest/en/Content/Operations/Services/AWS_IAM_Authenticator.htm)
        (`authn-iam`).
      parameters:
        - $ref: '#/components/parameters/ServiceID'
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: >-
            URL-encoded login name. For hosts, the login name is
            `host/<host-id>`
          name: login
          in: path
          required: true
          schema:
            $ref: >-
              #/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/parameters/1/schema
        - description: >-
            Setting the Accept-Encoding header to base64 will return a
            pre-encoded access token
          name: Accept-Encoding
          in: header
          schema:
            type: string
            enum:
              - application/json
              - base64
            default: application/json
      requestBody:
        description: AWS Signature header
        required: true
        content:
          text/plain:
            schema:
              $ref: '#/components/schemas/AuthenticationGetShortLivedTokenRequest'
      responses:
        '200':
          $ref: >-
            #/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/responses/200
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /authn-azure/{service_id}/{account}/{login}/authenticate:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    post:
      tags:
        - authentication
      summary: Gets a short-lived access token for applications running in Azure.
      operationId: Authentication_azureAuthenticate
      security: []
      description: >
        The access token is used to communicate to the REST API that

        the bearer of the token has been authorized to access the API and
        perform

        specific actions specified by the scope that was granted during
        authorization.


        For API usage, the base64-encoded access token is ordinarily passed as
        an HTTP

        Authorization header as `Authorization: Token token=<base64-encoded
        token>`.


        The `login` must be URL encoded and the host ID must have the prefix

        `host/`. For example, the host webserver would login as
        `host/webserver`,

        and would be encoded as `host%2Fwebserver`.


        The `service_id`, if given, must be URL encoded. For example,

        `prod/gke` must be encoded as `prod%2Fgke`.


        To authenticate to Conjur using this endpoint, reference the detailed

        documentation: [Azure
        Authenticator](https://docs.conjur.org/Latest/en/Content/Operations/Services/azure_authn.htm)
        (`authn-azure`).
      parameters:
        - $ref: '#/components/parameters/ServiceID'
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: >-
            URL-encoded login name. For users, it’s the user ID. For hosts, the
            login name is `host/<host-id>`
          name: login
          in: path
          required: true
          schema:
            $ref: >-
              #/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/parameters/1/schema
        - description: >-
            Setting the Accept-Encoding header to base64 will return a
            pre-encoded access token
          name: Accept-Encoding
          in: header
          schema:
            type: string
            enum:
              - application/json
              - base64
            default: application/json
      requestBody:
        description: Azure identity token
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AuthenticationAzureAuthenticateRequest'
      responses:
        '200':
          $ref: >-
            #/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/responses/200
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /authn-gcp/{account}/authenticate:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    post:
      tags:
        - authentication
      summary: |
        Gets a short-lived access token for applications running in
        Google Cloud Platform.
      operationId: Authentication_gcpAuthnAuthenticate
      security: []
      description: >
        Use the GCP Authenticator API to send an authentication

        request from a Google Cloud service to Conjur.


        For more information, see [the
        documentation](https://docs.conjur.org/Latest/en/Content/Operations/Services/cjr-gcp-authn.htm).
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            type: string
          example: dev
        - description: >-
            Setting the Accept-Encoding header to base64 will return a
            pre-encoded access token
          name: Accept-Encoding
          in: header
          schema:
            type: string
            enum:
              - base64
      requestBody:
        description: Google JWT identity token for the Google Cloud service
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AuthenticationGcpAuthnAuthenticateRequest'
      responses:
        '200':
          $ref: '#/paths/~1authn~1%7Baccount%7D~1login/get/responses/200'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /authn-k8s/{service_id}/{account}/{login}/authenticate:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    post:
      tags:
        - authentication
      summary: Gets a short-lived access token for applications running in Kubernetes.
      operationId: Authentication_kubernetesAuthnAuthenticate
      description: >
        The access token is used to communicate to the REST API that

        the bearer of the token has been authorized to access the API and
        perform

        specific actions specified by the scope that was granted during
        authorization.


        For API usage, the base64-encoded access token is ordinarily passed as
        an HTTP

        Authorization header as `Authorization: Token token=<base64-encoded
        token>`.


        The `login` must be URL encoded and the host ID must have the prefix

        `host/`. For example, the host webserver would login as
        `host/webserver`,

        and would be encoded as `host%2Fwebserver`.


        The `service_id`, if given, must be URL encoded. For example,

        `prod/gke` must be encoded as `prod%2Fgke`.


        To authenticate to Conjur using this endpoint, reference the detailed

        documentation: [Kubernetes
        Authenticator](https://docs.conjur.org/Latest/en/Content/Operations/Services/k8s_auth.htm)
        (`authn-k8s`).
      parameters:
        - $ref: '#/components/parameters/ServiceID'
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: >-
            URL-encoded login name. For users, it’s the user ID. For hosts, the
            login name is `host/<host-id>`
          name: login
          in: path
          required: true
          schema:
            $ref: >-
              #/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/parameters/1/schema
        - description: >-
            Setting the Accept-Encoding header to base64 will return a
            pre-encoded access token
          name: Accept-Encoding
          in: header
          schema:
            type: string
            enum:
              - application/json
              - base64
            default: application/json
      responses:
        '200':
          $ref: >-
            #/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/responses/200
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /authn-ldap/{service_id}/{account}/{login}/authenticate:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    post:
      tags:
        - authentication
      summary: |
        Gets a short-lived access token for users and hosts using their
        LDAP identity to access the Conjur API.
      operationId: Authentication_ldapAuthenticate
      security: []
      description: >
        The access token is used to communicate to the REST API that

        the bearer of the token has been authorized to access the API and
        perform

        specific actions specified by the scope that was granted during
        authorization.


        For API usage, the base64-encoded access token is ordinarily passed as
        an HTTP

        Authorization header as `Authorization: Token token=<base64-encoded
        token>`.


        The `login` must be URL encoded. For example, `alice@devops` must be

        encoded as `alice%40devops`.


        The `service_id`, if given, must be URL encoded. For example,

        `prod/gke` must be encoded as `prod%2Fgke`.


        For host authentication, the `login` is the host ID with the prefix

        `host/`. For example, the host webserver would login as
        `host/webserver`,

        and would be encoded as `host%2Fwebserver`.


        To authenticate to Conjur using a LDAP, reference the detailed
        documentation:

        [LDAP
        Authenticator](https://docs.conjur.org/Latest/en/Content/Integrations/ldap/ldap_authenticator.html)
        (`authn-ldap`).
      parameters:
        - $ref: '#/components/parameters/ServiceID'
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: >-
            URL-encoded login name. For users, it’s the user ID. For hosts, the
            login name is `host/<host-id>`
          name: login
          in: path
          required: true
          schema:
            $ref: >-
              #/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/parameters/1/schema
        - description: >-
            Setting the Accept-Encoding header to base64 will return a
            pre-encoded access token
          name: Accept-Encoding
          in: header
          schema:
            type: string
            enum:
              - application/json
              - base64
            default: application/json
      requestBody:
        description: API key
        required: false
        content:
          text/plain:
            schema:
              $ref: >-
                #/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/requestBody/content/text~1plain/schema
      responses:
        '200':
          $ref: >-
            #/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/responses/200
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /authn-oidc/{service_id}/{account}/authenticate:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    post:
      tags:
        - authentication
      summary: |
        Gets a short-lived access token for applications using OpenID
        Connect (OIDC) to access the Conjur API.
      operationId: Authentication_oidcAuthenticate
      security: []
      description: >
        Use the OIDC Authenticator to leverage the identity layer

        provided by OIDC to authenticate with Conjur.


        For more information see [the
        documentation](https://docs.conjur.org/Latest/en/Content/OIDC/OIDC.htm).
      parameters:
        - $ref: '#/components/parameters/ServiceID'
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
      requestBody:
        description: ID token
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AuthenticationOidcAuthenticateRequest'
      responses:
        '200':
          $ref: >-
            #/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/responses/200
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
  /authn-jwt/{service_id}/{account}/authenticate:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    post:
      tags:
        - authentication
      summary: >
        Gets a short-lived access token for applications using JSON Web Token
        (JWT)

        to access the Conjur API.
      operationId: Authentication_jwtAuthenticate
      security: []
      description: |
        Use the JWT Authenticator to leverage the identity layer
        provided by JWT to authenticate with Conjur.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - $ref: '#/components/parameters/ServiceID'
      requestBody:
        description: ID token
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AuthenticationJwtAuthenticateRequest'
      responses:
        '200':
          $ref: >-
            #/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/responses/200
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /authn-jwt/{service_id}/{account}/{id}/authenticate:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    post:
      tags:
        - authentication
      summary: >
        Gets a short-lived access token for applications using JSON Web Token
        (JWT)

        to access the Conjur API. Covers the case of use of optional URL
        parameter "ID"
      operationId: Authentication_authenticateWithId
      security: []
      description: |
        Use the JWT Authenticator to leverage the identity layer
        provided by JWT to authenticate with Conjur.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: Organization user id
          name: id
          in: path
          required: true
          schema:
            description: Represents the user/host identity
            type: string
            minLength: 1
            example: SomeUserID
        - $ref: '#/components/parameters/ServiceID'
      requestBody:
        description: ID token
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: >-
                #/paths/~1authn-jwt~1%7Bservice_id%7D~1%7Baccount%7D~1authenticate/post/requestBody/content/application~1x-www-form-urlencoded/schema
      responses:
        '200':
          $ref: >-
            #/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/responses/200
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /authn/{account}/password:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    put:
      tags:
        - authentication
      summary: Changes a user’s password.
      operationId: Authentication_changeUserPassword
      description: |
        You must provide the login name and current password or
        API key of the user whose password is to be updated in an HTTP Basic
        Authentication header. Also replaces the user’s API key with a new
        securely generated random value. You can fetch the new API key using
        the Login method.

        The Basic authentication-compliant header is formed by:
        1. Concatenating the role's name, a literal colon character ':',
           and the password or API key to create the authentication string.
        2. Base64-encoding the authentication string.
        3. Prefixing the authentication string with the scheme: `Basic `
           (note the required space).
        4. Providing the result as the value of the `Authorization` HTTP header:
           `Authorization: Basic <authentication string>`.

        Your HTTP/REST client probably provides HTTP basic authentication
        support. For example, `curl` and all of the Conjur client libraries
        provide this.

        Note that machine roles (Hosts) do not have passwords. They authenticate
        using their API keys, while passwords are only used by human users.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
      requestBody:
        description: New password
        required: true
        content:
          text/plain:
            schema:
              $ref: '#/components/schemas/AuthenticationChangeUserPasswordRequest'
      responses:
        '204':
          description: The password has been changed
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /authn/{account}/api_key:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    put:
      tags:
        - authentication
      summary: Rotates a role's API key.
      operationId: Authentication_rotateApiKey
      security:
        - basicAuth: []
          conjurAuth: []
      description: >
        Any role can rotate its own API key. The name and password

        (for users) or current API key (for hosts and users) of the role must

        be provided via HTTP Basic Authorization.


        To rotate another role's API key, you may provide your name and password

        (for users) or current API key (for hosts and users) via HTTP Basic

        Authorization with the request. Alternatively, you may provide your

        Conjur access token via the standard Conjur `Authorization` header.


        The Basic authentication-compliant header is formed by:

        1. Concatenating the role's name, a literal colon character ':',
           and the password or API key to create the authentication string.
        2. Base64-encoding the authentication string.

        3. Prefixing the authentication string with the scheme: `Basic `
           (note the required space).
        4. Providing the result as the value of the `Authorization` HTTP header:
           `Authorization: Basic <authentication string>`.

        Your HTTP/REST client probably provides HTTP basic authentication
        support.

        For example, `curl` and all of the Conjur client libraries provide this.


        If using the Conjur `Authorization` header, its value should be set to

        `Token token=<base64-encoded access token>`.


        Note that the body of the request must be the empty string.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: |
            (**Optional**) role specifier in `{kind}:{identifier}` format

            ##### Permissions required

            `update` privilege on the role whose API key is being rotated.
          name: role
          in: query
          schema:
            $ref: '#/components/schemas/RoleType'
      responses:
        '200':
          $ref: '#/paths/~1authn~1%7Baccount%7D~1login/get/responses/200'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /{authenticator}/{account}:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    patch:
      tags:
        - authentication
      summary: Enables or disables authenticator defined without service_id.
      operationId: Authentication_toggleAuthenticatorStatus
      description: >
        Allows you to either enable or disable a given authenticator that does
        not have service_id (For example: authn-gcp).


        When you enable or disable an authenticator via this

        endpoint, the status of the authenticator is stored

        in the Conjur database. The enablement status of the authenticator

        service may be overridden by setting the `CONJUR_AUTHENTICATORS`

        environment variable on the Conjur server; in the case where this

        environment variable is set, the database record of whether the

        authenticator service is enabled will be ignored.


        **This endpoint is part of an early implementation of support for
        enabling Conjur

        authenticators via the API, and is currently available at the Community

        (or early alpha) level. This endpoint is still subject to breaking

        changes in the future.**
      parameters:
        - description: The authenticator to update
          name: authenticator
          in: path
          required: true
          schema:
            type: string
            enum:
              - authn-iam
              - authn-oidc
              - authn-ldap
              - authn-k8s
              - authn-gcp
              - authn-azure
              - authn-jwt
          example: authn-gcp
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            type: string
          example: dev
      requestBody:
        description: |
          Contains either `enabled=true` or `enabled=false` to
          enable or disable an authenticator
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: >-
                #/components/schemas/AuthenticationToggleAuthenticatorStatusRequest
      responses:
        '204':
          description: The config was updated properly
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /{authenticator}/{service_id}/{account}:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    patch:
      tags:
        - authentication
      summary: Enables or disables authenticator service instances.
      operationId: Authentication_toggleAuthenticatorInstanceStatus
      description: >
        Allows you to either enable or disable a given authenticator

        service instance.


        When you enable or disable an authenticator service instance via this

        endpoint, the status of the authenticator service instance is stored

        in the Conjur database. The enablement status of the authenticator

        service instance may be overridden by setting the
        `CONJUR_AUTHENTICATORS`

        environment variable on the Conjur server; in the case where this

        environment variable is set, the database record of whether the

        authenticator service instance is enabled will be ignored.


        **This endpoint is part of an early implementation of support for
        enabling Conjur

        authenticators via the API, and is currently available at the Community

        (or early alpha) level. This endpoint is still subject to breaking

        changes in the future.**
      parameters:
        - description: The authenticator to update
          name: authenticator
          in: path
          required: true
          schema:
            $ref: >-
              #/paths/~1%7Bauthenticator%7D~1%7Baccount%7D/patch/parameters/0/schema
          example: authn-oidc
        - $ref: '#/components/parameters/ServiceID'
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            type: string
          example: dev
      requestBody:
        description: |
          Contains either `enabled=true` or `enabled=false` to
          enable or disable an authenticator
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: >-
                #/paths/~1%7Bauthenticator%7D~1%7Baccount%7D/patch/requestBody/content/application~1x-www-form-urlencoded/schema
      responses:
        '204':
          description: The config was updated properly
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /whoami:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    get:
      tags:
        - status
      summary: Provides information about the client making an API request.
      operationId: Status_getClientInfo
      description: >
        WhoAmI provides information about the client making an API request.

        It can be used to help troubleshoot configuration by verifying
        authentication

        and the client IP address for audit and network access restrictions.

        For more information, see Host Attributes.
      responses:
        '200':
          description: Details about the client making the request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StatusGetClientInfoResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
  /{authenticator}/{service_id}/{account}/status:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    get:
      tags:
        - status
      summary: Details whether an authentication service has been configured properly
      operationId: Status_checkAuthenticatorConfiguration
      description: >
        Once the status webservice has been properly configured and the relevant
        user

        groups have been given permissions to access the status webservice, the

        users in those groups can check the status of the authenticator.


        Supported Authenticators:
          - Azure
          - OIDC

        Not Supported:
          - AWS IAM
          - Kubernetes
          - LDAP

        See [Conjur
        Documentation](https://docs.conjur.org/Latest/en/Content/Integrations/Authn-status.htm)

        for details on setting up the authenticator status webservice.
      parameters:
        - description: The type of authenticator
          name: authenticator
          in: path
          schema:
            type: string
          required: true
          example: authn-oidc
        - $ref: '#/components/parameters/ServiceID'
        - description: The organization account name
          name: account
          in: path
          schema:
            type: string
          required: true
          example: dev
      responses:
        '200':
          $ref: '#/paths/~1authn-gcp~1%7Baccount%7D~1status/get/responses/200'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/InadequatePrivileges'
        '404':
          description: The service was not found
        '500':
          $ref: '#/paths/~1authn-gcp~1%7Baccount%7D~1status/get/responses/200'
        '501':
          $ref: '#/paths/~1authn-gcp~1%7Baccount%7D~1status/get/responses/200'
  /authn-gcp/{account}/status:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    get:
      tags:
        - status
      summary: Details whether an authentication service has been configured properly
      operationId: Status_checkAuthenticatorStatus
      description: >
        Once the status webservice has been properly configured and the relevant
        user

        groups have been given permissions to access the status webservice, the

        users in those groups can check the status of the authenticator.


        This operation only supports the GCP authenticator


        See [Conjur
        Documentation](https://docs.conjur.org/Latest/en/Content/Integrations/Authn-status.htm)

        for details on setting up the authenticator status webservice.
      parameters:
        - description: The organization account name
          name: account
          in: path
          schema:
            type: string
          required: true
          example: dev
      responses:
        '200':
          description: The response contains info about the result
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/StatusCheckAuthenticatorConfigurationResponse
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/InadequatePrivileges'
        '404':
          description: The service was not found
        '500':
          $ref: '#/paths/~1authn-gcp~1%7Baccount%7D~1status/get/responses/200'
        '501':
          $ref: '#/paths/~1authn-gcp~1%7Baccount%7D~1status/get/responses/200'
  /authenticators:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    get:
      tags:
        - status
      summary: Details about which authenticators are on the Conjur Server
      operationId: Status_authenticatorDetails
      description: >
        Response contains three members: installed, configured, and enabled.


        installed: The authenticator is implemented in Conjur and is available
        for configuration

        configured: The authenticator has a webservice in the DB that was loaded
        by policy

        enabled: The authenticator is enabled (in the DB or in the ENV) and is
        ready for authentication
      responses:
        '200':
          description: Details about authenticators for this Conjur server
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StatusAuthenticatorDetailsResponse'
  /health:
    x-conjur-settings:
      enterprise-only: true
    get:
      tags:
        - status
      summary: Health info about conjur
      operationId: Status_checkConjurHealth
      description: >
        You can request health checks against any cluster node using the Conjur
        API.

        These routes do not require authentication.


        The health check attempts an internal HTTP or TCP connection to

        each Conjur Enterprise service. It also attempts a simple transaction
        against all internal databases.
      responses:
        '200':
          description: The tests were successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StatusCheckConjurHealthResponse'
        '502':
          description: The tests failed
      x-conjur-settings:
        enterprise-only: true
  /remote_health/{remote}:
    x-conjur-settings:
      enterprise-only: true
    get:
      tags:
        - status
      summary: Health info about a given Conjur Enterprise server
      operationId: Status_checkRemoteHealth
      description: >
        Use the remote_health route to check the health of any Conjur Enterprise
        Server from any other Conjur Enterprise Server.

        With this route, you can check master health relative to a follower, or
        follower health relative

        to a standby, and so on.
      parameters:
        - description: The hostname of the remote to check
          name: remote
          in: path
          schema:
            type: string
          required: true
          example: conjur.myorg.com
      responses:
        '200':
          description: The tests were successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StatusCheckRemoteHealthResponse'
        '502':
          description: The tests failed
      x-conjur-settings:
        enterprise-only: true
  /info:
    x-conjur-settings:
      enterprise-only: true
    get:
      tags:
        - status
      summary: Basic information about the Conjur Enterprise server
      operationId: Status_conjurServerInfo
      description: >
        Information about the Conjur Enterprise node which was queried against.


        Includes authenticator info, release/version info, configuration
        details,

        internal services, and role information.
      responses:
        '200':
          description: info
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StatusConjurServerInfoResponse'
      x-conjur-settings:
        enterprise-only: true
  /secrets/{account}/{kind}/{identifier}:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    post:
      tags:
        - secrets
      summary: Creates a secret value within the specified variable.
      operationId: Secrets_createSecretValue
      description: >
        Creates a secret value within the specified Secret.



        Note: Conjur will allow you to add a secret to any resource, but the

        best practice is to store and retrieve secret data only using Secret
        resources.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: Type of resource - in almost all cases this should be `variable`
          name: kind
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Kind'
        - description: URL-encoded variable ID
          name: identifier
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/ResourceID'
        - description: Tells the server to reset the variables expiration date
          name: expirations
          in: query
          required: false
          schema:
            type: string
      requestBody:
        description: Secret data
        required: false
        content:
          application/octet-stream:
            schema:
              $ref: '#/components/schemas/SecretsCreateSecretValueRequest'
      responses:
        '201':
          description: The secret value was added successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/InadequatePrivileges'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
    get:
      tags:
        - secrets
      summary: Fetches the value of a secret from the specified Secret.
      operationId: Secrets_getSecretValue
      description: >
        Fetches the value of a secret from the specified Secret. The latest
        version

        will be retrieved unless the version parameter is specified. The twenty
        most recent secret versions are retained.


        The secret data is returned in the response body.


        Note: Conjur will allow you to add a secret to any resource, but the
        best practice is to store

        and retrieve secret data only using Secret resources.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: Type of resource - in almost all cases this should be `variable`
          name: kind
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Kind'
        - description: URL-encoded variable ID
          name: identifier
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/ResourceID'
        - description: >-
            (**Optional**) Version you want to retrieve (Conjur keeps the last
            20 versions of a secret)
          name: version
          in: query
          schema:
            $ref: '#/components/schemas/ResourceVersion'
      responses:
        '200':
          description: The secret value was added successfully
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/SecretsGetSecretValueResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/InadequatePrivileges'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
  /secrets:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    get:
      tags:
        - secrets
      summary: Fetch multiple secrets
      operationId: Secrets_getMultipleValues
      description: >-
        Fetches multiple secret values in one invocation. It’s faster to fetch
        secrets in batches than to fetch them one at a time.
      parameters:
        - description: Comma-delimited, URL-encoded resource IDs of the variables.
          name: variable_ids
          in: query
          required: true
          schema:
            description: |
              Comma-delimited, URL-encoded resource identifiers.

              ##### Resources IDs encoding:

              - `myapp-01` -> `myapp-01` (unchanged)
              - `alice@devops` -> `alice%40devops`
              - `prod/aws/db-password` -> `prod%2Faws%2Fdb-password`
              - `research+development` -> `research%2Bdevelopment`
              - `sales&marketing` -> `sales%26marketing`
            type: string
            example: myorg:variable:secret1,myorg:variable:secret1
        - description: Set the encoding of the response object
          name: Accept-Encoding
          in: header
          schema:
            type: string
            enum:
              - base64
      responses:
        '200':
          description: The batch secret values
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretsGetMultipleValuesResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/InadequatePrivileges'
        '404':
          $ref: '#/components/responses/ResourcesNotFound'
        '406':
          description: Issue encoding secret into JSON format
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretsGetMultipleValues406Response'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
  /policies/{account}/policy/{identifier}:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    put:
      tags:
        - policies
      summary: Loads or replaces a Conjur policy document.
      operationId: Policies_putPolicyDocument
      description: |
        Loads or replaces a Conjur policy document.

        **Any policy data which already exists on the server but is not
        explicitly specified in the new policy file will be deleted!**.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: >-
            ID of the policy to load (root if no root policy has been loaded
            yet)
          name: identifier
          in: path
          required: true
          example: root
          schema:
            $ref: '#/components/schemas/ResourceID'
      requestBody:
        description: Policy
        required: true
        content:
          text/yaml:
            schema:
              $ref: '#/components/schemas/PoliciesPutPolicyDocumentRequest'
          text/x-yaml:
            schema:
              $ref: >-
                #/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema
          application/x-yaml:
            schema:
              $ref: >-
                #/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema
          text/plain:
            schema:
              $ref: >-
                #/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema
      responses:
        '201':
          description: Decsribes new data created by a successful policy load
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PoliciesModifyPolicyResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/InadequatePrivileges'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '409':
          $ref: '#/components/responses/Busy'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
    post:
      tags:
        - policies
      summary: Adds data to the existing Conjur policy.
      operationId: Policies_addDataToExistingPolicy
      description: >
        Adds data to the existing Conjur policy. Deletions are not allowed.

        Any policy objects that exist on the server but are omitted from the

        policy file will not be deleted and any explicit deletions in the policy
        file will result in an error.


        ##### Permissions required


        `create` privilege on the policy."
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: ID of the policy to update
          name: identifier
          in: path
          required: true
          example: root
          schema:
            $ref: '#/components/schemas/ResourceID'
      requestBody:
        description: Policy
        required: true
        content:
          text/yaml:
            schema:
              $ref: >-
                #/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema
          text/x-yaml:
            schema:
              $ref: >-
                #/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema
          application/x-yaml:
            schema:
              $ref: >-
                #/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema
          text/plain:
            schema:
              $ref: >-
                #/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema
      responses:
        '201':
          $ref: >-
            #/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/responses/201
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/InadequatePrivileges'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '409':
          $ref: '#/components/responses/Busy'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
    patch:
      tags:
        - policies
      summary: Modifies an existing Conjur policy.
      operationId: Policies_modifyPolicy
      description: |
        Modifies an existing Conjur policy. Data may be explicitly deleted using
        the `!delete`, `!revoke`, and `!deny` statements. Unlike `replace` mode,
        no data is ever implicitly deleted.

        ##### Permissions required
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: ID of the policy to update
          name: identifier
          in: path
          required: true
          example: root
          schema:
            $ref: '#/components/schemas/ResourceID'
      requestBody:
        description: Policy
        required: true
        content:
          text/yaml:
            schema:
              $ref: >-
                #/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema
          text/x-yaml:
            schema:
              $ref: >-
                #/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema
          application/x-yaml:
            schema:
              $ref: >-
                #/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema
          text/plain:
            schema:
              $ref: >-
                #/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema
      responses:
        '201':
          $ref: >-
            #/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/responses/201
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/InadequatePrivileges'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '409':
          $ref: '#/components/responses/Busy'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
  /roles/{account}/{kind}/{identifier}:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    get:
      tags:
        - roles
      summary: Get role information
      operationId: Roles_getRoleInformation
      description: >
        Gets detailed information about a specific role, including the role
        members.


        If a role A is granted to a role B, then role A is said to have role B
        as a member.

        These relationships are described in the “members” portion of the
        returned JSON.


        ##### Listing members


        If `members` is provided, you will get the members of a role.


        If a `kind` query parameter is given, narrows results to only resources
        of that kind.


        If a `limit` is given, returns no more than that number of results.
        Providing an `offset`

        skips a number of resources before returning the rest. In addition,
        providing an `offset`

        will give limit a default value of 10 if none other is provided. These
        two parameters

        can be combined to page through results.


        If the parameter `count` is true, returns only the number of items in
        the list.


        ##### Text search


        If the search parameter is provided, narrows results to those pertaining
        to the search query.

        Search works across resource IDs and the values of annotations. It
        weights results so that

        those with matching id or a matching value of an annotation called name
        appear first, then

        those with another matching annotation value, and finally those with a
        matching kind.


        ##### Parameter Priority


        If Conjur is given any combination of optional parameters, it responds
        with ONLY results

        for the parameter of the highest priority.


        1. `graph`

        2. `all`

        3. `memberships`

        4. `members`
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: Type of resource
          name: kind
          in: path
          required: true
          example: user
          schema:
            $ref: '#/components/schemas/Kind'
        - description: ID of the role for which to get the information about
          name: identifier
          in: path
          required: true
          example: admin
          schema:
            $ref: '#/components/schemas/ResourceID'
        - description: >-
            Returns an array of Role IDs representing all role memberships,
            expanded recursively.
          name: all
          in: query
          schema:
            type: string
        - description: >-
            Returns all direct role memberships (members not expanded
            recursively).
          name: memberships
          in: query
          schema:
            type: string
        - description: Returns a list of the Role's members.
          name: members
          in: query
          schema:
            type: string
        - description: When listing members, start at this item number.
          name: offset
          in: query
          schema:
            $ref: '#/components/schemas/Offset'
        - description: When listing members, return up to this many results.
          name: limit
          in: query
          schema:
            $ref: '#/components/schemas/Limit'
        - description: When listing members, if `true`, return only the count of members.
          name: count
          in: query
          schema:
            $ref: '#/components/schemas/Count'
        - description: >-
            When listing members, the results will be narrowed to only those
            matching the provided string
          name: search
          in: query
          schema:
            type: string
            minLength: 1
            example: user
        - description: If included in the query returns a graph view of the role
          name: graph
          in: query
          schema:
            type: string
            example: ''
      responses:
        '200':
          description: The response body contains the requested role(s)/member(s)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RolesGetRoleInformationResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
    post:
      tags:
        - roles
      summary: Update or modify an existing role membership
      operationId: Roles_updateRoleMembership
      description: >
        Updates or modifies an existing role membership.


        If a role A is granted to a role B, then role A is said to have role B
        as a member.

        These relationships are described in the “members” portion of the
        returned JSON.


        When the `members` query parameter is provided, you will get the members
        of a role.


        When the `members` and `member` query parameters are provided, the role
        specfified by

        `member` will be added as a member of the role specified in the endpoint
        URI.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: Type of resource
          name: kind
          in: path
          required: true
          example: user
          schema:
            $ref: '#/components/schemas/Kind'
        - description: ID of the role for which to get the information about
          name: identifier
          in: path
          required: true
          example: admin
          schema:
            $ref: '#/components/schemas/ResourceID'
        - description: Returns a list of the Role's members.
          name: members
          in: query
          required: true
          schema:
            type: string
        - description: The identifier of the Role to be added as a member.
          name: member
          in: query
          required: true
          schema:
            $ref: '#/components/schemas/RoleType'
      responses:
        '204':
          description: Member was added to role successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
    delete:
      tags:
        - roles
      summary: Deletes an existing role membership
      operationId: Roles_deleteRoleMembership
      description: >
        Deletes an existing role membership.


        If a role A is granted to a role B, then role A is said to have role B
        as a member.

        These relationships are described in the “members” portion of the
        returned JSON.


        When the `members` query parameter is provided, you will get the members
        of a role.


        When the `members` and `member` query parameters are provided, the role
        specfified by

        `member` will be removed as a member of the role specified in the
        endpoint URI.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: Type of resource
          name: kind
          in: path
          required: true
          example: user
          schema:
            $ref: '#/components/schemas/Kind'
        - description: ID of the role for which to get the information about
          name: identifier
          in: path
          required: true
          example: admin
          schema:
            $ref: '#/components/schemas/ResourceID'
        - description: Returns a list of the Role's members.
          name: members
          in: query
          required: true
          schema:
            type: string
        - description: The identifier of the Role to be added as a member.
          name: member
          in: query
          required: true
          schema:
            $ref: '#/components/schemas/RoleType'
      responses:
        '204':
          description: Member was deleted from role successfully
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
  /resources:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    get:
      tags:
        - resources
      summary: Lists resources within an organization account.
      operationId: Resources_list
      description: >
        Lists resources within an organization account.


        In the absence of an `account` query parameter, shows results for the
        account of the authorization token user.


        If an `account` query parameter is given, shows results for the
        specified account.


        If a `kind` query parameter is given, narrows results to only resources
        of that kind.


        If a `limit` is given, returns no more than that number of results.
        Providing an `offset`

        skips a number of resources before returning the rest. In addition,
        providing an `offset`

        will give `limit` a default value of 10 if none other is provided. These
        two parameters can

        be combined to page through results.


        If the parameter `count` is `true`, returns only the number of items in
        the list.


        ##### Text search


        If the `search` parameter is provided, narrows results to those
        pertaining to the search query.

        Search works across resource IDs and the values of annotations. It
        weighs results so that those

        with matching id or a matching value of an annotation called `name`
        appear first, then those with

        another matching annotation value, and finally those with a matching 
        `kind`."
      parameters:
        - description: Organization account name
          name: account
          in: query
          example: myorg
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: Type of resource
          name: kind
          in: query
          example: user
          schema:
            $ref: '#/components/schemas/Kind'
        - description: Filter resources based on this value by name
          name: search
          in: query
          example: db
          schema:
            description: Only returns results that contain this string value
            type: string
            minLength: 1
            example: password
        - description: When listing resources, start at this item number.
          name: offset
          in: query
          schema:
            $ref: '#/components/schemas/Offset'
        - description: When listing resources, return up to this many results.
          name: limit
          in: query
          schema:
            $ref: '#/components/schemas/Limit'
        - description: >-
            When listing resources, if `true`, return only the count of the
            results.
          name: count
          in: query
          schema:
            $ref: '#/components/schemas/Count'
        - description: >-
            Retrieves the resources list for a different role if the
            authenticated role has access
          name: role
          in: query
          example: myorg:host:host1
          schema:
            $ref: '#/components/schemas/RoleType'
        - description: >-
            Retrieves the resources list for a different role if the
            authenticated role has access
          name: acting_as
          in: query
          example: myorg:host:host1
          schema:
            $ref: '#/components/schemas/RoleType'
      responses:
        '200':
          description: The response body contains a list of resources
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourcesListResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/InadequatePrivileges'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
  /resources/{account}:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    get:
      tags:
        - resources
      summary: Lists resources within an organization account.
      operationId: Resources_listResources
      description: >
        Lists resources within an organization account.


        If a `kind` query parameter is given, narrows results to only resources
        of that kind.


        If a `limit` is given, returns no more than that number of results.
        Providing an `offset`

        skips a number of resources before returning the rest. In addition,
        providing an `offset`

        will give `limit` a default value of 10 if none other is provided. These
        two parameters

        can be combined to page through results.


        If the parameter `count` is `true`, returns only the number of items in
        the list.


        ##### Text search


        If the `search` parameter is provided, narrows results to those
        pertaining to the search query.

        Search works across resource IDs and the values of annotations. It
        weighs results so that those

        with matching id or a matching value of an annotation called `name`
        appear first, then those with

        another matching annotation value, and finally those with a matching 
        `kind`.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: Type of resource
          name: kind
          in: query
          example: user
          schema:
            $ref: '#/components/schemas/Kind'
        - description: Filter resources based on this value by name
          name: search
          in: query
          example: db
          schema:
            $ref: '#/paths/~1resources/get/parameters/2/schema'
        - description: When listing resources, start at this item number.
          name: offset
          in: query
          schema:
            $ref: '#/components/schemas/Offset'
        - description: When listing resources, return up to this many results.
          name: limit
          in: query
          schema:
            $ref: '#/components/schemas/Limit'
        - description: >-
            When listing resources, if `true`, return only the count of the
            results.
          name: count
          in: query
          schema:
            $ref: '#/components/schemas/Count'
        - description: >-
            Retrieves the resources list for a different role if the
            authenticated role has access
          name: role
          in: query
          example: myorg:host:host1
          schema:
            $ref: '#/components/schemas/RoleType'
        - description: >-
            Retrieves the resources list for a different role if the
            authenticated role has access
          name: acting_as
          in: query
          example: myorg:host:host1
          schema:
            $ref: '#/components/schemas/RoleType'
      responses:
        '200':
          $ref: '#/paths/~1resources/get/responses/200'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/InadequatePrivileges'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
  /resources/{account}/{kind}:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    get:
      tags:
        - resources
      summary: Lists resources of the same kind within an organization account.
      operationId: Resources_listResourcesForKind
      description: >
        Lists resources of the same kind within an organization account.


        Kinds of resources include: policy, user, host, group, layer, or
        variable


        If a `limit` is given, returns no more than that number of results.

        Providing an `offset` skips a number of resources before returning the
        rest.

        In addition, providing an `offset` will give `limit` a default value of
        10 if

        none other is provided. These two parameters can be combined to page
        through results.


        If the parameter `count` is `true`, returns only the number of items in
        the list.


        ##### Text search


        If the `search` parameter is provided, narrows results to those
        pertaining to the search query.

        Search works across resource IDs and the values of annotations. It
        weighs results so that those

        with matching id or a matching value of an annotation called `name`
        appear first, then those with

        another matching annotation value, and finally those with a matching 
        `kind`.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: Type of resource
          name: kind
          in: path
          required: true
          example: user
          schema:
            $ref: '#/components/schemas/Kind'
        - description: Filter resources based on this value by name
          name: search
          in: query
          example: db
          schema:
            $ref: '#/paths/~1resources/get/parameters/2/schema'
        - description: When listing resources, start at this item number.
          name: offset
          in: query
          schema:
            $ref: '#/components/schemas/Offset'
        - description: When listing resources, return up to this many results.
          name: limit
          in: query
          schema:
            $ref: '#/components/schemas/Limit'
        - description: >-
            When listing resources, if `true`, return only the count of the
            results.
          name: count
          in: query
          schema:
            $ref: '#/components/schemas/Count'
        - description: >-
            Retrieves the resources list for a different role if the
            authenticated role has access
          name: role
          in: query
          example: myorg:host:host1
          schema:
            $ref: '#/components/schemas/RoleType'
        - description: >-
            Retrieves the resources list for a different role if the
            authenticated role has access
          name: acting_as
          in: query
          example: myorg:host:host1
          schema:
            $ref: '#/components/schemas/RoleType'
      responses:
        '200':
          $ref: '#/paths/~1resources/get/responses/200'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/InadequatePrivileges'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
  /resources/{account}/{kind}/{identifier}:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    get:
      tags:
        - resources
      summary: Shows a description of a single resource.
      operationId: Resources_showResourceDetails
      description: >
        Details about a single resource.


        If `permitted_roles` and `privilege` are given, Conjur lists the

        roles with the specified privilege on the resource.


        If `check`, `privilege` and `role` are given, Conjur checks if the

        specified role has the privilege on the resource.


        If `permitted_roles` and `check` are both given, Conjur responds to the
        `check` call ONLY.


        ##### Permissions Required
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: Type of resource
          name: kind
          in: path
          required: true
          example: user
          schema:
            $ref: '#/components/schemas/Kind'
        - description: ID of the resource for which to get the information about
          name: identifier
          in: path
          required: true
          example: conjur/authn-iam/test
          schema:
            $ref: '#/components/schemas/ResourceID'
        - description: Lists the roles which have the named privilege on a resource.
          name: permitted_roles
          in: query
          schema:
            type: boolean
            example: true
        - description: >-
            Level of privilege to filter on. Can only be used in combination
            with `permitted_roles` or `check` parameter.
          name: privilege
          in: query
          schema:
            description: Denotes a type of permission allowed on a resource
            type: string
            minLength: 1
            example: execute
        - description: Check whether a role has a privilege on a resource.
          name: check
          in: query
          schema:
            description: Checks whether a role has a privilege on a resource.
            type: boolean
            example: true
        - description: >-
            Role to check privilege on. Can only be used in combination with
            `check` parameter.
          name: role
          in: query
          example: myorg:host:host1
          schema:
            $ref: '#/components/schemas/RoleType'
      responses:
        '200':
          description: >-
            The response body contains the list of role memberships or permitted
            roles
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourcesShowResourceDetailsResponse'
        '204':
          description: Permissions check was successful
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/InadequatePrivileges'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
  /host_factory_tokens:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    post:
      tags:
        - host factory
      summary: Creates one or more host identity tokens.
      operationId: HostFactory_createHostIdentityTokens
      description: >
        Creates one or more tokens which can be used to bootstrap host identity.
        Responds with a JSON document containing the tokens and their
        restrictions.


        If the tokens are created with a CIDR restriction, Conjur will only
        accept them from the whitelisted IP ranges.


        ##### Permissions required

        #

        `execute` privilege on the Host Factory."
      requestBody:
        description: Parameters
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/HostFactoryCreateHostIdentityTokensRequest'
      responses:
        '200':
          description: Zero or more tokens were created and delivered in the response body
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/HostFactoryCreateHostIdentityTokensResponse
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/InadequatePrivileges'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
  /host_factory_tokens/{token}:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    delete:
      tags:
        - host factory
      summary: Revokes a token, immediately disabling it.
      operationId: HostFactory_revokeToken
      description: |
        Revokes a token, immediately disabling it.

        ##### Permissions required

        `update` privilege on the host factory."
      parameters:
        - description: The host factory token to revoke
          name: token
          in: path
          required: true
          schema:
            type: string
            example: 2c0vfj61pmah3efbgpcz2x9vzcy1ycskfkyqy0kgk1fv014880f4
      responses:
        '204':
          description: Token was successfully revoked
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
  /host_factories/hosts:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    post:
      tags:
        - host factory
      summary: Creates a Host using the Host Factory.
      operationId: HostFactory_createHost
      description: >
        Creates a Host using the Host Factory and returns a JSON description of
        it.


        Requires a host factory token, which can be created using the create
        tokens API.

        In practice, this token is usually provided automatically as part of
        Conjur integration with your

        host provisioning infrastructure.


        Note: If the token was created with a CIDR restriction, you must make
        this API request from a whitelisted address.
      requestBody:
        description: Parameters
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/HostFactoryCreateHostRequest'
      responses:
        '201':
          description: The response body contains the newly-created host
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HostFactoryCreateHostResponse'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
  /public_keys/{account}/{kind}/{identifier}:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    get:
      tags:
        - public keys
      summary: Shows all public keys for a resource.
      operationId: PublicKeys_showAllForResource
      description: >
        Shows all public keys for a resource as newline delimited string for
        compatibility with the authorized_keys SSH format.

        Returns an empty string if the resource does not exist, to prevent
        attackers from determining whether a resource exists.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: Type of resource
          name: kind
          in: path
          required: true
          example: user
          schema:
            $ref: '#/components/schemas/Kind'
        - description: ID of the resource for which to get the information about
          name: identifier
          in: path
          required: true
          example: admin
          schema:
            $ref: '#/components/schemas/ResourceID'
      responses:
        '200':
          description: >-
            Public keys for a resource as newline delimited string for
            compatibility with the authorized_keys SSH format. Empty string if
            the resource does not exist
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/PublicKeysShowAllForResourceResponse'
              example: |
                ssh-rsa AAAAB3Nzabc2 admin@alice.com

                ssh-rsa AAAAB3Nza3nx alice@example.com
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/ResourceNotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /ca/{account}/{service_id}/sign:
    parameters:
      - $ref: '#/components/parameters/RequestID'
    post:
      tags:
        - certificate authority
      summary: >-
        Gets a signed certificate from the configured Certificate Authority
        service.
      operationId: CertificateAuthority_getSignedCertificate
      description: >
        Gets a signed certificate from the configured Certificate Authority
        service.


        The request must include a valid Certificate Signing Request, and a
        desired TTL in ISO 8601 format.


        *** IMPORTANT ***

        This endpoint is part of an early implementation of support for using
        Conjur as a certificate

        authority, and is currently available at the Community (or early alpha)
        level.

        This endpoint is still subject to breaking changes in the future.
      parameters:
        - description: Organization account name
          name: account
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/AccountName'
        - description: Name of the Certificate Authority service
          name: service_id
          in: path
          required: true
          schema:
            type: string
            minLength: 1
            example: ca-service
      requestBody:
        description: Client Certificate Signing Request
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: >-
                #/components/schemas/CertificateAuthorityGetSignedCertificateRequest
      responses:
        '201':
          description: The response body is the newly signed certificate
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/CertificateAuthorityGetSignedCertificateResponse
            application/x-pem-file:
              schema:
                $ref: >-
                  #/components/schemas/CertificateAuthorityGetSignedCertificate201Response
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          description: >
            Either          

            - The authenticated role is not a Host role,

            - The authenticated Host does not have `sign` privilege for the CA
            service, or

            - The authenticated Host ID does not match the of the CSR Common
            Name (CN).
        '404':
          description: CA Service with the given ID does not exist
components:
  parameters:
    ServiceID:
      description: URL-Encoded authenticator service ID
      name: service_id
      in: path
      required: true
      example: prod%2fgke
      schema:
        type: string
    RequestID:
      description: |
        Add an ID to the request being made so it can be tracked in Conjur.
        If not provided the server will automatically generate one.
      name: X-Request-Id
      in: header
      required: false
      example: test-id
      schema:
        type: string
        pattern: ^[a-zA-Z\d-]{1,255}$
  responses:
    BadRequest:
      description: The server cannot process the request due to malformed request syntax
    Busy:
      description: Similar operation already in progress, retry after a delay
    InadequatePrivileges:
      description: The authenticated user lacks the necessary privileges
    InternalServerError:
      description: Malfromed request, rejected by the server
    ResourceNotFound:
      description: >-
        The requested resource does not exist, the authenticated user lacks the
        required privileges to enumerate this resource, or its value has not
        been set
    ResourcesNotFound:
      description: At least one resource was unable to be found
    UnauthorizedError:
      description: Authentication information is missing or invalid
    UnprocessableEntity:
      description: A request parameter was either missing or invalid.
  schemas:
    AccountName:
      description: Conjur account name
      type: string
      minLength: 1
      example: default
    Count:
      description: Return only the count of results
      type: boolean
      example: true
    Kind:
      type: string
      minLength: 1
      example: variable
    Limit:
      description: Return no more than this number of results
      type: integer
      example: 10
    Offset:
      description: Skips this many items before returning the rest
      type: integer
      example: 20
    ResourceID:
      description: |
        Resource identifier. Requires to be encoded when in path.

        ##### Examples:

        - `myapp-01` -> `myapp-01` (unchanged)
        - `alice@devops` -> `alice%40devops`
        - `prod/aws/db-password` -> `prod%2Faws%2Fdb-password`
        - `research+development` -> `research%2Bdevelopment`
        - `sales&marketing` -> `sales%26marketing`
      type: string
      minLength: 1
      example: prod%2Faws%2Fdb-password
    ResourceVersion:
      description: Version of the resource (Conjur keeps the last 20 versions of a secret)
      type: integer
      example: 1
    RoleType:
      description: >
        ##### Kinds of roles:


        - User: one unique wonderful human

        - Host: a single logical machine (in the broad sense, not just physical)

        - Layer: a collection of hosts that have the same privileges

        - Group: a collection of users and groups that have the same privileges

        - Policy: a role which owns of a set of related object


        Any identifier included in the URL must be URL-encoded to be recognized
        by the Conjur API.


        ##### Resource Identifiers:


        - `myapp-01` -> `myapp-01` (unchanged)

        - `alice@devops` -> `alice%40devops`

        - `prod/aws/db-password` -> `prod%2Faws%2Fdb-password`

        - `research+development` -> `research%2Bdevelopment`

        - `sales&marketing` -> `sales%26marketing`
      type: string
      minLength: 1
    AuthenticationSendCsrForClientCertInjectionRequest:
      type: string
    AuthenticationObtainAccessTokenRequest:
      description: Example of a Conjur API key
      type: string
      minLength: 55
      example: 14m9cf91wfsesv1kkhevg12cdywm2wvqy6s8sk53z1ngtazp1t9tykc
    AuthenticationGetShortLivedTokenRequest:
      description: AWS Signature Version 4 header
      type: string
    AuthenticationAzureAuthenticateRequest:
      description: Azure instance identity token
      type: object
      properties:
        jwt:
          type: string
      example:
        jwt: eyJhbGciOiJSUzI1NiIs......uTonCA
    AuthenticationGcpAuthnAuthenticateRequest:
      description: Google Cloud instance identity token
      type: object
      properties:
        jwt:
          type: string
      example:
        jwt: eyJhbGciOiJSUzI1NiIs......uTonCA
    AuthenticationOidcAuthenticateRequest:
      description: OpenID Connect ID token
      type: object
      properties:
        id_token:
          type: string
      example:
        id_token: eyJhbGciOiJSUzI1NiIs......uTonCA
    AuthenticationJwtAuthenticateRequest:
      type: object
      properties:
        jwt:
          type: string
      example:
        jwt: eyJhbGciOiJSUzI1NiIs......uTonCA
    AuthenticationChangeUserPasswordRequest:
      type: string
      format: password
      minLength: 1
    AuthenticationToggleAuthenticatorStatusRequest:
      type: object
      properties:
        enabled:
          type: boolean
    SecretsCreateSecretValueRequest:
      type: string
    PoliciesPutPolicyDocumentRequest:
      type: string
      minLength: 1
      example: |
        - !policy
          id: database
          body:
          - !host
            id: db-host
          - !variable
            id: db-password
            owner: !host db-host
    HostFactoryCreateHostIdentityTokensRequest:
      type: object
      properties:
        expiration:
          description: '`ISO 8601 datetime` denoting a requested expiration time.'
          type: string
          example: '2017-08-04T22:27:20+00:00'
        host_factory:
          description: Fully qualified host factory ID
          type: string
          example: myorg:host_factory:hf-db
        count:
          description: Number of host tokens to create
          type: integer
          example: 2
        cidr:
          description: Number of host tokens to create
          type: array
          items:
            type: string
          example:
            - 127.0.0.1/32
      required:
        - expiration
        - host_factory
      example:
        expiration: '2017-08-04T22:27:20+00:00'
        host_factory: myorg:hosty_factory:hf-db
    HostFactoryCreateHostRequest:
      type: object
      properties:
        id:
          description: >-
            Identifier of the host to be created. It will be created within the
            account of the host factory.
          type: string
          example: my-new-host
        annotations:
          description: Annotations to apply to the new host
          type: object
          example:
            description: new db host
            puppet: 'true'
      required:
        - id
      example:
        id: new-host
    CertificateAuthorityGetSignedCertificateRequest:
      type: object
      properties:
        csr:
          type: string
        ttl:
          type: string
      required:
        - csr
        - ttl
    AuthenticationObtainAccessTokenResponse:
      type: string
    StatusGetClientInfoResponse:
      description: Information about the client making a request
      type: object
      properties:
        client_ip:
          description: >-
            The request client IP address as determined by Conjur. This same IP
            address appears in application logs and audit logs.
          type: string
          example: 127.0.0.1
        user_agent:
          description: The incoming request HTTP user agent header.
          type: string
          example: >-
            Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36
            (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
        account:
          description: The account attribute of the client provided access token.
          type: string
          example: dev
        username:
          description: The username attribute of the provided access token.
          type: string
          example: admin
        token_issued_at:
          description: >-
            The issued timestamp, that is, when the provided access token was
            created (iat field in the JWT)
          type: string
          example: '2017-08-04T22:27:20+00:00'
    StatusCheckAuthenticatorConfigurationResponse:
      type: object
      properties:
        status:
          description: The status of the endpoint, 'error' if there was an error
          type: string
          example: error
        error:
          description: The error message if there was an error
          type: string
          example: >-
            #<Errors::Authentication::AuthenticatorNotFound: CONJ00001E
            Authenticator 'authn-oidc' is not implemented in Conjur>
      required:
        - status
    StatusAuthenticatorDetailsResponse:
      type: object
      properties:
        installed:
          description: The authenticators installed on the Conjur server
          type: array
          items:
            type: string
          example:
            - authn
        configured:
          description: The authenticators configured on the Conjur server
          type: array
          items:
            type: string
          example:
            - authn
        enabled:
          description: The authenticators enabled on the Conjur server
          type: array
          items:
            type: string
          example:
            - authn
    StatusCheckConjurHealthResponse:
      type: object
      properties: {}
      example: {}
    StatusCheckRemoteHealthResponse:
      type: object
      properties: {}
      example: {}
    StatusConjurServerInfoResponse:
      type: object
      properties:
        version:
          type: string
        authenticators:
          type: object
          properties:
            installed:
              type: array
              items:
                type: string
            configured:
              type: array
              items:
                type: string
            enabled:
              type: array
              items:
                type: string
        configuration:
          type: object
        role:
          type: string
        container:
          type: string
        release:
          type: string
        services:
          type: object
    SecretsGetSecretValueResponse:
      type: string
      example: supersecret
    SecretsGetMultipleValuesResponse:
      type: object
      example:
        myorg:variable:secret1: secret1Value
        myorg:variable:secret2: secret2Value
    SecretsGetMultipleValues406Response:
      type: object
      properties: {}
      example: {}
    PoliciesModifyPolicyResponse:
      type: object
      properties:
        version:
          type: number
        created_roles:
          type: object
      example:
        version: 1
        created_roles:
          myorg:host:database/db-host:
            id: myorg:host:database/db-host
            api_key: 309yzpa1n5kp932waxw6d37x4hew2x8ve8w11m8xn92acfy672m929en
    RolesGetRoleInformationResponse:
      type: object
      example:
        created_at: 2020-12-31:12:34:56.789+00:00
        id: myorg:user:admin
        members: []
    ResourcesListResponse:
      type: array
      items:
        $ref: >-
          #/paths/~1resources~1%7Baccount%7D~1%7Bkind%7D~1%7Bidentifier%7D/get/responses/200/content/application~1json/schema
      example:
        - annotations: []
          created_at: '2021-03-23T16:37:14.455+00:00'
          id: dev:policy:conjur/authn-ldap/test
          owner: dev:user:admin
          permissions: []
          policy: dev:policy:root
          policy_versions: []
    ResourcesShowResourceDetailsResponse:
      type: object
      properties:
        created_at:
          type: string
        id:
          type: string
        owner:
          type: string
        permissions:
          type: array
          items:
            type: object
            properties:
              privilege:
                type: string
              role:
                type: string
              policy:
                type: string
        policy:
          type: string
        annotations:
          type: array
          items:
            type: string
        secrets:
          type: array
          items:
            type: object
            properties:
              version:
                type: number
              expires_at:
                type: string
        restricted_to:
          type: array
          items:
            type: string
        policy_versions:
          type: array
          items:
            type: object
            properties:
              version:
                type: number
              created_at:
                type: string
              policy_text:
                type: string
              policy_sha256:
                type: string
              finished_at:
                type: string
              client_ip:
                type: string
              id:
                type: string
              role:
                type: string
            example:
              version: 15
              client_ip: 172.19.0.6
              created_at: '2021-03-23T16:37:09.250+00:00'
              finished_at: '2021-03-23T16:37:09.435+00:00'
              id: dev:policy:root
              policy_sha256: 73d7b43ab17d69d163dedfaac88ec02a9c18ed8675abe4fe5643cd33470baf86
              policy_text: |
                - !variable one/password
                - !variable testSecret
              role: dev:user:admin
      example:
        annotations: []
        created_at: '2021-03-23T16:37:14.455+00:00'
        id: dev:policy:conjur/authn-ldap/testX
        owner: dev:user:admin
        permissions: []
        policy: dev:policy:root
        policy_versions: []
    HostFactoryCreateHostIdentityTokensResponse:
      type: array
      items:
        type: object
        properties:
          expiration:
            type: string
          cidr:
            type: array
            items:
              type: string
          token:
            type: string
        required:
          - expiration
          - cidr
          - token
      example:
        - expiration: '2017-08-04T22:27:20+00:00'
          cidr:
            - 127.0.0.1/32
            - 127.0.0.2/32
          token: 281s2ag1g8s7gd2ezf6td3d619b52t9gaak3w8rj0p38124n384sq7x
        - expiration: '2017-08-04T22:27:20+00:00'
          cidr:
            - 127.0.0.1/32
            - 127.0.0.2/32
          token: 2c0vfj61pmah3efbgpcz2x9vzcy1ycskfkyqy0kgk1fv014880f4
    HostFactoryCreateHostResponse:
      description: Contains information about a created host
      type: object
      properties:
        created_at:
          type: string
        id:
          type: string
        owner:
          type: string
        permissions:
          type: array
          items:
            type: string
        annotations:
          type: array
          items:
            type: string
        api_key:
          type: string
      required:
        - created_at
        - id
        - api_key
        - owner
        - permissions
        - annotations
      example:
        created_at: '2017-08-07T22:30:00.145+00:00'
        id: myorg:host:brand-new-host
        owner: myorg:host_factory:hf-db
        permissions: []
        annotations: []
        api_key: rq5bk73nwjnm52zdj87993ezmvx3m75k3whwxszekvmnwdqek0r
    PublicKeysShowAllForResourceResponse:
      type: string
    CertificateAuthorityGetSignedCertificateResponse:
      type: object
      properties:
        certificate:
          type: string
    CertificateAuthorityGetSignedCertificate201Response:
      type: string
      format: base64
  securitySchemes:
    basicAuth:
      description: |
        Basic authentication with Conjur username and password (users only)
        or API key (hosts and users).
      type: http
      scheme: basic
    conjurAuth:
      description: Conjur access token in `Token token=<base64_encoded_token>` format.
      type: apiKey
      in: header
      name: Authorization
    conjurKubernetesMutualTls:
      description: |
        Conjur Kubernetes authenticator mutual TLS authentication.
        To authenticate using this method, you must provide a trusted client
        certificate
      type: http
      scheme: mutual
security:
  - basicAuth: []
  - conjurAuth: []
  - conjurKubernetesMutualTls: []
externalDocs:
  description: Find out more about Conjur
  url: https://conjur.org