openapi: 3.0.3 info: title: Identity API description: >- The Identity API provides an OIDC compliant interface for use with all official and 3rd party services and proxies. As its intended use is for multi-tenant cloud deployments, it acts as an aggregation layer for other 3rd party OIDC services, dispatching login requests to the required OIDC backend. Token introspection forms the basis of role based access control across all APIs. For security purposes, access tokens and refresh tokens are limited to a single session per client, thus if they are being consumed by a horizontally scalable platform care must be taken to ensure token rotation is handled atomically by a single process, and the tokens are distributed to each service instance synchronously. version: 1.13.0 paths: /api/version: description: Service build version information. get: summary: Get the deployed service version description: |- Returns the build version stamped into the running binary at release time, allowing clients and CI gates to verify exactly which release is deployed. tags: - Version security: - oauth2Authentication: [] responses: "200": $ref: "#/components/responses/serviceVersionResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" /api/v1/organizations: description: |- Allows management of organizations. An organization may use ad hoc authentication, where users select their identity provider manually, or domain based authentication where, provided with an email address, the domain is matched against the organization and the identity provider implicitly selected. Domain based authentication allows integration with user provided OIDC compliant identity services. get: description: >- Returns a list of organizations that the user is a member of. If an email address is provided in the query this allows a user with sufficient privilege to check if a given user is a member of any organizations. The include parameter adds quotas or a visible project count to each organization that the caller can inspect. Rows that the caller cannot inspect omit the extra. summary: List organizations tags: - Organizations security: - oauth2Authentication: [] parameters: - $ref: "#/components/parameters/userEmailParameter" - $ref: "#/components/parameters/organizationListIncludeParameter" responses: "200": $ref: "#/components/responses/organizationsResponse" "400": $ref: "#/components/responses/badRequestResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "404": $ref: "#/components/responses/notFoundResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" /api/v1/organizations/{organizationID}: description: |- Allows management of organizations. An organization may use ad hoc authentication, where users select their identity provider manually, or domain based authentication where, provided with an email address, the domain is matched against the organization and the identity provider implicitly selected. Domain based authentication allows integration with user provided OIDC compliant identity services. parameters: - $ref: "#/components/parameters/organizationIDParameter" get: description: Get an organization. summary: Get organization tags: - Organizations security: - oauth2Authentication: [] responses: "200": $ref: "#/components/responses/organizationResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" put: description: Update an organization. summary: Update organization tags: - Organizations security: - oauth2Authentication: [] requestBody: $ref: "#/components/requestBodies/updateOrganizationRequest" responses: "200": description: Organization successfully updated and returned. "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "409": $ref: "#/components/responses/conflictResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" /api/v1/organizations/{organizationID}/serviceaccounts: description: >- Allows management of service accounts. Service accounts provide long-lived access tokens for use with CLI and CI/CD tooling. At present a service account token defaults to a 90 day lifetime. Service tokens can be refreshed with an API call. parameters: - $ref: "#/components/parameters/organizationIDParameter" get: description: Lists all service accounts. summary: List service accounts tags: - Service accounts security: - oauth2Authentication: [] responses: "200": $ref: "#/components/responses/serviceAccountsResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" post: description: >- Creates a new service account and returns an access token, The returned access token can only be read once. summary: Create service account tags: - Service accounts security: - oauth2Authentication: [] requestBody: $ref: "#/components/requestBodies/serviceAccountCreateRequest" responses: "201": $ref: "#/components/responses/serviceAccountCreateResponse" "400": $ref: "#/components/responses/badRequestResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" /api/v1/organizations/{organizationID}/serviceaccounts/{serviceAccountID}: description: >- Allows management of service accounts. Service accounts provide long-lived access tokens for use with CLI and CI/CD tooling. At present a service account token defaults to a 90 day lifetime. Service tokens can be refreshed with an API call. parameters: - $ref: "#/components/parameters/organizationIDParameter" - $ref: "#/components/parameters/serviceAccountIDParameter" put: description: Updates a service account. summary: Update service account tags: - Service accounts security: - oauth2Authentication: [] requestBody: $ref: "#/components/requestBodies/serviceAccountCreateRequest" responses: "200": $ref: "#/components/responses/serviceAccountResponse" "400": $ref: "#/components/responses/badRequestResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "404": $ref: "#/components/responses/notFoundResponse" "409": $ref: "#/components/responses/conflictResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" delete: description: Removes a service account and revokes an access token. summary: Delete service account tags: - Service accounts security: - oauth2Authentication: [] responses: "200": description: Service account removed and access token revoked. "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "404": $ref: "#/components/responses/notFoundResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" /api/v1/organizations/{organizationID}/serviceaccounts/{serviceAccountID}/rotate: description: >- Allows management of service accounts. Service accounts provide long-lived access tokens for use with CLI and CI/CD tooling. At present a service account token defaults to a 90 day lifetime. Service tokens can be refreshed with an API call. parameters: - $ref: "#/components/parameters/organizationIDParameter" - $ref: "#/components/parameters/serviceAccountIDParameter" post: description: |- Rotates a service account's access token. The returned access token can only be read once. summary: Rotate service account token tags: - Service accounts security: - oauth2Authentication: [] responses: "200": $ref: "#/components/responses/serviceAccountCreateResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "404": $ref: "#/components/responses/notFoundResponse" "409": $ref: "#/components/responses/conflictResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" /api/v1/organizations/{organizationID}/users: description: Allows management of users. parameters: - $ref: "#/components/parameters/organizationIDParameter" get: description: Lists all users. summary: List users tags: - Users security: - oauth2Authentication: [] responses: "200": $ref: "#/components/responses/usersResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" post: description: Creates a new user and associates with a set of groups. summary: Create user tags: - Users security: - oauth2Authentication: [] requestBody: $ref: "#/components/requestBodies/userCreateRequest" responses: "201": $ref: "#/components/responses/userResponse" "400": $ref: "#/components/responses/badRequestResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "409": $ref: "#/components/responses/conflictResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" /api/v1/organizations/{organizationID}/users/{userID}: description: Allows management of users. parameters: - $ref: "#/components/parameters/organizationIDParameter" - $ref: "#/components/parameters/userIDParameter" put: description: Updates a user. summary: Update user tags: - Users security: - oauth2Authentication: [] requestBody: $ref: "#/components/requestBodies/userCreateRequest" responses: "200": $ref: "#/components/responses/userResponse" "400": $ref: "#/components/responses/badRequestResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "404": $ref: "#/components/responses/notFoundResponse" "409": $ref: "#/components/responses/conflictResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" delete: description: Deletes a user and disassociates them with all groups they are a member of. summary: Delete user tags: - Users security: - oauth2Authentication: [] responses: "200": description: User removed and all groups disassociated with the user. "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "404": $ref: "#/components/responses/notFoundResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" /api/v1/organizations/{organizationID}/roles: description: |- Allows management of roles that define access control permissions for users that are linked to them via a group. parameters: - $ref: "#/components/parameters/organizationIDParameter" get: description: >- Returns non-protected roles visible in the organization. Each role reports whether the calling principal may grant it via its `grantable` flag; roles the caller cannot grant are still returned so they can be resolved and displayed. summary: List roles tags: - Roles security: - oauth2Authentication: [] responses: "200": $ref: "#/components/responses/rolesResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" /api/v1/organizations/{organizationID}/groups: description: >- Allows management of organization groups. Groups bind users and service accounts to roles and allow those users to perform API requests as defined by those roles. Groups are then typically linked to projects that grant the users the ability to perform project scoped operations, such as provisioning infrastructure. parameters: - $ref: "#/components/parameters/organizationIDParameter" get: description: Returns a list of groups that are defined for the organization. summary: List groups tags: - Groups security: - oauth2Authentication: [] responses: "200": $ref: "#/components/responses/groupsResponse" "400": $ref: "#/components/responses/badRequestResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" post: description: Allows creation of a new group. summary: Create group tags: - Groups security: - oauth2Authentication: [] requestBody: $ref: "#/components/requestBodies/createGroupRequest" responses: "201": $ref: "#/components/responses/groupResponse" "400": $ref: "#/components/responses/badRequestResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "404": $ref: "#/components/responses/notFoundResponse" "409": $ref: "#/components/responses/conflictResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" /api/v1/organizations/{organizationID}/groups/{groupid}: description: >- Allows management of organization groups. Groups bind users and service accounts to roles and allow those users to perform API requests as defined by those roles. Groups are then typically linked to projects that grant the users the ability to perform project scoped operations, such as provisioning infrastructure. parameters: - $ref: "#/components/parameters/organizationIDParameter" - $ref: "#/components/parameters/groupidParameter" get: description: Allows a single group to be polled. summary: Get group tags: - Groups security: - oauth2Authentication: [] responses: "200": $ref: "#/components/responses/groupResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "404": $ref: "#/components/responses/notFoundResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" put: description: Allows a group to be updated. summary: Update group tags: - Groups security: - oauth2Authentication: [] requestBody: $ref: "#/components/requestBodies/updateGroupRequest" responses: "200": description: Group successfully updated and returned. "400": $ref: "#/components/responses/badRequestResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "404": $ref: "#/components/responses/notFoundResponse" "409": $ref: "#/components/responses/conflictResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" delete: description: Allows the deletion of an existing group. summary: Delete group tags: - Groups security: - oauth2Authentication: [] responses: "200": description: Group successfully deleted. "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "404": $ref: "#/components/responses/notFoundResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" /api/v1/organizations/{organizationID}/projects: description: >- Implements project management services. Projects are associated with user groups, and provide project-scoped role-based access control. Infrastructure provisioning, for example the Compute and Kubernetes services, occurs within a project. parameters: - $ref: "#/components/parameters/organizationIDParameter" get: description: List all projects for the organization. summary: List projects tags: - Projects security: - oauth2Authentication: [] responses: "200": $ref: "#/components/responses/projectsResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" post: description: Creates a new project resource for the user's organization. summary: Create project tags: - Projects security: - oauth2Authentication: [] requestBody: $ref: "#/components/requestBodies/createProjectRequest" responses: "202": $ref: "#/components/responses/projectResponse" "400": $ref: "#/components/responses/badRequestResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "409": $ref: "#/components/responses/conflictResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" /api/v1/organizations/{organizationID}/projects/{projectID}: description: >- Implements project management services. Projects are associated with user groups, and provide project-scoped role-based access control. Infrastructure provisioning, for example the Compute and Kubernetes services, occurs within a project. parameters: - $ref: "#/components/parameters/organizationIDParameter" - $ref: "#/components/parameters/projectIDParameter" get: description: Gets a project. summary: Get project tags: - Projects security: - oauth2Authentication: [] responses: "200": $ref: "#/components/responses/projectResponse" "400": $ref: "#/components/responses/badRequestResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "404": $ref: "#/components/responses/notFoundResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" put: description: Updates a project. summary: Update project tags: - Projects security: - oauth2Authentication: [] requestBody: $ref: "#/components/requestBodies/updateProjectRequest" responses: "200": description: Project successfully updated. "400": $ref: "#/components/responses/badRequestResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "404": $ref: "#/components/responses/notFoundResponse" "409": $ref: "#/components/responses/conflictResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" delete: description: |- Deletes the project associated with the authenticated user's scoped authorization token. This is a cascading operation and will delete all contained cluster managers and clusters. summary: Delete project tags: - Projects security: - oauth2Authentication: [] responses: "202": $ref: "#/components/responses/acceptedResponse" "400": $ref: "#/components/responses/badRequestResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "404": $ref: "#/components/responses/notFoundResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" /api/v1/organizations/{organizationID}/quotas: description: >- Provides management of resource limits. These are typically managed by the platform provider and limit the amount of resources an organization can consume. Quotas provide fair usage on multi-tenant platforms, and can be used to limit operational expenditure. Quotas currently apply to the organization as a whole, and cannot be subdivided among projects. parameters: - $ref: "#/components/parameters/organizationIDParameter" get: description: Gets quotas for the organization. summary: List quotas tags: - Quotas security: - oauth2Authentication: [] responses: "200": $ref: "#/components/responses/quotasResponse" "401": $ref: "#/components/responses/unauthorizedResponse" "403": $ref: "#/components/responses/forbiddenResponse" "500": $ref: "#/components/responses/internalServerErrorResponse" components: parameters: organizationIDParameter: name: organizationID in: path description: An organization ID. required: true schema: $ref: "#/components/schemas/organizationId" serviceAccountIDParameter: name: serviceAccountID in: path description: A service account ID. required: true schema: $ref: "#/components/schemas/serviceAccountId" userIDParameter: name: userID in: path description: A user ID. required: true schema: $ref: "#/components/schemas/userId" projectIDParameter: name: projectID in: path description: A project ID. required: true schema: $ref: "#/components/schemas/projectId" groupidParameter: name: groupid in: path description: A unique group ID. required: true schema: $ref: "#/components/schemas/groupId" oauth2ProvderIDParameter: name: providerID in: path description: An oauth2 provider ID. required: true schema: $ref: "#/components/schemas/oauth2ProviderId" allocationIDParameter: name: allocationID in: path description: A resource allocation ID. required: true schema: $ref: "#/components/schemas/allocationId" userEmailParameter: name: email in: query description: A user's email address. schema: type: string organizationListIncludeParameter: name: include in: query description: |- Extra data to return for each organization. Repeat the parameter for each value (?include=quotas&include=projectsCount). A comma-separated list returns 400. Each value appears only where the caller can read it. An organization that the caller cannot inspect keeps its base fields and omits the extra. style: form explode: true schema: type: array items: type: string enum: - quotas - projectsCount referenceParameter: name: reference in: path description: A resource reference. required: true schema: type: string schemas: organizationId: description: An organization ID. type: string format: uuid projectId: description: A project ID. type: string format: uuid serviceAccountId: description: A service account ID. type: string format: uuid userId: description: A user ID. type: string format: uuid groupId: description: A group ID. type: string format: uuid oauth2ProviderId: description: An OAuth2 provider ID. type: string format: uuid allocationId: description: A resource allocation ID. type: string format: uuid oauth2Error: description: Generic error message, compatible with oauth2. type: object required: - error - error_description properties: error: description: A terse error string expanding on the HTTP error code. Errors are based on the OAuth 2.02 specification, but are expanded with proprietary status codes for APIs other than those specified by OAuth 2.02. type: string enum: - invalid_request - unauthorized_client - access_denied - unsupported_response_type - invalid_scope - server_error - temporarily_unavailable - invalid_client - invalid_grant - unsupported_grant_type error_description: description: Verbose message describing the error. type: string openidConfiguration: description: OpenID configuration. type: object required: - issuer - authorization_endpoint - token_endpoint - userinfo_endpoint - jwks_uri - scopes_supported - claims_supported - response_types_supported - response_modes_supported - token_endpoint_auth_methods_supported - grant_types_supported - id_token_signing_alg_values_supported - code_challenge_methods_supported - claims_parameter_supported - request_parameter_supported - request_uri_parameter_supported properties: issuer: description: The OpenID Issuer (iss field). type: string authorization_endpoint: description: The OAuth 2.0 endpoint that initiates authentication. type: string format: uri token_endpoint: description: The OAuth 2.0 endpoint that is used to exchange an authentication code for tokens. type: string format: uri userinfo_endpoint: description: The OIDC endpoint used to get information about an access token's user. type: string format: uri jwks_uri: description: The endpoint that exposes public signing keys for token validation. type: string format: uri scopes_supported: description: A list of supported OAuth 2.0 scopes. type: array items: $ref: "#/components/schemas/scope" claims_supported: description: A list of supported claims type: array items: $ref: "#/components/schemas/claim" response_types_supported: description: A list of supported response types that can be requested for the authorization endpoint. type: array items: $ref: "#/components/schemas/responseType" response_modes_supported: description: A list of supported response modes. type: array items: $ref: "#/components/schemas/responseMode" token_endpoint_auth_methods_supported: description: A list of supported authentication methods for the token endpoint. type: array items: $ref: "#/components/schemas/authMethod" grant_types_supported: description: A list of supported grants for the token endpoint. type: array items: $ref: "#/components/schemas/grantType" id_token_signing_alg_values_supported: description: A list of signing algorithms supported for ID tokens. type: array items: $ref: "#/components/schemas/signingAlgorithm" code_challenge_methods_supported: description: A list of code challenge methods supported. type: array items: $ref: "#/components/schemas/codeChallengeMethod" claims_parameter_supported: description: Whether claims can be requested individually. type: boolean request_parameter_supported: description: Whether requests can be passed as a JWT object. type: boolean request_uri_parameter_supported: description: Whether requests can be passed via a URI. type: boolean scope: description: Supported scopes. type: string enum: - openid - email - profile claim: description: Supported claims. type: string enum: - aud - email - email_verified - exp - family_name - given_name - iat - iss - locale - name - picture - sub responseType: description: Supported response types. type: string enum: - code - token - id_token - code token - code id_token - token id_token - code token id_token - none responseMode: description: Supported response modes. type: string enum: - query - fragment authMethod: description: Supported authentication methods. type: string enum: - client_secret_post - client_secret_basic - tls_client_auth grantType: description: Supported grant type. type: string enum: - authorization_code - client_credentials - refresh_token - urn:ietf:params:oauth:grant-type:token-exchange signingAlgorithm: description: Supported signing algorithms. type: string enum: - ES512 codeChallengeMethod: description: Supported code challenge methods. type: string enum: - S256 - plain loginRequestOptions: description: Login request options. type: object required: - state properties: email: description: The user's email address. type: string nullable: true provider: description: The explicit provider type. type: string nullable: true state: description: The state string supplied by the authorization endpoint. type: string authorizationRequestOptions: description: OAuth 2.0/OIDC authorization endpoint request. type: object required: - response_type - client_id - redirect_uri properties: response_type: $ref: "#/components/schemas/responseType" client_id: description: The client identifier. type: string redirect_uri: description: The registered callback address. type: string scope: description: Authorization scope. type: string nullable: true state: description: Client state information. type: string nullable: true nonce: description: OIDC nonce. type: string nullable: true max_age: description: Max age of the login. type: string nullable: true display: description: How to display the login prompt. type: string nullable: true prompt: description: OIDC prompt. type: string nullable: true ui_locales: description: Language options. type: string nullable: true id_token_hint: description: A previously issued ID token. type: string nullable: true login_hint: description: A login hint e.g. user name. type: string nullable: true acr_values: description: Requested content class reference values. type: string nullable: true userinfoRequestOptions: description: A userinfo POST request. type: object properties: access_token: description: The oauth2 access token. type: string tokenRequestOptions: description: OAuth 2.0 token request. type: object required: - grant_type properties: grant_type: description: >- Supported grant type. One of "authorization_code", "refresh_token", "client_credentials", or "urn:ietf:params:oauth:grant-type:token-exchange" (RFC 8693). type: string code: description: Authorization code. Required with the "authorization_code" grant type. type: string nullable: true client_id: description: Client ID. Required with the "authorization_code" and "refresh_token" grant types. type: string nullable: true client_secret: description: Client secret. Required with the "authorization_code" and "refresh_token" grant types. type: string nullable: true redirect_uri: description: Client redirect URI. Required with the "authorization_code" grant type. type: string nullable: true code_verifier: description: Client code verifier. type: string nullable: true refresh_token: description: A refresh token for the "refresh_token" grant type. type: string nullable: true subject_token: description: >- The security token that represents the identity of the party on behalf of whom the request is being made. Required for the token-exchange grant (RFC 8693 section 2.1). type: string nullable: true subject_token_type: description: |- An identifier that indicates the type of the security token in the "subject_token" parameter. Required for the token-exchange grant (RFC 8693 section 2.1). type: string nullable: true requested_token_type: description: >- An identifier for the type of the requested security token. Optional for the token-exchange grant; defaults to the implementation-defined exchanged token type URI when omitted (RFC 8693 section 2.1). type: string nullable: true audience: description: >- The logical name of the target service where the client intends to use the requested security token. Optional for the token-exchange grant (RFC 8693 section 2.1). type: string nullable: true resource: description: |- A URI that indicates the target service or resource where the client intends to use the requested security token. Optional for the token-exchange grant (RFC 8693 section 2.1). type: string nullable: true scope: description: |- A list of space-delimited, case-sensitive strings that specify the requested scope of the issued token. Optional for the token-exchange grant (RFC 8693 section 2.1). type: string nullable: true x_organization_id: description: |- Optional organization context to scope the issued token ACL to. Used with the token-exchange grant. type: string nullable: true x_project_id: description: |- Optional project context to include in the issued token. Used with the token-exchange grant. type: string nullable: true token: description: OAuth 2.0 token result. type: object required: - token_type - access_token - expires_in properties: token_type: description: >- How the issued token is to be presented to the resource server. Typically "Bearer". For the RFC 8693 token-exchange grant this is "Bearer" when the issued JWT is presented in the Authorization header of downstream requests. type: string access_token: description: >- The issued token. For the token-exchange grant this carries the signed JWT returned by the exchange (RFC 8693 section 2.2.1 defines "access_token" as the response envelope for any issued security token). type: string issued_token_type: description: |- An identifier for the representation of the issued security token. Required for the token-exchange grant; omitted for other grant types (RFC 8693 section 2.2.1). type: string refresh_token: description: The opaque refresh token. type: string id_token: description: An OIDC ID token. type: string expires_in: description: The time in seconds the token will last for. type: integer authClaims: description: Custom claims for authorisation, specific to UNI required: - acctype - orgIds properties: acctype: description: Denotes the type of account represented. This is non-standard claim. type: string enum: - system - service - user orgIds: description: > The IDs of organisations of which the account is a member. This may be just the org for which they are currently authenticated. type: array items: description: An organisation ID. type: string userinfo: description: Access token introspection data. type: object required: - sub properties: https://unikorn-cloud.org/authz: $ref: "#/components/schemas/authClaims" sub: description: The access token's subject. type: string email: description: The user's email address. type: string email_verified: description: Whether the email address has been verified. type: boolean name: description: The user's full name. type: string given_name: description: The user's forename. type: string family_name: description: The user's surname. type: string middle_name: description: The user's middle name(s). type: string nickname: description: The user's nickname. type: string preferred_username: description: How the user chooses to be addressed. type: string profile: description: URL to the user's profile page. type: string picture: description: URL to the user's picture. type: string website: description: URL to the user's website. type: string gender: description: The user's gender. type: string birthdate: description: The users' birth date formatted according to ISO8601. The year portion may be 0000 if they choose not to reveal they are really old. type: string format: date-time zoneinfo: description: The user's IANA assigned timezone. type: string locale: description: The user's RFC5646 language tag. type: string updated_at: description: Then the user's profile was last updated. type: string jsonWebKeySet: description: >- JSON web key set. This data type is defined by an external 3rd party standards committee. Consult the relevant documentation for further details. type: object properties: keys: type: array items: $ref: "#/components/schemas/jsonWebKey" jsonWebKey: description: JSON web key. See the relevant JWKS documentation for further details. type: object items: description: JSON web key. type: object oauth2ProviderType: description: The type of identity provider. type: string enum: - google - microsoft - github oauth2ProviderSpec: description: An OAuth 2.0 provider. type: object required: - issuer - clientID properties: type: $ref: "#/components/schemas/oauth2ProviderType" issuer: description: The OIDC issuer, typically where to perform auto discovery relative to. type: string clientID: description: | The client identification. type: string clientSecret: description: | The client secret. type: string systemOauth2ProviderRead: description: An OAuth 2.0 provider when read. type: object required: - metadata - spec properties: metadata: $ref: "#/components/schemas/resourceReadMetadata" spec: $ref: "#/components/schemas/oauth2ProviderSpec" oauth2ProviderRead: description: An OAuth 2.0 provider when read. type: object required: - metadata - spec properties: metadata: $ref: "#/components/schemas/organizationScopedResourceReadMetadata" spec: $ref: "#/components/schemas/oauth2ProviderSpec" oauth2ProviderWrite: description: An OAuth 2.0 provider when created or updated. type: object required: - metadata - spec properties: metadata: $ref: "#/components/schemas/resourceMetadata" spec: $ref: "#/components/schemas/oauth2ProviderSpec" systemOauth2Providers: description: A list of system provided OAuth 2.0 providers. type: array items: $ref: "#/components/schemas/systemOauth2ProviderRead" oauth2Providers: description: A list of OAuth 2.0 providers. type: array items: $ref: "#/components/schemas/oauth2ProviderRead" organizationType: description: >- Describes the authentication method of the organization. Ad hoc authentication means that users are exclusively added via explicit group membership And must use a 'sign-in via' option. Domain authentication means that users may login via their email address, must in the case of custom identity providers, that maps from domain to an identity provider. type: string enum: - adhoc - domain providerScope: description: >- Describes how to lookup the provider, when "global", use a built in generic provider e.g. Google/Microsoft, when "organization", use an organization scoped provider. type: string enum: - global - organization organizationSpec: description: An organization. type: object required: - organizationType properties: organizationType: $ref: "#/components/schemas/organizationType" domain: description: The email domain of the organization. type: string format: hostname providerScope: $ref: "#/components/schemas/providerScope" providerID: description: >- The ID of the provider to use, the scope is determined by useCustomProvider. If false, this refers to a built in provider, if true, then to an organization specific one. type: string googleCustomerID: description: >- When set this identifies the customer ID for the google managed organization. This field is currently unused. type: string organizationRead: description: An organization when read. type: object required: - metadata - spec properties: metadata: $ref: "#/components/schemas/resourceReadMetadata" spec: $ref: "#/components/schemas/organizationSpec" quotas: description: |- The quotas of the organization, as GET /api/v1/organizations/{id}/quotas returns them. Present only on the organization list, when include names quotas and the caller has organization-scope read on identity:quotas. allOf: - $ref: "#/components/schemas/quotaReadList" quotasError: description: |- Present instead of quotas when include names quotas, the caller can read the quotas, and the quota data of the organization does not render. The value is a short generic reason. type: string projectsCount: description: |- The number of projects in the organization that the caller can see. Present only on the organization list, when include names projectsCount and the caller can see projects in this organization. type: integer organizationWrite: description: An organization when created or updated. type: object required: - metadata - spec properties: metadata: $ref: "#/components/schemas/resourceMetadata" spec: $ref: "#/components/schemas/organizationSpec" organizations: description: A list of organizations. type: array items: $ref: "#/components/schemas/organizationRead" aclOperation: description: An access control operation. type: string enum: - create - read - update - delete aclOperations: description: A list of access control operations. type: array items: $ref: "#/components/schemas/aclOperation" aclEndpoint: description: A set of access control permissions for a resource type. type: object required: - name - operations properties: name: description: The resource name type: string operations: $ref: "#/components/schemas/aclOperations" aclEndpoints: description: A list of access control scopes. type: array items: $ref: "#/components/schemas/aclEndpoint" aclProject: description: A project the subject is a member of. type: object required: - id - endpoints properties: id: description: The project ID. type: string endpoints: $ref: "#/components/schemas/aclEndpoints" aclProjectList: description: A list of projects the subject is a member of. type: array items: $ref: "#/components/schemas/aclProject" aclOrganization: description: An organization the subject is a member of. type: object required: - id properties: id: description: The organization ID. type: string endpoints: $ref: "#/components/schemas/aclEndpoints" projects: $ref: "#/components/schemas/aclProjectList" aclOrganizationList: description: A list of organizations the subject is a member of. type: array items: $ref: "#/components/schemas/aclOrganization" acl: description: A list of access control scopes and permissions. type: object properties: global: $ref: "#/components/schemas/aclEndpoints" organizations: $ref: "#/components/schemas/aclOrganizationList" organization: $ref: "#/components/schemas/aclOrganization" projects: $ref: "#/components/schemas/aclProjectList" stringList: description: A list of strings. type: array items: description: An arbitrary string. type: string roleRead: description: A role. type: object required: - metadata - grantable properties: metadata: $ref: "#/components/schemas/resourceReadMetadata" grantable: description: |- Whether the calling principal holds every permission in this role and may therefore grant it to groups. Roles with grantable set to false are returned so clients can resolve and display them — for example a role a group already carries — but this caller cannot grant them: adding one to a group is refused. Roles already on a group are exempt: re-sending one is accepted, and omitting one removes it, whether or not the caller could grant it. type: boolean roles: description: A list of roles. type: array items: $ref: "#/components/schemas/roleRead" subject: description: A user account, as described when member of a group. type: object required: - id - issuer properties: id: description: The identitifier for this subject, given by the issuer. type: string email: description: An email for the user, if supplied by the issuer. type: string issuer: description: The issuer URL. type: string groupSpec: description: A group. type: object required: - serviceAccountIDs - roleIDs properties: subjects: description: list of subjects that are assigned to this group type: array items: $ref: "#/components/schemas/subject" userIDs: $ref: "#/components/schemas/stringList" serviceAccountIDs: $ref: "#/components/schemas/stringList" roleIDs: $ref: "#/components/schemas/stringList" groupRead: description: A group when read. type: object required: - metadata - spec properties: metadata: $ref: "#/components/schemas/organizationScopedResourceReadMetadata" spec: $ref: "#/components/schemas/groupSpec" groupWrite: description: A group when created or updated. type: object required: - metadata - spec properties: metadata: $ref: "#/components/schemas/resourceMetadata" spec: $ref: "#/components/schemas/groupSpec" groups: description: A list of groups. type: array items: $ref: "#/components/schemas/groupRead" groupIDs: description: A list of group IDs. type: array items: description: A group ID. type: string projectSpec: description: A project. type: object required: - groupIDs properties: groupIDs: $ref: "#/components/schemas/groupIDs" projectRead: description: A project when read. type: object required: - metadata - spec properties: metadata: $ref: "#/components/schemas/organizationScopedResourceReadMetadata" spec: $ref: "#/components/schemas/projectSpec" projectWrite: description: A project when created or updated. type: object required: - metadata - spec properties: metadata: $ref: "#/components/schemas/resourceMetadata" spec: $ref: "#/components/schemas/projectSpec" projects: description: A list of projects. type: array items: $ref: "#/components/schemas/projectRead" serviceAccountSpec: description: A service account specification. type: object required: - groupIDs properties: groupIDs: $ref: "#/components/schemas/groupIDs" serviceAccountStatus: description: A service account status. type: object required: - expiry properties: expiry: description: When the service token is due to expire. type: string format: date-time accessToken: description: A long lived access token that can be exchanged for an API access token. type: string serviceAccountCreate: description: A new service account. type: object required: - metadata - spec - status properties: metadata: $ref: "#/components/schemas/organizationScopedResourceReadMetadata" spec: $ref: "#/components/schemas/serviceAccountSpec" status: $ref: "#/components/schemas/serviceAccountStatus" serviceAccountRead: description: A service account. type: object required: - metadata - spec - status properties: metadata: $ref: "#/components/schemas/organizationScopedResourceReadMetadata" spec: $ref: "#/components/schemas/serviceAccountSpec" status: $ref: "#/components/schemas/serviceAccountStatus" serviceAccounts: description: A list of service accounts. type: array items: $ref: "#/components/schemas/serviceAccountRead" serviceAccountWrite: description: A service account creation request. type: object required: - metadata - spec properties: metadata: $ref: "#/components/schemas/resourceMetadata" spec: $ref: "#/components/schemas/serviceAccountSpec" userState: description: The state a user is in. type: string enum: - active - pending - suspended userSpec: description: A user specification. type: object required: - subject - state - groupIDs properties: subject: description: The user's canonical name, usually an email address. type: string state: $ref: "#/components/schemas/userState" groupIDs: $ref: "#/components/schemas/groupIDs" userStatus: description: Additional user metadata. type: object properties: lastActive: description: >- The last time a user performed some action. This is not guaranteed to be completely accurate depending on performance constraints. type: string format: date-time userRead: description: A user read object. type: object required: - metadata - spec - status properties: metadata: $ref: "#/components/schemas/organizationScopedResourceReadMetadata" spec: $ref: "#/components/schemas/userSpec" status: $ref: "#/components/schemas/userStatus" userWrite: description: A user create/update object. type: object required: - spec properties: metadata: $ref: "#/components/schemas/resourceMetadata" spec: $ref: "#/components/schemas/userSpec" users: description: A list of users. type: array items: $ref: "#/components/schemas/userRead" quotaMetadata: description: A single quota's metadata. type: object required: - name quotaMetadataRead: description: A list of quota metadata. type: array items: $ref: "#/components/schemas/quotaMetadata" quotaRead: description: A single quota. type: object required: - kind - quantity - used - free - committed - reserved - displayName - description - default - format properties: kind: description: The kind of resource. type: string quantity: description: The maximum amount of that resource. type: integer used: description: The amount of that resource that is used. type: integer free: description: The amount of that resource that is free. type: integer committed: description: The amount of that resource always in use. type: integer reserved: description: The amount of that resource that may be used e.g. autoscaled. type: integer displayName: description: The name that should be displayed to end users. type: string description: description: A verbose explanation of what the quota limits. type: string default: description: The default value of the quota. type: integer format: description: A hint for clients on how to format quota values. type: string enum: - decimal - binary quotaWrite: description: A single quota. type: object required: - kind - quantity properties: kind: description: The kind of resource. type: string quantity: description: The maximum amount of that resource. type: integer quotaReadList: description: A list of quotas. type: array items: $ref: "#/components/schemas/quotaRead" quotaWriteList: description: A list of quotas. type: array items: $ref: "#/components/schemas/quotaWrite" quotasRead: description: A list of quotas. type: object required: - quotas properties: quotas: $ref: "#/components/schemas/quotaReadList" quotasWrite: description: A list of quotas. type: object required: - quotas properties: quotas: $ref: "#/components/schemas/quotaWriteList" resourceAllocation: description: A single quota but taking into account dynamic allocation. type: object required: - kind - committed - reserved properties: kind: description: The kind of resource. type: string committed: description: The amount of that resource always in use. type: integer reserved: description: The amount of that resource that may be used e.g. autoscaled. type: integer resourceAllocationList: description: A list of quotas. type: array items: $ref: "#/components/schemas/resourceAllocation" allocationSpec: description: A set of resource allocations. type: object required: - kind - id - allocations properties: kind: description: The resource kind that owns this allocation. type: string id: description: The resource ID that owns this allocation. type: string allocations: $ref: "#/components/schemas/resourceAllocationList" allocationRead: description: An allocation of resources. type: object required: - metadata - spec properties: metadata: $ref: "#/components/schemas/projectScopedResourceReadMetadata" spec: $ref: "#/components/schemas/allocationSpec" allocations: description: A list of allocations. type: array items: $ref: "#/components/schemas/allocationRead" allocationWrite: description: An allocation of resources. type: object required: - metadata - spec properties: metadata: $ref: "#/components/schemas/resourceMetadata" spec: $ref: "#/components/schemas/allocationSpec" authorizationServerList: description: List of authorization servers that can grant access to the resource. type: array items: description: An authorization server's scheme and hostname. type: string scopeList: description: A set of OIDC scopes that are required for authorization. type: array items: type: string bearerMethod: description: Bearer token transport method type: string enum: - header - body - query bearerMethodList: description: A set of bearer token transport methods supported by the protected endpoint. type: array items: $ref: "#/components/schemas/bearerMethod" openidProtectedResource: description: OpenID athentication server discovery configuration. type: object required: - resource - authorization_servers - scopes_supported - bearer_methods_supported properties: resource: description: The protected resource's scheme and hostname. type: string authorization_servers: $ref: "#/components/schemas/authorizationServerList" scopes_supported: $ref: "#/components/schemas/scopeList" bearer_methods_supported: $ref: "#/components/schemas/bearerMethodList" serviceVersionRead: description: |- Build version information for the running service, stamped into the binary at release time. Developer builds report version 0.0.0. type: object required: - name - version properties: name: description: The service application name. type: string version: description: The service release version, e.g. v1.2.3. type: string error: description: Generic error message, compatible with oauth2. type: object required: - error - error_description properties: error: description: A terse error string expanding on the HTTP error code. Errors are based on the OAuth 2.02 specification, but are expanded with proprietary status codes for APIs other than those specified by OAuth 2.02. type: string enum: - invalid_request - server_error - access_denied - not_found - conflict - method_not_allowed - unsupported_media_type - request_entity_too_large - unprocessable_content - forbidden error_description: description: Verbose message describing the error. type: string trace_id: description: Unique trace identifier for the request. type: string kubernetesLabelValue: description: >- A valid Kubernetes label value, typically used for resource names that can be indexed in the database. type: string pattern: ^[0-9A-Za-z](?:[0-9A-Za-z-_.]{0,61}[0-9A-Za-z])?$ tag: description: >- A tag mapping arbitrary names to values. These have no special meaning for any component are are intended for use by end users to add additional context to a resource, for example to categorize it. type: object required: - name - value properties: name: description: A unique tag name. type: string value: description: The value of the tag. type: string tagList: description: A list of tags. type: array items: $ref: "#/components/schemas/tag" resourceMetadata: description: Metadata required for all API resource reads and writes. required: - name properties: name: $ref: "#/components/schemas/kubernetesLabelValue" description: description: The resource description, this optionally augments the name with more context. type: string tags: $ref: "#/components/schemas/tagList" staticResourceMetadata: description: | This metadata is for resources that just exist, and don't require any provisioning and health status, but benefit from a standardized metadata format. type: object allOf: - $ref: "#/components/schemas/resourceMetadata" - type: object required: - id - creationTime properties: id: description: The unique resource ID. type: string creationTime: description: The time the resource was created. type: string format: date-time createdBy: description: The user who created the resource. type: string modifiedTime: description: The time a resource was updated. type: string format: date-time modifiedBy: description: The user who updated the resource. type: string resourceProvisioningStatus: description: The provisioning state of a resource. type: string enum: - unknown - pending - provisioning - provisioned - deprovisioning - error resourceHealthStatus: description: The health state of a resource. type: string enum: - unknown - healthy - degraded - error resourceReadMetadata: description: Metadata required by all resource reads. allOf: - $ref: "#/components/schemas/staticResourceMetadata" - type: object required: - provisioningStatus - healthStatus properties: deletionTime: description: The time the resource was deleted. type: string format: date-time provisioningStatus: $ref: "#/components/schemas/resourceProvisioningStatus" healthStatus: $ref: "#/components/schemas/resourceHealthStatus" organizationScopedResourceReadMetadata: description: Metadata required by organization scoped resource reads. allOf: - $ref: "#/components/schemas/resourceReadMetadata" - type: object required: - organizationId properties: organizationId: description: The organization identifier the resource belongs to. type: string projectScopedResourceReadMetadata: description: Metadata required by project scoped resource reads. allOf: - $ref: "#/components/schemas/organizationScopedResourceReadMetadata" - type: object required: - projectId properties: projectId: description: The project identifier the resource belongs to. type: string requestBodies: authorizationRequest: description: OIDC authentication request. required: true content: application/x-www-form-urlencoded: schema: $ref: "#/components/schemas/authorizationRequestOptions" example: response_type: code client_id: c5b4c8b8-fa7b-49d4-a9ec-aaaef6f55105 redirect_uri: https://client.org.com/callback nonce: bRSQrMrRRA scope: openid userinfoRequest: description: OIDC userinfo. content: application/x-www-form-urlencoded: schema: $ref: "#/components/schemas/userinfoRequestOptions" example: access_token: foo loginRequest: description: Information necessary to resolve a federated SSO provider. required: true content: application/x-www-form-urlencoded: schema: $ref: "#/components/schemas/loginRequestOptions" example: state: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c email: joe.bloggs@acme.com tokenRequest: description: OAuth 2.0 token request, consult the relevant OAuth2 and OIDC specifications for further details. required: true content: application/x-www-form-urlencoded: schema: $ref: "#/components/schemas/tokenRequestOptions" example: grant_type: authorization_code client_id: e58d490e-62f8-49a3-b7d0-b9beb615dabb redirect_uri: https://example.com/oauth2/callback code: eyJhbGciOiJFQ0RILUVTIiwiY3R5IjoiSldUIiwiZW5jIjoiQTI1NkdDTSIsImVwayI6eyJrdHkiOiJFQyIsImNydiI6IlAtNTIxIiwieCI6IkFic05hU1ByY3Y5RVJsWmFrOHVDc2V0T2F2aTJ4bS1taXFPWjVvQmFNR2ptc05Cbi04aE84QU9DbGR2OVM3dDlydTBEbDhabzFEcThxOEM5WUp0WGJfa0YiLCJ5IjoiQWU3VS1DcktsY3RJOXYzM0RsTWFsS0ZBZk9YcC1QeV9zZ0Y5Tjdaa05NQkRDRkVKb0FrRy1FTnhTczI2ME5memg4SnJnSnBRbUFFWHhvZ0poWHp2YWZMQSJ9LCJraWQiOiIxZHh3c29KUlZEQmxTYmxvSm93dDlJTkJwdGJTb21XUlBZck5LeWNFQV9RIiwidHlwIjoiSldUIn0..urRmbxH2_bn8LMla.Yw0a3qstHMAKnxawkIYntHcvOCjaxjzvV1JlmYM-2CTbC1i2VtAsNIKoOlFJ56H2N08pMY9OpZ2cukCHP1BQxsKMsc41VwlIZYvjFrzWIEeDoF92FmpCRGWztuwchBWd7PEQYpfeJFJ2BegacGheQqfRXX35RNDy-ZOc4dWkuvFrV8ISuA8-7_ce7Ha25SrRuSRarTfM_BLA1uDA_P9AWjhsyGKOK2FkuaDU0XmXlLWDz6dKdKy9RJtR_nUUcsljtaImJXjNNPAmJq10nJ501EK_I6M9B3TRUrqalOBm4ks7-vmF_gcE1saOv2AciE9P2BMkc635kaD3C5HlyWT95Skd6C_FwppjQUvYUY0y7Eq2NpnVfkX4uSPm8fUD4brSjGWnHMNE8z4M2_PlM4KSZAieLRmMAjY5xW8XY_uCXr5nb-8SmA_P-ljCVOPPAXDXExa2xSxbAJvrYqWeuG2IvAkC0ab6pojlqUmkRWvOX5tnXQav5vO2qOAgCYUhSIWXz0-Y8hczRUSgDTyQm59yU7xqVqCiywChgXlO32KwhhnrfLxNlrMB45XOlzhJP1c3DCg7ZW7bO_Q7A08GjvrXxTm7gUDr-jsdW9hTSiNJQu__zSMFPVVNTqnz1MDFIeusi6GJi9VC0A_ouXsdhcNKn6jeIDV9dnMxCcjbQT5qsCEqo-UcCGvH0_w4aChpldMg8HGPeUSZhaBSL1yns_I0C9AADFe9dmXN6wCHBu8JCy-T4FoeXRlVSKVuG2GJi8sfzAFFh6iKhQXxHm5KNA_iorBJVEOSX3dL6KOUXfdsBfTzg3aMoEyp2bJ9NaactGmFyJZM9e6MxS8UxgN6KHe7Gduc0NGFyBru3ClMq2BzchOxbzDQ_oi5YoSuxLpgGl3xiJfNnClqFTqXMJ75uSk0_OkKgvmHea9QGRaasx5XALSpap_ckCZvNYjG_oZh404-KTjpa2iJgENczeUT2F4jq59rCCAUFZVfyu3qtBAeJme4VghnbTvaITJbpFeBUySgYKcuGQ.uvQMjilUi8JcdyGe3Lbatg code_verifier: ZWQ0MGJjZGYyNThkZDYyM2QwNzQyOTY0NGM0ZWZjMzU5ZjRmMDkzZjVkNDJkNjVhNjAxZDYzZTVkYzY0MmNjZQo oauth2ProviderRequest: description: Body required to create an oauth2 provider. required: true content: application/json: schema: $ref: "#/components/schemas/oauth2ProviderWrite" example: metadata: name: acme-auth0 description: My organization's Auth0 IdP. spec: issuer: https://acmo.auth0.com clientID: 2616072e-e87b-4b5b-b28f-9731bf29dae2 clientSecret: 734bc91b-ccee-4e6c-a00e-e2b14f361589 serviceAccountCreateRequest: description: Body required to create a service account. required: true content: application/json: schema: $ref: "#/components/schemas/serviceAccountWrite" example: metadata: name: my-service-account description: A service account for doing stuff. spec: groupIDs: - 0aaba80d-67ef-4799-b6d9-59f37e2ce2ad userCreateRequest: description: Body required to create a user. required: true content: application/json: schema: $ref: "#/components/schemas/userWrite" example: spec: subject: john.doe@acme.com state: active groupIDs: - 0aaba80d-67ef-4799-b6d9-59f37e2ce2ad createOrganizationRequest: description: Body required to create an organization. required: true content: application/json: schema: $ref: "#/components/schemas/organizationWrite" example: metadata: name: acme description: Acme.com's organization. spec: organizationType: adhoc updateOrganizationRequest: description: Body required to update an organization. required: true content: application/json: schema: $ref: "#/components/schemas/organizationWrite" example: metadata: name: acme description: Acme.com's organization. spec: organizationType: adhoc createGroupRequest: description: Body required to create a group. required: true content: application/json: schema: $ref: "#/components/schemas/groupWrite" example: metadata: name: The-A-Team description: An elite commando unit. spec: roleIDs: - 64c46f16-43b1-495d-8ee3-040b8321050d userIDs: - b0c0dc92-b123-410e-bad6-75a2265ca6e1 serviceAccountIDs: [] updateGroupRequest: description: Body required to update a group. required: true content: application/json: schema: $ref: "#/components/schemas/groupWrite" example: metadata: name: The-A-Team description: An elite commando unit. spec: roleIDs: - 64c46f16-43b1-495d-8ee3-040b8321050d userIDs: - b0c0dc92-b123-410e-bad6-75a2265ca6e1 serviceAccountIDs: [] createProjectRequest: description: Project request parameters. required: true content: application/json: schema: $ref: "#/components/schemas/projectWrite" example: metadata: name: my-project spec: groupIDs: - ddde69ef-bb52-4815-9e9e-aed856c6057f updateProjectRequest: description: Project request parameters. required: true content: application/json: schema: $ref: "#/components/schemas/projectWrite" example: metadata: name: my-project spec: groupIDs: - ddde69ef-bb52-4815-9e9e-aed856c6057f quotasRequest: description: Allows the setting of quotas. required: true content: application/json: schema: $ref: "#/components/schemas/quotasWrite" example: quotas: - kind: clusters quantity: 2 - kind: servers quantity: 10 allocationRequest: description: Creates a resource allocation. required: true content: application/json: schema: $ref: "#/components/schemas/allocationWrite" example: metadata: name: undefined spec: kind: kubernetescluster id: a4e7fddc-4812-4bfa-94b4-2b1174ac7e0e allocations: - kind: clusters committed: 1 reserved: 0 - kind: servers committed: 3 reserved: 10 responses: htmlErrorResponse: description: A generic HTML error page. content: text/html: {} oauth2BadRequestResponse: description: |- Request body failed schema validation, or the request does not contain all the required fields. content: application/json: schema: $ref: "#/components/schemas/oauth2Error" example: error: invalid_request error_description: request body invalid oauth2UnauthorizedResponse: description: Authentication failed or the access token has expired. content: application/json: schema: $ref: "#/components/schemas/oauth2Error" example: error: access_denied error_description: authentication failed oauth2ServerErrorResponse: description: >- An unexpected or unhandled error occurred. This may be a transient error and may succeed on a retry. If this isn't the case, please report it as an issue. content: application/json: schema: $ref: "#/components/schemas/oauth2Error" example: error: server_error error_description: failed to token claim openidConfigurationResponse: description: |- OpenID configuration used for auto-discovery of endpoints and supported algorithms and features. content: application/json: schema: $ref: "#/components/schemas/openidConfiguration" authorizationResponse: description: A login form to request federation data from the user. content: text/html: {} tokenResponse: description: >- Authentication was successful and returns an authorization token. The response may optionally include an OIDC identity token if that scope was requested. content: application/json: schema: $ref: "#/components/schemas/token" example: token_type: Bearer access_token: eyJhbGciOiJFQ0RILUVTIiwiY3R5IjoiSldUIiwiZW5jIjoiQTI1NkdDTSIsImVwayI6eyJrdHkiOiJFQyIsImNydiI6IlAtNTIxIiwieCI6IkFic05hU1ByY3Y5RVJsWmFrOHVDc2V0T2F2aTJ4bS1taXFPWjVvQmFNR2ptc05Cbi04aE84QU9DbGR2OVM3dDlydTBEbDhabzFEcThxOEM5WUp0WGJfa0YiLCJ5IjoiQWU3VS1DcktsY3RJOXYzM0RsTWFsS0ZBZk9YcC1QeV9zZ0Y5Tjdaa05NQkRDRkVKb0FrRy1FTnhTczI2ME5memg4SnJnSnBRbUFFWHhvZ0poWHp2YWZMQSJ9LCJraWQiOiIxZHh3c29KUlZEQmxTYmxvSm93dDlJTkJwdGJTb21XUlBZck5LeWNFQV9RIiwidHlwIjoiSldUIn0..urRmbxH2_bn8LMla.Yw0a3qstHMAKnxawkIYntHcvOCjaxjzvV1JlmYM-2CTbC1i2VtAsNIKoOlFJ56H2N08pMY9OpZ2cukCHP1BQxsKMsc41VwlIZYvjFrzWIEeDoF92FmpCRGWztuwchBWd7PEQYpfeJFJ2BegacGheQqfRXX35RNDy-ZOc4dWkuvFrV8ISuA8-7_ce7Ha25SrRuSRarTfM_BLA1uDA_P9AWjhsyGKOK2FkuaDU0XmXlLWDz6dKdKy9RJtR_nUUcsljtaImJXjNNPAmJq10nJ501EK_I6M9B3TRUrqalOBm4ks7-vmF_gcE1saOv2AciE9P2BMkc635kaD3C5HlyWT95Skd6C_FwppjQUvYUY0y7Eq2NpnVfkX4uSPm8fUD4brSjGWnHMNE8z4M2_PlM4KSZAieLRmMAjY5xW8XY_uCXr5nb-8SmA_P-ljCVOPPAXDXExa2xSxbAJvrYqWeuG2IvAkC0ab6pojlqUmkRWvOX5tnXQav5vO2qOAgCYUhSIWXz0-Y8hczRUSgDTyQm59yU7xqVqCiywChgXlO32KwhhnrfLxNlrMB45XOlzhJP1c3DCg7ZW7bO_Q7A08GjvrXxTm7gUDr-jsdW9hTSiNJQu__zSMFPVVNTqnz1MDFIeusi6GJi9VC0A_ouXsdhcNKn6jeIDV9dnMxCcjbQT5qsCEqo-UcCGvH0_w4aChpldMg8HGPeUSZhaBSL1yns_I0C9AADFe9dmXN6wCHBu8JCy-T4FoeXRlVSKVuG2GJi8sfzAFFh6iKhQXxHm5KNA_iorBJVEOSX3dL6KOUXfdsBfTzg3aMoEyp2bJ9NaactGmFyJZM9e6MxS8UxgN6KHe7Gduc0NGFyBru3ClMq2BzchOxbzDQ_oi5YoSuxLpgGl3xiJfNnClqFTqXMJ75uSk0_OkKgvmHea9QGRaasx5XALSpap_ckCZvNYjG_oZh404-KTjpa2iJgENczeUT2F4jq59rCCAUFZVfyu3qtBAeJme4VghnbTvaITJbpFeBUySgYKcuGQ.uvQMjilUi8JcdyGe3Lbatg refresh_token: eyJhbGciOiJFQ0RILUVTIiwiY3R5IjoiSldUIiwiZW5jIjoiQTI1NkdDTSIsImVwayI6eyJrdHkiOiJFQyIsImNydiI6IlAtNTIxIiwieCI6IkFTcHB0RE03Z2RVcEJVN2o2R3RnTk5yRE1kMm9pZHo1NWNzMi1rcEpRa0xTRUJBSTZTdlQ5SlR6eDdXM0kyUU9Edk5DbHFMdGhONHd3SEhaUDVEV1FEam0iLCJ5IjoiQU9rQ05kckVWR1JiVzF5OFdKRjhwU3BMamNqYjJ4NWEzYUhQOEl4XzZBX3NzU210OEVzYlRMbDFTcjRYS0EzYU4yV2pnaVY2RGpVSGdJY01oWnJ5Uy1uNCJ9LCJraWQiOiJzR1Y4a0IyYkRfVzA4ZVJIcjJXR2RPMGhxVm5XUUtFaERTVW91dXY3RE5rIiwidHlwIjoidW5pa29ybi1jbG91ZC5vcmcvcnQrand0In0..OI78X8c0hyScr_D7.6GgtL4ScJr8l4oxo7Uvak-KXoNttUDQxmZnIkcJD8Qpa_eJOw6SjWH3CS9jlkZRCg3d7U17t-b0sv-11WumWlUv7RFs74bEakr9Ue2-SVdguDaALHEd9gCvLPqV6BmQL3SroFWgVu7Mei0U0iore6E-eK-_bt7mGU00NXGTvgPMkYGZkwrX8ecJ8yajL-1t--N1ygTRG3eDU4nkNEJEF41tqB9hCYss_AUmCnIs0RFapVu-7hKgj6TzdOn6AwPjruaywvlIxzjFpMIWabgoUAPzqa_SOrlG-a7S91Mu3hzR7b5lFP2T8GR4oRohsUNrRZt9IgZuAJGcVM74m0t43ZvJSKDR50em7-zJr554qdlaX8qu2htxtYUBlD-Pzxw4swumw-335MJzasXPGCErTDf4ezSXBCbIs5IH4cbR_PztBqbkVTZ2YPuy7cORIKQiz8llMZCwirs2ad7HHvulLFgMl5SU6lv6zhi-QYTb0dTvc8DcKHhGljyDQtCYyxEF-GuU3VXiDH8nGHJlm2V5RjaRmTpQkjAn_2B9Ul8B8wwS1ROOCdTVpccdSa1F04izI5eYTO1I4sxtabw9r-E028y6dVOtmSPpcfaj88EB9_YdP3e8WrgdUz0_JPEodyWURmn5InoCG6oOYvuofViSXJ4XOtjME7vhgn4yQfOlebTnbVlV6zY6Vlb2BPn7VXVTCAvzItmfvlYF3cg4-uk11k-LTSSQ0mdll66gnwSHqjNQImknkwpVCTmmupeljG0bQWUt1J2s4ONvnLnPF8rlnnrOWBCvwnM33dO2hy9wt0edpK-IM3lGSPi3iX14ET4opFniZbLZbTipCwPZzvSeGhlMeXXTzg5quNQNupwtIdFgYmJacn301eRoR.OSpqA7IdukA7-HLtM4CRUQ id_token: eyJhbGciOiJFUzUxMiJ9.eyJhdF9oYXNoIjoidGJHNlFHek5WZE5fcjZ6Y0EzRlFyQzllNmVPbUpPN3lrSjFsTFBxNUJ0RSIsImF1ZCI6WyI5YTcxOWUxZS1hYTg1LTRhMjEtYTIyMS0zMjRlNzg3ZWZkNzgiXSwiZW1haWwiOiJqb2huLmRvZUBlbWFpbC5jb20iLCJleHAiOjE2OTE1NzM4NzEsImlhdCI6MTY5MTQ4NzQ3MSwiaXNzIjoiaHR0cHM6Ly9rdWJlcm5ldGVzLmVzY2hlcmNsb3VkLmNvbSIsInBpY3R1cmUiOiJodHRwczovL3d3dy5ncmF2YXRhci5jb20vYXZhdGFyLzhmNmU5NjI3NGMyYWJmNjE3YTM5ODdlNzRlOWU3NTdlIiwic3ViIjoiam9obi5kb2VAZW1haWwuY29tIn0.AYxSoAwkuKfBpp5o1spmAyqzhkSR76hbjF1OCKe4iLS6BCP9ySZYeV-kBCd0t3cd6VxbO5FVQJPRt8k0q88rc21JATyV8kScNnr-1jFmAJuXO6ga021KTRQnG68D8zZN9LwmMSRh3HPFtOq4LCcmQES2adeJysoG998mmtuTwp4fArwa expires_in: 3600 userinfoResponse: description: Information about the user from the access token. content: application/json: schema: $ref: "#/components/schemas/userinfo" example: iss: https://identity.acme.com sub: b02b0e92-6a4f-4916-9ca7-d26d65622f89 aud: https://identity.acme.com exp: 1311281970 iat: 1311280970 jwksResponse: description: >- A JSON web key set. This is a set of named public keys that are referenced by JSON web tokens. The public key can be used to verify that a token was signed by this service. content: application/json: schema: $ref: "#/components/schemas/jsonWebKeySet" example: keys: - use: sig kty: EC kid: 1dxwsoJRVDBlSbloJowt9INBptbSomWRPYrNKycEA_Q crv: P-521 x: AGWAbuKBnn0qXsj8iddWhZj5-ZTM4F4d5rJeKbblOGVc-5nJNURsPb7k-MhEqr9QAi5jKnd7lkmkHU2mnalwsQPK y: AAepClWS8MoLLCzqMQ2bl3KwzF7eSYLhcSrsk8kYuRaNN45mnVuQsH43QOILEB5XXaHhySSRgVCamMwZWUwArv1k systemOauth2ProvidersResponse: description: A list of system provided OAuth 2.0 providers. content: application/json: schema: $ref: "#/components/schemas/oauth2Providers" example: - metadata: id: a142f641-7fd6-4ab9-a875-344c7ebadc53 name: google-identity organizationId: d4600d6e-e965-4b44-a808-84fb2fa36702 creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: issuer: https://accounts.google.com clientID: 111069338664-poc0c81dgsfudr0rbupj0unurjcvt12e.apps.googleusercontent.com oauth2ProviderResponse: description: An OAuth 2.0 provider. content: application/json: schema: $ref: "#/components/schemas/oauth2ProviderRead" example: metadata: id: a142f641-7fd6-4ab9-a875-344c7ebadc53 name: google-identity organizationId: d4600d6e-e965-4b44-a808-84fb2fa36702 creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: issuer: https://accounts.google.com clientID: 111069338664-poc0c81dgsfudr0rbupj0unurjcvt12e.apps.googleusercontent.com oauth2ProvidersResponse: description: A list of OAuth 2.0 providers. content: application/json: schema: $ref: "#/components/schemas/oauth2Providers" example: - metadata: id: a142f641-7fd6-4ab9-a875-344c7ebadc53 name: google-identity organizationId: d4600d6e-e965-4b44-a808-84fb2fa36702 creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: issuer: https://accounts.google.com clientID: 111069338664-poc0c81dgsfudr0rbupj0unurjcvt12e.apps.googleusercontent.com organizationResponse: description: An organization. content: application/json: schema: $ref: "#/components/schemas/organizationRead" example: metadata: id: a142f641-7fd6-4ab9-a875-344c7ebadc53 name: acme-corp creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: organizationType: domain domain: acme.corp providerID: b6ec241d-e3b4-4afc-a7aa-500fcb650d8e organizationsResponse: description: A list of organizations. content: application/json: schema: $ref: "#/components/schemas/organizations" example: - metadata: id: a142f641-7fd6-4ab9-a875-344c7ebadc53 name: acme-corp creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: organizationType: domain domain: acme.corp providerID: b6ec241d-e3b4-4afc-a7aa-500fcb650d8e aclResponse: description: A list of access controls. content: application/json: schema: $ref: "#/components/schemas/acl" example: organization: id: adb2e414-1aef-4589-b933-ad0613d2d78f endpoints: - name: groups operations: - create - read - update - delete project: - id: a866ea05-2655-41bc-8135-d99b62ed4be6 endpoints: - name: infrastructure operations: - create rolesResponse: description: A set of roles within the organization. content: application/json: schema: $ref: "#/components/schemas/roles" example: - metadata: id: a142f641-7fd6-4ab9-a875-344c7ebadc53 name: platform-admins description: Platform administrators. creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy grantable: true groupResponse: description: A group in the organization. content: application/json: schema: $ref: "#/components/schemas/groupRead" example: metadata: id: a142f641-7fd6-4ab9-a875-344c7ebadc53 name: a-team organizationId: d4600d6e-e965-4b44-a808-84fb2fa36702 creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: userIDs: - d4600d6e-e965-4b44-a808-84fb2fa36702 serviceAccountIDs: - a0e9c93a-3a47-4ea1-9caf-22757428a810 roleIDs: - d4600d6e-e965-4b44-a808-84fb2fa36702 groupsResponse: description: A list of groups for the organization. content: application/json: schema: $ref: "#/components/schemas/groups" example: - metadata: id: a142f641-7fd6-4ab9-a875-344c7ebadc53 name: a-team organizationId: d4600d6e-e965-4b44-a808-84fb2fa36702 creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: userIDs: - d4600d6e-e965-4b44-a808-84fb2fa36702 serviceAccountIDs: - a0e9c93a-3a47-4ea1-9caf-22757428a810 roleIDs: - d4600d6e-e965-4b44-a808-84fb2fa36702 projectsResponse: description: A list of projects. content: application/json: schema: $ref: "#/components/schemas/projects" example: - metadata: id: a142f641-7fd6-4ab9-a875-344c7ebadc53 name: my-project organizationId: d4600d6e-e965-4b44-a808-84fb2fa36702 creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: groupIDs: - ef509cd1-c7e6-42f8-aae7-a01164dc60dc projectResponse: description: A project. content: application/json: schema: $ref: "#/components/schemas/projectRead" example: metadata: id: a142f641-7fd6-4ab9-a875-344c7ebadc53 name: my-project organizationId: d4600d6e-e965-4b44-a808-84fb2fa36702 creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: groupIDs: - ef509cd1-c7e6-42f8-aae7-a01164dc60dc serviceAccountResponse: description: A service accounts. content: application/json: schema: $ref: "#/components/schemas/serviceAccountRead" example: metadata: id: ee45f34b-9685-40d8-8724-23c31252ca46 name: my-service-account organizationId: d4600d6e-e965-4b44-a808-84fb2fa36702 creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: groupIDs: - f2000047-19f8-426e-93b9-9f0a5bfa0edd status: expiry: 2025-03-14T16:10:00Z serviceAccountsResponse: description: A list of service accounts. content: application/json: schema: $ref: "#/components/schemas/serviceAccounts" example: - metadata: id: ee45f34b-9685-40d8-8724-23c31252ca46 name: my-service-account organizationId: d4600d6e-e965-4b44-a808-84fb2fa36702 creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: groupIDs: - f2000047-19f8-426e-93b9-9f0a5bfa0edd status: expiry: 2025-03-14T16:10:00Z serviceAccountCreateResponse: description: A service account creation. content: application/json: schema: $ref: "#/components/schemas/serviceAccountCreate" example: metadata: id: ee45f34b-9685-40d8-8724-23c31252ca46 name: my-service-account organizationId: d4600d6e-e965-4b44-a808-84fb2fa36702 creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: groupIDs: - f2000047-19f8-426e-93b9-9f0a5bfa0edd status: expiry: 2025-03-14T16:10:00Z accessToken: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c usersResponse: description: A list of users. content: application/json: schema: $ref: "#/components/schemas/users" example: - metadata: id: ee45f34b-9685-40d8-8724-23c31252ca46 name: undefined organizationId: d4600d6e-e965-4b44-a808-84fb2fa36702 creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: subject: john.doe@acme.com state: active groupIDs: - 0aaba80d-67ef-4799-b6d9-59f37e2ce2ad status: lastAcive: 2025-01-12T10:49:13Z userResponse: description: A user. content: application/json: schema: $ref: "#/components/schemas/userRead" example: metadata: id: ee45f34b-9685-40d8-8724-23c31252ca46 name: undefined organizationId: d4600d6e-e965-4b44-a808-84fb2fa36702 creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: subject: john.doe@acme.com state: active groupIDs: - 0aaba80d-67ef-4799-b6d9-59f37e2ce2ad status: lastAcive: 2025-01-12T10:49:13Z quotasResponse: description: Queries the quotas for an organizational unit. content: application/json: schema: $ref: "#/components/schemas/quotasRead" example: quotas: - kind: clusters quantity: 2 used: 1 free: 1 committed: 1 reserved: 0 displayName: Clusters description: All cluster types e.g. Kubernetes, compute, etc. default: 5 format: decimal allocationResponse: description: An allocation. content: application/json: schema: $ref: "#/components/schemas/allocationRead" example: metadata: id: ee45f34b-9685-40d8-8724-23c31252ca46 name: undefined organizationId: d4600d6e-e965-4b44-a808-84fb2fa36702 projectId: a4e7fddc-4812-4bfa-94b4-2b1174ac7e0e creationTime: 2024-05-31T14:11:00Z provisioningStatus: provisioned healthStatus: healthy spec: kind: kubernetescluster id: e0b6a5d2-ef9b-4f61-8d84-033b81ad3f73 allocations: - kind: clusters committed: 1 reserved: 0 - kind: servers committed: 3 reserved: 10 openidProtectedResourceResponse: description: >- OpenID configuration used to discover authentication servers when hitting a protected endpoint. This is returned to the client when an authorization error is encountered so they can discover how to authenticate. content: application/json: schema: $ref: "#/components/schemas/openidProtectedResource" example: resource: https://endpoint.acme.com authorization_servers: - http://auth.acme.com scopes_supported: - openid - profile - email bearer_methods_supported: - header serviceVersionResponse: description: Build version information for the running service. content: application/json: schema: $ref: "#/components/schemas/serviceVersionRead" example: name: unikorn-region-server version: v1.16.7 unauthorizedResponse: description: Authentication failed or the access token has expired. content: application/json: schema: $ref: "#/components/schemas/error" example: error: access_denied error_description: authentication failed trace_id: 57bc14d9bd461f0b5a72db830149b67a internalServerErrorResponse: description: >- An unexpected or unhandled error occurred. This may be a transient error and may succeed on a retry. If this isn't the case, please report it as an issue. content: application/json: schema: $ref: "#/components/schemas/error" example: error: server_error error_description: failed to token claim trace_id: 57bc14d9bd461f0b5a72db830149b67a forbiddenResponse: description: >- Request was denied by authorization, this may be caused by the authorization token not having the required scope for an API, or the user doesn't have the necessary privileges on the provider platform. content: application/json: schema: $ref: "#/components/schemas/error" example: error: forbidden error_description: user credentials do not have the required privileges trace_id: 57bc14d9bd461f0b5a72db830149b67a badRequestResponse: description: |- Request body failed schema validation, or the request does not contain all the required fields. content: application/json: schema: $ref: "#/components/schemas/error" example: error: invalid_request error_description: request body invalid trace_id: 57bc14d9bd461f0b5a72db830149b67a notFoundResponse: description: Unable to find a resource. content: application/json: schema: $ref: "#/components/schemas/error" example: error: not_found error_description: the requested resource does not exist trace_id: 57bc14d9bd461f0b5a72db830149b67a conflictResponse: description: Resource conflicts with another, usually this means they have the same name. content: application/json: schema: $ref: "#/components/schemas/error" example: error: conflict error_description: a resource with the same name already exists trace_id: 57bc14d9bd461f0b5a72db830149b67a acceptedResponse: description: |- The request has been accepted and will be fulfilled asynchronously. You may poll the resource and monitor its provisioning and health status to await completion of the operation. securitySchemes: oauth2Authentication: description: Operation requires OAuth 2.0 bearer token authentication. type: oauth2 flows: authorizationCode: authorizationUrl: https://identity.nks.europe-west4.nscale.com/oauth2/v2/authorization tokenUrl: https://identity.nks.europe-west4.nscale.com/oauth2/v2/token scopes: {} servers: - url: https://identity.nks.europe-west4.nscale.com description: Production