From 46eb2cfdcdfd940f2fb7bc3ece7114e4ea5d4c7c Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Tue, 4 May 2021 16:26:30 -0400 Subject: [PATCH] remove swagger.yml --- specs/swagger.yml | 8055 --------------------------------------------- 1 file changed, 8055 deletions(-) delete mode 100644 specs/swagger.yml diff --git a/specs/swagger.yml b/specs/swagger.yml deleted file mode 100644 index a3b85a1d0..000000000 --- a/specs/swagger.yml +++ /dev/null @@ -1,8055 +0,0 @@ ---- -swagger: '2.0' -info: - version: 0.16.3 - title: Ziti Edge - contact: { } -host: demo.ziti.dev -basePath: /edge/v1 -schemes: - - https -consumes: - - application/json -produces: - - application/json -securityDefinitions: - ztSession: - type: apiKey - in: header - name: zt-session - description: An API Key that is provided post authentication - -####################################################################################################################### -# -# Paths - Endpoints and their associated HTTP methods -# -####################################################################################################################### -paths: - ################################################################### - # .well-known RFC - ################################################################## - '/.well-known/est/cacerts': - get: - summary: Get CA Cert Store - description: | - This endpoint is used during enrollments to bootstrap trust between enrolling clients and the Ziti Edge API. - This endpoint returns a base64 encoded PKCS7 store. The content can be base64 decoded and parsed by any library - that supports parsing PKCS7 stores. - security: [ ] - tags: - - Well Known - operationId: listWellKnownCas - produces: - - application/pkcs7-mime - responses: - '200': - description: A base64 encoded PKCS7 store - schema: - type: string - example: 'MIIMUQYJKoZIhvcNAQcCoIIMQjCCDD4CAQExADALBgkqhkiG9w0BBwGgggwkMIIG - BjCCA+6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZcxCzAJBgNVBAYTAlVTMRcw - FQYDVQQIDA5Ob3J0aCBDYXJvbGluYTESMBAGA1UEBwwJQ2hhcmxvdHRlMRMwEQYD - VQQKDApOZXRGb3VuZHJ5MSkwJwYDVQQLDCBOZXRGb3VuZHJ5IENlcnRpZmljYXRl - IEF1dGhvcml0eTEbMBkGA1UEAwwSTmV0Rm91bmRyeSBSb290IENBMB4XDTE4MDUx - ODE2NTcyM1oXDTI4MDUxNTE2NTcyM1owgYsxCzAJBgNVBAYTAlVTMRcwFQYDVQQI - DA5Ob3J0aCBDYXJvbGluYTETMBEGA1UECgwKTmV0Rm91bmRyeTEpMCcGA1UECwwg - TmV0Rm91bmRyeSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxIzAhBgNVBAMMGk5ldEZv - dW5kcnkgSW50ZXJtZWRpYXRlIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC - CgKCAgEAsb1EPhMUweS9WpjT7L54xAOmZqugJ6fhSrFfLUwNUy172q+ASvZTpT1z - KIPcZpGmPB3TX2bHaAR67BbRkUR11JgWE3U8+FsGrYmPZtaKM6fg8Mh0WZ41oMYQ - NJyQixOktrgqfybyJoT5PeT5AA7QQmd8mku2X9nkAu6gWPf2nHNc7SeQdijmyQQa - VK3oqyaxOzWzsU/XbfMEz/ObkefUxgt5Z6jlK0xcW0Q+QgtawMKLUiuo6obWRPcl - 7Hm9Sze8XJS5pbvS5JkUszxoRZuDVHZylrlHIpA/IL+BnvS+M7SP28UWe9skrv/s - 6ACpJtuPJ1EYf5fakugOpY7i+hq7YNi//csbc49Qjn2OtttrR7JcTaHUEU1I/tQb - QGAtNkI4pJjRVUdDawQFQlWHZD1COixNLErs2HzAI00DhLrY6SKITI/kjN0Xx010 - XdMcdfay0PLWm6RwxiRmMQFL4GNIC895NF1q6xV4W4rWgqUNlcvKpy+i1chWpRbU - He16ul0qh10fcESrRvAbXn5YrQJLrwbSr+85ubN8lYdNLE0qg2cIXZlUilarZZzW - ghtCe+KkUpjfRuAi/CqfSwNK3QXEfeVEK6S49mHeSekOizFIw7fmDhCz9vXwMOnb - ryRSLEJks0gIRcSDVChXheAqC98y4kcQdniNWFnqJXoqA+rrSokCAwEAAaNmMGQw - HQYDVR0OBBYEFK8UXC/sq6dGVFAqEXHsQDzqzwuUMB8GA1UdIwQYMBaAFEHz6RRu - OuXj2mwAzOeUinfWeivpMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQD - AgGGMA0GCSqGSIb3DQEBCwUAA4ICAQBDAAaOE2Nbb49eOjyTNxIeOB+ZKQjJ1hUE - gRrootAA8NYbtKW/vyxTWnNi5XOGXd4DFS9OKZ0mL/7NyLc0mbTwPH2ZT8KTPUTS - Cpo6yktZ/7TMjyAtWZiOMg2EH+6m/nlNSXk/v5fb8+JQLdZfpxoA017dHh3tc8l7 - KOskCZNwQHgF/YMXrPXUNbsGkXRuJLtpjPw5O9GvPys7p+a1aJH1WCTly9zfB6j+ - rMF+UGCPDT30sxitVlohik83j6pKLgEAP/gi8nJbILlTP7ce+gJeHR2tfDvmK91X - 6QgCF2STUFBU7/9H1/pPRRykOxQpAd8xqSgqGEyp9Ie4tysZjwoUEnG8IVJ5ykrI - Fximvnb4B+LABV9WEo08n8m1R8wEryrISi8fBPn3Pr5nuayOfFLa15CLTkZF40FN - 8ika1qNZy8bWRDwTZJQUUb7VCheRWcMwdZdNmhl3J+VZLpQ+ruW7b2ajwacHz5Nw - BHKNcmxXb/4vHq/BnlcayHnSqT6036+OZQ+owDegcYmWV6LaM7xLErjHz2EE38M2 - YSiW5SU1zluDe+iHb6l3Gd3Fj/X1gkMWFgYh0XPMSUSyimLNYzy4THKzmWlcQNFo - LLiIDbLrMt+vk+vBkIsNTTPXRJOFPBhmIF6uIUj+2YhzNotX/pQtqMKms3pPlmHq - dH6biwygETCCBhYwggP+oAMCAQICCQDquKpymLJ5WzANBgkqhkiG9w0BAQsFADCB - lzELMAkGA1UEBhMCVVMxFzAVBgNVBAgMDk5vcnRoIENhcm9saW5hMRIwEAYDVQQH - DAlDaGFybG90dGUxEzARBgNVBAoMCk5ldEZvdW5kcnkxKTAnBgNVBAsMIE5ldEZv - dW5kcnkgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MRswGQYDVQQDDBJOZXRGb3VuZHJ5 - IFJvb3QgQ0EwHhcNMTgwNTE4MTY1NDQ3WhcNMzgwNTEzMTY1NDQ3WjCBlzELMAkG - A1UEBhMCVVMxFzAVBgNVBAgMDk5vcnRoIENhcm9saW5hMRIwEAYDVQQHDAlDaGFy - bG90dGUxEzARBgNVBAoMCk5ldEZvdW5kcnkxKTAnBgNVBAsMIE5ldEZvdW5kcnkg - Q2VydGlmaWNhdGUgQXV0aG9yaXR5MRswGQYDVQQDDBJOZXRGb3VuZHJ5IFJvb3Qg - Q0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDKq/Xa+749Cr3WJGYD - DIEtNKIRnTFc6TeiRSm/O7hG2+1Nrh/dObjZJuDjsopWP8NFA/DwlNyEphYKAeSw - HDmu+4nFd6ifoeDE2lYq6bNhLcgN+A3MlN5Phb2rnO32YYZwHXGWov+jtd2gaK0f - WsH8CQxn6n2v7qvPMTeYFP8p4jqTZw2bvZWw+LMYTFCy541DFqQLQasMg10mXRAV - XO7Oa9y+D1re1zLq4wS6u8ItJoKzfmvZkMvD90C/tQ4u0iJaL7GB2SE9MOPDeGVv - pnoSAIkSVmvRDUAj2x9PuukykzoL1OAWzc5Cg+5LxRmLejVE7PvPcHaTtNag2tRD - w2vbMeFKN8NvQH1QYcaPWZe4Vl9b6DAuTaH5RN919H/F+ZHyjZybVPwC14lflneI - KyNy8JEV/YMIbEADWnuiedzDehk2Opn+0+9Zr2X/xfjCo8iWHFbNaVnQX7wdRaOo - 783lEouncqe46FDBLBpyAuDKHQpIT3MK8rkC/1yBNxsH44vMweUZuK0u7PC9KHtm - pQfuflYGfxA34kY6WU3jzyQHetoLYjoxTqNEEjuGpwy2o1j7RaCBEFIbYlnlbhpE - WFTaQf96z2GQ6m1U3y7JyDflHSu9Fo1JNkG3qXsjDwda/6W7NRJRgdFrhnOwrm7F - 6L9X4P1HnzU/VJL66LwPmiHVjQIDAQABo2MwYTAdBgNVHQ4EFgQUQfPpFG465ePa - bADM55SKd9Z6K+kwHwYDVR0jBBgwFoAUQfPpFG465ePabADM55SKd9Z6K+kwDwYD - VR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggIB - ACfU74aKWROaxnue8tZb5PFkEbnDRcRrKXRhnptA0vrgB4ydnYxX9hEBZD8o6PBy - 3rewvl5meSOBE6zyb4JD80lHdzHSVFIwbzsNOeEjCslv/PA/3Y+J7DCt6gPNMDeY - uEssdqeSiMoYz2gnven4flSMKgTAJd3/SpVrn35HzXiU9MkmFVpPEMnTctOjw+Jn - cCkG5+D9N14dxtgZ/tUfbH+GUfhyGVxRdPrX5KQqAyapMfEaMXXa8KNs7PG+sDiS - WI+Sg9jUGtxgkfKdVNtFW+QMXyy7eT3iXPA+1r2hFAhgfIaGtBJUhxPHMhKtjbAg - AX+6+2D3GAbaD1+lcQHhKry3hygQ3OX79FJW6zyPS0tiV/LfovHqX/3x9q5PTVBO - wEOS2/LCc4R2M7S+HIPf4eSJ+nH4uCIdJ42WCror/mRsuL7geCksi70GHuCynP4y - qQFszu/UtbBEsN8loTnLpOInxaGB1Y8UPm14b2Lo1/3HkoMVh0/UaHJ0TmnZ1r7m - fGhfRyAZYRdvT1sB+Eb4b5A2zEZqsTc9IwFOhnI4ZilPoZ5s2xejqrVw3GSvovEh - dprrQmvxuh+VQ23y/+/4z9b2xWyDu2zVveB4whqPe2rkgxJrEl4GfLk2DW+dN6j8 - 3Zl4lPoUZYwzkC6raCaHyFlAoaTbqz0H6rvVJYxJPS6UoQAxAA==' - '/': - get: - summary: Returns version information - security: [ ] - tags: - - Informational - operationId: listRoot - responses: - '200': - $ref: '#/responses/listVersion' - '/version': - get: - summary: Returns version information - security: [ ] - tags: - - Informational - operationId: listVersion - responses: - '200': - $ref: '#/responses/listVersion' - '/protocols': - get: - summary: Return a list of the listening Edge protocols - security: [ ] - tags: - - Informational - operationId: listProtocols - responses: - '200': - $ref: '#/responses/listProtocols' - ################################################################### - # Informational - ################################################################## - '/summary': - get: - summary: Returns a list of accessible resource counts - description: This endpoint is usefull for UIs that wish to display UI elements with counts. - security: - - ztSession: [ ] - tags: - - Informational - operationId: listSummary - responses: - '200': - $ref: '#/responses/listSummaryCounts' - '401': - $ref: '#/responses/unauthorizedResponse' - '/specs': - get: - summary: Returns a list of API specs - description: Returns a list of spec files embedded within the controller for consumption/documentation/code geneartion - security: [ ] - tags: - - Informational - operationId: listSpecs - responses: - '200': - $ref: '#/responses/listSpecs' - '/specs/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Return a single spec resource - description: Returns single spec resource embedded within the controller for consumption/documentation/code geneartion - security: [ ] - tags: - - Informational - operationId: detailSpec - responses: - '200': - $ref: '#/responses/detailSpec' - '/specs/{id}/spec': - parameters: - - $ref: '#/parameters/id' - get: - summary: Returns the spec's file - description: Return the body of the specification (i.e. Swagger, OpenAPI 2.0, 3.0, etc). - security: [ ] - tags: - - Informational - operationId: detailSpecBody - produces: - - text/yaml - - application/json - responses: - '200': - $ref: '#/responses/detailSpecBody' - ################################################################### - # API Sessions - ################################################################## - '/api-sessions': - get: - summary: List active API sessions - description: | - Returns a list of active API sessions. The resources can be sorted, filtered, and paginated. This endpoint - requries admin access. - security: - - ztSession: [ ] - tags: - - API Session - operationId: listAPISessions - produces: - - application/json; charset=utf-8 - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listAPISessions' - '/api-sessions/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single API Session - description: Retrieves a single API Session by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - API Session - operationId: detailAPISessions - responses: - '200': - $ref: '#/responses/detailAPISession' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Deletes an API Sessions - description: Deletes and API sesion by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - API Session - operationId: deleteAPISessions - responses: - '200': - $ref: '#/responses/deleteResponse' - '404': - $ref: '#/responses/notFoundResponse' - '403': - $ref: '#/responses/unauthorizedResponse' - ################################################################### - # Authentication - ################################################################## - '/authenticate': - parameters: - - $ref: '#/parameters/authMethod' - post: - summary: Authenticate via a method supplied via a query string parameter - description: | - Allows authentication Methods include "password" and "cert" - security: [ ] - tags: - - Authentication - operationId: authenticate - parameters: - - name: auth - in: body - required: false - schema: - $ref: '#/definitions/authenticate' - responses: - '200': - $ref: '#/responses/detailCurrentAPISession' - '400': - $ref: '#/responses/badRequestResponse' - '403': - $ref: '#/responses/invalidAuthResponse' - - '/authenticate/mfa': - post: - summary: Complete MFA authentication - description: Completes MFA authentication by submitting a MFA time based one time token or backup code. - security: - - ztSession: [ ] - tags: - - Authentication - - MFA - operationId: authenticateMfa - parameters: - - name: mfaAuth - in: body - required: true - description: 'An MFA validation request' - schema: - $ref: '#/definitions/mfaCode' - responses: - '200': - $ref: '#/responses/emptyResponse' - '401': - $ref: '#/responses/emptyResponse' - ################################################################### - # Authenticators - ################################################################## - '/authenticators': - get: - summary: List authenticators - description: | - Returns a list of authenticators associated to identities. The resources can be sorted, filtered, and paginated. - This endpoint requries admin access. - security: - - ztSession: [ ] - tags: - - Authenticator - operationId: listAuthenticators - - responses: - '200': - $ref: '#/responses/listAuthenticators' - post: - summary: Creates an authenticator - description: | - Creates an authenticator for a specific identity. Requires admin access. - security: - - ztSession: [ ] - tags: - - Authenticator - operationId: createAuthenticator - parameters: - - name: authenticator - in: body - required: true - description: A Authenticator create object - schema: - $ref: '#/definitions/authenticatorCreate' - responses: - '201': - description: The create was successful - schema: - $ref: '#/definitions/authenticatorCreate' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/authenticators/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single authenticator - description: Retrieves a single authenticator by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Authenticator - operationId: detailAuthenticator - responses: - '200': - $ref: '#/responses/detailAuthenticator' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - put: - summary: Update all fields on an authenticator - description: Update all fields on an authenticator by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Authenticator - operationId: updateAuthenticator - parameters: - - name: authenticator - in: body - required: true - description: 'An authenticator put object' - schema: - $ref: '#/definitions/authenticatorUpdate' - responses: - '200': - $ref: '#/responses/updateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - patch: - summary: Update the supplied fields on an authenticator - description: Update the supplied fields on an authenticator by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Authenticator - operationId: patchAuthenticator - parameters: - - name: authenticator - in: body - required: true - description: An authenticator patch object - schema: - $ref: '#/definitions/authenticatorPatch' - responses: - '200': - $ref: '#/responses/patchResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete an Authenticator - description: | - Delete an authenticator by id. Deleting all authenticators for an identity will make it impossible to log in. - Requires admin access. - security: - - ztSession: [ ] - tags: - - Authenticator - operationId: deleteAuthenticator - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - - ################################################################### - # Certificate Authorities - ################################################################## - '/cas': - get: - summary: List CAs - description: Retrieves a list of CA resources; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Certificate Authority - operationId: listCas - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listCas' - post: - summary: Creates a CA - description: Creates a CA in an unverified state. Requires admin access. - security: - - ztSession: [ ] - tags: - - Certificate Authority - operationId: createCa - - parameters: - - name: ca - in: body - required: true - description: A CA to create - schema: - $ref: '#/definitions/caCreate' - responses: - '201': - $ref: '#/responses/createResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/cas/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single CA - description: Retrieves a single CA by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Certificate Authority - operationId: detailCa - responses: - '200': - $ref: '#/responses/detailCa' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - put: - summary: Update all fields on a CA - description: Update all fields on a CA by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Certificate Authority - operationId: updateCa - parameters: - - name: ca - in: body - required: true - description: A CA update object - schema: - $ref: '#/definitions/caUpdate' - responses: - '200': - $ref: '#/responses/updateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - patch: - summary: Update the supplied fields on a CA - description: Update only the supplied fields on a CA by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Certificate Authority - operationId: patchCa - parameters: - - name: ca - in: body - required: true - description: A CA patch object - schema: - $ref: '#/definitions/caPatch' - responses: - '200': - $ref: '#/responses/patchResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete a CA - description: | - Delete a CA by id. Deleting a CA will delete its associated certificate authenticators. This can make it - impossible for identities to authenticate if they no longer have any valid authenticators. Requires admin access. - security: - - ztSession: [ ] - tags: - - Certificate Authority - operationId: deleteCa - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/cas/{id}/jwt': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieve the enrollment JWT for a CA - description: | - For CA auto enrollment, the enrollment JWT is static and provided on each CA resource. This endpoint provides - the jwt as a text response. - security: - - ztSession: [ ] - tags: - - Certificate Authority - operationId: getCaJwt - produces: - - 'application/jwt' - responses: - '200': - description: The result is the JWT text to validate the CA - schema: - type: string - examples: - 'application/jwt': 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbSI6ImNhIiwiaXNzIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6MTI - 4MC8ifQ.Ot6lhNBSOw8ygHytdI5l7WDf9EWadOj44UPvJ0c-8mJ54fClWM3uMZrAHSSfV6KmOSZOeBBJe4VlNyoD-_MOECP0BzYSnSQP3E - zJb0VlM-fFmGcKNGW157icyZNISfO43JL_Lw2QPBzTgikqSIj9eZnocC3BeAmZCHsVznnLfHWqDldcmuxnu-5MNOSrWV1x9iVcgLFlLHXK - 2PLA4qIiZmlQTrQjpHJmUaoJ07mnj8hMKzxB3wBG8kpazjEo7HDRCO06aBH4eqFgf_l0iT8Dzcb31jquWMGUoSXPhf4lVJh_FiNcR1wVx- - UiHLbG5h23Aqf1UJF-F38rc1FElKz0Zg' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/cas/{id}/verify': - parameters: - - $ref: '#/parameters/id' - post: - summary: Verify a CA - description: | - Allows a CA to become verified by submitting a certificate in PEM format that has been signed by the target CA. - The common name on the certificate must match the verificationToken property of the CA. Unverfieid CAs can not - be used for enrollment/authentication. Requires admin access. - security: - - ztSession: [ ] - tags: - - Certificate Authority - operationId: verifyCa - consumes: - - 'text/plain' - parameters: - - name: certificate - required: true - in: body - description: A PEM formatted certificate signed by the target CA with the common name matching the CA's validationToken - schema: - type: string - responses: - 200: - $ref: '#/responses/emptyResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - ################################################################### - # Config-Types - ################################################################## - '/config-types': - get: - summary: List config-types - description: | - Retrieves a list of config-type resources; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Config - operationId: listConfigTypes - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listConfigTypes' - post: - summary: Create a config-type. Requires admin access. - security: - - ztSession: [ ] - tags: - - Config - operationId: createConfigType - parameters: - - name: configType - in: body - required: true - description: A config-type to create - schema: - $ref: '#/definitions/configTypeCreate' - responses: - '201': - $ref: '#/responses/createResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/config-types/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single config-type - description: Retrieves a single config-type by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Config - operationId: detailConfigType - responses: - '200': - $ref: '#/responses/detailConfigType' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - put: - summary: Update all fields on a config-type - description: Update all fields on a config-type by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Config - operationId: updateConfigType - parameters: - - name: configType - in: body - required: true - description: A config-type update object - schema: - $ref: '#/definitions/configTypeUpdate' - responses: - '200': - $ref: '#/responses/updateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - patch: - summary: Update the supplied fields on a config-type - description: Update the supplied fields on a config-type. Requires admin access. - security: - - ztSession: [ ] - tags: - - Config - operationId: patchConfigType - parameters: - - name: configType - in: body - required: true - description: A config-type patch object - schema: - $ref: '#/definitions/configTypePatch' - responses: - '200': - $ref: '#/responses/patchResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete a config-type - description: Delete a config-type by id. Removing a configuration type that are in use will result in a 409 conflict HTTP status code and error. All configurations of a type must be removed first. - security: - - ztSession: [ ] - tags: - - Config - operationId: deleteConfigType - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '409': - $ref: '#/responses/cannotDeleteReferencedResourceResponse' - '/config-types/{id}/configs': - parameters: - - $ref: '#/parameters/id' - get: - summary: Lists the configs of a specific config-type - description: Lists the configs associated to a config-type. Requires admin access. - security: - - ztSession: [ ] - tags: - - Config - operationId: listConfigsForConfigType - responses: - '200': - $ref: '#/responses/listConfigs' - ################################################################### - # Configs - ################################################################## - '/configs': - get: - summary: List configs - description: | - Retrieves a list of config resources; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Config - operationId: listConfigs - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listConfigs' - '401': - $ref: '#/responses/unauthorizedResponse' - post: - summary: Create a config resource - description: Create a config resource. Requires admin access. - security: - - ztSession: [ ] - tags: - - Config - operationId: createConfig - parameters: - - name: config - in: body - required: true - description: A config to create - schema: - $ref: '#/definitions/configCreate' - responses: - '201': - $ref: '#/responses/createResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/configs/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single config - description: Retrieves a single config by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Config - operationId: detailConfig - responses: - '200': - $ref: '#/responses/detailConfig' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - put: - summary: Update all fields on a config - description: Update all fields on a config by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Config - operationId: updateConfig - parameters: - - name: config - in: body - required: true - description: A config update object - schema: - $ref: '#/definitions/configUpdate' - responses: - '200': - $ref: '#/responses/updateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - patch: - summary: Update the supplied fields on a config - description: Update the supplied fields on a config. Requires admin access. - security: - - ztSession: [ ] - tags: - - Config - operationId: patchConfig - parameters: - - name: config - in: body - required: true - description: A config patch object - schema: - $ref: '#/definitions/configPatch' - responses: - '200': - $ref: '#/responses/patchResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete a config - description: Delete a config by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Config - operationId: deleteConfig - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '409': - $ref: '#/responses/cannotDeleteReferencedResourceResponse' - - ################################################################### - # Current API Session - ################################################################## - '/current-api-session': - get: - summary: Return the current API session - description: Retrieves the API session that was used to issue the current request - security: - - ztSession: [ ] - tags: - - Current API Session - operationId: getCurrentAPISession - responses: - 200: - $ref: '#/responses/detailCurrentAPISession' - 401: - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Logout - description: Terminates the current API session - security: - - ztSession: [ ] - tags: - - Current API Session - responses: - 200: - $ref: '#/responses/emptyResponse' - 401: - $ref: '#/responses/unauthorizedResponse' - '/current-api-session/certificates': - get: - summary: List the ephemeral certificates available for the current API Session - description: Retrieves a list of certificate resources for the current API session; supports filtering, sorting, and pagination - security: - - ztSession: [ ] - tags: - - Current API Session - operationId: listCurrentApiSessionCertificates - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listCurrentApiSessionCertificates' - post: - summary: Creates an ephemeral certificate for the current API Session - description: Creates an ephemeral certificate for the current API Session. This endpoint - expects a PEM encoded CSRs to be provided for fulfillment as a property of a JSON payload. - It is up to the client to manage the private key backing the CSR request. - security: - - ztSession: [ ] - tags: - - Current API Session - operationId: createCurrentApiSessionCertificate - parameters: - - name: sessionCertificate - in: body - required: true - description: The payload describing the CSR used to create a session certificate - schema: - $ref: '#/definitions/currentApiSessionCertificateCreate' - responses: - '201': - $ref: '#/responses/createCurrentApiSessionCertificateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/current-api-session/certificates/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves an ephemeral certificate - description: Retrieves a single ephemeral certificate by id - security: - - ztSession: [ ] - tags: - - Current API Session - operationId: detailCurrentApiSessionCertificate - responses: - '200': - $ref: '#/responses/detailCurrentApiSessionCertificate' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete an ephemeral certificate - description: | - Delete an ephemeral certificateby id - security: - - ztSession: [ ] - tags: - - Current API Session - operationId: deleteCurrentApiSessionCertificate - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - ################################################################### - # Current API Session - Service Updates - ################################################################# - '/current-api-session/service-updates': - get: - summary: Returns data indicating whether a client should updates it service list - description: | - Retrieves data indicating the last time data relevant to this API Session was altered that would necessitate - service refreshes. - security: - - ztSession: [ ] - tags: - - Current API Session - - Services - operationId: listServiceUpdates - responses: - '200': - $ref: '#/responses/listCurrentApiSessionServiceUpdates' - '401': - $ref: '#/responses/unauthorizedResponse' - - - '/current-identity': - get: - summary: Return the current identity - description: Returns the identity associated with the API sessions used to issue the current request - security: - - ztSession: [ ] - tags: - - Current Identity - operationId: getCurrentIdentity - responses: - '200': - $ref: '#/responses/detailCurrentIdentity' - '401': - $ref: '#/responses/unauthorizedResponse' - '/current-identity/edge-routers': - get: - summary: Return this list of Edge Routers the identity has access to - description: | - Lists the Edge Routers that the current identity has access to via policies. The data returned - includes their address and online status - security: - - ztSession: [ ] - tags: - - Current Identity - - Edge Router - operationId: getCurrentIdentityEdgeRouters - responses: - '200': - $ref: '#/responses/listCurrentIdentityEdgeRouters' - '401': - $ref: '#/responses/unauthorizedResponse' - '/current-identity/mfa': - post: - summary: Initiate MFA enrollment - description: > - Allows authenticator based MFA enrollment. If enrollment has already been completed, it must be - disabled before attempting to re-enroll. Subsequent enrollment request is completed via - `POST /current-identity/mfa/verify` - security: - - ztSession: [ ] - tags: - - Current Identity - - MFA - operationId: enrollMfa - responses: - '201': - $ref: '#/responses/createResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '409': - $ref: '#/responses/alreadyMfaEnrolledResponse' - get: - summary: Returns the current status of MFA enrollment - description: > - Returns details about the current MFA enrollment. If enrollment has not been completed it will - return the current MFA configuration details necessary to complete a `POST /current-identity/mfa/verify`. - security: - - ztSession: [ ] - tags: - - Current Identity - - MFA - operationId: detailMfa - responses: - '200': - $ref: '#/responses/detailMfa' - '401': - $ref: '#/responses/unauthorizedResponse' - '404': - $ref: '#/responses/notFoundResponse' - delete: - summary: Disable MFA for the current identity - description: > - Disable MFA for the current identity. Requires a current valid time based one time password if MFA enrollment - has been completed. If not, code should be an empty string. If one time passwords are not available and admin - account can be used to remove MFA from the identity via `DELETE /identities//mfa`. - security: - - ztSession: [ ] - tags: - - Current Identity - - MFA - operationId: deleteMfa - parameters: - - name: mfaValidation - in: body - required: false - description: 'An MFA validation request' - schema: - $ref: '#/definitions/mfaCode' - - name: mfa-validation-code - in: header - required: false - type: string - responses: - '200': - $ref: '#/responses/emptyResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '404': - $ref: '#/responses/notFoundResponse' - '/current-identity/mfa/qr-code': - get: - summary: Show a QR code for unverified MFA enrollments - description: > - Shows an QR code image for unverified MFA enrollments. 404s if the MFA enrollment has been completed or - not started. - security: - - ztSession: [ ] - tags: - - Current Identity - - MFA - operationId: detailMfaQrCode - produces: - - image/png - - application/json - responses: - 200: - description: OK - 404: - description: No MFA enrollment or MFA enrollment is completed - '/current-identity/mfa/verify': - post: - summary: Complete MFA enrollment by verifying a time based one time token - description: > - Completes MFA enrollment by accepting a time based one time password as verification. Called - after MFA enrollment has been initiated via `POST /current-identity/mfa`. - security: - - ztSession: [ ] - tags: - - Current Identity - - MFA - operationId: verifyMfa - parameters: - - name: mfaValidation - in: body - required: true - description: 'An MFA validation request' - schema: - $ref: '#/definitions/mfaCode' - responses: - '200': - $ref: '#/responses/emptyResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '404': - $ref: '#/responses/notFoundResponse' - '/current-identity/mfa/recovery-codes': - get: - summary: For a completed MFA enrollment view the current recovery codes - description: > - Allows the viewing of recovery codes of an MFA enrollment. Requires a current valid - time based one time password to interact with. Available after a completed MFA enrollment. - security: - - ztSession: [ ] - tags: - - Current Identity - - MFA - operationId: detailMfaRecoveryCodes - parameters: - - name: mfaValidation - in: body - required: false - description: 'An MFA validation request' - schema: - $ref: '#/definitions/mfaCode' - - name: mfa-validation-code - in: header - required: false - type: string - responses: - '200': - $ref: '#/responses/emptyResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '404': - $ref: '#/responses/notFoundResponse' - post: - summary: For a completed MFA enrollment regenerate the recovery codes - description: > - Allows regeneration of recovery codes of an MFA enrollment. Requires a current valid - time based one time password to interact with. Available after a completed MFA enrollment. This replaces - all existing recovery codes. - security: - - ztSession: [ ] - tags: - - Current Identity - - MFA - operationId: createMfaRecoveryCodes - parameters: - - name: mfaValidation - in: body - required: true - description: 'An MFA validation request' - schema: - $ref: '#/definitions/mfaCode' - responses: - '200': - $ref: '#/responses/detailMfaRecoveryCodes' - '401': - $ref: '#/responses/unauthorizedResponse' - '404': - $ref: '#/responses/notFoundResponse' - '/current-identity/authenticators': - get: - summary: List authenticators for the current identity - description: Retrieves a list of authenticators assigned to the current API session's identity; supports filtering, sorting, and pagination. - security: - - ztSession: [ ] - tags: - - Current API Session - operationId: listCurrentIdentityAuthenticators - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listAuthenticators' - '401': - $ref: '#/responses/unauthorizedResponse' - '/current-identity/authenticators/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieve an authenticator for the current identity - description: Retrieves a single authenticator by id. Will only show authenticators assigned to the API session's identity. - security: - - ztSession: [ ] - tags: - - Current API Session - operationId: detailCurrentIdentityAuthenticator - responses: - '200': - $ref: '#/responses/detailAuthenticator' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - put: - summary: Update all fields on an authenticator of this identity - description: | - Update all fields on an authenticator by id. Will only update authenticators assigned to the API session's - identity. - security: - - ztSession: [ ] - tags: - - Current API Session - operationId: updateCurrentIdentityAuthenticator - parameters: - - name: authenticator - in: body - required: true - description: 'An authenticator put object' - schema: - $ref: '#/definitions/authenticatorUpdateWithCurrent' - responses: - '200': - $ref: '#/responses/updateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - patch: - summary: Update the supplied fields on an authenticator of this identity - description: | - Update the supplied fields on an authenticator by id. Will only update authenticators assigned to the API - session's identity. - security: - - ztSession: [ ] - tags: - - Current API Session - operationId: patchCurrentIdentityAuthenticator - parameters: - - name: authenticator - in: body - required: true - description: An authenticator patch object - schema: - $ref: '#/definitions/authenticatorPatchWithCurrent' - responses: - '200': - $ref: '#/responses/patchResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - - ################################################################### - # Edge Router Policies - ################################################################## - '/edge-router-policies': - get: - summary: List edge router policies - description: | - Retrieves a list of edge router policy resources; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router Policy - operationId: listEdgeRouterPolicies - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listEdgeRouterPolicies' - '401': - $ref: '#/responses/unauthorizedResponse' - post: - summary: Create an edge router policy resource - description: Create an edge router policy resource. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router Policy - operationId: createEdgeRouterPolicy - parameters: - - name: policy - in: body - required: true - description: An edge router policy to create - schema: - $ref: '#/definitions/edgeRouterPolicyCreate' - responses: - '201': - $ref: '#/responses/createResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/edge-router-policies/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single edge router policy - description: Retrieves a single edge router policy by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router Policy - operationId: detailEdgeRouterPolicy - responses: - '200': - $ref: '#/responses/detailEdgeRouterPolicy' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - put: - summary: Update all fields on an edge router policy - description: Update all fields on an edge router policy by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router Policy - operationId: updateEdgeRouterPolicy - parameters: - - name: policy - in: body - required: true - description: An edge router policy update object - schema: - $ref: '#/definitions/edgeRouterPolicyUpdate' - responses: - '200': - $ref: '#/responses/updateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - patch: - summary: Update the supplied fields on an edge router policy - description: Update the supplied fields on an edge router policy. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router Policy - operationId: patchEdgeRouterPolicy - parameters: - - name: policy - in: body - required: true - description: An edge router policy patch object - schema: - $ref: '#/definitions/edgeRouterPolicyPatch' - responses: - '200': - $ref: '#/responses/patchResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete an edge router policy - description: Delete an edge router policy by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router Policy - operationId: deleteEdgeRouterPolicy - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '409': - $ref: '#/responses/cannotDeleteReferencedResourceResponse' - '/edge-router-policies/{id}/edge-routers': - parameters: - - $ref: '#/parameters/id' - get: - summary: List edge routers a policy affects - description: | - Retrieves a list of edge routers an edge router policy resources affects; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router Policy - operationId: listEdgeRouterPolicyEdgeRouters - responses: - '200': - $ref: '#/responses/listEdgeRouters' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/edge-router-policies/{id}/identities': - parameters: - - $ref: '#/parameters/id' - get: - summary: List identities an edge router policy affects - description: | - Retrieves a list of identities an edge router policy resources affects; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router Policy - operationId: listEdgeRouterPolicyIdentities - responses: - '200': - $ref: '#/responses/listIdentities' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - ################################################################### - # Edge Routers - ################################################################## - '/edge-routers': - get: - summary: List edge routers - description: | - Retrieves a list of edge router resources; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router - operationId: listEdgeRouters - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - - $ref: '#/parameters/roleFilter' - - $ref: '#/parameters/roleSemantic' - responses: - '200': - $ref: '#/responses/listEdgeRouters' - '401': - $ref: '#/responses/unauthorizedResponse' - post: - summary: Create an edge router - description: Create a edge router resource. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router - operationId: createEdgeRouter - parameters: - - name: edgeRouter - in: body - required: true - description: A edge router to create - schema: - $ref: '#/definitions/edgeRouterCreate' - responses: - '201': - $ref: '#/responses/createResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/edge-routers/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single edge router - description: Retrieves a single edge router by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router - operationId: detailEdgeRouter - responses: - '200': - $ref: '#/responses/detailEdgeRouter' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - put: - summary: Update all fields on an edge router - description: Update all fields on an edge router by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router - operationId: updateEdgeRouter - parameters: - - name: edgeRouter - in: body - required: true - description: An edge router update object - schema: - $ref: '#/definitions/edgeRouterUpdate' - responses: - '200': - $ref: '#/responses/updateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - patch: - summary: Update the supplied fields on an edge router - description: Update the supplied fields on an edge router. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router - operationId: patchEdgeRouter - parameters: - - name: edgeRouter - in: body - required: true - description: An edge router patch object - schema: - $ref: '#/definitions/edgeRouterPatch' - responses: - '200': - $ref: '#/responses/patchResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete an edge router - description: Delete an edge router by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router - operationId: deleteEdgeRouter - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '409': - $ref: '#/responses/cannotDeleteReferencedResourceResponse' - '/edge-routers/{id}/edge-router-policies': - parameters: - - $ref: '#/parameters/id' - get: - summary: List the edge router policies that affect an edge router - description: Retrieves a list of edge router policies that apply to the specified edge router. - security: - - ztSession: [ ] - tags: - - Edge Router - operationId: listEdgeRouterEdgeRouterPolicies - responses: - '200': - $ref: '#/responses/listEdgeRouterPolicies' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/edge-routers/{id}/identities': - parameters: - - $ref: '#/parameters/id' - get: - summary: List associated identities - description: | - Retrieves a list of identities that may access services via the given edge router. Supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router - operationId: listEdgeRouterIdentities - responses: - '200': - $ref: '#/responses/listIdentities' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/edge-routers/{id}/service-edge-router-policies': - parameters: - - $ref: '#/parameters/id' - get: - summary: List the service policies that affect an edge router - description: Retrieves a list of service policies policies that apply to the specified edge router. - security: - - ztSession: [ ] - tags: - - Edge Router - operationId: listEdgeRouterServiceEdgeRouterPolicies - responses: - '200': - $ref: '#/responses/listServicePolicies' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - - '/edge-routers/{id}/services': - parameters: - - $ref: '#/parameters/id' - get: - summary: List associated services - description: | - Retrieves a list of services that may be accessed via the given edge router. Supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Edge Router - operationId: listEdgeRouterServices - responses: - '200': - $ref: '#/responses/listServices' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - ################################################################### - # Enroll - Identity - ################################################################## - '/enroll': - parameters: - - $ref: '#/parameters/token-optional' - post: - summary: Legacy enrollment endpoint - description: endpoint defers to the logic in the more specific `enroll/*` endpoints - operationId: enroll - tags: - - Enroll - consumes: - - application/pkcs10 - - application/json - - application/x-pem-file - - text/plain - produces: - #default to PEM for older clients that do not properly set/inspect accept/content-type headers - - application/x-pem-file - - application/json - responses: - '200': - $ref: '#/responses/emptyResponse' - '404': - $ref: '#/responses/notFoundResponse' - '/enroll/ca': - post: - summary: Enroll an identity with a pre-exchanged certificate - description: | - For CA auto enrollment, an identity is not created beforehand. - Instead one will be created during enrollment. The client will present a client certificate that is signed by a - Certificate Authority that has been added and verified (See POST /cas and POST /cas/{id}/verify). - - During this process no CSRs are requires as the client should already be in possession of a valid certificate. - operationId: enrollCa - tags: - - Enroll - responses: - '200': - $ref: '#/responses/emptyResponse' - '404': - $ref: '#/responses/notFoundResponse' - '/enroll/ott': - parameters: - - $ref: '#/parameters/token' - post: - summary: Enroll an identity via one-time-token - description: | - Enroll an identity via a one-time-token which is supplied via a query string parameter. This enrollment method - expects a PEM encoded CSRs to be provided for fulfillment. It is up to the enrolling identity to manage the - private key backing the CSR request. - operationId: enrollOtt - tags: - - Enroll - consumes: - - application/pkcs10 - produces: - - application/x-x509-user-cert - responses: - '200': - $ref: '#/responses/zitiSignedCert' - '404': - $ref: '#/responses/notFoundResponse' - '/enroll/ottca': - parameters: - - $ref: '#/parameters/token' - post: - summary: Enroll an identity via one-time-token with a pre-exchanged client certificate - description: | - Enroll an identity via a one-time-token that also requires a pre-exchanged client certificate to match a - Certificate Authority that has been added and verified (See POST /cas and POST /cas{id}/verify). The client - must present a client certificate signed by CA associated with the enrollment. This enrollment is similar to - CA auto enrollment except that is required the identity to be pre-created. - - As the client certificate has been pre-exchanged there is no CSR input to this enrollment method. - operationId: enrollOttCa - tags: - - Enroll - responses: - '200': - $ref: '#/responses/emptyResponse' - '/enroll/updb': - parameters: - - $ref: '#/parameters/token' - post: - summary: Enroll an identity via one-time-token - description: | - Enrolls an identity via a one-time-token to establish an initial username and password combination - operationId: ernollUpdb - tags: - - Enroll - responses: - '200': - $ref: '#/responses/emptyResponse' - '404': - $ref: '#/responses/notFoundResponse' - ################################################################### - # Enroll - Routers - ################################################################## - '/enroll/erott': - parameters: - - $ref: '#/parameters/token' - post: - summary: Enroll an edge-router - description: | - Enrolls an edge-router via a one-time-token to establish a certificate based identity. - operationId: enrollErOtt - tags: - - Enroll - responses: - '200': - $ref: '#/responses/erottResponse' - - '/enroll/extend/router': - post: - summary: Extend the life of a currently enrolled router's certificates - description: | - Allows a router to extend its certificates' expiration date by - using its current and valid client certificate to submit a CSR. This CSR may - be pased in using a new private key, thus allowing private key rotation or swapping. - - After completion any new connections must be made with certificates returned from a 200 OK - response. Previous client certificate is rendered invalid for use with the controller even if it - has not expired. - - This request must be made using the existing, valid, client certificate. - operationId: extendRouterEnrollment - parameters: - - name: routerExtendEnrollmentRequest - in: body - required: true - schema: - $ref: '#/definitions/routerExtendEnrollmentRequest' - tags: - - Enroll - - Extend Enrollment - responses: - '200': - $ref: '#/responses/routerExtendEnrollmentResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - - ################################################################### - # Enrollments - ################################################################## - '/enrollments': - get: - summary: List outstanding enrollments - description: | - Retrieves a list of outstanding enrollments; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Enrollment - operationId: listEnrollments - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listEnrollments' - '401': - $ref: '#/responses/unauthorizedResponse' - '/enrollments/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves an outstanding enrollment - description: Retrieves a single outstanding enrollment by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Enrollment - operationId: detailEnrollment - responses: - '200': - $ref: '#/responses/detailEnrollment' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete an outstanding enrollment - description: Delete an outstanding enrollment by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Enrollment - operationId: deleteEnrollment - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - - ################################################################### - # Geo Regions - ################################################################## - '/geo-regions': - get: - summary: List available geo-regions - description: | - Retrieves a list of geo-regions; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Geo Region - operationId: listGeoRegions - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listGeoRegions' - '401': - $ref: '#/responses/unauthorizedResponse' - '/geo-regions/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a geo-region - description: Retrieves a single geo-region by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Geo Region - operationId: detailGeoRegion - responses: - '200': - $ref: '#/responses/detailGeoRegion' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - ################################################################### - # Identities - ################################################################## - '/identities': - get: - summary: List identities - description: | - Retrieves a list of identity resources; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Identity - operationId: listIdentities - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - - $ref: '#/parameters/roleFilter' - - $ref: '#/parameters/roleSemantic' - responses: - '200': - $ref: '#/responses/listIdentities' - '401': - $ref: '#/responses/unauthorizedResponse' - post: - summary: Create an identity resource - description: Create an identity resource. Requires admin access. - security: - - ztSession: [ ] - tags: - - Identity - operationId: createIdentity - parameters: - - name: identity - in: body - required: true - description: An identity to create - schema: - $ref: '#/definitions/identityCreate' - responses: - '201': - $ref: '#/responses/createResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/identities/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single identity - description: Retrieves a single identity by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Identity - operationId: detailIdentity - responses: - '200': - $ref: '#/responses/detailIdentity' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - put: - summary: Update all fields on an identity - description: Update all fields on an identity by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Identity - operationId: updateIdentity - parameters: - - name: identity - in: body - required: true - description: An identity update object - schema: - $ref: '#/definitions/identityUpdate' - responses: - '200': - $ref: '#/responses/updateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - patch: - summary: Update the supplied fields on an identity - description: Update the supplied fields on an identity. Requires admin access. - security: - - ztSession: [ ] - tags: - - Identity - operationId: patchIdentity - parameters: - - name: identity - in: body - required: true - description: An identity patch object - schema: - $ref: '#/definitions/identityPatch' - responses: - '200': - $ref: '#/responses/patchResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete an identity - description: Delete an identity by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Identity - operationId: deleteIdentity - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '409': - $ref: '#/responses/cannotDeleteReferencedResourceResponse' - '/identities/{id}/edge-router-policies': - parameters: - - $ref: '#/parameters/id' - get: - summary: List the edge router policies that affect an idenitty - description: Retrieves a list of edge router policies that apply to the specified identity. - security: - - ztSession: [ ] - tags: - - Identity - operationId: listIdentitysEdgeRouterPolicies - responses: - '200': - $ref: '#/responses/listEdgeRouterPolicies' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/identities/{id}/service-configs': - parameters: - - $ref: '#/parameters/id' - get: - summary: List the service configs associated a specific identity - description: Retrieves a list of service configs associated to a specific identity - security: - - ztSession: [ ] - tags: - - Identity - operationId: listIdentitysServiceConfigs - responses: - '200': - $ref: '#/responses/listServiceConfigs' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - post: - summary: Associate service configs for a specific identity - description: Associate service configs to a specific identity - parameters: - - name: serviceConfigs - in: body - required: true - description: A service config patch object - schema: - $ref: '#/definitions/serviceConfigsAssignList' - security: - - ztSession: [ ] - tags: - - Identity - operationId: associateIdentitysServiceConfigs - responses: - '200': - $ref: '#/responses/emptyResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Remove associated service configs from a specific identity - description: Remove service configs from a specific identity - parameters: - - name: serviceConfigIdPairs - in: body - required: false - description: An array of service and config id pairs to remove - schema: - $ref: '#/definitions/serviceConfigsAssignList' - security: - - ztSession: [ ] - tags: - - Identity - operationId: disassociateIdentitysServiceConfigs - responses: - '200': - $ref: '#/responses/emptyResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/identities/{id}/service-policies': - parameters: - - $ref: '#/parameters/id' - get: - summary: List the service policies that affect an identity - description: Retrieves a list of service policies that apply to the specified identity. - security: - - ztSession: [ ] - tags: - - Identity - operationId: listIdentityServicePolicies - responses: - '200': - $ref: '#/responses/listServicePolicies' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - - '/identities/{id}/edge-routers': - parameters: - - $ref: '#/parameters/id' - get: - summary: List accessible edge-routers - description: | - Retrieves a list of edge-routers that the given identity may use to access services. Supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Identity - operationId: listIdentityEdgeRouters - responses: - '200': - $ref: '#/responses/listEdgeRouters' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - - '/identities/{id}/services': - parameters: - - $ref: '#/parameters/id' - get: - summary: List accessible services - description: | - Retrieves a list of services that the given identity has access to. Supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Identity - operationId: listIdentityServices - responses: - '200': - $ref: '#/responses/listEdgeRouters' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - - '/identities/{id}/policy-advice/{serviceId}': - parameters: - - $ref: '#/parameters/id' - - $ref: '#/parameters/serviceId' - get: - summary: Analyze policies relating the given identity and service - description: | - Analyzes policies to see if the given identity should be able to dial or bind the given service. | - Will check services policies to see if the identity can access the service. Will check edge router policies | - to check if the identity and service have access to common edge routers so that a connnection can be made. | - Will also check if at least one edge router is on-line. Requires admin access. - security: - - ztSession: [ ] - tags: - - Identity - operationId: getIdentityPolicyAdvice - responses: - '200': - $ref: '#/responses/getIdentityPolicyAdvice' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/identities/{id}/posture-data': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieve the curent posture data for a specific identity. - description: | - Returns a nested map data represeting the posture data of the identity. - This data should be considered volatile. - security: - - ztSession: [ ] - tags: - - Identity - operationId: getIdentityPostureData - responses: - '200': - $ref: '#/responses/getIdentityPostureData' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/identities/{id}/failed-service-requests': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieve a list of the most recent service failure requests due to posture checks - description: | - Returns a list of service session requests that failed due to posture checks. The entries will contain - every policy that was verified against and every failed check in each policy. Each check will include - the historical posture data and posture check configuration. - security: - - ztSession: [ ] - tags: - - Identity - operationId: getIdentityFailedServiceRequests - responses: - '200': - $ref: '#/responses/getIdentityFailedServiceRequest' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/identities/{id}/mfa': - parameters: - - $ref: '#/parameters/id' - delete: - summary: Remove MFA from an identitity - description: | - Allows an admin to remove MFA enrollment from a specific identity. Requires admin. - security: - - ztSession: [ ] - tags: - - Identity - - MFA - operationId: removeIdentityMfa - responses: - '200': - $ref: '#/responses/emptyResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - ################################################################### - # Identity-Types - ################################################################## - '/identity-types': - get: - summary: List available identity types - description: | - Retrieves a list of identity types; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Identity - operationId: listIdentityTypes - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listIdentityTypes' - '401': - $ref: '#/responses/unauthorizedResponse' - '/identity-types/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a identity type - description: Retrieves a single identity type by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Identity - operationId: detailIdentityType - responses: - '200': - $ref: '#/responses/detailIdentityType' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - ################################################################### - # Service Edge Router Policies - ################################################################## - '/service-edge-router-policies': - get: - summary: List service edge router policies - description: | - Retrieves a list of service edge router policy resources; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Edge Router Policy - operationId: listServiceEdgeRouterPolicies - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listServiceEdgeRouterPolicies' - '401': - $ref: '#/responses/unauthorizedResponse' - post: - summary: Create a service edge router policy resource - description: Create a service edge router policy resource. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Edge Router Policy - operationId: createServiceEdgeRouterPolicy - parameters: - - name: policy - in: body - required: true - description: A service edge router policy to create - schema: - $ref: '#/definitions/serviceEdgeRouterPolicyCreate' - responses: - '201': - $ref: '#/responses/createResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/service-edge-router-policies/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single service edge policy - description: Retrieves a single service edge policy by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Edge Router Policy - operationId: detailServiceEdgeRouterPolicy - responses: - '200': - $ref: '#/responses/detailServiceEdgePolicy' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - put: - summary: Update all fields on a service edge policy - description: Update all fields on a service edge policy by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Edge Router Policy - operationId: updateServiceEdgeRouterPolicy - parameters: - - name: policy - in: body - required: true - description: A service edge router policy update object - schema: - $ref: '#/definitions/serviceEdgeRouterPolicyUpdate' - responses: - '200': - $ref: '#/responses/updateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - patch: - summary: Update the supplied fields on a service edge policy - description: Update the supplied fields on a service edge policy. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Edge Router Policy - operationId: patchServiceEdgeRouterPolicy - parameters: - - name: policy - in: body - required: true - description: A service edge router policy patch object - schema: - $ref: '#/definitions/serviceEdgeRouterPolicyPatch' - responses: - '200': - $ref: '#/responses/patchResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete a service edge policy - description: Delete a service edge policy by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Edge Router Policy - operationId: deleteServiceEdgeRouterPolicy - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '409': - $ref: '#/responses/cannotDeleteReferencedResourceResponse' - '/service-edge-router-policies/{id}/edge-routers': - parameters: - - $ref: '#/parameters/id' - get: - summary: List the edge routers that a service edge router policy applies to - description: List the edge routers that a service edge router policy applies to - security: - - ztSession: [ ] - tags: - - Service Edge Router Policy - operationId: listServiceEdgeRouterPolicyEdgeRouters - responses: - '200': - $ref: '#/responses/listEdgeRouters' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/service-edge-router-policies/{id}/services': - parameters: - - $ref: '#/parameters/id' - get: - summary: List the services that a service edge router policy applies to - description: List the services that a service edge router policy applies to - security: - - ztSession: [ ] - tags: - - Service Edge Router Policy - operationId: listServiceEdgeRouterPolicyServices - responses: - '200': - $ref: '#/responses/listServices' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - - ################################################################### - # Service Policies - ################################################################## - '/service-policies': - get: - summary: List service policies - description: | - Retrieves a list of service policy resources; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Policy - operationId: listServicePolicies - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listServicePolicies' - '401': - $ref: '#/responses/unauthorizedResponse' - post: - summary: Create a service policy resource - description: Create a service policy resource. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Policy - operationId: createServicePolicy - parameters: - - name: policy - in: body - required: true - description: A service policy to create - schema: - $ref: '#/definitions/servicePolicyCreate' - responses: - '201': - $ref: '#/responses/createResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/service-policies/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single service policy - description: Retrieves a single service policy by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Policy - operationId: detailServicePolicy - responses: - '200': - $ref: '#/responses/detailServicePolicy' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - put: - summary: Update all fields on a service policy - description: Update all fields on a service policy by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Policy - operationId: updateServicePolicy - parameters: - - name: policy - in: body - required: true - description: A service policy update object - schema: - $ref: '#/definitions/servicePolicyUpdate' - responses: - '200': - $ref: '#/responses/updateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - patch: - summary: Update the supplied fields on a service policy - description: Update the supplied fields on a service policy. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Policy - operationId: patchServicePolicy - parameters: - - name: policy - in: body - required: true - description: A service policy patch object - schema: - $ref: '#/definitions/servicePolicyPatch' - responses: - '200': - $ref: '#/responses/patchResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete a service policy - description: Delete a service policy by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Policy - operationId: deleteServicePolicy - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '409': - $ref: '#/responses/cannotDeleteReferencedResourceResponse' - '/service-policies/{id}/identities': - parameters: - - $ref: '#/parameters/id' - get: - summary: List identities a service policy affects - description: | - Retrieves a list of identity resources that are affected by a service policy; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Policy - operationId: listServicePolicyIdentities - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listIdentities' - '401': - $ref: '#/responses/unauthorizedResponse' - '400': - $ref: '#/responses/notFoundResponse' - '/service-policies/{id}/services': - parameters: - - $ref: '#/parameters/id' - get: - summary: List services a service policy affects - description: | - Retrieves a list of service resources that are affected by a service policy; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Policy - operationId: listServicePolicyServices - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listServices' - '401': - $ref: '#/responses/unauthorizedResponse' - '400': - $ref: '#/responses/notFoundResponse' - '/service-policies/{id}/posture-checks': - parameters: - - $ref: '#/parameters/id' - get: - summary: List posture check a service policy includes - description: | - Retrieves a list of posture check resources that are affected by a service policy; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service Policy - operationId: listServicePolicyPostureChecks - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listPostureChecks' - '401': - $ref: '#/responses/unauthorizedResponse' - '400': - $ref: '#/responses/notFoundResponse' - ################################################################### - # Services - ################################################################## - '/services': - get: - summary: List services - description: | - Retrieves a list of config resources; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service - operationId: listServices - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - - $ref: '#/parameters/roleFilter' - - $ref: '#/parameters/roleSemantic' - responses: - '200': - $ref: '#/responses/listServices' - '401': - $ref: '#/responses/unauthorizedResponse' - post: - summary: Create a services resource - description: Create a services resource. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service - operationId: createService - parameters: - - name: service - in: body - required: true - description: A service to create - schema: - $ref: '#/definitions/serviceCreate' - responses: - '201': - $ref: '#/responses/createResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/services/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single service - description: Retrieves a single service by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service - operationId: detailService - responses: - '200': - $ref: '#/responses/detailService' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - put: - summary: Update all fields on a service - description: Update all fields on a service by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service - operationId: updateService - parameters: - - name: service - in: body - required: true - description: A service update object - schema: - $ref: '#/definitions/serviceUpdate' - responses: - '200': - $ref: '#/responses/updateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - patch: - summary: Update the supplied fields on a service - description: Update the supplied fields on a service. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service - operationId: patchService - parameters: - - name: service - in: body - required: true - description: A service patch object - schema: - $ref: '#/definitions/servicePatch' - responses: - '200': - $ref: '#/responses/patchResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete a service - description: Delete a service by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service - operationId: deleteService - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '409': - $ref: '#/responses/cannotDeleteReferencedResourceResponse' - '/services/{id}/configs': - parameters: - - $ref: '#/parameters/id' - get: - summary: List configs associated to a specific service - description: | - Retrieves a list of config resources associated to a specific service; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service - operationId: listServiceConfig - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listConfigs' - '401': - $ref: '#/responses/unauthorizedResponse' - '/services/{id}/service-edge-router-policies': - parameters: - - $ref: '#/parameters/id' - get: - summary: List service edge router policies that affect a specific service - description: | - Retrieves a list of service edge router policy resources that affect a specific service; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service - operationId: listServiceServiceEdgeRouterPolicies - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listServiceEdgeRouterPolicies' - '401': - $ref: '#/responses/unauthorizedResponse' - '/services/{id}/service-policies': - parameters: - - $ref: '#/parameters/id' - get: - summary: List service policies that affect a specific service - description: | - Retrieves a list of service policy resources that affect specific service; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service - operationId: listServiceServicePolicies - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listServicePolicies' - '401': - $ref: '#/responses/unauthorizedResponse' - - '/services/{id}/identities': - parameters: - - $ref: '#/parameters/id' - get: - summary: List identities with access - description: | - Retrieves a list of identities that have access to this service. Supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service - operationId: listServiceIdentities - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listIdentities' - '401': - $ref: '#/responses/unauthorizedResponse' - - '/services/{id}/edge-routers': - parameters: - - $ref: '#/parameters/id' - get: - summary: List accessible edge-routers - description: | - Retrieves a list of edge-routers that may be used to access the given service. Supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Service - operationId: listServiceEdgeRouters - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listEdgeRouters' - '401': - $ref: '#/responses/unauthorizedResponse' - - '/services/{id}/terminators': - parameters: - - $ref: '#/parameters/id' - get: - summary: List of terminators assigned to a service - description: | - Retrieves a list of terminator resources that are assigned specific service; supports filtering, sorting, and pagination. - security: - - ztSession: [ ] - tags: - - Service - operationId: listServiceTerminators - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listTerminators' - '401': - $ref: '#/responses/unauthorizedResponse' - ################################################################### - # Sessions - ################################################################## - '/sessions': - get: - summary: List sessions - description: | - Retrieves a list of active sessions resources; supports filtering, sorting, and pagination. Requires admin access. - - Sessions are tied to an API session and are moved when an API session times out or logs out. Active sessions - (i.e. Ziti SDK connected to an edge router) will keep the session and API session marked as active. - security: - - ztSession: [ ] - tags: - - Session - operationId: listSessions - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listSessions' - '401': - $ref: '#/responses/unauthorizedResponse' - post: - summary: Create a session resource - description: Create a session resource. Requires admin access. - security: - - ztSession: [ ] - tags: - - Session - operationId: createSession - parameters: - - name: session - in: body - required: true - description: A session to create - schema: - $ref: '#/definitions/sessionCreate' - responses: - '201': - $ref: '#/responses/sessionCreateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/sessions/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single session - description: Retrieves a single session by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Session - operationId: detailSession - responses: - '200': - $ref: '#/responses/detailSession' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete a session - description: Delete a session by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Session - operationId: deleteSession - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '409': - $ref: '#/responses/cannotDeleteReferencedResourceResponse' - '/sessions/{id}/route-path': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single session's router path - description: Retrieves a single session's route path by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Session - operationId: detailSessionRoutePath - responses: - '200': - $ref: '#/responses/detailSessionRoutePath' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - ################################################################### - # Terminators - ################################################################## - '/terminators': - get: - summary: List terminators - description: | - Retrieves a list of terminator resources; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Terminator - operationId: listTerminators - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listTerminators' - '401': - $ref: '#/responses/unauthorizedResponse' - post: - summary: Create a terminator resource - description: Create a terminator resource. Requires admin access. - security: - - ztSession: [ ] - tags: - - Terminator - operationId: createTerminator - parameters: - - name: terminator - in: body - required: true - description: A terminator to create - schema: - $ref: '#/definitions/terminatorCreate' - responses: - '201': - $ref: '#/responses/createResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/terminators/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single terminator - description: Retrieves a single terminator by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Terminator - operationId: detailTerminator - responses: - '200': - $ref: '#/responses/detailTerminator' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - put: - summary: Update all fields on a terminator - description: Update all fields on a terminator by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Terminator - operationId: updateTerminator - parameters: - - name: terminator - in: body - required: true - description: A terminator update object - schema: - $ref: '#/definitions/terminatorUpdate' - responses: - '200': - $ref: '#/responses/updateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - patch: - summary: Update the supplied fields on a terminator - description: Update the supplied fields on a terminator. Requires admin access. - security: - - ztSession: [ ] - tags: - - Terminator - operationId: patchTerminator - parameters: - - name: terminator - in: body - required: true - description: A terminator patch object - schema: - $ref: '#/definitions/terminatorPatch' - responses: - '200': - $ref: '#/responses/patchResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete a terminator - description: Delete a terminator by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Terminator - operationId: deleteTerminator - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '409': - $ref: '#/responses/cannotDeleteReferencedResourceResponse' - - ################################################################### - # List Role Attributes in Use - ################################################################## - '/edge-router-role-attributes': - get: - summary: List role attributes in use by edge routers - description: | - Retrieves a list of role attributes in use by edge routers; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Role Attributes - operationId: listEdgeRouterRoleAttributes - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listRoleAttributes' - '401': - $ref: '#/responses/unauthorizedResponse' - - '/identity-role-attributes': - get: - summary: List role attributes in use by identities - description: | - Retrieves a list of role attributes in use by identities; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Role Attributes - operationId: listIdentityRoleAttributes - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listRoleAttributes' - '401': - $ref: '#/responses/unauthorizedResponse' - - '/service-role-attributes': - get: - summary: List role attributes in use by services - description: | - Retrieves a list of role attributes in use by services; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Role Attributes - operationId: listServiceRoleAttributes - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listRoleAttributes' - '401': - $ref: '#/responses/unauthorizedResponse' - ################################################################### - # Transit Routers - ################################################################## - '/transit-routers': - get: - summary: List transit routers - description: | - Retrieves a list of transit router resources; supports filtering, sorting, and pagination. Requires admin access. - security: - - ztSession: [ ] - tags: - - Transit Router - operationId: listTransitRouters - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listTransitRouters' - '401': - $ref: '#/responses/unauthorizedResponse' - post: - summary: Create a transit router resource - description: Create a transit router resource. Requires admin access. - security: - - ztSession: [ ] - tags: - - Transit Router - operationId: createTransitRouter - parameters: - - name: router - in: body - required: true - description: A transit router to create - schema: - $ref: '#/definitions/transitRouterCreate' - responses: - '201': - $ref: '#/responses/createResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/transit-routers/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single transit router - description: Retrieves a single transit router by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Transit Router - operationId: detailTransitRouter - responses: - '200': - $ref: '#/responses/detailTransitRouter' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - put: - summary: Update all fields on a transit router - description: Update all fields on a transit router by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Transit Router - operationId: updateTransitRouter - parameters: - - name: router - in: body - required: true - description: A transit router update object - schema: - $ref: '#/definitions/transitRouterUpdate' - responses: - '200': - $ref: '#/responses/updateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - patch: - summary: Update the supplied fields on a transit router - description: Update the supplied fields on a transit router. Requires admin access. - security: - - ztSession: [ ] - tags: - - Transit Router - operationId: patchTransitRouter - parameters: - - name: router - in: body - required: true - description: A transit router patch object - schema: - $ref: '#/definitions/transitRouterPatch' - responses: - '200': - $ref: '#/responses/patchResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Delete a transit router - description: Delete a transit router by id. Requires admin access. - security: - - ztSession: [ ] - tags: - - Transit Router - operationId: deleteTransitRouter - responses: - '200': - $ref: '#/responses/deleteResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '409': - $ref: '#/responses/cannotDeleteReferencedResourceResponse' - - ################################################################### - # Database - ################################################################## - '/database/snapshot': - post: - summary: Create a new database snapshot - description: Create a new database snapshot. Requires admin access. - security: - - ztSession: [ ] - tags: - - Database - operationId: createDatabaseSnapshot - responses: - '200': - $ref: '#/responses/emptyResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '429': - $ref: '#/responses/rateLimitedResponse' - /database/check-data-integrity: - post: - summary: Starts a data integrity scan on the datastore - description: Starts a data integrity scan on the datastore. Requires admin access. Only once instance may run at a time, including runs of fixDataIntegrity. - security: - - ztSession: [ ] - tags: - - Database - operationId: checkDataIntegrity - responses: - '202': - $ref: '#/responses/emptyResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '429': - $ref: '#/responses/rateLimitedResponse' - /database/fix-data-integrity: - post: - summary: Runs a data integrity scan on the datastore, attempts to fix any issues it can and returns any found issues - description: Runs a data integrity scan on the datastore, attempts to fix any issues it can, and returns any found issues. Requires admin access. Only once instance may run at a time, including runs of checkDataIntegrity. - security: - - ztSession: [ ] - tags: - - Database - operationId: fixDataIntegrity - responses: - '202': - $ref: '#/responses/emptyResponse' - '429': - $ref: '#/responses/rateLimitedResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - /database/data-integrity-results: - get: - summary: Returns any results found from in-progress integrity checks - description: Returns any results found from in-progress integrity checks. Requires admin access. - security: - - ztSession: [ ] - tags: - - Database - operationId: dataIntegrityResults - responses: - '200': - $ref: '#/responses/dataIntegrityCheckResult' - '401': - $ref: '#/responses/unauthorizedResponse' - - ################################################################### - # Posture Check Types - ################################################################## - '/posture-check-types': - get: - summary: List a subset of posture check types - description: | - Retrieves a list of posture check types - security: - - ztSession: [ ] - tags: - - Posture Checks - operationId: listPostureCheckTypes - produces: - - application/json; charset=utf-8 - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - responses: - '200': - $ref: '#/responses/listPostureCheckTypes' - '/posture-check-types/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single posture check type - description: Retrieves a single posture check type by id - security: - - ztSession: [ ] - tags: - - Posture Checks - operationId: detailPostureCheckType - responses: - '200': - $ref: '#/responses/detailPostureCheckType' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - ################################################################### - # Posture Response - ################################################################## - '/posture-response': - post: - summary: Submit a posture response to a posture query - description: Submits posture responses - security: - - ztSession: [ ] - tags: - - Posture Checks - operationId: createPostureResponse - parameters: - - name: postureResponse - in: body - required: true - description: A Posture Response - schema: - $ref: '#/definitions/PostureResponseCreate' - responses: - '201': - $ref: '#/responses/createResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/posture-response-bulk': - post: - summary: Submit multiple posture responses - description: Submits posture responses - security: - - ztSession: [ ] - tags: - - Posture Checks - operationId: createPostureResponseBulk - parameters: - - name: postureResponse - in: body - required: true - description: A Posture Response - schema: - # using a named array definition causes issues w/ code gen - type: array - items: - $ref: "#/definitions/PostureResponseCreate" - responses: - '200': - $ref: '#/responses/emptyResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - ################################################################### - # Posture Checks - ################################################################## - '/posture-checks': - get: - summary: List a subset of posture checks - description: | - Retrieves a list of posture checks - security: - - ztSession: [ ] - tags: - - Posture Checks - operationId: listPostureChecks - produces: - - application/json; charset=utf-8 - parameters: - - $ref: '#/parameters/limit' - - $ref: '#/parameters/offset' - - $ref: '#/parameters/filter' - - $ref: '#/parameters/roleFilter' - - $ref: '#/parameters/roleSemantic' - responses: - '200': - $ref: '#/responses/listPostureChecks' - post: - summary: Creates a Posture Checks - description: Creates a Posture Checks - security: - - ztSession: [ ] - tags: - - Posture Checks - operationId: createPostureCheck - parameters: - - name: postureCheck - in: body - required: true - description: A Posture Check to create - schema: - $ref: '#/definitions/PostureCheckCreate' - responses: - '201': - $ref: '#/responses/createResponse' - '400': - $ref: '#/responses/badRequestResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - '/posture-checks/{id}': - parameters: - - $ref: '#/parameters/id' - get: - summary: Retrieves a single Posture Checks - description: Retrieves a single Posture Checks by id - security: - - ztSession: [ ] - tags: - - Posture Checks - operationId: detailPostureCheck - responses: - '200': - $ref: '#/responses/detailPostureCheck' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - put: - summary: Update all fields on a Posture Checks - description: Update all fields on a Posture Checks by id - security: - - ztSession: [ ] - tags: - - Posture Checks - operationId: updatePostureCheck - parameters: - - name: postureCheck - in: body - required: true - description: A Posture Check update object - schema: - $ref: '#/definitions/PostureCheckUpdate' - responses: - '200': - $ref: '#/responses/updateResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - patch: - summary: Update the supplied fields on a Posture Checks - description: Update only the supplied fields on a Posture Checks by id - security: - - ztSession: [ ] - tags: - - Posture Checks - operationId: patchPostureCheck - parameters: - - name: postureCheck - in: body - required: true - description: A Posture Check patch object - schema: - $ref: '#/definitions/PostureCheckPatch' - responses: - '200': - $ref: '#/responses/patchResponse' - '400': - $ref: '#/responses/badRequestResponse' - '404': - $ref: '#/responses/notFoundResponse' - '401': - $ref: '#/responses/unauthorizedResponse' - delete: - summary: Deletes an Posture Checks - description: Deletes and Posture Checks by id - security: - - ztSession: [ ] - tags: - - Posture Checks - operationId: deletePostureCheck - responses: - '200': - $ref: '#/responses/deleteResponse' - '404': - $ref: '#/responses/notFoundResponse' - '403': - $ref: '#/responses/unauthorizedResponse' - -####################################################################################################################### -# -# Parameters - Reusable parameters -# -####################################################################################################################### -parameters: - id: - name: id - required: true - type: string - in: path - description: The id of the requested resource - serviceId: - name: serviceId - required: true - type: string - in: path - description: The id of a service - limit: - name: limit - type: integer - in: query - offset: - name: offset - type: integer - in: query - filter: - name: filter - type: string - in: query - token: - name: token - type: string - format: uuid - in: query - required: true - token-optional: - name: token - type: string - format: uuid - in: query - authMethod: - name: method - in: query - required: true - type: string - enum: - - password - - cert - roleFilter: - name: roleFilter - type: array - in: query - collectionFormat: multi - items: - type: string - roleSemantic: - name: roleSemantic - type: string - in: query - -####################################################################################################################### -# -# Responses - Envelope Wrapped Definitions -# -####################################################################################################################### -responses: - ################################################################### - # Errors - ################################################################## - badRequestResponse: - description: The supplied request contains invalid fields or could not be parsed (json and non-json bodies). The error's code, message, and cause fields can be inspected for further information - schema: - $ref: '#/definitions/apiErrorEnvelope' - examples: - 'application/json': - error: - args: - urlVars: { } - cause: - field: '(root)' - type: required - value: - fooField: abc - fooField2: def - message: '(root): fooField3 is required' - details: - context: '(root)' - field: '(root)' - property: fooField3 - causeMessage: schema validation failed - code: COULD_NOT_VALIDATE - message: The supplied request contains an invalid document - requestId: ac6766d6-3a09-44b3-8d8a-1b541d97fdd9 - meta: - apiEnrolmentVersion: 0.0.1 - apiVersion: 0.0.1 - unauthorizedResponse: - description: The currently supplied session does not have the correct access rights to request this resource - schema: - $ref: '#/definitions/apiErrorEnvelope' - examples: - 'application/json': - error: - args: - urlVars: { } - cause: '' - causeMessage: '' - code: UNAUTHORIZED - message: The request could not be completed. The session is not authorized or the - credentials are invalid - requestId: 0bfe7a04-9229-4b7a-812c-9eb3cc0eac0f - meta: - apiEnrolmentVersion: 0.0.1 - apiVersion: 0.0.1 - invalidAuthResponse: - description: The authentication request could not be processed as the credentials are invalid - schema: - $ref: '#/definitions/apiErrorEnvelope' - examples: - 'application/json': - error: - args: - urlVars: { } - cause: '' - causeMessage: '' - code: INVALID_AUTH - message: The authentication request failed - requestId: 5952ed10-3091-474f-a691-47ebab6990dc - meta: - apiEnrolmentVersion: 0.0.1 - apiVersion: 0.0.1 - notFoundResponse: - description: The requested resource does not exist - schema: - $ref: '#/definitions/apiErrorEnvelope' - examples: - 'application/json': - error: - args: - urlVars: - id: 71a3000f-7dda-491a-9b90-a19f4ee6c406 - cause: - causeMessage: '' - code: NOT_FOUND - message: The resource requested was not found or is no longer available - requestId: 270908d6-f2ef-4577-b973-67bec18ae376 - meta: - apiEnrolmentVersion: 0.0.1 - apiVersion: 0.0.1 - alreadyMfaEnrolledResponse: - description: The identity is already enrolled in MFA - schema: - $ref: '#/definitions/apiErrorEnvelope' - examples: - 'application/json': - error: - args: - cause: - causeMessage: '' - code: ALREADY_MFA_ENROLLED - message: The identity is already enrolled in MFA - requestId: 270908d6-f2ef-4577-b973-67bec18ae376 - meta: - apiEnrolmentVersion: 0.0.1 - apiVersion: 0.0.1 - cannotDeleteReferencedResourceResponse: - description: The resource requested to be removed/altered cannot be as it is referenced by another object. - schema: - $ref: '#/definitions/apiErrorEnvelope' - examples: - 'application/json': - error: - args: - urlVars: - id: 71a3000f-7dda-491a-9b90-a19f4ee6c406 - causeMessage: 'referenced by /some-resource/05f4f710-c155-4a74-86d5-77558eb9cb42' - code: CONFLICT_CANNOT_MODIFY_REFERENCED - message: The resource cannot be deleted/modified. Remove all referencing resources first. - requestId: 270908d6-f2ef-4577-b973-67bec18ae376 - meta: - apiEnrolmentVersion: 0.0.1 - apiVersion: 0.0.1 - rateLimitedResponse: - description: The resource requested is rate limited and the rate limit has been exceeded - schema: - $ref: '#/definitions/apiErrorEnvelope' - examples: - 'application/json': - error: - args: - urlVars: { } - causeMessage: 'you have hit a rate limit in the requested operation' - code: RATE_LIMITED - message: The resource is rate limited and the rate limit has been exceeded. Please try again later - requestId: 270908d6-f2ef-4577-b973-67bec18ae376 - meta: - apiEnrolmentVersion: 0.0.1 - apiVersion: 0.0.1 - ################################################################### - # Standard Responses - ################################################################## - emptyResponse: - description: Base empty response - schema: - $ref: '#/definitions/empty' - deleteResponse: - description: The delete request was successful and the resource has been removed - schema: - $ref: '#/definitions/empty' - updateResponse: - description: The update request was successful and the resource has been altered - schema: - $ref: '#/definitions/empty' - patchResponse: - description: The patch request was successful and the resource has been altered - schema: - $ref: '#/definitions/empty' - createResponse: - description: The create request was successful and the resource has been added at the following location - schema: - $ref: '#/definitions/createEnvelope' - sessionCreateResponse: - description: The create request was successful and the resource has been added at the following location - schema: - $ref: '#/definitions/sessionCreateEnvelope' - - ################################################################### - # Current Session - ################################################################## - detailCurrentAPISession: - description: The API session associated with the session used to issue the request - schema: - $ref: '#/definitions/currentAPISessionDetailEnvelope' - examples: - default: - meta: { } - data: - id: 27343114-b44f-406e-9981-f3c4f2f28d54 - createdAt: '2020-03-09T19:03:49.1883693Z' - updatedAt: '2020-03-09T19:04:21.5600897Z' - _links: - self: - href: './current-api-session' - tags: - - userField1: 123 - - userField2: asdf - token: 28bb0ed2-0577-4632-ae70-d17106b92871 - identity: - urlName: identities - id: 66352d7b-a6b2-4ce9-85bb-9f18e318704d - name: Default Admin - _links: - self: - href: './identities/66352d7b-a6b2-4ce9-85bb-9f18e318704d' - expiresAt: '2020-03-09T19:34:21.5600897Z' - configTypes: [ ] - - #################################################################### - # Current API Session: Certificates - ################################################################## - listCurrentApiSessionCertificates: - description: A list of the current API Session's certificate - schema: - $ref: '#/definitions/listCurrentAPISessionCertificatesEnvelope' - createCurrentApiSessionCertificateResponse: - description: A response of a create API Session certificate - schema: - $ref: '#/definitions/createCurrentApiSessionCertificateEnvelope' - detailCurrentApiSessionCertificate: - description: A response containing a single API Session certificate - schema: - $ref: '#/definitions/detailCurrentApiSessionCertificateEnvelope' - - ################################################################### - # Current Identity - ################################################################## - detailCurrentIdentity: - description: The identity associated with the API Session used to issue the request - schema: - $ref: '#/definitions/currentIdentityDetailEnvelope' - examples: - default: - meta: { } - data: - id: 66352d7b-a6b2-4ce9-85bb-9f18e318704d - createdAt: '2020-01-13T16:38:13.6854788Z' - updatedAt: '2020-01-13T16:38:13.6854788Z' - _links: - edge-router-policies: - href: './identities/66352d7b-a6b2-4ce9-85bb-9f18e318704d/edge-routers' - self: - href: './identities/66352d7b-a6b2-4ce9-85bb-9f18e318704d' - service-policies: - href: './identities/66352d7b-a6b2-4ce9-85bb-9f18e318704d/identities' - tags: { } - name: Default Admin - type: - urlName: identity-types - id: User - name: User - _links: - self: - href: './identity-types/User' - isDefaultAdmin: true - isAdmin: true - authenticators: - updb: - username: admin - enrollment: { } - roleAttributes: - $ref: '#/definitions/attributes' - - ################################################################### - # Current Identity: MFA - ################################################################## - mfaCreatedResponse: - description: The create request was succesful and the response contains the location and details to complete MFA enrollment - schema: - $ref: '#/definitions/mfaCreatedEnvelope' - - detailMfa: - description: The details of an MFA enrollment - schema: - $ref: '#/definitions/detailMfaEnvelope' - - detailMfaRecoveryCodes: - description: The recovery codes of an MFA enrollment - schema: - $ref: '#/definitions/detailMfaRecoveryCodesEnvelope' - - ################################################################### - # API Session - ################################################################## - listAPISessions: - description: A list of active API Sessions - schema: - $ref: '#/definitions/listAPISessionsEnvelope' - detailAPISession: - description: Retrieves a singular API Session by id - schema: - $ref: '#/definitions/detailAPISessionEnvelope' - - ################################################################### - # Authenticators - ################################################################## - listAuthenticators: - description: A list of authenticators - schema: - $ref: '#/definitions/listAuthenticatorsEnvelope' - detailAuthenticator: - description: A singular authenticator resource - schema: - $ref: '#/definitions/detailAuthenticatorEnvelope' - ################################################################### - # Certificate Authority - ################################################################## - listCas: - description: A list of Certificate Authorities (CAs) - schema: - $ref: '#/definitions/listCasEnvelope' - detailCa: - description: A singular Certificate Authority (CA) resource - schema: - $ref: '#/definitions/detailCaEnvelope' - ################################################################### - # Config-Types - ################################################################## - listConfigTypes: - description: A list of config-types - schema: - $ref: '#/definitions/listConfigTypesEnvelope' - detailConfigType: - description: A singular config-type resource - schema: - $ref: '#/definitions/detailConfigTypeEnvelope' - ################################################################### - # Configs - ################################################################## - listConfigs: - description: A list of configs - schema: - $ref: '#/definitions/listConfigsEnvelope' - detailConfig: - description: A singular config resource - schema: - $ref: '#/definitions/detailConfigEnvelope' - ################################################################### - # Informational - ################################################################## - listVersion: - description: Version information for the controller - schema: - $ref: '#/definitions/listVersionEnvelope' - listSummaryCounts: - description: Entity counts scopped to the current identitie's access - schema: - $ref: '#/definitions/listSummaryCountsEnvelope' - listProtocols: - description: A list of supported Edge protocols - schema: - $ref: '#/definitions/listProtocolsEnvelope' - ################################################################### - # Enrollments - ################################################################## - listEnrollments: - description: A list of enrollments - schema: - $ref: '#/definitions/listEnrollmentsEnvelope' - detailEnrollment: - description: A singular enrollment resource - schema: - $ref: '#/definitions/detailEnrollmentEnvelope' - zitiSignedCert: - description: A PEM encoded certificate signed by the internal Ziti CA - schema: - type: string - examples: - application/x-x509-user-cert: | - -----BEGIN CERTIFICATE----- - MIICzDCCAlGgAwIBAgIRAPkVg1jVKqnNGFpSB3lPbaIwCgYIKoZIzj0EAwIwXjEL - MAkGA1UEBhMCVVMxCzAJBgNVBAgMAk5DMRMwEQYDVQQKDApOZXRGb3VuZHJ5MS0w - KwYDVQQDDCROZXRGb3VuZHJ5IFppdGkgRXh0ZXJuYWwgQVBJIFJvb3QgQ0EwHhcN - MTgxMTE1MTI1NzE3WhcNMTkxMTI1MTI1NzE3WjBrMQswCQYDVQQGEwJVUzELMAkG - A1UECAwCTkMxEjAQBgNVBAcMCUNoYXJsb3R0ZTETMBEGA1UECgwKTmV0Rm91bmRy - eTEPMA0GA1UECwwGQWR2RGV2MRUwEwYDVQQDDAxaaXRpQ2xpZW50MDEwdjAQBgcq - hkjOPQIBBgUrgQQAIgNiAATTl2ft+/K9RvDgki9gSr9udNcV2bxD4LrWEdCdXNzF - iVUiEcEte9z/M0JRt8lgo17OjFvS+ecrAmLtIZNmQnH3+9YeafjeNPpvQsMKxlTN - MnU7Hka11GHc6swQZSyHvlKjgcUwgcIwCQYDVR0TBAIwADARBglghkgBhvhCAQEE - BAMCBaAwMwYJYIZIAYb4QgENBCYWJE9wZW5TU0wgR2VuZXJhdGVkIENsaWVudCBD - ZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUtx+Tej6lSYdjb8Jbc2QuvoEsI/swHwYDVR0j - BBgwFoAUcdTlRrnP43ZbQ3PGAbZMPE26+H4wDgYDVR0PAQH/BAQDAgXgMB0GA1Ud - JQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAKBggqhkjOPQQDAgNpADBmAjEAuXDS - H7KKMr+la+Yuh8d8Q9cLtXzdS0j6a8e7iOyPJmdWq2WuzNdbCfAfLgKXuxhSAjEA - sadZrXl1OBv11RGAKdYBIyRmfYUotCFAtCNKcfgBUxci0TDaKDA7r3jnjKT1d7Fs - -----END CERTIFICATE----- - erottResponse: - description: A response containing the edge routers signed certificates (server chain, server cert, CAs). - schema: - $ref: '#/definitions/enrollmentCertsEnvelope' - routerExtendEnrollmentResponse: - description: A response containg the edge routers new signed certificates (server chain, server cert, CAs). - schema: - $ref: '#/definitions/enrollmentCertsEnvelope' - ################################################################### - # Edge Routers - ################################################################## - listEdgeRouters: - description: A list of edge routers - schema: - $ref: '#/definitions/listEdgeRoutersEnvelope' - detailEdgeRouter: - description: A singular edge router resource - schema: - $ref: '#/definitions/detailedEdgeRouterEnvelope' - - listCurrentIdentityEdgeRouters: - description: A list of edge routers - schema: - $ref: '#/definitions/listCurrentIdentityEdgeRoutersEnvelope' - ################################################################### - # Edge Router Policies - ################################################################## - listEdgeRouterPolicies: - description: A list of edge router policies - schema: - $ref: '#/definitions/listEdgeRouterPoliciesEnvelope' - detailEdgeRouterPolicy: - description: A single edge router policy - schema: - $ref: '#/definitions/detailEdgeRouterPolicyEnvelope' - - ################################################################### - # Service Policies - ################################################################## - listServicePolicies: - description: A list of service policies - schema: - $ref: '#/definitions/listServicePoliciesEnvelope' - detailServicePolicy: - description: A single service policy - schema: - $ref: '#/definitions/detailServicePolicyEnvelop' - ################################################################### - # Services - ################################################################## - listServices: - description: A list of services - schema: - $ref: '#/definitions/listServicesEnvelope' - detailService: - description: A single service - schema: - $ref: '#/definitions/detailServiceEnvelope' - ################################################################### - # Identities - ################################################################## - listIdentities: - description: A list of identities - schema: - $ref: '#/definitions/listIdentitiesEnvelope' - detailIdentity: - description: A signle identity - schema: - $ref: '#/definitions/detailIdentityEnvelope' - ################################################################### - # Geo Regions - ################################################################## - listGeoRegions: - description: A list of geo-regions - schema: - $ref: '#/definitions/listGeoRegionsEnvelope' - detailGeoRegion: - description: A single geo-region - schema: - $ref: '#/definitions/detailGeoRegionEnvelope' - ################################################################### - # Identity-Types - ################################################################## - listIdentityTypes: - description: A list of identity types - schema: - $ref: '#/definitions/listIdentityTypesEnvelope' - detailIdentityType: - description: A single identity type - schema: - $ref: '#/definitions/detailIdentityTypeEnvelope' - ################################################################### - # Service Configs - ################################################################## - listServiceConfigs: - description: A list of service configs - schema: - $ref: '#/definitions/listServiceConfigsEnvelope' - ################################################################### - # Service Edge Router Policies - ################################################################## - listServiceEdgeRouterPolicies: - description: A list of service edge router policies - schema: - $ref: '#/definitions/listServiceEdgeRouterPoliciesEnvelope' - detailServiceEdgePolicy: - description: A single service edge router policy - schema: - $ref: '#/definitions/detailServiceEdgePolicyEnvelope' - ################################################################### - # Sessions - ################################################################## - listSessions: - description: A list of sessions - schema: - $ref: '#/definitions/listSessionsEnvelope' - detailSession: - description: A single session - schema: - $ref: '#/definitions/detailSessionEnvelope' - detailSessionRoutePath: - description: A single session's route path - schema: - $ref: '#/definitions/detailSessionRoutePathEnvelope' - ################################################################### - # Terminators - ################################################################## - listTerminators: - description: A list of terminators - schema: - $ref: '#/definitions/listTerminatorsEnvelope' - detailTerminator: - description: A single terminator - schema: - $ref: '#/definitions/detailTerminatorEnvelope' - ################################################################### - # Specs - ################################################################## - listSpecs: - description: A list of specifications - schema: - $ref: '#/definitions/listSpecsEnvelope' - detailSpec: - description: A single specification - schema: - $ref: '#/definitions/detailSpecEnvelope' - detailSpecBody: - description: Returns the document that represents the specification - schema: - $ref: '#/definitions/detailSpecBodyEnvelope' - ################################################################### - # Role Attributes - ################################################################## - listRoleAttributes: - description: A list of role attributes - schema: - $ref: '#/definitions/listRoleAttributesEnvelope' - - ################################################################### - # Policy Advisor - ################################################################## - getIdentityPolicyAdvice: - description: Returns the document that represents the policy advice - schema: - $ref: '#/definitions/getIdentityPolicyAdviceEnvelope' - - ################################################################### - # Posture Data - ################################################################## - getIdentityPostureData: - description: Returns the document that represents posture data - schema: - $ref: '#/definitions/getIdentityPostureDataEnvelope' - getIdentityFailedServiceRequest: - description: Returns a list of service request failures - schema: - $ref: '#/definitions/getIdentityFailedServiceRequestEnvelope' - ################################################################### - # Transit Routers - ################################################################## - listTransitRouters: - description: A list of specifications - schema: - $ref: '#/definitions/listTransitRoutersEnvelope' - detailTransitRouter: - description: A single transit router - schema: - $ref: '#/definitions/detailTransitRouterEnvelope' - - ################################################################### - # Datastore - ################################################################## - dataIntegrityCheckResult: - description: A list of data integrity issues found - schema: - $ref: '#/definitions/dataIntegrityCheckResultEnvelope' - - ################################################################### - # Posture Check Types - ################################################################## - listPostureCheckTypes: - description: A list of posture check types - schema: - $ref: '#/definitions/listPostureCheckTypesEnvelope' - detailPostureCheckType: - description: Retrieves a singular posture check type by id - schema: - $ref: '#/definitions/detailPostureCheckTypeEnvelope' - - ################################################################### - # Posture Check - ################################################################## - listPostureChecks: - description: A list of posture checks - schema: - $ref: '#/definitions/listPostureCheckEnvelope' - detailPostureCheck: - description: Retrieves a singular posture check by id - schema: - $ref: '#/definitions/detailPostureCheckEnvelope' - ################################################################### - # List Service Updates - ################################################################## - listCurrentApiSessionServiceUpdates: - description: Data indicating necessary service updates - schema: - $ref: '#/definitions/listCurrentApiSessionServiceUpdatesEnvelope' - -####################################################################################################################### -# -# Definitions - In & Out Models Only -# -####################################################################################################################### -definitions: - ################################################################### - # Shared Definitions - ################################################################## - baseEntity: - description: Fields shared by all Edge API entities - type: object - required: - - id - - createdAt - - updatedAt - - _links - - tags - properties: - id: - type: string - createdAt: - type: string - format: date-time - updatedAt: - type: string - format: date-time - _links: - $ref: '#/definitions/links' - tags: - $ref: '#/definitions/tags' - link: - description: A link to another resource - type: object - required: - - href - properties: - href: - type: string - format: uri - method: - type: string - comment: - type: string - links: - description: A map of named links - type: object - x-omitempty: false - additionalProperties: - $ref: '#/definitions/link' - entityRef: - description: A reference to another resource and links to interact with it - type: object - properties: - entity: - type: string - id: - type: string - name: - type: string - _links: - $ref: '#/definitions/links' - tags: - description: 'A map of user defined fields and values. The values are limited to the following types/values: null, string, boolean' - type: object - x-omitempty: false - additionalProperties: { - type: object - } - attributes: - description: A set of strings used to loosly couple this resource to policies - type: array - x-omitempty: false - items: - type: string - roles: - type: array - x-omitempty: false - items: - type: string - namedRole: - type: object - properties: - role: - type: string - name: - type: string - namedRoles: - type: array - x-omitempty: false - items: - $ref: '#/definitions/namedRole' - semantic: - type: string - enum: - - AllOf - - AnyOf - dialBind: - type: string - enum: - - Dial - - Bind - dialBindArray: - type: array - items: - $ref: '#/definitions/dialBind' - versionInfo: - type: object - required: - - os - - version - - arch - - buildDate - - revision - properties: - os: - type: string - version: - type: string - arch: - type: string - buildDate: - type: string - revision: - type: string - osType: - type: string - enum: - - Windows - - WindowsServer - - Android - - iOS - - Linux - - macOS - operatingSystem: - type: object - required: - - type - - versions - properties: - type: - $ref: '#/definitions/osType' - versions: - type: array - items: - type: string - process: - type: object - required: - - osType - - path - properties: - osType: - $ref: '#/definitions/osType' - path: - type: string - hashes: - type: array - items: - type: string - signerFingerprint: - type: string - processMulti: - type: object - required: - - osType - - path - properties: - osType: - $ref: '#/definitions/osType' - path: - type: string - hashes: - type: array - items: - type: string - signerFingerprints: - type: array - items: - type: string - postureCheckType: - type: string - enum: - - OS - - PROCESS - - PROCESS_MULTI - - DOMAIN - - MAC - - MFA - ################################################################### - # Authentication - ################################################################## - password: - type: string - minLength: 5 - maxLength: 100 - password-nullable: - type: string - minLength: 5 - maxLength: 100 - x-nullable: true - username: - type: string - minLength: 4 - maxLength: 100 - username-nullable: - type: string - minLength: 4 - maxLength: 100 - x-nullable: true - authenticate: - type: object - description: A generic authenticate object meant for use with the /authenticate path. Required fields depend on authentication method. - properties: - username: - $ref: '#/definitions/username' - password: - $ref: '#/definitions/password' - envInfo: - $ref: '#/definitions/envInfo' - sdkInfo: - $ref: '#/definitions/sdkInfo' - configTypes: - $ref: '#/definitions/configTypes' - ################################################################### - # Current Session - ################################################################## - apiSessionList: - type: array - items: - $ref: '#/definitions/apiSessionDetail' - apiSessionDetail: - description: An API Session object - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - token - - identity - - identityId - - configTypes - - ipAddress - - authQueries - - cachedUpdatedAt - - isMfaRequired - - isMfaComplete - properties: - token: - type: string - identity: - $ref: '#/definitions/entityRef' - identityId: - type: string - ipAddress: - type: string - configTypes: - type: array - items: - type: string - authQueries: - $ref: '#/definitions/authQueryList' - isMfaRequired: - type: boolean - isMfaComplete: - type: boolean - lastActivityAt: - type: string - format: date-time - cachedLastActivityAt: - type: string - format: date-time - - - currentApiSessionDetail: - description: An API Session object for the current API session - type: object - allOf: - - $ref: '#/definitions/apiSessionDetail' - - type: object - required: - - expiresAt - - expirationSeconds - properties: - expiresAt: - type: string - format: date-time - expirationSeconds: - type: integer - ################################################################### - # Identities - ################################################################## - identityType: - type: string - enum: - - User - - Device - - Service - - Router - identityCreate: - description: An identity to create - type: object - required: - - name - - type - - isAdmin - properties: - name: - type: string - type: - $ref: '#/definitions/identityType' - isAdmin: - type: boolean - enrollment: - type: object - properties: - ott: - type: boolean - updb: - type: string - ottca: - type: string - roleAttributes: - $ref: '#/definitions/attributes' - tags: - $ref: '#/definitions/tags' - defaultHostingPrecedence: - $ref: '#/definitions/terminatorPrecedence' - defaultHostingCost: - $ref: '#/definitions/terminatorCost' - serviceHostingPrecedences: - $ref: '#/definitions/terminatorPrecedenceMap' - serviceHostingCosts: - $ref: '#/definitions/terminatorCostMap' - appData: - $ref: '#/definitions/tags' - - identityUpdate: - type: object - required: - - type - - name - - isAdmin - properties: - name: - type: string - type: - $ref: '#/definitions/identityType' - isAdmin: - type: boolean - roleAttributes: - $ref: '#/definitions/attributes' - tags: - $ref: '#/definitions/tags' - defaultHostingPrecedence: - $ref: '#/definitions/terminatorPrecedence' - defaultHostingCost: - $ref: '#/definitions/terminatorCost' - serviceHostingPrecedences: - $ref: '#/definitions/terminatorPrecedenceMap' - serviceHostingCosts: - $ref: '#/definitions/terminatorCostMap' - appData: - $ref: '#/definitions/tags' - - identityPatch: - type: object - properties: - name: - type: string - type: - $ref: '#/definitions/identityType' - isAdmin: - type: boolean - roleAttributes: - $ref: '#/definitions/attributes' - tags: - $ref: '#/definitions/tags' - defaultHostingPrecedence: - $ref: '#/definitions/terminatorPrecedence' - defaultHostingCost: - $ref: '#/definitions/terminatorCost' - serviceHostingPrecedences: - $ref: '#/definitions/terminatorPrecedenceMap' - serviceHostingCosts: - $ref: '#/definitions/terminatorCostMap' - appData: - $ref: '#/definitions/tags' - - identityList: - description: A list of identities - type: array - items: - $ref: '#/definitions/identityDetail' - identityDetail: - description: Detail of a specific identity - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - name - - type - - typeId - - isDefaultAdmin - - isAdmin - - authenticators - - enrollment - - envInfo - - sdkInfo - - roleAttributes - - hasEdgeRouterConnection - - hasApiSession - - isMfaEnabled - - serviceHostingPrecedences - - serviceHostingCosts - properties: - name: - type: string - type: - $ref: '#/definitions/entityRef' - typeId: - type: string - isDefaultAdmin: - type: boolean - isAdmin: - type: boolean - authenticators: - $ref: '#/definitions/identityAuthenticators' - enrollment: - $ref: '#/definitions/identityEnrollments' - envInfo: - $ref: '#/definitions/envInfo' - sdkInfo: - $ref: '#/definitions/sdkInfo' - roleAttributes: - $ref: '#/definitions/attributes' - hasEdgeRouterConnection: - type: boolean - hasApiSession: - type: boolean - isMfaEnabled: - type: boolean - defaultHostingPrecedence: - $ref: '#/definitions/terminatorPrecedence' - defaultHostingCost: - $ref: '#/definitions/terminatorCost' - serviceHostingPrecedences: - $ref: '#/definitions/terminatorPrecedenceMap' - serviceHostingCosts: - $ref: '#/definitions/terminatorCostMap' - appData: - $ref: '#/definitions/tags' - - identityAuthenticators: - type: object - properties: - updb: - properties: - username: - type: string - type: object - cert: - type: object - properties: - fingerprint: - type: string - identityEnrollments: - type: object - properties: - updb: - type: object - properties: - id: - type: string - token: - type: string - jwt: - type: string - expiresAt: - type: string - format: date-time - ott: - type: object - properties: - id: - type: string - token: - type: string - jwt: - type: string - expiresAt: - type: string - format: date-time - ottca: - type: object - properties: - id: - type: string - token: - type: string - jwt: - type: string - caId: - type: string - ca: - $ref: '#/definitions/entityRef' - expiresAt: - type: string - format: date-time - ################################################################### - # Authenticator - ################################################################## - authenticatorCreate: - description: Creates an authenticator for a specific identity which can be used for API authentication - type: object - required: - - username - - password - - method - - identityId - properties: - username: - type: string - description: The username that the identity will login with. Used only for method='updb' - password: - type: string - description: The password the identity will login with, Used only for method='updb' - method: - type: string - description: The type of authenticator to create; which will dictate which properties on this object are required. - identityId: - type: string - description: The id of an existing identity that will be assigned this authenticator - tags: - $ref: '#/definitions/tags' - authenticatorList: - description: An array of authenticator resources - type: array - items: - $ref: '#/definitions/authenticatorDetail' - authenticatorDetail: - description: A singular authenticator resource - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - method - - identityId - - identity - properties: - method: - type: string - identityId: - type: string - identity: - $ref: '#/definitions/entityRef' - certPem: - type: string - fingerprint: - type: string - username: - type: string - authenticatorUpdate: - description: All of the fields on an authenticator that will be updated - type: object - required: - - username - - password - properties: - username: - $ref: '#/definitions/username' - password: - $ref: '#/definitions/password' - tags: - $ref: '#/definitions/tags' - authenticatorPatch: - description: All of the fields on an authenticator that may be updated - type: object - properties: - username: - $ref: '#/definitions/username-nullable' - password: - $ref: '#/definitions/password-nullable' - tags: - $ref: '#/definitions/tags' - authenticatorUpdateWithCurrent: - description: All of the fields on an authenticator that will be updated - type: object - allOf: - - $ref: '#/definitions/authenticatorUpdate' - - type: object - required: - - currentPassword - properties: - currentPassword: - $ref: '#/definitions/password' - authenticatorPatchWithCurrent: - description: All of the fields on an authenticator that may be updated - type: object - allOf: - - $ref: '#/definitions/authenticatorPatch' - - type: object - required: - - currentPassword - properties: - currentPassword: - $ref: '#/definitions/password' - ################################################################### - # Certificate Authorities - ################################################################## - caList: - description: An array of Certificate Authority (CA) resources - type: array - items: - $ref: '#/definitions/caDetail' - caDetail: - description: A Certificate Authority (CA) resource - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - name - - fingerprint - - certPem - - isVerified - - isAutoCaEnrollmentEnabled - - isOttCaEnrollmentEnabled - - isAuthEnabled - - identityRoles - - identityNameFormat - properties: - name: - type: string - fingerprint: - type: string - certPem: - type: string - isVerified: - type: boolean - example: false - verificationToken: - type: string - format: uuid - isAutoCaEnrollmentEnabled: - type: boolean - example: true - isOttCaEnrollmentEnabled: - type: boolean - example: true - isAuthEnabled: - type: boolean - example: true - identityRoles: - $ref: '#/definitions/roles' - identityNameFormat: - type: string - caCreate: - description: A create Certificate Authority (CA) object - type: object - required: - - name - - certPem - - isAutoCaEnrollmentEnabled - - isOttCaEnrollmentEnabled - - isAuthEnabled - - identityRoles - properties: - name: - type: string - example: 'Test 3rd Party External CA' - isAutoCaEnrollmentEnabled: - type: boolean - example: true - isAuthEnabled: - type: boolean - example: true - isOttCaEnrollmentEnabled: - type: boolean - example: true - certPem: - type: string - example: '-----BEGIN CERTIFICATE-----\nMIICUjCCAdmgAwIBAgIJANooo7NB+dZZMAoGCCqGSM49BAMCMF4xCzAJBgNVBAYT\nAlVTMQswCQYDVQQIDAJOQzETMBEGA1UECgwKTmV0Rm91bmRyeTEtMCsGA1UEAwwk\nTmV0Rm91bmRyeSBaaXRpIEV4dGVybmFsIEFQSSBSb290IENBMB4XDTE4MTExNTEy\nNTcwOVoXDTM4MTExMDEyNTcwOVowXjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk5D\nMRMwEQYDVQQKDApOZXRGb3VuZHJ5MS0wKwYDVQQDDCROZXRGb3VuZHJ5IFppdGkg\nRXh0ZXJuYWwgQVBJIFJvb3QgQ0EwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARwq61Z\nIaqbaw0PDt3frJZaHjkxfZhwYrykI1GlbRNd/jix03lVG9qvpN5Og9fQfFFcFmD/\n3vCE9S6O0npm0mADQxcBcxbMRAH5dtBuCuiJW6qAAbPgiM32vqSxBiFt0KejYzBh\nMB0GA1UdDgQWBBRx1OVGuc/jdltDc8YBtkw8Tbr4fjAfBgNVHSMEGDAWgBRx1OVG\nuc/jdltDc8YBtkw8Tbr4fjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB\nhjAKBggqhkjOPQQDAgNnADBkAjBDRxNZUaIVpkQKnAgJukl3ysd3/i7Z6hDyIEms\nkllz/+ZvmdBp9iedV5o5BvJUggACMCv+UBFlJH7pmsOCo/F45Kk178YsCC7gaMxE\n1ZG1zveyMvsYsH04C9FndE6w2MLvlA==\n-----END CERTIFICATE-----' - identityRoles: - $ref: '#/definitions/roles' - identityNameFormat: - type: string - tags: - $ref: '#/definitions/tags' - caUpdate: - type: object - required: - - name - - isAutoCaEnrollmentEnabled - - isOttCaEnrollmentEnabled - - isAuthEnabled - - identityRoles - properties: - name: - type: string - example: My CA - isAutoCaEnrollmentEnabled: - type: boolean - example: true - isOttCaEnrollmentEnabled: - type: boolean - example: true - isAuthEnabled: - type: boolean - example: true - identityRoles: - $ref: '#/definitions/roles' - identityNameFormat: - type: string - tags: - $ref: '#/definitions/tags' - caPatch: - type: object - properties: - name: - type: string - example: My CA - isAutoCaEnrollmentEnabled: - type: boolean - example: true - isOttCaEnrollmentEnabled: - type: boolean - example: true - isAuthEnabled: - type: boolean - example: true - identityRoles: - $ref: '#/definitions/roles' - identityNameFormat: - type: string - tags: - $ref: '#/definitions/tags' - ################################################################### - # Config-Types - ################################################################## - configTypeList: - description: An array of config-type resources - type: array - items: - $ref: '#/definitions/configTypeDetail' - configTypeDetail: - description: A config-type resource - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - name - - schema - properties: - name: - type: string - example: ziti-tunneler-server.v1 - schema: - description: A JSON schema to enforce configuration against - type: object - additionalProperties: true - configTypeCreate: - type: object - description: A config-type create object - required: - - name - properties: - tags: - $ref: '#/definitions/tags' - name: - type: string - example: ziti-tunneler-server.v1 - schema: - description: A JSON schema to enforce configuration against - type: object - additionalProperties: true - configTypeUpdate: - description: A config-type update object - type: object - required: - - name - properties: - tags: - $ref: '#/definitions/tags' - name: - type: string - example: ziti-tunneler-server.v1 - schema: - description: A JSON schema to enforce configuration against - type: object - additionalProperties: true - configTypePatch: - description: A config-type patch object - type: object - properties: - tags: - $ref: '#/definitions/tags' - name: - type: string - example: ziti-tunneler-server.v1 - schema: - description: A JSON schema to enforce configuration against - type: object - additionalProperties: true - ################################################################### - # Configs - ################################################################## - configList: - description: An array of config resources - type: array - items: - $ref: '#/definitions/configDetail' - configDetail: - description: A config resource - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - name - - configTypeId - - configType - - data - properties: - name: - type: string - configTypeId: - type: string - configType: - $ref: '#/definitions/entityRef' - data: - type: object - description: The data section of a config is based on the schema of its type - configCreate: - type: object - description: A config create object - required: - - name - - configTypeId - - data - properties: - tags: - $ref: '#/definitions/tags' - name: - type: string - example: default.ziti-tunneler-server.v1 - configTypeId: - type: string - description: The id of a config-type that the data section will match - data: - type: object - x-nullable: false - additionalProperties: true - description: Data payload is defined by the schema of the config-type defined in the type parameter - example: - name: test-config - configTypeId: cea49285-6c07-42cf-9f52-09a9b115c783 - data: - hostname: example.com - port: 80 - configUpdate: - type: object - description: A config update object - required: - - name - - data - properties: - tags: - $ref: '#/definitions/tags' - name: - type: string - example: default.ziti-tunneler-server.v1 - data: - type: object - x-nullable: false - additionalProperties: true - description: Data payload is defined by the schema of the config-type defined in the type parameter - example: - name: example-config-name - data: - hostname: example.com - port: 80 - configPatch: - type: object - description: A config patch object - properties: - tags: - $ref: '#/definitions/tags' - name: - type: string - example: default.ziti-tunneler-server.v1 - data: - type: object - additionalProperties: true - description: Data payload is defined by the schema of the config-type defined in the type parameter - example: - name: example-config-name - data: - hostname: example.com - port: 80 - ################################################################### - # Enrollments - ################################################################## - enrollmentDetail: - type: object - description: | - An enrollment object. Enrolments are tied to identities and portentially a CA. Depending on the - method, different fields are utilized. For example ottca enrollments use the `ca` field and updb enrollments - use the username field, but not vice versa. - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - token - - method - - expiresAt - - details - properties: - token: - type: string - method: - type: string - expiresAt: - type: string - format: date-time - identityId: - type: string - identity: - $ref: '#/definitions/entityRef' - edgeRouterId: - type: string - edgeRouter: - $ref: '#/definitions/entityRef' - transitRouterId: - type: string - transitRouter: - $ref: '#/definitions/entityRef' - username: - type: string - details: - type: object - additionalProperties: - type: string - example: - id: 624fa53f-7629-4a7a-9e38-c1f4ce322c1d - createdAt: '0001-01-01T00:00:00Z' - updatedAt: '0001-01-01T00:00:00Z' - _links: - self: - href: './enrollments/624fa53f-7629-4a7a-9e38-c1f4ce322c1d' - tags: - token: 1e727c8f-07e4-4a1d-a8b0-da0c7a01c6e1 - method: updb - expiresAt: '2020-03-11T20:20:24.0055543Z' - identity: - urlName: identities - id: f047ac96-dc3a-408a-a6f2-0ba487c08ef9 - name: updb--0f245140-7f2e-4326-badf-6aba55e52475 - _links: - self: - href: './identities/f047ac96-dc3a-408a-a6f2-0ba487c08ef9' - ca: - username: example-username - enrollmentList: - description: An array of enrollment resources - type: array - items: - $ref: '#/definitions/enrollmentDetail' - ################################################################### - # Edge Routers - ################################################################## - edgeRouterCreate: - description: An edge router create object - type: object - required: - - name - properties: - name: - type: string - isTunnelerEnabled: - type: boolean - roleAttributes: - $ref: '#/definitions/attributes' - tags: - $ref: '#/definitions/tags' - appData: - $ref: '#/definitions/tags' - - edgeRouterUpdate: - description: An edge router update object - type: object - required: - - name - properties: - name: - type: string - isTunnelerEnabled: - type: boolean - roleAttributes: - $ref: '#/definitions/attributes' - tags: - $ref: '#/definitions/tags' - appData: - $ref: '#/definitions/tags' - - edgeRouterPatch: - description: An edge router patch object - type: object - properties: - name: - type: string - isTunnelerEnabled: - type: boolean - roleAttributes: - $ref: '#/definitions/attributes' - tags: - $ref: '#/definitions/tags' - appData: - $ref: '#/definitions/tags' - currentIdentityEdgeRouterList: - description: A list of edge router resources - type: array - items: - $ref: '#/definitions/currentIdentityEdgeRouterDetail' - currentIdentityEdgeRouterDetail: - description: A detail edge router resource - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - $ref: '#/definitions/commonEdgeRouterProperties' - edgeRouterList: - description: A list of edge router resources - type: array - items: - $ref: '#/definitions/edgeRouterDetail' - edgeRouterDetail: - description: A detail edge router resource - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - $ref: '#/definitions/commonEdgeRouterProperties' - - type: object - required: - - isVerified - - roleAttributes - - os - - version - - arch - - buildDate - - revision - - isTunnelerEnabled - properties: - isVerified: - type: boolean - enrollmentToken: - type: string - x-nullable: true - enrollmentJwt: - type: string - x-nullable: true - enrollmentCreatedAt: - type: string - format: date-time - x-nullable: true - enrollmentExpiresAt: - type: string - format: date-time - x-nullable: true - roleAttributes: - $ref: '#/definitions/attributes' - fingerprint: - type: string - versionInfo: - $ref: '#/definitions/versionInfo' - isTunnelerEnabled: - type: boolean - example: - id: b0766b8d-bd1a-4d28-8415-639b29d3c83d - createdAt: '2020-03-16T17:13:31.5807454Z' - updatedAt: '2020-03-16T17:13:31.5807454Z' - _links: - edge-router-policies: - href: "./edge-routers/b0766b8d-bd1a-4d28-8415-639b29d3c83d/edge-routers" - self: - href: "./edge-routers/b0766b8d-bd1a-4d28-8415-639b29d3c83d" - tags: { } - name: TestRouter-e33c837f-3222-4b40-bcd6-b3458fd5156e - fingerprint: - roleAttributes: - - eastCoast - - sales - - test - isVerified: false - isOnline: false - isTunnelerEnabled: false - enrollmentToken: 30a1f0ea-d39b-4aae-b852-304cf1c30d1f - enrollmentJwt: 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbSI6ImVyb3R0IiwiZXhwIjoxNTg0Mzc5MTExLCJpc3MiOiJodHRwczovL - 2xvY2FsaG9zdDoxMjgwIiwianRpIjoiMzBhMWYwZWEtZDM5Yi00YWFlLWI4NTItMzA0Y2YxYzMwZDFmIiwic3ViIjoiYjA3NjZiOGQtYmQxYS00ZDI - 4LTg0MTUtNjM5YjI5ZDNjODNkIn0.UsyQhCPORQ5tQnYWY7S88LNvV9iFS5Hy-P4aJaClZzEICobKgnQoyQblJcdMvk3cGKwyFqAnQtt0tDZkb8tHz - Vqyv6bilHcAFuMRrdwXRqdXquabSN5geu2qBUnyzL7Mf2X85if8sbMida6snB4oLZsVRF3CRn4ODBJdeiVJ_Z4rgD-zW2IwtXPApT7ALyiiw2cN4EH - 8pqQ7tpZKqztE0PGEbBQFPGKUFnm7oXyvSUo17EsFJUv5gUlBzfKKGolh5io4ptp22HZrqsqSnqDSOnYEZHonr5Yljuwiktrlh-JKiK6GGns5OAJMP - dO9lgM4yHSpF2ILbqhWMV93Y3zMOg' - enrollmentCreatedAt: '2020-03-16T17:13:31.5777637Z' - enrollmentExpiresAt: '2020-03-16T17:18:31.5777637Z' - hostname: '' - supportedProtocols: { } - ################################################################### - # Edge Router Policies - ################################################################## - edgeRouterPolicyCreate: - required: - - name - properties: - name: - type: string - semantic: - $ref: '#/definitions/semantic' - edgeRouterRoles: - $ref: '#/definitions/roles' - identityRoles: - $ref: '#/definitions/roles' - tags: - $ref: '#/definitions/tags' - edgeRouterPolicyUpdate: - required: - - name - properties: - name: - type: string - semantic: - $ref: '#/definitions/semantic' - edgeRouterRoles: - $ref: '#/definitions/roles' - identityRoles: - $ref: '#/definitions/roles' - tags: - $ref: '#/definitions/tags' - edgeRouterPolicyPatch: - properties: - name: - type: string - semantic: - $ref: '#/definitions/semantic' - edgeRouterRoles: - $ref: '#/definitions/roles' - identityRoles: - $ref: '#/definitions/roles' - tags: - $ref: '#/definitions/tags' - edgeRouterPolicyList: - type: array - items: - $ref: '#/definitions/edgeRouterPolicyDetail' - edgeRouterPolicyDetail: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - name - - semantic - - edgeRouterRoles - - edgeRouterRolesDisplay - - identityRoles - - identityRolesDisplay - - isSystem - properties: - name: - type: string - semantic: - $ref: '#/definitions/semantic' - edgeRouterRoles: - $ref: '#/definitions/roles' - edgeRouterRolesDisplay: - $ref: '#/definitions/namedRoles' - identityRoles: - $ref: '#/definitions/roles' - identityRolesDisplay: - $ref: '#/definitions/namedRoles' - isSystem: - type: boolean - ################################################################### - # Service Policies - ################################################################## - servicePolicyList: - type: array - items: - $ref: '#/definitions/servicePolicyDetail' - servicePolicyDetail: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - name - - type - - semantic - - serviceRoles - - serviceRolesDisplay - - identityRoles - - identityRolesDisplay - - postureCheckRoles - - postureCheckRolesDisplay - properties: - name: - type: string - type: - $ref: '#/definitions/dialBind' - semantic: - $ref: '#/definitions/semantic' - serviceRoles: - $ref: '#/definitions/roles' - serviceRolesDisplay: - $ref: '#/definitions/namedRoles' - identityRoles: - $ref: '#/definitions/roles' - identityRolesDisplay: - $ref: '#/definitions/namedRoles' - postureCheckRoles: - $ref: '#/definitions/roles' - postureCheckRolesDisplay: - $ref: '#/definitions/namedRoles' - servicePolicyCreate: - type: object - required: - - name - - type - properties: - tags: - $ref: '#/definitions/tags' - name: - type: string - type: - $ref: '#/definitions/dialBind' - semantic: - $ref: '#/definitions/semantic' - serviceRoles: - $ref: '#/definitions/roles' - identityRoles: - $ref: '#/definitions/roles' - postureCheckRoles: - $ref: '#/definitions/roles' - servicePolicyUpdate: - type: object - required: - - name - - type - properties: - tags: - $ref: '#/definitions/tags' - name: - type: string - type: - $ref: '#/definitions/dialBind' - semantic: - $ref: '#/definitions/semantic' - serviceRoles: - $ref: '#/definitions/roles' - identityRoles: - $ref: '#/definitions/roles' - postureCheckRoles: - $ref: '#/definitions/roles' - servicePolicyPatch: - type: object - properties: - tags: - $ref: '#/definitions/tags' - name: - type: string - type: - $ref: '#/definitions/dialBind' - semantic: - $ref: '#/definitions/semantic' - serviceRoles: - $ref: '#/definitions/roles' - identityRoles: - $ref: '#/definitions/roles' - postureCheckRoles: - $ref: '#/definitions/roles' - ################################################################### - # Services - ################################################################## - serviceList: - type: array - items: - $ref: '#/definitions/serviceDetail' - serviceDetail: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - name - - terminatorStrategy - - roleAttributes - - permissions - - configs - - config - - encryptionRequired - - postureQueries - properties: - name: - type: string - terminatorStrategy: - type: string - roleAttributes: - $ref: '#/definitions/attributes' - permissions: - $ref: '#/definitions/dialBindArray' - configs: - type: array - items: - type: string - config: - type: object - additionalProperties: - type: object - additionalProperties: - type: object - description: map of config data for this service keyed by the config type name. Only configs of the types requested will be returned. - encryptionRequired: - type: boolean - postureQueries: - type: array - items: - $ref: '#/definitions/postureQueries' - serviceCreate: - type: object - required: - - name - - encryptionRequired - properties: - name: - type: string - terminatorStrategy: - type: string - roleAttributes: - type: array - items: - type: string - configs: - type: array - items: - type: string - encryptionRequired: - type: boolean - tags: - $ref: '#/definitions/tags' - serviceUpdate: - type: object - required: - - name - properties: - name: - type: string - terminatorStrategy: - type: string - roleAttributes: - type: array - items: - type: string - configs: - type: array - items: - type: string - encryptionRequired: - type: boolean - tags: - $ref: '#/definitions/tags' - servicePatch: - type: object - properties: - name: - type: string - terminatorStrategy: - type: string - roleAttributes: - type: array - items: - type: string - configs: - type: array - items: - type: string - encryptionRequired: - type: boolean - tags: - $ref: '#/definitions/tags' - ################################################################### - # Geo Regions - ################################################################## - geoRegionList: - type: array - items: - $ref: '#/definitions/geoRegionDetail' - geoRegionDetail: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - name - properties: - name: - type: string - ################################################################### - # Identity-Types - ################################################################## - identityTypeList: - type: array - items: - $ref: '#/definitions/identityDetail' - identityTypeDetail: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - properties: - name: - type: string - ################################################################### - # Service Configs - ################################################################## - serviceConfigList: - type: array - items: - $ref: '#/definitions/serviceConfigDetail' - serviceConfigDetail: - type: object - required: - - serviceId - - service - - configId - - config - properties: - serviceId: - type: string - service: - $ref: '#/definitions/entityRef' - configId: - type: string - config: - $ref: '#/definitions/entityRef' - example: - service: - urlName: services - id: 913a8c63-17a6-44d7-82b3-9f6eb997cf8e - name: netcat4545-egress-r2 - _links: - self: - href: "./services/913a8c63-17a6-44d7-82b3-9f6eb997cf8e" - config: - urlName: configs - id: 13347602-ba34-4ff7-8082-e533ba945744 - name: test-config-02fade09-fcc3-426c-854e-18539726bdc6 - _links: - self: - href: "./identities/13347602-ba34-4ff7-8082-e533ba945744" - serviceConfigAssign: - type: object - required: - - serviceId - - configId - properties: - serviceId: - type: string - configId: - type: string - serviceConfigsAssignList: - type: array - items: - $ref: '#/definitions/serviceConfigAssign' - ################################################################### - # Service Edge Router Policies - ################################################################## - serviceEdgeRouterPolicyList: - type: array - items: - $ref: '#/definitions/serviceEdgeRouterPolicyDetail' - serviceEdgeRouterPolicyDetail: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - name - - semantic - - edgeRouterRoles - - edgeRouterRolesDisplay - - serviceRoles - - serviceRolesDisplay - properties: - name: - type: string - semantic: - $ref: '#/definitions/semantic' - edgeRouterRoles: - $ref: '#/definitions/roles' - edgeRouterRolesDisplay: - $ref: '#/definitions/namedRoles' - serviceRoles: - $ref: '#/definitions/roles' - serviceRolesDisplay: - $ref: '#/definitions/namedRoles' - serviceEdgeRouterPolicyCreate: - type: object - required: - - name - properties: - tags: - $ref: '#/definitions/tags' - name: - type: string - semantic: - $ref: '#/definitions/semantic' - edgeRouterRoles: - $ref: '#/definitions/roles' - serviceRoles: - $ref: '#/definitions/roles' - serviceEdgeRouterPolicyUpdate: - type: object - required: - - name - properties: - tags: - $ref: '#/definitions/tags' - name: - type: string - semantic: - $ref: '#/definitions/semantic' - edgeRouterRoles: - $ref: '#/definitions/roles' - serviceRoles: - $ref: '#/definitions/roles' - serviceEdgeRouterPolicyPatch: - type: object - properties: - tags: - $ref: '#/definitions/tags' - name: - type: string - semantic: - $ref: '#/definitions/semantic' - edgeRouterRoles: - $ref: '#/definitions/roles' - serviceRoles: - $ref: '#/definitions/roles' - ################################################################### - # Sessions - ################################################################## - sessionCreate: - type: object - properties: - serviceId: - type: string - type: - $ref: '#/definitions/dialBind' - tags: - $ref: '#/definitions/tags' - sessionList: - type: array - items: - $ref: '#/definitions/sessionDetail' - sessionRoutePathDetail: - type: object - properties: - routePath: - type: array - items: - type: string - sessionDetail: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - type - - apiSessionId - - apiSession - - serviceId - - service - - token - - edgeRouters - properties: - type: - $ref: '#/definitions/dialBind' - token: - type: string - apiSessionId: - type: string - apiSession: - $ref: '#/definitions/entityRef' - serviceId: - type: string - service: - $ref: '#/definitions/entityRef' - edgeRouters: - type: array - items: - $ref: '#/definitions/sessionEdgeRouter' - sessionEdgeRouter: - allOf: - - $ref: "#/definitions/commonEdgeRouterProperties" - - type: object - required: - - urls - properties: - # deprecated property, see supportedProtocols in commonEdgeRouterProperties - urls: - type: object - additionalProperties: - type: string - commonEdgeRouterProperties: - type: object - required: - - hostname - - name - - supportedProtocols - - syncStatus - - isOnline - properties: - hostname: - type: string - name: - type: string - supportedProtocols: - additionalProperties: - type: string - type: object - syncStatus: - type: string - isOnline: - type: boolean - appData: - $ref: '#/definitions/tags' - ################################################################### - # Errors - ################################################################## - apiErrorEnvelope: - type: object - required: - - meta - - error - properties: - meta: - $ref: '#/definitions/meta' - error: - $ref: '#/definitions/apiError' - apiError: - type: object - properties: - args: - $ref: '#/definitions/apiErrorArgs' - data: - type: object - additionalProperties: true - causeMessage: - type: string - code: - type: string - message: - type: string - requestId: - type: string - cause: - $ref: '#/definitions/apiErrorCause' - apiFieldError: - type: object - properties: - reason: - type: string - field: - type: string - value: - type: string - apiErrorCause: - allOf: - - $ref: '#/definitions/apiFieldError' - - $ref: '#/definitions/apiError' - apiErrorArgs: - type: object - properties: - urlVars: - properties: { } - additionalProperties: - type: string - type: object - ################################################################### - # Standard - ################################################################## - empty: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - type: object - example: { } - meta: - type: object - properties: - filterableFields: - type: array - items: - type: string - x-omitempty: true - pagination: - $ref: '#/definitions/pagination' - apiEnrolmentVersion: - type: string - apiVersion: - type: string - createEnvelope: - type: object - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/createLocation' - createLocation: - type: object - properties: - _links: - $ref: '#/definitions/links' - id: - type: string - sessionCreateEnvelope: - type: object - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/sessionDetail' - enrollmentCertsEnvelope: - type: object - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/enrollmentCerts' - version: - type: object - properties: - buildDate: - type: string - example: '2020-02-11 16:09:08' - revision: - type: string - example: 'ea556fc18740' - runtimeVersion: - type: string - example: 'go1.13.5' - version: - type: string - example: 'v0.9.0' - apiVersions: - type: object - additionalProperties: - type: object - additionalProperties: - $ref: '#/definitions/apiVersion' - apiVersion: - type: object - required: - - path - properties: - version: - type: string - path: - type: string - protocol: - type: object - required: - - address - properties: - address: - type: string - listSummaryCounts: - type: object - additionalProperties: - type: integer - listProtocols: - type: object - additionalProperties: - $ref: '#/definitions/protocol' - enrollmentCerts: - type: object - properties: - serverCert: - type: string - description: A PEM encoded set of certificates to use as the servers chain - cert: - type: string - description: A PEM encoded cert for the server - ca: - type: string - description: A PEM encoded set of CA certificates to trust - currentAPISessionDetailEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/currentApiSessionDetail' - currentIdentityDetailEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/identityDetail' - listAPISessionsEnvelope: - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/apiSessionList' - listCurrentAPISessionCertificatesEnvelope: - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/currentApiSessionCertificateList' - createCurrentApiSessionCertificateEnvelope: - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/currentApiSessionCertificateCreateResponse' - detailCurrentApiSessionCertificateEnvelope: - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/currentApiSessionCertificateDetail' - detailAPISessionEnvelope: - required: - - meta - - data - type: object - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/apiSessionDetail' - listAuthenticatorsEnvelope: - type: object - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/authenticatorList' - detailAuthenticatorEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/authenticatorDetail' - listCasEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/caList' - detailCaEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/caDetail' - listConfigTypesEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/configTypeList' - detailConfigTypeEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/configTypeDetail' - listConfigsEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/configList' - detailConfigEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/configDetail' - listVersionEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/version' - listSummaryCountsEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/listSummaryCounts' - listProtocolsEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/listProtocols' - listEnrollmentsEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/enrollmentList' - detailEnrollmentEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/enrollmentDetail' - listCurrentIdentityEdgeRoutersEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/currentIdentityEdgeRouterList' - listEdgeRoutersEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/edgeRouterList' - detailedEdgeRouterEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/edgeRouterDetail' - listEdgeRouterPoliciesEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/edgeRouterPolicyList' - detailEdgeRouterPolicyEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/edgeRouterPolicyDetail' - listServicePoliciesEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/servicePolicyList' - detailServicePolicyEnvelop: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/servicePolicyDetail' - listServicesEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/serviceList' - detailServiceEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/serviceDetail' - listIdentitiesEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/identityList' - detailIdentityEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/identityDetail' - listGeoRegionsEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/geoRegionList' - detailGeoRegionEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/geoRegionDetail' - listIdentityTypesEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/identityTypeList' - detailIdentityTypeEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/identityTypeDetail' - listServiceConfigsEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/serviceConfigList' - listServiceEdgeRouterPoliciesEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/serviceEdgeRouterPolicyList' - detailServiceEdgePolicyEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/serviceEdgeRouterPolicyDetail' - listSessionsEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/sessionList' - detailSessionEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/sessionDetail' - detailSessionRoutePathEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/sessionRoutePathDetail' - envInfo: - description: Environment information an authenticating client may provide - properties: - os: - type: string - arch: - type: string - osRelease: - type: string - osVersion: - type: string - type: object - sdkInfo: - description: SDK information an authenticating client may provide - properties: - type: - type: string - branch: - type: string - version: - type: string - revision: - type: string - appId: - type: string - appVersion: - type: string - type: object - configTypes: - description: Specific configuration types that should be returned - type: array - items: - type: string - pagination: - type: object - required: - - limit - - offset - - totalCount - properties: - limit: - type: number - format: int64 - offset: - type: number - format: int64 - totalCount: - type: number - format: int64 - ################################################################### - # Terminators - ################################################################## - listTerminatorsEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/terminatorList' - detailTerminatorEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/terminatorDetail' - terminatorList: - type: array - items: - $ref: '#/definitions/terminatorDetail' - terminatorDetail: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - serviceId - - service - - routerId - - router - - binding - - address - - identity - - cost - - precedence - - dynamicCost - properties: - serviceId: - type: string - service: - $ref: '#/definitions/entityRef' - routerId: - type: string - router: - $ref: '#/definitions/entityRef' - binding: - type: string - address: - type: string - identity: - type: string - cost: - $ref: '#/definitions/terminatorCost' - precedence: - $ref: '#/definitions/terminatorPrecedence' - dynamicCost: - $ref: '#/definitions/terminatorCost' - terminatorDetailLimited: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - serviceId - - service - - routerId - - identity - properties: - serviceId: - type: string - service: - $ref: '#/definitions/entityRef' - routerId: - type: string - identity: - type: string - - terminatorCreate: - type: object - required: - - service - - router - - address - - binding - properties: - service: - type: string - router: - type: string - binding: - type: string - address: - type: string - identity: - type: string - identitySecret: - type: string - format: byte - cost: - $ref: '#/definitions/terminatorCost' - precedence: - $ref: '#/definitions/terminatorPrecedence' - tags: - $ref: '#/definitions/tags' - terminatorUpdate: - type: object - required: - - service - - router - - address - - binding - properties: - service: - type: string - router: - type: string - binding: - type: string - address: - type: string - cost: - $ref: '#/definitions/terminatorCost' - precedence: - $ref: '#/definitions/terminatorPrecedence' - tags: - $ref: '#/definitions/tags' - terminatorPatch: - type: object - properties: - service: - type: string - router: - type: string - binding: - type: string - address: - type: string - cost: - $ref: '#/definitions/terminatorCost' - precedence: - $ref: '#/definitions/terminatorPrecedence' - tags: - $ref: '#/definitions/tags' - ################################################################### - # Specs - ################################################################## - listSpecsEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/specList' - detailSpecEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/specDetail' - detailSpecBodyEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/specBodyDetail' - specList: - type: array - items: - $ref: '#/definitions/specDetail' - specDetail: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - name - properties: - name: - type: string - specBodyDetail: - type: string - - listRoleAttributesEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/roleAttributesList' - - roleAttributesList: - description: An array of role attributes - type: array - items: - type: string - - getIdentityPolicyAdviceEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/policyAdvice' - - policyAdvice: - type: "object" - properties: - identityId: - type: "string" - identity: - $ref: '#/definitions/entityRef' - serviceId: - type: "string" - service: - $ref: '#/definitions/entityRef' - isBindAllowed: - type: "boolean" - isDialAllowed: - type: "boolean" - identityRouterCount: - type: "number" - format: int32 - serviceRouterCount: - type: "number" - format: int32 - commonRouters: - type: "array" - items: - $ref: '#/definitions/routerEntityRef' - - routerEntityRef: - type: object - allOf: - - $ref: '#/definitions/entityRef' - - type: object - required: - - isOnline - properties: - isOnline: - type: boolean - - ################################################################### - # Transit Routers - ################################################################## - listTransitRoutersEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/transitRouterList' - detailTransitRouterEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/transitRouterDetail' - transitRouterList: - type: array - items: - $ref: '#/definitions/transitRouterDetail' - transitRouterDetail: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - name - - isVerified - - isOnline - - fingerprint - properties: - name: - type: string - fingerprint: - type: string - isVerified: - type: boolean - isOnline: - type: boolean - enrollmentToken: - type: string - x-nullable: true - enrollmentJwt: - type: string - x-nullable: true - enrollmentCreatedAt: - type: string - format: date-time - x-nullable: true - enrollmentExpiresAt: - type: string - format: date-time - x-nullable: true - transitRouterCreate: - type: object - required: - - name - properties: - name: - type: string - tags: - $ref: '#/definitions/tags' - transitRouterUpdate: - type: object - required: - - name - properties: - name: - type: string - tags: - $ref: '#/definitions/tags' - transitRouterPatch: - type: object - properties: - name: - type: string - tags: - $ref: '#/definitions/tags' - terminatorCost: - type: integer - minimum: 0 - maximum: 65535 - terminatorPrecedence: - type: string - enum: - - default - - required - - failed - terminatorPrecedenceMap: - type: object - additionalProperties: - $ref: '#/definitions/terminatorPrecedence' - terminatorCostMap: - type: object - additionalProperties: - $ref: '#/definitions/terminatorCost' - dataIntegrityCheckResultEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/dataIntegrityCheckDetails' - dataIntegrityCheckDetails: - type: object - required: - - inProgress - - fixingErrors - - tooManyErrors - - startTime - - endTime - - error - - results - properties: - inProgress: - type: boolean - startTime: - type: string - format: date-time - endTime: - type: string - format: date-time - fixingErrors: - type: boolean - error: - type: string - tooManyErrors: - type: boolean - results: - $ref: '#/definitions/dataIntegrityCheckDetailList' - dataIntegrityCheckDetailList: - type: array - items: - $ref: '#/definitions/dataIntegrityCheckDetail' - dataIntegrityCheckDetail: - type: object - required: - - description - - fixed - properties: - description: - type: string - fixed: - type: boolean - - ################################################################### - # Posture Data - ################################################################## - getIdentityFailedServiceRequestEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/failedServiceRequestList' - - getIdentityPostureDataEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/postureData' - - postureDataBase: - type: object - required: - - postureCheckId - - timedOut - - lastUpdatedAt - properties: - postureCheckId: - type: string - timedOut: - type: boolean - lastUpdatedAt: - type: string - format: date-time - - postureDataMac: - type: object - allOf: - - $ref: '#/definitions/postureDataBase' - - type: object - required: - - addresses - properties: - addresses: - type: array - items: - type: string - - postureDataDomain: - type: object - allOf: - - $ref: '#/definitions/postureDataBase' - - type: object - required: - - domain - properties: - domain: - type: string - - postureDataOs: - type: object - allOf: - - $ref: '#/definitions/postureDataBase' - - type: object - required: - - type - - version - - build - properties: - type: - type: string - version: - type: string - build: - type: string - - postureDataProcess: - type: object - allOf: - - $ref: '#/definitions/postureDataBase' - - type: object - properties: - isRunning: - type: boolean - binaryHash: - type: string - signerFingerprints: - type: array - items: - type: string - - postureDataMfa: - type: object - required: - - apiSessionId - - passedMfa - properties: - apiSessionId: - type: string - passedMfa: - type: boolean - - apiSessionPostureData: - type: object - required: - - mfa - properties: - mfa: - $ref: '#/definitions/postureDataMfa' - - postureCheckFailure: - type: object - discriminator: postureCheckType - required: - - postureCheckId - - postureCheckName - - postureCheckType - properties: - postureCheckId: - type: string - postureCheckName: - type: string - postureCheckType: - type: string - - postureCheckFailureMacAddress: - x-class: MAC - allOf: - - $ref: '#/definitions/postureCheckFailure' - - type: object - required: - - actualValue - - expectedValue - properties: - actualValue: - type: array - items: - type: string - expectedValue: - type: array - items: - type: string - - postureCheckFailureDomain: - x-class: DOMAIN - allOf: - - $ref: '#/definitions/postureCheckFailure' - - type: object - required: - - actualValue - - expectedValue - properties: - actualValue: - type: string - expectedValue: - type: array - items: - type: string - postureCheckFailureOperatingSystemActual: - type: object - required: - - type - - version - properties: - type: - type: string - version: - type: string - - postureCheckFailureOperatingSystem: - x-class: OS - allOf: - - $ref: '#/definitions/postureCheckFailure' - - type: object - required: - - actualValue - - expectedValue - properties: - actualValue: - $ref: '#/definitions/postureCheckFailureOperatingSystemActual' - expectedValue: - type: array - minItems: 1 - items: - $ref: '#/definitions/operatingSystem' - - postureCheckFailureProcessActual: - type: object - required: - - isRunning - - hash - - signerFingerprints - properties: - path: - type: string - isRunning: - type: boolean - hash: - type: string - signerFingerprints: - type: array - items: - type: string - osType: - $ref: '#/definitions/osType' - - postureCheckFailureProcess: - x-class: PROCESS - allOf: - - $ref: '#/definitions/postureCheckFailure' - - type: object - required: - - actualValue - - expectedValue - properties: - actualValue: - $ref: '#/definitions/postureCheckFailureProcessActual' - expectedValue: - $ref: '#/definitions/process' - - postureCheckFailureProcessMulti: - x-class: PROCESS_MULTI - allOf: - - $ref: '#/definitions/postureCheckFailure' - - type: object - required: - - actualValue - - expectedValue - - semantic - properties: - semantic: - $ref: '#/definitions/semantic' - actualValue: - type: array - items: - $ref: '#/definitions/postureCheckFailureProcessActual' - expectedValue: - type: array - items: - $ref: '#/definitions/processMulti' - - postureCheckFailureMfa: - x-class: MFA - allOf: - - $ref: '#/definitions/postureCheckFailure' - - type: object - required: - - actualValue - - expectedValue - properties: - actualValue: - type: boolean - expectedValue: - type: boolean - - policyFailure: - type: object - properties: - policyId: - type: string - policyName: - type: string - checks: - type: array - items: - $ref: '#/definitions/postureCheckFailure' - - failedSessionRequest: - type: object - properties: - apiSessionId: - type: string - when: - type: string - format: date-time - serviceId: - type: string - serviceName: - type: string - sessionType: - $ref: '#/definitions/dialBind' - policyFailures: - type: array - items: - $ref: '#/definitions/policyFailure' - - postureData: - type: object - required: - - mac - - domain - - os - - processes - - apiSessionPostureData - properties: - mac: - $ref: '#/definitions/postureDataMac' - domain: - $ref: '#/definitions/postureDataDomain' - os: - $ref: '#/definitions/postureDataOs' - processes: - type: array - items: - $ref: '#/definitions/postureDataProcess' - apiSessionPostureData: - type: object - additionalProperties: - $ref: '#/definitions/apiSessionPostureData' - - failedServiceRequestList: - type: array - items: - $ref: '#/definitions/failedSessionRequest' - - ################################################################### - # Posture Query - ################################################################## - postureQueries: - type: object - required: - - policyId - - isPassing - - postureQueries - properties: - policyId: - type: string - isPassing: - type: boolean - policyType: - $ref: '#/definitions/dialBind' - postureQueries: - type: array - items: - $ref: '#/definitions/postureQuery' - postureQuery: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - queryType - - isPassing - - timeout - properties: - isPassing: - type: boolean - timeout: - type: integer - queryType: - $ref: '#/definitions/postureCheckType' - process: - $ref: '#/definitions/postureQueryProcess' - processes: - type: array - items: - $ref: '#/definitions/postureQueryProcess' - postureQueryProcess: - type: object - properties: - osType: - $ref: '#/definitions/osType' - path: - type: string - ################################################################### - # Posture Check Types - ################################################################## - listPostureCheckTypesEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/PostureCheckTypeList' - detailPostureCheckTypeEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/PostureCheckTypeDetail' - PostureCheckTypeList: - type: array - items: - $ref: '#/definitions/PostureCheckTypeDetail' - PostureCheckTypeDetail: - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - name - - operatingSystems - - version - properties: - name: - type: string - operatingSystems: - type: array - items: - $ref: '#/definitions/operatingSystem' - version: - type: string - - ################################################################### - # Posture Check - ################################################################## - listPostureCheckEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - #can't use PostureCheckList as it will cause issues w/ the code generation as of 3/2021 - type: array - items: - $ref: '#/definitions/PostureCheckDetail' - detailPostureCheckEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/PostureCheckDetail' - PostureCheckDetail: - type: object - discriminator: typeId - # base is duped here due to a bug in go-swagger that will try to embed a struct in an interface - # see https://github.com/go-swagger/go-swagger/issues/2413 - required: - - name - - typeId - - version - - roleAttributes - - id - - createdAt - - updatedAt - - _links - - tags - properties: - name: - type: string - typeId: - type: string - version: - type: integer - roleAttributes: - $ref: '#/definitions/attributes' - id: - type: string - createdAt: - type: string - format: date-time - updatedAt: - type: string - format: date-time - _links: - $ref: '#/definitions/links' - tags: - $ref: '#/definitions/tags' - PostureCheckCreate: - type: object - discriminator: typeId - required: - - name - - typeId - properties: - name: - type: string - typeId: - $ref: '#/definitions/postureCheckType' - roleAttributes: - $ref: '#/definitions/attributes' - tags: - $ref: '#/definitions/tags' - PostureCheckUpdate: - type: object - discriminator: typeId - required: - - name - properties: - name: - type: string - typeId: - $ref: '#/definitions/postureCheckType' - roleAttributes: - $ref: '#/definitions/attributes' - tags: - $ref: '#/definitions/tags' - PostureCheckPatch: - type: object - discriminator: typeId - properties: - name: - type: string - roleAttributes: - $ref: '#/definitions/attributes' - tags: - $ref: '#/definitions/tags' - - ################################################################### - # Posture Check Operating System - ################################################################### - PostureCheckOperatingSystemDetail: - allOf: - - $ref: '#/definitions/PostureCheckDetail' - - type: object - required: - - operatingSystems - properties: - operatingSystems: - type: array - items: - $ref: '#/definitions/operatingSystem' - x-class: "OS" - - PostureCheckOperatingSystemCreate: - allOf: - - $ref: '#/definitions/PostureCheckCreate' - - type: object - required: - - operatingSystems - properties: - operatingSystems: - type: array - minItems: 1 - items: - $ref: '#/definitions/operatingSystem' - x-class: "OS" - PostureCheckOperatingSystemUpdate: - allOf: - - $ref: '#/definitions/PostureCheckUpdate' - - type: object - required: - - operatingSystems - properties: - operatingSystems: - type: array - minItems: 1 - items: - $ref: '#/definitions/operatingSystem' - x-class: "OS" - PostureCheckOperatingSystemPatch: - allOf: - - $ref: '#/definitions/PostureCheckPatch' - - type: object - properties: - operatingSystems: - type: array - minItems: 1 - items: - $ref: '#/definitions/operatingSystem' - x-class: "OS" - - ################################################################### - # Posture Check Domain - ################################################################### - PostureCheckDomainDetail: - allOf: - - $ref: '#/definitions/PostureCheckDetail' - - type: object - required: - - domains - properties: - domains: - type: array - minItems: 1 - items: - type: string - x-class: "DOMAIN" - - PostureCheckDomainCreate: - allOf: - - $ref: '#/definitions/PostureCheckCreate' - - type: object - required: - - domains - properties: - domains: - type: array - minItems: 1 - items: - type: string - x-class: "DOMAIN" - - PostureCheckDomainUpdate: - allOf: - - $ref: '#/definitions/PostureCheckUpdate' - - type: object - required: - - domains - properties: - domains: - type: array - minItems: 1 - items: - type: string - x-class: "DOMAIN" - - PostureCheckDomainPatch: - allOf: - - $ref: '#/definitions/PostureCheckPatch' - - type: object - properties: - domains: - type: array - minItems: 1 - items: - type: string - x-class: "DOMAIN" - - ################################################################### - # Posture Check MAC Address - ################################################################### - PostureCheckMacAddressDetail: - allOf: - - $ref: '#/definitions/PostureCheckDetail' - - type: object - required: - - macAddresses - properties: - macAddresses: - type: array - minItems: 1 - items: - type: string - - x-class: "MAC" - - PostureCheckMacAddressCreate: - allOf: - - $ref: '#/definitions/PostureCheckCreate' - - type: object - required: - - macAddresses - properties: - macAddresses: - type: array - minItems: 1 - items: - type: string - x-class: "MAC" - - PostureCheckMacAddressUpdate: - allOf: - - $ref: '#/definitions/PostureCheckUpdate' - - type: object - required: - - macAddresses - properties: - macAddresses: - type: array - minItems: 1 - items: - type: string - x-class: "MAC" - - PostureCheckMacAddressPatch: - allOf: - - $ref: '#/definitions/PostureCheckPatch' - - type: object - properties: - macAddresses: - type: array - minItems: 1 - items: - type: string - x-class: "MAC" - - ################################################################### - # Posture Check Process - ################################################################### - PostureCheckProcessDetail: - allOf: - - $ref: '#/definitions/PostureCheckDetail' - - type: object - required: - - process - properties: - process: - $ref: '#/definitions/process' - x-class: "PROCESS" - - PostureCheckProcessCreate: - allOf: - - $ref: '#/definitions/PostureCheckCreate' - - type: object - required: - - process - properties: - process: - $ref: '#/definitions/process' - x-class: "PROCESS" - - PostureCheckProcessUpdate: - allOf: - - $ref: '#/definitions/PostureCheckUpdate' - - type: object - required: - - process - properties: - process: - $ref: '#/definitions/process' - x-class: "PROCESS" - - PostureCheckProcessPatch: - allOf: - - $ref: '#/definitions/PostureCheckPatch' - - type: object - properties: - process: - $ref: '#/definitions/process' - x-class: "PROCESS" - - ################################################################### - # Posture Check Process Multi - ################################################################### - PostureCheckProcessMultiDetail: - allOf: - - $ref: '#/definitions/PostureCheckDetail' - - type: object - required: - - semantic - - processes - properties: - semantic: - $ref: '#/definitions/semantic' - processes: - type: array - minItems: 1 - items: - $ref: '#/definitions/processMulti' - x-class: "PROCESS_MULTI" - - PostureCheckProcessMultiCreate: - allOf: - - $ref: '#/definitions/PostureCheckCreate' - - type: object - required: - - semantic - - processes - properties: - semantic: - $ref: '#/definitions/semantic' - processes: - type: array - minItems: 1 - items: - $ref: '#/definitions/processMulti' - x-class: "PROCESS_MULTI" - - PostureCheckProcessMultiUpdate: - allOf: - - $ref: '#/definitions/PostureCheckUpdate' - - type: object - required: - - semantic - - processes - properties: - semantic: - $ref: '#/definitions/semantic' - processes: - type: array - minItems: 1 - items: - $ref: '#/definitions/processMulti' - x-class: "PROCESS_MULTI" - - PostureCheckProcessMultiPatch: - allOf: - - $ref: '#/definitions/PostureCheckPatch' - - type: object - properties: - semantic: - $ref: '#/definitions/semantic' - processes: - type: array - minItems: 1 - items: - $ref: '#/definitions/processMulti' - x-class: "PROCESS_MULTI" - - ################################################################### - # Posture Check MFA - ################################################################### - PostureCheckMfaDetail: - allOf: - - $ref: '#/definitions/PostureCheckDetail' - x-class: "MFA" - - PostureCheckMfaCreate: - allOf: - - $ref: '#/definitions/PostureCheckCreate' - x-class: "MFA" - - PostureCheckMfaUpdate: - allOf: - - $ref: '#/definitions/PostureCheckUpdate' - x-class: "MFA" - - PostureCheckMfaPatch: - allOf: - - $ref: '#/definitions/PostureCheckPatch' - x-class: "MFA" - - ################################################################### - # Posture Response - ################################################################### - PostureResponseCreate: - type: object - discriminator: typeId - required: - - id - - typeId - properties: - id: - type: string - typeId: - $ref: '#/definitions/postureCheckType' - - PostureResponseOperatingSystemCreate: - allOf: - - $ref: '#/definitions/PostureResponseCreate' - - type: object - required: - - type - - version - properties: - type: - type: string - version: - type: string - build: - type: string - x-class: "OS" - - PostureResponseDomainCreate: - allOf: - - $ref: '#/definitions/PostureResponseCreate' - - type: object - required: - - domain - properties: - domain: - type: string - x-class: "DOMAIN" - - PostureResponseMacAddressCreate: - allOf: - - $ref: '#/definitions/PostureResponseCreate' - - type: object - required: - - macAddresses - properties: - macAddresses: - type: array - items: - type: string - x-class: "MAC" - - PostureResponseProcessCreate: - allOf: - - $ref: '#/definitions/PostureResponseCreate' - - type: object - required: - - path - - isRunning - - hash - - signerFingerprints - properties: - path: - type: string - isRunning: - type: boolean - hash: - type: string - signerFingerprints: - type: array - items: - type: string - x-class: "PROCESS" - - ################################################################### - # Authentication Checks - ################################################################### - authQueryList: - type: array - items: - $ref: '#/definitions/authQueryDetail' - authQueryDetail: - type: object - required: - - provider - properties: - typeId: - type: string - provider: - $ref: '#/definitions/mfaProviders' - httpMethod: - type: string - httpUrl: - type: string - minLength: - type: integer - maxLength: - type: integer - format: - $ref: '#/definitions/mfaFormats' - - mfaFormats: - type: string - enum: - - numeric - - alpha - - alphaNumeric - mfaProviders: - type: string - enum: - - ziti - ################################################################### - # Current API Session: Certificates - ################################################################### - currentApiSessionCertificateList: - type: array - items: - $ref: '#/definitions/currentApiSessionCertificateDetail' - currentApiSessionCertificateDetail: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - type: object - required: - - subject - - fingerprint - - validFrom - - validTo - - certificate - properties: - subject: - type: string - fingerprint: - type: string - validFrom: - type: string - format: date-time - validTo: - type: string - format: date-time - certificate: - type: string - currentApiSessionCertificateCreate: - type: object - required: - - csr - properties: - csr: - type: string - currentApiSessionCertificateCreateResponse: - allOf: - - $ref: '#/definitions/createLocation' - - type: object - required: - - certificate - properties: - certificate: - type: string - cas: - type: string - - ################################################################### - # Current Identity: MFA - ################################################################### - mfaCreatedEnvelope: - type: object - required: - - meta - - error - properties: - meta: - $ref: '#/definitions/meta' - error: - $ref: '#/definitions/apiError' - detailMfaEnvelope: - type: object - required: - - meta - - error - properties: - meta: - $ref: '#/definitions/meta' - error: - $ref: '#/definitions/detailMfa' - detailMfa: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - required: - - isVerified - properties: - isVerified: - type: boolean - recoveryCodes: - type: array - items: - type: string - description: Not provided if MFA verification has been completed - provisioningUrl: - type: string - description: Not provided if MFA verification has been completed - detailMfaRecoveryCodesEnvelope: - type: object - required: - - meta - - error - properties: - meta: - $ref: '#/definitions/meta' - error: - $ref: '#/definitions/detailMfaRecoveryCodes' - detailMfaRecoveryCodes: - type: object - allOf: - - $ref: '#/definitions/baseEntity' - - required: - - recoveryCodes - properties: - recoveryCodes: - type: array - items: - type: string - mfaCode: - type: object - required: - - code - properties: - code: - type: string - ################################################################### - # Current API Session: Service Updates - ################################################################## - listCurrentApiSessionServiceUpdatesEnvelope: - type: object - required: - - meta - - data - properties: - meta: - $ref: '#/definitions/meta' - data: - $ref: '#/definitions/CurrentApiSessionServiceUpdateList' - CurrentApiSessionServiceUpdateList: - type: object - required: - - lastChangeAt - properties: - lastChangeAt: - type: string - format: 'date-time' - - ################################################################### - # Enrollment/Reenrollment - ################################################################## - routerExtendEnrollmentRequest: - type: object - required: - - serverCertCsr - - certCsr - properties: - serverCertCsr: - type: string - certCsr: - type: string