Merge pull request #259 from openziti/db-integrity-check

Integrate data integrity check/repair framework and add REST API. Fix…
2026-10-14 16:19:57 +00:00 · 2020-07-29 13:39:30 -04:00
parent e5701b427a bb3ca676e8
commit fc8412b6f2
35 changed files with 2150 additions and 50 deletions
@@ -23,8 +23,10 @@ import (
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
 	"github.com/openziti/edge/controller/response"
+	"github.com/openziti/edge/rest_model"
 	"github.com/openziti/edge/rest_server/operations/database"
 	"github.com/openziti/fabric/controller/network"
+	"net/http"
 )

 func init() {
@@ -43,6 +45,14 @@ func (r *DatabaseRouter) Register(ae *env.AppEnv) {
 	ae.Api.DatabaseCreateDatabaseSnapshotHandler = database.CreateDatabaseSnapshotHandlerFunc(func(params database.CreateDatabaseSnapshotParams, _ interface{}) middleware.Responder {
 		return ae.IsAllowed(func(ae *env.AppEnv, rc *response.RequestContext) { r.CreateSnapshot(ae, rc) }, params.HTTPRequest, "", "", permissions.IsAdmin())
 	})
+
+	ae.Api.DatabaseCheckDataIntegrityHandler = database.CheckDataIntegrityHandlerFunc(func(params database.CheckDataIntegrityParams, _ interface{}) middleware.Responder {
+		return ae.IsAllowed(func(ae *env.AppEnv, rc *response.RequestContext) { r.CheckDatastoreIntegrity(ae, rc, false) }, params.HTTPRequest, "", "", permissions.IsAdmin())
+	})
+
+	ae.Api.DatabaseFixDataIntegrityHandler = database.FixDataIntegrityHandlerFunc(func(params database.FixDataIntegrityParams, _ interface{}) middleware.Responder {
+		return ae.IsAllowed(func(ae *env.AppEnv, rc *response.RequestContext) { r.CheckDatastoreIntegrity(ae, rc, true) }, params.HTTPRequest, "", "", permissions.IsAdmin())
+	})
 }

 func (r *DatabaseRouter) CreateSnapshot(ae *env.AppEnv, rc *response.RequestContext) {
@@ -56,3 +66,38 @@ func (r *DatabaseRouter) CreateSnapshot(ae *env.AppEnv, rc *response.RequestCont
 	}
 	rc.RespondWithEmptyOk()
 }
+
+func (r *DatabaseRouter) CheckDatastoreIntegrity(ae *env.AppEnv, rc *response.RequestContext, fixErrors bool) {
+	var results []*rest_model.DataIntegrityCheckDetail
+
+	errorHandler := func(err error, fixed bool) {
+		description := err.Error()
+		results = append(results, &rest_model.DataIntegrityCheckDetail{
+			Description: &description,
+			Fixed:       &fixed,
+		})
+	}
+
+	if err := ae.GetStores().CheckIntegrity(fixErrors, errorHandler); err != nil {
+		rc.RespondWithError(err)
+		return
+	}
+
+	limit := int64(-1)
+	zero := int64(0)
+	count := int64(len(results))
+
+	result := rest_model.DataIntegrityCheckResultEnvelope{
+		Data: results,
+		Meta: &rest_model.Meta{
+			Pagination: &rest_model.Pagination{
+				Limit:      &limit,
+				Offset:     &zero,
+				TotalCount: &count,
+			},
+			FilterableFields: make([]string, 0),
+		},
+	}
+
+	rc.Respond(result, http.StatusOK)
+}
@@ -88,7 +88,6 @@ type EdgeRouterPolicyStore interface {
 	NameIndexedStore
 	LoadOneById(tx *bbolt.Tx, id string) (*EdgeRouterPolicy, error)
 	LoadOneByName(tx *bbolt.Tx, id string) (*EdgeRouterPolicy, error)
-	CheckIntegrity(tx *bbolt.Tx, fix bool, errorSink func(error)) error
 }

 func newEdgeRouterPolicyStore(stores *stores) *edgeRouterPolicyStoreImpl {
@@ -198,8 +197,9 @@ func (store *edgeRouterPolicyStoreImpl) DeleteById(ctx boltz.MutateContext, id s
 	return store.BaseStore.DeleteById(ctx, id)
 }

-func (store *edgeRouterPolicyStoreImpl) CheckIntegrity(tx *bbolt.Tx, fix bool, errorSink func(error)) error {
+func (store *edgeRouterPolicyStoreImpl) CheckIntegrity(tx *bbolt.Tx, fix bool, errorSink func(error, bool)) error {
 	ctx := &denormCheckCtx{
+		name:                   "edge-router-policies",
 		tx:                     tx,
 		sourceStore:            store.stores.identity,
 		targetStore:            store.stores.edgeRouter,
@@ -210,5 +210,9 @@ func (store *edgeRouterPolicyStoreImpl) CheckIntegrity(tx *bbolt.Tx, fix bool, e
 		repair:                 fix,
 		errorSink:              errorSink,
 	}
-	return validatePolicyDenormalization(ctx)
+	if err := validatePolicyDenormalization(ctx); err != nil {
+		return err
+	}
+
+	return store.BaseStore.CheckIntegrity(tx, fix, errorSink)
 }
@@ -418,7 +418,7 @@ func (ctx *TestContext) validateEdgeRouterPolicyIdentities(identities []*Identit
 func (ctx *TestContext) validateEdgeRouterPolicyDenormalization() {
 	errorHolder := &errorz.ErrorHolderImpl{}
 	errorHolder.SetError(ctx.db.View(func(tx *bbolt.Tx) error {
-		return ctx.stores.EdgeRouterPolicy.CheckIntegrity(tx, false, func(err error) {
+		return ctx.stores.EdgeRouterPolicy.CheckIntegrity(tx, false, func(err error, _ bool) {
 			errorHolder.SetError(err)
 		})
 	}))
@@ -86,7 +86,6 @@ func (entity *EdgeRouter) SetValues(ctx *boltz.PersistContext) {
 	ctx.SetStringP(FieldEdgeRouterHostname, entity.Hostname)
 	ctx.SetMap(FieldEdgeRouterProtocols, toStringInterfaceMap(entity.EdgeRouterProtocols))
 	ctx.SetStringList(FieldRoleAttributes, entity.RoleAttributes)
-	ctx.SetLinkedIds(FieldEdgeRouterEnrollments, entity.Enrollments)

 	// index change won't fire if we don't have any roles on create, but we need to evaluate if we match any #all roles
 	if ctx.IsCreate && len(entity.RoleAttributes) == 0 {
@@ -162,7 +161,6 @@ func (store *edgeRouterStoreImpl) initializeLocal() {
 func (store *edgeRouterStoreImpl) initializeLinked() {
 	store.AddLinkCollection(store.symbolEdgeRouterPolicies, store.stores.edgeRouterPolicy.symbolEdgeRouters)
 	store.AddLinkCollection(store.symbolServiceEdgeRouterPolicies, store.stores.serviceEdgeRouterPolicy.symbolEdgeRouters)
-	store.AddLinkCollection(store.symbolEnrollments, store.stores.enrollment.symbolEdgeRouter)

 	store.identitiesCollection = store.AddRefCountedLinkCollection(store.symbolIdentities, store.stores.identity.symbolEdgeRouters)
 	store.servicesCollection = store.AddRefCountedLinkCollection(store.symbolServices, store.stores.edgeService.symbolEdgeRouters)
@@ -127,8 +127,6 @@ func (entity *Identity) SetValues(ctx *boltz.PersistContext) {
 	ctx.SetBool(FieldIdentityIsDefaultAdmin, entity.IsDefaultAdmin)
 	ctx.SetBool(FieldIdentityIsAdmin, entity.IsAdmin)
 	ctx.SetString(FieldIdentityType, entity.IdentityTypeId)
-	ctx.SetLinkedIds(FieldIdentityEnrollments, entity.Enrollments)
-	ctx.SetLinkedIds(FieldIdentityAuthenticators, entity.Authenticators)
 	ctx.SetStringList(FieldRoleAttributes, entity.RoleAttributes)

 	if entity.EnvInfo != nil {
@@ -238,8 +236,6 @@ func (store *identityStoreImpl) initializeLocal() {
 }

 func (store *identityStoreImpl) initializeLinked() {
-	store.AddLinkCollection(store.symbolAuthenticators, store.stores.authenticator.symbolIdentityId)
-	store.AddLinkCollection(store.symbolEnrollments, store.stores.enrollment.symbolIdentity)
 	store.AddLinkCollection(store.symbolEdgeRouterPolicies, store.stores.edgeRouterPolicy.symbolIdentities)
 	store.AddLinkCollection(store.symbolServicePolicies, store.stores.servicePolicy.symbolIdentities)

@@ -8,24 +8,24 @@ import (
 func (m *Migrations) denormalizePolicies(step *boltz.MigrationStep) {
 	log := pfxlog.Logger()

-	err := m.stores.EdgeRouterPolicy.CheckIntegrity(step.Ctx.Tx(), true, func(err error) {
-		log.WithError(err).Debug("updating edge router policies")
+	err := m.stores.EdgeRouterPolicy.CheckIntegrity(step.Ctx.Tx(), true, func(err error, fixed bool) {
+		log.WithError(err).Debugf("updating edge router policies. Fixed? %v", fixed)
 	})

 	if step.SetError(err) {
 		return
 	}

-	err = m.stores.ServiceEdgeRouterPolicy.CheckIntegrity(step.Ctx.Tx(), true, func(err error) {
-		log.WithError(err).Debug("updating service edge router policies")
+	err = m.stores.ServiceEdgeRouterPolicy.CheckIntegrity(step.Ctx.Tx(), true, func(err error, fixed bool) {
+		log.WithError(err).Debugf("updating service edge router policies. Fixed? %v", fixed)
 	})

 	if step.SetError(err) {
 		return
 	}

-	err = m.stores.ServicePolicy.CheckIntegrity(step.Ctx.Tx(), true, func(err error) {
-		log.WithError(err).Debug("updating service policies")
+	err = m.stores.ServicePolicy.CheckIntegrity(step.Ctx.Tx(), true, func(err error, fixed bool) {
+		log.WithError(err).Debugf("updating service policies. Fixed? %v", fixed)
 	})

 	if step.SetError(err) {
@@ -162,6 +162,7 @@ func ProcessEntityPolicyUnmatched(ctx *roleAttributeChangeContext, entityId, pol
 }

 type denormCheckCtx struct {
+	name                   string
 	tx                     *bbolt.Tx
 	sourceStore            boltz.CrudStore
 	targetStore            boltz.CrudStore
@@ -170,7 +171,7 @@ type denormCheckCtx struct {
 	targetCollection       boltz.LinkCollection
 	targetDenormCollection boltz.RefCountedLinkCollection
 	policyFilter           func(policyId []byte) bool
-	errorSink              func(err error)
+	errorSink              func(err error, fixed bool)
 	repair                 bool
 }

@@ -212,10 +213,10 @@ func validatePolicyDenormalization(ctx *denormCheckCtx) error {
 func logDiscrepencies(ctx *denormCheckCtx, count int, sourceId, targetId []byte, sourceLinkCount, targetLinkCount *int32) {
 	oldValuesMatch := (sourceLinkCount == nil && targetLinkCount == nil) || (sourceLinkCount != nil && targetLinkCount != nil && *sourceLinkCount == *targetLinkCount)
 	if !oldValuesMatch {
-		err := errors.Errorf("fixed mismatched link counts. was %v %v (%v) <-> %v %v (%v), now both are %v",
+		err := errors.Errorf("%v: ismatched link counts. %v %v (%v) <-> %v %v (%v), should be both are %v", ctx.name,
 			ctx.sourceStore.GetSingularEntityType(), string(sourceId), sourceLinkCount,
 			ctx.targetStore.GetSingularEntityType(), string(targetId), targetLinkCount, count)
-		ctx.errorSink(err)
+		ctx.errorSink(err, ctx.repair)
 	}

 	if ((sourceLinkCount == nil || *sourceLinkCount == 0) && count != 0) ||
@@ -224,11 +225,11 @@ func logDiscrepencies(ctx *denormCheckCtx, count int, sourceId, targetId []byte,
 		if sourceLinkCount != nil {
 			sourceCount = *sourceLinkCount
 		}
-		err := errors.Errorf("fixed incorrect link counts for %v %v <-> %v %v was %v, is now %v",
+		err := errors.Errorf("%v: incorrect link counts for %v %v <-> %v %v is %v, should be %v", ctx.name,
 			ctx.sourceStore.GetSingularEntityType(), string(sourceId),
 			ctx.targetStore.GetSingularEntityType(), string(targetId),
 			sourceCount, count)
-		ctx.errorSink(err)
+		ctx.errorSink(err, ctx.repair)
 	}
 }

@@ -88,7 +88,6 @@ type ServiceEdgeRouterPolicyStore interface {
 	NameIndexedStore
 	LoadOneById(tx *bbolt.Tx, id string) (*ServiceEdgeRouterPolicy, error)
 	LoadOneByName(tx *bbolt.Tx, id string) (*ServiceEdgeRouterPolicy, error)
-	CheckIntegrity(tx *bbolt.Tx, fix bool, errorSink func(error)) error
 }

 func newServiceEdgeRouterPolicyStore(stores *stores) *serviceEdgeRouterPolicyStoreImpl {
@@ -198,8 +197,9 @@ func (store *serviceEdgeRouterPolicyStoreImpl) DeleteById(ctx boltz.MutateContex
 	return store.BaseStore.DeleteById(ctx, id)
 }

-func (store *serviceEdgeRouterPolicyStoreImpl) CheckIntegrity(tx *bbolt.Tx, fix bool, errorSink func(error)) error {
+func (store *serviceEdgeRouterPolicyStoreImpl) CheckIntegrity(tx *bbolt.Tx, fix bool, errorSink func(err error, fixed bool)) error {
 	ctx := &denormCheckCtx{
+		name:                   "service-edge-router-policies",
 		tx:                     tx,
 		sourceStore:            store.stores.edgeService,
 		targetStore:            store.stores.edgeRouter,
@@ -210,5 +210,9 @@ func (store *serviceEdgeRouterPolicyStoreImpl) CheckIntegrity(tx *bbolt.Tx, fix
 		errorSink:              errorSink,
 		repair:                 fix,
 	}
-	return validatePolicyDenormalization(ctx)
+	if err := validatePolicyDenormalization(ctx); err != nil {
+		return err
+	}
+
+	return store.BaseStore.CheckIntegrity(tx, fix, errorSink)
 }
@@ -429,7 +429,7 @@ func (ctx *TestContext) validateServiceEdgeRouterPolicyEdgeRouters(edgeRouters [
 func (ctx *TestContext) validateServiceEdgeRouterPolicyDenormalization() {
 	errorHolder := &errorz.ErrorHolderImpl{}
 	errorHolder.SetError(ctx.db.View(func(tx *bbolt.Tx) error {
-		return ctx.stores.ServiceEdgeRouterPolicy.CheckIntegrity(tx, false, func(err error) {
+		return ctx.stores.ServiceEdgeRouterPolicy.CheckIntegrity(tx, false, func(err error, _ bool) {
 			errorHolder.SetError(err)
 		})
 	}))
@@ -57,7 +57,7 @@ func (entity *ServicePolicy) GetSemantic() string {
 func (entity *ServicePolicy) LoadValues(_ boltz.CrudStore, bucket *boltz.TypedBucket) {
 	entity.LoadBaseValues(bucket)
 	entity.Name = bucket.GetStringOrError(FieldName)
-	entity.PolicyType = bucket.GetInt32WithDefault(FieldServicePolicyType, PolicyTypeInvalid)
+	entity.PolicyType = bucket.GetInt32WithDefault(FieldServicePolicyType, PolicyTypeDial)
 	entity.Semantic = bucket.GetStringWithDefault(FieldSemantic, SemanticAllOf)
 	entity.IdentityRoles = bucket.GetStringList(FieldIdentityRoles)
 	entity.ServiceRoles = bucket.GetStringList(FieldServiceRoles)
@@ -68,8 +68,9 @@ func (entity *ServicePolicy) SetValues(ctx *boltz.PersistContext) {
 		entity.Semantic = SemanticAllOf
 	}

-	if entity.PolicyType != PolicyTypeBind {
-		entity.PolicyType = PolicyTypeDial
+	if ctx.ProceedWithSet(FieldServicePolicyType) && entity.PolicyType != PolicyTypeBind && entity.PolicyType != PolicyTypeDial {
+		ctx.Bucket.SetError(validation.NewFieldError("invalid policy type", FieldServicePolicyType, entity.PolicyType))
+		return
 	}

 	if err := validateRolesAndIds(FieldIdentityRoles, entity.IdentityRoles); err != nil {
@@ -80,7 +81,7 @@ func (entity *ServicePolicy) SetValues(ctx *boltz.PersistContext) {
 		ctx.Bucket.SetError(err)
 	}

-	if !isSemanticValid(entity.Semantic) {
+	if ctx.ProceedWithSet(FieldSemantic) && !isSemanticValid(entity.Semantic) {
 		ctx.Bucket.SetError(validation.NewFieldError("invalid semantic", FieldSemantic, entity.Semantic))
 		return
 	}
@@ -126,7 +127,6 @@ type ServicePolicyStore interface {
 	NameIndexedStore
 	LoadOneById(tx *bbolt.Tx, id string) (*ServicePolicy, error)
 	LoadOneByName(tx *bbolt.Tx, id string) (*ServicePolicy, error)
-	CheckIntegrity(tx *bbolt.Tx, fix bool, errorSink func(error)) error
 }

 func newServicePolicyStore(stores *stores) *servicePolicyStoreImpl {
@@ -248,8 +248,9 @@ func (store *servicePolicyStoreImpl) DeleteById(ctx boltz.MutateContext, id stri
 	return store.BaseStore.DeleteById(ctx, id)
 }

-func (store *servicePolicyStoreImpl) CheckIntegrity(tx *bbolt.Tx, fix bool, errorSink func(error)) error {
+func (store *servicePolicyStoreImpl) CheckIntegrity(tx *bbolt.Tx, fix bool, errorSink func(err error, fixed bool)) error {
 	ctx := &denormCheckCtx{
+		name:                   "service-policies/bind",
 		tx:                     tx,
 		sourceStore:            store.stores.identity,
 		targetStore:            store.stores.edgeService,
@@ -272,6 +273,7 @@ func (store *servicePolicyStoreImpl) CheckIntegrity(tx *bbolt.Tx, fix bool, erro
 	}

 	ctx = &denormCheckCtx{
+		name:                   "service-policies/dial",
 		tx:                     tx,
 		sourceStore:            store.stores.identity,
 		targetStore:            store.stores.edgeService,
@@ -290,5 +292,9 @@ func (store *servicePolicyStoreImpl) CheckIntegrity(tx *bbolt.Tx, fix bool, erro
 		},
 	}

-	return validatePolicyDenormalization(ctx)
+	if err := validatePolicyDenormalization(ctx); err != nil {
+		return err
+	}
+
+	return store.BaseStore.CheckIntegrity(tx, fix, errorSink)
 }
@@ -431,7 +431,7 @@ func (ctx *TestContext) validateServicePolicyServices(services []*EdgeService, p
 func (ctx *TestContext) validateServicePolicyDenormalization() {
 	errorHolder := &errorz.ErrorHolderImpl{}
 	errorHolder.SetError(ctx.db.View(func(tx *bbolt.Tx) error {
-		return ctx.stores.ServicePolicy.CheckIntegrity(tx, false, func(err error) {
+		return ctx.stores.ServicePolicy.CheckIntegrity(tx, false, func(err error, _ bool) {
 			errorHolder.SetError(err)
 		})
 	}))
@@ -83,6 +83,27 @@ func (stores *Stores) GetStoreForEntity(entity boltz.Entity) boltz.CrudStore {
 	return stores.storeMap[reflect.TypeOf(entity)]
 }

+func (stores *Stores) CheckIntegrity(fix bool, errorHandler func(error, bool)) error {
+	if fix {
+		return stores.DbProvider.GetDb().Update(func(tx *bbolt.Tx) error {
+			return stores.CheckIntegrityInTx(tx, fix, errorHandler)
+		})
+	}
+
+	return stores.DbProvider.GetDb().View(func(tx *bbolt.Tx) error {
+		return stores.CheckIntegrityInTx(tx, fix, errorHandler)
+	})
+}
+
+func (stores *Stores) CheckIntegrityInTx(tx *bbolt.Tx, fix bool, errorHandler func(error, bool)) error {
+	for _, store := range stores.storeMap {
+		if err := store.CheckIntegrity(tx, fix, errorHandler); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 type stores struct {
 	DbProvider DbProvider

@@ -196,8 +217,3 @@ func NewBoltStores(dbProvider DbProvider) (*Stores, error) {
 	}
 	return externalStores, nil
 }
-
-type QueryContext struct {
-	Stores *Stores
-	Tx     *bbolt.Tx
-}
@@ -60,7 +60,6 @@ func (entity *TransitRouter) SetValues(ctx *boltz.PersistContext) {
 	entity.Router.SetValues(ctx.GetParentContext())
 	if ctx.Bucket != nil {
 		ctx.SetBool(FieldTransitRouterIsVerified, entity.IsVerified)
-		ctx.SetStringList(FieldTransitRouterEnrollments, entity.Enrollments)
 	}
 }

@@ -106,7 +105,6 @@ func (store *transitRouterStoreImpl) initializeLocal() {
 }

 func (store *transitRouterStoreImpl) initializeLinked() {
-	store.AddLinkCollection(store.symbolEnrollments, store.stores.enrollment.symbolIdentity)
 }

 func (store *transitRouterStoreImpl) CleanupExternal(ctx boltz.MutateContext, id string) error {
@@ -31,9 +31,9 @@ require (
 	github.com/michaelquigley/pfxlog v0.0.0-20190813191113-2be43bd0dccc
 	github.com/miekg/dns v1.1.30
 	github.com/mitchellh/mapstructure v1.3.3
-	github.com/openziti/fabric v0.11.56
-	github.com/openziti/foundation v0.11.15
-	github.com/openziti/sdk-golang v0.13.24
+	github.com/openziti/fabric v0.11.57
+	github.com/openziti/foundation v0.11.16
+	github.com/openziti/sdk-golang v0.13.26
 	github.com/pkg/errors v0.9.1
 	github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0
 	github.com/sirupsen/logrus v1.6.0
@@ -282,12 +282,12 @@ github.com/onsi/ginkgo v1.7.0 h1:WSHQ+IS43OoUrWtD1/bbclrwK8TTH5hzp+umCiuxHgs=
 github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/gomega v1.4.3 h1:RE1xgDvH7imwFD45h+u2SgIfERHlS2yNG4DObb5BSKU=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/openziti/fabric v0.11.56 h1:u76PWSwbIgATtlF3mp3J1ioDwCyr7geaHFr0mZaiqEk=
-github.com/openziti/fabric v0.11.56/go.mod h1:9hvRAwTCRJanUb+1iF/NQ6HFfull7maHa9tCqklsNxk=
-github.com/openziti/foundation v0.11.15 h1:+LpphupxZvABFT2lZoS+Nk5EPBe09aXE935Jyfb5sQ8=
-github.com/openziti/foundation v0.11.15/go.mod h1:4Jgs3HGDiP1aVk5nNzXJqwJwWhrjOYy1F+4Xtxcgxvo=
-github.com/openziti/sdk-golang v0.13.24 h1:gu9R7QaGwAjgBigbotZz8Qwe0jiCkCVSzMuBWNIc9FE=
-github.com/openziti/sdk-golang v0.13.24/go.mod h1:hPRLQHARp9OuRViYFsZ6icwn1LjudXQBJ/USswKQyTY=
+github.com/openziti/fabric v0.11.57 h1:9M9nXzsLvUR/qq9XBwMXN7NE1mtrn/cI+ZsfFd+lcJc=
+github.com/openziti/fabric v0.11.57/go.mod h1:KJN8zm/krVb4aeMRR/8QcEszHQOoaGxUmE+jm88K4iA=
+github.com/openziti/foundation v0.11.16 h1:8pWIEHGM6Stmc9QxW/R+saRzxkzDsTDlAcyO21qrh4k=
+github.com/openziti/foundation v0.11.16/go.mod h1:4Jgs3HGDiP1aVk5nNzXJqwJwWhrjOYy1F+4Xtxcgxvo=
+github.com/openziti/sdk-golang v0.13.26 h1:WOGdmkzqNTh/3dT1dU6Bg0yZ7IX3drAhQju3WO/+kJs=
+github.com/openziti/sdk-golang v0.13.26/go.mod h1:leIaRUZzYSt+AHnwXlzH/XSX0hOhcjjJ/rMDTkieV/8=
 github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6 h1:lNCW6THrCKBiJBpz8kbVGjC7MgdCGKwuvBgc7LoD6sw=
 github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CFcDWnWD9XkenwhI=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
@@ -0,0 +1,136 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package database
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewCheckDataIntegrityParams creates a new CheckDataIntegrityParams object
+// with the default values initialized.
+func NewCheckDataIntegrityParams() *CheckDataIntegrityParams {
+
+	return &CheckDataIntegrityParams{
+
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewCheckDataIntegrityParamsWithTimeout creates a new CheckDataIntegrityParams object
+// with the default values initialized, and the ability to set a timeout on a request
+func NewCheckDataIntegrityParamsWithTimeout(timeout time.Duration) *CheckDataIntegrityParams {
+
+	return &CheckDataIntegrityParams{
+
+		timeout: timeout,
+	}
+}
+
+// NewCheckDataIntegrityParamsWithContext creates a new CheckDataIntegrityParams object
+// with the default values initialized, and the ability to set a context for a request
+func NewCheckDataIntegrityParamsWithContext(ctx context.Context) *CheckDataIntegrityParams {
+
+	return &CheckDataIntegrityParams{
+
+		Context: ctx,
+	}
+}
+
+// NewCheckDataIntegrityParamsWithHTTPClient creates a new CheckDataIntegrityParams object
+// with the default values initialized, and the ability to set a custom HTTPClient for a request
+func NewCheckDataIntegrityParamsWithHTTPClient(client *http.Client) *CheckDataIntegrityParams {
+
+	return &CheckDataIntegrityParams{
+		HTTPClient: client,
+	}
+}
+
+/*CheckDataIntegrityParams contains all the parameters to send to the API endpoint
+for the check data integrity operation typically these are written to a http.Request
+*/
+type CheckDataIntegrityParams struct {
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithTimeout adds the timeout to the check data integrity params
+func (o *CheckDataIntegrityParams) WithTimeout(timeout time.Duration) *CheckDataIntegrityParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the check data integrity params
+func (o *CheckDataIntegrityParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the check data integrity params
+func (o *CheckDataIntegrityParams) WithContext(ctx context.Context) *CheckDataIntegrityParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the check data integrity params
+func (o *CheckDataIntegrityParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the check data integrity params
+func (o *CheckDataIntegrityParams) WithHTTPClient(client *http.Client) *CheckDataIntegrityParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the check data integrity params
+func (o *CheckDataIntegrityParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *CheckDataIntegrityParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
@@ -0,0 +1,132 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package database
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// CheckDataIntegrityReader is a Reader for the CheckDataIntegrity structure.
+type CheckDataIntegrityReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *CheckDataIntegrityReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewCheckDataIntegrityOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 401:
+		result := NewCheckDataIntegrityUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+
+	default:
+		return nil, runtime.NewAPIError("unknown error", response, response.Code())
+	}
+}
+
+// NewCheckDataIntegrityOK creates a CheckDataIntegrityOK with default headers values
+func NewCheckDataIntegrityOK() *CheckDataIntegrityOK {
+	return &CheckDataIntegrityOK{}
+}
+
+/*CheckDataIntegrityOK handles this case with default header values.
+
+A list of data integrity issues found
+*/
+type CheckDataIntegrityOK struct {
+	Payload *rest_model.DataIntegrityCheckResultEnvelope
+}
+
+func (o *CheckDataIntegrityOK) Error() string {
+	return fmt.Sprintf("[GET /database/check-data-integrity][%d] checkDataIntegrityOK  %+v", 200, o.Payload)
+}
+
+func (o *CheckDataIntegrityOK) GetPayload() *rest_model.DataIntegrityCheckResultEnvelope {
+	return o.Payload
+}
+
+func (o *CheckDataIntegrityOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.DataIntegrityCheckResultEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewCheckDataIntegrityUnauthorized creates a CheckDataIntegrityUnauthorized with default headers values
+func NewCheckDataIntegrityUnauthorized() *CheckDataIntegrityUnauthorized {
+	return &CheckDataIntegrityUnauthorized{}
+}
+
+/*CheckDataIntegrityUnauthorized handles this case with default header values.
+
+The currently supplied session does not have the correct access rights to request this resource
+*/
+type CheckDataIntegrityUnauthorized struct {
+	Payload *rest_model.APIErrorEnvelope
+}
+
+func (o *CheckDataIntegrityUnauthorized) Error() string {
+	return fmt.Sprintf("[GET /database/check-data-integrity][%d] checkDataIntegrityUnauthorized  %+v", 401, o.Payload)
+}
+
+func (o *CheckDataIntegrityUnauthorized) GetPayload() *rest_model.APIErrorEnvelope {
+	return o.Payload
+}
+
+func (o *CheckDataIntegrityUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.APIErrorEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
@@ -51,11 +51,52 @@ type Client struct {

 // ClientService is the interface for Client methods
 type ClientService interface {
+	CheckDataIntegrity(params *CheckDataIntegrityParams, authInfo runtime.ClientAuthInfoWriter) (*CheckDataIntegrityOK, error)
+
 	CreateDatabaseSnapshot(params *CreateDatabaseSnapshotParams, authInfo runtime.ClientAuthInfoWriter) (*CreateDatabaseSnapshotOK, error)

+	FixDataIntegrity(params *FixDataIntegrityParams, authInfo runtime.ClientAuthInfoWriter) (*FixDataIntegrityOK, error)
+
 	SetTransport(transport runtime.ClientTransport)
 }

+/*
+  CheckDataIntegrity runs an data integrity scan on the datastore and returns any found issues
+
+  Runs an data integrity scan on the datastore and returns any found issues. Requires admin access.
+*/
+func (a *Client) CheckDataIntegrity(params *CheckDataIntegrityParams, authInfo runtime.ClientAuthInfoWriter) (*CheckDataIntegrityOK, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewCheckDataIntegrityParams()
+	}
+
+	result, err := a.transport.Submit(&runtime.ClientOperation{
+		ID:                 "checkDataIntegrity",
+		Method:             "GET",
+		PathPattern:        "/database/check-data-integrity",
+		ProducesMediaTypes: []string{"application/json"},
+		ConsumesMediaTypes: []string{"application/json"},
+		Schemes:            []string{"https"},
+		Params:             params,
+		Reader:             &CheckDataIntegrityReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	})
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*CheckDataIntegrityOK)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for checkDataIntegrity: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
 /*
  CreateDatabaseSnapshot creates a new database snapshot

@@ -93,6 +134,43 @@ func (a *Client) CreateDatabaseSnapshot(params *CreateDatabaseSnapshotParams, au
 	panic(msg)
 }

+/*
+  FixDataIntegrity runs an data integrity scan on the datastore attempts to fix any issues it can and returns any found issues
+
+  Runs an data integrity scan on the datastore, attempts to fix any issues it can, and returns any found issues. Requires admin access.
+*/
+func (a *Client) FixDataIntegrity(params *FixDataIntegrityParams, authInfo runtime.ClientAuthInfoWriter) (*FixDataIntegrityOK, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewFixDataIntegrityParams()
+	}
+
+	result, err := a.transport.Submit(&runtime.ClientOperation{
+		ID:                 "fixDataIntegrity",
+		Method:             "POST",
+		PathPattern:        "/database/fix-data-integrity",
+		ProducesMediaTypes: []string{"application/json"},
+		ConsumesMediaTypes: []string{"application/json"},
+		Schemes:            []string{"https"},
+		Params:             params,
+		Reader:             &FixDataIntegrityReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	})
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*FixDataIntegrityOK)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for fixDataIntegrity: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
 // SetTransport changes the transport on the client
 func (a *Client) SetTransport(transport runtime.ClientTransport) {
 	a.transport = transport
@@ -0,0 +1,136 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package database
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewFixDataIntegrityParams creates a new FixDataIntegrityParams object
+// with the default values initialized.
+func NewFixDataIntegrityParams() *FixDataIntegrityParams {
+
+	return &FixDataIntegrityParams{
+
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewFixDataIntegrityParamsWithTimeout creates a new FixDataIntegrityParams object
+// with the default values initialized, and the ability to set a timeout on a request
+func NewFixDataIntegrityParamsWithTimeout(timeout time.Duration) *FixDataIntegrityParams {
+
+	return &FixDataIntegrityParams{
+
+		timeout: timeout,
+	}
+}
+
+// NewFixDataIntegrityParamsWithContext creates a new FixDataIntegrityParams object
+// with the default values initialized, and the ability to set a context for a request
+func NewFixDataIntegrityParamsWithContext(ctx context.Context) *FixDataIntegrityParams {
+
+	return &FixDataIntegrityParams{
+
+		Context: ctx,
+	}
+}
+
+// NewFixDataIntegrityParamsWithHTTPClient creates a new FixDataIntegrityParams object
+// with the default values initialized, and the ability to set a custom HTTPClient for a request
+func NewFixDataIntegrityParamsWithHTTPClient(client *http.Client) *FixDataIntegrityParams {
+
+	return &FixDataIntegrityParams{
+		HTTPClient: client,
+	}
+}
+
+/*FixDataIntegrityParams contains all the parameters to send to the API endpoint
+for the fix data integrity operation typically these are written to a http.Request
+*/
+type FixDataIntegrityParams struct {
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithTimeout adds the timeout to the fix data integrity params
+func (o *FixDataIntegrityParams) WithTimeout(timeout time.Duration) *FixDataIntegrityParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the fix data integrity params
+func (o *FixDataIntegrityParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the fix data integrity params
+func (o *FixDataIntegrityParams) WithContext(ctx context.Context) *FixDataIntegrityParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the fix data integrity params
+func (o *FixDataIntegrityParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the fix data integrity params
+func (o *FixDataIntegrityParams) WithHTTPClient(client *http.Client) *FixDataIntegrityParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the fix data integrity params
+func (o *FixDataIntegrityParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *FixDataIntegrityParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
@@ -0,0 +1,132 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package database
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// FixDataIntegrityReader is a Reader for the FixDataIntegrity structure.
+type FixDataIntegrityReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *FixDataIntegrityReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewFixDataIntegrityOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 401:
+		result := NewFixDataIntegrityUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+
+	default:
+		return nil, runtime.NewAPIError("unknown error", response, response.Code())
+	}
+}
+
+// NewFixDataIntegrityOK creates a FixDataIntegrityOK with default headers values
+func NewFixDataIntegrityOK() *FixDataIntegrityOK {
+	return &FixDataIntegrityOK{}
+}
+
+/*FixDataIntegrityOK handles this case with default header values.
+
+A list of data integrity issues found
+*/
+type FixDataIntegrityOK struct {
+	Payload *rest_model.DataIntegrityCheckResultEnvelope
+}
+
+func (o *FixDataIntegrityOK) Error() string {
+	return fmt.Sprintf("[POST /database/fix-data-integrity][%d] fixDataIntegrityOK  %+v", 200, o.Payload)
+}
+
+func (o *FixDataIntegrityOK) GetPayload() *rest_model.DataIntegrityCheckResultEnvelope {
+	return o.Payload
+}
+
+func (o *FixDataIntegrityOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.DataIntegrityCheckResultEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewFixDataIntegrityUnauthorized creates a FixDataIntegrityUnauthorized with default headers values
+func NewFixDataIntegrityUnauthorized() *FixDataIntegrityUnauthorized {
+	return &FixDataIntegrityUnauthorized{}
+}
+
+/*FixDataIntegrityUnauthorized handles this case with default header values.
+
+The currently supplied session does not have the correct access rights to request this resource
+*/
+type FixDataIntegrityUnauthorized struct {
+	Payload *rest_model.APIErrorEnvelope
+}
+
+func (o *FixDataIntegrityUnauthorized) Error() string {
+	return fmt.Sprintf("[POST /database/fix-data-integrity][%d] fixDataIntegrityUnauthorized  %+v", 401, o.Payload)
+}
+
+func (o *FixDataIntegrityUnauthorized) GetPayload() *rest_model.APIErrorEnvelope {
+	return o.Payload
+}
+
+func (o *FixDataIntegrityUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.APIErrorEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
@@ -0,0 +1,105 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package rest_model
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+	"github.com/go-openapi/validate"
+)
+
+// DataIntegrityCheckDetail data integrity check detail
+//
+// swagger:model dataIntegrityCheckDetail
+type DataIntegrityCheckDetail struct {
+
+	// description
+	// Required: true
+	Description *string `json:"description"`
+
+	// fixed
+	// Required: true
+	Fixed *bool `json:"fixed"`
+}
+
+// Validate validates this data integrity check detail
+func (m *DataIntegrityCheckDetail) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.validateDescription(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.validateFixed(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *DataIntegrityCheckDetail) validateDescription(formats strfmt.Registry) error {
+
+	if err := validate.Required("description", "body", m.Description); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (m *DataIntegrityCheckDetail) validateFixed(formats strfmt.Registry) error {
+
+	if err := validate.Required("fixed", "body", m.Fixed); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (m *DataIntegrityCheckDetail) MarshalBinary() ([]byte, error) {
+	if m == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(m)
+}
+
+// UnmarshalBinary interface implementation
+func (m *DataIntegrityCheckDetail) UnmarshalBinary(b []byte) error {
+	var res DataIntegrityCheckDetail
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*m = res
+	return nil
+}
@@ -0,0 +1,69 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package rest_model
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"strconv"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// DataIntegrityCheckDetailList data integrity check detail list
+//
+// swagger:model dataIntegrityCheckDetailList
+type DataIntegrityCheckDetailList []*DataIntegrityCheckDetail
+
+// Validate validates this data integrity check detail list
+func (m DataIntegrityCheckDetailList) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	for i := 0; i < len(m); i++ {
+		if swag.IsZero(m[i]) { // not required
+			continue
+		}
+
+		if m[i] != nil {
+			if err := m[i].Validate(formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName(strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
@@ -0,0 +1,121 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package rest_model
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+	"github.com/go-openapi/validate"
+)
+
+// DataIntegrityCheckResultEnvelope data integrity check result envelope
+//
+// swagger:model dataIntegrityCheckResultEnvelope
+type DataIntegrityCheckResultEnvelope struct {
+
+	// data
+	// Required: true
+	Data DataIntegrityCheckDetailList `json:"data"`
+
+	// meta
+	// Required: true
+	Meta *Meta `json:"meta"`
+}
+
+// Validate validates this data integrity check result envelope
+func (m *DataIntegrityCheckResultEnvelope) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.validateData(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.validateMeta(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *DataIntegrityCheckResultEnvelope) validateData(formats strfmt.Registry) error {
+
+	if err := validate.Required("data", "body", m.Data); err != nil {
+		return err
+	}
+
+	if err := m.Data.Validate(formats); err != nil {
+		if ve, ok := err.(*errors.Validation); ok {
+			return ve.ValidateName("data")
+		}
+		return err
+	}
+
+	return nil
+}
+
+func (m *DataIntegrityCheckResultEnvelope) validateMeta(formats strfmt.Registry) error {
+
+	if err := validate.Required("meta", "body", m.Meta); err != nil {
+		return err
+	}
+
+	if m.Meta != nil {
+		if err := m.Meta.Validate(formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("meta")
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (m *DataIntegrityCheckResultEnvelope) MarshalBinary() ([]byte, error) {
+	if m == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(m)
+}
+
+// UnmarshalBinary interface implementation
+func (m *DataIntegrityCheckResultEnvelope) UnmarshalBinary(b []byte) error {
+	var res DataIntegrityCheckResultEnvelope
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*m = res
+	return nil
+}
@@ -129,6 +129,11 @@ func configureAPI(api *operations.ZitiEdgeAPI) http.Handler {
 			return middleware.NotImplemented("operation authentication.Authenticate has not yet been implemented")
 		})
 	}
+	if api.DatabaseCheckDataIntegrityHandler == nil {
+		api.DatabaseCheckDataIntegrityHandler = database.CheckDataIntegrityHandlerFunc(func(params database.CheckDataIntegrityParams, principal interface{}) middleware.Responder {
+			return middleware.NotImplemented("operation database.CheckDataIntegrity has not yet been implemented")
+		})
+	}
 	if api.AuthenticatorCreateAuthenticatorHandler == nil {
 		api.AuthenticatorCreateAuthenticatorHandler = authenticator.CreateAuthenticatorHandlerFunc(func(params authenticator.CreateAuthenticatorParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation authenticator.CreateAuthenticator has not yet been implemented")
@@ -409,6 +414,11 @@ func configureAPI(api *operations.ZitiEdgeAPI) http.Handler {
 			return middleware.NotImplemented("operation enroll.ErnollUpdb has not yet been implemented")
 		})
 	}
+	if api.DatabaseFixDataIntegrityHandler == nil {
+		api.DatabaseFixDataIntegrityHandler = database.FixDataIntegrityHandlerFunc(func(params database.FixDataIntegrityParams, principal interface{}) middleware.Responder {
+			return middleware.NotImplemented("operation database.FixDataIntegrity has not yet been implemented")
+		})
+	}
 	if api.CertificateAuthorityGetCaJwtHandler == nil {
 		api.CertificateAuthorityGetCaJwtHandler = certificate_authority.GetCaJwtHandlerFunc(func(params certificate_authority.GetCaJwtParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation certificate_authority.GetCaJwt has not yet been implemented")
@@ -1331,6 +1331,52 @@ func init() {
        }
      ]
    },
+    "/database/check-data-integrity": {
+      "get": {
+        "security": [
+          {
+            "ztSession": []
+          }
+        ],
+        "description": "Runs an data integrity scan on the datastore and returns any found issues. Requires admin access.",
+        "tags": [
+          "Database"
+        ],
+        "summary": "Runs an data integrity scan on the datastore and returns any found issues",
+        "operationId": "checkDataIntegrity",
+        "responses": {
+          "200": {
+            "$ref": "#/responses/dataIntegrityCheckResult"
+          },
+          "401": {
+            "$ref": "#/responses/unauthorizedResponse"
+          }
+        }
+      }
+    },
+    "/database/fix-data-integrity": {
+      "post": {
+        "security": [
+          {
+            "ztSession": []
+          }
+        ],
+        "description": "Runs an data integrity scan on the datastore, attempts to fix any issues it can, and returns any found issues. Requires admin access.",
+        "tags": [
+          "Database"
+        ],
+        "summary": "Runs an data integrity scan on the datastore, attempts to fix any issues it can and returns any found issues",
+        "operationId": "fixDataIntegrity",
+        "responses": {
+          "200": {
+            "$ref": "#/responses/dataIntegrityCheckResult"
+          },
+          "401": {
+            "$ref": "#/responses/unauthorizedResponse"
+          }
+        }
+      }
+    },
    "/database/snapshot": {
      "post": {
        "security": [
@@ -5340,6 +5386,42 @@ func init() {
        }
      }
    },
+    "dataIntegrityCheckDetail": {
+      "type": "object",
+      "required": [
+        "description",
+        "fixed"
+      ],
+      "properties": {
+        "description": {
+          "type": "string"
+        },
+        "fixed": {
+          "type": "boolean"
+        }
+      }
+    },
+    "dataIntegrityCheckDetailList": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/dataIntegrityCheckDetail"
+      }
+    },
+    "dataIntegrityCheckResultEnvelope": {
+      "type": "object",
+      "required": [
+        "meta",
+        "data"
+      ],
+      "properties": {
+        "data": {
+          "$ref": "#/definitions/dataIntegrityCheckDetailList"
+        },
+        "meta": {
+          "$ref": "#/definitions/meta"
+        }
+      }
+    },
    "detailAPISessionEnvelope": {
      "type": "object",
      "required": [
@@ -7860,6 +7942,12 @@ func init() {
        "$ref": "#/definitions/createEnvelope"
      }
    },
+    "dataIntegrityCheckResult": {
+      "description": "A list of data integrity issues found",
+      "schema": {
+        "$ref": "#/definitions/dataIntegrityCheckResultEnvelope"
+      }
+    },
    "deleteResponse": {
      "description": "The delete request was successful and the resource has been removed",
      "schema": {
@@ -11799,6 +11887,100 @@ func init() {
        }
      ]
    },
+    "/database/check-data-integrity": {
+      "get": {
+        "security": [
+          {
+            "ztSession": []
+          }
+        ],
+        "description": "Runs an data integrity scan on the datastore and returns any found issues. Requires admin access.",
+        "tags": [
+          "Database"
+        ],
+        "summary": "Runs an data integrity scan on the datastore and returns any found issues",
+        "operationId": "checkDataIntegrity",
+        "responses": {
+          "200": {
+            "description": "A list of data integrity issues found",
+            "schema": {
+              "$ref": "#/definitions/dataIntegrityCheckResultEnvelope"
+            }
+          },
+          "401": {
+            "description": "The currently supplied session does not have the correct access rights to request this resource",
+            "schema": {
+              "$ref": "#/definitions/apiErrorEnvelope"
+            },
+            "examples": {
+              "application/json": {
+                "error": {
+                  "args": {
+                    "urlVars": {}
+                  },
+                  "cause": "",
+                  "causeMessage": "",
+                  "code": "UNAUTHORIZED",
+                  "message": "The request could not be completed. The session is not authorized or the credentials are invalid",
+                  "requestId": "0bfe7a04-9229-4b7a-812c-9eb3cc0eac0f"
+                },
+                "meta": {
+                  "apiEnrolmentVersion": "0.0.1",
+                  "apiVersion": "0.0.1"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/database/fix-data-integrity": {
+      "post": {
+        "security": [
+          {
+            "ztSession": []
+          }
+        ],
+        "description": "Runs an data integrity scan on the datastore, attempts to fix any issues it can, and returns any found issues. Requires admin access.",
+        "tags": [
+          "Database"
+        ],
+        "summary": "Runs an data integrity scan on the datastore, attempts to fix any issues it can and returns any found issues",
+        "operationId": "fixDataIntegrity",
+        "responses": {
+          "200": {
+            "description": "A list of data integrity issues found",
+            "schema": {
+              "$ref": "#/definitions/dataIntegrityCheckResultEnvelope"
+            }
+          },
+          "401": {
+            "description": "The currently supplied session does not have the correct access rights to request this resource",
+            "schema": {
+              "$ref": "#/definitions/apiErrorEnvelope"
+            },
+            "examples": {
+              "application/json": {
+                "error": {
+                  "args": {
+                    "urlVars": {}
+                  },
+                  "cause": "",
+                  "causeMessage": "",
+                  "code": "UNAUTHORIZED",
+                  "message": "The request could not be completed. The session is not authorized or the credentials are invalid",
+                  "requestId": "0bfe7a04-9229-4b7a-812c-9eb3cc0eac0f"
+                },
+                "meta": {
+                  "apiEnrolmentVersion": "0.0.1",
+                  "apiVersion": "0.0.1"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
    "/database/snapshot": {
      "post": {
        "security": [
@@ -20989,6 +21171,42 @@ func init() {
        }
      }
    },
+    "dataIntegrityCheckDetail": {
+      "type": "object",
+      "required": [
+        "description",
+        "fixed"
+      ],
+      "properties": {
+        "description": {
+          "type": "string"
+        },
+        "fixed": {
+          "type": "boolean"
+        }
+      }
+    },
+    "dataIntegrityCheckDetailList": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/dataIntegrityCheckDetail"
+      }
+    },
+    "dataIntegrityCheckResultEnvelope": {
+      "type": "object",
+      "required": [
+        "meta",
+        "data"
+      ],
+      "properties": {
+        "data": {
+          "$ref": "#/definitions/dataIntegrityCheckDetailList"
+        },
+        "meta": {
+          "$ref": "#/definitions/meta"
+        }
+      }
+    },
    "detailAPISessionEnvelope": {
      "type": "object",
      "required": [
@@ -23510,6 +23728,12 @@ func init() {
        "$ref": "#/definitions/createEnvelope"
      }
    },
+    "dataIntegrityCheckResult": {
+      "description": "A list of data integrity issues found",
+      "schema": {
+        "$ref": "#/definitions/dataIntegrityCheckResultEnvelope"
+      }
+    },
    "deleteResponse": {
      "description": "The delete request was successful and the resource has been removed",
      "schema": {
@@ -0,0 +1,97 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package database
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime/middleware"
+)
+
+// CheckDataIntegrityHandlerFunc turns a function with the right signature into a check data integrity handler
+type CheckDataIntegrityHandlerFunc func(CheckDataIntegrityParams, interface{}) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn CheckDataIntegrityHandlerFunc) Handle(params CheckDataIntegrityParams, principal interface{}) middleware.Responder {
+	return fn(params, principal)
+}
+
+// CheckDataIntegrityHandler interface for that can handle valid check data integrity params
+type CheckDataIntegrityHandler interface {
+	Handle(CheckDataIntegrityParams, interface{}) middleware.Responder
+}
+
+// NewCheckDataIntegrity creates a new http.Handler for the check data integrity operation
+func NewCheckDataIntegrity(ctx *middleware.Context, handler CheckDataIntegrityHandler) *CheckDataIntegrity {
+	return &CheckDataIntegrity{Context: ctx, Handler: handler}
+}
+
+/*CheckDataIntegrity swagger:route GET /database/check-data-integrity Database checkDataIntegrity
+
+Runs an data integrity scan on the datastore and returns any found issues
+
+Runs an data integrity scan on the datastore and returns any found issues. Requires admin access.
+
+*/
+type CheckDataIntegrity struct {
+	Context *middleware.Context
+	Handler CheckDataIntegrityHandler
+}
+
+func (o *CheckDataIntegrity) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		r = rCtx
+	}
+	var Params = NewCheckDataIntegrityParams()
+
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		r = aCtx
+	}
+	var principal interface{}
+	if uprinc != nil {
+		principal = uprinc
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}
@@ -0,0 +1,69 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package database
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+)
+
+// NewCheckDataIntegrityParams creates a new CheckDataIntegrityParams object
+// no default values defined in spec.
+func NewCheckDataIntegrityParams() CheckDataIntegrityParams {
+
+	return CheckDataIntegrityParams{}
+}
+
+// CheckDataIntegrityParams contains all the bound params for the check data integrity operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters checkDataIntegrity
+type CheckDataIntegrityParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewCheckDataIntegrityParams() beforehand.
+func (o *CheckDataIntegrityParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
@@ -0,0 +1,126 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package database
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// CheckDataIntegrityOKCode is the HTTP code returned for type CheckDataIntegrityOK
+const CheckDataIntegrityOKCode int = 200
+
+/*CheckDataIntegrityOK A list of data integrity issues found
+
+swagger:response checkDataIntegrityOK
+*/
+type CheckDataIntegrityOK struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.DataIntegrityCheckResultEnvelope `json:"body,omitempty"`
+}
+
+// NewCheckDataIntegrityOK creates CheckDataIntegrityOK with default headers values
+func NewCheckDataIntegrityOK() *CheckDataIntegrityOK {
+
+	return &CheckDataIntegrityOK{}
+}
+
+// WithPayload adds the payload to the check data integrity o k response
+func (o *CheckDataIntegrityOK) WithPayload(payload *rest_model.DataIntegrityCheckResultEnvelope) *CheckDataIntegrityOK {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the check data integrity o k response
+func (o *CheckDataIntegrityOK) SetPayload(payload *rest_model.DataIntegrityCheckResultEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *CheckDataIntegrityOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(200)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// CheckDataIntegrityUnauthorizedCode is the HTTP code returned for type CheckDataIntegrityUnauthorized
+const CheckDataIntegrityUnauthorizedCode int = 401
+
+/*CheckDataIntegrityUnauthorized The currently supplied session does not have the correct access rights to request this resource
+
+swagger:response checkDataIntegrityUnauthorized
+*/
+type CheckDataIntegrityUnauthorized struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.APIErrorEnvelope `json:"body,omitempty"`
+}
+
+// NewCheckDataIntegrityUnauthorized creates CheckDataIntegrityUnauthorized with default headers values
+func NewCheckDataIntegrityUnauthorized() *CheckDataIntegrityUnauthorized {
+
+	return &CheckDataIntegrityUnauthorized{}
+}
+
+// WithPayload adds the payload to the check data integrity unauthorized response
+func (o *CheckDataIntegrityUnauthorized) WithPayload(payload *rest_model.APIErrorEnvelope) *CheckDataIntegrityUnauthorized {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the check data integrity unauthorized response
+func (o *CheckDataIntegrityUnauthorized) SetPayload(payload *rest_model.APIErrorEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *CheckDataIntegrityUnauthorized) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(401)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
@@ -0,0 +1,111 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package database
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+)
+
+// CheckDataIntegrityURL generates an URL for the check data integrity operation
+type CheckDataIntegrityURL struct {
+	_basePath string
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *CheckDataIntegrityURL) WithBasePath(bp string) *CheckDataIntegrityURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *CheckDataIntegrityURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *CheckDataIntegrityURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/database/check-data-integrity"
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/edge/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *CheckDataIntegrityURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *CheckDataIntegrityURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *CheckDataIntegrityURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on CheckDataIntegrityURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on CheckDataIntegrityURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *CheckDataIntegrityURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}
@@ -0,0 +1,97 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package database
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime/middleware"
+)
+
+// FixDataIntegrityHandlerFunc turns a function with the right signature into a fix data integrity handler
+type FixDataIntegrityHandlerFunc func(FixDataIntegrityParams, interface{}) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn FixDataIntegrityHandlerFunc) Handle(params FixDataIntegrityParams, principal interface{}) middleware.Responder {
+	return fn(params, principal)
+}
+
+// FixDataIntegrityHandler interface for that can handle valid fix data integrity params
+type FixDataIntegrityHandler interface {
+	Handle(FixDataIntegrityParams, interface{}) middleware.Responder
+}
+
+// NewFixDataIntegrity creates a new http.Handler for the fix data integrity operation
+func NewFixDataIntegrity(ctx *middleware.Context, handler FixDataIntegrityHandler) *FixDataIntegrity {
+	return &FixDataIntegrity{Context: ctx, Handler: handler}
+}
+
+/*FixDataIntegrity swagger:route POST /database/fix-data-integrity Database fixDataIntegrity
+
+Runs an data integrity scan on the datastore, attempts to fix any issues it can and returns any found issues
+
+Runs an data integrity scan on the datastore, attempts to fix any issues it can, and returns any found issues. Requires admin access.
+
+*/
+type FixDataIntegrity struct {
+	Context *middleware.Context
+	Handler FixDataIntegrityHandler
+}
+
+func (o *FixDataIntegrity) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		r = rCtx
+	}
+	var Params = NewFixDataIntegrityParams()
+
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		r = aCtx
+	}
+	var principal interface{}
+	if uprinc != nil {
+		principal = uprinc
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}
@@ -0,0 +1,69 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package database
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+)
+
+// NewFixDataIntegrityParams creates a new FixDataIntegrityParams object
+// no default values defined in spec.
+func NewFixDataIntegrityParams() FixDataIntegrityParams {
+
+	return FixDataIntegrityParams{}
+}
+
+// FixDataIntegrityParams contains all the bound params for the fix data integrity operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters fixDataIntegrity
+type FixDataIntegrityParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewFixDataIntegrityParams() beforehand.
+func (o *FixDataIntegrityParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
@@ -0,0 +1,126 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package database
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// FixDataIntegrityOKCode is the HTTP code returned for type FixDataIntegrityOK
+const FixDataIntegrityOKCode int = 200
+
+/*FixDataIntegrityOK A list of data integrity issues found
+
+swagger:response fixDataIntegrityOK
+*/
+type FixDataIntegrityOK struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.DataIntegrityCheckResultEnvelope `json:"body,omitempty"`
+}
+
+// NewFixDataIntegrityOK creates FixDataIntegrityOK with default headers values
+func NewFixDataIntegrityOK() *FixDataIntegrityOK {
+
+	return &FixDataIntegrityOK{}
+}
+
+// WithPayload adds the payload to the fix data integrity o k response
+func (o *FixDataIntegrityOK) WithPayload(payload *rest_model.DataIntegrityCheckResultEnvelope) *FixDataIntegrityOK {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the fix data integrity o k response
+func (o *FixDataIntegrityOK) SetPayload(payload *rest_model.DataIntegrityCheckResultEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *FixDataIntegrityOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(200)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// FixDataIntegrityUnauthorizedCode is the HTTP code returned for type FixDataIntegrityUnauthorized
+const FixDataIntegrityUnauthorizedCode int = 401
+
+/*FixDataIntegrityUnauthorized The currently supplied session does not have the correct access rights to request this resource
+
+swagger:response fixDataIntegrityUnauthorized
+*/
+type FixDataIntegrityUnauthorized struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.APIErrorEnvelope `json:"body,omitempty"`
+}
+
+// NewFixDataIntegrityUnauthorized creates FixDataIntegrityUnauthorized with default headers values
+func NewFixDataIntegrityUnauthorized() *FixDataIntegrityUnauthorized {
+
+	return &FixDataIntegrityUnauthorized{}
+}
+
+// WithPayload adds the payload to the fix data integrity unauthorized response
+func (o *FixDataIntegrityUnauthorized) WithPayload(payload *rest_model.APIErrorEnvelope) *FixDataIntegrityUnauthorized {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the fix data integrity unauthorized response
+func (o *FixDataIntegrityUnauthorized) SetPayload(payload *rest_model.APIErrorEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *FixDataIntegrityUnauthorized) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(401)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
@@ -0,0 +1,111 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package database
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+)
+
+// FixDataIntegrityURL generates an URL for the fix data integrity operation
+type FixDataIntegrityURL struct {
+	_basePath string
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *FixDataIntegrityURL) WithBasePath(bp string) *FixDataIntegrityURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *FixDataIntegrityURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *FixDataIntegrityURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/database/fix-data-integrity"
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/edge/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *FixDataIntegrityURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *FixDataIntegrityURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *FixDataIntegrityURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on FixDataIntegrityURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on FixDataIntegrityURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *FixDataIntegrityURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}
@@ -120,6 +120,9 @@ func NewZitiEdgeAPI(spec *loads.Document) *ZitiEdgeAPI {
 		AuthenticationAuthenticateHandler: authentication.AuthenticateHandlerFunc(func(params authentication.AuthenticateParams) middleware.Responder {
 			return middleware.NotImplemented("operation authentication.Authenticate has not yet been implemented")
 		}),
+		DatabaseCheckDataIntegrityHandler: database.CheckDataIntegrityHandlerFunc(func(params database.CheckDataIntegrityParams, principal interface{}) middleware.Responder {
+			return middleware.NotImplemented("operation database.CheckDataIntegrity has not yet been implemented")
+		}),
 		AuthenticatorCreateAuthenticatorHandler: authenticator.CreateAuthenticatorHandlerFunc(func(params authenticator.CreateAuthenticatorParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation authenticator.CreateAuthenticator has not yet been implemented")
 		}),
@@ -288,6 +291,9 @@ func NewZitiEdgeAPI(spec *loads.Document) *ZitiEdgeAPI {
 		EnrollErnollUpdbHandler: enroll.ErnollUpdbHandlerFunc(func(params enroll.ErnollUpdbParams) middleware.Responder {
 			return middleware.NotImplemented("operation enroll.ErnollUpdb has not yet been implemented")
 		}),
+		DatabaseFixDataIntegrityHandler: database.FixDataIntegrityHandlerFunc(func(params database.FixDataIntegrityParams, principal interface{}) middleware.Responder {
+			return middleware.NotImplemented("operation database.FixDataIntegrity has not yet been implemented")
+		}),
 		CertificateAuthorityGetCaJwtHandler: certificate_authority.GetCaJwtHandlerFunc(func(params certificate_authority.GetCaJwtParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation certificate_authority.GetCaJwt has not yet been implemented")
 		}),
@@ -602,6 +608,8 @@ type ZitiEdgeAPI struct {
 	IdentityAssociateIdentitysServiceConfigsHandler identity.AssociateIdentitysServiceConfigsHandler
 	// AuthenticationAuthenticateHandler sets the operation handler for the authenticate operation
 	AuthenticationAuthenticateHandler authentication.AuthenticateHandler
+	// DatabaseCheckDataIntegrityHandler sets the operation handler for the check data integrity operation
+	DatabaseCheckDataIntegrityHandler database.CheckDataIntegrityHandler
 	// AuthenticatorCreateAuthenticatorHandler sets the operation handler for the create authenticator operation
 	AuthenticatorCreateAuthenticatorHandler authenticator.CreateAuthenticatorHandler
 	// CertificateAuthorityCreateCaHandler sets the operation handler for the create ca operation
@@ -714,6 +722,8 @@ type ZitiEdgeAPI struct {
 	EnrollEnrollOttCaHandler enroll.EnrollOttCaHandler
 	// EnrollErnollUpdbHandler sets the operation handler for the ernoll updb operation
 	EnrollErnollUpdbHandler enroll.ErnollUpdbHandler
+	// DatabaseFixDataIntegrityHandler sets the operation handler for the fix data integrity operation
+	DatabaseFixDataIntegrityHandler database.FixDataIntegrityHandler
 	// CertificateAuthorityGetCaJwtHandler sets the operation handler for the get ca jwt operation
 	CertificateAuthorityGetCaJwtHandler certificate_authority.GetCaJwtHandler
 	// CurrentAPISessionGetCurrentAPISessionHandler sets the operation handler for the get current API session operation
@@ -975,6 +985,9 @@ func (o *ZitiEdgeAPI) Validate() error {
 	if o.AuthenticationAuthenticateHandler == nil {
 		unregistered = append(unregistered, "authentication.AuthenticateHandler")
 	}
+	if o.DatabaseCheckDataIntegrityHandler == nil {
+		unregistered = append(unregistered, "database.CheckDataIntegrityHandler")
+	}
 	if o.AuthenticatorCreateAuthenticatorHandler == nil {
 		unregistered = append(unregistered, "authenticator.CreateAuthenticatorHandler")
 	}
@@ -1143,6 +1156,9 @@ func (o *ZitiEdgeAPI) Validate() error {
 	if o.EnrollErnollUpdbHandler == nil {
 		unregistered = append(unregistered, "enroll.ErnollUpdbHandler")
 	}
+	if o.DatabaseFixDataIntegrityHandler == nil {
+		unregistered = append(unregistered, "database.FixDataIntegrityHandler")
+	}
 	if o.CertificateAuthorityGetCaJwtHandler == nil {
 		unregistered = append(unregistered, "certificate_authority.GetCaJwtHandler")
 	}
@@ -1505,6 +1521,10 @@ func (o *ZitiEdgeAPI) initHandlerCache() {
 		o.handlers["POST"] = make(map[string]http.Handler)
 	}
 	o.handlers["POST"]["/authenticate"] = authentication.NewAuthenticate(o.context, o.AuthenticationAuthenticateHandler)
+	if o.handlers["GET"] == nil {
+		o.handlers["GET"] = make(map[string]http.Handler)
+	}
+	o.handlers["GET"]["/database/check-data-integrity"] = database.NewCheckDataIntegrity(o.context, o.DatabaseCheckDataIntegrityHandler)
 	if o.handlers["POST"] == nil {
 		o.handlers["POST"] = make(map[string]http.Handler)
 	}
@@ -1729,6 +1749,10 @@ func (o *ZitiEdgeAPI) initHandlerCache() {
 		o.handlers["POST"] = make(map[string]http.Handler)
 	}
 	o.handlers["POST"]["/enroll/updb"] = enroll.NewErnollUpdb(o.context, o.EnrollErnollUpdbHandler)
+	if o.handlers["POST"] == nil {
+		o.handlers["POST"] = make(map[string]http.Handler)
+	}
+	o.handlers["POST"]["/database/fix-data-integrity"] = database.NewFixDataIntegrity(o.context, o.DatabaseFixDataIntegrityHandler)
 	if o.handlers["GET"] == nil {
 		o.handlers["GET"] = make(map[string]http.Handler)
 	}
@@ -2913,6 +2913,34 @@ paths:
          $ref: '#/responses/unauthorizedResponse'
        '429':
          $ref: '#/responses/rateLimitedResponse'
+  /database/check-data-integrity:
+    get:
+      summary: Runs an data integrity scan on the datastore and returns any found issues
+      description: Runs an data integrity scan on the datastore and returns any found issues. Requires admin access.
+      security:
+        - ztSession: []
+      tags:
+        - Database
+      operationId: checkDataIntegrity
+      responses:
+        '200':
+          $ref: '#/responses/dataIntegrityCheckResult'
+        '401':
+          $ref: '#/responses/unauthorizedResponse'
+  /database/fix-data-integrity:
+    post:
+      summary: Runs an data integrity scan on the datastore, attempts to fix any issues it can and returns any found issues
+      description: Runs an data integrity scan on the datastore, attempts to fix any issues it can, and returns any found issues. Requires admin access.
+      security:
+        - ztSession: []
+      tags:
+        - Database
+      operationId: fixDataIntegrity
+      responses:
+        '200':
+          $ref: '#/responses/dataIntegrityCheckResult'
+        '401':
+          $ref: '#/responses/unauthorizedResponse'

 #######################################################################################################################
 #
@@ -3457,6 +3485,14 @@ responses:
    schema:
      $ref: '#/definitions/detailTransitRouterEnvelope'

+  ###################################################################
+  # Datastore
+  ##################################################################
+  dataIntegrityCheckResult:
+    description: A list of data integrity issues found
+    schema:
+      $ref: '#/definitions/dataIntegrityCheckResultEnvelope'
+
 #######################################################################################################################
 #
 # Definitions - In & Out Models Only
@@ -5685,4 +5721,27 @@ definitions:
      - required
      - failed

-
+  dataIntegrityCheckResultEnvelope:
+    type: object
+    required:
+      - meta
+      - data
+    properties:
+      meta:
+        $ref: '#/definitions/meta'
+      data:
+        $ref: '#/definitions/dataIntegrityCheckDetailList'
+  dataIntegrityCheckDetailList:
+    type: array
+    items:
+      $ref: '#/definitions/dataIntegrityCheckDetail'
+  dataIntegrityCheckDetail:
+    type: object
+    required:
+      - description
+      - fixed
+    properties:
+      description:
+        type: string
+      fixed:
+        type: boolean