infrawrench-sdk 1.15.0 → 1.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9e38a098383f11fdb35de83cb2014267146a3689c00f7b84da86b2c994a01ce1
-  data.tar.gz: aaba5e6be92f922ca34f0436611e30ec26cebb13687d0d454e3f1e987f3fe4f4
+  metadata.gz: ed2bbb041647f781da0b26a0d376c2cedcf6a4904aa085405ee8c7bd5d477de9
+  data.tar.gz: fc6adc2c9b7edd3188848c118b52f322ce2e54bd1d613fc927cc718401759df8
 SHA512:
-  metadata.gz: e9371a9e34e0adac31a39ea733dd10c50ffea1b4704726ae163bde10ca694e9cb666412fa48824501a32256098f165c3ada273fcccf0b90fc91851ef32211110
-  data.tar.gz: 65dd789443a52e1bb9368eec4dc7e92db2117850ad45e17645ed0e82f7d1a3367610eff61e92e05aa5c223fb62b493bc15cd2f6b08197a2bd5259a9d018799ec
+  metadata.gz: cfa7d9ba7d12d044aca5221751c60b316d4ac51133f6c17967417deaea411f688dafbce45af8c18836fd421cf9f1469b1972eb068c5fb085501efb3f7d14ff62
+  data.tar.gz: 1eb649eb2e24e58172ec86e6b84a4d90c2c8739bb7d01804defc426845bc566261a69f241f9b6af1cc7db1ea4ee888274ff2415a645c50efcc441d068962cc9d

data/README.md

@@ -1,6 +1,6 @@
 # infrawrench-sdk
 
-Generated Ruby client for the Infrawrench API (API version `1.15.0`).
+Generated Ruby client for the Infrawrench API (API version `1.16.0`).
 
 **Do not edit this gem by hand** — it is regenerated from `openapi.json` and is
 not checked into the repository. Run
@@ -41,7 +41,7 @@ Every method takes an optional trailing `request_options:` hash (`:headers`,
 Responses are the plain `Hash`/`Array` that `JSON.parse` returns, with String
 keys spelled exactly as the wire spells them. There are no model classes — see
 [`sig/infrawrench/sdk.rbs`](./sig/infrawrench/sdk.rbs) for the shape of every one of the
-586 schemas, as RBS type aliases that steep and TypeProf can read.
+596 schemas, as RBS type aliases that steep and TypeProf can read.
 
 Non-2xx responses raise `Infrawrench::ApiError`, which carries `#status`,
 the parsed `#body`, and the machine-readable `#code` when the API sends one —

data/infrawrench-sdk.gemspec

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.15.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.16.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.15.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.16.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk
@@ -17,8 +17,8 @@ require_relative "lib/infrawrench/version"
 Gem::Specification.new do |spec|
   spec.name = "infrawrench-sdk"
   spec.version = Infrawrench::VERSION
-  spec.summary = "Generated Ruby client for the Infrawrench API (v1.15.0)."
-  spec.description = "Generated Ruby client for the Infrawrench API (v1.15.0). Covers the published API surface only — operations marked x-internal in the spec are not generated. No runtime dependencies."
+  spec.summary = "Generated Ruby client for the Infrawrench API (v1.16.0)."
+  spec.description = "Generated Ruby client for the Infrawrench API (v1.16.0). Covers the published API surface only — operations marked x-internal in the spec are not generated. No runtime dependencies."
   spec.authors = ["Infrawrench LLC", "Astrid Gealer"]
   spec.email = ["astrid@infrawrench.com"]
   spec.homepage = "https://infrawrench.com/docs/team-and-billing/client-sdks"

data/lib/infrawrench/client.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.15.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.16.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.15.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.16.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk
@@ -246,6 +246,173 @@ module Infrawrench
     end
   end
 
+  # `client.access_review.dismissals`
+  class AccessReviewDismissalsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Dismiss an access review finding
+    #
+    # Accept a finding — that break-glass role really is meant to be admin, that
+    # shared key really is rotated out of band. The finding leaves `findings`
+    # and stops feeding the security alerts, but the rule keeps being evaluated
+    # and the finding is reported back under `dismissed` for as long as it still
+    # matches. The principal itself stays in `principals` either way.
+    # Idempotent: dismissing an already-dismissed finding rewrites the note and
+    # the author.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/access-review/dismissals
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `AccessReviewDismissalCreate`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `AccessReviewDismissal` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/access-review/dismissals",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Restore a dismissed access review finding
+    #
+    # Undo a dismissal, putting the finding back on the list and back into the
+    # security alerts. The finding is identified by query parameters rather than
+    # path segments because resource ids are provider-native and routinely
+    # contain slashes.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # DELETE /api/org/{orgId}/access-review/dismissals
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param resource_id [String] Infrawrench resource id the finding is on.
+    # @param rule_id [String] Which rule was raised. Half of a dismissal's key, alongside the
+    #   resource id. The `access-review:` prefix is reserved so these can share the posture
+    #   dismissal store without colliding with plugin-declared posture rule ids.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [nil] This endpoint returns no content.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(resource_id:, rule_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/access-review/dismissals",
+        path_params: { "orgId" => org_id },
+        query: { "resourceId" => resource_id, "ruleId" => rule_id },
+        accept: :empty,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.access_review`
+  class AccessReviewNamespace
+    # @return [AccessReviewDismissalsNamespace] `client.access_review.dismissals`
+    attr_reader :dismissals
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @dismissals = AccessReviewDismissalsNamespace.new(@transport)
+    end
+
+    # Export the access review as compliance evidence
+    #
+    # The same review as a downloadable file, one row per finding. `format=csv`
+    # (the default) returns RFC 4180 CSV with every cell quoted and spreadsheet
+    # formulas neutralised; `format=json` returns the full response body
+    # pretty-printed.
+    #
+    # Dismissed findings are included and labelled in both formats, with the
+    # note and the person who accepted them: an evidence pack answers what you
+    # found *and* what you decided. Exports are recorded in the audit log.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/access-review/export
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param format [String, nil] Defaults to "csv".
+    # @param stale_days [Integer, nil] Staleness window in days. Defaults to 90.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `AccessReviewResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def export(org_id: nil, format: nil, stale_days: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/access-review/export",
+        path_params: { "orgId" => org_id },
+        query: { "format" => format, "staleDays" => stale_days },
+        request_options: request_options
+      )
+    end
+
+    # Review the principals inside your connected clouds
+    #
+    # Every IAM user and role, service account, app registration, group, role
+    # binding and long-lived API key your connected accounts have synced, with
+    # the findings that have evidence against them: unused beyond the staleness
+    # window, holding administrative or wildcard permissions, past the rotation
+    # budget their plugin declares, carrying no recorded owner, or signing in
+    # without a second factor.
+    #
+    # This is about principals in **your** clouds — it is neither your
+    # Infrawrench team's roles (`/team`) nor the credentials Infrawrench stores
+    # for you (`/credential-hygiene`).
+    #
+    # No provider API calls are made: everything is computed from already-synced
+    # fields, so a principal whose provider does not report last use is reported
+    # with `activity: "unknown"` and is never called stale. Findings the
+    # organization has dismissed are reported separately under `dismissed` and
+    # are excluded from `findings`, `counts`, `byRule` and the security alerts.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/access-review
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param stale_days [Integer, nil] Staleness window in days. Defaults to 90.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `AccessReviewResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, stale_days: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/access-review",
+        path_params: { "orgId" => org_id },
+        query: { "staleDays" => stale_days },
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.accounts.credentials`
   class AccountsCredentialsNamespace
     # @api private
@@ -13552,6 +13719,8 @@ module Infrawrench
     attr_reader :transport
     # @return [AccessRequestsNamespace] `client.access_requests`
     attr_reader :access_requests
+    # @return [AccessReviewNamespace] `client.access_review`
+    attr_reader :access_review
     # @return [AccountsNamespace] `client.accounts`
     attr_reader :accounts
     # @return [AgentsNamespace] `client.agents`
@@ -13723,6 +13892,7 @@ module Infrawrench
     def initialize(**options)
       @transport = Transport.new(**options)
       @access_requests = AccessRequestsNamespace.new(@transport)
+      @access_review = AccessReviewNamespace.new(@transport)
       @accounts = AccountsNamespace.new(@transport)
       @agents = AgentsNamespace.new(@transport)
       @alert_rules = AlertRulesNamespace.new(@transport)

data/lib/infrawrench/sdk.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.15.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.16.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.15.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.16.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk

data/lib/infrawrench/transport.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.15.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.16.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.15.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.16.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk

data/lib/infrawrench/version.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.15.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.16.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.15.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.16.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk
@@ -15,5 +15,5 @@
 # Kept in its own file so the gemspec can read the version without loading the
 # client — a gemspec that pulls in net/http is a gemspec that can fail to parse.
 module Infrawrench
-  VERSION = "1.15.0"
+  VERSION = "1.16.0"
 end

data/lib/infrawrench-sdk.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.15.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.16.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.15.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.16.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk

data/sig/infrawrench/sdk.rbs

@@ -1,7 +1,7 @@
-# infrawrench-sdk v1.15.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.16.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.15.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.16.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk
@@ -104,6 +104,57 @@ module Infrawrench
     ?"missing" => Array[String]
   }
 
+  # Spec schema: `AccessFinding`.
+  type access_finding = {
+    "resourceId" => String,
+    "ruleId" => "access-review:stale-principal"
+      | "access-review:admin-principal"
+      | "access-review:key-past-rotation"
+      | "access-review:no-recorded-owner"
+      | "access-review:no-mfa",
+    "title" => String,
+    "severity" => "critical" | "high" | "medium" | "low",
+    "reason" => String,
+    "principal" => access_principal
+  }
+
+  # Spec schema: `AccessPrincipal`.
+  type access_principal = {
+    "resourceId" => String,
+    "pluginId" => plugin_id,
+    "pluginName" => String,
+    "resourceTypeId" => String,
+    "resourceTypeName" => String,
+    "accountId" => String,
+    "accountName" => String,
+    "displayName" => String,
+    "externalId" => String | nil,
+    "role" => "user" | "group" | "role" | "service-account" | "key" | "binding",
+    "lastUsedAt" => String | nil,
+    "daysSinceLastUsed" => Integer | nil,
+    "activity" => "active" | "stale" | "unknown",
+    "createdAt" => String | nil,
+    "ageDays" => Integer | nil,
+    "admin" => bool | nil,
+    "mfa" => bool | nil,
+    "parent" => String | nil,
+    "owner" => access_principal_owner,
+    "revokeActionId" => String | nil
+  }
+
+  # Who owns the resource, from the resource-ownership record. Null when nobody
+  # is named.
+  #
+  # Spec schema: `AccessPrincipalOwner`.
+  type access_principal_owner = {
+      "userId" => String | nil,
+      "displayName" => String,
+      "isLabel" => bool,
+      "ticketUrl" => String | nil,
+      "purpose" => String | nil
+    }
+    | nil
+
   # Spec schema: `AccessRequest`.
   type access_request = {
     "id" => String,
@@ -137,6 +188,63 @@ module Infrawrench
   # Spec schema: `AccessRequestCreate`.
   type access_request_create = { "permissions" => Array[String], "reason" => String, "durationMinutes" => Integer }
 
+  # Spec schema: `AccessReviewDismissal`.
+  type access_review_dismissal = {
+    "resourceId" => String,
+    "ruleId" => String,
+    "dismissedAt" => String,
+    "dismissedBy" => String | nil,
+    "reason" => String | nil
+  }
+
+  # Spec schema: `AccessReviewDismissalCreate`.
+  type access_review_dismissal_create = {
+    "resourceId" => String,
+    "ruleId" => "access-review:stale-principal"
+      | "access-review:admin-principal"
+      | "access-review:key-past-rotation"
+      | "access-review:no-recorded-owner"
+      | "access-review:no-mfa",
+    ?"reason" => String | nil
+  }
+
+  # Spec schema: `AccessReviewResponse`.
+  type access_review_response = {
+    "principals" => Array[access_principal],
+    "findings" => Array[access_finding],
+    "totalCount" => Integer,
+    "counts" => access_review_severity_counts,
+    "byRule" => access_review_rule_counts,
+    "byRole" => access_review_role_counts,
+    "dismissed" => Array[dismissed_access_finding],
+    "dismissedCount" => Integer,
+    "unknownActivityCount" => Integer,
+    "staleDays" => Integer,
+    "generatedAt" => String
+  }
+
+  # Spec schema: `AccessReviewRoleCounts`.
+  type access_review_role_counts = {
+    "user" => Integer,
+    "group" => Integer,
+    "role" => Integer,
+    "service-account" => Integer,
+    "key" => Integer,
+    "binding" => Integer
+  }
+
+  # Spec schema: `AccessReviewRuleCounts`.
+  type access_review_rule_counts = {
+    "access-review:stale-principal" => Integer,
+    "access-review:admin-principal" => Integer,
+    "access-review:key-past-rotation" => Integer,
+    "access-review:no-recorded-owner" => Integer,
+    "access-review:no-mfa" => Integer
+  }
+
+  # Spec schema: `AccessReviewSeverityCounts`.
+  type access_review_severity_counts = { "critical" => Integer, "high" => Integer, "medium" => Integer, "low" => Integer }
+
   # Spec schema: `AccessRevokeConflict`.
   type access_revoke_conflict = { "error" => String }
 
@@ -2178,6 +2286,21 @@ module Infrawrench
   # Spec schema: `DigestTransportResult`.
   type digest_transport_result = { "attempted" => Integer, "succeeded" => Integer }
 
+  # Spec schema: `DismissedAccessFinding`.
+  type dismissed_access_finding = {
+    "resourceId" => String,
+    "ruleId" => "access-review:stale-principal"
+      | "access-review:admin-principal"
+      | "access-review:key-past-rotation"
+      | "access-review:no-recorded-owner"
+      | "access-review:no-mfa",
+    "title" => String,
+    "severity" => "critical" | "high" | "medium" | "low",
+    "reason" => String,
+    "principal" => access_principal,
+    "dismissal" => access_review_dismissal
+  }
+
   # Spec schema: `DismissedPostureFinding`.
   type dismissed_posture_finding = {
     "resourceId" => String,
@@ -5792,6 +5915,7 @@ module Infrawrench
       | "changes"
       | "expiring"
       | "posture"
+      | "access-review"
       | "dns"
       | "environment-diff"
       | "ssh-fanout"
@@ -6038,6 +6162,19 @@ module Infrawrench
     def withdraw: (request_id: String, ?org_id: String?, ?request_options: Hash[Symbol, untyped]?) -> ok
   end
 
+  class AccessReviewDismissalsNamespace
+    def initialize: (Transport) -> void
+    def create: (?org_id: String?, ?body: access_review_dismissal_create?, ?request_options: Hash[Symbol, untyped]?) -> access_review_dismissal
+    def delete: (resource_id: String, rule_id: "access-review:stale-principal" | "access-review:admin-principal" | "access-review:key-past-rotation" | "access-review:no-recorded-owner" | "access-review:no-mfa", ?org_id: String?, ?request_options: Hash[Symbol, untyped]?) -> nil
+  end
+
+  class AccessReviewNamespace
+    attr_reader dismissals: AccessReviewDismissalsNamespace
+    def initialize: (Transport) -> void
+    def export: (?org_id: String?, ?format: "csv" | "json"?, ?stale_days: Integer?, ?request_options: Hash[Symbol, untyped]?) -> access_review_response
+    def get: (?org_id: String?, ?stale_days: Integer?, ?request_options: Hash[Symbol, untyped]?) -> access_review_response
+  end
+
   class AccountsCredentialsNamespace
     def initialize: (Transport) -> void
     def get: (id: String, ?org_id: String?, ?request_options: Hash[Symbol, untyped]?) -> Hash[String, String]
@@ -7049,6 +7186,7 @@ module Infrawrench
   class APIV1Client
     attr_reader transport: Transport
     attr_reader access_requests: AccessRequestsNamespace
+    attr_reader access_review: AccessReviewNamespace
     attr_reader accounts: AccountsNamespace
     attr_reader agents: AgentsNamespace
     attr_reader alert_rules: AlertRulesNamespace

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: infrawrench-sdk
 version: !ruby/object:Gem::Version
-  version: 1.15.0
+  version: 1.16.0
 platform: ruby
 authors:
 - Infrawrench LLC
@@ -11,7 +11,7 @@ bindir: bin
 cert_chain: []
 date: 2026-08-12 00:00:00.000000000 Z
 dependencies: []
-description: Generated Ruby client for the Infrawrench API (v1.15.0). Covers the published
+description: Generated Ruby client for the Infrawrench API (v1.16.0). Covers the published
   API surface only — operations marked x-internal in the spec are not generated. No
   runtime dependencies.
 email:
@@ -58,5 +58,5 @@ requirements: []
 rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
-summary: Generated Ruby client for the Infrawrench API (v1.15.0).
+summary: Generated Ruby client for the Infrawrench API (v1.16.0).
 test_files: []