@opusdns/api 1.15.0 → 1.17.0

package/src/openapi.yaml

@@ -2146,6 +2146,67 @@ components:
       - EUR
       title: Currency
       type: string
+    CustomRoleCreate:
+      description: Request body for creating a custom role.
+      properties:
+        description:
+          anyOf:
+          - type: string
+          - type: 'null'
+          description: Description of the custom role.
+          title: Description
+        name:
+          description: Display name of the custom role as provided by the user (e.g.
+            'Support Staff').
+          maxLength: 64
+          minLength: 1
+          title: Name
+          type: string
+        permissions:
+          description: Permissions the role grants, as `resource:scope` (e.g. `domains:read`).
+            The escalation-bearing admin/owner permissions cannot be granted.
+          items:
+            $ref: '#/components/schemas/PublicPermission'
+          title: Permissions
+          type: array
+      required:
+      - name
+      - permissions
+      title: CustomRoleCreate
+      type: object
+    CustomRoleLabel:
+      type: string
+    CustomRoleUpdate:
+      description: 'Request body for updating a custom role. Omitted fields are left
+        unchanged; `permissions`
+
+        is a full replacement set when provided.'
+      properties:
+        description:
+          anyOf:
+          - type: string
+          - type: 'null'
+          description: New description.
+          title: Description
+        name:
+          anyOf:
+          - maxLength: 64
+            minLength: 1
+            type: string
+          - type: 'null'
+          description: New display name.
+          title: Name
+        permissions:
+          anyOf:
+          - items:
+              $ref: '#/components/schemas/PublicPermission'
+            type: array
+          - type: 'null'
+          description: Full replacement set of `resource:scope` permissions the role
+            grants.
+          title: Permissions
+      title: CustomRoleUpdate
+      type: object
     DeletePolicyType:
       enum:
       - immediate
@@ -9929,6 +9990,7 @@ components:
       type: object
     PublicResource:
       enum:
+      - organization
       - domains
       - contacts
       - dns
@@ -9962,7 +10024,9 @@ components:
         role:
           anyOf:
           - $ref: '#/components/schemas/PublicRole'
+          - $ref: '#/components/schemas/CustomRoleLabel'
           - type: 'null'
+          title: Role
       title: PublicRoleAssignment
       type: object
     PublicRoleAssignmentRequest:
@@ -9970,9 +10034,60 @@ components:
         role:
           anyOf:
           - $ref: '#/components/schemas/AssignablePublicRole'
+          - $ref: '#/components/schemas/CustomRoleLabel'
           - type: 'null'
+          title: Role
       title: PublicRoleAssignmentRequest
       type: object
+    PublicRoleDefinition:
+      description: "A role as listed/read through the public API \u2014 built-in or\
+        \ custom."
+      properties:
+        built_in:
+          description: Built-in roles are immutable; custom roles are organization-owned.
+          title: Built In
+          type: boolean
+        created_on:
+          anyOf:
+          - format: date-time
+            type: string
+          - type: 'null'
+          description: Creation time (custom roles only).
+          title: Created On
+        description:
+          anyOf:
+          - type: string
+          - type: 'null'
+          description: Description of the role.
+          title: Description
+        label:
+          $ref: '#/components/schemas/CustomRoleLabel'
+          description: Per-organization unique identifier (snake_case, e.g. 'support_staff').
+            Used as the URL path parameter.
+        name:
+          description: Display name of the role (e.g. 'Support Staff').
+          title: Name
+          type: string
+        permissions:
+          description: Permissions the role grants, as `resource:scope` strings.
+          items:
+            $ref: '#/components/schemas/PublicPermission'
+          title: Permissions
+          type: array
+        updated_on:
+          anyOf:
+          - format: date-time
+            type: string
+          - type: 'null'
+          description: Last update time (custom roles only).
+          title: Updated On
+      required:
+      - label
+      - name
+      - built_in
+      - permissions
+      title: PublicRoleDefinition
+      type: object
     PublicScope:
       enum:
       - read
@@ -11567,7 +11682,9 @@ components:
         role:
           anyOf:
           - $ref: '#/components/schemas/PublicRole'
+          - $ref: '#/components/schemas/CustomRoleLabel'
           - type: 'null'
+          title: Role
         status:
           $ref: '#/components/schemas/UserStatus'
           readOnly: true
@@ -11771,7 +11888,9 @@ components:
         role:
           anyOf:
           - $ref: '#/components/schemas/PublicRole'
+          - $ref: '#/components/schemas/CustomRoleLabel'
           - type: 'null'
+          title: Role
         status:
           $ref: '#/components/schemas/UserStatus'
           readOnly: true
@@ -12142,7 +12261,7 @@ info:
     \n\n"
   summary: OpusDNS - your gateway to a seamless domain management experience.
   title: OpusDNS API
-  version: 2026-06-15-085110
+  version: 2026-06-16-093305
   x-logo:
     altText: OpusDNS API Reference
     url: https://d24lr4zqs1tgqh.cloudfront.net/c9505a20-5ae1-406c-b060-d392569caebf.jpg
@@ -24394,6 +24513,402 @@ paths:
       summary: Update an IP restriction
       tags:
       - organization
+  /v1/organizations/role-permissions:
+    get:
+      description: Retrieves the catalog of `resource:scope` permissions a custom
+        role may grant
+      operationId: list_role_permissions_v1_organizations_role_permissions_get
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PublicPermissionSet'
+          description: Successful Response
+        '401':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_AUTHENTICATION
+                detail: Additional error context.
+                status: 401
+                title: Authentication Error
+                type: authentication
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Unauthorized
+        '403':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_PERMISSION_DENIED
+                detail: Insufficient permissions to perform this action
+                status: 403
+                title: Permission Denied
+                type: permission-denied
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Forbidden
+        '422':
+          content:
+            application/problem+json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: List grantable role permissions
+      tags:
+      - organization
+  /v1/organizations/roles:
+    get:
+      description: 'Retrieves all roles assignable in the current organization: the
+        built-in roles plus the organization''s custom roles'
+      operationId: list_roles_v1_organizations_roles_get
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: '#/components/schemas/PublicRoleDefinition'
+                title: Response List Roles V1 Organizations Roles Get
+                type: array
+          description: Successful Response
+        '401':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_AUTHENTICATION
+                detail: Additional error context.
+                status: 401
+                title: Authentication Error
+                type: authentication
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Unauthorized
+        '403':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_PERMISSION_DENIED
+                detail: Insufficient permissions to perform this action
+                status: 403
+                title: Permission Denied
+                type: permission-denied
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Forbidden
+        '422':
+          content:
+            application/problem+json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: List roles
+      tags:
+      - organization
+    post:
+      description: Creates an organization-owned custom role granting the requested
+        permissions. The escalation-bearing admin/owner permissions cannot be granted.
+      operationId: create_role_v1_organizations_roles_post
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CustomRoleCreate'
+        required: true
+      responses:
+        '201':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PublicRoleDefinition'
+          description: Successful Response
+        '401':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_AUTHENTICATION
+                detail: Additional error context.
+                status: 401
+                title: Authentication Error
+                type: authentication
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Unauthorized
+        '403':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_PERMISSION_DENIED
+                detail: Insufficient permissions to perform this action
+                status: 403
+                title: Permission Denied
+                type: permission-denied
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Forbidden
+        '409':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_DUPLICATE_ROLE_NAME
+                detail: A role named 'support' already exists in this organization
+                status: 409
+                title: Role Management Error
+                type: duplicate-role-name
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Conflict
+        '422':
+          content:
+            application/problem+json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: Create a custom role
+      tags:
+      - organization
+  /v1/organizations/roles/{label}:
+    delete:
+      description: Deletes a custom role. Refused while the role is still assigned
+        to any subject, and for built-in roles.
+      operationId: delete_role_v1_organizations_roles__label__delete
+      parameters:
+      - in: path
+        name: label
+        required: true
+        schema:
+          title: Label
+          type: string
+      responses:
+        '204':
+          description: Successful Response
+        '401':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_AUTHENTICATION
+                detail: Additional error context.
+                status: 401
+                title: Authentication Error
+                type: authentication
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Unauthorized
+        '403':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_PERMISSION_DENIED
+                detail: Insufficient permissions to perform this action
+                status: 403
+                title: Permission Denied
+                type: permission-denied
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Forbidden
+        '404':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_ROLE_NOT_FOUND
+                detail: Role not found
+                role_name: support
+                status: 404
+                title: Role Management Error
+                type: role-not-found
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Not Found
+        '409':
+          content:
+            application/problem+json:
+              example:
+                binding_count: 1
+                code: ERROR_ROLE_IN_USE
+                detail: Role is still assigned to one or more subjects and cannot
+                  be deleted
+                role_name: support
+                status: 409
+                title: Role Management Error
+                type: role-in-use
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Conflict
+        '422':
+          content:
+            application/problem+json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: Delete a custom role
+      tags:
+      - organization
+    get:
+      description: Retrieves a single role (built-in or custom) by its name
+      operationId: get_role_v1_organizations_roles__label__get
+      parameters:
+      - in: path
+        name: label
+        required: true
+        schema:
+          title: Label
+          type: string
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PublicRoleDefinition'
+          description: Successful Response
+        '401':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_AUTHENTICATION
+                detail: Additional error context.
+                status: 401
+                title: Authentication Error
+                type: authentication
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Unauthorized
+        '403':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_PERMISSION_DENIED
+                detail: Insufficient permissions to perform this action
+                status: 403
+                title: Permission Denied
+                type: permission-denied
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Forbidden
+        '404':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_ROLE_NOT_FOUND
+                detail: Role not found
+                role_name: support
+                status: 404
+                title: Role Management Error
+                type: role-not-found
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Not Found
+        '422':
+          content:
+            application/problem+json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: Get a role
+      tags:
+      - organization
+    patch:
+      description: Updates a custom role's name, description and/or permission set.
+        Permission changes apply to every subject holding the role instantly. Built-in
+        roles are immutable.
+      operationId: update_role_v1_organizations_roles__label__patch
+      parameters:
+      - in: path
+        name: label
+        required: true
+        schema:
+          title: Label
+          type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CustomRoleUpdate'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PublicRoleDefinition'
+          description: Successful Response
+        '401':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_AUTHENTICATION
+                detail: Additional error context.
+                status: 401
+                title: Authentication Error
+                type: authentication
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Unauthorized
+        '403':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_PERMISSION_DENIED
+                detail: Insufficient permissions to perform this action
+                status: 403
+                title: Permission Denied
+                type: permission-denied
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Forbidden
+        '404':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_ROLE_NOT_FOUND
+                detail: Role not found
+                role_name: support
+                status: 404
+                title: Role Management Error
+                type: role-not-found
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Not Found
+        '409':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_BUILT_IN_ROLE_IMMUTABLE
+                detail: Built-in roles cannot be modified or deleted
+                role_name: viewer
+                status: 409
+                title: Role Management Error
+                type: built-in-role-immutable
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Conflict
+        '422':
+          content:
+            application/problem+json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+          description: Validation Error
+      security:
+      - OAuth2PasswordBearer: []
+      - APIKeyHeader: []
+      summary: Update a custom role
+      tags:
+      - organization
   /v1/organizations/users:
     get:
       description: Retrieves a paginated list of users under the current organization
@@ -26613,7 +27128,8 @@ paths:
       x-required-permissions:
       - users:read
     put:
-      description: Set the role for a user, replacing any existing role
+      description: Set the role for a user, replacing any existing role. Accepts a
+        built-in role name or the label of a custom role owned by the user's organization
       operationId: set_user_role_v1_users__user_id__role_put
       parameters:
       - in: path
@@ -26652,6 +27168,19 @@ paths:
               schema:
                 $ref: '#/components/schemas/Problem'
           description: Forbidden
+        '404':
+          content:
+            application/problem+json:
+              example:
+                code: ERROR_ROLE_NOT_FOUND
+                detail: Role not found
+                role_name: support_staff
+                status: 404
+                title: Role Management Error
+                type: role-not-found
+              schema:
+                $ref: '#/components/schemas/Problem'
+          description: Not Found
         '422':
           content:
             application/problem+json: