@willyim/idp 0.2.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +27 -0
- package/dist/src/api.d.ts +1 -1
- package/dist/src/api.d.ts.map +1 -1
- package/dist/src/schemas/index.d.ts +116 -0
- package/dist/src/schemas/index.d.ts.map +1 -1
- package/dist/src/schemas/index.js +85 -0
- package/dist/src/schemas/openapi.d.ts.map +1 -1
- package/dist/src/schemas/openapi.js +5 -4
- package/dist/src/schemas/operations.d.ts +205 -0
- package/dist/src/schemas/operations.d.ts.map +1 -1
- package/dist/src/schemas/operations.js +96 -1
- package/openapi/idp-api.json +1112 -16
- package/package.json +1 -1
package/openapi/idp-api.json
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
"info": {
|
|
4
4
|
"title": "willy.im IdP — Management API",
|
|
5
5
|
"version": "1.0.0",
|
|
6
|
-
"description": "Management API for the willy.im identity provider. Authenticate with `Authorization: Bearer <token>`. Two kinds of
|
|
6
|
+
"description": "Management API for the willy.im identity provider. Authenticate with `Authorization: Bearer <token>`. Two kinds of bearer, both `wim_` keys: IdP-level **admin keys** (every permission on every app, minted at `/api/v1/admin-keys`) and per-app **scoped keys** minted in the admin console (one app, a fixed permission set). The cross-app endpoints below require an admin key."
|
|
7
7
|
},
|
|
8
8
|
"servers": [
|
|
9
9
|
{
|
|
@@ -15,7 +15,7 @@
|
|
|
15
15
|
"bearerAuth": {
|
|
16
16
|
"type": "http",
|
|
17
17
|
"scheme": "bearer",
|
|
18
|
-
"description": "
|
|
18
|
+
"description": "An IdP-level admin key or a per-app scoped key (wim_…)."
|
|
19
19
|
}
|
|
20
20
|
}
|
|
21
21
|
},
|
|
@@ -23,7 +23,7 @@
|
|
|
23
23
|
"/api/v1/applications": {
|
|
24
24
|
"get": {
|
|
25
25
|
"summary": "List registered applications",
|
|
26
|
-
"description": "Requires
|
|
26
|
+
"description": "Requires an admin key.",
|
|
27
27
|
"security": [
|
|
28
28
|
{
|
|
29
29
|
"bearerAuth": []
|
|
@@ -67,6 +67,17 @@
|
|
|
67
67
|
],
|
|
68
68
|
"description": "Application key; consumer workspace claims are filtered by this"
|
|
69
69
|
},
|
|
70
|
+
"allowSignup": {
|
|
71
|
+
"type": "boolean",
|
|
72
|
+
"description": "Whether unknown users may sign themselves up"
|
|
73
|
+
},
|
|
74
|
+
"permissions": {
|
|
75
|
+
"type": "array",
|
|
76
|
+
"items": {
|
|
77
|
+
"type": "string"
|
|
78
|
+
},
|
|
79
|
+
"description": "The app's declared product-permission catalog"
|
|
80
|
+
},
|
|
70
81
|
"redirectUris": {
|
|
71
82
|
"type": "array",
|
|
72
83
|
"items": {
|
|
@@ -85,6 +96,8 @@
|
|
|
85
96
|
"clientId",
|
|
86
97
|
"name",
|
|
87
98
|
"app",
|
|
99
|
+
"allowSignup",
|
|
100
|
+
"permissions",
|
|
88
101
|
"redirectUris",
|
|
89
102
|
"disabled",
|
|
90
103
|
"createdAt"
|
|
@@ -105,12 +118,1095 @@
|
|
|
105
118
|
"description": "Missing or invalid bearer token"
|
|
106
119
|
}
|
|
107
120
|
}
|
|
121
|
+
},
|
|
122
|
+
"post": {
|
|
123
|
+
"summary": "Register an application (client secret returned once)",
|
|
124
|
+
"description": "Requires an admin key. Creating an application is an IdP-level act — there is no app to scope a permission to yet.",
|
|
125
|
+
"security": [
|
|
126
|
+
{
|
|
127
|
+
"bearerAuth": []
|
|
128
|
+
}
|
|
129
|
+
],
|
|
130
|
+
"requestBody": {
|
|
131
|
+
"required": true,
|
|
132
|
+
"content": {
|
|
133
|
+
"application/json": {
|
|
134
|
+
"schema": {
|
|
135
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
136
|
+
"type": "object",
|
|
137
|
+
"properties": {
|
|
138
|
+
"name": {
|
|
139
|
+
"type": "string",
|
|
140
|
+
"minLength": 1
|
|
141
|
+
},
|
|
142
|
+
"app": {
|
|
143
|
+
"type": "string",
|
|
144
|
+
"minLength": 1,
|
|
145
|
+
"pattern": "^[a-z0-9][a-z0-9-]*$",
|
|
146
|
+
"description": "Stable application key — the join key for members, workspaces and keys"
|
|
147
|
+
},
|
|
148
|
+
"redirectUris": {
|
|
149
|
+
"minItems": 1,
|
|
150
|
+
"type": "array",
|
|
151
|
+
"items": {
|
|
152
|
+
"type": "string",
|
|
153
|
+
"minLength": 1
|
|
154
|
+
}
|
|
155
|
+
},
|
|
156
|
+
"firstAdminUserId": {
|
|
157
|
+
"description": "Who becomes the app's first IdP admin. Defaults to the calling user; null leaves the app with no members (superadmin-managed).",
|
|
158
|
+
"anyOf": [
|
|
159
|
+
{
|
|
160
|
+
"type": "string"
|
|
161
|
+
},
|
|
162
|
+
{
|
|
163
|
+
"type": "null"
|
|
164
|
+
}
|
|
165
|
+
]
|
|
166
|
+
}
|
|
167
|
+
},
|
|
168
|
+
"required": [
|
|
169
|
+
"name",
|
|
170
|
+
"app",
|
|
171
|
+
"redirectUris"
|
|
172
|
+
]
|
|
173
|
+
}
|
|
174
|
+
}
|
|
175
|
+
}
|
|
176
|
+
},
|
|
177
|
+
"responses": {
|
|
178
|
+
"201": {
|
|
179
|
+
"description": "OK",
|
|
180
|
+
"content": {
|
|
181
|
+
"application/json": {
|
|
182
|
+
"schema": {
|
|
183
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
184
|
+
"type": "object",
|
|
185
|
+
"properties": {
|
|
186
|
+
"clientId": {
|
|
187
|
+
"type": "string"
|
|
188
|
+
},
|
|
189
|
+
"clientSecret": {
|
|
190
|
+
"type": "string",
|
|
191
|
+
"description": "Plaintext client secret — shown exactly once, never stored"
|
|
192
|
+
},
|
|
193
|
+
"app": {
|
|
194
|
+
"type": "string"
|
|
195
|
+
}
|
|
196
|
+
},
|
|
197
|
+
"required": [
|
|
198
|
+
"clientId",
|
|
199
|
+
"clientSecret",
|
|
200
|
+
"app"
|
|
201
|
+
],
|
|
202
|
+
"additionalProperties": false
|
|
203
|
+
}
|
|
204
|
+
}
|
|
205
|
+
}
|
|
206
|
+
},
|
|
207
|
+
"401": {
|
|
208
|
+
"description": "Missing or invalid bearer token"
|
|
209
|
+
},
|
|
210
|
+
"405": {
|
|
211
|
+
"description": "Method not allowed on this resource (see the `Allow` header)"
|
|
212
|
+
},
|
|
213
|
+
"409": {
|
|
214
|
+
"description": "Conflict (already a member, last admin, slug taken, …)"
|
|
215
|
+
},
|
|
216
|
+
"422": {
|
|
217
|
+
"description": "Body failed validation"
|
|
218
|
+
}
|
|
219
|
+
}
|
|
220
|
+
}
|
|
221
|
+
},
|
|
222
|
+
"/api/v1/applications/{clientId}": {
|
|
223
|
+
"get": {
|
|
224
|
+
"summary": "Get one application",
|
|
225
|
+
"description": "Requires `app:read` on the path app (or an admin key).",
|
|
226
|
+
"security": [
|
|
227
|
+
{
|
|
228
|
+
"bearerAuth": []
|
|
229
|
+
}
|
|
230
|
+
],
|
|
231
|
+
"parameters": [
|
|
232
|
+
{
|
|
233
|
+
"name": "clientId",
|
|
234
|
+
"in": "path",
|
|
235
|
+
"required": true,
|
|
236
|
+
"description": "OAuth client id of the application.",
|
|
237
|
+
"schema": {
|
|
238
|
+
"type": "string"
|
|
239
|
+
}
|
|
240
|
+
}
|
|
241
|
+
],
|
|
242
|
+
"responses": {
|
|
243
|
+
"200": {
|
|
244
|
+
"description": "OK",
|
|
245
|
+
"content": {
|
|
246
|
+
"application/json": {
|
|
247
|
+
"schema": {
|
|
248
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
249
|
+
"type": "object",
|
|
250
|
+
"properties": {
|
|
251
|
+
"clientId": {
|
|
252
|
+
"type": "string"
|
|
253
|
+
},
|
|
254
|
+
"name": {
|
|
255
|
+
"anyOf": [
|
|
256
|
+
{
|
|
257
|
+
"type": "string"
|
|
258
|
+
},
|
|
259
|
+
{
|
|
260
|
+
"type": "null"
|
|
261
|
+
}
|
|
262
|
+
]
|
|
263
|
+
},
|
|
264
|
+
"app": {
|
|
265
|
+
"anyOf": [
|
|
266
|
+
{
|
|
267
|
+
"type": "string"
|
|
268
|
+
},
|
|
269
|
+
{
|
|
270
|
+
"type": "null"
|
|
271
|
+
}
|
|
272
|
+
],
|
|
273
|
+
"description": "Application key; consumer workspace claims are filtered by this"
|
|
274
|
+
},
|
|
275
|
+
"allowSignup": {
|
|
276
|
+
"type": "boolean",
|
|
277
|
+
"description": "Whether unknown users may sign themselves up"
|
|
278
|
+
},
|
|
279
|
+
"permissions": {
|
|
280
|
+
"type": "array",
|
|
281
|
+
"items": {
|
|
282
|
+
"type": "string"
|
|
283
|
+
},
|
|
284
|
+
"description": "The app's declared product-permission catalog"
|
|
285
|
+
},
|
|
286
|
+
"redirectUris": {
|
|
287
|
+
"type": "array",
|
|
288
|
+
"items": {
|
|
289
|
+
"type": "string"
|
|
290
|
+
}
|
|
291
|
+
},
|
|
292
|
+
"disabled": {
|
|
293
|
+
"type": "boolean"
|
|
294
|
+
},
|
|
295
|
+
"createdAt": {
|
|
296
|
+
"type": "string",
|
|
297
|
+
"description": "ISO 8601 timestamp"
|
|
298
|
+
}
|
|
299
|
+
},
|
|
300
|
+
"required": [
|
|
301
|
+
"clientId",
|
|
302
|
+
"name",
|
|
303
|
+
"app",
|
|
304
|
+
"allowSignup",
|
|
305
|
+
"permissions",
|
|
306
|
+
"redirectUris",
|
|
307
|
+
"disabled",
|
|
308
|
+
"createdAt"
|
|
309
|
+
],
|
|
310
|
+
"additionalProperties": false
|
|
311
|
+
}
|
|
312
|
+
}
|
|
313
|
+
}
|
|
314
|
+
},
|
|
315
|
+
"401": {
|
|
316
|
+
"description": "Missing or invalid bearer token"
|
|
317
|
+
},
|
|
318
|
+
"403": {
|
|
319
|
+
"description": "Key lacks the permission / is bound to another app"
|
|
320
|
+
},
|
|
321
|
+
"404": {
|
|
322
|
+
"description": "No application with that client id"
|
|
323
|
+
}
|
|
324
|
+
}
|
|
325
|
+
},
|
|
326
|
+
"patch": {
|
|
327
|
+
"summary": "Update an application",
|
|
328
|
+
"description": "Requires `app:update` on the path app (or an admin key).",
|
|
329
|
+
"security": [
|
|
330
|
+
{
|
|
331
|
+
"bearerAuth": []
|
|
332
|
+
}
|
|
333
|
+
],
|
|
334
|
+
"parameters": [
|
|
335
|
+
{
|
|
336
|
+
"name": "clientId",
|
|
337
|
+
"in": "path",
|
|
338
|
+
"required": true,
|
|
339
|
+
"description": "OAuth client id of the application.",
|
|
340
|
+
"schema": {
|
|
341
|
+
"type": "string"
|
|
342
|
+
}
|
|
343
|
+
}
|
|
344
|
+
],
|
|
345
|
+
"requestBody": {
|
|
346
|
+
"required": true,
|
|
347
|
+
"content": {
|
|
348
|
+
"application/json": {
|
|
349
|
+
"schema": {
|
|
350
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
351
|
+
"type": "object",
|
|
352
|
+
"properties": {
|
|
353
|
+
"name": {
|
|
354
|
+
"type": "string",
|
|
355
|
+
"minLength": 1
|
|
356
|
+
},
|
|
357
|
+
"redirectUris": {
|
|
358
|
+
"minItems": 1,
|
|
359
|
+
"type": "array",
|
|
360
|
+
"items": {
|
|
361
|
+
"type": "string",
|
|
362
|
+
"minLength": 1
|
|
363
|
+
}
|
|
364
|
+
},
|
|
365
|
+
"allowSignup": {
|
|
366
|
+
"type": "boolean"
|
|
367
|
+
}
|
|
368
|
+
}
|
|
369
|
+
}
|
|
370
|
+
}
|
|
371
|
+
}
|
|
372
|
+
},
|
|
373
|
+
"responses": {
|
|
374
|
+
"200": {
|
|
375
|
+
"description": "OK",
|
|
376
|
+
"content": {
|
|
377
|
+
"application/json": {
|
|
378
|
+
"schema": {
|
|
379
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
380
|
+
"type": "object",
|
|
381
|
+
"properties": {
|
|
382
|
+
"clientId": {
|
|
383
|
+
"type": "string"
|
|
384
|
+
},
|
|
385
|
+
"name": {
|
|
386
|
+
"anyOf": [
|
|
387
|
+
{
|
|
388
|
+
"type": "string"
|
|
389
|
+
},
|
|
390
|
+
{
|
|
391
|
+
"type": "null"
|
|
392
|
+
}
|
|
393
|
+
]
|
|
394
|
+
},
|
|
395
|
+
"app": {
|
|
396
|
+
"anyOf": [
|
|
397
|
+
{
|
|
398
|
+
"type": "string"
|
|
399
|
+
},
|
|
400
|
+
{
|
|
401
|
+
"type": "null"
|
|
402
|
+
}
|
|
403
|
+
],
|
|
404
|
+
"description": "Application key; consumer workspace claims are filtered by this"
|
|
405
|
+
},
|
|
406
|
+
"allowSignup": {
|
|
407
|
+
"type": "boolean",
|
|
408
|
+
"description": "Whether unknown users may sign themselves up"
|
|
409
|
+
},
|
|
410
|
+
"permissions": {
|
|
411
|
+
"type": "array",
|
|
412
|
+
"items": {
|
|
413
|
+
"type": "string"
|
|
414
|
+
},
|
|
415
|
+
"description": "The app's declared product-permission catalog"
|
|
416
|
+
},
|
|
417
|
+
"redirectUris": {
|
|
418
|
+
"type": "array",
|
|
419
|
+
"items": {
|
|
420
|
+
"type": "string"
|
|
421
|
+
}
|
|
422
|
+
},
|
|
423
|
+
"disabled": {
|
|
424
|
+
"type": "boolean"
|
|
425
|
+
},
|
|
426
|
+
"createdAt": {
|
|
427
|
+
"type": "string",
|
|
428
|
+
"description": "ISO 8601 timestamp"
|
|
429
|
+
}
|
|
430
|
+
},
|
|
431
|
+
"required": [
|
|
432
|
+
"clientId",
|
|
433
|
+
"name",
|
|
434
|
+
"app",
|
|
435
|
+
"allowSignup",
|
|
436
|
+
"permissions",
|
|
437
|
+
"redirectUris",
|
|
438
|
+
"disabled",
|
|
439
|
+
"createdAt"
|
|
440
|
+
],
|
|
441
|
+
"additionalProperties": false
|
|
442
|
+
}
|
|
443
|
+
}
|
|
444
|
+
}
|
|
445
|
+
},
|
|
446
|
+
"401": {
|
|
447
|
+
"description": "Missing or invalid bearer token"
|
|
448
|
+
},
|
|
449
|
+
"403": {
|
|
450
|
+
"description": "Key lacks the permission / is bound to another app"
|
|
451
|
+
},
|
|
452
|
+
"404": {
|
|
453
|
+
"description": "No application with that client id"
|
|
454
|
+
},
|
|
455
|
+
"405": {
|
|
456
|
+
"description": "Method not allowed on this resource (see the `Allow` header)"
|
|
457
|
+
},
|
|
458
|
+
"409": {
|
|
459
|
+
"description": "Conflict (already a member, last admin, slug taken, …)"
|
|
460
|
+
},
|
|
461
|
+
"422": {
|
|
462
|
+
"description": "Body failed validation"
|
|
463
|
+
}
|
|
464
|
+
}
|
|
465
|
+
},
|
|
466
|
+
"delete": {
|
|
467
|
+
"summary": "Deregister an application",
|
|
468
|
+
"description": "Requires `app:delete` on the path app (or an admin key).",
|
|
469
|
+
"security": [
|
|
470
|
+
{
|
|
471
|
+
"bearerAuth": []
|
|
472
|
+
}
|
|
473
|
+
],
|
|
474
|
+
"parameters": [
|
|
475
|
+
{
|
|
476
|
+
"name": "clientId",
|
|
477
|
+
"in": "path",
|
|
478
|
+
"required": true,
|
|
479
|
+
"description": "OAuth client id of the application.",
|
|
480
|
+
"schema": {
|
|
481
|
+
"type": "string"
|
|
482
|
+
}
|
|
483
|
+
}
|
|
484
|
+
],
|
|
485
|
+
"responses": {
|
|
486
|
+
"200": {
|
|
487
|
+
"description": "OK",
|
|
488
|
+
"content": {
|
|
489
|
+
"application/json": {
|
|
490
|
+
"schema": {
|
|
491
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
492
|
+
"type": "object",
|
|
493
|
+
"properties": {
|
|
494
|
+
"ok": {
|
|
495
|
+
"type": "boolean",
|
|
496
|
+
"const": true
|
|
497
|
+
}
|
|
498
|
+
},
|
|
499
|
+
"required": [
|
|
500
|
+
"ok"
|
|
501
|
+
],
|
|
502
|
+
"additionalProperties": false
|
|
503
|
+
}
|
|
504
|
+
}
|
|
505
|
+
}
|
|
506
|
+
},
|
|
507
|
+
"401": {
|
|
508
|
+
"description": "Missing or invalid bearer token"
|
|
509
|
+
},
|
|
510
|
+
"403": {
|
|
511
|
+
"description": "Key lacks the permission / is bound to another app"
|
|
512
|
+
},
|
|
513
|
+
"404": {
|
|
514
|
+
"description": "No application with that client id"
|
|
515
|
+
},
|
|
516
|
+
"405": {
|
|
517
|
+
"description": "Method not allowed on this resource (see the `Allow` header)"
|
|
518
|
+
},
|
|
519
|
+
"409": {
|
|
520
|
+
"description": "Conflict (already a member, last admin, slug taken, …)"
|
|
521
|
+
}
|
|
522
|
+
}
|
|
523
|
+
}
|
|
524
|
+
},
|
|
525
|
+
"/api/v1/applications/{clientId}/rotate-secret": {
|
|
526
|
+
"post": {
|
|
527
|
+
"summary": "Rotate the client secret (returned once; the old one stops working)",
|
|
528
|
+
"description": "Requires `app:update` on the path app (or an admin key).",
|
|
529
|
+
"security": [
|
|
530
|
+
{
|
|
531
|
+
"bearerAuth": []
|
|
532
|
+
}
|
|
533
|
+
],
|
|
534
|
+
"parameters": [
|
|
535
|
+
{
|
|
536
|
+
"name": "clientId",
|
|
537
|
+
"in": "path",
|
|
538
|
+
"required": true,
|
|
539
|
+
"description": "OAuth client id of the application.",
|
|
540
|
+
"schema": {
|
|
541
|
+
"type": "string"
|
|
542
|
+
}
|
|
543
|
+
}
|
|
544
|
+
],
|
|
545
|
+
"responses": {
|
|
546
|
+
"200": {
|
|
547
|
+
"description": "OK",
|
|
548
|
+
"content": {
|
|
549
|
+
"application/json": {
|
|
550
|
+
"schema": {
|
|
551
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
552
|
+
"type": "object",
|
|
553
|
+
"properties": {
|
|
554
|
+
"clientSecret": {
|
|
555
|
+
"type": "string",
|
|
556
|
+
"description": "Plaintext client secret — shown exactly once, never stored"
|
|
557
|
+
}
|
|
558
|
+
},
|
|
559
|
+
"required": [
|
|
560
|
+
"clientSecret"
|
|
561
|
+
],
|
|
562
|
+
"additionalProperties": false
|
|
563
|
+
}
|
|
564
|
+
}
|
|
565
|
+
}
|
|
566
|
+
},
|
|
567
|
+
"401": {
|
|
568
|
+
"description": "Missing or invalid bearer token"
|
|
569
|
+
},
|
|
570
|
+
"403": {
|
|
571
|
+
"description": "Key lacks the permission / is bound to another app"
|
|
572
|
+
},
|
|
573
|
+
"404": {
|
|
574
|
+
"description": "No application with that client id"
|
|
575
|
+
},
|
|
576
|
+
"405": {
|
|
577
|
+
"description": "Method not allowed on this resource (see the `Allow` header)"
|
|
578
|
+
},
|
|
579
|
+
"409": {
|
|
580
|
+
"description": "Conflict (already a member, last admin, slug taken, …)"
|
|
581
|
+
}
|
|
582
|
+
}
|
|
583
|
+
}
|
|
584
|
+
},
|
|
585
|
+
"/api/v1/apps/{app}/permissions": {
|
|
586
|
+
"put": {
|
|
587
|
+
"summary": "Replace the app's product-permission catalog",
|
|
588
|
+
"description": "Requires `app:update` on the path app (or an admin key).",
|
|
589
|
+
"security": [
|
|
590
|
+
{
|
|
591
|
+
"bearerAuth": []
|
|
592
|
+
}
|
|
593
|
+
],
|
|
594
|
+
"parameters": [
|
|
595
|
+
{
|
|
596
|
+
"name": "app",
|
|
597
|
+
"in": "path",
|
|
598
|
+
"required": true,
|
|
599
|
+
"description": "Application key (oauth_client.metadata.app).",
|
|
600
|
+
"schema": {
|
|
601
|
+
"type": "string"
|
|
602
|
+
}
|
|
603
|
+
}
|
|
604
|
+
],
|
|
605
|
+
"requestBody": {
|
|
606
|
+
"required": true,
|
|
607
|
+
"content": {
|
|
608
|
+
"application/json": {
|
|
609
|
+
"schema": {
|
|
610
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
611
|
+
"type": "object",
|
|
612
|
+
"properties": {
|
|
613
|
+
"permissions": {
|
|
614
|
+
"type": "array",
|
|
615
|
+
"items": {
|
|
616
|
+
"type": "string",
|
|
617
|
+
"minLength": 1
|
|
618
|
+
}
|
|
619
|
+
}
|
|
620
|
+
},
|
|
621
|
+
"required": [
|
|
622
|
+
"permissions"
|
|
623
|
+
]
|
|
624
|
+
}
|
|
625
|
+
}
|
|
626
|
+
}
|
|
627
|
+
},
|
|
628
|
+
"responses": {
|
|
629
|
+
"200": {
|
|
630
|
+
"description": "OK",
|
|
631
|
+
"content": {
|
|
632
|
+
"application/json": {
|
|
633
|
+
"schema": {
|
|
634
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
635
|
+
"type": "object",
|
|
636
|
+
"properties": {
|
|
637
|
+
"permissions": {
|
|
638
|
+
"type": "array",
|
|
639
|
+
"items": {
|
|
640
|
+
"type": "string"
|
|
641
|
+
}
|
|
642
|
+
}
|
|
643
|
+
},
|
|
644
|
+
"required": [
|
|
645
|
+
"permissions"
|
|
646
|
+
],
|
|
647
|
+
"additionalProperties": false
|
|
648
|
+
}
|
|
649
|
+
}
|
|
650
|
+
}
|
|
651
|
+
},
|
|
652
|
+
"401": {
|
|
653
|
+
"description": "Missing or invalid bearer token"
|
|
654
|
+
},
|
|
655
|
+
"403": {
|
|
656
|
+
"description": "Key lacks the permission / is bound to another app"
|
|
657
|
+
},
|
|
658
|
+
"404": {
|
|
659
|
+
"description": "No application with that app key"
|
|
660
|
+
},
|
|
661
|
+
"405": {
|
|
662
|
+
"description": "Method not allowed on this resource (see the `Allow` header)"
|
|
663
|
+
},
|
|
664
|
+
"409": {
|
|
665
|
+
"description": "Conflict (already a member, last admin, slug taken, …)"
|
|
666
|
+
},
|
|
667
|
+
"422": {
|
|
668
|
+
"description": "Body failed validation"
|
|
669
|
+
}
|
|
670
|
+
}
|
|
671
|
+
}
|
|
672
|
+
},
|
|
673
|
+
"/api/v1/apps/{app}/keys": {
|
|
674
|
+
"get": {
|
|
675
|
+
"summary": "List scoped management API keys (never the hashes)",
|
|
676
|
+
"description": "Requires `apikey:read` on the path app (or an admin key).",
|
|
677
|
+
"security": [
|
|
678
|
+
{
|
|
679
|
+
"bearerAuth": []
|
|
680
|
+
}
|
|
681
|
+
],
|
|
682
|
+
"parameters": [
|
|
683
|
+
{
|
|
684
|
+
"name": "app",
|
|
685
|
+
"in": "path",
|
|
686
|
+
"required": true,
|
|
687
|
+
"description": "Application key (oauth_client.metadata.app).",
|
|
688
|
+
"schema": {
|
|
689
|
+
"type": "string"
|
|
690
|
+
}
|
|
691
|
+
}
|
|
692
|
+
],
|
|
693
|
+
"responses": {
|
|
694
|
+
"200": {
|
|
695
|
+
"description": "OK",
|
|
696
|
+
"content": {
|
|
697
|
+
"application/json": {
|
|
698
|
+
"schema": {
|
|
699
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
700
|
+
"type": "object",
|
|
701
|
+
"properties": {
|
|
702
|
+
"keys": {
|
|
703
|
+
"type": "array",
|
|
704
|
+
"items": {
|
|
705
|
+
"type": "object",
|
|
706
|
+
"properties": {
|
|
707
|
+
"id": {
|
|
708
|
+
"type": "string"
|
|
709
|
+
},
|
|
710
|
+
"name": {
|
|
711
|
+
"type": "string"
|
|
712
|
+
},
|
|
713
|
+
"prefix": {
|
|
714
|
+
"type": "string",
|
|
715
|
+
"description": "Non-secret token prefix (wim_…) for display"
|
|
716
|
+
},
|
|
717
|
+
"permissions": {
|
|
718
|
+
"type": "array",
|
|
719
|
+
"items": {
|
|
720
|
+
"type": "string"
|
|
721
|
+
},
|
|
722
|
+
"description": "IdP management permissions this key holds"
|
|
723
|
+
},
|
|
724
|
+
"status": {
|
|
725
|
+
"type": "string",
|
|
726
|
+
"enum": [
|
|
727
|
+
"active",
|
|
728
|
+
"expired",
|
|
729
|
+
"revoked"
|
|
730
|
+
]
|
|
731
|
+
},
|
|
732
|
+
"createdAt": {
|
|
733
|
+
"type": "string"
|
|
734
|
+
},
|
|
735
|
+
"lastUsedAt": {
|
|
736
|
+
"anyOf": [
|
|
737
|
+
{
|
|
738
|
+
"type": "string"
|
|
739
|
+
},
|
|
740
|
+
{
|
|
741
|
+
"type": "null"
|
|
742
|
+
}
|
|
743
|
+
]
|
|
744
|
+
},
|
|
745
|
+
"expiresAt": {
|
|
746
|
+
"anyOf": [
|
|
747
|
+
{
|
|
748
|
+
"type": "string"
|
|
749
|
+
},
|
|
750
|
+
{
|
|
751
|
+
"type": "null"
|
|
752
|
+
}
|
|
753
|
+
]
|
|
754
|
+
},
|
|
755
|
+
"revokedAt": {
|
|
756
|
+
"anyOf": [
|
|
757
|
+
{
|
|
758
|
+
"type": "string"
|
|
759
|
+
},
|
|
760
|
+
{
|
|
761
|
+
"type": "null"
|
|
762
|
+
}
|
|
763
|
+
]
|
|
764
|
+
}
|
|
765
|
+
},
|
|
766
|
+
"required": [
|
|
767
|
+
"id",
|
|
768
|
+
"name",
|
|
769
|
+
"prefix",
|
|
770
|
+
"permissions",
|
|
771
|
+
"status",
|
|
772
|
+
"createdAt",
|
|
773
|
+
"lastUsedAt",
|
|
774
|
+
"expiresAt",
|
|
775
|
+
"revokedAt"
|
|
776
|
+
],
|
|
777
|
+
"additionalProperties": false
|
|
778
|
+
}
|
|
779
|
+
}
|
|
780
|
+
},
|
|
781
|
+
"required": [
|
|
782
|
+
"keys"
|
|
783
|
+
],
|
|
784
|
+
"additionalProperties": false
|
|
785
|
+
}
|
|
786
|
+
}
|
|
787
|
+
}
|
|
788
|
+
},
|
|
789
|
+
"401": {
|
|
790
|
+
"description": "Missing or invalid bearer token"
|
|
791
|
+
},
|
|
792
|
+
"403": {
|
|
793
|
+
"description": "Key lacks the permission / is bound to another app"
|
|
794
|
+
}
|
|
795
|
+
}
|
|
796
|
+
},
|
|
797
|
+
"post": {
|
|
798
|
+
"summary": "Mint a scoped management API key (plaintext returned once)",
|
|
799
|
+
"description": "Requires `apikey:create` on the path app (or an admin key). The requested permissions must be a subset of the caller's own, otherwise 403 `permissions_exceed_caller` — without that rule any key holding `apikey:create` could mint itself a more powerful successor.",
|
|
800
|
+
"security": [
|
|
801
|
+
{
|
|
802
|
+
"bearerAuth": []
|
|
803
|
+
}
|
|
804
|
+
],
|
|
805
|
+
"parameters": [
|
|
806
|
+
{
|
|
807
|
+
"name": "app",
|
|
808
|
+
"in": "path",
|
|
809
|
+
"required": true,
|
|
810
|
+
"description": "Application key (oauth_client.metadata.app).",
|
|
811
|
+
"schema": {
|
|
812
|
+
"type": "string"
|
|
813
|
+
}
|
|
814
|
+
}
|
|
815
|
+
],
|
|
816
|
+
"requestBody": {
|
|
817
|
+
"required": true,
|
|
818
|
+
"content": {
|
|
819
|
+
"application/json": {
|
|
820
|
+
"schema": {
|
|
821
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
822
|
+
"type": "object",
|
|
823
|
+
"properties": {
|
|
824
|
+
"name": {
|
|
825
|
+
"type": "string",
|
|
826
|
+
"minLength": 1
|
|
827
|
+
},
|
|
828
|
+
"permissions": {
|
|
829
|
+
"type": "array",
|
|
830
|
+
"items": {
|
|
831
|
+
"type": "string",
|
|
832
|
+
"minLength": 1
|
|
833
|
+
},
|
|
834
|
+
"description": "IdP management permissions; must be a subset of the caller's own on this app"
|
|
835
|
+
},
|
|
836
|
+
"expiresAt": {
|
|
837
|
+
"description": "ISO 8601; omit for non-expiring",
|
|
838
|
+
"type": "string",
|
|
839
|
+
"format": "date-time",
|
|
840
|
+
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
|
|
841
|
+
}
|
|
842
|
+
},
|
|
843
|
+
"required": [
|
|
844
|
+
"name",
|
|
845
|
+
"permissions"
|
|
846
|
+
]
|
|
847
|
+
}
|
|
848
|
+
}
|
|
849
|
+
}
|
|
850
|
+
},
|
|
851
|
+
"responses": {
|
|
852
|
+
"201": {
|
|
853
|
+
"description": "OK",
|
|
854
|
+
"content": {
|
|
855
|
+
"application/json": {
|
|
856
|
+
"schema": {
|
|
857
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
858
|
+
"type": "object",
|
|
859
|
+
"properties": {
|
|
860
|
+
"id": {
|
|
861
|
+
"type": "string"
|
|
862
|
+
},
|
|
863
|
+
"token": {
|
|
864
|
+
"type": "string",
|
|
865
|
+
"description": "Plaintext key — shown exactly once, never stored"
|
|
866
|
+
},
|
|
867
|
+
"prefix": {
|
|
868
|
+
"type": "string"
|
|
869
|
+
}
|
|
870
|
+
},
|
|
871
|
+
"required": [
|
|
872
|
+
"id",
|
|
873
|
+
"token",
|
|
874
|
+
"prefix"
|
|
875
|
+
],
|
|
876
|
+
"additionalProperties": false
|
|
877
|
+
}
|
|
878
|
+
}
|
|
879
|
+
}
|
|
880
|
+
},
|
|
881
|
+
"401": {
|
|
882
|
+
"description": "Missing or invalid bearer token"
|
|
883
|
+
},
|
|
884
|
+
"403": {
|
|
885
|
+
"description": "Key lacks the permission / is bound to another app"
|
|
886
|
+
},
|
|
887
|
+
"405": {
|
|
888
|
+
"description": "Method not allowed on this resource (see the `Allow` header)"
|
|
889
|
+
},
|
|
890
|
+
"409": {
|
|
891
|
+
"description": "Conflict (already a member, last admin, slug taken, …)"
|
|
892
|
+
},
|
|
893
|
+
"422": {
|
|
894
|
+
"description": "Body failed validation"
|
|
895
|
+
}
|
|
896
|
+
}
|
|
897
|
+
}
|
|
898
|
+
},
|
|
899
|
+
"/api/v1/apps/{app}/keys/{id}": {
|
|
900
|
+
"delete": {
|
|
901
|
+
"summary": "Revoke a scoped management API key (idempotent)",
|
|
902
|
+
"description": "Requires `apikey:revoke` on the path app (or an admin key).",
|
|
903
|
+
"security": [
|
|
904
|
+
{
|
|
905
|
+
"bearerAuth": []
|
|
906
|
+
}
|
|
907
|
+
],
|
|
908
|
+
"parameters": [
|
|
909
|
+
{
|
|
910
|
+
"name": "app",
|
|
911
|
+
"in": "path",
|
|
912
|
+
"required": true,
|
|
913
|
+
"description": "Application key (oauth_client.metadata.app).",
|
|
914
|
+
"schema": {
|
|
915
|
+
"type": "string"
|
|
916
|
+
}
|
|
917
|
+
},
|
|
918
|
+
{
|
|
919
|
+
"name": "id",
|
|
920
|
+
"in": "path",
|
|
921
|
+
"required": true,
|
|
922
|
+
"schema": {
|
|
923
|
+
"type": "string"
|
|
924
|
+
}
|
|
925
|
+
}
|
|
926
|
+
],
|
|
927
|
+
"responses": {
|
|
928
|
+
"200": {
|
|
929
|
+
"description": "OK",
|
|
930
|
+
"content": {
|
|
931
|
+
"application/json": {
|
|
932
|
+
"schema": {
|
|
933
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
934
|
+
"type": "object",
|
|
935
|
+
"properties": {
|
|
936
|
+
"ok": {
|
|
937
|
+
"type": "boolean",
|
|
938
|
+
"const": true
|
|
939
|
+
}
|
|
940
|
+
},
|
|
941
|
+
"required": [
|
|
942
|
+
"ok"
|
|
943
|
+
],
|
|
944
|
+
"additionalProperties": false
|
|
945
|
+
}
|
|
946
|
+
}
|
|
947
|
+
}
|
|
948
|
+
},
|
|
949
|
+
"401": {
|
|
950
|
+
"description": "Missing or invalid bearer token"
|
|
951
|
+
},
|
|
952
|
+
"403": {
|
|
953
|
+
"description": "Key lacks the permission / is bound to another app"
|
|
954
|
+
},
|
|
955
|
+
"404": {
|
|
956
|
+
"description": "No key with that id on this app"
|
|
957
|
+
},
|
|
958
|
+
"405": {
|
|
959
|
+
"description": "Method not allowed on this resource (see the `Allow` header)"
|
|
960
|
+
},
|
|
961
|
+
"409": {
|
|
962
|
+
"description": "Conflict (already a member, last admin, slug taken, …)"
|
|
963
|
+
}
|
|
964
|
+
}
|
|
965
|
+
}
|
|
966
|
+
},
|
|
967
|
+
"/api/v1/admin-keys": {
|
|
968
|
+
"get": {
|
|
969
|
+
"summary": "List IdP-level admin keys (never the hashes)",
|
|
970
|
+
"description": "Requires an admin key. Admin keys are `api_key` rows with no application scope, so they hold every permission on every app.",
|
|
971
|
+
"security": [
|
|
972
|
+
{
|
|
973
|
+
"bearerAuth": []
|
|
974
|
+
}
|
|
975
|
+
],
|
|
976
|
+
"responses": {
|
|
977
|
+
"200": {
|
|
978
|
+
"description": "OK",
|
|
979
|
+
"content": {
|
|
980
|
+
"application/json": {
|
|
981
|
+
"schema": {
|
|
982
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
983
|
+
"type": "object",
|
|
984
|
+
"properties": {
|
|
985
|
+
"keys": {
|
|
986
|
+
"type": "array",
|
|
987
|
+
"items": {
|
|
988
|
+
"type": "object",
|
|
989
|
+
"properties": {
|
|
990
|
+
"id": {
|
|
991
|
+
"type": "string"
|
|
992
|
+
},
|
|
993
|
+
"name": {
|
|
994
|
+
"type": "string"
|
|
995
|
+
},
|
|
996
|
+
"prefix": {
|
|
997
|
+
"type": "string",
|
|
998
|
+
"description": "Non-secret token prefix (wim_…) for display"
|
|
999
|
+
},
|
|
1000
|
+
"status": {
|
|
1001
|
+
"type": "string",
|
|
1002
|
+
"enum": [
|
|
1003
|
+
"active",
|
|
1004
|
+
"expired",
|
|
1005
|
+
"revoked"
|
|
1006
|
+
]
|
|
1007
|
+
},
|
|
1008
|
+
"createdAt": {
|
|
1009
|
+
"type": "string"
|
|
1010
|
+
},
|
|
1011
|
+
"lastUsedAt": {
|
|
1012
|
+
"anyOf": [
|
|
1013
|
+
{
|
|
1014
|
+
"type": "string"
|
|
1015
|
+
},
|
|
1016
|
+
{
|
|
1017
|
+
"type": "null"
|
|
1018
|
+
}
|
|
1019
|
+
]
|
|
1020
|
+
},
|
|
1021
|
+
"expiresAt": {
|
|
1022
|
+
"anyOf": [
|
|
1023
|
+
{
|
|
1024
|
+
"type": "string"
|
|
1025
|
+
},
|
|
1026
|
+
{
|
|
1027
|
+
"type": "null"
|
|
1028
|
+
}
|
|
1029
|
+
]
|
|
1030
|
+
},
|
|
1031
|
+
"revokedAt": {
|
|
1032
|
+
"anyOf": [
|
|
1033
|
+
{
|
|
1034
|
+
"type": "string"
|
|
1035
|
+
},
|
|
1036
|
+
{
|
|
1037
|
+
"type": "null"
|
|
1038
|
+
}
|
|
1039
|
+
]
|
|
1040
|
+
}
|
|
1041
|
+
},
|
|
1042
|
+
"required": [
|
|
1043
|
+
"id",
|
|
1044
|
+
"name",
|
|
1045
|
+
"prefix",
|
|
1046
|
+
"status",
|
|
1047
|
+
"createdAt",
|
|
1048
|
+
"lastUsedAt",
|
|
1049
|
+
"expiresAt",
|
|
1050
|
+
"revokedAt"
|
|
1051
|
+
],
|
|
1052
|
+
"additionalProperties": false
|
|
1053
|
+
}
|
|
1054
|
+
}
|
|
1055
|
+
},
|
|
1056
|
+
"required": [
|
|
1057
|
+
"keys"
|
|
1058
|
+
],
|
|
1059
|
+
"additionalProperties": false
|
|
1060
|
+
}
|
|
1061
|
+
}
|
|
1062
|
+
}
|
|
1063
|
+
},
|
|
1064
|
+
"401": {
|
|
1065
|
+
"description": "Missing or invalid bearer token"
|
|
1066
|
+
}
|
|
1067
|
+
}
|
|
1068
|
+
},
|
|
1069
|
+
"post": {
|
|
1070
|
+
"summary": "Mint an IdP-level admin key (plaintext returned once)",
|
|
1071
|
+
"description": "Requires an admin key. Mint one per agent: an admin key has a name, an optional expiry, a revoke switch, and its own `adminkey:<id>` identity in the audit log, so every superadmin action is attributable.",
|
|
1072
|
+
"security": [
|
|
1073
|
+
{
|
|
1074
|
+
"bearerAuth": []
|
|
1075
|
+
}
|
|
1076
|
+
],
|
|
1077
|
+
"requestBody": {
|
|
1078
|
+
"required": true,
|
|
1079
|
+
"content": {
|
|
1080
|
+
"application/json": {
|
|
1081
|
+
"schema": {
|
|
1082
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
1083
|
+
"type": "object",
|
|
1084
|
+
"properties": {
|
|
1085
|
+
"name": {
|
|
1086
|
+
"type": "string",
|
|
1087
|
+
"minLength": 1,
|
|
1088
|
+
"description": "Who holds it — one key per agent, so the audit log reads"
|
|
1089
|
+
},
|
|
1090
|
+
"expiresAt": {
|
|
1091
|
+
"description": "ISO 8601; omit for non-expiring",
|
|
1092
|
+
"type": "string",
|
|
1093
|
+
"format": "date-time",
|
|
1094
|
+
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
|
|
1095
|
+
}
|
|
1096
|
+
},
|
|
1097
|
+
"required": [
|
|
1098
|
+
"name"
|
|
1099
|
+
]
|
|
1100
|
+
}
|
|
1101
|
+
}
|
|
1102
|
+
}
|
|
1103
|
+
},
|
|
1104
|
+
"responses": {
|
|
1105
|
+
"201": {
|
|
1106
|
+
"description": "OK",
|
|
1107
|
+
"content": {
|
|
1108
|
+
"application/json": {
|
|
1109
|
+
"schema": {
|
|
1110
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
1111
|
+
"type": "object",
|
|
1112
|
+
"properties": {
|
|
1113
|
+
"id": {
|
|
1114
|
+
"type": "string"
|
|
1115
|
+
},
|
|
1116
|
+
"token": {
|
|
1117
|
+
"type": "string",
|
|
1118
|
+
"description": "Plaintext key — shown exactly once, never stored"
|
|
1119
|
+
},
|
|
1120
|
+
"prefix": {
|
|
1121
|
+
"type": "string"
|
|
1122
|
+
}
|
|
1123
|
+
},
|
|
1124
|
+
"required": [
|
|
1125
|
+
"id",
|
|
1126
|
+
"token",
|
|
1127
|
+
"prefix"
|
|
1128
|
+
],
|
|
1129
|
+
"additionalProperties": false
|
|
1130
|
+
}
|
|
1131
|
+
}
|
|
1132
|
+
}
|
|
1133
|
+
},
|
|
1134
|
+
"401": {
|
|
1135
|
+
"description": "Missing or invalid bearer token"
|
|
1136
|
+
},
|
|
1137
|
+
"405": {
|
|
1138
|
+
"description": "Method not allowed on this resource (see the `Allow` header)"
|
|
1139
|
+
},
|
|
1140
|
+
"409": {
|
|
1141
|
+
"description": "Conflict (already a member, last admin, slug taken, …)"
|
|
1142
|
+
},
|
|
1143
|
+
"422": {
|
|
1144
|
+
"description": "Body failed validation"
|
|
1145
|
+
}
|
|
1146
|
+
}
|
|
1147
|
+
}
|
|
1148
|
+
},
|
|
1149
|
+
"/api/v1/admin-keys/{id}": {
|
|
1150
|
+
"delete": {
|
|
1151
|
+
"summary": "Revoke an IdP-level admin key (idempotent)",
|
|
1152
|
+
"description": "A key may revoke itself — an agent cleaning up after itself is legitimate — after which its next request is simply unauthorized.",
|
|
1153
|
+
"security": [
|
|
1154
|
+
{
|
|
1155
|
+
"bearerAuth": []
|
|
1156
|
+
}
|
|
1157
|
+
],
|
|
1158
|
+
"parameters": [
|
|
1159
|
+
{
|
|
1160
|
+
"name": "id",
|
|
1161
|
+
"in": "path",
|
|
1162
|
+
"required": true,
|
|
1163
|
+
"description": "Admin key id.",
|
|
1164
|
+
"schema": {
|
|
1165
|
+
"type": "string"
|
|
1166
|
+
}
|
|
1167
|
+
}
|
|
1168
|
+
],
|
|
1169
|
+
"responses": {
|
|
1170
|
+
"200": {
|
|
1171
|
+
"description": "OK",
|
|
1172
|
+
"content": {
|
|
1173
|
+
"application/json": {
|
|
1174
|
+
"schema": {
|
|
1175
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
1176
|
+
"type": "object",
|
|
1177
|
+
"properties": {
|
|
1178
|
+
"ok": {
|
|
1179
|
+
"type": "boolean",
|
|
1180
|
+
"const": true
|
|
1181
|
+
}
|
|
1182
|
+
},
|
|
1183
|
+
"required": [
|
|
1184
|
+
"ok"
|
|
1185
|
+
],
|
|
1186
|
+
"additionalProperties": false
|
|
1187
|
+
}
|
|
1188
|
+
}
|
|
1189
|
+
}
|
|
1190
|
+
},
|
|
1191
|
+
"401": {
|
|
1192
|
+
"description": "Missing or invalid bearer token"
|
|
1193
|
+
},
|
|
1194
|
+
"404": {
|
|
1195
|
+
"description": "No admin key with that id"
|
|
1196
|
+
},
|
|
1197
|
+
"405": {
|
|
1198
|
+
"description": "Method not allowed on this resource (see the `Allow` header)"
|
|
1199
|
+
},
|
|
1200
|
+
"409": {
|
|
1201
|
+
"description": "Conflict (already a member, last admin, slug taken, …)"
|
|
1202
|
+
}
|
|
1203
|
+
}
|
|
108
1204
|
}
|
|
109
1205
|
},
|
|
110
1206
|
"/api/v1/users": {
|
|
111
1207
|
"get": {
|
|
112
1208
|
"summary": "List users",
|
|
113
|
-
"description": "Requires
|
|
1209
|
+
"description": "Requires an admin key.",
|
|
114
1210
|
"security": [
|
|
115
1211
|
{
|
|
116
1212
|
"bearerAuth": []
|
|
@@ -181,7 +1277,7 @@
|
|
|
181
1277
|
"/api/v1/workspaces": {
|
|
182
1278
|
"get": {
|
|
183
1279
|
"summary": "List workspaces",
|
|
184
|
-
"description": "Requires
|
|
1280
|
+
"description": "Requires an admin key.",
|
|
185
1281
|
"security": [
|
|
186
1282
|
{
|
|
187
1283
|
"bearerAuth": []
|
|
@@ -252,7 +1348,7 @@
|
|
|
252
1348
|
"/api/v1/apps/{app}/members": {
|
|
253
1349
|
"get": {
|
|
254
1350
|
"summary": "List app members",
|
|
255
|
-
"description": "Requires `member:read` on the path app (or
|
|
1351
|
+
"description": "Requires `member:read` on the path app (or an admin key).",
|
|
256
1352
|
"security": [
|
|
257
1353
|
{
|
|
258
1354
|
"bearerAuth": []
|
|
@@ -342,7 +1438,7 @@
|
|
|
342
1438
|
},
|
|
343
1439
|
"post": {
|
|
344
1440
|
"summary": "Add or invite a member",
|
|
345
|
-
"description": "Requires `member:invite` on the path app (or
|
|
1441
|
+
"description": "Requires `member:invite` on the path app (or an admin key).",
|
|
346
1442
|
"security": [
|
|
347
1443
|
{
|
|
348
1444
|
"bearerAuth": []
|
|
@@ -441,7 +1537,7 @@
|
|
|
441
1537
|
"/api/v1/apps/{app}/members/{userId}": {
|
|
442
1538
|
"patch": {
|
|
443
1539
|
"summary": "Update a member's role + permissions",
|
|
444
|
-
"description": "Requires `member:manage` on the path app (or
|
|
1540
|
+
"description": "Requires `member:manage` on the path app (or an admin key).",
|
|
445
1541
|
"security": [
|
|
446
1542
|
{
|
|
447
1543
|
"bearerAuth": []
|
|
@@ -537,7 +1633,7 @@
|
|
|
537
1633
|
},
|
|
538
1634
|
"delete": {
|
|
539
1635
|
"summary": "Remove a member",
|
|
540
|
-
"description": "Requires `member:manage` on the path app (or
|
|
1636
|
+
"description": "Requires `member:manage` on the path app (or an admin key).",
|
|
541
1637
|
"security": [
|
|
542
1638
|
{
|
|
543
1639
|
"bearerAuth": []
|
|
@@ -602,7 +1698,7 @@
|
|
|
602
1698
|
"/api/v1/apps/{app}/workspaces": {
|
|
603
1699
|
"get": {
|
|
604
1700
|
"summary": "List app workspaces",
|
|
605
|
-
"description": "Requires `workspace:read` on the path app (or
|
|
1701
|
+
"description": "Requires `workspace:read` on the path app (or an admin key).",
|
|
606
1702
|
"security": [
|
|
607
1703
|
{
|
|
608
1704
|
"bearerAuth": []
|
|
@@ -685,7 +1781,7 @@
|
|
|
685
1781
|
},
|
|
686
1782
|
"post": {
|
|
687
1783
|
"summary": "Create a workspace",
|
|
688
|
-
"description": "Requires `workspace:create` on the path app (or
|
|
1784
|
+
"description": "Requires `workspace:create` on the path app (or an admin key).",
|
|
689
1785
|
"security": [
|
|
690
1786
|
{
|
|
691
1787
|
"bearerAuth": []
|
|
@@ -778,7 +1874,7 @@
|
|
|
778
1874
|
"/api/v1/apps/{app}/user-keys": {
|
|
779
1875
|
"get": {
|
|
780
1876
|
"summary": "List end-user API keys",
|
|
781
|
-
"description": "Requires `userkey:read` on the path app (or
|
|
1877
|
+
"description": "Requires `userkey:read` on the path app (or an admin key).",
|
|
782
1878
|
"security": [
|
|
783
1879
|
{
|
|
784
1880
|
"bearerAuth": []
|
|
@@ -922,7 +2018,7 @@
|
|
|
922
2018
|
},
|
|
923
2019
|
"post": {
|
|
924
2020
|
"summary": "Mint an end-user API key (plaintext returned once)",
|
|
925
|
-
"description": "Requires `userkey:create` on the path app (or
|
|
2021
|
+
"description": "Requires `userkey:create` on the path app (or an admin key).",
|
|
926
2022
|
"security": [
|
|
927
2023
|
{
|
|
928
2024
|
"bearerAuth": []
|
|
@@ -1032,7 +2128,7 @@
|
|
|
1032
2128
|
"/api/v1/apps/{app}/user-keys/validate": {
|
|
1033
2129
|
"post": {
|
|
1034
2130
|
"summary": "Validate a presented end-user key (200 + valid discriminator)",
|
|
1035
|
-
"description": "Requires `userkey:validate` on the path app (or
|
|
2131
|
+
"description": "Requires `userkey:validate` on the path app (or an admin key).",
|
|
1036
2132
|
"security": [
|
|
1037
2133
|
{
|
|
1038
2134
|
"bearerAuth": []
|
|
@@ -1168,7 +2264,7 @@
|
|
|
1168
2264
|
"/api/v1/apps/{app}/user-keys/{id}": {
|
|
1169
2265
|
"delete": {
|
|
1170
2266
|
"summary": "Revoke an end-user API key (idempotent)",
|
|
1171
|
-
"description": "Requires `userkey:revoke` on the path app (or
|
|
2267
|
+
"description": "Requires `userkey:revoke` on the path app (or an admin key).",
|
|
1172
2268
|
"security": [
|
|
1173
2269
|
{
|
|
1174
2270
|
"bearerAuth": []
|
|
@@ -1233,7 +2329,7 @@
|
|
|
1233
2329
|
"/api/v1/apps/{app}/audit": {
|
|
1234
2330
|
"get": {
|
|
1235
2331
|
"summary": "List recent audit entries",
|
|
1236
|
-
"description": "Requires `audit:read` on the path app (or
|
|
2332
|
+
"description": "Requires `audit:read` on the path app (or an admin key).",
|
|
1237
2333
|
"security": [
|
|
1238
2334
|
{
|
|
1239
2335
|
"bearerAuth": []
|