kb-cloud-client-typescript 2.4.0-alpha.93 → 2.4.0-alpha.95

package/src/adminapi.yaml

@@ -76,6 +76,548 @@ tags:
   - name: disasterRecovery
     description: Cluster Disaster Recovery APIs
 paths:
+  /admin/v1/data/mongodb/organizations/{orgName}/clusters/{clusterName}/rbac/users/{database}/{username}/password:
+    put:
+      summary: ChangeRBACUserPassword
+      operationId: mongoChangeRBACUserPassword
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: username
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MongoRBACPasswordChange'
+  /admin/v1/data/mongodb/organizations/{orgName}/clusters/{clusterName}/rbac/users:
+    get:
+      summary: ListRBACUsers
+      operationId: mongoListRBACUsers
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: query
+          schema:
+            type: string
+            default: admin
+      responses:
+        '200':
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/MongoRBACUser'
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+    post:
+      summary: CreateRBACUser
+      operationId: mongoCreateRBACUser
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MongoRBACUserCreate'
+  /admin/v1/data/mongodb/organizations/{orgName}/clusters/{clusterName}/rbac/capabilities:
+    get:
+      summary: GetRBACCapabilities
+      operationId: mongoGetRBACCapabilities
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MongoRBACCapabilities'
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+  /admin/v1/data/mongodb/organizations/{orgName}/clusters/{clusterName}/rbac/roles:
+    get:
+      summary: ListRBACRoles
+      operationId: mongoListRBACRoles
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: query
+          schema:
+            type: string
+            default: admin
+      responses:
+        '200':
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/MongoRBACRole'
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+    post:
+      summary: CreateRBACRole
+      operationId: mongoCreateRBACRole
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MongoRBACRoleWrite'
+  /admin/v1/data/mongodb/organizations/{orgName}/clusters/{clusterName}/rbac/roles/{database}/{roleName}:
+    get:
+      summary: GetRBACRole
+      operationId: mongoGetRBACRole
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: roleName
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MongoRBACRole'
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+    put:
+      summary: UpdateRBACRole
+      operationId: mongoUpdateRBACRole
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: roleName
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MongoRBACRoleWrite'
+    delete:
+      summary: DeleteRBACRole
+      operationId: mongoDeleteRBACRole
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: roleName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: expectedRevision
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+  /admin/v1/data/mongodb/organizations/{orgName}/clusters/{clusterName}/rbac/users/{database}/{username}:
+    get:
+      summary: GetRBACUser
+      operationId: mongoGetRBACUser
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: username
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MongoRBACUser'
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+    delete:
+      summary: DeleteRBACUser
+      operationId: mongoDeleteRBACUser
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: username
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+  /admin/v1/data/mongodb/organizations/{orgName}/clusters/{clusterName}/rbac/users/{database}/{username}/roles:
+    patch:
+      summary: ChangeRBACUserRoles
+      operationId: mongoChangeRBACUserRoles
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: username
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MongoRBACBindingChange'
   /admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/jars/config:
     get:
       operationId: getClusterJarConfig
@@ -24049,69 +24591,140 @@ paths:
           description: Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
         - name: subjectQualifiers
           in: query
-          required: false
+          required: false
+          schema:
+            type: string
+          description: JSON object of string identity qualifiers, e.g. {"host":"%"}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/ObjectPrivilegeChange'
+      responses:
+        '204':
+          description: Native statement completed. Query privileges again to inspect remaining access.
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          $ref: '#/components/responses/409'
+        '500':
+          $ref: '#/components/responses/500'
+      x-codegen-request-body-name: body
+  /admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/capabilities:
+    get:
+      tags:
+        - account
+        - rdbms
+        - shared
+      summary: List native object privilege capabilities for the connected server
+      operationId: getAccountObjectPrivilegeCapabilities
+      description: Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+      parameters:
+        - name: engineName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: accountName
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Native privilege snapshot
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ObjectPrivilegeCapabilities'
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '500':
+          $ref: '#/components/responses/500'
+  /admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/overview:
+    get:
+      tags:
+        - account
+        - rdbms
+        - shared
+      summary: Read native account privilege summary or selected database evidence
+      operationId: getAccountPrivilegeOverview
+      description: Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+      parameters:
+        - name: engineName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: accountName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: subjectType
+          in: query
+          required: false
+          schema:
+            $ref: '#/components/schemas/ObjectPrivilegeSubjectType'
+          description: Native subject kind; path account name identifies the subject.
+        - name: host
+          in: query
+          required: false
+          schema:
+            type: string
+          description: Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+        - name: subjectQualifiers
+          in: query
           schema:
             type: string
-          description: JSON object of string identity qualifiers, e.g. {"host":"%"}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/ObjectPrivilegeChange'
-      responses:
-        '204':
-          description: Native statement completed. Query privileges again to inspect remaining access.
-        '400':
-          $ref: '#/components/responses/400'
-        '401':
-          $ref: '#/components/responses/401'
-        '403':
-          $ref: '#/components/responses/403'
-        '404':
-          $ref: '#/components/responses/404'
-        '409':
-          $ref: '#/components/responses/409'
-        '500':
-          $ref: '#/components/responses/500'
-      x-codegen-request-body-name: body
-  /admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/capabilities:
-    get:
-      tags:
-        - account
-        - rdbms
-        - shared
-      summary: List native object privilege capabilities for the connected server
-      operationId: getAccountObjectPrivilegeCapabilities
-      description: Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
-      parameters:
-        - name: engineName
-          in: path
-          required: true
-          schema:
-            type: string
-        - name: orgName
-          in: path
-          required: true
-          schema:
-            type: string
-        - name: clusterName
-          in: path
-          required: true
-          schema:
-            type: string
-        - name: accountName
-          in: path
-          required: true
+        - name: databaseName
+          in: query
+          description: PostgreSQL database to inspect on demand. Omit for the global summary.
+          required: false
           schema:
             type: string
       responses:
         '200':
-          description: Native privilege snapshot
+          description: Native evidence groups for the requested scope
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/ObjectPrivilegeCapabilities'
+                type: array
+                items:
+                  $ref: '#/components/schemas/ObjectPrivilegeEvidence'
         '400':
           $ref: '#/components/responses/400'
         '401':
@@ -24128,9 +24741,9 @@ paths:
         - account
         - rdbms
         - shared
-      summary: Preview clearing all MySQL account privileges
+      summary: Preview clearing explicit account privileges
       operationId: previewAccountPrivilegeReset
-      description: MySQL only. Clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections.
+      description: MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
       parameters:
         - name: engineName
           in: path
@@ -24169,6 +24782,21 @@ paths:
           schema:
             type: string
           description: JSON identity qualifiers; MySQL host defaults to %.
+        - name: databaseNames
+          in: query
+          style: form
+          explode: true
+          description: PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+          schema:
+            type: array
+            items:
+              type: string
+        - name: allDatabases
+          in: query
+          description: PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+          schema:
+            type: boolean
+            default: false
       responses:
         '200':
           description: Server-generated steps with connection database, in execution order
@@ -24193,9 +24821,9 @@ paths:
         - account
         - rdbms
         - shared
-      summary: Clear all MySQL account privileges
+      summary: Clear explicit account privileges
       operationId: resetAccountPrivileges
-      description: MySQL only. Clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections.
+      description: MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
       parameters:
         - name: engineName
           in: path
@@ -24234,6 +24862,21 @@ paths:
           schema:
             type: string
           description: JSON identity qualifiers; MySQL host defaults to %.
+        - name: databaseNames
+          in: query
+          style: form
+          explode: true
+          description: PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+          schema:
+            type: array
+            items:
+              type: string
+        - name: allDatabases
+          in: query
+          description: PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+          schema:
+            type: boolean
+            default: false
       responses:
         '204':
           description: Privileges cleared; account and password preserved
@@ -24255,7 +24898,7 @@ paths:
         - shared
       summary: List exact column names for account object privileges
       operationId: listAccountObjectPrivilegeColumns
-      description: Read MySQL table or view column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+      description: Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
       parameters:
         - name: engineName
           in: path
@@ -24280,7 +24923,7 @@ paths:
         - name: objectType
           in: query
           required: true
-          description: Object type, either table or view
+          description: Object type, table/view; PostgreSQL also supports materializedView/foreignTable
           schema:
             type: string
         - name: databaseName
@@ -24293,6 +24936,11 @@ paths:
           required: true
           schema:
             type: string
+        - name: schemaName
+          in: query
+          description: Required for PostgreSQL; not accepted for MySQL
+          schema:
+            type: string
       responses:
         '200':
           description: Exact column names in catalog order; empty if no visible columns exist
@@ -29187,6 +29835,194 @@ components:
         curl --digest -u "accessKey:secretKey" https://api.example.com/admin/v1/user
         ```
   schemas:
+    MongoRBACPasswordChange:
+      type: object
+      required:
+        - password
+      properties:
+        password:
+          type: string
+          format: password
+    APIErrorResponse:
+      description: API error response.
+      properties:
+        code:
+          description: The HTTP status code.
+          type: integer
+        reason:
+          description: The reason for the error.
+          type: string
+        message:
+          description: The message for the error.
+          type: string
+      required:
+        - code
+      type: object
+    MongoRBACRoleRef:
+      type: object
+      properties:
+        role:
+          type: string
+        db:
+          type: string
+      required:
+        - role
+        - db
+    MongoRBACResource:
+      type: object
+      properties:
+        cluster:
+          type: boolean
+        db:
+          type: string
+          x-nullable: true
+          description: Preserve an explicit empty string for native wildcard scope; omit only for cluster resources.
+        collection:
+          type: string
+          x-nullable: true
+          description: Preserve an explicit empty string for native wildcard scope; omit only for cluster resources.
+        anyResource:
+          type: boolean
+          description: Read-only native evidence; write requests reject this internal resource.
+      description: Native MongoDB resource. cluster:true is system operations, not all database data. Empty db/collection are explicit wildcard scopes; system collections need explicit resources.
+    MongoRBACPrivilege:
+      type: object
+      properties:
+        resource:
+          $ref: '#/components/schemas/MongoRBACResource'
+        actions:
+          type: array
+          items:
+            type: string
+      required:
+        - resource
+        - actions
+    MongoRBACUser:
+      type: object
+      properties:
+        db:
+          type: string
+        roles:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACRoleRef'
+        inheritedRoles:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACRoleRef'
+        inheritedPrivileges:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACPrivilege'
+        user:
+          type: string
+        readOnly:
+          type: boolean
+          description: Platform-protected account; mutations are rejected.
+    MongoRBACUserCreate:
+      type: object
+      required:
+        - user
+        - db
+        - password
+        - roles
+      properties:
+        user:
+          type: string
+        db:
+          type: string
+        password:
+          type: string
+          format: password
+        roles:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACRoleRef'
+    MongoRBACResourceCapability:
+      type: object
+      properties:
+        type:
+          type: string
+          description: cluster, database, collection, allDatabases, collectionAcrossDatabases
+        actions:
+          type: array
+          items:
+            type: string
+      required:
+        - type
+        - actions
+    MongoRBACCapabilities:
+      type: object
+      properties:
+        engineVersion:
+          type: string
+        resources:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACResourceCapability'
+    MongoRBACRole:
+      type: object
+      properties:
+        role:
+          type: string
+        db:
+          type: string
+        isBuiltin:
+          type: boolean
+        privileges:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACPrivilege'
+        roles:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACRoleRef'
+        inheritedRoles:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACRoleRef'
+        inheritedPrivileges:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACPrivilege'
+        revision:
+          type: string
+          description: Stale-form fingerprint. updateRole has no native CAS; external concurrent writes are not transactional.
+    MongoRBACRoleWrite:
+      type: object
+      properties:
+        role:
+          type: string
+        db:
+          type: string
+        privileges:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACPrivilege'
+        roles:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACRoleRef'
+        expectedRevision:
+          type: string
+      required:
+        - role
+        - db
+        - privileges
+        - roles
+    MongoRBACBindingChange:
+      type: object
+      properties:
+        action:
+          type: string
+          description: grant or revoke. Incremental; all other native roles are retained.
+        roles:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACRoleRef'
+      required:
+        - action
+        - roles
     clusterJarConfig:
       type: object
       properties:
@@ -29214,21 +30050,6 @@ components:
         - maxFileBytes
         - maxTotalBytes
         - usedBytes
-    APIErrorResponse:
-      description: API error response.
-      properties:
-        code:
-          description: The HTTP status code.
-          type: integer
-        reason:
-          description: The reason for the error.
-          type: string
-        message:
-          description: The message for the error.
-          type: string
-      required:
-        - code
-      type: object
     clusterJarKind:
       type: string
       enum:
@@ -30755,12 +31576,14 @@ components:
     instanceTemplateCreate:
       type: object
       additionalProperties: false
-      description: |
-        Create assignment for one instance template. name and replicas are required. env, annotations, labels, availabilityZone, and storageClass are optional overlays onto the chart-rendered instance. The request must include every chart-rendered instance template exactly once. A template with an explicit zone uses single-zone scheduling: hostname anti-affinity follows the scheduling policy, while explicit rules and additional topology keys are preserved. Component scheduling remains unchanged; templates without a zone inherit it, including its zone anti-affinity constraints. Chart instance scheduling policies are cleared; an omitted or empty availabilityZone leaves the instance policy unset to inherit the component policy.
+      description: Create assignment for one instance template. name and replicas are required. env, annotations, labels, availabilityZone, nodeGroup and storageClass are optional overlays. The request must include every chart-rendered instance template exactly once. Explicit placement requires availabilityZone and optionally accepts nodeGroup, without inheriting upper-level AZ or NodeGroup. Omitting both leaves SchedulingPolicy unset for KubeBlocks default inheritance. Hostname, user scheduling rules and additional topology keys are preserved.
       required:
         - name
         - replicas
       properties:
+        nodeGroup:
+          type: string
+          description: Optional host group in this environment and the explicitly selected availabilityZone. Requires availabilityZone; no upper-level host group is inherited.
         name:
           type: string
           minLength: 1
@@ -30771,7 +31594,7 @@ components:
           description: Replica count for this instance template.
         availabilityZone:
           type: string
-          description: Availability zone for this template (topology.kubernetes.io/zone); omitted or empty inherits the component zone selection. Must be enabled in the environment. If the request explicitly supplies a non-empty cluster availabilityZones list, the template zone must also belong to that list.
+          description: Single AZ for explicit template placement (topology.kubernetes.io/zone). Must be enabled in the environment and is required when nodeGroup is specified. An omitted nodeGroup does not inherit the component or cluster host group. Omitting both leaves SchedulingPolicy unset for KubeBlocks inheritance.
         storageClass:
           type: string
           description: StorageClass name for all persistent volumes in this template. Copied from component volumeClaimTemplates, preserving volume sizes and other settings while overriding storageClassName. Chart instance volume templates are cleared; omitted or empty leaves instance volumeClaimTemplates unset.
@@ -30799,7 +31622,7 @@ components:
           type: object
           additionalProperties:
             type: string
-          description: Label map (string key to string value). Merged into this template; same-name keys overwritten. Chart keys are not deleted.
+          description: Label map (string key to string value). Merged into this template; same-name keys overwritten. Chart keys are not deleted. The apps.kubeblocks.io/instance-template label is managed by the system and must equal the template name if supplied.
     ioQuantity:
       description: IO Quantity describes IOPS and BPS of a volume
       properties:
@@ -30872,6 +31695,12 @@ components:
       required:
         - component
       properties:
+        nodeGroup:
+          type: string
+          description: Optional host group in this environment and the explicitly selected availabilityZone. Requires availabilityZone; no upper-level host group is inherited.
+        availabilityZone:
+          type: string
+          description: Single AZ for explicit component placement. Must be enabled in the environment and is required when nodeGroup is specified. An omitted nodeGroup does not inherit the cluster host group. Omitting both retains cluster scheduling.
         component:
           type: string
           description: component type, refer to componentDef and support NamePrefix
@@ -31211,6 +32040,18 @@ components:
       type: object
       description: ComponentItem is the information of a component
       properties:
+        nodeGroup:
+          type: string
+          description: Optional host group in this environment. Explicit placement does not inherit an upper-level host group.
+        availabilityZone:
+          type: string
+          description: Explicit component AZ selection, if configured.
+        instanceTemplates:
+          type: array
+          x-omitempty: true
+          description: Instance template assignments with effective replicas, placement and storage class, and user-provided env, labels and annotations.
+          items:
+            $ref: '#/components/schemas/instanceTemplateCreate'
         name:
           type: string
           description: component name
@@ -31556,6 +32397,9 @@ components:
         componentDef:
           description: ComponentDefinition name
           type: string
+        instanceTemplate:
+          description: Instance template name within the actual component. Omitted when no template identity is available.
+          type: string
         component:
           description: component type, refer to componentDef and support NamePrefix
           type: string
@@ -40198,6 +41042,12 @@ components:
           type: boolean
           description: whether the component supports custom secret
           x-nullable: false
+    placementScope:
+      type: string
+      description: UI placement input scope for this mode. Omitted defaults to cluster. cluster displays AZ and NodeGroup selection for the cluster. component hides cluster placement and displays selection for each component, or for each instance template when the component declares templates. This does not restrict API placement overrides.
+      enum:
+        - cluster
+        - component
     modeCompatibleKubeblocksVersion:
       type: string
       description: |
@@ -40219,7 +41069,6 @@ components:
         - env
         - annotations
         - labels
-        - availabilityZone
         - storageClass
     instanceTemplateEnv:
       type: object
@@ -40595,6 +41444,8 @@ components:
         - description
         - components
       properties:
+        placementScope:
+          $ref: '#/components/schemas/placementScope'
         name:
           type: string
         title:
@@ -47070,6 +47921,9 @@ components:
         - format
         - items
       properties:
+        databaseName:
+          type: string
+          description: Connection database for native privilege evidence.
         kind:
           type: string
           x-nullable: false
@@ -47339,7 +48193,7 @@ components:
           type: string
           x-nullable: false
           minLength: 1
-          description: Engine-generated SQL for display. Callers cannot submit or modify these steps for execution; reset rebuilds the plan from current grants.
+          description: Engine-generated statement for display (SQL, or a native MongoDB command encoded as JSON). Callers cannot submit or modify these steps for execution; reset rebuilds the plan from current grants.
     ObjectPrivilegeObject:
       type: object
       required: