kb-cloud-client-typescript 2.4.0-alpha.94 → 2.4.0-alpha.96

package/src/adminapi.yaml

@@ -76,6 +76,548 @@ tags:
   - name: disasterRecovery
     description: Cluster Disaster Recovery APIs
 paths:
+  /admin/v1/data/mongodb/organizations/{orgName}/clusters/{clusterName}/rbac/users/{database}/{username}/password:
+    put:
+      summary: ChangeRBACUserPassword
+      operationId: mongoChangeRBACUserPassword
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: username
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MongoRBACPasswordChange'
+  /admin/v1/data/mongodb/organizations/{orgName}/clusters/{clusterName}/rbac/users:
+    get:
+      summary: ListRBACUsers
+      operationId: mongoListRBACUsers
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: query
+          schema:
+            type: string
+            default: admin
+      responses:
+        '200':
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/MongoRBACUser'
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+    post:
+      summary: CreateRBACUser
+      operationId: mongoCreateRBACUser
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MongoRBACUserCreate'
+  /admin/v1/data/mongodb/organizations/{orgName}/clusters/{clusterName}/rbac/capabilities:
+    get:
+      summary: GetRBACCapabilities
+      operationId: mongoGetRBACCapabilities
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MongoRBACCapabilities'
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+  /admin/v1/data/mongodb/organizations/{orgName}/clusters/{clusterName}/rbac/roles:
+    get:
+      summary: ListRBACRoles
+      operationId: mongoListRBACRoles
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: query
+          schema:
+            type: string
+            default: admin
+      responses:
+        '200':
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/MongoRBACRole'
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+    post:
+      summary: CreateRBACRole
+      operationId: mongoCreateRBACRole
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MongoRBACRoleWrite'
+  /admin/v1/data/mongodb/organizations/{orgName}/clusters/{clusterName}/rbac/roles/{database}/{roleName}:
+    get:
+      summary: GetRBACRole
+      operationId: mongoGetRBACRole
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: roleName
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MongoRBACRole'
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+    put:
+      summary: UpdateRBACRole
+      operationId: mongoUpdateRBACRole
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: roleName
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MongoRBACRoleWrite'
+    delete:
+      summary: DeleteRBACRole
+      operationId: mongoDeleteRBACRole
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: roleName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: expectedRevision
+          in: query
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+  /admin/v1/data/mongodb/organizations/{orgName}/clusters/{clusterName}/rbac/users/{database}/{username}:
+    get:
+      summary: GetRBACUser
+      operationId: mongoGetRBACUser
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: username
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MongoRBACUser'
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+    delete:
+      summary: DeleteRBACUser
+      operationId: mongoDeleteRBACUser
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: username
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+  /admin/v1/data/mongodb/organizations/{orgName}/clusters/{clusterName}/rbac/users/{database}/{username}/roles:
+    patch:
+      summary: ChangeRBACUserRoles
+      operationId: mongoChangeRBACUserRoles
+      tags:
+        - mongodb
+        - account
+        - shared
+      parameters:
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: database
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: username
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '204':
+          description: Success
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          description: Conflict; refresh or remove role bindings first
+        '500':
+          $ref: '#/components/responses/500'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MongoRBACBindingChange'
   /admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/jars/config:
     get:
       operationId: getClusterJarConfig
@@ -24049,126 +24591,212 @@ paths:
           description: Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
         - name: subjectQualifiers
           in: query
-          required: false
-          schema:
-            type: string
-          description: JSON object of string identity qualifiers, e.g. {"host":"%"}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/ObjectPrivilegeChange'
-      responses:
-        '204':
-          description: Native statement completed. Query privileges again to inspect remaining access.
-        '400':
-          $ref: '#/components/responses/400'
-        '401':
-          $ref: '#/components/responses/401'
-        '403':
-          $ref: '#/components/responses/403'
-        '404':
-          $ref: '#/components/responses/404'
-        '409':
-          $ref: '#/components/responses/409'
-        '500':
-          $ref: '#/components/responses/500'
-      x-codegen-request-body-name: body
-  /admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/capabilities:
-    get:
-      tags:
-        - account
-        - rdbms
-        - shared
-      summary: List native object privilege capabilities for the connected server
-      operationId: getAccountObjectPrivilegeCapabilities
-      description: Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
-      parameters:
-        - name: engineName
-          in: path
-          required: true
-          schema:
-            type: string
-        - name: orgName
-          in: path
-          required: true
-          schema:
-            type: string
-        - name: clusterName
-          in: path
-          required: true
-          schema:
-            type: string
-        - name: accountName
-          in: path
-          required: true
-          schema:
-            type: string
-      responses:
-        '200':
-          description: Native privilege snapshot
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ObjectPrivilegeCapabilities'
-        '400':
-          $ref: '#/components/responses/400'
-        '401':
-          $ref: '#/components/responses/401'
-        '403':
-          $ref: '#/components/responses/403'
-        '404':
-          $ref: '#/components/responses/404'
-        '500':
-          $ref: '#/components/responses/500'
-  /admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/reset:
-    get:
-      tags:
-        - account
-        - rdbms
-        - shared
-      summary: Preview clearing all MySQL account privileges
-      operationId: previewAccountPrivilegeReset
-      description: MySQL only. Clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections.
-      parameters:
-        - name: engineName
-          in: path
-          required: true
-          schema:
-            type: string
-        - name: orgName
-          in: path
-          required: true
-          schema:
-            type: string
-        - name: clusterName
-          in: path
-          required: true
-          schema:
-            type: string
-        - name: accountName
-          in: path
-          required: true
+          required: false
+          schema:
+            type: string
+          description: JSON object of string identity qualifiers, e.g. {"host":"%"}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/ObjectPrivilegeChange'
+      responses:
+        '204':
+          description: Native statement completed. Query privileges again to inspect remaining access.
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '409':
+          $ref: '#/components/responses/409'
+        '500':
+          $ref: '#/components/responses/500'
+      x-codegen-request-body-name: body
+  /admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/capabilities:
+    get:
+      tags:
+        - account
+        - rdbms
+        - shared
+      summary: List native object privilege capabilities for the connected server
+      operationId: getAccountObjectPrivilegeCapabilities
+      description: Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+      parameters:
+        - name: engineName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: accountName
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Native privilege snapshot
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ObjectPrivilegeCapabilities'
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '500':
+          $ref: '#/components/responses/500'
+  /admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/overview:
+    get:
+      tags:
+        - account
+        - rdbms
+        - shared
+      summary: Read native account privilege summary or selected database evidence
+      operationId: getAccountPrivilegeOverview
+      description: Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+      parameters:
+        - name: engineName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: accountName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: subjectType
+          in: query
+          required: false
+          schema:
+            $ref: '#/components/schemas/ObjectPrivilegeSubjectType'
+          description: Native subject kind; path account name identifies the subject.
+        - name: host
+          in: query
+          required: false
+          schema:
+            type: string
+          description: Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+        - name: subjectQualifiers
+          in: query
+          schema:
+            type: string
+        - name: databaseName
+          in: query
+          description: PostgreSQL database to inspect on demand. Omit for the global summary.
+          required: false
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Native evidence groups for the requested scope
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/ObjectPrivilegeEvidence'
+        '400':
+          $ref: '#/components/responses/400'
+        '401':
+          $ref: '#/components/responses/401'
+        '403':
+          $ref: '#/components/responses/403'
+        '404':
+          $ref: '#/components/responses/404'
+        '500':
+          $ref: '#/components/responses/500'
+  /admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/reset:
+    get:
+      tags:
+        - account
+        - rdbms
+        - shared
+      summary: Preview clearing explicit account privileges
+      operationId: previewAccountPrivilegeReset
+      description: MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+      parameters:
+        - name: engineName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: orgName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: clusterName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: accountName
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: subjectType
+          in: query
+          required: false
+          schema:
+            $ref: '#/components/schemas/ObjectPrivilegeSubjectType'
+          description: Native subject kind; path account name identifies the subject.
+        - name: host
+          in: query
+          required: false
+          schema:
+            type: string
+          description: Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+        - name: subjectQualifiers
+          in: query
           schema:
             type: string
-        - name: subjectType
-          in: query
-          required: false
-          schema:
-            $ref: '#/components/schemas/ObjectPrivilegeSubjectType'
-          description: Native subject kind; path account name identifies the subject.
-        - name: host
+          description: JSON identity qualifiers; MySQL host defaults to %.
+        - name: databaseNames
           in: query
-          required: false
+          style: form
+          explode: true
+          description: PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
           schema:
-            type: string
-          description: Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
-        - name: subjectQualifiers
+            type: array
+            items:
+              type: string
+        - name: allDatabases
           in: query
+          description: PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
           schema:
-            type: string
-          description: JSON identity qualifiers; MySQL host defaults to %.
+            type: boolean
+            default: false
       responses:
         '200':
           description: Server-generated steps with connection database, in execution order
@@ -24193,9 +24821,9 @@ paths:
         - account
         - rdbms
         - shared
-      summary: Clear all MySQL account privileges
+      summary: Clear explicit account privileges
       operationId: resetAccountPrivileges
-      description: MySQL only. Clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections.
+      description: MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
       parameters:
         - name: engineName
           in: path
@@ -24234,6 +24862,21 @@ paths:
           schema:
             type: string
           description: JSON identity qualifiers; MySQL host defaults to %.
+        - name: databaseNames
+          in: query
+          style: form
+          explode: true
+          description: PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+          schema:
+            type: array
+            items:
+              type: string
+        - name: allDatabases
+          in: query
+          description: PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+          schema:
+            type: boolean
+            default: false
       responses:
         '204':
           description: Privileges cleared; account and password preserved
@@ -24255,7 +24898,7 @@ paths:
         - shared
       summary: List exact column names for account object privileges
       operationId: listAccountObjectPrivilegeColumns
-      description: Read MySQL table or view column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+      description: Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
       parameters:
         - name: engineName
           in: path
@@ -24280,7 +24923,7 @@ paths:
         - name: objectType
           in: query
           required: true
-          description: Object type, either table or view
+          description: Object type, table/view; PostgreSQL also supports materializedView/foreignTable
           schema:
             type: string
         - name: databaseName
@@ -24293,6 +24936,11 @@ paths:
           required: true
           schema:
             type: string
+        - name: schemaName
+          in: query
+          description: Required for PostgreSQL; not accepted for MySQL
+          schema:
+            type: string
       responses:
         '200':
           description: Exact column names in catalog order; empty if no visible columns exist
@@ -29187,6 +29835,194 @@ components:
         curl --digest -u "accessKey:secretKey" https://api.example.com/admin/v1/user
         ```
   schemas:
+    MongoRBACPasswordChange:
+      type: object
+      required:
+        - password
+      properties:
+        password:
+          type: string
+          format: password
+    APIErrorResponse:
+      description: API error response.
+      properties:
+        code:
+          description: The HTTP status code.
+          type: integer
+        reason:
+          description: The reason for the error.
+          type: string
+        message:
+          description: The message for the error.
+          type: string
+      required:
+        - code
+      type: object
+    MongoRBACRoleRef:
+      type: object
+      properties:
+        role:
+          type: string
+        db:
+          type: string
+      required:
+        - role
+        - db
+    MongoRBACResource:
+      type: object
+      properties:
+        cluster:
+          type: boolean
+        db:
+          type: string
+          x-nullable: true
+          description: Preserve an explicit empty string for native wildcard scope; omit only for cluster resources.
+        collection:
+          type: string
+          x-nullable: true
+          description: Preserve an explicit empty string for native wildcard scope; omit only for cluster resources.
+        anyResource:
+          type: boolean
+          description: Read-only native evidence; write requests reject this internal resource.
+      description: Native MongoDB resource. cluster:true is system operations, not all database data. Empty db/collection are explicit wildcard scopes; system collections need explicit resources.
+    MongoRBACPrivilege:
+      type: object
+      properties:
+        resource:
+          $ref: '#/components/schemas/MongoRBACResource'
+        actions:
+          type: array
+          items:
+            type: string
+      required:
+        - resource
+        - actions
+    MongoRBACUser:
+      type: object
+      properties:
+        db:
+          type: string
+        roles:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACRoleRef'
+        inheritedRoles:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACRoleRef'
+        inheritedPrivileges:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACPrivilege'
+        user:
+          type: string
+        readOnly:
+          type: boolean
+          description: Platform-protected account; mutations are rejected.
+    MongoRBACUserCreate:
+      type: object
+      required:
+        - user
+        - db
+        - password
+        - roles
+      properties:
+        user:
+          type: string
+        db:
+          type: string
+        password:
+          type: string
+          format: password
+        roles:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACRoleRef'
+    MongoRBACResourceCapability:
+      type: object
+      properties:
+        type:
+          type: string
+          description: cluster, database, collection, allDatabases, collectionAcrossDatabases
+        actions:
+          type: array
+          items:
+            type: string
+      required:
+        - type
+        - actions
+    MongoRBACCapabilities:
+      type: object
+      properties:
+        engineVersion:
+          type: string
+        resources:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACResourceCapability'
+    MongoRBACRole:
+      type: object
+      properties:
+        role:
+          type: string
+        db:
+          type: string
+        isBuiltin:
+          type: boolean
+        privileges:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACPrivilege'
+        roles:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACRoleRef'
+        inheritedRoles:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACRoleRef'
+        inheritedPrivileges:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACPrivilege'
+        revision:
+          type: string
+          description: Stale-form fingerprint. updateRole has no native CAS; external concurrent writes are not transactional.
+    MongoRBACRoleWrite:
+      type: object
+      properties:
+        role:
+          type: string
+        db:
+          type: string
+        privileges:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACPrivilege'
+        roles:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACRoleRef'
+        expectedRevision:
+          type: string
+      required:
+        - role
+        - db
+        - privileges
+        - roles
+    MongoRBACBindingChange:
+      type: object
+      properties:
+        action:
+          type: string
+          description: grant or revoke. Incremental; all other native roles are retained.
+        roles:
+          type: array
+          items:
+            $ref: '#/components/schemas/MongoRBACRoleRef'
+      required:
+        - action
+        - roles
     clusterJarConfig:
       type: object
       properties:
@@ -29214,21 +30050,6 @@ components:
         - maxFileBytes
         - maxTotalBytes
         - usedBytes
-    APIErrorResponse:
-      description: API error response.
-      properties:
-        code:
-          description: The HTTP status code.
-          type: integer
-        reason:
-          description: The reason for the error.
-          type: string
-        message:
-          description: The message for the error.
-          type: string
-      required:
-        - code
-      type: object
     clusterJarKind:
       type: string
       enum:
@@ -47100,6 +47921,9 @@ components:
         - format
         - items
       properties:
+        databaseName:
+          type: string
+          description: Connection database for native privilege evidence.
         kind:
           type: string
           x-nullable: false
@@ -47369,7 +48193,7 @@ components:
           type: string
           x-nullable: false
           minLength: 1
-          description: Engine-generated SQL for display. Callers cannot submit or modify these steps for execution; reset rebuilds the plan from current grants.
+          description: Engine-generated statement for display (SQL, or a native MongoDB command encoded as JSON). Callers cannot submit or modify these steps for execution; reset rebuilds the plan from current grants.
     ObjectPrivilegeObject:
       type: object
       required: