cmdbsyncer 4.0.3__tar.gz → 4.1.0.dev1__tar.gz

{cmdbsyncer-4.0.3/cmdbsyncer.egg-info → cmdbsyncer-4.1.0.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmdbsyncer
-Version: 4.0.3
+Version: 4.1.0.dev1
 Summary: Rule-based modular synchronizer for Checkmk, Netbox, Ansible, I-DOIT, Jira CMDB and 15+ other CMDB/monitoring systems
 Author-email: Kuhn & Ruess GmbH <info@kuhn-ruess.de>
 Maintainer-email: Bastian Kuhn <mail@bastian-kuhn.de>
@@ -63,6 +63,7 @@ Requires-Dist: pykerberos==1.2.4; extra == "ansible"
 Requires-Dist: pywinrm==0.4.3; extra == "ansible"
 Requires-Dist: ntlm-auth==1.5.0; extra == "ansible"
 Requires-Dist: ansible==10.5.0; extra == "ansible"
+Requires-Dist: cmdbsyncer-inventory==0.1.4; extra == "ansible"
 Dynamic: license-file
 
 # CMDBsyncer

{cmdbsyncer-4.0.3 → cmdbsyncer-4.1.0.dev1}/application/__init__.py

@@ -202,6 +202,50 @@ if not CLI_MODE:
         """
         app.config['CHANGES'] = get_changes()
 
+    @app.context_processor
+    def _inject_pending_approvals():
+        """
+        Feed the navbar badge in master.html. Runs on every admin
+        request, so it must be cheap and fail-soft — the count is a
+        nicety, not a correctness requirement.
+        """
+        # pylint: disable=import-outside-toplevel
+        from flask_login import current_user as _user
+        if not app.config.get('CMDB_MODE'):
+            return {'pending_approval_count': 0}
+        try:
+            if not _user.is_authenticated:
+                return {'pending_approval_count': 0}
+            from application.views.field_approval import pending_count
+            count = pending_count()
+        except Exception:  # pylint: disable=broad-exception-caught
+            return {'pending_approval_count': 0}
+        return {
+            'pending_approval_count': count,
+            'pending_approval_url': '/admin/fieldapproval/',
+        }
+
+    @app.context_processor
+    def _inject_user_theme():
+        """Expose the logged-in user's theme to ``_theme.html``.
+        Anonymous visitors and any error path fall back to the
+        default theme so the public templates (login, license)
+        render the same as before. Themes that no longer exist on
+        disk (e.g. an operator removed the CSS file) also fall
+        back, so a stale ``user.theme`` value never 404s."""
+        # pylint: disable=import-outside-toplevel
+        from flask_login import current_user as _user
+        from application.themes_registry import is_known
+        try:
+            if _user.is_authenticated:
+                slug = _user.theme or 'default'
+                if not is_known(slug):
+                    slug = 'default'
+                return {'user_theme': slug}
+        except Exception:  # pylint: disable=broad-exception-caught
+            pass
+        return {'user_theme': 'default'}
+
     @app.context_processor
     def _inject_https_warning():
         """Show a banner when HTTPS is required (default) but the
@@ -283,6 +327,12 @@ def _plugin_packages():
     return [p for p in (external_plugins_package, plugins_package) if p is not None]
 
 
+# Cached list of dotted plugin module names. Populated by
+# ``_import_all_plugins`` so the web-layer doesn't have to walk the
+# plugin packages with ``pkgutil.iter_modules`` a second time at startup.
+_DISCOVERED_PLUGIN_MODULES = []
+
+
 def _import_all_plugins():
     """Import every enabled plugin module so its side-effect registrations
     fire — Click CLI groups, sync hooks, cron entries.
@@ -292,8 +342,10 @@ def _import_all_plugins():
     here; they are web-only and handled by
     ``_register_all_plugin_admin_views``.
     """
+    _DISCOVERED_PLUGIN_MODULES.clear()
     for package in _plugin_packages():
         for module_name in _iter_enabled_plugin_modules(package):
+            _DISCOVERED_PLUGIN_MODULES.append(module_name)
             try:
                 importlib.import_module(module_name)
             except Exception:  # pylint: disable=broad-exception-caught
@@ -303,11 +355,7 @@ def _import_all_plugins():
 
 
 def _register_all_plugin_admin_views(admin_):
-    plugin_modules = []
-    for package in _plugin_packages():
-        plugin_modules.extend(_iter_enabled_plugin_modules(package))
-
-    for module_name in plugin_modules:
+    for module_name in _DISCOVERED_PLUGIN_MODULES:
         admin_module_name = f"{module_name}.admin_views"
         try:
             admin_module = importlib.import_module(admin_module_name)
@@ -343,8 +391,19 @@ def _register_web_layer():  # pylint: disable=too-many-locals,too-many-statement
     from application.auth.views import AUTH
     app.register_blueprint(AUTH)
 
+    from application.themes_registry import init_themes, themes_blueprint
+    init_themes(app)
+    app.register_blueprint(themes_blueprint)
+
     from application.api.views import API_BP as api
     app.register_blueprint(api, url_prefix="/api/v1")
+    # Intentional: every /api/v1 route authenticates per request via
+    # @require_token (Basic Auth) or @require_api_role, so CSRF tokens
+    # would only break external clients (CLI, MCP, Ansible inventory
+    # pulls, Grafana scrapes — none of which fetch a CSRF cookie). The
+    # invariant that no /api/v1/* route falls back to session auth is
+    # enforced by tests/test_api_csrf_invariant.py — DO NOT remove this
+    # exempt during a code review without first reading that test.
     csrf.exempt(api)
 
     # Give the enterprise package a chance to register its own auth-related
@@ -383,9 +442,14 @@ def _register_web_layer():  # pylint: disable=too-many-locals,too-many-statement
 
     #   .-- Host
     from application.models.host import Host
-    from application.views.host import HostModelView, ObjectModelView, TemplateModelView
+    from application.views.host import (
+        HostArchiveView, HostModelView, ObjectModelView, TemplateModelView,
+    )
     admin.add_view(HostModelView(Host, name="Hosts",
                                  menu_icon_type='fa', menu_icon_value='fa-server'))
+
+
+
     admin.add_category(name="Objects", icon_type='fa', icon_value='fa-folder-open')
     admin.add_view(ObjectModelView(Host, name="All Objects", endpoint="Objects",
                                    category="Objects",
@@ -393,6 +457,14 @@ def _register_web_layer():  # pylint: disable=too-many-locals,too-many-statement
     admin.add_view(TemplateModelView(Host, name="Templates", endpoint="Objects Templates",
                                      category="Objects",
                                      menu_icon_type='fa', menu_icon_value='fa-files-o'))
+    admin.add_view(HostArchiveView(Host, name="Archive", endpoint="archive",
+                                   category="Objects",
+                                   menu_icon_type='fa', menu_icon_value='fa-archive'))
+    from application.views.data_quality import DataQualityView
+    admin.add_view(DataQualityView(name="Data Quality", endpoint="data_quality",
+                                   category="Objects",
+                                   menu_icon_type='fa',
+                                   menu_icon_value='fa-stethoscope'))
     #.
     #   .-- Global
     from application.modules.custom_attributes.models import CustomAttributeRule
@@ -438,6 +510,12 @@ def _register_web_layer():  # pylint: disable=too-many-locals,too-many-statement
     admin.add_sub_category(name="Compliance", parent_name="Settings")
     admin.add_sub_category(name="Notifications", parent_name="Settings")
     admin.add_sub_category(name="Backups", parent_name="Settings")
+    from application.models.field_approval import FieldApproval
+    from application.views.field_approval import FieldApprovalView
+    admin.add_view(FieldApprovalView(FieldApproval, name="Approvals",
+                                     category="Settings",
+                                     menu_icon_type='fa',
+                                     menu_icon_value='fa-hourglass-half'))
 
     from application.modules.log.models import LogEntry
     from application.modules.log.views import LogView
@@ -459,6 +537,13 @@ def _register_web_layer():  # pylint: disable=too-many-locals,too-many-statement
                             endpoint='config.local_config_editor',
                             icon_type='fa', icon_value='fa-file-code-o'))
 
+    from application.models.saved_search import SavedSearch
+    from application.views.saved_search import SavedSearchView
+    admin.add_view(SavedSearchView(SavedSearch, name="Saved Searches",
+                                   category="Settings",
+                                   menu_icon_type='fa',
+                                   menu_icon_value='fa-bookmark'))
+
     from application.views.license import LicenseView
     admin.add_view(LicenseView(name="License", endpoint="license", category="Settings",
                                menu_icon_type='fa', menu_icon_value='fa-id-card'))
@@ -493,6 +578,9 @@ def _register_web_layer():  # pylint: disable=too-many-locals,too-many-statement
     admin.add_link(MenuLink(name='Set 2FA Code', category='Account',
                             url=f"{app.config['BASE_PREFIX']}set-2fa",
                             icon_type='fa', icon_value='fa-shield'))
+    admin.add_link(MenuLink(name='Theme', category='Account',
+                            url=f"{app.config['BASE_PREFIX']}set-theme",
+                            icon_type='fa', icon_value='fa-paint-brush'))
     admin.add_link(MenuLink(name='Logout', category='Account',
                             url=f"{app.config['BASE_PREFIX']}logout",
                             icon_type='fa', icon_value='fa-sign-out'))

{cmdbsyncer-4.0.3 → cmdbsyncer-4.1.0.dev1}/application/api/__init__.py

@@ -5,6 +5,7 @@ API
 from functools import wraps
 from flask import abort, request, current_app
 from mongoengine.errors import DoesNotExist, MultipleObjectsReturned
+from application.helpers.audit import audit
 from application.models.account import Account
 from application.models.user import User
 from application import log
@@ -73,15 +74,38 @@ def _authenticate_user():
     except DoesNotExist:
         _abort_unauthorized("Invalid credentials")
     except MultipleObjectsReturned:
-        user_result = next(
-            (candidate for candidate in User.objects(
-                disabled__ne=True,
-                __raw__={'$or': [{'name': username}, {'email': username}]}
-            ) if candidate.check_password(user_password)),
-            None,
-        )
-        if user_result is None:
+        # Several users match the same login string. Historically this
+        # happens when the `name` field (added later, sparse) accidentally
+        # matches another account's `email`. We can't drop the branch —
+        # purging or unique-indexing the existing duplicates breaks logins
+        # for users whose `name` was empty when the field was introduced.
+        # So: walk every candidate (constant-time, no early exit) and
+        # surface the collision as an audit event so it can be cleaned up.
+        candidates = list(User.objects(
+            disabled__ne=True,
+            __raw__={'$or': [{'name': username}, {'email': username}]}
+        ))
+        # Constant-time match: check every candidate so a wrong password
+        # against the first colliding user takes the same time as the
+        # last, which keeps timing from leaking *which* duplicate exists.
+        match = None
+        for candidate in candidates:
+            if candidate.check_password(user_password) and match is None:
+                match = candidate
+        audit('user.login.collision',
+              outcome='success' if match else 'failure',
+              actor_type='user',
+              actor_id=str(match.id) if match else None,
+              actor_name=username,
+              metadata={
+                  'reason': 'multiple users matched login string',
+                  'candidate_count': len(candidates),
+                  'candidate_ids': [str(c.id) for c in candidates],
+                  'matched_id': str(match.id) if match else None,
+              })
+        if match is None:
             _abort_unauthorized("Invalid credentials")
+        return match, username
     if not user_result.check_password(user_password):
         _abort_unauthorized("Invalid credentials")
     return user_result, username

cmdbsyncer-4.1.0.dev1/application/api/inventory.py

@@ -0,0 +1,54 @@
+"""
+Ansible namespace — inventory provider HTTP endpoints.
+
+The cross-module provider registry (`application.modules.inventory`)
+holds named providers. This namespace exposes them in the Ansible JSON
+shape under `/api/v1/ansible/inventory/<provider>` — same convention
+as the CLI (`cmdbsyncer ansible inventory <provider>`), so URL and
+command path read in the same order.
+
+Both the CLI and this HTTP endpoint share `render_ansible_inventory`,
+so data and format stay in lockstep regardless of how a consumer
+reaches them.
+"""
+from flask import request
+from flask_restx import Namespace, Resource
+
+from application.api import require_token
+from application.modules.inventory import (
+    list_inventory_providers,
+    render_ansible_inventory,
+)
+
+API = Namespace('ansible', description='Ansible-side endpoints (inventory provider)')
+
+
+@API.route('/inventory')
+class AnsibleProviderIndex(Resource):
+    """List the providers the Ansible-format adapter can serve."""
+
+    @require_token
+    def get(self):
+        """Names of all registered inventory providers."""
+        return {'providers': list_inventory_providers()}
+
+
+@API.route('/inventory/<provider>')
+class AnsibleProviderInventory(Resource):
+    """Full inventory for `provider`, in Ansible JSON shape.
+
+    Pass `?host=NAME` to get a single host's vars dict instead of the
+    full catalog — same contract Ansible expects from a dynamic
+    inventory script.
+    """
+
+    @require_token
+    def get(self, provider):
+        """Render the provider in Ansible-format JSON."""
+        host = request.args.get('host')
+        result = render_ansible_inventory(provider, host=host)
+        if result is None:
+            return {'message': f'Unknown provider: {provider}'}, 404
+        if result is False:
+            return {'message': f'Host not found: {host}'}, 404
+        return result

{cmdbsyncer-4.0.3 → cmdbsyncer-4.1.0.dev1}/application/api/objects.py

@@ -11,8 +11,11 @@ from mongoengine.errors import DoesNotExist
 
 from flask import request, abort
 from flask_restx import Namespace, Resource, reqparse, fields
+from application import app
 from application.api import require_token
-from application.models.host import Host
+from application.models.host import (
+    Host, HostError, RELATION_TYPES, RELATION_INVERSE_LABEL,
+)
 # @TODO pre_deletion method for Host so no import needed
 from application.plugins.checkmk.models import CheckmkFolderPool
 
@@ -164,6 +167,41 @@ LIST_RESPONSE = API.model('list_response', {
     '_links': fields.Nested(LIST_LINKS),
 })
 
+_RELATION_TYPE_VALUES = [t for t, _ in RELATION_TYPES]
+
+RELATION_INPUT = API.model('relation_input', {
+    'type': fields.String(required=True, enum=_RELATION_TYPE_VALUES,
+                          description='Edge type. One of: '
+                                      + ', '.join(_RELATION_TYPE_VALUES)),
+    'target': fields.String(required=True,
+                            description='Hostname of the target object.'),
+    'source': fields.String(required=False, default='manual',
+                            description='Free-form provenance tag '
+                                        '(default "manual"). Stored on the '
+                                        'edge so importers can later prune '
+                                        'their own edges without touching '
+                                        'manual ones.'),
+})
+
+RELATION_ITEM = API.model('relation_item', {
+    'type': fields.String(description='Edge type code'),
+    'type_label': fields.String(description='Human label for the type'),
+    'target': fields.String(description='Target hostname'),
+    'source': fields.String(description='Provenance tag (manual / import / …)'),
+})
+
+RELATIONS_RESPONSE = API.model('relations_response', {
+    'hostname': fields.String,
+    'outgoing': fields.List(fields.Nested(RELATION_ITEM)),
+    'inbound': fields.List(fields.Nested(RELATION_ITEM)),
+})
+
+
+def _require_cmdb_mode():
+    """Abort with 404 unless CMDB_MODE is enabled."""
+    if not app.config.get('CMDB_MODE'):
+        abort(404, 'CMDB_MODE is disabled on this install.')
+
 
 # ---------------------------------------------------------------------------
 # Endpoints
@@ -393,9 +431,13 @@ parser.add_argument('start', type=int, help='Pagination start')
 parser.add_argument('limit', type=int, help='Pagination limit')
 
 
+MAX_PAGE_LIMIT = 10000
+
+
 @API.route('/all')
 @API.param('start', 'Zero-based page offset. Default ``1``.', type='integer')
-@API.param('limit', 'Page size, max items returned per call. Default ``100``.',
+@API.param('limit', 'Page size, max items returned per call. Default ``100``,'
+                    f' max ``{MAX_PAGE_LIMIT}``.',
            type='integer')
 class HostDetailListApi(Resource):
     """Paginated listing of every host."""
@@ -403,7 +445,8 @@ class HostDetailListApi(Resource):
     @API.doc(security=['x-login-user', 'basicAuth'])
     @API.response(200, 'A page of host objects plus pagination links.',
                   LIST_RESPONSE)
-    @API.response(400, 'Pagination params not numeric or negative.', ERROR)
+    @API.response(400, 'Pagination params not numeric, negative, or limit '
+                       f'above {MAX_PAGE_LIMIT}.', ERROR)
     @API.response(401, 'Authentication failed', ERROR)
     @require_token
     def get(self):
@@ -420,6 +463,8 @@ class HostDetailListApi(Resource):
             abort(400, "start and limit must be integers")
         if start < 0 or limit < 0:
             abort(400, "start and limit must be non-negative")
+        if limit > MAX_PAGE_LIMIT:
+            abort(400, f"limit must be <= {MAX_PAGE_LIMIT}")
         end = start+limit
 
         db_objecs = Host.objects(is_object__ne=True)
@@ -441,3 +486,124 @@ class HostDetailListApi(Resource):
             'size': total,
             '_links': links,
         }
+
+
+@API.route('/<hostname>/relations')
+@API.param('hostname', 'Existing host name. CMDB_MODE only.')
+class HostRelationsApi(Resource):
+    """
+    Read, add or remove typed Host relations.
+
+    Only available when ``CMDB_MODE`` is True. Outgoing edges live on
+    the source host; inbound edges are computed via a Mongo query and
+    are read-only on this endpoint (mutate them on the source host).
+    """
+
+    @staticmethod
+    def _serialize_outgoing(host):
+        type_label = dict(RELATION_TYPES)
+        out = []
+        for rel in (host.relations or []):
+            target = rel.target_host
+            if not target:
+                continue
+            out.append({
+                'type': rel.type,
+                'type_label': type_label.get(rel.type, rel.type),
+                'target': target.hostname,
+                'source': rel.source or '',
+            })
+        return out
+
+    @staticmethod
+    def _serialize_inbound(host):
+        if not host.pk:
+            return []
+        out = []
+        sources = Host.objects(__raw__={'relations.target_host': host.pk}).only(
+            'hostname', 'relations'
+        )
+        for src in sources:
+            for rel in (src.relations or []):
+                if rel.target_host and rel.target_host.pk == host.pk:
+                    out.append({
+                        'type': rel.type,
+                        'type_label': RELATION_INVERSE_LABEL.get(rel.type,
+                                                                 rel.type),
+                        'target': src.hostname,
+                        'source': rel.source or '',
+                    })
+        return out
+
+    @API.doc(security=['x-login-user', 'basicAuth'])
+    @API.response(200, 'Outgoing and inbound edges for this host.',
+                  RELATIONS_RESPONSE)
+    @API.response(401, 'Authentication failed', ERROR)
+    @API.response(404, 'Host not found or CMDB_MODE disabled.', ERROR)
+    @require_token
+    def get(self, hostname):
+        """List outgoing + inbound relations for *hostname*."""
+        _require_cmdb_mode()
+        try:
+            host = Host.objects.get(hostname=hostname)
+        except DoesNotExist:
+            return {'error': 'Host not found'}, 404
+        return {
+            'hostname': hostname,
+            'outgoing': self._serialize_outgoing(host),
+            'inbound': self._serialize_inbound(host),
+        }
+
+    @API.doc(security=['x-login-user', 'basicAuth'])
+    @API.expect(RELATION_INPUT, validate=True)
+    @API.response(200, 'Relation added (or no-op if it already existed).',
+                  STATUS)
+    @API.response(400, 'Unknown relation type or self-edge.', ERROR)
+    @API.response(401, 'Authentication failed', ERROR)
+    @API.response(404, 'Source or target host not found, or CMDB_MODE off.',
+                  ERROR)
+    @require_token
+    def post(self, hostname):
+        """Add a relation from *hostname* to ``target``."""
+        _require_cmdb_mode()
+        body = request.json or {}
+        target_name = body.get('target')
+        rtype = body.get('type')
+        rsource = body.get('source') or 'manual'
+        try:
+            host = Host.objects.get(hostname=hostname)
+            target = Host.objects.get(hostname=target_name)
+        except DoesNotExist:
+            return {'error': 'Host or target not found'}, 404
+        try:
+            added = host.add_relation(target, rtype, source=rsource)
+        except HostError as exc:
+            abort(400, str(exc))
+        if added:
+            host.save()
+            return {'status': 'added'}, 200
+        return {'status': 'unchanged'}, 200
+
+    @API.doc(security=['x-login-user', 'basicAuth'])
+    @API.expect(RELATION_INPUT, validate=True)
+    @API.response(200, 'Relation removed (or no-op if it never existed).',
+                  STATUS)
+    @API.response(401, 'Authentication failed', ERROR)
+    @API.response(404, 'Source or target host not found, or CMDB_MODE off.',
+                  ERROR)
+    @require_token
+    def delete(self, hostname):
+        """Remove the relation ``(type, target)`` from *hostname*."""
+        _require_cmdb_mode()
+        body = request.json or {}
+        target_name = body.get('target')
+        rtype = body.get('type')
+        try:
+            host = Host.objects.get(hostname=hostname)
+            target = Host.objects.get(hostname=target_name)
+        except DoesNotExist:
+            return {'error': 'Host or target not found'}, 404
+        if host.remove_relation(target, rtype):
+            host.save()
+            return {'status': 'removed'}, 200
+        return {'status': 'unchanged'}, 200

{cmdbsyncer-4.0.3 → cmdbsyncer-4.1.0.dev1}/application/api/rules.py

@@ -14,6 +14,7 @@ import json
 from flask import request
 from flask_restx import Namespace, Resource, fields
 
+from application import log
 from application.api import require_token
 from application.plugins.rules.rule_definitions import rules as enabled_rules
 from application.plugins.rules.rule_import_export import (
@@ -105,11 +106,21 @@ AUTORULES_RESPONSE = API.model('autorules_response', {
 
 
 def _decode_rule_lines(rules):
-    """Yield JSON dicts from ``to_json()`` strings."""
+    """Yield JSON dicts from ``to_json()`` strings.
+
+    Skipped lines are surfaced in the syncer Log so a corrupted rule
+    document doesn't silently disappear from /rules/<type> exports.
+    """
     for raw in rules:
         try:
             yield json.loads(raw)
-        except (ValueError, TypeError):
+        except (ValueError, TypeError) as exp:
+            preview = (raw[:200] + '…') if isinstance(raw, str) and len(raw) > 200 else raw
+            log.log(
+                f"Skipping rule with invalid JSON: {exp}",
+                source='api.rules',
+                details=[('error', str(exp)), ('preview', str(preview))],
+            )
             continue
 
 

{cmdbsyncer-4.0.3 → cmdbsyncer-4.1.0.dev1}/application/api/syncer.py

@@ -8,7 +8,6 @@ namespace. The ``/cron/trigger/<group>`` route additionally accepts an
 ``X-Webhook-Token`` header tied to the CronGroup, so external systems
 can fire a sync without carrying a user credential.
 """
-import hmac
 from datetime import datetime, timedelta
 from mongoengine.errors import DoesNotExist
 from flask import request
@@ -302,7 +301,13 @@ class SyncerCronTriggerApi(Resource):
 
         token = request.headers.get('X-Webhook-Token')
         if auth_method is None and token:
-            if not group.webhook_enabled or not group.webhook_token:
+            # Hash-on-read: legacy rows still carrying plaintext get
+            # upgraded the first time they authenticate after the
+            # rollout, so operators don't have to run a separate
+            # migration step.
+            if group.migrate_legacy_webhook_token():
+                group.save()
+            if not group.webhook_enabled or not group.webhook_token_hash:
                 log.log("Webhook trigger rejected", source="API",
                         details=[('group', group_name),
                                  ('reason', 'webhook disabled or no token set'),
@@ -313,8 +318,8 @@ class SyncerCronTriggerApi(Resource):
                       target_name=group_name,
                       metadata={'reason': 'webhook disabled or no token set'})
                 return {'error': "Webhook not enabled for this group"}, 403
-            # hmac.compare_digest prevents timing-based token discovery.
-            if not hmac.compare_digest(token, group.webhook_token):
+            # verify_webhook_token uses hmac.compare_digest internally.
+            if not group.verify_webhook_token(token):
                 log.log("Webhook trigger rejected", source="API",
                         details=[('group', group_name),
                                  ('reason', 'token mismatch'),

{cmdbsyncer-4.0.3 → cmdbsyncer-4.1.0.dev1}/application/api/views.py

@@ -8,6 +8,7 @@ from application import app, limiter
 from application.api.syncer import API as syncer
 from application.api.objects import API as objects
 from application.api.rules import API as rules
+from application.api.inventory import API as ansible
 
 API_BP = Blueprint('api', __name__)
 
@@ -52,3 +53,4 @@ API = Api(API_BP, authorizations=AUTHORIZATIONS,
 API.add_namespace(syncer, path='/syncer')
 API.add_namespace(objects, path='/objects')
 API.add_namespace(rules, path='/rules')
+API.add_namespace(ansible, path='/ansible')