{ "openapi": "3.0.4", "info": { "title": "Aritma IAM API", "description": "An API for interacting with the identity and access management system of Aritma.", "contact": { "name": "Aritma", "url": "https://aritma.com/contact" }, "version": "V1" }, "servers": [ { "url": "https://api.dev.aritma.io/core/iam", "description": "IAM API" } ], "paths": { "/v1/actions": { "get": { "tags": [ "Actions" ], "summary": "Returns a list of all available actions, including their display names, description and names of their immediate children.", "operationId": "ListFullActions", "parameters": [ { "name": "Accept-Language", "in": "header", "description": "Preferred response locale", "schema": { "enum": [ "en", "nb-NO" ], "type": "string", "default": "en" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActionDto" } } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/clients": { "get": { "tags": [ "Client" ], "summary": "Returns a paginated list of available clients, optionally filtered by a query", "operationId": "GetClients", "parameters": [ { "name": "searchText", "in": "query", "description": "Search query", "schema": { "type": "string" } }, { "name": "page", "in": "query", "description": "Requested page", "schema": { "type": "integer", "format": "int32" } }, { "name": "pageSize", "in": "query", "description": "Requested pagesize", "schema": { "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientDtoPaginatedResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } }, "post": { "tags": [ "Client" ], "summary": "Creates a client", "operationId": "CreateClient", "requestBody": { "description": "The client creation request.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/CreateClientRequest" } ], "description": "Request body for registering a new client." } } } }, "responses": { "201": { "description": "Created" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/clients/{clientId}": { "get": { "tags": [ "Client" ], "summary": "Returns a client by clientId", "operationId": "GetClientByClientId", "parameters": [ { "name": "clientId", "in": "path", "description": "The client ID of the client to retrieve.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientDetailsDto" } } } }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "put": { "tags": [ "Client" ], "summary": "Updates a client", "operationId": "UpdateClient", "parameters": [ { "name": "clientId", "in": "path", "description": "The client ID of the client to update.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "description": "The update request body.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/UpdateClientRequest" } ], "description": "Request body for updating an existing client application." } } } }, "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "delete": { "tags": [ "Client" ], "summary": "Deletes a client by ID", "operationId": "DeleteClient", "parameters": [ { "name": "clientId", "in": "path", "description": "The client ID of the client to delete.", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "No Content" }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/clients/{clientId}/secrets": { "get": { "tags": [ "Client" ], "summary": "Returns a paginated list of client secrets belonging to a client", "operationId": "GetClientSecrets", "parameters": [ { "name": "clientId", "in": "path", "description": "The client ID whose secrets to list.", "required": true, "schema": { "type": "string" } }, { "name": "page", "in": "query", "description": "Requested page", "schema": { "type": "integer", "format": "int32" } }, { "name": "pageSize", "in": "query", "description": "Requested pagesize", "schema": { "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientSecretDtoPaginatedResponse" } } } }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "post": { "tags": [ "Client" ], "summary": "Creates a new secret for a client", "operationId": "CreateClientSecret", "parameters": [ { "name": "clientId", "in": "path", "description": "The client ID to add the secret to.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "description": "The secret creation request.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/CreateClientSecretRequest" } ], "description": "Request body for adding a new secret to a client application." } } } }, "responses": { "201": { "description": "Created" }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/clients/{clientId}/secrets/{clientSecretId}": { "delete": { "tags": [ "Client" ], "summary": "Deletes a client secret", "operationId": "DeleteClientsecret", "parameters": [ { "name": "clientId", "in": "path", "description": "The client ID that owns the secret.", "required": true, "schema": { "type": "string" } }, { "name": "clientSecretId", "in": "path", "description": "The numeric identifier of the secret to delete.", "required": true, "schema": { "type": "integer", "format": "int32" } } ], "responses": { "204": { "description": "No Content" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/domains": { "get": { "tags": [ "Domains" ], "summary": "Gets registered domains", "operationId": "GetDomains", "parameters": [ { "name": "filter", "in": "query", "description": "The string used to filter the request", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/DomainDto" } } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } }, "post": { "tags": [ "Domains" ], "summary": "Registers a new domain", "operationId": "RegisterDomain", "parameters": [ { "name": "domain", "in": "query", "description": "The domain", "schema": { "type": "string" } } ], "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DomainDto" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "delete": { "tags": [ "Domains" ], "summary": "Unregisters a domain", "operationId": "UnregisterDomain", "parameters": [ { "name": "domain", "in": "query", "description": "The domain", "schema": { "type": "string" } } ], "responses": { "204": { "description": "No Content" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/domains/status": { "get": { "tags": [ "Domains" ], "summary": "Gets status of a specific domain", "operationId": "GetDomain", "parameters": [ { "name": "domain", "in": "query", "description": "The domain", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DomainDto" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/me": { "get": { "tags": [ "Me" ], "summary": "Gets information about the user", "operationId": "GetSelf", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserDto" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/me/claims": { "get": { "tags": [ "Me" ], "summary": "Returns an unpaginated list of all claims assigned to you", "operationId": "GetUserClaims", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserClaimDto" } } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/me/permissions": { "get": { "tags": [ "Me" ], "summary": "Gets permissions for the currently authenticated user", "operationId": "GetOwnPermissions", "parameters": [ { "name": "resourceType", "in": "query", "description": "Filters results to policies on resources of this type.", "schema": { "type": "string", "example": "subscriptions" }, "example": "subscriptions" }, { "name": "resourceProvider", "in": "query", "description": "Filters results to policies on resources from this provider.", "schema": { "type": "string", "example": "aritma.control" }, "example": "aritma.control" }, { "name": "action", "in": "query", "description": "Filters results to policies granting this action.", "schema": { "type": "string", "example": "iam.policy.read" }, "example": "iam.policy.read" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubjectPermissionsResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/me/roles": { "get": { "tags": [ "Me" ], "summary": "Returns an unpaginated list of all roles assigned to you", "operationId": "GetUserRoles", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/RoleDto" } } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/policies": { "post": { "tags": [ "Policies" ], "summary": "Creates a new policy", "operationId": "CreatePolicy", "requestBody": { "description": "The policy request", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/PolicyRequest" } ], "example": { "subject": "user-00000000-0000-0000-0000-000000000000", "scope": "/subscriptions/123", "action": "iam.policy.read" } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyDto" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "delete": { "tags": [ "Policies" ], "summary": "Deletes a policy", "operationId": "RemovePolicy", "requestBody": { "description": "The policy request", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/PolicyRequest" } ], "example": { "subject": "user-00000000-0000-0000-0000-000000000000", "scope": "/subscriptions/123", "action": "iam.policy.read" } } } } }, "responses": { "204": { "description": "No Content" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "get": { "tags": [ "Policies" ], "summary": "Finds policies that matches a request filter", "description": "Requires the requesting party to have read access on the requested scope", "operationId": "FindPolicies", "parameters": [ { "name": "pageSize", "in": "query", "description": "The number of items to return per page. Clamped between 10 and 200.", "schema": { "type": "integer", "format": "int32", "example": 100 }, "example": 100 }, { "name": "cursor", "in": "query", "description": "Opaque cursor returned from a previous response. Pass this to retrieve the next page.", "schema": { "type": "string", "example": "eyJhbGciOiJub25lIn0" }, "example": "eyJhbGciOiJub25lIn0" }, { "name": "includeDerived", "in": "query", "description": "If policies with a derived scope should be included", "schema": { "type": "boolean", "example": false }, "example": false }, { "name": "includeInherited", "in": "query", "description": "If policies with parent scope should be included", "schema": { "type": "boolean", "example": false }, "example": false }, { "name": "subject", "in": "query", "description": "Filters results to policies belonging to this subject identifier", "schema": { "type": "string", "example": "user-00000000-0000-0000-0000-000000000000" }, "example": "user-00000000-0000-0000-0000-000000000000" }, { "name": "scope", "in": "query", "description": "Filters results to policies on this scope", "schema": { "type": "string", "format": "uri", "example": "https://api.aritma.com/tenants/my-tenant" }, "example": "https://api.aritma.com/tenants/my-tenant" }, { "name": "action", "in": "query", "description": "Filters results to policies granting this action", "schema": { "type": "string", "example": "iam.policy.read" }, "example": "iam.policy.read" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FindPoliciesResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/role": { "get": { "tags": [ "Role" ], "summary": "Returns a paginated list of available roles that can be assigned to users, optionally filtered by a query", "operationId": "GetRoles", "parameters": [ { "name": "searchText", "in": "query", "description": "Search query", "schema": { "type": "string" } }, { "name": "page", "in": "query", "description": "Requested page", "schema": { "type": "integer", "format": "int32" } }, { "name": "pageSize", "in": "query", "description": "Requested pagesize", "schema": { "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoleDtoPaginatedResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/scim": { "post": { "tags": [ "Scim" ], "summary": "Creates a SCIM token, must be connected to an SSO Provider", "description": "The SCIM token secret will only be showed in the response of this endpoint, it will never be shown again, so be sure to copy it.", "operationId": "CreateScimToken", "requestBody": { "description": "The token creation request containing the provider scheme and display name.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/CreateScimTokenRequest" } ], "description": "Request body for creating a new SCIM provisioning token." } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateScimTokenResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } }, "get": { "tags": [ "Scim" ], "summary": "Lists all registered SCIM tokens", "operationId": "ListScimTokens", "parameters": [ { "name": "query", "in": "query", "description": "Optional search term to filter tokens by provider name.", "schema": { "type": "string", "example": "azure" }, "example": "azure" }, { "name": "page", "in": "query", "description": "The page number to retrieve (1-based).", "schema": { "type": "integer", "format": "int32", "example": 1 }, "example": 1 }, { "name": "pageSize", "in": "query", "description": "The number of items per page.", "schema": { "type": "integer", "format": "int32", "example": 10 }, "example": 10 } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListScimTokenResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/scim/{id}": { "delete": { "tags": [ "Scim" ], "summary": "Deletes a SCIM token by id", "operationId": "DeleteScimToken", "parameters": [ { "name": "id", "in": "path", "description": "The GUID identifier of the SCIM token to delete.", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "No Content" }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/scopes": { "get": { "tags": [ "Scope" ], "summary": "Returns a paginated list of available scopes that can be assigned to clients, optionally filtered by a query", "operationId": "GetScopes", "parameters": [ { "name": "searchText", "in": "query", "description": "Search query", "schema": { "type": "string" } }, { "name": "page", "in": "query", "description": "Requested page", "schema": { "type": "integer", "format": "int32" } }, { "name": "pageSize", "in": "query", "description": "Requested pagesize", "schema": { "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScopeDtoPaginatedResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/sso": { "get": { "tags": [ "SSO" ], "summary": "Lists registered SSO providers", "operationId": "ListIdentityProviders", "parameters": [ { "name": "query", "in": "query", "description": "Optional search term to filter providers by name or scheme.", "schema": { "type": "string", "example": "azure" }, "example": "azure" }, { "name": "page", "in": "query", "description": "The page number to retrieve (1-based).", "schema": { "type": "integer", "format": "int32", "example": 1 }, "example": 1 }, { "name": "pageSize", "in": "query", "description": "The number of items per page.", "schema": { "type": "integer", "format": "int32", "example": 10 }, "example": 10 } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListSsoProvidersResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/sso/azuread": { "post": { "tags": [ "SSO - Azure AD (Entra ID)" ], "summary": "Creates a new SSO provider", "operationId": "AzureCreateIdentityProvider", "requestBody": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/AzureAdPropertiesCreateSsoProviderRequest" } ] } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NavigationLink" } } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/sso/azuread/{id}": { "get": { "tags": [ "SSO - Azure AD (Entra ID)" ], "summary": "Gets an SSO provider by id", "operationId": "AzureGetIdentityProvider", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AzureAdPropertiesGetIdentityProviderResponse" } } } }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "put": { "tags": [ "SSO - Azure AD (Entra ID)" ], "summary": "Updates an SSO provider", "operationId": "AzureUpdateIdentityProvider", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "integer", "format": "int32" } } ], "requestBody": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/AzureAdPropertiesUpdateIdentityProviderDto" } ] } } } }, "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "delete": { "tags": [ "SSO - Azure AD (Entra ID)" ], "summary": "Deletes an SSO provider by id", "operationId": "AzureDeleteIdentityProvider", "parameters": [ { "name": "id", "in": "path", "description": "The numeric identifier of the SSO provider to delete.", "required": true, "schema": { "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/sso/custom": { "post": { "tags": [ "SSO - Custom Providers" ], "summary": "Creates a new SSO provider", "operationId": "CreateIdentityProvider", "requestBody": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/CustomPropertiesCreateSsoProviderRequest" } ] } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NavigationLink" } } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/sso/custom/{id}": { "delete": { "tags": [ "SSO - Custom Providers" ], "summary": "Deletes an SSO provider by id", "operationId": "DeleteIdentityProvider", "parameters": [ { "name": "id", "in": "path", "description": "The identifier of the SSO provider to delete.", "required": true, "schema": { "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "get": { "tags": [ "SSO - Custom Providers" ], "summary": "Gets an SSO provider by id", "operationId": "CustomGetIdentityProvider", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CustomPropertiesGetIdentityProviderResponse" } } } }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "put": { "tags": [ "SSO - Custom Providers" ], "summary": "Updates an SSO provider", "operationId": "CustomUpdateIdentityProvider", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "integer", "format": "int32" } } ], "requestBody": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/CustomPropertiesUpdateIdentityProviderDto" } ] } } } }, "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/sso/custom/{id}/icon": { "put": { "tags": [ "SSO - Custom Providers" ], "summary": "Updates the icon for a custom SSO provider", "operationId": "UpdateProviderIcon", "parameters": [ { "name": "id", "in": "path", "description": "The identifier of the custom SSO provider.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "multipart/form-data": { "schema": { "required": [ "icon" ], "type": "object", "properties": { "icon": { "type": "string", "description": "The icon to add to the custom SSO provider.", "format": "binary" } } }, "encoding": { "icon": { "style": "form" } } }, "application/json": { "schema": { "required": [ "icon" ], "type": "object", "properties": { "icon": { "type": "string", "description": "The icon to add to the custom SSO provider.", "format": "binary" } } }, "encoding": { "icon": { "style": "form" } } } } }, "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "delete": { "tags": [ "SSO - Custom Providers" ], "summary": "Removes the icon from a custom SSO provider", "operationId": "DeleteProviderIcon", "parameters": [ { "name": "id", "in": "path", "description": "The identifier of the custom SSO provider.", "required": true, "schema": { "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/sso/google": { "post": { "tags": [ "SSO - Google" ], "summary": "Creates a new SSO provider", "operationId": "GoogleCreateIdentityProvider", "requestBody": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/GooglePropertiesCreateSsoProviderRequest" } ] } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NavigationLink" } } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/sso/google/{id}": { "get": { "tags": [ "SSO - Google" ], "summary": "Gets an SSO provider by id", "operationId": "GoogleGetIdentityProvider", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GooglePropertiesGetIdentityProviderResponse" } } } }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "put": { "tags": [ "SSO - Google" ], "summary": "Updates an SSO provider", "operationId": "GoogleUpdateIdentityProvider", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "integer", "format": "int32" } } ], "requestBody": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/GooglePropertiesUpdateIdentityProviderDto" } ] } } } }, "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "delete": { "tags": [ "SSO - Google" ], "summary": "Deletes an SSO provider by id", "operationId": "GoogleDeleteIdentityProvider", "parameters": [ { "name": "id", "in": "path", "description": "The numeric identifier of the SSO provider to delete.", "required": true, "schema": { "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/sso/signicat": { "post": { "tags": [ "SSO - Signicat" ], "summary": "Creates a new SSO provider", "operationId": "SignicatCreateIdentityProvider", "requestBody": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/SignicatPropertiesCreateSsoProviderRequest" } ] } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NavigationLink" } } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/sso/signicat/{id}": { "get": { "tags": [ "SSO - Signicat" ], "summary": "Gets an SSO provider by id", "operationId": "SignicatGetIdentityProvider", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignicatPropertiesGetIdentityProviderResponse" } } } }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "put": { "tags": [ "SSO - Signicat" ], "summary": "Updates an SSO provider", "operationId": "SignicatUpdateIdentityProvider", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "integer", "format": "int32" } } ], "requestBody": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/SignicatPropertiesUpdateIdentityProviderDto" } ] } } } }, "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "delete": { "tags": [ "SSO - Signicat" ], "summary": "Deletes an SSO provider by id", "operationId": "SignicatDeleteIdentityProvider", "parameters": [ { "name": "id", "in": "path", "description": "The numeric identifier of the SSO provider to delete.", "required": true, "schema": { "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/subjects": { "get": { "tags": [ "Subjects" ], "summary": "Gets subjects of all types", "operationId": "GetSubjects", "parameters": [ { "name": "searchQuery", "in": "query", "description": "Filters results to entries whose name contains this value. Leave empty to return all entries.", "schema": { "type": "string", "example": "john" }, "example": "john" }, { "name": "page", "in": "query", "description": "The page number to retrieve.", "schema": { "type": "integer", "format": "int32", "example": 1 }, "example": 1 }, { "name": "pageSize", "in": "query", "description": "The number of items to return per page. Clamped between 10 and 200.", "schema": { "type": "integer", "format": "int32", "example": 100 }, "example": 100 } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubjectDtoPaginatedIamResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/subjects/{subject}/memberships": { "get": { "tags": [ "Subjects" ], "summary": "List the groups of which a subject is a member of", "operationId": "GetSubjectMemberships", "parameters": [ { "name": "subject", "in": "path", "description": "The fully-qualified subject identifier, e.g. `user-00000000-0000-0000-0000-000000000000`", "required": true, "schema": { "type": "string" } }, { "name": "page", "in": "query", "description": "The page number to retrieve.", "schema": { "type": "integer", "format": "int32", "example": 1 }, "example": 1 }, { "name": "pageSize", "in": "query", "description": "The number of items to return per page. Clamped between 10 and 200.", "schema": { "type": "integer", "format": "int32", "example": 100 }, "example": 100 } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubjectGroupDtoPaginatedIamResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/subjects/{subject}/permissions": { "get": { "tags": [ "Subjects" ], "summary": "Gets the permissions of a subject", "description": "The requesting party must have read access for a given scope to return it", "operationId": "GetSubjectPermissions", "parameters": [ { "name": "subject", "in": "path", "description": "The subject id", "required": true, "schema": { "type": "string" } }, { "name": "resourceType", "in": "query", "description": "Filters results to policies on resources of this type.", "schema": { "type": "string", "example": "subscriptions" }, "example": "subscriptions" }, { "name": "resourceProvider", "in": "query", "description": "Filters results to policies on resources from this provider.", "schema": { "type": "string", "example": "aritma.control" }, "example": "aritma.control" }, { "name": "action", "in": "query", "description": "Filters results to policies granting this action.", "schema": { "type": "string", "example": "iam.policy.read" }, "example": "iam.policy.read" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubjectPermissionsResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/subjects/clients": { "get": { "tags": [ "Subjects" ], "summary": "Gets client subjects", "operationId": "GetClientSubjects", "parameters": [ { "name": "searchQuery", "in": "query", "description": "Filters results to entries whose name contains this value. Leave empty to return all entries.", "schema": { "type": "string", "example": "john" }, "example": "john" }, { "name": "page", "in": "query", "description": "The page number to retrieve.", "schema": { "type": "integer", "format": "int32", "example": 1 }, "example": 1 }, { "name": "pageSize", "in": "query", "description": "The number of items to return per page. Clamped between 10 and 200.", "schema": { "type": "integer", "format": "int32", "example": 100 }, "example": 100 } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientSubjectDtoPaginatedIamResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/subjects/clients/{clientId}/permissions": { "get": { "tags": [ "Subjects" ], "summary": "Gets the permissions of a client", "operationId": "GetClientPermissions", "parameters": [ { "name": "clientId", "in": "path", "description": "The client id", "required": true, "schema": { "type": "string" } }, { "name": "resourceType", "in": "query", "description": "Filters results to policies on resources of this type.", "schema": { "type": "string", "example": "subscriptions" }, "example": "subscriptions" }, { "name": "resourceProvider", "in": "query", "description": "Filters results to policies on resources from this provider.", "schema": { "type": "string", "example": "aritma.control" }, "example": "aritma.control" }, { "name": "action", "in": "query", "description": "Filters results to policies granting this action.", "schema": { "type": "string", "example": "iam.policy.read" }, "example": "iam.policy.read" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubjectPermissionsResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/subjects/groups": { "get": { "tags": [ "Subjects" ], "summary": "Gets subject groups", "operationId": "GetSubjectGroups", "parameters": [ { "name": "searchQuery", "in": "query", "description": "Filters results to entries whose name contains this value. Leave empty to return all entries.", "schema": { "type": "string", "example": "john" }, "example": "john" }, { "name": "page", "in": "query", "description": "The page number to retrieve.", "schema": { "type": "integer", "format": "int32", "example": 1 }, "example": 1 }, { "name": "pageSize", "in": "query", "description": "The number of items to return per page. Clamped between 10 and 200.", "schema": { "type": "integer", "format": "int32", "example": 100 }, "example": 100 } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubjectGroupDtoPaginatedIamResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } }, "post": { "tags": [ "Subjects" ], "summary": "Creates a new subject group", "operationId": "CreateSubjectGroup", "requestBody": { "description": "Group creation parameters", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/CreateSubjectGroupRequest" } ] } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubjectGroupDto" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/subjects/groups/{groupId}": { "delete": { "tags": [ "Subjects" ], "summary": "Deletes a subject group", "operationId": "DeleteSubjectGroup", "parameters": [ { "name": "groupId", "in": "path", "description": "The id of the subject group", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "No Content" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found" }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/subjects/groups/{groupId}/permissions": { "get": { "tags": [ "Subjects" ], "summary": "Gets the permissions of a group", "operationId": "GetGroupPermissions", "parameters": [ { "name": "groupId", "in": "path", "description": "The group id", "required": true, "schema": { "type": "string" } }, { "name": "resourceType", "in": "query", "description": "Filters results to policies on resources of this type.", "schema": { "type": "string", "example": "subscriptions" }, "example": "subscriptions" }, { "name": "resourceProvider", "in": "query", "description": "Filters results to policies on resources from this provider.", "schema": { "type": "string", "example": "aritma.control" }, "example": "aritma.control" }, { "name": "action", "in": "query", "description": "Filters results to policies granting this action.", "schema": { "type": "string", "example": "iam.policy.read" }, "example": "iam.policy.read" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubjectPermissionsResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/subjects/groups/{groupSubjectId}/members": { "get": { "tags": [ "Subjects" ], "summary": "Gets the subjects within a subject group", "operationId": "GetGroupSubjects", "parameters": [ { "name": "groupSubjectId", "in": "path", "description": "The id of the subject group", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "page", "in": "query", "description": "The page number to retrieve.", "schema": { "type": "integer", "format": "int32", "example": 1 }, "example": 1 }, { "name": "pageSize", "in": "query", "description": "The number of items to return per page. Clamped between 10 and 200.", "schema": { "type": "integer", "format": "int32", "example": 100 }, "example": 100 } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubjectDtoPaginatedIamResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found" } } }, "post": { "tags": [ "Subjects" ], "summary": "Adds a member to a subject group", "operationId": "AddSubjectsToSubjectGroup", "parameters": [ { "name": "groupSubjectId", "in": "path", "description": "The id of the subject group", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "description": "The mutation request", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/MutateGroupMembersRequest" } ], "description": "Request body for adding or removing members from a subject group." } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/SubjectGroupMemberDto" } } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found" }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "delete": { "tags": [ "Subjects" ], "summary": "Removes a member from a subject group", "operationId": "RemoveSubjectFromSubjectGroup", "parameters": [ { "name": "groupSubjectId", "in": "path", "description": "The id of the subject group", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "description": "The mutation request", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/MutateGroupMembersRequest" } ], "description": "Request body for adding or removing members from a subject group." } } } }, "responses": { "204": { "description": "No Content" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found" }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/subjects/users": { "get": { "tags": [ "Subjects" ], "summary": "Gets user subjects", "operationId": "GetUserSubjects", "parameters": [ { "name": "searchQuery", "in": "query", "description": "Filters results to entries whose name contains this value. Leave empty to return all entries.", "schema": { "type": "string", "example": "john" }, "example": "john" }, { "name": "page", "in": "query", "description": "The page number to retrieve.", "schema": { "type": "integer", "format": "int32", "example": 1 }, "example": 1 }, { "name": "pageSize", "in": "query", "description": "The number of items to return per page. Clamped between 10 and 200.", "schema": { "type": "integer", "format": "int32", "example": 100 }, "example": 100 } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserSubjectDtoPaginatedIamResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/subjects/users/{userId}/permissions": { "get": { "tags": [ "Subjects" ], "summary": "Gets the permissions of a user", "operationId": "GetUserPermissions", "parameters": [ { "name": "userId", "in": "path", "description": "The user id", "required": true, "schema": { "type": "string" } }, { "name": "resourceType", "in": "query", "description": "Filters results to policies on resources of this type.", "schema": { "type": "string", "example": "subscriptions" }, "example": "subscriptions" }, { "name": "resourceProvider", "in": "query", "description": "Filters results to policies on resources from this provider.", "schema": { "type": "string", "example": "aritma.control" }, "example": "aritma.control" }, { "name": "action", "in": "query", "description": "Filters results to policies granting this action.", "schema": { "type": "string", "example": "iam.policy.read" }, "example": "iam.policy.read" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubjectPermissionsResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/users": { "get": { "tags": [ "User" ], "summary": "Returns a paginated list of users, optionally filtered by a search query", "operationId": "GetUsers", "parameters": [ { "name": "searchText", "in": "query", "description": "Search query", "schema": { "type": "string" } }, { "name": "page", "in": "query", "description": "Requested page", "schema": { "type": "integer", "format": "int32" } }, { "name": "pageSize", "in": "query", "description": "Requested pagesize", "schema": { "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserDtoPaginatedResponse" } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/users/{userId}": { "get": { "tags": [ "User" ], "summary": "Returns a user by their id", "operationId": "GetUser", "parameters": [ { "name": "userId", "in": "path", "description": "The user's unique identifier.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserDto" } } } }, "400": { "description": "Bad Request – Invalid or missing parameters" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/users/{userId}/role/{roleId}": { "post": { "tags": [ "User" ], "summary": "Assigns a role to a user", "operationId": "AssignRoleToUser", "parameters": [ { "name": "userId", "in": "path", "description": "The user's unique identifier.", "required": true, "schema": { "type": "string" } }, { "name": "roleId", "in": "path", "description": "The role's unique identifier.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } }, "delete": { "tags": [ "User" ], "summary": "Removes a role from a user", "operationId": "RemoveRoleFromUser", "parameters": [ { "name": "userId", "in": "path", "description": "The user's unique identifier.", "required": true, "schema": { "type": "string" } }, { "name": "roleId", "in": "path", "description": "The role's unique identifier.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } }, "/v1/users/invite": { "post": { "tags": [ "User" ], "summary": "Sends an invitation to Aritma ID", "operationId": "InviteUserSubject", "parameters": [ { "name": "email", "in": "query", "description": "The email address to send the invitation to.", "schema": { "type": "string", "example": "jane.doe@aritma.com" }, "example": "jane.doe@aritma.com" }, { "name": "redirectUrl", "in": "query", "description": "The URL the user will be redirected to after accepting the invitation.", "schema": { "type": "string", "example": "https://app.example.com/accept-invite" }, "example": "https://app.example.com/accept-invite" } ], "responses": { "204": { "description": "No Content" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" } } } }, "/v1/users/users": { "post": { "tags": [ "User" ], "summary": "Creates a user subject if their domain is verified.", "operationId": "CreateUserSubject", "parameters": [ { "name": "email", "in": "query", "description": "The email address for the new user.", "schema": { "type": "string", "example": "jane.doe@example.com" }, "example": "jane.doe@example.com" }, { "name": "fullName", "in": "query", "description": "The full name of the new user.", "schema": { "type": "string", "example": "Jane Doe" }, "example": "Jane Doe" }, { "name": "phoneNumber", "in": "query", "description": "The phone number of the new user.", "schema": { "type": "string", "example": "+4712345678" }, "example": "+4712345678" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateUserResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "$ref": "#/components/schemas/HttpValidationProblemDetails" } ] } } } } } } } }, "components": { "schemas": { "ActionChildDto": { "required": [ "id", "type" ], "type": "object", "properties": { "id": { "type": "string", "description": "The unique action identifier.", "example": "iam.policy.write" }, "type": { "type": "string", "description": "Whether this child is a role or an action.\nA role has children whilst an action does not." } }, "additionalProperties": false, "description": "A lightweight reference to a child action.", "example": { "id": "iam.policy.write" } }, "ActionDto": { "required": [ "children", "description", "displayName", "id", "type" ], "type": "object", "properties": { "id": { "type": "string", "description": "The unique action identifier used in policy definitions.", "example": "iam.policy.write" }, "displayName": { "type": "string", "description": "A human-readable name for the action.", "example": "Read policies" }, "description": { "type": "string", "description": "A short description of what this action grants access to.", "example": "Grants read access to IAM policies within the authorized scope." }, "children": { "type": "array", "items": { "$ref": "#/components/schemas/ActionChildDto" }, "description": "Immediate child actions nested under this action." }, "type": { "type": "string", "description": "Whether the action is a role action or application action" } }, "additionalProperties": false, "description": "Full representation of an IAM action, including its display name, description, and child actions.", "example": { "id": "iam.policy.write", "displayName": "Read policies", "description": "Grants read access to IAM policies within the authorized scope.", "children": [ { "id": "iam.policy.write" } ] } }, "AzureAdProperties": { "allOf": [ { "$ref": "#/components/schemas/CommonIdentityProviderProperties" }, { "required": [ "authority", "responseType", "scope", "usePkce" ], "type": "object", "properties": { "usePkce": { "type": "boolean", "description": "Whether to use PKCE for the authorization code flow.", "example": true }, "authority": { "type": "string", "description": "The Azure AD authority URL. Replace {TenantId} with your Azure AD tenant ID.", "example": "https://login.microsoftonline.com/{TenantId}/v2.0" }, "responseType": { "allOf": [ { "$ref": "#/components/schemas/AzureAdResponseType" } ], "description": "The OAuth 2.0 response type to request from Azure AD.", "example": "code" }, "scope": { "type": "string", "description": "The OAuth 2.0 scopes to request (space-separated).", "example": "openid profile email" } }, "additionalProperties": false } ], "description": "Configuration properties for an Azure Active Directory SSO provider." }, "AzureAdPropertiesCreateSsoProviderRequest": { "required": [ "displayName", "enabled", "properties", "scheme", "type" ], "type": "object", "properties": { "scheme": { "type": "string", "description": "The scheme name for the provider" }, "displayName": { "type": "string", "description": "The display name of the provider" }, "enabled": { "type": "boolean", "description": "Whether or not the provider is enabled" }, "type": { "allOf": [ { "$ref": "#/components/schemas/IdentityProviderType" } ], "description": "The type of identityprovider" }, "properties": { "allOf": [ { "$ref": "#/components/schemas/AzureAdProperties" } ], "description": "The properties that defines the behavior of this provider, dependent on which provider that is used, see json schemas for more details" } }, "additionalProperties": false }, "AzureAdPropertiesGetIdentityProviderResponse": { "required": [ "displayName", "enabled", "id", "properties", "providerName", "scheme", "type" ], "type": "object", "properties": { "id": { "type": "integer", "description": "The internal identifier of the identity provider.", "format": "int32", "example": 1 }, "scheme": { "type": "string", "description": "The unique authentication scheme name used to identify this provider.", "example": "azure-ad" }, "displayName": { "type": "string", "description": "The human-readable name shown to users on the login page.", "example": "Our Azure AD" }, "enabled": { "type": "boolean", "description": "Indicates whether this provider is currently active and available for login.", "example": true }, "providerName": { "type": "string", "description": "The provider type name (e.g. Azure, Google, Signicat, Custom).", "example": "Azure" }, "type": { "type": "string", "description": "The protocol type of the provider (e.g. oidc, saml2p).", "example": "oidc" }, "properties": { "allOf": [ { "$ref": "#/components/schemas/AzureAdProperties" } ], "description": "Provider-specific configuration properties." } }, "additionalProperties": false, "description": "Details of a single SSO identity provider, including its provider-specific configuration." }, "AzureAdPropertiesUpdateIdentityProviderDto": { "required": [ "displayName", "enabled", "id", "properties", "scheme", "type" ], "type": "object", "properties": { "id": { "type": "integer", "description": "The id of the identityprovider", "format": "int32" }, "scheme": { "type": "string", "description": "The scheme name for the provider" }, "displayName": { "type": "string", "description": "The display name of the provider" }, "enabled": { "type": "boolean", "description": "Whether or not the provider is enabled" }, "type": { "allOf": [ { "$ref": "#/components/schemas/IdentityProviderType" } ], "description": "The type of identityprovider" }, "properties": { "allOf": [ { "$ref": "#/components/schemas/AzureAdProperties" } ], "description": "The properties that defines the behavior of this provider, dependent on which provider that is used, see json schemas for more details" } }, "additionalProperties": false }, "AzureAdResponseType": { "enum": [ "id_token", "code" ], "type": "string", "description": "OAuth 2.0 response type for Azure AD." }, "ClientAdditionalData": { "required": [ "description", "iconUri" ], "type": "object", "properties": { "iconUri": { "type": "string", "description": "URI of the client application's icon.", "example": "https://aritma.com/favicon.ico" }, "description": { "type": "string", "description": "A short description of the client application.", "example": "Internal billing service" } }, "additionalProperties": false, "description": "Additional metadata for a client subject.", "example": { "iconUri": "https://aritma.com/favicon.ico", "description": "Internal billing service" } }, "ClientDetailsDto": { "allOf": [ { "$ref": "#/components/schemas/ClientDto" }, { "required": [ "allowedGrantTypes", "allowedScopes", "redirectUris" ], "type": "object", "properties": { "allowedGrantTypes": { "type": "array", "items": { "type": "string" }, "description": "Allowed grant types. I.e. \"authorization_code\", \"client_credentials\", \"password\", etc." }, "redirectUris": { "type": "array", "items": { "type": "string" }, "description": "Allowed redirect uris" }, "allowedScopes": { "type": "array", "items": { "type": "string" }, "description": "Scopes that can be requested for this client" } }, "additionalProperties": false } ], "description": "Represents a client in Aritma ID" }, "ClientDto": { "required": [ "clientId", "description", "name" ], "type": "object", "properties": { "clientId": { "type": "string", "description": "Client ID" }, "name": { "type": "string", "description": "Client name" }, "description": { "type": "string", "description": "Client description" } }, "additionalProperties": false, "description": "A concise client dto" }, "ClientDtoPaginatedResponse": { "required": [ "items", "links", "metadata" ], "type": "object", "properties": { "items": { "type": "array", "items": { "oneOf": [ { "$ref": "#/components/schemas/ClientDto" }, { "$ref": "#/components/schemas/ClientDetailsDto" } ], "description": "A concise client dto" }, "description": "The items on the current page." }, "metadata": { "allOf": [ { "$ref": "#/components/schemas/PaginationMetadata" } ], "description": "Pagination details such as current page, page size, and total count." }, "links": { "allOf": [ { "$ref": "#/components/schemas/PaginationLinks" } ], "description": "Navigation links for first, previous, next, and last pages." } }, "additionalProperties": false, "description": "A paginated response envelope containing a page of items and navigation metadata." }, "ClientSecretDto": { "required": [ "created", "description", "id", "type" ], "type": "object", "properties": { "id": { "type": "integer", "description": "The internal identifier of the secret.", "format": "int32" }, "type": { "type": "string", "description": "The secret type (e.g. SharedSecret)." }, "description": { "type": "string", "description": "A human-readable description of the secret." }, "expiration": { "type": "string", "description": "The optional expiry date of the secret.", "format": "date-time", "nullable": true }, "created": { "type": "string", "description": "The date the secret was created.", "format": "date-time" } }, "additionalProperties": false, "description": "Represents a secret credential associated with a client." }, "ClientSecretDtoPaginatedResponse": { "required": [ "items", "links", "metadata" ], "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/ClientSecretDto" }, "description": "The items on the current page." }, "metadata": { "allOf": [ { "$ref": "#/components/schemas/PaginationMetadata" } ], "description": "Pagination details such as current page, page size, and total count." }, "links": { "allOf": [ { "$ref": "#/components/schemas/PaginationLinks" } ], "description": "Navigation links for first, previous, next, and last pages." } }, "additionalProperties": false, "description": "A paginated response envelope containing a page of items and navigation metadata." }, "ClientSubjectDto": { "allOf": [ { "$ref": "#/components/schemas/SubjectDto" }, { "required": [ "properties" ], "type": "object", "properties": { "properties": { "allOf": [ { "$ref": "#/components/schemas/ClientAdditionalData" } ], "description": "Additional metadata for the client application.", "example": { "iconUri": "https://aritma.com/favicon.ico", "description": "Internal billing service" } } }, "additionalProperties": false } ], "description": "A client subject — represents a machine/service identity within the IAM system.", "example": { "properties": { "iconUri": "https://aritma.com/favicon.ico", "description": "Internal billing service" }, "type": "Client", "id": "00000000-0000-0000-0000-000000000000", "displayName": "John Doe", "tenant": "00000000-0000-0000-0000-000000000000", "subjectId": "user-00000000-0000-0000-0000-000000000000" } }, "ClientSubjectDtoPaginatedIamResponse": { "required": [ "count", "data", "page", "pageSize", "total", "totalPages" ], "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ClientSubjectDto" }, "description": "Data returned by request" }, "page": { "type": "integer", "description": "The current page which is fetched", "format": "int32", "example": 1 }, "pageSize": { "type": "integer", "description": "The current page size", "format": "int32", "example": 100 }, "count": { "type": "integer", "description": "The count of entries on the current page", "format": "int32", "readOnly": true, "example": 3 }, "total": { "type": "integer", "description": "Total entries across all pages.", "format": "int32", "example": 3 }, "totalPages": { "type": "integer", "description": "The total number of pages based on Aritma.IAM.V2.PaginatedIamResponse`1.Total and Aritma.IAM.V2.PaginatedIamResponse`1.PageSize.", "format": "int32", "readOnly": true, "example": 1 } }, "additionalProperties": false, "example": { "page": 1, "pageSize": 100, "count": 3, "total": 3, "totalPages": 1, "data": [ { "properties": { "iconUri": "https://aritma.com/favicon.ico", "description": "Internal billing service" }, "type": "Client", "id": "00000000-0000-0000-0000-000000000000", "displayName": "John Doe", "tenant": "00000000-0000-0000-0000-000000000000", "subjectId": "user-00000000-0000-0000-0000-000000000000" } ] } }, "CommonIdentityProviderProperties": { "required": [ "autoProvisioningEnabled", "clientId", "delegationEnabled", "loginEnabled", "visible" ], "type": "object", "properties": { "loginEnabled": { "type": "boolean", "description": "Whether users can log in via this provider.", "example": true }, "visible": { "type": "boolean", "description": "Whether this provider is shown on the login page.", "example": true }, "delegationEnabled": { "type": "boolean", "description": "Whether delegation is permitted via this provider.", "example": false }, "autoProvisioningEnabled": { "type": "boolean", "description": "Whether users are automatically provisioned on first login via this provider.", "example": true }, "clientId": { "type": "string", "description": "The OAuth 2.0 client ID registered with the identity provider.", "example": "my-client-id" }, "clientSecret": { "type": "string", "description": "The OAuth 2.0 client secret. Leave null for public clients using PKCE.", "nullable": true, "example": "my-client-secret" } }, "additionalProperties": false, "description": "Base configuration properties shared by all SSO identity providers." }, "CreateClientRequest": { "required": [ "allowedGrantTypes", "allowedScopes", "description", "name", "redirectUris" ], "type": "object", "properties": { "name": { "type": "string", "description": "The display name of the client.", "example": "My Application" }, "description": { "type": "string", "description": "Client description" }, "allowedGrantTypes": { "type": "array", "items": { "type": "string" }, "description": "Allowed grant types. I.e. \"authorization_code\", \"client_credentials\", \"password\", etc." }, "redirectUris": { "type": "array", "items": { "type": "string" }, "description": "Allowed redirect uris" }, "allowedScopes": { "type": "array", "items": { "type": "string" }, "description": "Scopes that can be requested for this client" } }, "additionalProperties": false, "description": "Request body for registering a new client." }, "CreateClientSecretRequest": { "required": [ "description", "value" ], "type": "object", "properties": { "value": { "maxLength": 32, "minLength": 8, "type": "string", "description": "The secret value. Must be between 8 and 32 characters.", "example": "s3cr3tV@lue!" }, "description": { "type": "string", "description": "An optional human-readable description of what this secret is used for.", "example": "Production API access" }, "expiration": { "type": "string", "description": "An optional expiration date for the secret. If not set then there is no expiry.", "format": "date-time", "nullable": true } }, "additionalProperties": false, "description": "Request body for adding a new secret to a client application." }, "CreateScimTokenRequest": { "required": [ "provider", "providerDisplayName" ], "type": "object", "properties": { "provider": { "type": "string", "description": "The scheme name of the identity provider to associate with the token." }, "providerDisplayName": { "type": "string", "description": "The human-readable name of the identity provider." } }, "additionalProperties": false, "description": "Request body for creating a new SCIM provisioning token." }, "CreateScimTokenResponse": { "required": [ "id", "provider", "providerDisplayName", "token" ], "type": "object", "properties": { "id": { "type": "string", "description": "The unique identifier of the SCIM token." }, "token": { "type": "string", "description": "The secret token value. Store this securely — it will not be shown again." }, "provider": { "type": "string", "description": "The scheme name of the associated identity provider." }, "providerDisplayName": { "type": "string", "description": "The human-readable name of the associated identity provider." } }, "additionalProperties": false, "description": "Response returned when a SCIM token is created. The token secret is only shown once and cannot be retrieved again." }, "CreateSubjectGroupRequest": { "required": [ "description", "displayName" ], "type": "object", "properties": { "displayName": { "type": "string" }, "description": { "type": "string" } }, "additionalProperties": false }, "CreateUserResponse": { "required": [ "email", "fullName", "phoneNumber", "userId" ], "type": "object", "properties": { "userId": { "type": "string", "description": "The unique identifier of the newly created user.", "example": "00000000-0000-0000-0000-000000000001" }, "email": { "type": "string", "description": "The email address of the newly created user.", "example": "jane.doe@aritma.com" }, "phoneNumber": { "type": "string", "description": "The phone number of the newly created user.", "example": "+4712345678" }, "fullName": { "type": "string", "description": "The full name of the newly created user.", "example": "Jane Doe" } }, "additionalProperties": false, "description": "Response returned when a new user has been created." }, "CustomProperties": { "allOf": [ { "$ref": "#/components/schemas/CommonIdentityProviderProperties" }, { "required": [ "authority", "emailClaimType", "getClaimsFromUserInfoEndpoint", "nameClaimType", "phoneNumberClaimType", "responseType", "scope", "subjectClaimType", "usePkce", "verifyEnabled" ], "type": "object", "properties": { "verifyEnabled": { "type": "boolean", "description": "Whether this provider can be used to verify the user in a higher level of assurance.", "example": false }, "responseType": { "allOf": [ { "$ref": "#/components/schemas/CustomResponseType" } ], "description": "The OAuth 2.0 response type to request from the provider.", "example": "code" }, "nameClaimType": { "type": "string", "description": "The claim type used to extract the user's name.", "example": "name" }, "emailClaimType": { "type": "string", "description": "The claim type used to extract the user's email.", "example": "email" }, "phoneNumberClaimType": { "type": "string", "description": "The claim type used to extract the user's phone number.", "example": "phone" }, "subjectClaimType": { "type": "string", "description": "The claim type used as the subject identifier.", "example": "sub" }, "authority": { "type": "string", "description": "The OIDC authority URL of the custom provider.", "example": "https://your-idp.example.com" }, "scope": { "type": "string", "description": "The OAuth 2.0 scopes to request (space-separated).", "example": "openid profile email" }, "getClaimsFromUserInfoEndpoint": { "type": "boolean", "description": "Whether to fetch additional claims from the userinfo endpoint after authentication.", "example": false }, "usePkce": { "type": "boolean", "description": "Whether to use PKCE for the authorization code flow.", "example": false } }, "additionalProperties": false } ], "description": "Configuration properties for a custom OIDC SSO provider." }, "CustomPropertiesCreateSsoProviderRequest": { "required": [ "displayName", "enabled", "properties", "scheme", "type" ], "type": "object", "properties": { "scheme": { "type": "string", "description": "The scheme name for the provider" }, "displayName": { "type": "string", "description": "The display name of the provider" }, "enabled": { "type": "boolean", "description": "Whether or not the provider is enabled" }, "type": { "allOf": [ { "$ref": "#/components/schemas/IdentityProviderType" } ], "description": "The type of identityprovider" }, "properties": { "allOf": [ { "$ref": "#/components/schemas/CustomProperties" } ], "description": "The properties that defines the behavior of this provider, dependent on which provider that is used, see json schemas for more details" } }, "additionalProperties": false }, "CustomPropertiesGetIdentityProviderResponse": { "required": [ "displayName", "enabled", "id", "properties", "providerName", "scheme", "type" ], "type": "object", "properties": { "id": { "type": "integer", "description": "The internal identifier of the identity provider.", "format": "int32", "example": 1 }, "scheme": { "type": "string", "description": "The unique authentication scheme name used to identify this provider.", "example": "azure-ad" }, "displayName": { "type": "string", "description": "The human-readable name shown to users on the login page.", "example": "Our Azure AD" }, "enabled": { "type": "boolean", "description": "Indicates whether this provider is currently active and available for login.", "example": true }, "providerName": { "type": "string", "description": "The provider type name (e.g. Azure, Google, Signicat, Custom).", "example": "Azure" }, "type": { "type": "string", "description": "The protocol type of the provider (e.g. oidc, saml2p).", "example": "oidc" }, "properties": { "allOf": [ { "$ref": "#/components/schemas/CustomProperties" } ], "description": "Provider-specific configuration properties." } }, "additionalProperties": false, "description": "Details of a single SSO identity provider, including its provider-specific configuration." }, "CustomPropertiesUpdateIdentityProviderDto": { "required": [ "displayName", "enabled", "id", "properties", "scheme", "type" ], "type": "object", "properties": { "id": { "type": "integer", "description": "The id of the identityprovider", "format": "int32" }, "scheme": { "type": "string", "description": "The scheme name for the provider" }, "displayName": { "type": "string", "description": "The display name of the provider" }, "enabled": { "type": "boolean", "description": "Whether or not the provider is enabled" }, "type": { "allOf": [ { "$ref": "#/components/schemas/IdentityProviderType" } ], "description": "The type of identityprovider" }, "properties": { "allOf": [ { "$ref": "#/components/schemas/CustomProperties" } ], "description": "The properties that defines the behavior of this provider, dependent on which provider that is used, see json schemas for more details" } }, "additionalProperties": false }, "CustomResponseType": { "enum": [ "id_token", "code", "token", "none" ], "type": "string", "description": "OAuth 2.0 response type for custom providers." }, "DomainDto": { "required": [ "domain", "status" ], "type": "object", "properties": { "domain": { "type": "string", "description": "The domain name (e.g. \"example.com\").", "example": "aritma.com" }, "status": { "allOf": [ { "$ref": "#/components/schemas/DomainStatus" } ], "description": "The current verification status of the domain.", "example": "Pending" }, "verificationToken": { "type": "string", "description": "A DNS TXT token that must be published to verify ownership of the domain. Removed once verified.", "nullable": true, "example": "aritma-verify-00000000-0000-0000-0000-000000000000" } }, "additionalProperties": false, "description": "Represents a domain registered for a tenant and its verification status." }, "DomainStatus": { "enum": [ "NotRegistered", "Pending", "Confirmed" ], "type": "string", "description": "Verification status of a registered domain." }, "FindPoliciesResponse": { "required": [ "policies" ], "type": "object", "properties": { "policies": { "type": "array", "items": { "$ref": "#/components/schemas/PolicyDto" }, "description": "The list of policies matching the request filter." }, "cursor": { "type": "string", "description": "Opaque cursor to pass in the next request to retrieve the following page. `null` when there are no more pages.", "nullable": true, "example": "eyJhbGciOiJub25lIn0" } }, "additionalProperties": false, "example": { "cursor": "eyJhbGciOiJub25lIn0", "policies": [ { "subject": "user-00000000-0000-0000-0000-000000000000", "scope": "/subscriptions/123", "action": "iam.policy.read", "tenant": "00000000-0000-0000-0000-000000000000" } ] } }, "GoogleProperties": { "allOf": [ { "$ref": "#/components/schemas/CommonIdentityProviderProperties" }, { "required": [ "authority", "emailClaimType", "nameClaimType", "phoneNumberClaimType", "scope", "subjectClaimType", "usePkce" ], "type": "object", "properties": { "nameClaimType": { "type": "string", "description": "The claim type used to extract the user's name from the Google token.", "example": "name" }, "emailClaimType": { "type": "string", "description": "The claim type used to extract the user's email from the Google token.", "example": "email" }, "phoneNumberClaimType": { "type": "string", "description": "The claim type used to extract the user's phone number from the Google token.", "example": "phone" }, "subjectClaimType": { "type": "string", "description": "The claim type used to extract the subject identifier from the Google token.", "example": "subject" }, "usePkce": { "type": "boolean", "description": "Whether to use PKCE for the authorization code flow.", "example": false }, "authority": { "type": "string", "description": "The Google authority URL.", "example": "https://accounts.google.com" }, "scope": { "type": "string", "description": "The OAuth 2.0 scopes to request (space-separated).", "example": "openid profile email" } }, "additionalProperties": false } ], "description": "Configuration properties for a Google SSO provider." }, "GooglePropertiesCreateSsoProviderRequest": { "required": [ "displayName", "enabled", "properties", "scheme", "type" ], "type": "object", "properties": { "scheme": { "type": "string", "description": "The scheme name for the provider" }, "displayName": { "type": "string", "description": "The display name of the provider" }, "enabled": { "type": "boolean", "description": "Whether or not the provider is enabled" }, "type": { "allOf": [ { "$ref": "#/components/schemas/IdentityProviderType" } ], "description": "The type of identityprovider" }, "properties": { "allOf": [ { "$ref": "#/components/schemas/GoogleProperties" } ], "description": "The properties that defines the behavior of this provider, dependent on which provider that is used, see json schemas for more details" } }, "additionalProperties": false }, "GooglePropertiesGetIdentityProviderResponse": { "required": [ "displayName", "enabled", "id", "properties", "providerName", "scheme", "type" ], "type": "object", "properties": { "id": { "type": "integer", "description": "The internal identifier of the identity provider.", "format": "int32", "example": 1 }, "scheme": { "type": "string", "description": "The unique authentication scheme name used to identify this provider.", "example": "azure-ad" }, "displayName": { "type": "string", "description": "The human-readable name shown to users on the login page.", "example": "Our Azure AD" }, "enabled": { "type": "boolean", "description": "Indicates whether this provider is currently active and available for login.", "example": true }, "providerName": { "type": "string", "description": "The provider type name (e.g. Azure, Google, Signicat, Custom).", "example": "Azure" }, "type": { "type": "string", "description": "The protocol type of the provider (e.g. oidc, saml2p).", "example": "oidc" }, "properties": { "allOf": [ { "$ref": "#/components/schemas/GoogleProperties" } ], "description": "Provider-specific configuration properties." } }, "additionalProperties": false, "description": "Details of a single SSO identity provider, including its provider-specific configuration." }, "GooglePropertiesUpdateIdentityProviderDto": { "required": [ "displayName", "enabled", "id", "properties", "scheme", "type" ], "type": "object", "properties": { "id": { "type": "integer", "description": "The id of the identityprovider", "format": "int32" }, "scheme": { "type": "string", "description": "The scheme name for the provider" }, "displayName": { "type": "string", "description": "The display name of the provider" }, "enabled": { "type": "boolean", "description": "Whether or not the provider is enabled" }, "type": { "allOf": [ { "$ref": "#/components/schemas/IdentityProviderType" } ], "description": "The type of identityprovider" }, "properties": { "allOf": [ { "$ref": "#/components/schemas/GoogleProperties" } ], "description": "The properties that defines the behavior of this provider, dependent on which provider that is used, see json schemas for more details" } }, "additionalProperties": false }, "HttpMethod": { "required": [ "method" ], "type": "object", "properties": { "method": { "type": "string" } }, "additionalProperties": false }, "HttpValidationProblemDetails": { "allOf": [ { "$ref": "#/components/schemas/ProblemDetails" }, { "required": [ "errors" ], "type": "object", "properties": { "errors": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } }, "additionalProperties": {} } ] }, "IdentityProviderType": { "enum": [ "oidc" ], "type": "string", "description": "Supported SSO protocol types." }, "ListIdentityProviderDto": { "required": [ "displayName", "enabled", "id", "provider", "scheme", "type" ], "type": "object", "properties": { "id": { "type": "integer", "description": "The internal identifier of the provider.", "format": "int32" }, "provider": { "type": "string", "description": "The provider type name (e.g. Azure, Google)." }, "scheme": { "type": "string", "description": "The unique authentication scheme name." }, "displayName": { "type": "string", "description": "The human-readable display name shown to users." }, "enabled": { "type": "boolean", "description": "Indicates whether the provider is currently active." }, "type": { "type": "string", "description": "The protocol type of the provider (e.g. oidc, saml2p)." } }, "additionalProperties": false, "description": "Summary of a single SSO identity provider." }, "ListScimTokenResponse": { "required": [ "page", "pageSize", "tokens", "totalCount" ], "type": "object", "properties": { "tokens": { "type": "array", "items": { "$ref": "#/components/schemas/ScimTokenDto" }, "description": "The SCIM tokens on this page." }, "totalCount": { "type": "integer", "description": "Total number of SCIM tokens across all pages.", "format": "int32" }, "page": { "type": "integer", "description": "The current page number.", "format": "int32" }, "pageSize": { "type": "integer", "description": "The number of items per page.", "format": "int32" } }, "additionalProperties": false, "description": "Paginated list of SCIM provisioning tokens." }, "ListSsoProvidersResponse": { "required": [ "identityProviders", "page", "pageSize", "totalCount" ], "type": "object", "properties": { "identityProviders": { "type": "array", "items": { "$ref": "#/components/schemas/ListIdentityProviderDto" }, "description": "The identity providers on this page." }, "totalCount": { "type": "integer", "description": "Total number of identity providers across all pages.", "format": "int32" }, "page": { "type": "integer", "description": "The current page number.", "format": "int32" }, "pageSize": { "type": "integer", "description": "The number of items per page.", "format": "int32" } }, "additionalProperties": false, "description": "Paginated list of SSO identity providers." }, "MutateGroupMembersRequest": { "required": [ "subjectIds" ], "type": "object", "properties": { "subjectIds": { "type": "array", "items": { "type": "string" }, "description": "The list of subject identifiers to add or remove.\nEach entry must be a valid subject string in the format `type-id`, e.g. `user-00000000-0000-0000-0000-000000000000` or `user-00000000-0000-0000-0000-000000000000`." } }, "additionalProperties": false, "description": "Request body for adding or removing members from a subject group." }, "NavigationLink": { "required": [ "method", "rel" ], "type": "object", "properties": { "rel": { "type": "string", "description": "The link relation type (e.g. self, update, delete).", "example": "self" }, "href": { "type": "string", "description": "The URL of the related action.", "nullable": true, "example": "/v0/sso/custom/1" }, "method": { "allOf": [ { "$ref": "#/components/schemas/HttpMethod" } ], "description": "The HTTP method to use when calling this link.", "example": "GET" } }, "additionalProperties": false, "description": "A single hypermedia link describing a related action on a resource." }, "PaginationLinks": { "type": "object", "properties": { "first": { "type": "string", "description": "Link to the first page.", "format": "uri", "nullable": true }, "previous": { "type": "string", "description": "Link to the previous page, if one exists.", "format": "uri", "nullable": true }, "next": { "type": "string", "description": "Link to the next page, if one exists.", "format": "uri", "nullable": true }, "last": { "type": "string", "description": "Link to the last page.", "format": "uri", "nullable": true } }, "additionalProperties": false, "description": "Navigation links for paginated responses." }, "PaginationMetadata": { "required": [ "page", "pageSize", "totalCount" ], "type": "object", "properties": { "page": { "type": "integer", "description": "The current page number (1-based).", "format": "int32" }, "pageSize": { "type": "integer", "description": "The number of items per page.", "format": "int32" }, "totalCount": { "type": "integer", "description": "The total number of items across all pages.", "format": "int32" } }, "additionalProperties": false, "description": "Metadata describing the current page position within a paginated result set." }, "PolicyDto": { "required": [ "action", "scope", "subject", "tenant" ], "type": "object", "properties": { "subject": { "type": "string", "description": "The subject identifier the policy applies to.", "example": "user-00000000-0000-0000-0000-000000000000" }, "scope": { "type": "string", "description": "The resource scope the policy applies to.", "example": "/subscriptions/123" }, "action": { "type": "string", "description": "The action permitted by this policy.", "example": "iam.policy.read" }, "tenant": { "type": "string", "description": "The tenant this policy belongs to.", "example": "00000000-0000-0000-0000-000000000000" } }, "additionalProperties": false, "example": { "subject": "user-00000000-0000-0000-0000-000000000000", "scope": "/subscriptions/123", "action": "iam.policy.read", "tenant": "00000000-0000-0000-0000-000000000000" } }, "PolicyRequest": { "required": [ "action", "scope", "subject" ], "type": "object", "properties": { "subject": { "minLength": 1, "type": "string", "description": "The subject identifier the policy should be created for.", "example": "user-00000000-0000-0000-0000-000000000000" }, "scope": { "type": "string", "description": "The resource scope the policy applies to.", "format": "uri", "example": "/subscriptions/123" }, "action": { "minLength": 1, "type": "string", "description": "The action to grant. Must be one of the actions returned by the /actions endpoint.", "example": "iam.policy.read" } }, "additionalProperties": false, "example": { "subject": "user-00000000-0000-0000-0000-000000000000", "scope": "/subscriptions/123", "action": "iam.policy.read" } }, "ProblemDetails": { "type": "object", "properties": { "type": { "type": "string", "nullable": true }, "title": { "type": "string", "nullable": true }, "status": { "type": "integer", "format": "int32", "nullable": true }, "detail": { "type": "string", "nullable": true }, "instance": { "type": "string", "nullable": true } }, "additionalProperties": {} }, "RoleDto": { "required": [ "id", "name" ], "type": "object", "properties": { "id": { "type": "string", "description": "The unique identifier of the role." }, "name": { "type": "string", "description": "The name of the role." } }, "additionalProperties": false, "description": "Represents a role that can be assigned to a user." }, "RoleDtoPaginatedResponse": { "required": [ "items", "links", "metadata" ], "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/RoleDto" }, "description": "The items on the current page." }, "metadata": { "allOf": [ { "$ref": "#/components/schemas/PaginationMetadata" } ], "description": "Pagination details such as current page, page size, and total count." }, "links": { "allOf": [ { "$ref": "#/components/schemas/PaginationLinks" } ], "description": "Navigation links for first, previous, next, and last pages." } }, "additionalProperties": false, "description": "A paginated response envelope containing a page of items and navigation metadata." }, "ScimTokenDto": { "required": [ "createdAt", "id", "provider", "providerDisplayName" ], "type": "object", "properties": { "id": { "type": "string", "description": "The unique identifier of the SCIM token.", "format": "uuid" }, "provider": { "type": "string", "description": "The scheme name of the associated identity provider." }, "providerDisplayName": { "type": "string", "description": "The human-readable name of the associated identity provider." }, "createdAt": { "type": "string", "description": "The UTC date and time the token was created.", "format": "date-time" } }, "additionalProperties": false, "description": "Represents a SCIM provisioning token linked to an identity provider." }, "ScopeDto": { "required": [ "description", "displayName", "name" ], "type": "object", "properties": { "name": { "type": "string", "description": "The name of the scope, which is used to identify it in requests" }, "displayName": { "type": "string", "description": "The display name of the scope, which is used for user-friendly representation" }, "description": { "type": "string", "description": "A brief description of the scope and its purpose" } }, "additionalProperties": false, "description": "Represents a scope in Aritma ID" }, "ScopeDtoPaginatedResponse": { "required": [ "items", "links", "metadata" ], "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/ScopeDto" }, "description": "The items on the current page." }, "metadata": { "allOf": [ { "$ref": "#/components/schemas/PaginationMetadata" } ], "description": "Pagination details such as current page, page size, and total count." }, "links": { "allOf": [ { "$ref": "#/components/schemas/PaginationLinks" } ], "description": "Navigation links for first, previous, next, and last pages." } }, "additionalProperties": false, "description": "A paginated response envelope containing a page of items and navigation metadata." }, "SignicatMethods": { "enum": [ "None", "BankId", "MitId", "SBID" ], "type": "string", "description": "Electronic ID methods available through Signicat." }, "SignicatProperties": { "allOf": [ { "$ref": "#/components/schemas/CommonIdentityProviderProperties" }, { "required": [ "authority", "method", "verifyEnabled" ], "type": "object", "properties": { "verifyEnabled": { "type": "boolean", "description": "Whether to verify user identity on each login.", "example": false }, "authority": { "type": "string", "description": "The Signicat authority URL for your environment.", "example": "https://yourorg.signicat.com/auth/open" }, "method": { "allOf": [ { "$ref": "#/components/schemas/SignicatMethods" } ], "description": "The electronic ID method to enforce for authentication.", "example": "BankId" } }, "additionalProperties": false } ], "description": "Configuration properties for a Signicat SSO provider." }, "SignicatPropertiesCreateSsoProviderRequest": { "required": [ "displayName", "enabled", "properties", "scheme", "type" ], "type": "object", "properties": { "scheme": { "type": "string", "description": "The scheme name for the provider" }, "displayName": { "type": "string", "description": "The display name of the provider" }, "enabled": { "type": "boolean", "description": "Whether or not the provider is enabled" }, "type": { "allOf": [ { "$ref": "#/components/schemas/IdentityProviderType" } ], "description": "The type of identityprovider" }, "properties": { "allOf": [ { "$ref": "#/components/schemas/SignicatProperties" } ], "description": "The properties that defines the behavior of this provider, dependent on which provider that is used, see json schemas for more details" } }, "additionalProperties": false }, "SignicatPropertiesGetIdentityProviderResponse": { "required": [ "displayName", "enabled", "id", "properties", "providerName", "scheme", "type" ], "type": "object", "properties": { "id": { "type": "integer", "description": "The internal identifier of the identity provider.", "format": "int32", "example": 1 }, "scheme": { "type": "string", "description": "The unique authentication scheme name used to identify this provider.", "example": "azure-ad" }, "displayName": { "type": "string", "description": "The human-readable name shown to users on the login page.", "example": "Our Azure AD" }, "enabled": { "type": "boolean", "description": "Indicates whether this provider is currently active and available for login.", "example": true }, "providerName": { "type": "string", "description": "The provider type name (e.g. Azure, Google, Signicat, Custom).", "example": "Azure" }, "type": { "type": "string", "description": "The protocol type of the provider (e.g. oidc, saml2p).", "example": "oidc" }, "properties": { "allOf": [ { "$ref": "#/components/schemas/SignicatProperties" } ], "description": "Provider-specific configuration properties." } }, "additionalProperties": false, "description": "Details of a single SSO identity provider, including its provider-specific configuration." }, "SignicatPropertiesUpdateIdentityProviderDto": { "required": [ "displayName", "enabled", "id", "properties", "scheme", "type" ], "type": "object", "properties": { "id": { "type": "integer", "description": "The id of the identityprovider", "format": "int32" }, "scheme": { "type": "string", "description": "The scheme name for the provider" }, "displayName": { "type": "string", "description": "The display name of the provider" }, "enabled": { "type": "boolean", "description": "Whether or not the provider is enabled" }, "type": { "allOf": [ { "$ref": "#/components/schemas/IdentityProviderType" } ], "description": "The type of identityprovider" }, "properties": { "allOf": [ { "$ref": "#/components/schemas/SignicatProperties" } ], "description": "The properties that defines the behavior of this provider, dependent on which provider that is used, see json schemas for more details" } }, "additionalProperties": false }, "SubjectDto": { "required": [ "displayName", "id", "properties", "subjectId", "type" ], "type": "object", "properties": { "id": { "type": "string", "description": "The unique identifier of the subject within its type.", "example": "00000000-0000-0000-0000-000000000000" }, "displayName": { "type": "string", "description": "A human-readable display name for the subject.", "example": "John Doe" }, "tenant": { "type": "string", "description": "The tenant this subject belongs to. `null` for global subjects.", "nullable": true, "example": "00000000-0000-0000-0000-000000000000" }, "subjectId": { "type": "string", "description": "The fully-qualified subject identifier in the format `type-id`.", "readOnly": true, "example": "user-00000000-0000-0000-0000-000000000000" }, "type": { "allOf": [ { "$ref": "#/components/schemas/SubjectType" } ], "description": "The type of subject: User, Client, or Group.", "readOnly": true }, "properties": { "description": "Type-specific additional data about the subject. Shape depends on Aritma.IAM.V2.SubjectDto.Type.", "readOnly": true } }, "additionalProperties": false, "description": "Base representation of a subject (user, client, or group) within the IAM system.\nThe concrete type is indicated by the `$type` discriminator property.", "example": { "id": "00000000-0000-0000-0000-000000000000", "displayName": "John Doe", "tenant": "00000000-0000-0000-0000-000000000000", "subjectId": "user-00000000-0000-0000-0000-000000000000" } }, "SubjectDtoPaginatedIamResponse": { "required": [ "count", "data", "page", "pageSize", "total", "totalPages" ], "type": "object", "properties": { "data": { "type": "array", "items": { "oneOf": [ { "$ref": "#/components/schemas/UserSubjectDto" }, { "$ref": "#/components/schemas/ClientSubjectDto" }, { "$ref": "#/components/schemas/SubjectGroupDto" } ], "description": "Base representation of a subject (user, client, or group) within the IAM system.\nThe concrete type is indicated by the `$type` discriminator property." }, "description": "Data returned by request" }, "page": { "type": "integer", "description": "The current page which is fetched", "format": "int32", "example": 1 }, "pageSize": { "type": "integer", "description": "The current page size", "format": "int32", "example": 100 }, "count": { "type": "integer", "description": "The count of entries on the current page", "format": "int32", "readOnly": true, "example": 3 }, "total": { "type": "integer", "description": "Total entries across all pages.", "format": "int32", "example": 3 }, "totalPages": { "type": "integer", "description": "The total number of pages based on Aritma.IAM.V2.PaginatedIamResponse`1.Total and Aritma.IAM.V2.PaginatedIamResponse`1.PageSize.", "format": "int32", "readOnly": true, "example": 1 } }, "additionalProperties": false, "example": { "page": 1, "pageSize": 100, "count": 3, "total": 3, "totalPages": 1, "data": [ { "id": "00000000-0000-0000-0000-000000000000", "displayName": "John Doe", "tenant": "00000000-0000-0000-0000-000000000000", "subjectId": "user-00000000-0000-0000-0000-000000000000", "properties": { "username": "john.doe@aritma.com", "email": "john.doe@aritma.com", "phoneNumber": "+47 123 45 678" }, "type": "User" }, { "properties": { "iconUri": "https://aritma.com/favicon.ico", "description": "Internal billing service" }, "type": "Client", "id": "00000000-0000-0000-0000-000000000000", "displayName": "John Doe", "tenant": "00000000-0000-0000-0000-000000000000", "subjectId": "user-00000000-0000-0000-0000-000000000000" }, { "properties": { "description": "All administrators in the tenant", "memberCount": 5 }, "type": "Group", "id": "00000000-0000-0000-0000-000000000000", "displayName": "John Doe", "tenant": "00000000-0000-0000-0000-000000000000", "subjectId": "user-00000000-0000-0000-0000-000000000000" } ] } }, "SubjectGroupAdditionalData": { "required": [ "description", "memberCount" ], "type": "object", "properties": { "description": { "type": "string", "description": "A short description of the group's purpose.", "example": "All administrators in the tenant" }, "memberCount": { "type": "integer", "description": "The number of members currently in the group.", "format": "int32", "example": 5 } }, "additionalProperties": false, "description": "Additional metadata for a subject group.", "example": { "description": "All administrators in the tenant", "memberCount": 5 } }, "SubjectGroupDto": { "allOf": [ { "$ref": "#/components/schemas/SubjectDto" }, { "required": [ "properties" ], "type": "object", "properties": { "properties": { "allOf": [ { "$ref": "#/components/schemas/SubjectGroupAdditionalData" } ], "description": "Additional metadata for the subject group.", "example": { "description": "All administrators in the tenant", "memberCount": 5 } } }, "additionalProperties": false } ], "description": "A subject group — a named collection of users and/or clients.", "example": { "properties": { "description": "All administrators in the tenant", "memberCount": 5 }, "type": "Group", "id": "00000000-0000-0000-0000-000000000000", "displayName": "John Doe", "tenant": "00000000-0000-0000-0000-000000000000", "subjectId": "user-00000000-0000-0000-0000-000000000000" } }, "SubjectGroupDtoPaginatedIamResponse": { "required": [ "count", "data", "page", "pageSize", "total", "totalPages" ], "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/SubjectGroupDto" }, "description": "Data returned by request" }, "page": { "type": "integer", "description": "The current page which is fetched", "format": "int32", "example": 1 }, "pageSize": { "type": "integer", "description": "The current page size", "format": "int32", "example": 100 }, "count": { "type": "integer", "description": "The count of entries on the current page", "format": "int32", "readOnly": true, "example": 3 }, "total": { "type": "integer", "description": "Total entries across all pages.", "format": "int32", "example": 3 }, "totalPages": { "type": "integer", "description": "The total number of pages based on Aritma.IAM.V2.PaginatedIamResponse`1.Total and Aritma.IAM.V2.PaginatedIamResponse`1.PageSize.", "format": "int32", "readOnly": true, "example": 1 } }, "additionalProperties": false, "example": { "page": 1, "pageSize": 100, "count": 3, "total": 3, "totalPages": 1, "data": [ { "properties": { "description": "All administrators in the tenant", "memberCount": 5 }, "type": "Group", "id": "00000000-0000-0000-0000-000000000000", "displayName": "John Doe", "tenant": "00000000-0000-0000-0000-000000000000", "subjectId": "user-00000000-0000-0000-0000-000000000000" } ] } }, "SubjectGroupMemberDto": { "required": [ "groupId", "subjectId" ], "type": "object", "properties": { "groupId": { "type": "string", "description": "The identifier of the subject group.", "format": "uuid", "example": "00000000-0000-0000-0000-000000000000" }, "subjectId": { "type": "string", "description": "The fully-qualified subject identifier of the member, in the format `type-id`.", "example": "user-00000000-0000-0000-0000-000000000000" } }, "additionalProperties": false, "description": "Represents a membership link between a subject and a subject group.", "example": { "groupId": "00000000-0000-0000-0000-000000000000", "subjectId": "user-00000000-0000-0000-0000-000000000000" } }, "SubjectPermissionsResponse": { "required": [ "policies", "subject", "tenantRoles" ], "type": "object", "properties": { "policies": { "type": "array", "items": { "$ref": "#/components/schemas/PolicyDto" }, "description": "The policies that applies to the subject, filtered to scopes the requesting party has read access on." }, "tenantRoles": { "type": "array", "items": { "type": "string" }, "description": "The tenant-level OIDC roles assigned to the subject.", "example": [ "TenantAdmin" ] }, "subject": { "type": "string", "description": "The subject identifier this response is for.", "example": "user-00000000-0000-0000-0000-000000000000" } }, "additionalProperties": false, "example": { "tenantRoles": [ "TenantAdmin" ], "subject": "user-00000000-0000-0000-0000-000000000000", "policies": [ { "subject": "user-00000000-0000-0000-0000-000000000000", "scope": "/subscriptions/123", "action": "iam.policy.read", "tenant": "00000000-0000-0000-0000-000000000000" } ] } }, "SubjectType": { "enum": [ "User", "Client", "Anonymous", "Group" ], "type": "string" }, "UpdateClientRequest": { "required": [ "allowedGrantTypes", "allowedScopes", "description", "name", "redirectUris" ], "type": "object", "properties": { "name": { "type": "string", "description": "The updated display name of the client application.", "example": "My Application" }, "description": { "type": "string", "description": "Client description" }, "allowedGrantTypes": { "type": "array", "items": { "type": "string" }, "description": "Allowed grant types. I.e. \"authorization_code\", \"client_credentials\", \"password\", etc." }, "redirectUris": { "type": "array", "items": { "type": "string" }, "description": "Allowed redirect uris" }, "allowedScopes": { "type": "array", "items": { "type": "string" }, "description": "Scopes that can be requested for this client" } }, "additionalProperties": false, "description": "Request body for updating an existing client application." }, "UserAdditionalData": { "required": [ "email", "phoneNumber", "username" ], "type": "object", "properties": { "username": { "type": "string", "description": "The user's login username.", "example": "john.doe@aritma.com" }, "email": { "type": "string", "description": "The user's email address.", "example": "john.doe@aritma.com" }, "phoneNumber": { "type": "string", "description": "The user's phone number.", "example": "+47 123 45 678" } }, "additionalProperties": false, "description": "Additional identity data for a user subject.", "example": { "username": "john.doe@aritma.com", "email": "john.doe@aritma.com", "phoneNumber": "+47 123 45 678" } }, "UserClaimDto": { "required": [ "claimId", "claimType", "claimValue", "userId" ], "type": "object", "properties": { "claimId": { "type": "integer", "description": "The internal claim identifier.", "format": "int32", "example": 42 }, "userId": { "type": "string", "description": "The user the claim belongs to.", "example": "00000000-0000-0000-0000-000000000001" }, "claimType": { "type": "string", "description": "The claim type (e.g. a URI or short name).", "example": "email" }, "claimValue": { "type": "string", "description": "The claim value.", "example": "user@aritma.com" } }, "additionalProperties": false, "description": "Represents a claim assigned to a user." }, "UserDto": { "required": [ "email", "id", "phoneNumber", "roles", "twoFactorEnabled", "userName" ], "type": "object", "properties": { "id": { "type": "string", "description": "The unique identifier of the user.", "example": "00000000-0000-0000-0000-000000000001" }, "userName": { "type": "string", "description": "The username (login name) of the user.", "example": "jane.doe@aritma.com" }, "email": { "type": "string", "description": "The email address of the user.", "example": "jane.doe@aritma.com" }, "phoneNumber": { "type": "string", "description": "The phone number of the user, if registered.", "example": "+4712345678" }, "twoFactorEnabled": { "type": "boolean", "description": "Indicates whether two-factor authentication is enabled for the user.", "example": false }, "roles": { "type": "array", "items": { "$ref": "#/components/schemas/RoleDto" }, "description": "The roles assigned to the user." } }, "additionalProperties": false, "description": "Represents a user in Aritma ID." }, "UserDtoPaginatedResponse": { "required": [ "items", "links", "metadata" ], "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/UserDto" }, "description": "The items on the current page." }, "metadata": { "allOf": [ { "$ref": "#/components/schemas/PaginationMetadata" } ], "description": "Pagination details such as current page, page size, and total count." }, "links": { "allOf": [ { "$ref": "#/components/schemas/PaginationLinks" } ], "description": "Navigation links for first, previous, next, and last pages." } }, "additionalProperties": false, "description": "A paginated response envelope containing a page of items and navigation metadata." }, "UserSubjectDto": { "allOf": [ { "$ref": "#/components/schemas/SubjectDto" }, { "required": [ "properties" ], "type": "object", "properties": { "properties": { "allOf": [ { "$ref": "#/components/schemas/UserAdditionalData" } ], "description": "Additional identity data for the user.", "example": { "username": "john.doe@aritma.com", "email": "john.doe@aritma.com", "phoneNumber": "+47 123 45 678" } } }, "additionalProperties": false } ], "description": "A user subject — represents a human user within the IAM system.", "example": { "id": "00000000-0000-0000-0000-000000000000", "displayName": "John Doe", "tenant": "00000000-0000-0000-0000-000000000000", "subjectId": "user-00000000-0000-0000-0000-000000000000", "properties": { "username": "john.doe@aritma.com", "email": "john.doe@aritma.com", "phoneNumber": "+47 123 45 678" }, "type": "User" } }, "UserSubjectDtoPaginatedIamResponse": { "required": [ "count", "data", "page", "pageSize", "total", "totalPages" ], "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/UserSubjectDto" }, "description": "Data returned by request" }, "page": { "type": "integer", "description": "The current page which is fetched", "format": "int32", "example": 1 }, "pageSize": { "type": "integer", "description": "The current page size", "format": "int32", "example": 100 }, "count": { "type": "integer", "description": "The count of entries on the current page", "format": "int32", "readOnly": true, "example": 3 }, "total": { "type": "integer", "description": "Total entries across all pages.", "format": "int32", "example": 3 }, "totalPages": { "type": "integer", "description": "The total number of pages based on Aritma.IAM.V2.PaginatedIamResponse`1.Total and Aritma.IAM.V2.PaginatedIamResponse`1.PageSize.", "format": "int32", "readOnly": true, "example": 1 } }, "additionalProperties": false, "example": { "page": 1, "pageSize": 100, "count": 3, "total": 3, "totalPages": 1, "data": [ { "id": "00000000-0000-0000-0000-000000000000", "displayName": "John Doe", "tenant": "00000000-0000-0000-0000-000000000000", "subjectId": "user-00000000-0000-0000-0000-000000000000", "properties": { "username": "john.doe@aritma.com", "email": "john.doe@aritma.com", "phoneNumber": "+47 123 45 678" }, "type": "User" } ] } } }, "securitySchemes": { "authorization_code_with_pkce": { "type": "oauth2", "flows": { "authorizationCode": { "authorizationUrl": "https://id.dev.aritma.io/connect/authorize", "tokenUrl": "https://id.dev.aritma.io/connect/token", "scopes": { "services.iam": "Access to Aritma Identity and Access Management API" } } } }, "client_credentials": { "type": "oauth2", "flows": { "clientCredentials": { "tokenUrl": "https://id.dev.aritma.io/connect/token", "scopes": { "services.iam": "Access to Aritma Identity and Access Management API" } } } } } }, "security": [ { "authorization_code_with_pkce": [ "services.iam" ] }, { "client_credentials": [ "services.iam" ] } ], "tags": [ { "name": "Actions", "description": "Actions related to IAM actions" }, { "name": "Client", "description": "Actions related to clients in Aritma ID" }, { "name": "Domains", "description": "Actions related to domains registered for the tenant, and their verification status" }, { "name": "Me", "description": "Actions related to the currently authenticated user" }, { "name": "Me", "description": "Actions listing information about the currently authenticated user" }, { "name": "Policies", "description": "Actions related to IAM policies" }, { "name": "Role", "description": "Actions related to Aritma ID roles" }, { "name": "Scim", "description": "Actions related to SCIM tokens" }, { "name": "Scope", "description": "Actions related to scopes in Aritma ID" }, { "name": "SSO", "description": "Actions common for all SSO providers" }, { "name": "SSO - Azure AD (Entra ID)", "description": "Actions relating to AzureAd as an SSO provider" }, { "name": "SSO - Custom Providers", "description": "Actions relating to custom SSO providers" }, { "name": "SSO - Google", "description": "Actions relating to Google as an SSO provider" }, { "name": "SSO - Signicat", "description": "Actions relating to Signicat as an SSO provider" }, { "name": "Subjects", "description": "Actions related to IAM subjects" }, { "name": "User", "description": "Actions related to Aritma ID users" } ] }