Adobe Suite Attribute Based Access Control Policies API

openapi: 3.2.0
info:
  title: Attribute Based Access Control Policies API
  description: Access Control in Adobe Experience Platform allows organization administrators to assign roles and permissions for various Platform capabilities.
  version: '1.0'
servers:
- url: //{environment}.adobe.io/data/foundation/access-control
  variables:
    environment:
      default: platform
      enum:
      - platform
      - platform-stage
tags:
- name: Attribute Based Access Control Policies
  description: Attribute based access control policies are statements that bring attributes together to establish permissible and impermissible actions. More information about using this set of endpoints can be found in the policies endpoint guide.
paths:
  /administration/policies:
    get:
      tags:
      - Attribute Based Access Control Policies
      summary: List all existing policies in your organization
      operationId: listExistingPolicies
      parameters:
      - $ref: '#/components/parameters/authorization'
      - $ref: '#/components/parameters/content-type'
      - $ref: '#/components/parameters/x-api-key'
      - $ref: '#/components/parameters/x-gw-ims-org-id'
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/policyResponse'
    post:
      tags:
      - Attribute Based Access Control Policies
      summary: Create a new policy
      operationId: createPolicy
      parameters:
      - $ref: '#/components/parameters/authorization'
      - $ref: '#/components/parameters/x-api-key'
      - $ref: '#/components/parameters/x-gw-ims-org-id'
      requestBody:
        description: The request body for creating a policy.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/createNewPolicyRequestBody'
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/newPolicyResponse'
  /administration/policies/{POLICY_ID}:
    get:
      tags:
      - Attribute Based Access Control Policies
      summary: Retrieve a policy
      operationId: retrievePolicy
      parameters:
      - $ref: '#/components/parameters/authorization'
      - $ref: '#/components/parameters/content-type'
      - $ref: '#/components/parameters/x-api-key'
      - $ref: '#/components/parameters/x-gw-ims-org-id'
      - name: POLICY_ID
        in: path
        description: The ID of the policy you want to retrieve.
        required: true
        schema:
          type: string
          example: 7019068e-a3a0-48ce-b56b-008109470592
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/policyResponse'
    put:
      tags:
      - Attribute Based Access Control Policies
      summary: Update a policy by policy ID
      operationId: updatePolicyByPolicyId
      parameters:
      - $ref: '#/components/parameters/authorization'
      - $ref: '#/components/parameters/x-api-key'
      - $ref: '#/components/parameters/x-gw-ims-org-id'
      - name: POLICY_ID
        in: path
        description: The ID of the role you want to update.
        required: true
        schema:
          type: string
          example: 8cf487d7-3642-4243-a8ea-213d72f694b9
      requestBody:
        description: The request body for updating a policy using the policy ID.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/policyUpdateByIdBody'
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/policyUpdateResponse'
    patch:
      tags:
      - Attribute Based Access Control Policies
      summary: Update policy properties
      operationId: updatePolicy
      parameters:
      - $ref: '#/components/parameters/authorization'
      - $ref: '#/components/parameters/x-api-key'
      - $ref: '#/components/parameters/x-gw-ims-org-id'
      - name: POLICY_ID
        in: path
        description: The ID of the policy you want to update.
        required: true
        schema:
          type: string
          example: 8cf487d7-3642-4243-a8ea-213d72f694b9
      requestBody:
        description: The request body for updating a policy.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/policyPatchOperation'
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/policyUpdateResponse'
    delete:
      tags:
      - Attribute Based Access Control Policies
      summary: Delete a policy
      operationId: deletePolicy
      parameters:
      - $ref: '#/components/parameters/authorization'
      - $ref: '#/components/parameters/x-api-key'
      - $ref: '#/components/parameters/x-gw-ims-org-id'
      - name: POLICY_ID
        in: path
        description: The ID of the policy you want to delete.
        required: true
        schema:
          type: string
          example: 8cf487d7-3642-4243-a8ea-213d72f694b9
      responses:
        204:
          description: A successful response returns HTTP status 204 (No Content) and a blank body.
          content:
            application/json:
              schema:
                type: object
components:
  schemas:
    policyResponse:
      type: object
      properties:
        items:
          type: array
          properties:
            type: object
            properties:
              id:
                type: string
                description: The ID that corresponds with the policy.
              recordType:
                type: string
                description: The record type of the policy.
              imsOrgId:
                type: string
                description: The organization where the queried policy is accessible.
              createdBy:
                type: string
                description: The ID of the user that created the polucy.
              createdAt:
                type: integer
                description: A timestamp to date the creation of the policy.
              modifiedBy:
                type: string
                description: The ID of the user that modified the policy.
              modifiedAt:
                type: integer
                description: A timestamp to date the modification of the policy.
              name:
                type: string
                description: The name of the policy.
              description:
                type: string
                description: Additional information for the policy.
              status:
                type: string
                description: The current status of a policy.
              subjectCondition:
                type: string
                description: The conditions applied to a subject.
              rules:
                type: array
                properties:
                  effect:
                    type: string
                    description: The effect that results after considering values for action, condition and resource. Possible values include permit, deny, or indeterminate.
                    enum:
                    - permit
                    - deny
                    - indeterminate
                  resource:
                    type: string
                    description: The asset or object that a subject can or can’t access.
                  condition:
                    type: string
                    description: The conditions applied to a resource.
                  actions:
                    type: string
                    description: The action that a subject is permitted to do against a queried resource. Possible values include read, write, view, and delete.
                description: The set of rules that define a policy.
            parameters:
              type: object
              properties:
                sandboxes:
                  type: array
                  items:
                    type: string
                  description: The sandboxes associated with the policy.
              description: Additional parameters associated with the policy.
            etag:
              type: string
              description: A unique eTag is returned by the HTTP response.
            isDefault:
              type: boolean
              description: Indicates if the policy is a default policy.
          example:
          - id: 7019068e-a3a0-48ce-b56b-008109470592
            recordType: policy
            imsOrgId: 5555467B5D8013E50A494220@AdobeOrg
            createdBy: example@AdobeID
            createdAt: 1652892767559
            modifiedBy: example@AdobeID
            modifiedAt: 1652895736367
            name: schema-field
            description: schema-field
            status: inactive
            subjectCondition: null
            rules:
            - effect: Deny
              resource: /orgs/5555467B5D8013E50A494220@AdobeOrg/sandboxes/xql/schemas/*/schema-fields/*
              condition: '{"adobe.match_all_labels_by_prefix":[{"var":"subject.roles.labels"},"core/",{"var":"resource.labels"}]}'
              actions:
              - com.adobe.action.read
              - com.adobe.action.write
              - com.adobe.action.view
            - effect: Permit
              resource: /orgs/5555467B5D8013E50A494220@AdobeOrg/sandboxes/*/schemas/*/schema-fields/*
              condition: '{"adobe.match_all_labels_by_prefix":[{"var":"subject.roles.labels"},"core/",{"var":"resource.labels"}]}'
              actions:
              - com.adobe.action.delete
            - effect: Deny
              resource: /orgs/5555467B5D8013E50A494220@AdobeOrg/sandboxes/delete-sandbox-adfengine-test-8/segments/*
              condition: '{"!":[{"adobe.match_any_labels_by_prefix":[{"var":"subject.roles.labels"},"custom/",{"var":"resource.labels"}]}]}'
              actions:
              - com.adobe.action.write
            parameters:
              sandboxes:
              - prod
            etag: '"0300593f-0000-0200-0000-62852ff80000"'
            isDefault: false
        _links:
          type: object
          description: Contains the URL for the currently displayed response page.
          properties:
            self:
              type: object
              properties:
                href:
                  type: string
                  example: /administration/policies
                  description: The URL for the currently displayed response page.
                templated:
                  type: boolean
                  example: false
                  description: Indicates if the sibling `href` property is a template.
                type:
                  type: string
                  example: null
                  description: The type of the link.
                method:
                  type: string
                  example: null
                  description: The HTTP method used for the link.
            page:
              type: object
              properties:
                href:
                  type: string
                  example: /administration/policies?limit={limit}&start={start}&orderBy={orderBy}&property={property}
                  description: The URL for the currently displayed response page.
                templated:
                  type: boolean
                  description: Indicates if the sibling `href` property is a template.
                type:
                  type: string
                  example: null
                  description: The type of the link.
                method:
                  type: string
                  example: null
        _page:
          type: object
          description: An object that shows what page the list is on.
          properties:
            orderBy:
              type: string
              example: -createdAt
              description: The field by which the results are ordered.
            start:
              type: integer
              example: 0
              description: The index of the first item in the response.
            count:
              type: integer
              example: 1
              description: The number of results returned per page.
            next:
              type: integer
              example: null
              description: The index of the first item in the next page of results.
            properties:
              type: array
              items:
                type: string
              description: The list of properties included in the response.
    policyUpdateByIdBody:
      type: object
      properties:
        id:
          type: string
          example: 8cf487d7-3642-4243-a8ea-213d72f694b9
          description: The ID that corresponds with the policy.
        imsOrgID:
          type: string
          example: 5555467B5D8013E50A494220@AdobeOrg
          description: The organization where the queried policy is accessible.
        name:
          type: string
          example: acme-integration-policy
          description: The name of the policy.
        rules:
          type: object
          properties:
            effect:
              type: string
              description: The effect that results after considering values for action, condition and resource. Possible values include permit, deny, or indeterminate.
              enum:
              - permit
              - deny
              - indeterminate
            resource:
              type: string
              description: The asset or object that a subject can or can’t access.
            condition:
              type: string
              description: The conditions applied to a resource.
            actions:
              type: string
              description: The action that a subject is permitted to do against a queried resource. Possible values include read, write, view, and delete.
          example:
          - effect: Deny
            resource: /orgs/5555467B5D8013E50A494220@AdobeOrg/sandboxes/*
            condition: '{"or":[{"adobe.match_any_labels_by_prefix":[{"var":"subject.roles.labels"},"core/",{"var":"resource.labels"}]},{"!":[{"adobe.match_all_labels_by_prefix":[{"var":"subject.roles.labels"},"core/",{"var":"resource.labels"}]}]}]}'
            actions:
            - com.adobe.action.read
    policyUpdateResponse:
      type: object
      properties:
        id:
          type: string
          description: The ID that corresponds with the policy.
        imsOrgID:
          type: string
          description: The organization where the queried policy is accessible.
        createdBy:
          type: string
          description: The ID of the user that created the polucy.
        createdAt:
          type: integer
          description: A timestamp to date the creation of the policy.
        modifiedBy:
          type: string
          description: The ID of the user that modified the policy.
        modifiedAt:
          type: integer
          description: A timestamp to date the modification of the policy.
        name:
          type: string
          description: The name of the policy.
        description:
          type: string
          description: A descriptive value that you can include to provide more information on your role.
        status:
          type: string
          description: The current status of a policy.
        subjectCondition:
          description: The conditions applied to a subject.
        rules:
          type: object
          properties:
            effect:
              type: string
              description: The effect that results after considering values for action, condition and resource. Possible values include permit, deny, or indeterminate.
              enum:
              - permit
              - deny
              - indeterminate
            resource:
              type: string
              description: The asset or object that a subject can or can’t access.
            condition:
              type: string
              description: The conditions applied to a resource.
            actions:
              type: string
              description: The action that a subject is permitted to do against a queried resource. Possible values include read, write, view, and delete.
          description: The set of rules that define a policy.
        _etag:
          type: string
          example: null
          description: A unique eTag is returned by the HTTP response.
      example:
      - id: 8cf487d7-3642-4243-a8ea-213d72f694b9
        imsOrgId: 5555467B5D8013E50A494220@AdobeOrg
        createdBy: example@AdobeID
        createdAt: 1652988866647
        modifiedBy: example@AdobeID
        modifiedAt: 1652989297287
        name: acme-integration-policy
        description: Policy for ACME.
        status: active
        subjectCondition: null
        rules:
        - effect: Deny
          resource: /orgs/5555467B5D8013E50A494220@AdobeOrg/sandboxes/*
          condition: '{"or":[{"adobe.match_any_labels_by_prefix":[{"var":"subject.roles.labels"},"core/",{"var":"resource.labels"}]},{"!":[{"adobe.match_all_labels_by_prefix":[{"var":"subject.roles.labels"},"core/",{"var":"resource.labels"}]}]}]}'
          actions:
          - com.adobe.action.read
        _etag: null
    policyPatchOperation:
      required:
      - op
      - path
      - value
      type: object
      properties:
        op:
          type: string
          description: The operation call used to define the action needed to update the policy. Operations include add, replace, and remove.
          example: replace
          enum:
          - add
          - replace
          - remove
        path:
          type: string
          description: The path of the parameter to be updated.
          example: /description
        value:
          type: string
          description: The new value you want to update your parameter with.
          example: Policy for ACME.
      description: Patch operation.
    newPolicyResponse:
      type: object
      properties:
        id:
          type: string
          description: The ID that corresponds with the policy.
        imsOrgID:
          type: string
          description: The organization where the queried policy is accessible.
        createdBy:
          type: string
          description: The ID of the user that created the polucy.
        createdAt:
          type: integer
          description: A timestamp to date the creation of the policy.
        modifiedBy:
          type: string
          description: The ID of the user that modified the policy.
        modifiedAt:
          type: integer
          description: A timestamp to date the modification of the policy.
        name:
          type: string
          description: The name of the policy.
        description:
          type: string
          description: A descriptive value that you can include to provide more information on your role.
        status:
          type: string
          description: The current status of a policy.
        subjectCondition:
          description: The conditions applied to a subject.
        rules:
          type: object
          properties:
            effect:
              type: string
              description: The effect that results after considering values for action, condition and resource. Possible values include permit, deny, or indeterminate.
              enum:
              - permit
              - deny
              - indeterminate
            resource:
              type: string
              description: The asset or object that a subject can or can’t access.
            condition:
              type: string
              description: The conditions applied to a resource.
            actions:
              type: string
              description: The action that a subject is permitted to do against a queried resource. Possible values include read, write, view, and delete.
          description: The set of rules that define a policy.
        _etag:
          type: string
          example: null
          description: A unique eTag is returned by the HTTP response.
      example:
      - id: c3863937-5d40-448d-a7be-416e538f955e
        imsOrgId: 5555467B5D8013E50A494220@AdobeOrg
        createdBy: example@AdobeID
        createdAt: 1652988384458
        modifiedBy: example@AdobeID
        modifiedAt: 1652988384458
        name: acme-integration-policy
        description: Policy for ACME.
        status: active
        subjectCondition: null
        rules:
        - effect: Permit
          resource: /orgs/5555467B5D8013E50A494220@AdobeOrg/sandboxes/*
          condition: '{"or":[{"adobe.match_any_labels_by_prefix":[{"var":"subject.roles.labels"},"core/",{"var":"resource.labels"}]},{"!":[{"adobe.match_all_labels_by_prefix":[{"var":"subject.roles.labels"},"core/",{"var":"resource.labels"}]}]}]}'
          actions:
          - com.adobe.action.read
        _etag: null
    createNewPolicyRequestBody:
      type: object
      properties:
        name:
          type: string
          example: acme-integration-policy
          description: The name of the policy.
        description:
          type: string
          example: Policy for ACME.
          description: A descriptive value that you can include to provide more information on your policy.
        imsOrgID:
          type: string
          example: 5555467B5D8013E50A494220@AdobeOrg
          description: The organization where the queried policy is accessible.
        rules:
          type: object
          properties:
            effect:
              type: string
              example: Permit
              description: The effect that results after considering values for action, condition and resource. Possible values include permit, deny, or indeterminate.
              enum:
              - permit
              - deny
              - indeterminate
            resource:
              type: string
              example: /orgs/5555467B5D8013E50A494220@AdobeOrg/sandboxes/*
              description: The asset or object that a subject can or can’t access.
            condition:
              type: string
              example: '{"or":[{"adobe.match_any_labels_by_prefix":[{"var":"subject.roles.labels"},"core/",{"var":"resource.labels"}]},{"!":[{"adobe.match_all_labels_by_prefix":[{"var":"subject.roles.labels"},"core/",{"var":"resource.labels"}]}]}]}'
              description: The conditions applied to a resource.
            actions:
              type: string
              example:
              - com.adobe.action.read
              description: The action that a subject is permitted to do against a queried resource. Possible values include read, write, view, and delete.
  parameters:
    x-api-key:
      name: x-api-key
      in: header
      description: The API key which can be copied from your Experience Platform integration. For more information on how to obtain this value, visit the [authentication tutorial](http://www.adobe.com/go/platform-api-authentication-en).
      required: true
      schema:
        type: string
    authorization:
      name: Authorization
      in: header
      description: The access token which can be copied from your Experience Platform integration, prefixed with "Bearer ". For more information on how to obtain this value, visit the [authentication tutorial](http://www.adobe.com/go/platform-api-authentication-en). If a user token is being passed, then the user of the token must have an “org admin” role for the requested org.
      required: true
      schema:
        type: string
    content-type:
      name: Content-Type
      in: header
      description: The content type of the request body. For all requests, this value must be application/json.
      required: true
      schema:
        type: string
        enum:
        - application/json
    x-gw-ims-org-id:
      name: x-gw-ims-org-id
      in: header
      description: The Organization ID which can be copied from your Experience Platform integration. For more information on how to obtain this value, visit the [authentication tutorial](http://www.adobe.com/go/platform-api-authentication-en).
      required: true
      schema:
        type: string
x-original-swagger-version: '2.0'