Amazon KMS Kms Grant API

openapi: 3.2.0
info:
  title: AWS Key Management Service Grant API
  version: '2014-11-01'
  description: Generated from AWS's published Smithy model for AWS Key Management Service. 4 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://kms.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Grant
paths:
  /#CreateGrant:
    post:
      operationId: CreateGrant
      summary: Create Grant
      description: Adds a grant to a KMS key. A grant is a policy instrument that allows Amazon Web Services principals to use KMS keys in cryptographic operations. It also can allow them to view a KMS key (DescribeKey) and create and manage grants. When authorizing access to a KMS key, grants are considered along with key policies and IAM policies. Grants are often used for temporary permissions because you can create one, use its permissions, and delete it without changing your key policies or IAM policies. You can create a grant for an Amazon Web Services principal (IAM user, IAM role, or Amazon Web Services account) by specifying the GranteePrincipal parameter. You can also create a grant for an Amazon Web Services service principal by specifying the GranteeServicePrincipal parameter. For detailed information about grants, including grant terminology, see Grants in KMS in the Key Management Service Developer Guide . For examples of creating grants in several programming languages, see Use CreateGrant with an Amazon Web Services SDK or CLI. The CreateGrant operation returns a GrantToken and a GrantId. When you create, retire, or revoke a grant, there might be a brief delay, usually less than five
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/CreateGrantResponse'
              example:
                GrantToken: AQpAM2RhZTk1MGMyNTk2ZmZmMzEyYWVhOWViN2I1MWM4Mzc0MWFiYjc0ZDE1ODkyNGFlNTIzODZhMzgyZjBlNGY3NiKIAgEBAgB4Pa6VDCWW__MSrqnre1HIN0Grt00ViSSuUjhqOC8OT3YAAADfMIHcBgkqhkiG9w0BBwaggc4wgcsCAQAwgcUGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMmqLyBTAegIn9XlK5AgEQgIGXZQjkBcl1dykDdqZBUQ6L1OfUivQy7JVYO2-ZJP7m6f1g8GzV47HX5phdtONAP7K_HQIflcgpkoCqd_fUnE114mSmiagWkbQ5sqAVV3ov-VeqgrvMe5ZFEWLMSluvBAqdjHEdMIkHMlhlj4ENZbzBfo9Wxk8b8SnwP4kc4gGivedzFXo-dwN8fxjjq_ZZ9JFOj2ijIbj5FyogDCN0drOfi8RORSEuCEmPvjFRMFAwcmwFkN2NPp89amA
                GrantId: 0c237476b39f8bc44e45212e08498fbe3151305030726c0590dd8d3e9f3d6a60
        '503':
          description: DependencyTimeoutException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DependencyTimeoutException'
        '409':
          description: DisabledException; KMSInvalidStateException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DisabledException'
        '412':
          description: DryRunOperationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DryRunOperationException'
        '400':
          description: InvalidArnException; InvalidGrantTokenException; LimitExceededException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidArnException'
        '500':
          description: KMSInternalException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/KMSInternalException'
        '404':
          description: NotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/NotFoundException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - TrentService.CreateGrant
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/CreateGrantRequest'
            example:
              KeyId: arn:aws:kms:us-east-2:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab
              GranteePrincipal: arn:aws:iam::111122223333:role/ExampleRole
              Operations:
              - Encrypt
              - Decrypt
      tags:
      - Grant
  /#ListGrants:
    post:
      operationId: ListGrants
      summary: List Grants
      description: 'Gets a list of all grants for the specified KMS key. You must specify the KMS key in all requests. You can filter the grant list by grant ID, grantee principal, or grantee service principal. For detailed information about grants, including grant terminology, see Grants in KMS in the Key Management Service Developer Guide . For examples of creating grants in several programming languages, see Use CreateGrant with an Amazon Web Services SDK or CLI. When a grant is created with the GranteePrincipal field, the ListGrants response usually contains the user or role designated as the grantee principal in the grant. However, if the grantee principal is an Amazon Web Services service, the GranteePrincipal field contains an Amazon Web Services service principal, which might correspond to several different grantee principals, such as an IAM user, IAM role, or Amazon Web Services account. When a grant is created with the GranteeServicePrincipal field, the ListGrants response always includes a GranteeServicePrincipal that indicates the grantee is actually an Amazon Web Services service principal. Cross-account use: Yes. To perform this operation on a KMS key in a different Amazon Web Services a'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ListGrantsResponse'
        '503':
          description: DependencyTimeoutException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DependencyTimeoutException'
        '400':
          description: InvalidArnException; InvalidGrantIdException; InvalidMarkerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidArnException'
        '500':
          description: KMSInternalException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/KMSInternalException'
        '409':
          description: KMSInvalidStateException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/KMSInvalidStateException'
        '404':
          description: NotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/NotFoundException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - TrentService.ListGrants
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/ListGrantsRequest'
      tags:
      - Grant
  /#RetireGrant:
    post:
      operationId: RetireGrant
      summary: Retire Grant
      description: 'Deletes a grant. Typically, you retire a grant when you no longer need its permissions. To identify the grant to retire, use a grant token, or both the grant ID and a key identifier (key ID or key ARN) of the KMS key. The CreateGrant operation returns both values. This operation can be called by the retiring principal for a grant, by the grantee principal if the grant allows the RetireGrant operation, and by the Amazon Web Services account in which the grant is created. It can also be called by principals to whom permission for retiring a grant is delegated. For detailed information about grants, including grant terminology, see Grants in KMS in the Key Management Service Developer Guide . For examples of creating grants in several programming languages, see Use CreateGrant with an Amazon Web Services SDK or CLI. Cross-account use: Yes. You can retire a grant on a KMS key in a different Amazon Web Services account. Required permissions: Permission to retire a grant is determined primarily by the grant. For details, see Retiring and revoking grants in the Key Management Service Developer Guide. Related operations: CreateGrant ListGrants ListRetirableGrants RevokeGrant Eventual consi'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '503':
          description: DependencyTimeoutException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DependencyTimeoutException'
        '412':
          description: DryRunOperationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DryRunOperationException'
        '400':
          description: InvalidArnException; InvalidGrantIdException; InvalidGrantTokenException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidArnException'
        '500':
          description: KMSInternalException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/KMSInternalException'
        '409':
          description: KMSInvalidStateException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/KMSInvalidStateException'
        '404':
          description: NotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/NotFoundException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - TrentService.RetireGrant
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/RetireGrantRequest'
            example:
              KeyId: arn:aws:kms:us-east-2:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab
              GrantId: 0c237476b39f8bc44e45212e08498fbe3151305030726c0590dd8d3e9f3d6a60
      tags:
      - Grant
  /#RevokeGrant:
    post:
      operationId: RevokeGrant
      summary: Revoke Grant
      description: 'Deletes the specified grant. You revoke a grant to terminate the permissions that the grant allows. For more information, see Retiring and revoking grants in the Key Management Service Developer Guide . When you create, retire, or revoke a grant, there might be a brief delay, usually less than five minutes, until the grant is available throughout KMS. This state is known as eventual consistency. For details, see Eventual consistency in the Key Management Service Developer Guide . For detailed information about grants, including grant terminology, see Grants in KMS in the Key Management Service Developer Guide . For examples of creating grants in several programming languages, see Use CreateGrant with an Amazon Web Services SDK or CLI. Cross-account use: Yes. To perform this operation on a KMS key in a different Amazon Web Services account, specify the key ARN in the value of the KeyId parameter. Required permissions: kms:RevokeGrant (key policy). Related operations: CreateGrant ListGrants ListRetirableGrants RetireGrant Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '503':
          description: DependencyTimeoutException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DependencyTimeoutException'
        '412':
          description: DryRunOperationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DryRunOperationException'
        '400':
          description: InvalidArnException; InvalidGrantIdException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidArnException'
        '500':
          description: KMSInternalException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/KMSInternalException'
        '409':
          description: KMSInvalidStateException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/KMSInvalidStateException'
        '404':
          description: NotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/NotFoundException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - TrentService.RevokeGrant
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/RevokeGrantRequest'
            example:
              KeyId: 1234abcd-12ab-34cd-56ef-1234567890ab
              GrantId: 0c237476b39f8bc44e45212e08498fbe3151305030726c0590dd8d3e9f3d6a60
      tags:
      - Grant
components:
  schemas:
    RevokeGrantRequest:
      type: object
      properties:
        KeyId:
          type: string
          description: 'A unique identifier for the KMS key associated with the grant. To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey. Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN. For example: Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.'
        GrantId:
          type: string
          description: Identifies the grant to revoke. To get the grant ID, use CreateGrant, ListGrants, or ListRetirableGrants.
        DryRun:
          type: boolean
          description: Checks if your request will succeed. DryRun is an optional parameter. To learn more about how to use this parameter, see Testing your permissions in the Key Management Service Developer Guide.
      required:
      - KeyId
      - GrantId
    ListGrantsResponse:
      type: object
      properties:
        Grants:
          type: array
          items:
            $ref: '#/components/schemas/GrantListEntry'
          description: A list of grants.
        NextMarker:
          type: string
          description: When Truncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent request.
        Truncated:
          type: boolean
          description: A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of the NextMarker element in this response to the Marker parameter in a subsequent request.
    GrantConstraints:
      type: object
      properties:
        EncryptionContextSubset:
          type: object
          additionalProperties:
            type: string
          description: A list of key-value pairs that must be included in the encryption context of the cryptographic operation request. The grant allows the cryptographic operation only when the encryption context in the request includes the key-value pairs specified in this constraint, although it can include additional key-value pairs.
        EncryptionContextEquals:
          type: object
          additionalProperties:
            type: string
          description: A list of key-value pairs that must match the encryption context in the cryptographic operation request. The grant allows the operation only when the encryption context in the request is the same as the encryption context specified in this constraint.
        SourceArn:
          type: string
          description: The Amazon Resource Name (ARN) of an Amazon Web Services resource on behalf of which the request is made. This is effectively the same as having the aws:SourceArn global condition key in the grant. The SourceArn constraint ensures that the principal can use the KMS key only when the request is made on behalf of the specified resource.
    RetireGrantRequest:
      type: object
      properties:
        GrantToken:
          type: string
          description: Identifies the grant to be retired. You can use a grant token to identify a new grant even before it has achieved eventual consistency. Only the CreateGrant operation returns a grant token. For details, see Grant token and Eventual consistency in the Key Management Service Developer Guide.
        KeyId:
          type: string
          description: 'The key ARN KMS key associated with the grant. To find the key ARN, use the ListKeys operation. For example: arn:aws:kms:us-east-2:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab'
        GrantId:
          type: string
          description: Identifies the grant to retire. To get the grant ID, use CreateGrant, ListGrants, or ListRetirableGrants. Grant ID Example - 0123456789012345678901234567890123456789012345678901234567890123
        DryRun:
          type: boolean
          description: Checks if your request will succeed. DryRun is an optional parameter. To learn more about how to use this parameter, see Testing your permissions in the Key Management Service Developer Guide.
    GrantListEntry:
      type: object
      properties:
        KeyId:
          type: string
          description: The unique identifier for the KMS key to which the grant applies.
        GrantId:
          type: string
          description: The unique identifier for the grant.
        Name:
          type: string
          description: The friendly name that identifies the grant. If a name was provided in the CreateGrant request, that name is returned. Otherwise this value is null.
        CreationDate:
          type: string
          format: date-time
          description: The date and time when the grant was created.
        GranteePrincipal:
          type: string
          description: The identity that gets the permissions in the grant. When a grant is created with the GranteePrincipal field, the ListGrants response usually contains the user or role designated as the grantee principal in the grant. However, if the grantee principal is an Amazon Web Services service, the GranteePrincipal field contains an Amazon Web Services service principal, which might correspond to several different grantee principals, such as an IAM user, IAM role, or Amazon Web Services account.
        RetiringPrincipal:
          type: string
          description: The principal that can retire the grant.
        IssuingAccount:
          type: string
          description: The Amazon Web Services account under which the grant was issued.
        Operations:
          type: array
          items:
            type: string
            enum:
            - Decrypt
            - Encrypt
            - GenerateDataKey
            - GenerateDataKeyWithoutPlaintext
            - ReEncryptFrom
            - ReEncryptTo
            - Sign
            - Verify
            - GetPublicKey
            - CreateGrant
            - RetireGrant
            - DescribeKey
            - GenerateDataKeyPair
            - GenerateDataKeyPairWithoutPlaintext
            - GenerateMac
            - VerifyMac
            - DeriveSharedSecret
            - Encapsulate
            - Decapsulate
          description: The list of operations permitted by the grant.
        Constraints:
          $ref: '#/components/schemas/GrantConstraints'
        GranteeServicePrincipal:
          type: string
          description: The Amazon Web Services service principal that gets the permissions in the grant.
        RetiringServicePrincipal:
          type: string
          description: The Amazon Web Services service principal that can retire the grant.
    NotFoundException:
      type: object
      properties:
        message:
          type: string
    DryRunOperationException:
      type: object
      properties:
        message:
          type: string
    CreateGrantResponse:
      type: object
      properties:
        GrantToken:
          type: string
          description: The grant token. Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved eventual consistency. For more information, see Grant token and Using a grant token in the Key Management Service Developer Guide.
        GrantId:
          type: string
          description: The unique identifier for the grant. You can use the GrantId in a ListGrants, RetireGrant, or RevokeGrant operation.
    KMSInvalidStateException:
      type: object
      properties:
        message:
          type: string
    DisabledException:
      type: object
      properties:
        message:
          type: string
    ListGrantsRequest:
      type: object
      properties:
        Limit:
          type: integer
          description: Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer. This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.
        Marker:
          type: string
          description: Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of NextMarker from the truncated response you just received.
        KeyId:
          type: string
          description: 'Returns only grants for the specified KMS key. This parameter is required. Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN. For example: Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.'
        GrantId:
          type: string
          description: Returns only the grant with the specified grant ID. The grant ID uniquely identifies the grant.
        GranteePrincipal:
          type: string
          description: Returns only grants where the specified principal is the grantee principal for the grant. You can specify either GranteePrincipal or GranteeServicePrincipal, but not both.
        GranteeServicePrincipal:
          type: string
          description: Returns only grants where the specified Amazon Web Services service principal is the grantee service principal for the grant. This filter is only usable by callers in a service principal. You can specify either GranteePrincipal or GranteeServicePrincipal, but not both.
      required:
      - KeyId
    KMSInternalException:
      type: object
      properties:
        message:
          type: string
    DependencyTimeoutException:
      type: object
      properties:
        message:
          type: string
    InvalidArnException:
      type: object
      properties:
        message:
          type: string
    CreateGrantRequest:
      type: object
      properties:
        KeyId:
          type: string
          description: 'Identifies the KMS key for the grant. The grant gives principals permission to use this KMS key. Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN. For example: Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.'
        GranteePrincipal:
          type: string
          description: The identity that gets the permissions specified in the grant. To specify the grantee principal, use the Amazon Resource Name (ARN) of an Amazon Web Services principal. Valid principals include Amazon Web Services accounts, IAM users, IAM roles, federated users, and assumed role users. For help with the ARN syntax for a principal, see IAM ARNs in the Identity and Access Management User Guide . You must specify either GranteePrincipal or GranteeServicePrincipal, but not both.
        RetiringPrincipal:
          type: string
          description: The principal that has permission to use the RetireGrant operation to retire the grant. To specify the principal, use the Amazon Resource Name (ARN) of an Amazon Web Services principal. Valid principals include Amazon Web Services accounts, IAM users, IAM roles, federated users, and assumed role users. For help with the ARN syntax for a principal, see IAM ARNs in the Identity and Access Management User Guide . The grant determines the retiring principal. Other principals might have permission to retire the grant or revoke the grant. For details, see RevokeGrant and Retiring and revoking grants
        Operations:
          type: array
          items:
            type: string
            enum:
            - Decrypt
            - Encrypt
            - GenerateDataKey
            - GenerateDataKeyWithoutPlaintext
            - ReEncryptFrom
            - ReEncryptTo
            - Sign
            - Verify
            - GetPublicKey
            - CreateGrant
            - RetireGrant
            - DescribeKey
            - GenerateDataKeyPair
            - GenerateDataKeyPairWithoutPlaintext
            - GenerateMac
            - VerifyMac
            - DeriveSharedSecret
            - Encapsulate
            - Decapsulate
          description: A list of operations that the grant permits. This list must include only operations that are permitted in a grant. Also, the operation must be supported on the KMS key. For example, you cannot create a grant for a symmetric encryption KMS key that allows the Sign operation, or a grant for an asymmetric KMS key that allows the GenerateDataKey operation. If you try, KMS returns a ValidationError exception. For details, see Grant operations in the Key Management Service Developer Guide.
        Constraints:
          $ref: '#/components/schemas/GrantConstraints'
        GrantTokens:
          type: array
          items:
            type: string
          description: A list of grant tokens. Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved eventual consistency. For more information, see Grant token and Using a grant token in the Key Management Service Developer Guide.
        Name:
          type: string
          description: A friendly name for the grant. Use this value to prevent the unintended creation of duplicate grants when retrying this request. Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output. When this value is absent, all CreateGrant requests result in a new grant with a unique GrantId even if all the supplied parameters are identical. This can result in unintended duplicates when you retry the CreateGrant request. When this value is present, you can retry a CreateGrant request with identical parameters; if the
        DryRun:
          type: boolean
          description: Checks if your request will succeed. DryRun is an optional parameter. To learn more about how to use this parameter, see Testing your permissions in the Key Management Service Developer Guide.
        GranteeServicePrincipal:
          type: string
          description: The Amazon Web Services service principal that gets the permissions specified in the grant. When you specify a GranteeServicePrincipal, you must also specify a SourceArn grant constraint. In addition, you must specify either a RetiringPrincipal or a RetiringServicePrincipal. You must specify either GranteePrincipal or GranteeServicePrincipal, but not both.
        RetiringServicePrincipal:
          type: string
          description: The Amazon Web Services service principal that has permission to use the RetireGrant operation to retire the grant. You can specify either RetiringPrincipal or RetiringServicePrincipal, but not both.
      required:
      - KeyId
      - Operations
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: kms
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/kms/service/2014-11-01/kms-2014-11-01.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)