Anaconda Users API

openapi: 3.2.0
info:
  version: '6.5'
  title: Anaconda Server Users API
  description: User role management endpoints (CRUD is managed separately)
servers:
- url: https://api.anaconda.cloud/api
tags:
- name: users
  description: User role management endpoints (CRUD is managed separately)
paths:
  /account/tokens/{token_id}/metadata:
    put:
      tags:
      - users
      summary: Update user token metadata
      operationId: repo.endpoints.tokens.user_tokens.put_token_metadata
      description: 'Updates token metadata

        '
      parameters:
      - $ref: '#/components/parameters/token_id-parameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserTokenUpdateMetadataRequest'
      responses:
        '200':
          description: Updated token object, which also contains the token itself
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserTokenUpdateResponse'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
  /users/{user_id}/tokens:
    get:
      tags:
      - users
      summary: Get user tokens for current account by admin user
      description: 'Returns the list of created token by this user, either `scope` or `resource` type. Token list includes also `token_hash`.

        '
      operationId: repo.endpoints.tokens.admin_user_tokens.list_tokens
      parameters:
      - $ref: '#/components/parameters/user_id-parameter'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserTokenList'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
    post:
      tags:
      - users
      summary: Create a new user token by admin user
      description: Give access to allow user to do specific actions on one or more resources
      operationId: repo.endpoints.tokens.admin_user_tokens.post_token
      parameters:
      - $ref: '#/components/parameters/user_id-parameter'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserTokenCreateRequest'
      responses:
        '200':
          description: Created token object, which also contains the token itself and id of the token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserTokenCreateResponse'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
  /users/tokens:
    post:
      tags:
      - users
      summary: Bulk update of token information for users
      operationId: repo.endpoints.tokens.admin_user_tokens.list_users_tokens
      description: 'By default reissues a new tokens and returns a UsersTokens object with tokens,  successful_updated_users and unsuccessful_updated_users attributes. If `reissue_token` query parameter is false, then tokens are not reissued and old values are used. The api returns `null` as a token in this case.

        '
      parameters:
      - $ref: '#/components/parameters/with_hash-query'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UsersTokenGetRequest'
      responses:
        '200':
          description: Updated users tokens object, which also contains the tokens itself
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UsersTokensGetResponse'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
    put:
      tags:
      - users
      summary: Bulk update of token information for users
      operationId: repo.endpoints.tokens.admin_user_tokens.put_tokens
      description: 'By default reissues a new tokens and returns a UsersTokens object with tokens,  successful_updated_users and unsuccessful_updated_users attributes. If `reissue_token` query parameter is false, then tokens are not reissued and old values are used. The api returns `null` as a token in this case.

        '
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UsersTokenUpdateRequest'
      responses:
        '200':
          description: Updated users tokens object, which also contains the tokens itself
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UsersTokenUpdateResponse'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
  /users/{user_id}/tokens/{token_id}:
    put:
      tags:
      - users
      summary: Update user token information
      operationId: repo.endpoints.tokens.admin_user_tokens.put_token
      description: 'By default reissues a new token and returns in `token` attribute. If `reissue_token` query parameter is false, then token is not reissued and old value is used. The api returns `null` as a token in this case.

        '
      parameters:
      - $ref: '#/components/parameters/user_id-parameter'
      - $ref: '#/components/parameters/token_id-parameter'
      - $ref: '#/components/parameters/reissue_token-query'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserTokenUpdateRequest'
      responses:
        '200':
          description: Updated token object, which also contains the token itself
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserTokenUpdateResponse'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
    delete:
      tags:
      - users
      summary: Delete specific user token
      operationId: repo.endpoints.tokens.admin_user_tokens.delete_token
      parameters:
      - $ref: '#/components/parameters/user_id-parameter'
      - $ref: '#/components/parameters/token_id-parameter'
      responses:
        '204':
          description: Token is deleted
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
  /users/{user_id}/tokens/{token_id}/metadata:
    put:
      tags:
      - users
      summary: Update user token metadata
      operationId: repo.endpoints.tokens.admin_user_tokens.put_token_metadata
      description: 'Updates token metadata

        '
      parameters:
      - $ref: '#/components/parameters/user_id-parameter'
      - $ref: '#/components/parameters/token_id-parameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserTokenUpdateMetadataRequest'
      responses:
        '200':
          description: Updated token object, which also contains the token itself
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserTokenUpdateResponse'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
  /users:
    get:
      tags:
      - users
      summary: Get list of users for the group editing
      operationId: repo.endpoints.users.list_users
      parameters:
      - $ref: '#/components/parameters/search-query'
      - $ref: '#/components/parameters/limit-query'
      - $ref: '#/components/parameters/offset-query'
      responses:
        '200':
          description: successfully retrieved users
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/GroupMember'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
    post:
      x-not-implemented: red
      tags:
      - users
      summary: Admin Only! Create user (handled by IDP for now)
      description: Admin only. This can only be done by the logged in user.
      operationId: repo.endpoints.users.post
      requestBody:
        description: create user with provided payload
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/User'
      responses:
        '200':
          description: successful operation
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
      deprecated: true
  /users/{user_id}:
    get:
      x-not-implemented: red
      tags:
      - users
      summary: Admin Only! get individual user by user id (handled by IDP for now)
      operationId: repo.endpoints.users.get
      parameters:
      - in: path
        name: user_id
        schema:
          type: string
        required: true
      responses:
        '200':
          description: successfully retrieved single user
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
      deprecated: true
    put:
      x-not-implemented: red
      tags:
      - users
      summary: Admin Only! Edit the individual user role by user id
      operationId: repo.endpoints.users.put
      parameters:
      - in: path
        name: user_id
        schema:
          type: string
        required: true
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                id:
                  type: string
                  description: the user's id
                role:
                  type: string
                  enum:
                  - user
                  - author
                  - admin
      responses:
        '200':
          description: successfully edited single org
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
      deprecated: true
    delete:
      x-not-implemented: red
      tags:
      - users
      summary: Admin Only! delete user (handled by IDP for now)
      operationId: repo.endpoints.users.delete
      parameters:
      - in: path
        name: user_id
        schema:
          type: string
        required: true
      responses:
        '200':
          description: successfully deleted user
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
      deprecated: true
  /users/{user_id}/activity:
    get:
      x-not-implemented: red
      tags:
      - users
      summary: Get the activity logs for the specific user
      operationId: repo.endpoints.users.logs
      parameters:
      - in: path
        name: user_id
        schema:
          type: string
        required: true
      - $ref: '#/components/parameters/offset-query'
      - $ref: '#/components/parameters/limit-query'
      responses:
        '200':
          description: successfully retrieved the activity logs for the user
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserLogs'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
      deprecated: true
  /roles:
    get:
      tags:
      - users
      summary: Get the list of available roles
      operationId: repo.endpoints.roles.list_roles
      responses:
        '200':
          description: get all roles
          content:
            application/json:
              schema:
                type: object
                properties:
                  total_count:
                    type: number
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/AuthRole'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
    post:
      tags:
      - users
      summary: Adds a new role
      operationId: repo.endpoints.roles.post_role
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthRole'
      responses:
        '200':
          description: the role object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthRole'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
  /roles/{role_id}:
    put:
      tags:
      - users
      summary: Edit the role
      operationId: repo.endpoints.roles.put_role
      parameters:
      - $ref: '#/components/parameters/role_id-parameter'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthRole'
      responses:
        '200':
          description: get all roles
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthRole'
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
    delete:
      tags:
      - users
      summary: Delete the role
      operationId: repo.endpoints.roles.delete_role
      parameters:
      - $ref: '#/components/parameters/role_id-parameter'
      responses:
        '204':
          description: successfully deleted role
        '401':
          $ref: '#/components/responses/Unauthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
      - jwt: []
components:
  responses:
    Forbidden:
      description: Access is forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The specified resource was not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Server cannot execute request due to something that is perceived to be a client error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthenticated:
      description: Unauthenticated, no token is provided or token is invalid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: Creating/updating resource raises a conflict
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    UserResourceToken:
      type: object
      properties:
        id:
          type: string
          description: Id of the token in the system, not a token itself!
        name:
          type: string
        created_at:
          type: string
        expires_at:
          type: string
        metadata:
          type: object
        resources:
          type: array
          items:
            $ref: '#/components/schemas/UserTokenPermissionResourceItem'
    UserTokenUpdateMetadataRequest:
      type: object
    UserTokenCreateResourceRequest:
      type: object
      additionalProperties: false
      required:
      - name
      - resources
      properties:
        name:
          type: string
          minLength: 1
        metadata:
          type: object
        expires_at:
          type: string
          minLength: 1
          pattern: ^\d{4}-\d{2}-\d{2}$
        resources:
          type: array
          items:
            $ref: '#/components/schemas/UserTokenPermissionResourceItem'
          minItems: 1
    User:
      type: object
      description: Use same structure for create and read
      properties:
        id:
          type: string
        username:
          type: string
          description: could username be the email? its unique
        firstName:
          type: string
          description: do we need this?
        lastName:
          type: string
          description: do we need this?
        email:
          type: string
        org:
          type: string
          description: the uid of the org this user might belong to
        role:
          type: array
          items:
            type: string
            enum:
            - user
            - author
            - admin
          description: "permissions types for users\n  * \"user\" - Allows for searching and downloading\n  * \"author\" - Allows for searching, downloading, uploading, and updating packages\n"
    AuthRole:
      type: object
      required:
      - name
      - permissions
      properties:
        id:
          type: string
          description: role_id, this is read-only attribute
        name:
          type: string
          pattern: ^[a-z][a-z0-9_\-]*$
          description: 'Role name, next names are reserved: admin (admin''s permissions could not be overwriten)

            '
        persistent:
          type: boolean
          description: persistent roles are built-in and can't be removed. This is read-only attribute
        permissions:
          $ref: '#/components/schemas/AuthRolePermissions'
    AuthRolePermissions:
      type: object
      additionalProperties: false
      properties:
        channel:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        channel.default-channel:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        channel.group:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        channel.mirror:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        channel.routes-filtered:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        subchannel:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        subchannel.group:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        subchannel.mirror:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        artifact:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        cve:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        role:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        system:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        system.license:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        system.settings:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        user.token:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        mirror:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        audit-logs:
          $ref: '#/components/schemas/AuthRolePermissionValue'
        cve-notifications:
          $ref: '#/components/schemas/AuthRolePermissionValue'
    GroupMember:
      type: object
      description: Small object that represents the users belonging to the group
      properties:
        id:
          type: string
          description: the uid of the
        username:
          type: string
          description: the username of the member
    ErrorResponse:
      type: object
      description: The metadata contained in an error response
      properties:
        code:
          type: string
          description: Internal error code. Could be used to show corresponding message text from a message catalog
          example: bad-parameter
        message:
          type: string
          description: Short human-readable error message. Used mainly for logging
          example: Bad request parameter for 'sort'
        status:
          type: integer
          description: The HTTP Status code
          example: 401
    UserTokenCreateResponse:
      type: object
      properties:
        id:
          type: string
          description: Token Id, represents the token position for token management
        token:
          type: string
          description: Token itself. It's one-time generated, couldn't be read with different api.
    UserTokenPermissionResourceItem:
      type: object
      description: Represents a resource element, which user can access, for example specific channel. This enforces the default user authorization level.
      required:
      - resource_type
      - resource_id
      - permission
      properties:
        resource_type:
          type: string
          enum:
          - channel
          - subchannel
          - artifact
        resource_id:
          type: string
          description: resource name
        permission:
          type: string
    AuthRolePermissionValue:
      type:
      - string
      - 'null'
      enum:
      - read
      - write
      - manage
      description: the lowerest permission level, which could be set for the resource
    UserTokenList:
      type: object
      description: The list of user tokens, either `scope` or `resource` types.
      properties:
        items:
          type: array
          items:
            oneOf:
            - $ref: '#/components/schemas/UserResourceToken'
            - $ref: '#/components/schemas/UserScopeToken'
    UserTokenCreateScopedRequest:
      type: object
      additionalProperties: false
      required:
      - name
      - scopes
      properties:
        name:
          type: string
          minLength: 1
        metadata:
          type: object
        expires_at:
          type: string
          minLength: 1
          format: date
        scopes:
          type: array
          items:
            type: string
          minItems: 1
    UsersTokensGetResponse:
      type: object
      properties:
        items:
          type: array
    UsersTokenUpdateResponse:
      type: object
      properties:
        tokens:
          type: array
        successful_updated_users:
          type: array
    UsersTokenGetRequest:
      type: object
      properties:
        users_ids:
          type: array
    UsersTokenUpdateRequest:
      type: object
      properties:
        token_ids:
          type: array
        expires_at:
          type: string
          minLength: 1
          format: date
        resources:
          type: array
          items:
            $ref: '#/components/schemas/UserTokenPermissionResourceItem'
          minItems: 1
          maxItems: 100
    UserTokenUpdateRequest:
      type: object
      properties:
        name:
          type: string
          minLength: 1
        expires_at:
          type: string
          minLength: 1
          format: date
        resources:
          type: array
          items:
            $ref: '#/components/schemas/UserTokenPermissionResourceItem'
          minItems: 1
    UserTokenCreateRequest:
      oneOf:
      - $ref: '#/components/schemas/UserTokenCreateResourceRequest'
      - $ref: '#/components/schemas/UserTokenCreateScopedRequest'
      description: The token could be created either `scope` or `resource` based.
      example:
        name: channel view token
        expires_at: '2021-01-01'
        scopes:
        - channel:view
        - subchannel:view
    UserLogs:
      type: object
      description: Logs for a user
      properties:
        id:
          type: string
        userId:
          description: id of user that logs are associated with
          type: string
        updated:
          description: timestamp of last log update
          type: string
        logs:
          type: string
    UserTokenUpdateResponse:
      type: object
      properties:
        token:
          type: string
    UserScopeToken:
      type: object
      properties:
        id:
          type: string
          description: Id of the token in the system, not a token itself!
        name:
          type: string
        metadata:
          type: object
        created_at:
          type: string
        expires_at:
          type: string
        scopes:
          type: array
          items:
            type: string
            description: must be valid, which is available in the system
  parameters:
    offset-query:
      in: query
      name: offset
      required: false
      schema:
        type: integer
        default: 0
      description: the offset of the result set
    search-query:
      in: query
      name: q
      description: the string to search on
      schema:
        type: string
    reissue_token-query:
      in: query
      name: reissue_token
      required: false
      schema:
        type: boolean
        default: true
      description: update token endpoint by default reissues a new token.
    limit-query:
      in: query
      name: limit
      required: false
      schema:
        type: integer
        default: 100
      description: the number of results in the result set
    role_id-parameter:
      name: role_id
      in: path
      required: true
      schema:
        type: string
    token_id-parameter:
      name: token_id
      description: Id of the token position, not an X-Auth or JWT token itself!
      in: path
      required: true
      schema:
        type: string
        minLength: 1
    with_hash-query:
      in: query
      name: with_hash
      required: false
      schema:
        type: boolean
        default: true
      description: get token endpoint by default returns token hash.
    user_id-parameter:
      name: user_id
      in: path
      required: true
      schema:
        type: string
  securitySchemes:
    jwt:
      type: http
      scheme: bearer
      bearerFormat: JWT
      x-bearerInfoFunc: repo.auth.token_provider.decode_token
    user_token:
      type: apiKey
      name: X-Auth
      in: header
      x-apikeyInfoFunc: repo.auth.token_provider.decode_user_private_token