Antfly Permission API

openapi: 3.2.0
info:
  title: Antfly Public Permission API
  version: v1alpha1
  description: Joined public contract for the Antfly server. Antfly APIs are served under `/db/v1`, auth APIs under `/auth/v1`, inference APIs under `/ai/v1`, ML prediction APIs under `/ml/v1`, and extension lifecycle APIs under `/extensions/v1`.
servers:
- url: /
security:
- BasicAuth: []
- ApiKeyAuth: []
- BearerAuth: []
tags:
- name: Permission
  x-displayName: Permission
  description: Operations related to permissions
paths:
  /auth/v1/users/{userName}/permissions:
    parameters:
    - $ref: '#/components/parameters/UserNamePathParameter'
    get:
      tags:
      - Permission
      summary: Get user permissions
      description: Retrieves all permissions for a specific user.
      operationId: getUserPermissions
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Permission'
        '400':
          description: Bad Request (e.g., username is required)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: User not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - BasicAuth: []
      - ApiKeyAuth: []
      - BearerAuth: []
    post:
      tags:
      - Permission
      summary: Add permission to user
      description: Adds a new permission to a specific user.
      operationId: addPermissionToUser
      requestBody:
        description: Permission details to add
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Permission'
      responses:
        '201':
          description: Permission added successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessMessage'
        '400':
          description: Bad Request (e.g., invalid input, username required)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: User not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - BasicAuth: []
      - ApiKeyAuth: []
      - BearerAuth: []
    delete:
      tags:
      - Permission
      summary: Remove permission from user
      description: Removes a specific permission rule from a user based on resource name and type.
      operationId: removePermissionFromUser
      parameters:
      - name: resource
        in: query
        required: true
        description: The name of the resource for the permission to be removed.
        schema:
          type: string
          example: orders_table
      - name: resourceType
        in: query
        required: true
        description: The type of the resource for the permission to be removed.
        schema:
          $ref: '#/components/schemas/ResourceType'
      - name: database
        in: query
        schema:
          type: string
      - name: namespace
        in: query
        schema:
          type: string
      - name: all_tables
        in: query
        schema:
          type: boolean
      responses:
        '204':
          description: Permission removed successfully
        '400':
          description: Bad Request (e.g., missing query parameters, invalid resourceType, username required)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: User not found or Role not found for the given resource
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - BasicAuth: []
      - ApiKeyAuth: []
      - BearerAuth: []
components:
  schemas:
    Permission:
      type: object
      description: Specify exactly one of a legacy literal resource or a structured table_target; table_target requires resource_type table.
      properties:
        resource:
          type: string
          description: Resource name (e.g., table name, target username, or '*' for all inference operations or a global grant).
          example: orders_table
        table_target:
          $ref: '#/components/schemas/CatalogTableScope'
        resource_type:
          $ref: '#/components/schemas/ResourceType'
        type:
          $ref: '#/components/schemas/PermissionType'
      required:
      - resource_type
      - type
    SuccessMessage:
      type: object
      properties:
        message:
          type: string
          example: Operation completed successfully
    CatalogTableScope:
      type: object
      description: A table or all tables in an explicit namespace. A missing table selects the namespace; a table named '*' remains literal.
      properties:
        database:
          type: string
          default: default
        namespace:
          type: string
          default: public
        table:
          type: string
      additionalProperties: false
    Error:
      type: object
      properties:
        code:
          type: string
          description: Optional stable machine-readable error code for programmatic handling.
        error:
          type: string
          example: An error message
          description: Legacy human-readable error text.
        message:
          type: string
          description: Human-readable error description when supplied by the endpoint.
        retryable:
          type: boolean
          description: Whether retrying the operation may succeed without changing the request.
        retry_after_ms:
          type: integer
          format: int32
          minimum: 1
          description: Suggested minimum retry delay in milliseconds.
      required:
      - error
    ResourceType:
      type: string
      enum:
      - table
      - database
      - namespace
      - tablespace
      - user
      - inference
      - '*'
      description: 'Type of resource: table, user, inference, or global (''*''). Use inference with resource ''*'' to grant access to unified inference routes.'
      example: table
    PermissionType:
      type: string
      enum:
      - read
      - write
      - curator
      - admin
      description: Type of permission.
      example: read
  parameters:
    UserNamePathParameter:
      name: userName
      in: path
      required: true
      description: The username.
      schema:
        type: string
        example: johndoe
  securitySchemes:
    BasicAuth:
      type: http
      scheme: basic
    ApiKeyAuth:
      type: apiKey
      in: header
      name: Authorization
    BearerAuth:
      type: http
      scheme: bearer
x-tagGroups:
- name: Antfly
  tags:
  - cluster_management
  - table_management
  - data_operations
  - query_operations
  - index_management
- name: Auth
  tags:
  - User
  - Permission
  - ApiKey
  - RowFilter
- name: Inference
  tags: []
- name: Extensions
  tags:
  - Packages
  - Installed