OpenAPI Specification
openapi: 3.2.0
info:
title: Britive Services API Documentation My Access API
version: v1
description: API documentation for Users, Tags, Identity providers, Applications, Reporting, Audit logs, Tenants, SSO, Profiles, Password policies, MFA, Access Builder Settings, etc.
servers:
- url: https://{tenantURL}
description: The primary server
variables:
tenantURL:
default: test.britive-app.com
description: The host of the server
security:
- bearerAuth: []
tags:
- name: My Access
description: Manage My Access
paths:
/api/access:
get:
tags:
- My Access
summary: Get all profiles associated with the user with an API token
operationId: getMyAccess
parameters:
- name: page
in: query
description: page number of my-access profile list. Default is 0
required: false
schema:
type: integer
format: int32
default: 0
- name: size
in: query
description: size of the request for my-access profile list. Default is 20.
required: false
schema:
type: integer
format: int32
default: 20
- name: filter
in: query
description: Filters for my-access profiles that can be applied - appName, papName, environmentName, environmentId, appType. Operators - eq, sw, co
required: false
schema:
type: string
example: appName eq "AWS"
- name: sort
in: query
description: Sorting of my-access profiles that can be applied - appName, papName, environmentName, environmentId, appType. Operators - asc, desc
required: false
schema:
type: string
example: appName,ASC
- name: searchText
in: query
description: Search by all fields.
required: false
schema:
type: string
example: searchText=AWS
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/MyAccessSummary'
/api/access/frequently-used:
get:
tags:
- My Access
summary: Get all frequently-used profiles for the logged-in user
operationId: myAccessUI
parameters:
- name: limit
in: query
required: false
schema:
type: integer
format: int32
default: 10
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
/api/access/{id}/url:
get:
tags:
- My Access
summary: Get console URL
description: 'Returns the console sign-in URL for a checked-out profile. Available for `CLI` and `CONSOLE` checkout types; throws an error for `PROGRAMMATIC` checkouts. The response always contains a `url` key; some application types (e.g. OpenShift) may include additional keys such as `idpName`. When `spInitiatedSSO=true`, returns the tenant SAML endpoint URL instead of the application URL.
'
operationId: url
parameters:
- name: id
in: path
description: Transaction ID returned by the checkout call
required: true
schema:
type: string
- name: spInitiatedSSO
in: query
required: false
schema:
type: boolean
default: false
responses:
'200':
description: Console URL retrieved successfully
content:
application/json:
schema:
$ref: '#/components/schemas/ConsoleUrlResponse'
/api/access/{profileId}/environments/{environmentId}:
post:
tags:
- My Access
summary: Checkout profile - console or programmatic
description: 'Checkout a profile for a specific environment. Use `accessType=CONSOLE` to obtain a federated console session or `accessType=PROGRAMMATIC` to obtain short-lived programmatic credentials (e.g. AWS access keys). The response `transactionId` is required for subsequent getToken, getConsoleUrl, and check-in calls. For ITSM-gated profiles, supply `ticketId` and `ticketType` in the request body.
'
operationId: checkoutProfile
parameters:
- name: profileId
in: path
description: Profile (PAP) ID to checkout
required: true
schema:
type: string
- name: environmentId
in: path
description: Environment ID within the application
required: true
schema:
type: string
- name: accessType
in: query
description: 'Type of access to checkout. `CONSOLE` grants a federated web-console session; `PROGRAMMATIC` grants short-lived API credentials; `CLI` (default) for CLI-based access.
'
required: false
schema:
type: string
enum:
- CLI
- CONSOLE
- PROGRAMMATIC
default: CLI
- name: type
in: query
description: Legacy alias for `accessType`. Ignored when `accessType` is provided.
required: false
schema:
type: string
default: CLI
requestBody:
description: Optional ITSM ticket details for approval-gated profiles
required: false
content:
application/json:
schema:
$ref: '#/components/schemas/Settings'
example:
justification: Access required for incident response
ticketId: INC0001234
ticketType: INCIDENT
userOnCall: 'false'
responses:
'200':
description: Checkout initiated successfully. Poll `status` until `checkedOut`.
content:
application/json:
schema:
$ref: '#/components/schemas/AppAccessStatusResponse'
'403':
description: Access denied or profile policy conditions not met
'404':
description: Profile or environment not found
/api/access/{profileId}/environments/{environmentId}/approvalRequest:
post:
tags:
- My Access
summary: Create an approval request for profile
description: This API is used when a profile is configured with advanced settings for ITSM integration.
operationId: profileApprovalRequest
parameters:
- name: profileId
in: path
required: true
schema:
type: string
- name: environmentId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
/api/access/{profileId}/environments/{environmentId}/itsm/{ticketType}/search:
get:
tags:
- My Access
summary: Search tickets using search text and the ITSM integration setting available for the profile
operationId: searchItsmTickets
parameters:
- name: profileId
in: path
description: Profile ID to get the effective ITSM settings
required: true
schema:
type: string
- name: environmentId
in: path
description: Environment ID to get the effective ITSM settings
required: true
schema:
type: string
- name: ticketType
in: path
description: Ticket type for ITSM ticket searching
required: true
schema:
type: string
- name: searchText
in: query
schema:
type: string
description: The text for searching
responses:
'200':
description: Successful operation
content:
application/json:
schema:
$ref: '#/components/schemas/ITSMTicketSearchResult'
'404':
description: Profile, environment or ticketType not found
/api/access/{profileId}/environments/{environmentId}/itsm/{ticketType}/validate/{ticketId}:
get:
tags:
- My Access
summary: Validate ITSM ticket using the ITSM integration setting available for the profile
operationId: validateItsmTicket
parameters:
- name: profileId
in: path
description: Profile ID to get the effective ITSM settings
required: true
schema:
type: string
- name: environmentId
in: path
description: Environment ID to get the effective ITSM settings
required: true
schema:
type: string
- name: ticketType
in: path
description: Ticket type for the validation
required: true
schema:
type: string
- name: ticketId
in: path
required: true
schema:
type: string
description: Ticket Id for the validation
responses:
'200':
description: Successful operation
content:
application/json:
schema:
$ref: '#/components/schemas/ITSMTicketValidationResult'
'404':
description: Profile, environment or ticketType not found
/api/access/{profileId}/environments/{environmentId}/settings:
get:
tags:
- My Access
summary: Get access profile setting for given profile ID
operationId: getAccessProfileSetting
parameters:
- name: profileId
in: path
description: Profile ID to get Profile Access Setting
required: true
schema:
type: string
- name: environmentId
in: path
description: Environment ID to get Profile Access Setting
required: true
schema:
type: string
responses:
'200':
description: Successful operation
content:
application/json:
schema:
$ref: '#/components/schemas/AccessProfileSettings'
'404':
description: Profile or environment not found
/api/access/{transactionId}:
put:
tags:
- My Access
summary: Check in profile
description: 'Check in a previously checked-out profile session. The `transactionId` is returned by the checkout call. Terminates the active session and revokes any issued credentials.
'
operationId: checkinProfile
parameters:
- name: transactionId
in: path
description: Transaction ID returned by the checkout call
required: true
schema:
type: string
responses:
'200':
description: Check-in completed successfully
content:
application/json:
schema:
$ref: '#/components/schemas/AppAccessStatusResponse'
'404':
description: Transaction not found
/api/access/{transactionId}/tokens:
get:
tags:
- My Access
summary: Get programmatic credentials (tokens)
description: 'Retrieve short-lived programmatic credentials for a checked-out profile. Available for `CLI` and `PROGRAMMATIC` checkout types; throws an error for `CONSOLE` checkouts. The response is a key-value map whose structure varies by application type. Requires the application to have token support enabled (`supportsTokens=true`).
'
operationId: getTokens
parameters:
- name: transactionId
in: path
description: Transaction ID returned by the checkout call
required: true
schema:
type: string
responses:
'200':
description: Programmatic credentials retrieved successfully
content:
application/json:
schema:
$ref: '#/components/schemas/TokensResponse'
'404':
description: Transaction not found or credentials not yet ready
/api/access/{userId}/filters:
post:
tags:
- My Access
summary: Create user filter
operationId: createUserFilter
parameters:
- name: userId
in: path
description: userid
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/UserFiltersDTO'
required: true
responses:
'201':
description: User filter created successfully
content:
application/json:
schema:
$ref: '#/components/schemas/UserFiltersDTO'
get:
tags:
- My Access
summary: Get user filters
operationId: getUserFilters
parameters:
- name: userId
in: path
description: userid
required: true
schema:
type: string
responses:
'200':
description: Get user filters
content:
application/json:
schema:
$ref: '#/components/schemas/UserFiltersDTO'
'404':
description: Not found
/api/access/{userId}/filters/{filterId}:
delete:
tags:
- My Access
summary: Delete user filter
operationId: deleteUserFilter
parameters:
- name: userId
in: path
description: Id of the user for that filter needs to be updated/deleted
required: true
schema:
type: string
- name: filterId
in: path
description: Id of the filter that needs to be updated/deleted
required: true
schema:
type: string
responses:
'204':
description: Delete user filter
'404':
description: Error
put:
tags:
- My Access
summary: Update user filter
operationId: updateUserFilter
parameters:
- name: userId
in: path
description: Id of the user for that filter needs to be updated/deleted
required: true
schema:
type: string
- name: filterId
in: path
description: Id of the filter that needs to be updated/deleted
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/UserFiltersDTO'
example:
name: filter5
filter:
applications:
- test11
associations:
- env11
profiles:
- profile11
statuses:
- status11
applicationTypes:
- AWS11
required: true
responses:
'204':
description: Update user filter
'404':
description: Error
components:
schemas:
UserFiltersDTO:
type: object
properties:
id:
type: string
name:
type: string
filter:
$ref: '#/components/schemas/Filter'
ITSMTicketValidationResult:
type: object
properties:
success:
type: boolean
description: Validation result
message:
type: string
description: Validation message
ticketDetails:
type: object
description: Ticket details like id, number, title, assignee, priority, etc.
Filter:
type: object
properties:
applications:
type: array
items:
type: string
associations:
type: array
items:
type: string
profiles:
type: array
items:
type: string
statuses:
type: array
items:
type: string
applicationTypes:
type: array
items:
type: string
AccessProfileSettings:
type: object
properties:
profileId:
type: string
environmentId:
type: string
justificationSetting:
$ref: '#/components/schemas/JustificationSettingsDto'
itsmSetting:
$ref: '#/components/schemas/ItsmSettingsDto'
onCallSettings:
$ref: '#/components/schemas/AutoApprovalSettings'
approvalRequestData:
$ref: '#/components/schemas/ApprovalRequestData'
MyAccessProfile:
type: object
properties:
papId:
type: string
example: id1
papName:
type: string
example: S3Access
description:
type: string
example: ''
consoleAccess:
type: boolean
example: 'true'
programmaticAccess:
type: boolean
example: 'false'
sessionAttributes:
type: array
items:
type: object
example: []
accessCount:
type: integer
example: '0'
expirationDuration:
type: integer
format: int64
description: Duration in milliseconds
example: '1800000'
extensionDuration:
type: integer
format: int64
description: Duration in milliseconds
example: '1800000'
extensionLimit:
type: integer
example: '1'
notificationPriorToExpiration:
type: integer
format: int64
description: Duration in milliseconds
example: '300000'
extendable:
type: boolean
example: 'false'
ITSMFilter:
type: object
additionalProperties:
type: string
ItsmSettingsDto:
allOf:
- $ref: '#/components/schemas/SettingsDto'
- type: object
properties:
connectionId:
type: string
connectionType:
type: string
isCommentRequired:
type: boolean
isITSMEnabled:
type: boolean
supportedTicketTypes:
type: array
items:
type: string
itsmFilterCriteria:
type: array
items:
$ref: '#/components/schemas/ItsmFilterCriteriaDto'
settingsType:
type: string
ApprovalRequestData:
type: object
properties:
justification:
type: string
description: Existing Justification
ticketId:
type: string
description: Existing Ticket ID
ticketType:
type: string
description: Existing Ticket Type
ITSMTicketSearchResult:
type: object
properties:
totalCount:
type: integer
description: Total count of search result
maxResults:
type: integer
description: Maximum result count
tickets:
type: object
description: List of the tickets with the details like id, number, title, assignee, priority, etc.
ItsmFilterCriteriaDto:
type: object
properties:
supportedTicketType:
type: string
filter:
$ref: '#/components/schemas/ITSMFilter'
TokensResponse:
type: object
description: 'Short-lived programmatic credentials. The keys and values are application-type-specific. Only available for `CLI` and `PROGRAMMATIC` checkout types; requires the application to have `supportsTokens=true`.
'
additionalProperties:
type: string
AutoApprovalSettings:
type: object
properties:
isAutoApproved:
type: boolean
default: false
autoApprovalEndDate:
type: string
MyAccess:
type: object
properties:
frequency:
type: integer
example: '0'
countOfProfiles:
type: integer
example: '100'
papId:
type: string
example: id1
environmentId:
type: string
example: envId1
appId:
type: string
example: appId1
myAccessDetails:
type: array
items:
$ref: '#/components/schemas/MyAccessDetail'
application:
$ref: '#/components/schemas/MyAccessApplication'
environment:
$ref: '#/components/schemas/MyAccessEnvironment'
profile:
$ref: '#/components/schemas/MyAccessProfile'
AppAccessStatusResponse:
type: object
description: Status of a profile checkout or check-in operation
properties:
transactionId:
type: string
description: Unique transaction identifier; required for getTokens, getConsoleUrl, and check-in calls
example: txn_abc123
papId:
type: string
description: Profile (PAP) string identifier
example: pap_xyz456
appContainerId:
type: string
description: Application container identifier
example: app_123
environmentId:
type: string
description: Environment identifier
example: env_789
userId:
type: string
description: User identifier (string form)
example: user_001
status:
type: string
description: Current lifecycle status of the checkout operation
enum:
- checkedOut
- checkedIn
- checkedInExpired
- checkOutSubmitted
- checkOutInProgress
- checkOutFailed
- checkInSubmitted
- checkInInProgress
- checkInFailed
- checkOutTimeOut
- checkInTimeOut
example: checkedOut
statusText:
type: string
description: Human-readable label for `status`
example: Checked Out
accessType:
type: string
enum:
- CLI
- CONSOLE
- PROGRAMMATIC
example: CONSOLE
checkedOut:
type: string
format: date-time
description: Timestamp when the profile was checked out
checkedIn:
type:
- string
- 'null'
format: date-time
description: Timestamp when the profile was checked in; null if still active
expiration:
type: string
format: date-time
description: Timestamp when the session expires automatically
currentExtensionIndex:
type: integer
description: Number of times the session has been extended
example: '0'
policyConditionEndTime:
type:
- string
- 'null'
format: date-time
description: End time derived from policy time conditions, if applicable
errorMessage:
type:
- string
- 'null'
description: Error details if the checkout or check-in operation failed
ConsoleUrlResponse:
type: object
description: Console sign-in URL for a checked-out profile
properties:
url:
type: string
description: The console sign-in URL
example: https://signin.aws.amazon.com/federation?Action=login&...
idpName:
type:
- string
- 'null'
description: Identity provider name, present for some application types (e.g. OpenShift)
MyAccessEnvironment:
type: object
properties:
environmentId:
type: string
example: envId1
environmentName:
type: string
example: demo
environmentDescription:
type: string
example: ''
alternateEnvironmentName:
type: string
example: demo
accountId:
type:
- string
- 'null'
profileEnvironmentProperties:
type: object
additionalProperties: 'true'
example: {}
MyAccessSummary:
type: object
properties:
count:
type: integer
description: Total count of items
example: '100'
page:
type: integer
description: Current page number
example: '0'
size:
type: integer
description: Page size
example: '20'
sort:
type: string
description: Sort order
example: appName,ASC
filter:
type:
- string
- 'null'
description: Applied filter
example: appName eq "AWS"
data:
type: array
items:
$ref: '#/components/schemas/MyAccess'
MyAccessApplication:
type: object
properties:
appId:
type: string
example: appId1
appName:
type: string
example: AWS
applicationType:
type: string
example: AWS
consoleAccessError:
type:
- string
- 'null'
programmaticAccessError:
type:
- string
- 'null'
description:
type:
- string
- 'null'
supportsToken:
type: boolean
example: 'false'
showAwsAccountNumber:
type: boolean
example: 'false'
supportsMultipleProfilesCheckoutCli:
type: boolean
example: 'false'
supportsMultipleProfilesCheckoutConsole:
type: boolean
example: 'false'
allowCopyingConsoleUrl:
type: boolean
example: 'false'
displayProgrammaticKeys:
type: boolean
example: 'true'
requiresHierarchicalModel:
type: boolean
example: 'false'
consoleAccess:
type: boolean
example: 'true'
programmaticAccess:
type: boolean
example: 'false'
supportsSharedAccounts:
type: boolean
example: 'true'
SettingsDto:
type: object
required:
- settingsType
properties:
settingsType:
type: string
id:
type: string
entityId:
type: string
entityType:
type: string
isInherited:
type: boolean
discriminator:
propertyName: settingsType
mapping:
ITSM: ItsmSettingsDto
JUSTIFICATION: JustificationSettingsDto
JustificationSettingsDto:
allOf:
- $ref: '#/components/schemas/SettingsDto'
- type: object
properties:
isJustificationRequired:
type: boolean
isJustificationRequiredAtCheckout:
type: boolean
justificationRegex:
type: string
MyAccessDetail:
type: object
properties:
checkOutTime:
type:
- string
- 'null'
format: date-time
checkInTime:
type:
- string
- 'null'
format: date-time
status:
type: string
enum:
- Allow
- Deny
- Pending
example: Allow
approvalValidityTime:
type:
- string
- 'null'
format: date-time
accessType:
type: string
enum:
- CONSOLE
- PROGRAMMATIC
example: CONSOLE
favoriteId:
type:
- string
- 'null'
Settings:
type: object
x-exclude-from-codegen: 'true'
properties:
justification:
type: string
ticketId:
type: string
ticketType:
type: string
userOnCall:
type: boolean
default: false
checkoutVariableValues:
type: object
additionalProperties:
type: string
writeOnly: true
description: 'Per-checkout map of variableName -> value for every variable on the resolved profile-permission flagged with promptAtCheckout=true. UI populates from ResourceProfileSettings.checkoutVariablePrompts returned by GET /api/resource-manager/my-resources/{profileId}/resources/{resourceId}/settings. Server validates each supplied value against the variable''s regexPattern when one is configured (any type); values for variables without a pattern are taken literally. Missing/blank for a required variable produces 400 RM-0024; regex validation failure produces 400 RM-0025; entries for variables not flagged promptAtCheckout are silently ignored.
'
securitySchemes:
bearerAuth:
type: http
scheme: bearer
x-api-evangelist:
assembled_from: https://docs.britive.com/apidocs/ (one OpenAPI fragment per operation page, .md variant)
assembled_on: '2026-08-08'
fragments: 372
note: Britive publishes this contract only as per-operation fragments inside its Document360 API reference. This file is the faithful union of those fragments; the verbatim assembly is in openapi/_original/.