Chef Software roles API

openapi: 3.2.0
info:
  title: external/applications/applications.proto ApplicationsService Roles API
  version: version not set
servers:
- url: https://automate.chef.io/api/v0
tags:
- name: roles
paths:
  /apis/iam/v2/roles:
    get:
      summary: Lists all roles
      description: 'Lists all *Chef-managed* and *Custom* roles.


        Authorization Action:

        ```

        iam:roles:list

        ```'
      operationId: Policies_ListRoles
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/chef.automate.api.iam.v2.ListRolesResp'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/grpc.gateway.runtime.Error'
      tags:
      - roles
    post:
      summary: Creates a custom role
      description: 'Creates a new role to be used in the policies that control permissions in Automate.


        A role defines the scope of actions in a policy statement.


        Authorization Action:

        ```

        iam:roles:create

        ```'
      operationId: Policies_CreateRole
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/chef.automate.api.iam.v2.CreateRoleResp'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/grpc.gateway.runtime.Error'
      tags:
      - roles
      x-code-samples:
      - lang: JSON
        source: '{"id": "custom-role", "name": "My Custom Secret Manager Role", "actions": ["secrets:*", "iam:projects:list"]}'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/chef.automate.api.iam.v2.CreateRoleReq'
        required: true
  /apis/iam/v2/roles/{id}:
    get:
      summary: Gets a role
      description: 'Returns the details for a role.


        Authorization Action:

        ```

        iam:roles:get

        ```'
      operationId: Policies_GetRole
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/chef.automate.api.iam.v2.GetRoleResp'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/grpc.gateway.runtime.Error'
      parameters:
      - name: id
        description: ID of the role.
        in: path
        required: true
        schema:
          type: string
      tags:
      - roles
    delete:
      summary: Deletes a custom role
      description: 'Deletes a specified custom role (you cannot delete Chef-managed roles) and remove it from any statements that may have been using it.

        If such a statement has no other associated actions, the statement is deleted as well.

        Similarly, if that statement removal results in a policy with no other statements,

        that policy is removed as well.


        Authorization Action:

        ```

        iam:roles:delete

        ```'
      operationId: Policies_DeleteRole
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/chef.automate.api.iam.v2.DeleteRoleResp'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/grpc.gateway.runtime.Error'
      parameters:
      - name: id
        description: ID of the role.
        in: path
        required: true
        schema:
          type: string
      tags:
      - roles
    put:
      summary: Updates a custom role
      description: 'This operation overwrites all fields excepting ID,

        including those omitted from the request, so be sure to specify all properties.

        Properties that you do not include are reset to empty values.


        Authorization Action:

        ```

        iam:roles:update

        ```'
      operationId: Policies_UpdateRole
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/chef.automate.api.iam.v2.UpdateRoleResp'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/grpc.gateway.runtime.Error'
      parameters:
      - name: id
        description: Unique ID. Cannot be changed.
        in: path
        required: true
        schema:
          type: string
      tags:
      - roles
      x-code-samples:
      - lang: JSON
        source: '{"name": "My Updated Custom Secret Manager Role", "actions": ["secrets:*", "iam:projects:list"]}'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/chef.automate.api.iam.v2.UpdateRoleReq'
        required: true
components:
  schemas:
    chef.automate.api.iam.v2.Role:
      type: object
      properties:
        name:
          type: string
          description: Name for the role.
        id:
          type: string
          description: Unique ID. Cannot be changed.
        type:
          $ref: '#/components/schemas/chef.automate.api.iam.v2.Type'
          description: Whether this policy is user created (`CUSTOM`) or chef managed (`CHEF_MANAGED`).
        actions:
          type: array
          items:
            type: string
          description: List of actions this role scopes to. Will contain one or more.
        projects:
          type: array
          items:
            type: string
          description: List of projects this role belongs to. May be empty.
    chef.automate.api.iam.v2.UpdateRoleReq:
      type: object
      example:
        name: My Updated Custom Secret Manager Role
        actions:
        - secrets:*
        - iam:projects:list
      properties:
        id:
          type: string
          description: Unique ID. Cannot be changed.
        name:
          type: string
          description: Name for the role.
        actions:
          type: array
          items:
            type: string
          description: List of actions that this role scopes to.
        projects:
          type: array
          items:
            type: string
          description: List of projects this role belongs to.
      required:
      - id
      - name
      - actions
    chef.automate.api.iam.v2.ListRolesResp:
      type: object
      example:
        roles:
        - id: custom-role
          name: My Custom Secret Manager Role
          actions:
          - secrets:*
          - iam:projects:list
        - id: custom-role-2
          name: My Custom Secret Role 2
          actions:
          - infra:*
      properties:
        roles:
          type: array
          items:
            $ref: '#/components/schemas/chef.automate.api.iam.v2.Role'
    chef.automate.api.iam.v2.UpdateRoleResp:
      type: object
      example:
        id: custom-role
        name: My Custom Secret Manager Role
        actions:
        - secrets:*
        - iam:projects:list
      properties:
        role:
          $ref: '#/components/schemas/chef.automate.api.iam.v2.Role'
    chef.automate.api.iam.v2.CreateRoleResp:
      type: object
      example:
        id: custom-role
        name: My Custom Secret Manager Role
        actions:
        - secrets:*
        - iam:projects:list
      properties:
        role:
          $ref: '#/components/schemas/chef.automate.api.iam.v2.Role'
    chef.automate.api.iam.v2.DeleteRoleResp:
      type: object
      example:
        id: custom-role
        name: My Custom Secret Manager Role
        actions:
        - secrets:*
        - iam:projects:list
    google.protobuf.Any:
      type: object
      properties:
        type_url:
          type: string
          description: "A URL/resource name that uniquely identifies the type of the serialized\nprotocol buffer message. This string must contain at least\none \"/\" character. The last segment of the URL's path must represent\nthe fully qualified name of the type (as in\n`path/google.protobuf.Duration`). The name should be in a canonical form\n(e.g., leading \".\" is not accepted).\n\nIn practice, teams usually precompile into the binary all types that they\nexpect it to use in the context of Any. However, for URLs which use the\nscheme `http`, `https`, or no scheme, one can optionally set up a type\nserver that maps type URLs to message definitions as follows:\n\n* If no scheme is provided, `https` is assumed.\n* An HTTP GET on the URL must yield a [google.protobuf.Type][]\n  value in binary format, or produce an error.\n* Applications are allowed to cache lookup results based on the\n  URL, or have them precompiled into a binary to avoid any\n  lookup. Therefore, binary compatibility needs to be preserved\n  on changes to types. (Use versioned type names to manage\n  breaking changes.)\n\nNote: this functionality is not currently available in the official\nprotobuf release, and it is not used for type URLs beginning with\ntype.googleapis.com.\n\nSchemes other than `http`, `https` (or the empty scheme) might be\nused with implementation specific semantics."
        value:
          type: string
          format: byte
          description: Must be a valid serialized protocol buffer of the above specified type.
      description: "`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nProtobuf library provides support to pack/unpack Any values in the form\nof utility functions or additional generated methods of the Any type.\n\nExample 1: Pack and unpack a message in C++.\n\n    Foo foo = ...;\n    Any any;\n    any.PackFrom(foo);\n    ...\n    if (any.UnpackTo(&foo)) {\n      ...\n    }\n\nExample 2: Pack and unpack a message in Java.\n\n    Foo foo = ...;\n    Any any = Any.pack(foo);\n    ...\n    if (any.is(Foo.class)) {\n      foo = any.unpack(Foo.class);\n    }\n\n Example 3: Pack and unpack a message in Python.\n\n    foo = Foo(...)\n    any = Any()\n    any.Pack(foo)\n    ...\n    if any.Is(Foo.DESCRIPTOR):\n      any.Unpack(foo)\n      ...\n\n Example 4: Pack and unpack a message in Go\n\n     foo := &pb.Foo{...}\n     any, err := anypb.New(foo)\n     if err != nil {\n       ...\n     }\n     ...\n     foo := &pb.Foo{}\n     if err := any.UnmarshalTo(foo); err != nil {\n       ...\n     }\n\nThe pack methods provided by protobuf library will by default use\n'type.googleapis.com/full.type.name' as the type URL and the unpack\nmethods only use the fully qualified type name after the last '/'\nin the type URL, for example \"foo.bar.com/x/y.z\" will yield type\nname \"y.z\".\n\n\nJSON\n====\nThe JSON representation of an `Any` value uses the regular\nrepresentation of the deserialized, embedded message, with an\nadditional field `@type` which contains the type URL. Example:\n\n    package google.profile;\n    message Person {\n      string first_name = 1;\n      string last_name = 2;\n    }\n\n    {\n      \"@type\": \"type.googleapis.com/google.profile.Person\",\n      \"firstName\": <string>,\n      \"lastName\": <string>\n    }\n\nIf the embedded message type is well-known and has a custom JSON\nrepresentation, that representation will be embedded adding a field\n`value` which holds the custom JSON in addition to the `@type`\nfield. Example (for message [google.protobuf.Duration][]):\n\n    {\n      \"@type\": \"type.googleapis.com/google.protobuf.Duration\",\n      \"value\": \"1.212s\"\n    }"
    grpc.gateway.runtime.Error:
      type: object
      properties:
        error:
          type: string
        code:
          type: integer
          format: int32
        message:
          type: string
        details:
          type: array
          items:
            $ref: '#/components/schemas/google.protobuf.Any'
    chef.automate.api.iam.v2.GetRoleResp:
      type: object
      example:
        id: custom-role
        name: My Custom Secret Manager Role
        actions:
        - secrets:*
        - iam:projects:list
      properties:
        role:
          $ref: '#/components/schemas/chef.automate.api.iam.v2.Role'
    chef.automate.api.iam.v2.CreateRoleReq:
      type: object
      example:
        id: custom-role
        name: My Custom Secret Manager Role
        actions:
        - secrets:*
        - iam:projects:list
      properties:
        id:
          type: string
          description: Unique ID. Cannot be changed.
        name:
          type: string
          description: Name for the role.
        actions:
          type: array
          items:
            type: string
          description: List of actions that this role scopes to.
        projects:
          type: array
          items:
            type: string
          description: List of projects this role belongs to.
      description: Does not contain type as the enduser can only create 'custom' roles.
      required:
      - id
      - name
      - actions
    chef.automate.api.iam.v2.Type:
      type: string
      enum:
      - CHEF_MANAGED
      - CUSTOM
      default: CHEF_MANAGED