Cisco Crosswork Rbac API
The rbac API from Cisco Crosswork — 6 operation(s) for rbac.
OpenAPI Specification
openapi: 3.2.0
info:
title: Crosswork Rbac API
contact:
name: Crosswork Team, Cisco
email: support@cisco.com
description: Crosswork Role-based Access Control APIs
license:
name: Cisco Software License Agreement
url: http://www.cisco.com/public/sw-license-agreement.html
version: 1.0.0
x-provenance:
method: harvested
authored_by: Cisco Crosswork
harvested_by: API Evangelist
harvested_on: '2026-08-19'
first_party: true
note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
provider_published: true
x-evidence:
- type: source
url: https://github.com/CiscoDevNet/crosswork-openapi-spec/blob/master/NCAHI/3.1APIs/rbac.swagger.json
- type: raw
url: https://raw.githubusercontent.com/CiscoDevNet/crosswork-openapi-spec/master/NCAHI/3.1APIs/rbac.swagger.json
servers:
- url: /crosswork/aaa
security:
- bearerAuth: []
tags:
- name: rbac
paths:
/v1/api:
get:
summary: Get the list of secured APIs.
operationId: GetAuthorizedAPIs
responses:
'200':
description: OK. The request was successful. The result is contained in the response body.
content:
application/json:
schema:
$ref: '#/components/schemas/rbacSecuredAPIs'
'403':
description: Forbidden. The server recognizes the authentication credentials, but the client is not authorized to perform this request.
tags:
- rbac
/v2/api:
get:
summary: Get names and IDs of the secured APIs grouped by the feature they belong to
operationId: GetAuthorizedAPIsByFeature
responses:
'200':
description: OK. The request was successful. The result is contained in the response body.
content:
application/json:
schema:
$ref: '#/components/schemas/rbacSecuredAPIsByFeature'
'403':
description: Forbidden. The server recognizes the authentication credentials, but the client is not authorized to perform this request.
tags:
- rbac
/v1/role:
get:
summary: Get Roles
operationId: GetRoles
responses:
'200':
description: OK. The request was successful. The result is contained in the response body.
content:
application/json:
schema:
$ref: '#/components/schemas/rbacRoles'
'403':
description: Forbidden. The server recognizes the authentication credentials, but the client is not authorized to perform this request.
tags:
- rbac
post:
summary: Create Role
operationId: CreateRole
responses:
'201':
description: Created. The request was successful. One or more new resources were created.
content:
application/json:
schema:
$ref: '#/components/schemas/rbacEmpty'
'403':
description: Forbidden. The server recognizes the authentication credentials, but the client is not authorized to perform this request.
tags:
- rbac
requestBody:
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/rbacRoles'
description: Specification of the role. The key represents the role ID. The value represents the role specification.
required: true
/v1/role/{id}:
put:
summary: Update Role
operationId: UpdateRole
responses:
'204':
description: No Content. The request was successful and there is no additional content in the response body.
content:
application/json:
schema:
$ref: '#/components/schemas/rbacEmpty'
'403':
description: Forbidden. The server recognizes the authentication credentials, but the client is not authorized to perform this request.
parameters:
- name: id
description: Unique ID of the role being updated
in: path
required: true
schema:
type: string
tags:
- rbac
requestBody:
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/rbacRole'
description: Updated specification of the role. See GET /role request for an example payload.
required: true
delete:
summary: Delete a role
operationId: DeleteRole
responses:
'204':
description: No Content. The request was successful and there is no additional content in the response body.
content:
application/json:
schema:
$ref: '#/components/schemas/rbacEmpty'
'403':
description: Forbidden. The server recognizes the authentication credentials, but the client is not authorized to perform this request.
'500':
description: Internal Server Error. The server could not fulfill the request.
parameters:
- name: id
description: ID of the role being deleted
in: path
required: true
schema:
type: string
tags:
- rbac
/v1/user:
get:
summary: Query all users from the local authentication store.
operationId: GetUsers
responses:
'200':
description: OK. The request was successful. The result is contained in the response body.
content:
application/json:
schema:
$ref: '#/components/schemas/rbacUsers'
'403':
description: Forbidden. The server recognizes the authentication credentials, but the client is not authorized to perform this request.
tags:
- rbac
post:
summary: Create a user on the local authentication store.
operationId: CreateUser
responses:
'201':
description: Created. The request was successful. One or more new resources were created.
content:
application/json:
schema:
$ref: '#/components/schemas/rbacEmpty'
'403':
description: Forbidden. The server recognizes the authentication credentials, but the client is not authorized to perform this request.
tags:
- rbac
requestBody:
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/rbacUsers'
required: true
/v1/user/{Username}:
put:
summary: Update the user on the local authentication store.
description: This API allows updates to the user's PolicyId, FirstName, and LastName only. Updating the user's password is done via the password change API.
operationId: UpdateUser
responses:
'204':
description: No Content. The request was successful and there is no additional content in the response body.
content:
application/json:
schema:
$ref: '#/components/schemas/rbacEmpty'
'403':
description: Forbidden. The server recognizes the authentication credentials, but the client is not authorized to perform this request.
parameters:
- name: Username
description: ID of the user being updated
in: path
required: true
schema:
type: string
tags:
- rbac
requestBody:
content:
application/json; charset=UTF-8:
schema:
$ref: '#/components/schemas/rbacUpdateUserReq'
description: Updated values for the attributes of the user
required: true
delete:
summary: Delete a user on the local authentication store.
operationId: DeleteUser
responses:
'204':
description: No Content. The request was successful and there is no additional content in the response body.
content:
application/json:
schema:
$ref: '#/components/schemas/rbacEmpty'
'403':
description: Forbidden. The server recognizes the authentication credentials, but the client is not authorized to perform this request.
'500':
description: Internal Server Error. The server could not fulfill the request.
parameters:
- name: Username
description: ID of the user being deleted
in: path
required: true
schema:
type: string
tags:
- rbac
components:
schemas:
rbacRole:
type: object
properties:
id:
type: string
org_id:
type: string
rate:
type: number
format: float
per:
type: number
format: float
quota_max:
type: string
format: int64
quota_renewal_rate:
type: string
format: int64
access_rights:
type: object
additionalProperties:
$ref: '#/components/schemas/rbacAccessDefinition'
hmac_enabled:
type: boolean
format: boolean
active:
type: boolean
format: boolean
is_inactive:
type: boolean
format: boolean
tags:
type: array
items:
type: string
key_expires_in:
type: string
format: int64
partitions:
$ref: '#/components/schemas/rbacPolicyPartitions'
last_updated:
type: string
title: Role represents a collection of security options, such as access rights to APIs, which are deployed on the system.
rbacResponseProcessor:
type: object
rbacGlobalRateLimit:
type: object
rbacAuthTypeEnum:
type: string
rbacUpdateUserReq:
type: object
properties:
PolicyId:
type: string
FirstName:
type: string
LastName:
type: string
example:
PolicyId: UpdatedPolicyId
FirstName: UpdatedFirstName
LastName: UpdatedLastName
title: Update user request
rbacRoles:
type: object
additionalProperties:
$ref: '#/components/schemas/rbacRole'
example:
adminRole:
_id: ''
id: ''
org_id: '1'
rate: 1000
per: 60
quota_max: -1
quota_renewal_rate: 60
access_rights:
api_v1_services:
api_name: api/v1/services api
api_id: api_v1_services
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
api_v1_spans:
api_name: api/v1/spans api
api_id: api_v1_spans
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
api_v1_trace:
api_name: api/v1/trace api
api_id: api_v1_trace
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
api_v1_traces:
api_name: api/v1/traces api
api_id: api_v1_traces
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
auth-apis:
api_name: auth-apis api
api_id: auth-apis
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
auth-configs:
api_name: auth-configs api
api_id: auth-configs
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
cwaaa:
api_name: Users and Roles api
api_id: cwaaa
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
cwauthconfig:
api_name: Auth Server Config api
api_id: cwauthconfig
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
cwhi:
api_name: HI api
api_id: cwhi
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
cwinventory:
api_name: inventory api
api_id: cwinventory
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
cwnca:
api_name: NCA api
api_id: cwnca
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
cwpassword:
api_name: Password Change api
api_id: cwpassword
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
cwplatform:
api_name: Platform api
api_id: cwplatform
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
cwtopology:
api_name: Topology api
api_id: cwtopology
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
daas:
api_name: WAE Design as service api
api_id: daas
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
gcp-service:
api_name: gcp-service api
api_id: gcp-service
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
geoserver:
api_name: geoserver api
api_id: geoserver
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
grafana.monitoring:
api_name: grafana.monitoring api
api_id: grafana.monitoring
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
guacamole:
api_name: guacamole api
api_id: guacamole
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
inode-manager:
api_name: inode-manager api
api_id: inode-manager
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
kafka-manager:
api_name: kafka-manager api
api_id: kafka-manager
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
kibana:
api_name: kibana api
api_id: kibana
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
kubernetes-dashboard.kube-system:
api_name: kubernetes-dashboard.kube-system api
api_id: kubernetes-dashboard.kube-system
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
nbi_v1_assurance:
api_name: nbi/v1/assurance api
api_id: nbi_v1_assurance
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
nbi_v1_central-inventory:
api_name: nbi/v1/central-inventory api
api_id: nbi_v1_central-inventory
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
robot:
api_name: Robot_Infra_API_Proxy
api_id: robot
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
robot-grafana:
api_name: robot-grafana api
api_id: robot-grafana
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
robot-logger:
api_name: robot-logger api
api_id: robot-logger
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
robot-nca:
api_name: robot-nca api
api_id: robot-nca
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
robot-openbmp-mysql:
api_name: robot-openbmp-mysql api
api_id: robot-openbmp-mysql
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
robot-pulse:
api_name: robot-pulse api
api_id: robot-pulse
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
robot-pulsecore:
api_name: robot-pulsecore api
api_id: robot-pulsecore
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
robot-pycon:
api_name: robot-pycon api
api_id: robot-pycon
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
robot-telemetry-broker:
api_name: robot-telemetry-broker api
api_id: robot-telemetry-broker
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
robotctl:
api_name: robotctl api
api_id: robotctl
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
rpd-service-manager:
api_name: rpd-service-manager api
api_id: rpd-service-manager
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
rpd-service-manager-socket:
api_name: rpd-service-manager-socket api
api_id: rpd-service-manager-socket
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
topology:
api_name: topology api
api_id: topology
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
zipkin:
api_name: zipkin api
api_id: zipkin
versions:
- Default
allowed_urls:
- url: /.*
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
hmac_enabled: false
active: true
is_inactive: false
tags: []
key_expires_in: -1
partitions:
quota: false
rate_limit: false
acl: false
last_updated: ''
rbacMiddlewareSection:
type: object
rbacobject:
type: object
rbacOauth2Meta:
type: object
rbacAccessSpec:
type: object
properties:
url:
type: string
methods:
type: array
items:
type: string
rbacEmpty:
type: object
rbacAuth:
type: object
rbacSecuredAPIsByFeature:
example:
Change Automations:
- api_id: cwnca
name: NCA api
- api_id: robot-nca
name: robot-nca api
Core Infra:
- api_id: api_v1_services
name: api/v1/services api
- api_id: api_v1_spans
name: api/v1/spans api
- api_id: api_v1_trace
name: api/v1/trace api
- api_id: api_v1_traces
name: api/v1/traces api
- api_id: cwauthconfig
name: Auth Server Config api
- api_id: cwsso
name: Authentication api
- api_id: gcp-service
name: gcp-service api
- api_id: grafana.monitoring
name: grafana.monitoring api
- api_id: nbi_v1_assurance
name: nbi/v1/assurance api
- api_id: nbi_v1_central-inventory
name: nbi/v1/central-inventory api
- api_id: cwpassword
name: Password Change api
- api_id: robot-grafana
name: robot-grafana api
- api_id: robot-logger
name: robot-logger api
- api_id: robot-ui
name: robot-ui api
- api_id: robot
name: Robot_Infra_API_Proxy
- api_id: rpd-service-manager
name: rpd-service-manager api
- api_id: rpd-service-manager-socket
name: rpd-service-manager-socket api
- api_id: vmtime
name: Server Time api
- api_id: cwtopology
name: Topology api
- api_id: cwaaa
name: Users and Roles api
- api_id: zipkin
name: zipkin api
Health Insights:
- api_id: cwhi
name: HI api
Inventory:
- api_id: cwinventory
name: inventory api
Platform:
- api_id: cwplatform
name: Platform api
- api_id: robotctl
name: robotctl api
T-SDN:
- api_id: NSO
name: NSO proxy api
rbacProxy:
type: object
rbacNotificationsManager:
type: object
rbacUser:
type: object
properties:
Username:
type: string
Password:
type: string
PolicyId:
type: string
FirstName:
type: string
LastName:
type: string
title: User represents a user account created on a local authentication store.
rbacCacheOptions:
type: object
rbacVersionDefinition:
type: object
rbacAuthProviderMeta:
type: object
rbacVersionData:
type: object
rbacEventHandlerMetaConfig:
type: object
rbacSessionProviderMeta:
type: object
rbacCORS:
type: object
rbacAccessDefinition:
type: object
properties:
api_name:
type: string
api_id:
type: string
versions:
type: array
items:
type: string
allowed_urls:
type: array
items:
$ref: '#/components/schemas/rbacAccessSpec'
rbacBasicAuth:
type: object
rbacSecuredAPI:
type: object
properties:
name:
type: string
slug:
type: string
api_id:
type: string
org_id:
type: string
use_keyless:
type: boolean
format: boolean
use_oauth2:
type: boolean
format: boolean
use_openid:
type: boolean
format: boolean
openid_options:
$ref: '#/components/schemas/rbacOpenIDOptions'
oauth_meta:
$ref: '#/components/schemas/rbacOauth2Meta'
auth:
$ref: '#/components/schemas/rbacAuth'
use_basic_auth:
type: boolean
format: boolean
basic_auth:
$ref: '#/components/schemas/rbacBasicAuth'
use_mutual_tls_auth:
type: boolean
format: boolean
client_certificates:
type: array
items:
type: string
upstream_certificates:
type: object
additionalProperties:
type: string
pinned_public_keys:
type: object
additionalProperties:
type: string
enable_jwt:
type: boolean
format: boolean
use_standard_auth:
type: boolean
format: boolean
enable_coprocess_auth:
type: boolean
format: boolean
jwt_signing_method:
type: string
jwt_identit_base_field:
type: string
jwt_client_base_field:
type: string
jwt_policy_field_name:
type: string
jwt_issued_at_validation_skew:
type: string
format: uint64
jwt_expires_at_validation_skew:
type: string
format: uint64
jwt_not_before_validation_skew:
type: string
format: uint64
jwt_skip_kid:
type: boolean
format: boolean
notifications:
$ref: '#/components/schemas/rbacNotificationsManager'
enable_signature_checking:
type: boolean
format: boolean
hmac_allowed_clock_skew:
type: number
format: double
base_identity_provided_by:
$ref: '#/components/schemas/rbacAuthTypeEnum'
definition:
$ref: '#/components/schemas/rbacVersionDefinition'
version_data:
$ref: '#/components/schemas/rbacVersionData'
uptime_tests:
$ref: '#/components/schemas/rbacUptimeTests'
proxy:
$ref: '#/components/schemas/rbacProxy'
disable_rate_limit:
type: boolean
format: boolean
disable_quota:
type: boolean
format: boolean
custom_middleware:
$ref: '#/components/schemas/rbacMiddlewareSection'
custom_middleware_bundle:
type: string
cache_options:
$ref: '#/components/schemas/rbacCacheOptions'
session_lifetime:
type: string
format: int64
active:
type: boolean
format: boolean
auth_provider:
$ref: '#/components/schemas/rbacAuthProviderMeta'
session_provider:
$ref: '#/components/schemas/rbacSessionProviderMeta'
event_handlers:
$ref: '#/components/schemas/rbacEventHandlerMetaConfig'
enable_batch_request_support:
type: boolean
format: boolean
allowed_ips:
type: array
items:
type: string
dont_set_quota_on_create:
type: boolean
format: boolean
expire_analytics_after:
type: string
format: int64
response_processors:
type: array
items:
$ref: '#/components/schemas/rbacResponseProcessor'
CORS:
$ref: '#/components/schemas/rbacCORS'
domain:
type: string
do_not_track:
type: boolean
format: boolean
tags:
type: array
items:
type: string
enable_context_vars:
type: boolean
format: boolean
config_data:
type: object
additionalProperties:
$ref: '#/components/schemas/rbacobject'
tag_headers:
type: array
items:
type: string
global_rate_limit:
$ref: '#/components/schemas/rbacGlobalRateLimit'
strip_auth_data:
type: boolean
format: boolean
title: AuthorizedAPI represents the core settings of an API which requires a JWT (JSON Web Token) bearer token to access
rbacUptimeTests:
type: object
rbacOpenIDOptions:
type: object
rbacPolicyPartitions:
type: object
properties:
quota:
type: boolean
format: boolean
rate_limit:
type: boolean
format: boolean
acl:
type: boolean
format: boolean
rbacSecuredAPIs:
type: array
items:
$ref: '#/components/schemas/rbacSecuredAPI'
e
# --- truncated at 32 KB (238 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-crosswork/refs/heads/main/openapi/cisco-crosswork-rbac-api-openapi.yml