Every API here is available over the APIs.io API and to AI agents over MCP.
openapi: 3.2.0
info:
title: Confighub Group API
version: 0.1.0
contact:
name: ConfigHub Support
url: https://confighub.com/
email: hello@confighub.com
license:
name: N/A
url: https://confighub.com/TBD
termsOfService: TBD
description: 'Operations tagged Group across 2 of this provider''s published API definitions: openapi.json, confighub-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://hub.confighub.com/api
description: production
security:
- bearerAuth: []
tags:
- name: Group
paths:
/group:
get:
tags:
- Group
summary: List Groups
operationId: ListGroups
parameters:
- name: where
in: query
description: 'The specified string is an expression for the purpose of filtering
the list of Groups returned. The expression syntax was inspired by SQL.
It supports conjunctions using `AND` of relational expressions of the form *attribute*
*operator* *attribute_or_literal*. The attribute names are case-sensitive and PascalCase,
as in the JSON encoding.
Strings support the following operators: `<`, `>`, `<=`, `>=`, `=`, `!=`, `LIKE`, `NOT LIKE`, `ILIKE`, `~~`, `!~~`, `~`, `~*`, `!~`, `!~*`, `IN`, `NOT IN`.
String pattern operators: `LIKE` and `~~` for pattern matching with `%` and `_` wildcards,
`ILIKE` for case-insensitive pattern matching, `NOT LIKE` and `!~~` for negated pattern matching.
String regex operators: `~` for regex matching, `~*` for case-insensitive regex,
`!~` and `!~*` for regex not matching (case-sensitive and insensitive).
Integers support the following operators: `<`, `>`, `<=`, `>=`, `=`, `!=`, `IN`, `NOT IN`.
UUIDs and boolean attributes support equality and inequality only.
UUID and time literals must be quoted as string literals.
String literals are quoted with single quotes, such as `''string''`.
Time literals use the same form as when serialized as JSON,
such as: `CreatedAt > ''2025-02-18T23:16:34''`.
Integer and boolean literals are also supported for attributes of those types.
Arrays support the `?` operator to to match any element of the array,
as in `FromLinkID ? ''7c61626f-ddbe-41af-93f6-b69f4ab6d308''`.
Arrays can perform LEN() to check for length, as in `LEN(FromLinkID) > 0`.
An attribute naming a list of other entities can be filtered on their attributes with a `*` segment,
as in `FromLink.*.Slug = ''upgrade-app''`, which holds when any element satisfies it.
Without the `*` such a reference is an error, since it names no single value to compare.
Map support the dot notation to specify a particular map key, as in `Labels.tier = ''Backend''`.
Maps support `IS NULL` and `IS NOT NULL` with dot notation to check for key absence or presence,
as in `Labels.tier IS NULL` (key doesn''t exist) or `Labels.tier IS NOT NULL` (key exists).
Comparison results can be tested with `IS TRUE`, `IS FALSE`, `IS NOT TRUE`, and `IS NOT FALSE`.
These are useful for nullable columns: `MergeSourceID = ''<uuid>'' IS NOT FALSE` matches rows where MergeSourceID equals the value OR is NULL.
The `IN` and `NOT IN` operators accept a comma-separated list of values in parentheses,
such as `Slug IN (''slugone'', ''slugtwo'')` or `Labels.environment IN (''prod'', ''staging'')`.
Conjunctions are supported using the `AND` operator.
An example conjunction is:
`CreatedAt >= ''2025-01-07'' AND Slug = ''test'' AND Labels.mykey = ''myvalue''`.
Supported attributes for filtering on Group: CreatedAt, DisplayName, ExternalID, GroupID, Slug, UpdatedAt.
The whole string must be query-encoded.'
required: false
schema:
type: string
- name: filter
in: query
description: 'UUID of a Filter entity to apply to the Group list.
The Filter must be in the same Organization as the user credentials.
The Filter''s From field must match the entity type being filtered (Group).
For Space-resident entities, if the Filter has a FromSpaceID, it must match the operation''s SpaceID.
The Filter''s Where clause will be combined with any explicit ''where'' parameter using AND logic.
If both ''filter'' and ''where'' parameters are specified, they are combined with AND logic.'
required: false
schema:
type: string
- name: contains
in: query
description: 'Free text search that approximately matches the specified string against string fields and map keys/values.
The search is case-insensitive and uses pattern matching to find entities containing the text.
Searchable string fields include attributes like Slug, DisplayName, and string-typed custom fields.
For map fields (like Labels and Annotations), the search matches both map keys and values.
The search uses OR logic across all searchable fields, so matching any field will return the entity.
If both ''where'' and ''contains'' parameters are specified, they are combined with AND logic.
Searchable fields for Group include string and map-type attributes from the queryable attributes list.
The whole string must be query-encoded.'
required: false
schema:
type: string
- name: where_permission
in: query
description: 'Only return Group entities on which the caller has this permission, as well as View, which every entity listed needs.
A list made to choose an entity to act on can name the permission the action needs, such as Edit to change it or Use to refer to it from another entity, so that it leaves out the entities the action would be refused on.
Supported values: Manage, Edit, Use, View.'
required: false
schema:
enum:
- Manage
- Edit
- Use
- View
type: string
- name: select
in: query
description: 'Select clause for specifying which fields to include in the response for Group.
The attribute names are case-sensitive, PascalCase, and
expected in a comma-separated list format as in the JSON encoding.
If not specified, all fields are returned.
Entity and parent IDs (like OrganizationID, SpaceID, GroupID) and Slug are always returned regardless of the select parameter.
Fields used in where and contains filters, fields named by order_by, and fields read by the columns of the View named by view are also automatically included.
Example: ''DisplayName,CreatedAt,Labels'' will return only those fields plus the required ID and Slug fields.
The whole string must be query-encoded.'
required: false
schema:
type: string
- name: include_hidden
in: query
description: 'Hidden Group entities, those with a HiddenReason, are left out of the results, or of what a bulk operation acts on, unless this names their HiddenReason.
It is a comma-separated list of HiddenReasons, or `*` for all of them.
A where clause naming the entities, by their Slug or ID with `=` or `IN`, or naming HiddenReason at all, also returns hidden entities it selects.
ConfigHub/YAML Units, which hold the configuration of entities, are hidden with the HiddenReason `BackingUnit`.'
required: false
schema:
type: string
- name: view
in: query
description: 'UUID of a View whose columns to compute for each Group, returned as ViewColumns.
The View must be in the same Organization as the user credentials, and be a View of Group: its Of, or the From of its Filter, must be Group.
If the View has a Filter, the Filter selects the entities as the filter parameter does, so the two may not both be specified.
The related entities and fields the View''s columns read are included and selected automatically, so neither include nor select has to name them.'
required: false
schema:
type: string
- name: limit
in: query
description: Maximum number of Group entities to return. If not specified, all matching entities are returned. Values greater than 1000 are rejected with 400. When there may be more entities, the response has a ConfigHub-Continue header to pass as the continue parameter of the next request.
required: false
schema:
maximum: 1000
minimum: 0
type: integer
- name: order_by
in: query
description: 'Comma-separated list of fields to sort Group results by, each in the form ''ASC|DESC:FieldName'' or just ''FieldName''.
Field names are case-sensitive and PascalCase, as in the JSON encoding. Sort direction defaults to ASC when the ''DIRECTION:'' prefix is omitted.
Supported attributes for ordering Group: CreatedAt, DisplayName, ExternalID, GroupID, Slug, UpdatedAt.
Example: ''DESC:CreatedAt'' or ''DisplayName,DESC:CreatedAt''.
Results are ordered by the Group''s ID after the fields named, and by the ID alone if none are.
The whole string must be query-encoded.'
required: false
schema:
pattern: ^\s*(?:(?:[Aa][Ss][Cc]|[Dd][Ee][Ss][Cc])\s*:\s*)?(CreatedAt|DisplayName|ExternalID|GroupID|Slug|UpdatedAt)\s*(?:,\s*(?:(?:[Aa][Ss][Cc]|[Dd][Ee][Ss][Cc])\s*:\s*)?(?:CreatedAt|DisplayName|ExternalID|GroupID|Slug|UpdatedAt)\s*)*$
type: string
- name: continue
in: query
description: 'The token from the ConfigHub-Continue header of the previous page, to return the Group entities after it.
The request''s other parameters, except limit, must be the same as those of the request that returned the token.
Keep reading until a response has no such header: a page can hold fewer entities than the limit, or none, and still be followed by more.'
required: false
schema:
type: string
responses:
default:
description: Unexpected error.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'200':
description: OK
headers:
ConfigHub-Continue:
style: simple
description: The token to pass as the continue parameter of the next request, when there may be more entities after this page. It is absent on the last page. A page can hold fewer entities than the limit, or none, and still have one.
schema:
type: string
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/ExtendedGroup'
'400':
description: Group request is invalid (Bad Request).
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'401':
description: Unauthorized access.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'403':
description: Forbidden access.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'404':
description: Group not found.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'500':
description: Something went wrong while processing Group.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
servers:
- url: https://hub.confighub.com/api
description: production
/group/{group_id}:
get:
tags:
- Group
summary: Get Group
operationId: GetGroup
parameters:
- name: select
in: query
description: 'Select clause for specifying which fields to include in the response for Group.
The attribute names are case-sensitive, PascalCase, and
expected in a comma-separated list format as in the JSON encoding.
If not specified, all fields are returned.
Entity and parent IDs (like OrganizationID, SpaceID, GroupID) and Slug are always returned regardless of the select parameter.
Fields used in where and contains filters, fields named by order_by, and fields read by the columns of the View named by view are also automatically included.
Example: ''DisplayName,CreatedAt,Labels'' will return only those fields plus the required ID and Slug fields.
The whole string must be query-encoded.'
required: false
schema:
type: string
- name: group_id
in: path
description: Unique identifier for a group_id
required: true
schema:
type: string
format: uuid
responses:
default:
description: Unexpected error.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'200':
description: Group with additional related entities expanded based on the request's include parameter.
content:
application/json:
schema:
$ref: '#/components/schemas/ExtendedGroup'
'400':
description: Group request is invalid (Bad Request).
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'401':
description: Unauthorized access.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'403':
description: Forbidden access.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'404':
description: Group not found.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'500':
description: Something went wrong while processing Group.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
servers:
- url: https://hub.confighub.com/api
description: production
/group/{group_id}/user/{user_id}:
delete:
tags:
- Group
summary: Remove a bot User from a Group
description: Remove the User of a ServiceAccount, or the bot User of a BridgeWorker, in the caller's Organization from the Group. An organization admin or manager may. So may a member of the Group who has Manage permission on the bot User's ServiceAccount or BridgeWorker. Removing a bot that is not a member does nothing. Returns the bot User with its GroupIDs.
operationId: RemoveGroupBotUser
parameters:
- name: group_id
in: path
description: Unique identifier for a group_id
required: true
schema:
type: string
format: uuid
- name: user_id
in: path
description: Unique identifier for a user_id
required: true
schema:
type: string
format: uuid
responses:
default:
description: Unexpected error.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'200':
description: a User in Confighub.
content:
application/json:
schema:
$ref: '#/components/schemas/User'
'400':
description: Group request is invalid (Bad Request).
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'401':
description: Unauthorized access.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'403':
description: Forbidden access.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'404':
description: Group not found.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'409':
description: 'Group is still in use: it has DeleteGates, or other entities still reference it. Or data has changed since last read.'
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'422':
description: Group could not be deleted.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'500':
description: Something went wrong while processing Group.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
post:
tags:
- Group
summary: Add a bot User to a Group
description: Add the User of a ServiceAccount, or the bot User of a BridgeWorker, in the caller's Organization to the Group. Other Users' Group memberships are managed in the identity provider. An organization admin or manager may. So may a member of the Group who has Manage permission on the bot User's ServiceAccount or BridgeWorker. Adding a bot that is already a member does nothing. Returns the bot User with its GroupIDs.
operationId: AddGroupBotUser
parameters:
- name: group_id
in: path
description: Unique identifier for a group_id
required: true
schema:
type: string
format: uuid
- name: user_id
in: path
description: Unique identifier for a user_id
required: true
schema:
type: string
format: uuid
responses:
default:
description: Unexpected error.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'200':
description: a User in Confighub.
content:
application/json:
schema:
$ref: '#/components/schemas/User'
'400':
description: Group request is invalid (Bad Request).
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'401':
description: Unauthorized access.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'403':
description: Forbidden access.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'404':
description: Group not found.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'409':
description: Group data conflict. Data has changed since last read.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
'500':
description: Something went wrong while processing Group.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
servers:
- url: https://hub.confighub.com/api
description: production
components:
schemas:
ErrorMetadata:
type: object
properties:
EntityID:
type: string
description: Optional ID of the entity this error relates to
x-go-type-skip-optional-pointer: true
EntitySlug:
type: string
description: Optional slug of the entity this error relates to
x-go-type-skip-optional-pointer: true
EntityType:
type: string
description: Optional type of the entity this error relates to
x-go-type-skip-optional-pointer: true
Items:
type: array
items:
$ref: '#/components/schemas/ErrorItem'
description: Collection of error details
x-go-type-skip-optional-pointer: true
ErrorItem:
type: object
properties:
Description:
type: string
description: A clear explanation of what went wrong
x-go-type-skip-optional-pointer: true
Item:
type: string
description: The name of the field, resource, or entity that the error relates to
x-go-type-skip-optional-pointer: true
ExtendedGroup:
type: object
properties:
Error:
$ref: '#/components/schemas/ResponseError'
Group:
allOf:
- $ref: '#/components/schemas/Group'
description: The Group.
ViewColumns:
type: array
items:
$ref: '#/components/schemas/ViewColumn'
description: The values of the columns of the View named by the view parameter, in the View's column order. A column that selects several values, such as one with a wildcard, has an entry for each, all with the column's Name.
x-go-type-skip-optional-pointer: true
description: Group with additional related entities expanded based on the request's include parameter.
ResponseError:
type: object
properties:
Details:
type: array
items:
type: string
description: Additional context messages
x-go-type-skip-optional-pointer: true
ErrorMetadata:
allOf:
- $ref: '#/components/schemas/ErrorMetadata'
description: Structured error details like field violations
Message:
type: string
description: The primary error message
x-go-type-skip-optional-pointer: true
Status:
type: integer
description: HTTP status code
x-go-type-skip-optional-pointer: true
Type:
type: string
description: 'The category of the error, as a code: UserInput, Validation, Data, Authentication, Permission, NotFound, Conflict, AlreadyExists, Unprocessable, Locked, PreconditionFailed, TooManyRequests, Unexpected, GatewayTimeout, or ServiceUnavailable'
x-go-type-skip-optional-pointer: true
User:
required:
- Slug
type: object
properties:
CreatedAt:
type: string
description: The timestamp when the entity was created in "2023-01-01T12:00:00Z" format.
format: date-time
readOnly: true
example: '2025-04-04T11:50:02.95102-07:00'
x-confighub-where:
dataType: time
x-go-type-skip-optional-pointer: true
x-omitzero: true
DisplayName:
type: string
description: Friendly name for the entity.
x-confighub-where:
dataType: string
x-go-type-skip-optional-pointer: true
EntityType:
type: string
description: The type of entity.
readOnly: true
x-go-type-skip-optional-pointer: true
ExternalID:
type: string
description: Unique identifier for the External Identity Provider record matching this User.
x-confighub-where:
dataType: uuid
x-go-type-skip-optional-pointer: true
GroupIDs:
type: array
items:
$ref: '#/components/schemas/UUID'
description: The Groups the User belongs to, from the identity provider's claims at their last login. A bot User's Groups are the ones it was added to through the Group API instead. (readonly)
x-confighub-where:
dataType: '[]uuid'
references: Group
x-go-type-skip-optional-pointer: true
HiddenReason:
maxLength: 64
pattern: ^([A-Za-z0-9]([\-_.A-Za-z0-9]*[A-Za-z0-9])?)?$
type: string
description: The reason the entity is hidden, if it is. A hidden entity is left out of List and Search results, and of what bulk operations act on, unless the include_hidden parameter names its reason or is *, or the where parameter names the entity by Slug or ID. ConfigHub/YAML Units are created hidden with the reason BackingUnit unless given another.
x-confighub-where:
dataType: string
x-go-type-skip-optional-pointer: true
ProfilePictureURL:
type: string
description: The URL to get the profile avatar picture of the User.
x-go-type-skip-optional-pointer: true
Slug:
maxLength: 128
pattern: ^[A-Za-z0-9]([\-_.A-Za-z0-9]*[A-Za-z0-9])?$
type: string
description: Unique URL-safe identifier for the entity.
x-confighub-where:
dataType: string
x-go-type-skip-optional-pointer: true
UpdatedAt:
type: string
description: The timestamp when the entity was last updated in "2023-01-01T12:00:00Z" format.
format: date-time
readOnly: true
example: '2025-04-04T11:50:02.95102-07:00'
x-confighub-where:
dataType: time
x-go-type-skip-optional-pointer: true
x-omitzero: true
UserID:
type: string
description: Unique identifier for a User.
format: uuid
example: 248df4b7-aa70-47b8-a036-33ac447e668d
x-confighub-where:
dataType: uuid
x-go-type-skip-optional-pointer: true
x-omitzero: true
Username:
type: string
description: Unique username for a User. Must be unique for all of Confighub.
x-confighub-where:
dataType: string
x-go-type-skip-optional-pointer: true
Version:
type: integer
description: An entity-specific sequence number used for optimistic concurrency control. The value read must be sent in calls to Update.
format: int64
readOnly: false
x-go-type-skip-optional-pointer: true
description: a User in Confighub.
ViewColumn:
type: object
properties:
Name:
type: string
x-go-type-skip-optional-pointer: true
Value:
type: string
x-go-type-skip-optional-pointer: true
UUID:
type: string
format: uuid
example: 248df4b7-aa70-47b8-a036-33ac447e668d
Group:
required:
- Slug
type: object
properties:
CreatedAt:
type: string
description: The timestamp when the entity was created in "2023-01-01T12:00:00Z" format.
format: date-time
readOnly: true
example: '2025-04-04T11:50:02.95102-07:00'
x-confighub-where:
dataType: time
x-go-type-skip-optional-pointer: true
x-omitzero: true
DisplayName:
type: string
description: Friendly name for the entity.
x-confighub-where:
dataType: string
x-go-type-skip-optional-pointer: true
EntityType:
type: string
description: The type of entity.
readOnly: true
x-go-type-skip-optional-pointer: true
ExternalID:
type: string
description: Unique identifier for the External Identity Provider record matching this Group.
readOnly: true
x-confighub-where:
dataType: string
x-go-type-skip-optional-pointer: true
GroupID:
type: string
description: Unique identifier for a Group. (readonly)
format: uuid
example: 248df4b7-aa70-47b8-a036-33ac447e668d
x-confighub-where:
dataType: uuid
x-go-type-skip-optional-pointer: true
x-omitzero: true
HiddenReason:
maxLength: 64
pattern: ^([A-Za-z0-9]([\-_.A-Za-z0-9]*[A-Za-z0-9])?)?$
type: string
description: The reason the entity is hidden, if it is. A hidden entity is left out of List and Search results, and of what bulk operations act on, unless the include_hidden parameter names its reason or is *, or the where parameter names the entity by Slug or ID. ConfigHub/YAML Units are created hidden with the reason BackingUnit unless given another.
x-go-type-skip-optional-pointer: true
Slug:
maxLength: 128
pattern: ^[A-Za-z0-9]([\-_.A-Za-z0-9]*[A-Za-z0-9])?$
type: string
description: Unique URL-safe identifier for the entity.
x-confighub-where:
dataType: string
x-go-type-skip-optional-pointer: true
UpdatedAt:
type: string
description: The timestamp when the entity was last updated in "2023-01-01T12:00:00Z" format.
format: date-time
readOnly: true
example: '2025-04-04T11:50:02.95102-07:00'
x-confighub-where:
dataType: time
x-go-type-skip-optional-pointer: true
x-omitzero: true
Version:
type: integer
description: An entity-specific sequence number used for optimistic concurrency control. The value read must be sent in calls to Update.
format: int64
readOnly: false
x-go-type-skip-optional-pointer: true
description: 'A Group of Users, a subject in an entity''s Permissions. Groups and their membership are managed in the identity provider, and like Users are not scoped to an Organization; a Group is provisioned when a User in it logs in. Bot Users are the exception: they are added to a Group through the API.'
StandardErrorResponse:
type: object
properties:
Error:
allOf:
- $ref: '#/components/schemas/ResponseError'
description: 'The error: its message, category (Type), HTTP status, details, and structured items.'
message:
type: string
description: 'The error as one string: its message, with any details, items, and individual errors appended. Kept for clients written before Error; new clients read Error.'
x-go-type-skip-optional-pointer: true
description: 'The body of an error response: the error as data (Error), and as one string (message) for clients written before Error.'
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: Bearer authentication
x-refined-from:
- openapi.json
- confighub-openapi.json