Eon iam API

openapi: 3.2.0
info:
  description: The Eon.io REST API
  title: Eon accounts Iam API
  version: 1.0.0
servers:
- url: /
security:
- ApiKeyAuth: []
tags:
- name: iam
paths:
  /v1/permissions:
    get:
      description: 'Description: Retrieves a list of user permissions.'
      operationId: listPermissions
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListPermissionsResponse'
          description: Permissions retrieved.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: List Permissions
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions: []
      x-audit-log:
        excluded: true
  /v1/roles:
    post:
      description: 'Description: Creates a custom role.<br/>


        When creating a role, you''ll specify a list of permissions and, optionally, data access conditions.

        Data access conditions let you restrict the resources a permission is granted for.

        For example, for a particular role, you can set data access conditions to allow access only to resources without PII.

        '
      operationId: createRole
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateRoleRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateRoleResponse'
          description: Role created.
        '400':
          description: Validation error.
        '409':
          description: A role with the same name already exists.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Create Role
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - create:account_roles
      x-audit-log:
        action: create
        entityRefs:
        - entityType: role
          in: resBody
          key: id
  /v1/roles/list:
    post:
      description: 'Description: Retrieves a list of user roles.'
      operationId: listRoles
      parameters:
      - allowEmptyValue: true
        description: 'Cursor that points to the first record of the next page of results.

          Get this value from the previous response.

          To preserve the results in the same order, use the same sorting and filters in the first request as all subsequent requests.

          '
        example: Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE=
        explode: true
        in: query
        name: pageToken
        required: false
        schema:
          format: tobedefined
          type: string
        style: form
      - description: Maximum number of items to return in the response.
        example: 10
        explode: true
        in: query
        name: pageSize
        required: false
        schema:
          default: 50
          minimum: 1
          type: integer
        style: form
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRolesResponse'
          description: Roles retrieved.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: List Roles
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions: []
      x-audit-log:
        excluded: true
  /v1/roles/{roleId}:
    delete:
      description: 'Description: Deletes a role.'
      operationId: deleteRole
      parameters:
      - description: Role ID.
        example: ceaf2281-bf04-542d-a801-a6a4865373ad
        explode: false
        in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      responses:
        '204':
          description: Role deleted.
        '404':
          description: Role not found
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Delete Role
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - delete:account_roles
      x-audit-log:
        action: delete
        entityRefs:
        - entityType: role
          in: path
          key: roleId
    get:
      description: 'Description: Retrieves a role.'
      operationId: getRole
      parameters:
      - description: Role ID.
        example: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        explode: false
        in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetRoleResponse'
          description: Role retrieved.
        '404':
          description: Role wasn't found.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Get Role
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions: []
      x-audit-log:
        excluded: true
    put:
      description: 'Description: This API operation updates the details of a role using its unique ID. The request body must contain the updated role details.'
      operationId: updateRole
      parameters:
      - description: ID of the role
        explode: false
        in: path
        name: roleId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRoleRequest'
        description: The request body for updating a user
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateRoleResponse'
          description: Role updated.
        '404':
          description: Role not found
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Update Role
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - update:account_roles
      x-audit-log:
        action: update
        entityRefs:
        - entityType: role
          in: path
          key: roleId
  /v1/idps/list:
    post:
      description: 'Description: Retrieves a list of identity providers for the account.'
      operationId: listIdps
      parameters:
      - allowEmptyValue: true
        description: 'Cursor that points to the first record of the next page of results.

          Get this value from the previous response.

          To preserve the results in the same order, use the same sorting and filters in the first request as all subsequent requests.

          '
        example: Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE=
        explode: true
        in: query
        name: pageToken
        required: false
        schema:
          format: tobedefined
          type: string
        style: form
      - description: Maximum number of items to return in the response.
        example: 10
        explode: true
        in: query
        name: pageSize
        required: false
        schema:
          default: 50
          minimum: 1
          type: integer
        style: form
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListIdpsResponse'
          description: Identity providers retrieved.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: List Identity Providers
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - read:idp_configs
      x-audit-log:
        excluded: true
  /v1/idp-groups:
    post:
      description: 'Description: Maps an identity provider group to one or more Eon roles.<br/>


        When users authenticate via SAML and belong to the specified group, they''re granted the assigned roles.

        '
      operationId: createIdpGroup
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateIdpGroupRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateIdpGroupResponse'
          description: IdP group role assignment created.
        '400':
          description: Validation error.
        '404':
          description: Identity provider not found.
        '409':
          description: A group with the same provider-assigned group ID already exists for the specified identity provider.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Create IdP Group Role Assignment
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        action: create
        entityRefs:
        - entityType: idp_group
          in: resBody
          key: group.id
  /v1/idp-groups/list:
    post:
      description: 'Description: Retrieves a list of IdP group role assignments mapped in your Eon account.'
      operationId: listIdpGroups
      parameters:
      - allowEmptyValue: true
        description: 'Cursor that points to the first record of the next page of results.

          Get this value from the previous response.

          To preserve the results in the same order, use the same sorting and filters in the first request as all subsequent requests.

          '
        example: Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE=
        explode: true
        in: query
        name: pageToken
        required: false
        schema:
          format: tobedefined
          type: string
        style: form
      - description: Maximum number of items to return in the response.
        example: 10
        explode: true
        in: query
        name: pageSize
        required: false
        schema:
          default: 50
          minimum: 1
          type: integer
        style: form
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListIdpGroupsResponse'
          description: IdP group role assignments retrieved.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: List IdP Group Role Assignments
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        excluded: true
  /v1/idp-groups/{groupId}:
    delete:
      description: 'Description: Deletes an IdP group role assignment.<br/>


        After deletion, users are no longer assigned roles from their membership in the specified group.

        '
      operationId: deleteIdpGroup
      parameters:
      - description: Eon-assigned IdP group role assignment ID.
        example: ceaf2281-bf04-542d-a801-a6a4865373ad
        explode: false
        in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      responses:
        '204':
          description: IdP group role assignment deleted.
        '404':
          description: IdP group role assignment wasn't found.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Delete IdP Group Role Assignment
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        action: delete
        entityRefs:
        - entityType: idp_group
          in: path
          key: groupId
    get:
      description: 'Description: Retrieves an IdP group role assignment by ID.'
      operationId: getIdpGroup
      parameters:
      - description: Eon-assigned IdP group role assignment ID.
        example: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        explode: false
        in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetIdpGroupResponse'
          description: IdP group role assignment retrieved.
        '404':
          description: IdP group role assignment wasn't found.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Get IdP Group Role Assignment
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        excluded: true
    put:
      description: 'Description: Updates the roles assigned to an IdP group.<br/>


        This operation replaces all existing role assignments with the provided list.

        To add a role, include all existing roles plus the new one.

        To remove a role, include all roles except the one to remove.

        '
      operationId: updateIdpGroup
      parameters:
      - description: Eon-assigned IdP group role assignment ID.
        explode: false
        in: path
        name: groupId
        required: true
        schema:
          format: uuid
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateIdpGroupRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateIdpGroupResponse'
          description: IdP group role assignment updated.
        '404':
          description: IdP group role assignment wasn't found.
        1XX:
          description: Informational
        3XX:
          description: Redirect
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Client Error
        5XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal Server Error
      summary: Update IdP Group Role Assignment
      tags:
      - iam
      x-internal: false
      x-data-access:
        excluded: true
      x-permissions:
      - admin:idp_groups
      x-audit-log:
        action: update
        entityRefs:
        - entityType: idp_group
          in: path
          key: groupId
components:
  schemas:
    Idp:
      description: Identity provider.
      example:
        id: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
        providerName: okta-prod
      properties:
        id:
          description: Eon-assigned identity provider ID.
          example: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          format: uuid
          type: string
        providerName:
          description: Identity provider display name.
          example: okta-prod
          type: string
      required:
      - id
      - providerName
      type: object
    CreateIdpGroupRequest:
      example:
        roleIds:
        - 550e8400-e29b-41d4-a716-446655440000
        - 72bc42a0-e169-533f-b95a-4a434574756b
        providerGroupId: engineering-team
        idpId: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
        displayName: Engineering Team
      properties:
        idpId:
          description: '[ID of the identity provider](./list-idps) the group belongs to.'
          example: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          format: uuid
          type: string
        providerGroupId:
          description: 'Identity-provider-assigned group ID.

            Must match the exact group ID passed by the identity provider to Eon during SAML sign-on.

            '
          example: engineering-team
          type: string
        roleIds:
          description: List of [role IDs](../roles/list-roles) to assign to the group.
          example:
          - 550e8400-e29b-41d4-a716-446655440000
          - 72bc42a0-e169-533f-b95a-4a434574756b
          items:
            format: uuid
            type: string
          type: array
        displayName:
          description: 'Optional human-readable label for the group mapping. For display and management only;

            it is not used when matching SAML groups during sign-on.

            '
          example: Engineering Team
          type:
          - string
          - 'null'
          x-nullable: true
      required:
      - idpId
      - providerGroupId
      - roleIds
      type: object
    PermissionGrantInput:
      example:
        accessConditionId: Non-PII only.
        permission: inventory.view
      properties:
        permission:
          $ref: '#/components/schemas/PermissionType'
        accessConditionId:
          description: 'If present, the ID of the set of access conditions that restrict the resources the permission is granted for.

            The ID must be present in an entry in `accessConditions`, and the permission itself must support access conditions.

            If omitted, the permission is granted for all resources.

            '
          example: Non-PII only.
          type: string
      required:
      - permission
      type: object
    ListIdpGroupsResponse:
      example:
        nextToken: Y2NiMGYyZmMtYjYyZi00OTc5LTgzNjQtYmQ2YjEyYzdjZTNifDE=
        groups:
        - roleIds:
          - 550e8400-e29b-41d4-a716-446655440000
          - 72bc42a0-e169-533f-b95a-4a434574756b
          providerGroupId: engineering-team
          idpId: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          displayName: Engineering Team
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        - roleIds:
          - 550e8400-e29b-41d4-a716-446655440000
          - 72bc42a0-e169-533f-b95a-4a434574756b
          providerGroupId: engineering-team
          idpId: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          displayName: Engineering Team
          id: daa42222-6ad2-5d37-bb26-4f2a9cba73da
        totalCount: 0
      properties:
        groups:
          description: List of IdP group role assignments.
          items:
            $ref: '#/components/schemas/IdpGroup'
          type: array
        totalCount:
          description: Total number of IdP group role assignments.
          type: integer
        nextToken:
          description: 'Cursor that points to the first record of the next page of results.

            Pass this value in the next request.

            '
          example: Y2NiMGYyZmMtYjYyZi00OTc5LTgzNjQtYmQ2YjEyYzdjZTNifDE=
          type: string
      required:
      - groups
      type: object
    ResourceIdCondition:
      example:
        operator: IN
        resourceIds:
        - resourceIds
        - resourceIds
      properties:
        operator:
          $ref: '#/components/schemas/ScalarOperators'
        resourceIds:
          items:
            type: string
          type: array
      required:
      - operator
      - resourceIds
      type:
      - object
      - 'null'
    DataClass:
      description: 'Data classes.


        Allowed values: `FI`, `PHI`, `PII`

        '
      example: PII
      type: string
    ListIdpsResponse:
      example:
        nextToken: Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE=
        totalCount: 5
        idps:
        - id: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          providerName: okta-prod
        - id: 8f14e45f-ceea-467f-a8dc-e5e47d61e5d7
          providerName: okta-prod
      properties:
        idps:
          description: List of identity providers.
          items:
            $ref: '#/components/schemas/Idp'
          type: array
        totalCount:
          description: Total number of identity providers.
          example: 5
          type: integer
        nextToken:
          description: 'Cursor that points to the first record of the next page of results.

            Pass this value in the next request.

            '
          example: Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE=
          type: string
      required:
      - idps
      - totalCount
      type: object
    AccessConditionalExpression:
      description: 'Conditional expression to evaluate to determine which resources are accessible.


        Only one of the expressions below can be used.

        For multiple conditions using `AND` or `OR` logic, group expressions with `group`.

        You can nest multiple groups to create more complex expressions.

        '
      example:
        resourceId:
          operator: IN
          resourceIds:
          - resourceIds
          - resourceIds
        resourceGroupName:
          resourceGroupNames:
          - resourceGroupNames
          - resourceGroupNames
          operator: IN
        tagKeys:
          tagKeys:
          - tagKeys
          - tagKeys
          operator: CONTAINS_ANY_OF
        vpc:
          vpcs:
          - vpcs
          - vpcs
          operator: IN
        resourceName:
          resourceNames:
          - resourceNames
          - resourceNames
          operator: IN
        dataClasses:
          dataClasses:
          - PII
          - PII
          operator: CONTAINS_ANY_OF
        accountId:
          accountIds:
          - accountIds
          - accountIds
          operator: IN
        environment:
          environments:
          - PROD
          - PROD
          operator: IN
        tagKeyValues:
          tagKeyValues:
          - value: value
            key: key
          - value: value
            key: key
          operator: CONTAINS_ANY_OF
        cloudProvider:
          cloudProviders:
          - AWS
          - AWS
          operator: IN
        sourceRegion:
          regions:
          - regions
          - regions
          operator: IN
        subnets:
          subnets:
          - subnets
          - subnets
          operator: CONTAINS_ANY_OF
        group:
          operands:
          - resourceType:
              operator: IN
              resourceTypes:
              - AWS_EC2
              - AWS_RDS
          - environment:
              operator: IN
              environments:
              - PROD
              - PROD_INTERNAL
          operator: AND
        resourceType:
          resourceTypes:
          - AWS_EC2
          - AWS_EC2
          operator: IN
        apps:
          operator: CONTAINS_ANY_OF
          apps:
          - apps
          - apps
      properties:
        group:
          $ref: '#/components/schemas/RoleAccessGroupCondition'
        resourceType:
          $ref: '#/components/schemas/ResourceTypeCondition'
        dataClasses:
          $ref: '#/components/schemas/DataClassesCondition'
        environment:
          $ref: '#/components/schemas/EnvironmentCondition'
        apps:
          $ref: '#/components/schemas/AppsCondition'
        cloudProvider:
          $ref: '#/components/schemas/CloudProviderCondition'
        accountId:
          $ref: '#/components/schemas/AccountIdCondition'
        sourceRegion:
          $ref: '#/components/schemas/RegionCondition'
        vpc:
          $ref: '#/components/schemas/VpcCondition'
        subnets:
          $ref: '#/components/schemas/SubnetsCondition'
        resourceGroupName:
          $ref: '#/components/schemas/ResourceGroupNameCondition'
        resourceName:
          $ref: '#/components/schemas/ResourceNameCondition'
        resourceId:
          $ref: '#/components/schemas/ResourceIdCondition'
        tagKeys:
          $ref: '#/components/schemas/TagKeysCondition'
        tagKeyValues:
          $ref: '#/components/schemas/TagKeyValuesCondition'
      type:
      - object
      - 'null'
    UpdateRoleResponse:
      example:
        role:
          restoreDestinationLimits:
            effect: INCLUSIVE
            restoreAccountProviderIds:
            - restoreAccountProviderIds
            - restoreAccountProviderIds
          permissionGrants:
          - accessConditionId: Non-PII only.
            permission: inventory.view
          - accessConditionId: Non-PII only.
            permission: inventory.view
          sameSourceAccountRestoreLimits:
            dataAccessRuleId: dataAccessRuleId
            enabled: true
          isBuiltInRole: false
          name: My custom role
          accessConditions:
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
                  key: key
                operator: CONTAINS_ANY_OF
              cloudProvider:
                cloudProviders:
                - AWS
                - AWS
                operator: IN
              sourceRegion:
                regions:
                - regions
                - regions
                operator: IN
              subnets:
                subnets:
                - subnets
                - subnets
                operator: CONTAINS_ANY_OF
              group:
                operands:
                - resourceType:
                    operator: IN
                    resourceTypes:
                    - AWS_EC2
                    - AWS_RDS
                - environment:
                    operator: IN
                    environments:
                    - PROD
                    - PROD_INTERNAL
                operator: AND
              resourceType:
                resourceTypes:
                - AWS_EC2
                - AWS_EC2
                operator: IN
              apps:
                operator: CONTAINS_ANY_OF
                apps:
                - apps
                - apps
            effect: INCLUSIVE
            id: Non-PII only
          - expression:
              resourceId:
                operator: IN
                resourceIds:
                - resourceIds
                - resourceIds
              resourceGroupName:
                resourceGroupNames:
                - resourceGroupNames
                - resourceGroupNames
                operator: IN
              tagKeys:
                tagKeys:
                - tagKeys
                - tagKeys
                operator: CONTAINS_ANY_OF
              vpc:
                vpcs:
                - vpcs
                - vpcs
                operator: IN
              resourceName:
                resourceNames:
                - resourceNames
                - resourceNames
                operator: IN
              dataClasses:
                dataClasses:
                - PII
                - PII
                operator: CONTAINS_ANY_OF
              accountId:
                accountIds:
                - accountIds
                - accountIds
                operator: IN
              environment:
                environments:
                - PROD
                - PROD
                operator: IN
              tagKeyValues:
                tagKeyValues:
                - value: value
                  key: key
                - value: value
      

# --- truncated at 32 KB (99 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/eon/refs/heads/main/openapi/eon-iam-api-openapi.yml