HERE Authorization Information API

openapi: 3.2.0
info:
  title: Here Account v1 Authorization Information API
  version: 1.1.x
  description: This specification describes the Here Account v1 APIs
servers:
- url: https://account.api.here.com
security:
- Bearer: []
tags:
- name: Authorization Information
paths:
  /user/me/authorization:
    get:
      tags:
      - Authorization Information
      summary: Get my authorization details
      operationId: HereAccountV1APIsUserAuthorizationDetails
      description: 'Get the authorization details of the user represented by the Authorization header.

        The response includes all roles and permissions of the user.'
      responses:
        '200':
          description: 'Ok

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizationResponse'
        '404':
          description: '* 404600 - Authorization record is not found

            '
        default:
          description: "An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n  * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n  * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n  * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n  * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n  * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n  * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n  * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      parameters:
      - $ref: '#/components/parameters/includeAllPermissionsOrNoneParam'
      x-operation-id-source: normalized
      x-operation-id-original: Here Account v1 APIs userAuthorizationDetails
  /user/me/authorization/permissions:
    get:
      tags:
      - Authorization Information
      summary: Get my permissions
      operationId: HereAccountV1APIsGetMyPermissions
      description: Get a pageable list of permissions assigned to you
      parameters:
      - $ref: '#/components/parameters/countParam'
      - $ref: '#/components/parameters/pageTokenParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionsListPageToken'
        '400':
          description: '* 400001 - count must be Integer 0 or greater.

            * 400202 - Field ''pageToken'' cannot be empty.

            * 400203 - Invalid characters for page token query string.

            '
        default:
          description: "An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n  * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n  * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n  * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n  * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n  * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n  * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n  * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      x-operation-id-source: normalized
      x-operation-id-original: Here Account v1 APIs getMyPermissions
  /app/me/authorization:
    get:
      tags:
      - Authorization Information
      summary: Introspect application authorizations
      operationId: HereAccountV1APIsIntrospectApplicationAuthorization
      description: Retrieve the application authorization associated with the application.
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppAuthorizationResponse'
        '401':
          description: '* 404660 - No app exists with the given Id.

            '
        default:
          description: "An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n  * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n  * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n  * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n  * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n  * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n  * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n  * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      parameters:
      - $ref: '#/components/parameters/includeAllPermissionsOrNoneParam'
      x-operation-id-source: normalized
      x-operation-id-original: Here Account v1 APIs introspectApplicationAuthorization
  /app/me/authorization/permissions:
    get:
      tags:
      - Authorization Information
      summary: Get my app permissions
      security:
      - clientToken: []
      operationId: HereAccountV1APIsGetMyAppPermissions
      description: Get a pageable list of permissions directly assigned to your application. Permissions assigned indirectly via group memberships or policy or plans are not returned in this response.
      parameters:
      - $ref: '#/components/parameters/countParam'
      - $ref: '#/components/parameters/pageTokenParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionsListPageToken'
        '400':
          description: '* 400001 - count must be Integer 0 or greater.

            * 400202 - Field ''pageToken'' cannot be empty.

            * 400203 - Invalid characters for page token query string.

            * 404660 - No app exists with the given Id.

            '
        default:
          description: "An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n  * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n  * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n  * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n  * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n  * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n  * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n  * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      x-operation-id-source: normalized
      x-operation-id-original: Here Account v1 APIs getMyAppPermissions
components:
  schemas:
    App:
      type: object
      properties:
        clientId:
          type: string
          description: 'Identifier for the client/application. If provided, identifier should be present and active in Druid

            '
        name:
          type: string
          description: 'Human readable name of the client.  This field is required unless a clientId is provided

            '
        description:
          type: string
          description: 'Prose description of the client

            '
        status:
          type: string
          description: 'Current status of the application.

            '
        hrn:
          type: string
          description: 'HRN of the application.

            '
        realm:
          type: string
          description: 'realm of the application.

            '
      example:
        clientId: DdcIHVVKuMvTQrdci1FW
        name: My Third Party App
        description: This is a longer description of My Third Party App.
        status: active
        hrn: hrn:here:account::HERE:app/DdcIHVVKuMvTQrdci1FW
    PlanLink:
      type: object
      properties:
        id:
          type: string
          description: 'The unique identifier of the linked plan.

            '
          example: PLANLINK-d5e0f0ca-d122-4810-88a5-08fcade9e2d9
        planId:
          type: string
          description: 'Identifies the plan that this attachment is associated with.

            '
          example: PLAN-348e6490-8c6a-4528-83de-0a00692c4a7c
        policies:
          type: array
          items:
            $ref: '#/components/schemas/Policy'
          description: 'Policy contracts for each policy in the plan.

            '
        allowUpdates:
          type: boolean
          description: Identifies if plan is mutable
          example: true
      required:
      - id
      - planId
    User:
      type: object
      properties:
        userId:
          type: string
          description: 'The unique identifier of the user. Begins with AUTHINVITE if status is invited otherwise a HERE id.

            '
        realm:
          type: string
          description: 'Realm of the user. Since v2.74.

            '
        email:
          type: string
          description: 'Email address of the user. Present in all status states.

            '
        firstname:
          type: string
          description: 'The first name of the user. Only present if status is active.

            '
        lastname:
          type: string
          description: 'The last name of the user. Only present if status is active.

            '
        url:
          type: string
          description: 'The url from the authorization invite for this user. Only present if status is invited.

            '
        clientData:
          type: string
          description: 'The additional client data from the authorization invite for this user. Only present if status is invited.

            '
        hrn:
          type: string
          description: 'HRN of the user.

            '
      required:
      - userId
      - email
      example:
        userId: HERE-c184c17c-0deb-11e5-a6c0-1697f925ec7b
        realm: HERE
        firstname: Jack
        lastname: Sparrow
        email: jsparrow@example.com
        url: https://testUrl.com
        clientdata: Some Test Client Data
        hrn: hrn:here:account::HERE:user/HERE-c184c17c-0deb-11e5-a6c0-1697f925ec7b
    AppAuthorizationResponse:
      type: object
      description: 'App authorization information.

        '
      properties:
        app:
          $ref: '#/components/schemas/App'
        permissions:
          type: array
          items:
            $ref: '#/components/schemas/PermissionsResponse'
        policies:
          type: array
          items:
            $ref: '#/components/schemas/PolicyLink'
          example:
          - id: POLICYLINK-8d4dc5c1-bc0d-4b67-b90d-3b88d46013e0
            policyId: POLICY-99b7c7d7-867a-4573-8730-4689be1718c9
            contractId: CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b
        plans:
          type: array
          description: 'Policy contracts for each policy in the plan

            '
          items:
            $ref: '#/components/schemas/PlanLink'
    AuthorizationResponse:
      title: AuthorizationResponse
      type: object
      description: 'User Information, including assigned roles and permissions.

        '
      properties:
        user:
          $ref: '#/components/schemas/User'
        roles:
          type: array
          items:
            $ref: '#/components/schemas/RoleResponse'
        permissions:
          type: array
          items:
            $ref: '#/components/schemas/PermissionsResponse'
        status:
          type: string
          description: 'The status of this authorization.

            '
          enum:
          - created
          - invited
          - active
          - inactive
          example: active
        creatorUserId:
          type: string
          description: 'The unique identifier of the user that created the authorization.

            '
          example: HERE-1fc4a1dc-0deb-11e5-a6c0-1697f925da21
        creatorClientId:
          type: string
          description: 'Client ID from which the authorization was created.

            '
          example: bKmnBQVXCTxpP8A6Jp95a
        createdTime:
          type: integer
          format: int64
          description: 'Unix time (seconds) when the authorization was created.

            '
          example: 1433142351
        updatedTime:
          type: integer
          format: int64
          description: 'Unix time (seconds) when the authorization was last updated.

            '
          example: 1433144884
    RoleResponse:
      type: object
      properties:
        id:
          type: string
          description: 'The unique identifier of the role in the context of the user.  Begins with ROLE-

            '
        name:
          type: string
          description: 'The Role the user has in EUM. Valid values are hereadmin, reseller, serviceseller, customermanager, contractmanager

            '
        value:
          type: string
          description: 'For resellers, it''s the customer ID of the customer they manage. For customer admins, it''s the app ID of the app they administrate.

            '
      required:
      - name
      example:
      - id: ROLE-3742ed97-e80f-4b80-9c2a-2f2ef02c7cce
        name: contractmanager
        value: CONTRACT-cfe1d66c-86fa-4212-8751-b5048e1489a0
      - id: ROLE-a16ecb4b-ad74-4636-9c3a-02f2925ac9e7
        name: reseller
        value: CUST-d4ffefb0-0e13-11e5-a6c0-169ec7b7f925
    PolicyLink:
      type: object
      properties:
        id:
          type: string
        policyId:
          type: string
        contractId:
          type: string
        serviceId:
          type: string
        allowUpdates:
          type: boolean
    ErrorResponse:
      type: object
      properties:
        errorId:
          type: string
          description: Unique id for the error. This is searchable from HERE Account logs.
          example: ERROR-9d862c5a-4cfd-4780-8be4-2728b42849e1
        httpStatus:
          type: integer
          description: HTTP status code of the response
          example: 401
        errorCode:
          type: integer
          description: 'Error code representing the specific error. If the ''errorFields'' element is present, it will have precise error codes.

            '
          example: 401300
        message:
          type: string
          description: 'Descriptive message to help with development.  Note that the value of this field is **NOT** guaranteed to be consistent across releases and should **NOT** be coded against.

            '
          example: Invalid client credentials.
        errorFields:
          type: array
          items:
            type: object
            properties:
              name:
                type: string
                description: 'Name of the field that had an error. Will be blank in case the error was caused when comparing multiple fields.

                  '
                example: Received invalid data.  See json element 'errorFields' for more information.
              errorCode:
                type: integer
                description: 'More detailed error code. Needs to be paired with ''errorFields.name'' to get the exact error.

                  '
                example: 400201
              message:
                type: string
                description: 'Descriptive message to help with development.  Note that the value of this field is **NOT** guaranteed to be consistent across releases and should **NOT** be coded against.

                  '
                example: This field is required.
    PermissionsListPageToken:
      type: object
      description: Permissions list response.
      properties:
        total:
          type: integer
          description: The total number of records that match the search criteria.
          example: 10
        count:
          type: integer
          description: The number of records returned.
          example: 3
        pageToken:
          type: string
          description: The page token used for pagination.
          example: 7afd7f8e94eb4844ba45
        data:
          type: array
          description: List of Permissions
          items:
            $ref: '#/components/schemas/PermissionsResponse'
    PermissionsResponse:
      type: object
      properties:
        id:
          type: string
          description: 'The unique identifier of the permission in the context of the user.  Begins with PERM-

            '
        effect:
          type: string
          description: 'Allow or Deny

            '
        action:
          type: string
          description: 'The specific action identifier that this permission is controlling access to for the specific associated service.

            '
        resource:
          type: string
          description: 'The resource identifier that this permission is controlling access to for the given action.  May identify multiple resources via wildcard syntax.

            '
        expiresAt:
          type: string
          format: date-time
          example: '2030-05-26T19:30:00Z'
          description: The UTC time when the permission expires.
        serviceId:
          type: string
          description: 'Identifies the service that this permission is associated with.

            '
        contractId:
          type: string
          description: 'Identifies the contract, and therefore the customer and service that this permission is associated with.

            '
        customerId:
          type: string
          description: 'Identifies the customer that this permission is associated with.

            '
      example:
      - id: PERM-5d595ef9-d081-4ea5-b404-4c7bd816aec6
        effect: allow
        action: share
        resource: hrn:here:datastore:::*
        expiresAt: '2022-10-18T03:20:33.352Z'
        serviceId: SERVICE-fe2fe02d-a16d-4dab-aacc-7605aa37294e
        contractId: CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b
        customerId: CUST-0e13ffb0-fd4e-1697-11e5-a6c0f925ec7b
      - id: PERM-a72ab4a6-09bf-4960-9617-186976256f77
        effect: allow
        action: create
        serviceId: SERVICE-fe2fe02d-a16d-4dab-aacc-7605aa37294e
        contractId: CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b
        customerId: CUST-0e13ffb0-fd4e-1697-11e5-a6c0f925ec7b
      - id: PERM-226aa70d-83f7-4c63-a9de-b99fa8bcb1a5
        effect: deny
        action: update
        serviceId: SERVICE-c425116a-03bf-40ce-9cef-7fa0ee122a65
        contractId: CONTRACT-77e05a82-f80b-4f85-ab03-69a8bb3830ce
        customerId: CUST-c34114a5-152f-4f82-b0ad-c90162471e95
    Policy:
      type: object
      properties:
        policyId:
          type: string
          example: null
          description: 'Identifies the policy that is being attached to the client

            '
        contractId:
          type: string
          description: 'Identifies the contract that the permissions from the policy will be associated with.  This is required if the policy is a service scoped policy for a service that requires contracts.

            '
      required:
      - policyId
      example:
      - policyId: POLICY-e5e07c82-d6b5-417a-b180-076508a3a61d
        contractId: CONTRACT-f7d85359-3df9-47c2-8808-836cfb5ef258
      - policyId: POLICY-99b7c7d7-867a-4573-8730-4689be1718c9
        contractId: CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b
  parameters:
    includeAllPermissionsOrNoneParam:
      name: includeAllPermissions
      required: false
      in: query
      description: 'If true, include the permissions associated with the

        user inline in the response.  Otherwise, omit the permissions

        attribute from the response.

        '
      schema:
        type: boolean
        default: true
    pageTokenParam:
      in: query
      name: pageToken
      schema:
        type: string
      description: 'The pageToken to be used for search.  If omitted, the first

        page is returned.

        '
    countParam:
      in: query
      name: count
      schema:
        type: integer
      description: The number of records to be returned. Defaults to 100.
  securitySchemes:
    Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer Access Token issued to either the User or Application.
externalDocs:
  description: The developer guide and related API references are available here.
  url: https://www.here.com/docs/category/identity-and-access-management