HERE Authorization API v1.1

{"openapi":"3.0.0","info":{"title":"Authorization API v1.1","version":"1.1.0","description":"\nThis specification is intended to describe the Authorization v1.1 APIs\n## Roles\n### **OrgAdmin** - An entity which has administrative authority over an organization.\n  + Administrative rights include authority to:\n    + Promote realm members to the **OrgAdmin** role\n    + Promote realm members to the **OrgInviter** role\n    + Promote realm members to the **GroupAdmin** role within all groups\n    + Promote project members to the **ProjectAdmin** role\n    + Promote realm members to the **CrossRealmTrustManager** role\n    + All rights associated with the **OrgInviter** role\n    + All rights associated with the **CrossRealmTrustManager** role\n    + Create groups\n    + Delete groups\n    + Modify groups\n    + Add/remove group members for all groups\n    + Add/remove project members for all projects\n    + Read/List project members for all projects\n    + List their projects\n    + List all projects in the Org\n    + Read all projects\n    + Update all projects\n    + Delete all projects\n\n### **OrgInviter** - An entity which has elevated permissions within an organization.\n  + Administrative rights include the authority to:\n    + Create and send an invitation to the organization and optionally add the invitee to a group if the **OrgInviter** is also a **GroupAdmin** for that group\n    + Resend an invitation to the organization\n    + Search for pending invitations of the organization\n    + Cancel invitations sent to members of that organization\n\n### **ResourceManager** - An entity which has elevated permissions within an organization.\n  + Administrative rights include the authority to:\n    + Management permissions on all applications within the realm\n    + Management permissions on all schemas and artifacts within the realm\n    + Management permissions on all catalogs and layers within the realm\n    + Management permissions on all projects within the realm\n\n### **GroupAdmin** - An entity which has administrative authority over groups in which they have been assigned this role.\n  + Administrative rights include the authority to:\n    + Add/remove group members for their groups\n    + Promote realm members to the **GroupAdmin** role for their groups\n    + Modify their groups\n    + Delete their groups\n\n### **ProjectAdmin** - Entities that have administrative authority over projects in which they have been assigned this role.\n  + Administrative rights include the authority to:\n    + Add/remove project members for their projects\n    + Read/List project members for their projects\n    + Promote members to the **ProjectAdmin** role for their projects\n    + List their projects\n    + Read their projects\n    + Update their projects\n    + Delete their projects\n\n### **MonitoringDashboardEditor** - An entity which has role defined within an organization.\n  + No additional Administrative rights included\n  + This role maps to the Grafana 'Editor' role when interacting with Grafana\n\n### **LicensingAdmin** - An entity which has elevated permissions within an organization.\n  + Administrative rights include the authority to:\n    + \"manageLicenses\" access for all resources within the realm for BAM Config Service\n\n### **CrossRealmTrustManager** - An entity which has elevated permissions within an organization.\n  + Administrative rights include the authority to:\n    + Create/update/delete cross realm trusts\n    + Read/list cross realm trusts\n\n## Project scoped token\n  + Project scoped token contains an \"scp\" (scope) claim of value \"project hrn\"\n"},"externalDocs":{"description":"The developer guide and related API references are available here.","url":"https://www.here.com/docs/category/identity-and-access-management"},"servers":[{"url":"Use API Lookup for a base URL"}],"security":[{"Bearer":[]}],"tags":[{"name":"Realms","description":"Realms and Realm Membership Management"},{"name":"Roles","description":"Role and Role Membership Management"},{"name":"Groups","description":"Group and Group Membership Management"},{"name":"Grants","description":"Manage resource access by external users"},{"name":"Access Filters","description":"Manage access control boundaries for identities"},{"name":"Resource Info and Management","description":"Resource Management and Information"},{"name":"Resource Policies","description":"Resource Policy Management"},{"name":"Project Management","description":"Project Management"},{"name":"Project Access Management","description":"Project Access and Membership Management"},{"name":"Project Resource Management","description":"Project Resource Management"},{"name":"Cross Realm Trusts","description":"Cross Realm Trusts"},{"name":"Services","description":"Service discovery and management"}],"paths":{"/roles":{"get":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"},{"$ref":"#/components/parameters/roleName"},{"$ref":"#/components/parameters/resourceHrn"}],"tags":["Roles"],"summary":"Get Roles","description":"Retrieve the list of roles within the context of the provided realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readRoles\"** action permission for the callers **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getRoles","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RolePageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}}},"/roles/me":{"get":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"}],"tags":["Roles"],"summary":"Get My Roles","description":"Retrieve the list of roles which have been assigned to the calling party.\n\n</br>Access Control:\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getMyRoles","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RolePageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}}}},"/roles/{role}":{"parameters":[{"$ref":"#/components/parameters/role"}],"get":{"tags":["Roles"],"summary":"Get Role","operationId":"getRole","description":"Get the role identified by the provided Role HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"readRoles\"** action permission for the callers **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Role"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Role not found"}}}},"/roles/{role}/permissions":{"parameters":[{"$ref":"#/components/parameters/role"}],"get":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"}],"tags":["Roles"],"summary":"Get Role Permissions","operationId":"getRolePermissions","description":"Get the **unscoped** permissions associated with the role identified by the provided Role HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"readPermissions\"** action permission for the resource **\"{role}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Role not found"}}}},"/roles/{role}/permissions/{permission}":{"parameters":[{"$ref":"#/components/parameters/role"},{"$ref":"#/components/parameters/permission"}],"get":{"tags":["Roles"],"summary":"Get Role Permission","operationId":"getRolePermission","description":"Get a single permission associated with the role identified by the provided Role HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"readPermissions\"** action permission for the resource **\"{role}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActivePermission"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Role or permission not found"}}}},"/roles/{role}/filter":{"get":{"parameters":[{"$ref":"#/components/parameters/role"}],"tags":["Roles"],"summary":"Get Role Access Filter","description":"Retrieve the Access Filter attached to this role if there is one.\n\n</br>Access Control:\n* The calling principal must have **\"readFilter\"** action permission for the resource **\"{role}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getRoleAccessFilter","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessFilter"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Role or access filter not found."}}}},"/realms/{realm}/invites/{invite}":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/invite"}],"post":{"tags":["Realms"],"summary":"Resend an invitation to a user in a realm","description":"Resend an invitation to a new member to the realm.\n\n</br>Access Control:\n  * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * This API is rate limited to a maximum of **6** invites per realm per minute.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"resendRealmMemberInvite","responses":{"204":{"$ref":"#/components/responses/NoContent"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or invite not found."},"429":{"description":"Realm invitation is temporarily suspended due to repeated requests. Wait for a while before making a new request."}}},"put":{"tags":["Realms"],"summary":"Update and send an invitation to a user in a realm","description":"Update and resend an invitation to add a new member to the realm,\noptionally assign membership to one or more groups if the Inviter is\nalso a **GroupAdmin** for the group and optionally invite with one or\nmore roles assigned.\n\n</br>Access Control:\n  * In order to invite a new user to the **\"{realm}\"**:\n    * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * In order to invite a new user to the **\"{realm}\"** as a member of the **\"{group}\"**:\n    * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** **AND** \n      **\"manageMembers\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service.\n  * In order to invite a new user to the **\"{realm}\"** to have roles. For each **\"{role}\"**:\n    * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** **AND** \n      **\"manageEntities\"** action permission for the resource **\"{role}\"** in the **\"authorization\"** service.\n  * This API is rate limited to a maximum of **6** invites per realm per minute.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"sendUpdatedRealmMemberInvite","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RealmAuthorizationInvite"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RealmAuthInviteResponse"}}}},"400":{"description":"Invalid name or role."},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or group or role not found."},"422":{"description":"Group size limit exceeded."},"429":{"description":"Realm invitation is temporarily suspended due to repeated requests. Wait for a while before making a new request."}}},"delete":{"tags":["Realms"],"summary":"Cancel a user invitation to a realm","description":"Cancel an invitation to the realm.\n\n</br>Access Control:\n  * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"cancelRealmMemberInvite","responses":{"204":{"$ref":"#/components/responses/NoContent"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or invite not found."}}}},"/realms/{realm}/invites":{"get":{"tags":["Realms"],"summary":"Search for invitations in a realm","description":"Search for invitations in the realm, optionally providing a group.\n\n</br>Access Control:\n  * The calling principal must have either **\"manageInvites\"** or **\"readMembers\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"searchRealmMemberInvites","parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/groupQuery"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"},{"$ref":"#/components/parameters/invitesSearch"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitePageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or group not found."}}},"post":{"tags":["Realms"],"summary":"Create and send a user invitation for a realm","description":"Create and send an invitation to add a new member to the realm,optionally assign membership to one or more groups\nif the Inviter is also a **GroupAdmin** for the group and optionally invite with one or more roles assigned.\n\n</br>Access Control:\n  * In order to invite a new user to the **\"{realm}\"**:\n    * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * In order to invite a new user to the **\"{realm}\"** as a member of the **\"{group}\"**:\n    * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** **AND** \n      **\"manageMembers\"** action permission for the resource **\"{group}\"** in the **\"authorization\"** service.\n  * In order to invite a new user to the **\"{realm}\"** to have roles. For each **\"{role}\"**:\n    * The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** **AND** \n      **\"manageEntities\"** action permission for the resource **\"{role}\"** in the **\"authorization\"** service.\n  * This API is rate limited to a maximum of **6** invites per realm per minute.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"createRealmMemberInvite","parameters":[{"$ref":"#/components/parameters/realm"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RealmAuthorizationInvite"}}},"required":true},"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RealmAuthInviteResponse"}}}},"400":{"description":"Invalid email or name or role."},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or group or role not found."},"422":{"description":"Group size limit exceeded."},"429":{"description":"Realm invitation is temporarily suspended due to repeated requests. Wait for a while before making a new request."}}}},"/realms/{realm}/invites/targets":{"get":{"tags":["Realms"],"summary":"Get list of supported invite targets for the realm","description":"Get the list of supported invite targets for the realm.  An invite target determines what application a\nuser is directed to use in the invitation email.  The value **\"platform\"** is available by default in every\nrealm.  Additional supported values are available depending on the realm's configuration.\n\n</br>Access Control:\n* The calling principal must have **\"manageInvites\"** action permission for the resource **\"{realm}\"** in the **\"account\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getRealmMemberInviteTargets","parameters":[{"$ref":"#/components/parameters/realm"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InviteTargets"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or group not found."}}}},"/realms/{realm}/limits":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/XCorrelationId"},{"$ref":"#/components/parameters/XRequestId"}],"get":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/limitType"}],"tags":["Realms"],"summary":"Get Realm limits","description":"Retrieve the list of limits associated with this realm.  A limit with the same **\"type\"** __may__ appear in the list\nmultiple times.  In this case, the actual limit that is enforced by the same is the highest of all configured values.\n\n</br>Access Control:\n* The calling principal must have **\"readLimits\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n* The calling principal MUST NOT include a project scope.\n","operationId":"getRealmLimits","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RealmLimitPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members":{"parameters":[{"$ref":"#/components/parameters/realm"}],"get":{"parameters":[{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"},{"$ref":"#/components/parameters/realmEntityType"},{"$ref":"#/components/parameters/realmMembersSearch"},{"$ref":"#/components/parameters/realmMembersState"},{"$ref":"#/components/parameters/vehicleContractId"}],"tags":["Realms"],"summary":"Get realm members","description":"Retrieve the list of members within the realm.\n\n</br>Access Control:\n  * The calling principal must have **\"readMembers\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getRealmMembers","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RealmMemberPageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"}],"get":{"tags":["Realms"],"summary":"Get realm member","description":"Retrieve the user or application details of the member defined by member HRN.\n\n</br>Access Control:\n  * The calling principal must have **\"readMembers\"** action permission for the resource **\"{realm}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getRealmMember","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RealmMember"},"examples":{"user":{"value":{"memberHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899","entityType":"user","info":{"userId":"HERE-64badba9-4242-4859-88d5-74563a8f0899","userHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0899","realm":"myrealm","firstname":"John","lastname":"Williams","email":"john.williams@example.com","roles":["OrgAdmin","GroupAdmin"],"state":"enabled","createdTime":1432216394712}}},"vehicle":{"value":{"memberHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0890","entityType":"car","info":{"userId":"HERE-64badba9-4242-4859-88d5-74563a8f0890","userHrn":"hrn:here:account::myrealm:user/HERE-64badba9-4242-4859-88d5-74563a8f0890","realm":"myrealm","carId":"HashedVehicleVIN","vehicleContractId":"XY/1234","roles":["OrgAdmin","GroupAdmin"],"state":"enabled","createdTime":1432216394712}}},"app":{"value":{"memberHrn":"hrn:here:account::myrealm:app/0123456789ABCDEFGHHIJKLM","entityType":"app","info":{"clientId":"0123456789ABCDEFGHHIJKLM","clientHrn":"hrn:here:account::myrealm:app/0123456789ABCDEFGHHIJKLM","realm":"myrealm","name":"Some Application","description":"Application for doing something.","ownerId":"HERE-00000000-0000-0000-0000-000000000000","ownerHrn":"hrn:here:account::myrealm:user/HERE-00000000-0000-0000-0000-000000000000","defaultScope":"hrn:here:authorization::myrealm:project/my-project-0000","isRestrictedScope":"true","appCreationEnabled":"true","alwaysProjectScope":"true","status":"active","roles":["OrgAdmin","GroupAdmin"],"state":"enabled","createdTime":1432216394712}}}}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or realm member not found"}}}},"/realms/{realm}/members/{member}/roles":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"}],"get":{"tags":["Realms"],"summary":"Get entity roles","description":"Retrieve the roles a given entity has been assigned.\n\n</br>Access Control:\n  * The calling principal must have **\"readRoles\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getEntityRoleAssignments","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RolePageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or realm member not found"}}}},"/realms/{realm}/members/{member}/groups":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/count"}],"get":{"tags":["Realms"],"summary":"Get entity group membership","description":"Retrieve the groups a given entity is a member of.\n\n</br>Access Control:\n  * The calling principal must have **\"readGroups\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getEntityGroupMembership","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupPageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or realm member not found"}}}},"/realms/{realm}/members/{member}/managedGroups":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/count"},{"$ref":"#/components/parameters/pageToken"}],"get":{"tags":["Realms"],"summary":"Get entity managed group","description":"Retrieve the list of groups over which the provided entity has been\ngranted the role of GroupAdmin.\n\n</br>Access Control:\n  * The calling principal must have **\"readGroups\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getEntityManagedGroups","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupPageWToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"description":"Realm or realm member not found"}}}},"/realms/{realm}/members/{member}/projects":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"}],"get":{"tags":["Realms"],"summary":"Get entity project membership","description":"Retrieve the projects a given entity is a member of.\n\n</br>Access Control:\n  * The calling principal must have **\"manage\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n","operationId":"getEntityProjectMembership","responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectListWithPageToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}/plans":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Entity Plans","operationId":"getEntityPlans","description":"Get all plans attached to the requested entity.\n\n**Note:** Plans can only be attached to apps. Requesting plans attached to a user will return 404.\n\n</br>Access Control:\n  * The calling principal must have **\"readPlans\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedUnscopedPlanPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}/plans/{plan}/policies":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/planHrn"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Entity Plan Policies","operationId":"getEntityPlanPolicies","description":"Get all policies associated with a plan attached to the requested entity.\n\n</br>Access Control:\n  * The calling principal must have **\"readPlans\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedUnscopedPolicyPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}/plans/{plan}/policies/{policy}/permissions":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/planHrn"},{"$ref":"#/components/parameters/policyHrn"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Entity Plan Policy Permissions","operationId":"getEntityPlanPolicyPermissions","description":"Get all **unscoped** permissions that are in a policy associated with a plan attached to the requested entity.\n\n</br>Access Control:\n  * The calling principal must have **\"readPlans\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}/policies":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Entity Policies","operationId":"getEntityPolicies","description":"Get all policies attached to the requested entity.\n\n**Note:** Policies can only be attached to apps. Requesting policies attached to a user will return 404.\n\n</br>Access Control:\n  * The calling principal must have **\"readPolicies\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachedUnscopedPolicyPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}/policies/{policy}/permissions":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/policyHrn"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/XCorrelationId"}],"get":{"tags":["Realms"],"summary":"Get Entity Policy Permissions","operationId":"getEntityPolicyPermissions","description":"Get all **unscoped** permissions that are in a policy attached to the requested entity.\n\n</br>Access Control:\n  * The calling principal must have **\"readPolicies\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","responses":{"200":{"description":"OK.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/realms/{realm}/members/{member}/permissions":{"parameters":[{"$ref":"#/components/parameters/realm"},{"$ref":"#/components/parameters/member"},{"$ref":"#/components/parameters/permissionServiceId"},{"$ref":"#/components/parameters/pageToken"},{"$ref":"#/components/parameters/limit"}],"get":{"tags":["Realms"],"summary":"Get entity permissions","description":"Retrieve the **unscoped** permissions a given entity has been assigned.\n\n</br>Access Control:\n  * The calling principal must have **\"readPermissions\"** action permission for the resource **\"{member}\"** in the **\"authorization\"** service.\n  * The calling principal MUST NOT include a project scope.\n","operationId":"getEntityPermissions","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionPageWithToken"}}}},"401":{"$ref":"#/components/responses/Unauthoriz

# --- truncated at 32 KB (271 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/here/refs/heads/main/openapi/here-authorization-v1-1-openapi.yml