Sonatype Nexus Repository Security: IP Allow List API

openapi: 3.2.0
info:
  title: 'Nexus Repository Manager REST Security: IP Allow List API'
  version: 3.97.2-02
servers:
- url: /service/rest
tags:
- name: 'Security: IP Allow List'
paths:
  /v1/security/ip-allowlist/entries:
    get:
      tags:
      - 'Security: IP Allow List'
      summary: Get paginated list of IP Allow List entries with optional search filter
      operationId: listSecurityIpAllowlistEntries
      parameters:
      - name: page
        in: query
        description: Page number (0-based)
        schema:
          type: integer
          format: int32
          default: 0
      - name: pageSize
        in: query
        description: Number of entries per page
        schema:
          type: integer
          format: int32
          default: 20
      - name: search
        in: query
        description: Search query (matches against IP address, CIDR notation, and description)
        schema:
          type: string
      responses:
        '200':
          description: Entries retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IpAllowListEntriesPageXO'
        '400':
          description: Invalid pagination parameters
        '403':
          description: Insufficient permissions to view entries
    post:
      tags:
      - 'Security: IP Allow List'
      summary: Add a new entry to the IP Allow List
      operationId: createSecurityIpAllowlistEntries
      requestBody:
        description: Entry to add
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EntryXO'
        required: true
      responses:
        '201':
          description: Entry added successfully
        '400':
          description: Invalid IP address or CIDR notation
        '403':
          description: Insufficient permissions to add entries
        '409':
          description: Entry already exists or would exceed maximum entries limit
    delete:
      tags:
      - 'Security: IP Allow List'
      summary: Clear all entries from the IP Allow List
      operationId: deleteSecurityIpAllowlistEntries
      parameters:
      - name: confirm
        in: query
        description: Must be 'true' to confirm the destructive operation
        required: true
        schema:
          type: boolean
      responses:
        '204':
          description: All entries cleared successfully
        '400':
          description: confirm=true query parameter is required to prevent accidental data loss
        '403':
          description: Insufficient permissions to clear entries
  /v1/security/ip-allowlist/entries/bulk:
    post:
      tags:
      - 'Security: IP Allow List'
      summary: Bulk upload entries from CSV content
      operationId: createSecurityIpAllowlistEntriesBulk
      requestBody:
        description: CSV upload request
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkUploadRequest'
        required: true
      responses:
        '200':
          description: Upload processed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkUploadResultXO'
        '400':
          description: Invalid CSV content or size exceeds limit
        '403':
          description: Insufficient permissions
        '500':
          description: Error processing CSV
    delete:
      tags:
      - 'Security: IP Allow List'
      summary: Remove one or more entries from the IP Allow List by ID
      operationId: deleteSecurityIpAllowlistEntriesBulk
      requestBody:
        description: List of entry IDs to remove
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
        required: true
      responses:
        '200':
          description: Bulk delete result with counts of deleted and failed IDs
        '400':
          description: Entry IDs list cannot be empty
        '403':
          description: Insufficient permissions to remove entries
  /v1/security/ip-allowlist/current-ip:
    get:
      tags:
      - 'Security: IP Allow List'
      summary: Get the current user's IP address and whether it is in the allow list
      operationId: listSecurityIpAllowlistCurrentIp
      responses:
        '200':
          description: Current IP and allowed status retrieved
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CurrentIpXO'
        '403':
          description: Insufficient permissions
  /v1/security/ip-allowlist:
    get:
      tags:
      - 'Security: IP Allow List'
      summary: Get IP Allow List settings (mode, entry counts, max entries)
      operationId: listSecurityIpAllowlist
      responses:
        '200':
          description: Settings retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IpAllowListSettingsXO'
        '403':
          description: Insufficient permissions to view settings
  /v1/security/ip-allowlist/entries/{id}:
    put:
      tags:
      - 'Security: IP Allow List'
      summary: Update an existing entry in the IP Allow List
      operationId: updateSecurityIpAllowlistEntries
      parameters:
      - name: id
        in: path
        description: Entry ID
        required: true
        schema:
          type: string
      requestBody:
        description: Updated entry data
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EntryXO'
        required: true
      responses:
        '200':
          description: Entry updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IpAllowListEntryXO'
        '400':
          description: Invalid IP address or CIDR notation
        '403':
          description: Insufficient permissions to update entries
        '404':
          description: Entry not found
        '409':
          description: IP address already exists
  /v1/security/ip-allowlist/mode:
    put:
      tags:
      - 'Security: IP Allow List'
      summary: Update the IP Allow List operational mode
      operationId: updateSecurityIpAllowlistMode
      requestBody:
        description: Mode change request
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ModeChangeXO'
        required: true
      responses:
        '204':
          description: Mode updated successfully
        '400':
          description: Invalid mode value provided
        '403':
          description: Insufficient permissions to change mode
components:
  schemas:
    IpAllowListEntriesPageXO:
      type: object
      properties:
        entries:
          type: array
          description: List of entries on the current page
          items:
            $ref: '#/components/schemas/IpAllowListEntryXO'
        page:
          type: integer
          description: Current page number (0-based)
          format: int32
          example: 0
        pageSize:
          type: integer
          description: Number of entries per page
          format: int32
          example: 20
        totalEntries:
          type: integer
          description: Total number of entries across all pages
          format: int32
          example: 42
        totalPages:
          type: integer
          description: Total number of pages
          format: int32
          example: 3
      description: Paginated list of IP Allow List entries
    ModeChangeXO:
      required:
      - mode
      type: object
      properties:
        mode:
          type: string
          description: 'The new mode: DISABLED, MONITOR, or ENFORCE'
          example: MONITOR
          enum:
          - DISABLED
          - MONITOR
          - ENFORCE
      description: Request to change IP Allow List mode
    IpAllowListEntryXO:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the entry
          example: 550e8400-e29b-41d4-a716-446655440000
        entryType:
          type: string
          description: 'Entry type: IPV4, IPV6, CIDR_IPV4, or CIDR_IPV6'
          example: CIDR_IPV4
        entry:
          type: string
          description: The IP address or CIDR notation
          example: 192.168.1.0/24
        createdBy:
          type: string
          description: Username who created the entry
          example: admin
        createdAt:
          type: string
          description: When the entry was created
          format: date-time
        updatedBy:
          type: string
          description: Username who last updated the entry
          example: admin
        updatedAt:
          type: string
          description: When the entry was last updated
          format: date-time
        description:
          type: string
          description: Optional description for this IP address
          example: Office network
      description: IP Allow List entry
    BulkUploadRequest:
      required:
      - csvContent
      type: object
      properties:
        csvContent:
          type: string
    CurrentIpXO:
      type: object
      properties:
        ip:
          type: string
          description: The caller's IP address, or "unknown" if it cannot be determined
          example: 10.0.0.5
        allowed:
          type: boolean
          description: Whether the address would be permitted if enforcement were enabled
          example: true
      description: The caller's IP address and whether it is permitted by the IP Allow List
    EntryXO:
      required:
      - ipOrCidr
      type: object
      properties:
        ipOrCidr:
          minLength: 1
          type: string
          description: IP address or CIDR notation to add
          example: 192.168.1.0/24
        description:
          maxLength: 255
          minLength: 0
          type: string
          description: Optional description for this IP address
          example: Office network
      description: Request to add an IP Allow List entry
    BulkUploadResultXO:
      type: object
      properties:
        totalRows:
          type: integer
          description: Total number of data rows processed (excluding header)
          format: int32
          example: 32
        addedCount:
          type: integer
          description: Number of entries successfully added
          format: int32
          example: 17
        skippedCount:
          type: integer
          description: Number of entries skipped (duplicates)
          format: int32
          example: 5
        rejectedCount:
          type: integer
          description: Number of entries rejected due to validation errors
          format: int32
          example: 10
        rejectedEntries:
          type: array
          description: Structured list of rejected entries with line number, value, and reason
          items:
            $ref: '#/components/schemas/RejectedEntryXO'
      description: Result of bulk CSV upload operation
    RejectedEntryXO:
      type: object
      properties:
        line:
          type: integer
          description: Line number in the CSV file
          format: int32
          example: 19
        value:
          type: string
          description: The value that was rejected
          example: 999.999.999.999
        reason:
          type: string
          description: Reason the entry was rejected
          example: 'Invalid IP address: ''999.999.999.999'''
      description: A rejected entry from a bulk CSV upload
    IpAllowListSettingsXO:
      type: object
      properties:
        mode:
          type: string
          description: 'Current mode: DISABLED, MONITOR, or ENFORCE'
          example: DISABLED
          enum:
          - DISABLED
          - MONITOR
          - ENFORCE
        effectiveMode:
          type: string
          description: The mode currently being applied. May differ from 'mode' when the feature is force-disabled, or when the mode is ENFORCE with an empty allow list (which is not enforced, as it would deny all requests).
          example: DISABLED
          enum:
          - DISABLED
          - MONITOR
          - ENFORCE
        featureEnabled:
          type: boolean
          description: Whether the IP Allow List feature is currently enabled
          example: true
        totalEntries:
          type: integer
          description: Total number of entries in the allow list
          format: int32
          example: 42
        maxEntries:
          type: integer
          description: Maximum number of entries allowed
          format: int32
          example: 256
        ipv4AddressesCovered:
          type: integer
          description: Number of individual IPv4 addresses covered by IPv4 and CIDR_IPV4 entries
          format: int64
          example: 257
        ipv6AddressesCovered:
          type: integer
          description: Number of individual IPv6 addresses covered by IPv6 and CIDR_IPV6 entries
          format: int64
          example: 15
      description: IP Allow List settings