Pure Storage Active Directory API

openapi: 3.2.0
info:
  title: FlashArray REST Active Directory API
  version: '2.52'
  description: 'Active Directory configuration authenticates users for NFS using Kerberos or SMB using Kerberos

    or New Technology LAN Manager (NTLM). Active Directory is also used to authorize users by

    mapping identities across the NFS and SMB protocols by using LDAP queries.

    '
servers:
- url: /
tags:
- name: Active Directory
  description: 'Active Directory configuration authenticates users for NFS using Kerberos or SMB using Kerberos

    or New Technology LAN Manager (NTLM). Active Directory is also used to authorize users by

    mapping identities across the NFS and SMB protocols by using LDAP queries.

    '
paths:
  /api/2.52/active-directory:
    get:
      tags:
      - Active Directory
      summary: Pure Storage List Active Directory Accounts
      description: 'Displays configured Active Directory accounts.

        '
      parameters:
      - $ref: '#/components/parameters/Authorization'
      - $ref: '#/components/parameters/XRequestId'
      - $ref: '#/components/parameters/Continuation_token'
      - $ref: '#/components/parameters/Filter'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Fqnames'
      - $ref: '#/components/parameters/Offset'
      - $ref: '#/components/parameters/Sort'
      - $ref: '#/components/parameters/Total_item_count'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryGetResponse'
    post:
      tags:
      - Active Directory
      summary: Pure Storage Create Active Directory Account
      description: 'Creates one or more Active Directory accounts.

        The `user` and `password` provided are used

        to join the array to the specified `domain`.

        '
      parameters:
      - $ref: '#/components/parameters/Authorization'
      - $ref: '#/components/parameters/XRequestId'
      - $ref: '#/components/parameters/Join_existing_acct_ad'
      - $ref: '#/components/parameters/Fqnames_required'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActiveDirectoryPost'
        required: true
        x-codegen-request-body-name: active-directory
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryResponse'
      x-codegen-request-body-name: active-directory
    delete:
      tags:
      - Active Directory
      summary: Pure Storage Delete Active Directory Account
      description: 'Deletes one or more specified Active Directory accounts.

        '
      parameters:
      - $ref: '#/components/parameters/Authorization'
      - $ref: '#/components/parameters/XRequestId'
      - $ref: '#/components/parameters/Local_only_ad'
      - $ref: '#/components/parameters/Fqnames_required'
      responses:
        '200':
          description: OK
          content: {}
    patch:
      tags:
      - Active Directory
      summary: Pure Storage Modify Active Directory Account
      description: 'Modifies specified Active Directory account.

        '
      parameters:
      - $ref: '#/components/parameters/Authorization'
      - $ref: '#/components/parameters/XRequestId'
      - $ref: '#/components/parameters/Fqnames_required'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActiveDirectoryPatch'
        required: true
        x-codegen-request-body-name: active-directory
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryResponse'
      x-codegen-request-body-name: active-directory
  /api/2.52/active-directory/test:
    get:
      tags:
      - Active Directory
      summary: Pure Storage GET Active-directory/test
      description: 'The diagnostic process that executes a series of validation tests on one or more `Active Directory` `accounts`. Each individual test verifies a specific aspect of the `configuration`, such as connectivity, authentication permissions, and service principal integrity, to ensure the environment is functioning properly.

        '
      parameters:
      - $ref: '#/components/parameters/Authorization'
      - $ref: '#/components/parameters/XRequestId'
      - $ref: '#/components/parameters/Allow_errors'
      - $ref: '#/components/parameters/Context_names_get'
      - $ref: '#/components/parameters/Continuation_token'
      - $ref: '#/components/parameters/Filter'
      - $ref: '#/components/parameters/Ids'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Names_required'
      - $ref: '#/components/parameters/Offset'
      - $ref: '#/components/parameters/Sort'
      - $ref: '#/components/parameters/Total_item_count'
      responses:
        '200':
          description: OK
          headers:
            X-Request-ID:
              description: The identifier or attribute provided by the `client` during the initial `request` or automatically generated by the `server` if not specified.
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TestResultWithResourceAndErrorContextPartialResourceResponse'
        '207':
          description: 'The status indicating a partial success. While some `resources`

            were successfully returned, specific `errors` occurred during

            the operation that may have prevented the full set of

            requested data from being retrieved or displayed.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TestResultWithResourceAndErrorContextPartialResourceResponse'
  /api/2.26/active-directory:
    get:
      tags:
      - Active Directory
      summary: Pure Storage GET Active-directory
      description: List Active Directory accounts and their configuration.
      parameters:
      - $ref: '#/components/parameters/XRequestId'
      - $ref: '#/components/parameters/Continuation_token'
      - $ref: '#/components/parameters/Filter'
      - $ref: '#/components/parameters/Ids_2'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Names'
      - $ref: '#/components/parameters/Offset_2'
      - $ref: '#/components/parameters/Sort_2'
      responses:
        '200':
          description: OK
          headers:
            X-Request-ID:
              description: Supplied by client during request or generated by server.
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryGetResponse'
    post:
      tags:
      - Active Directory
      summary: Pure Storage POST Active-directory
      description: 'Join an Active Directory domain and generate keytabs for the

        registered SPNs and supported encryption types.

        '
      parameters:
      - $ref: '#/components/parameters/XRequestId'
      - $ref: '#/components/parameters/Join_existing_acct_ad_2'
      - $ref: '#/components/parameters/Names'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActiveDirectoryPost_2'
        required: true
        x-codegen-request-body-name: active-directory
      responses:
        '200':
          description: OK
          headers:
            X-Request-ID:
              description: Supplied by client during request or generated by server.
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryResponse_2'
      x-codegen-request-body-name: active-directory
    delete:
      tags:
      - Active Directory
      summary: Pure Storage DELETE Active-directory
      description: Delete an Active Directory account.
      parameters:
      - $ref: '#/components/parameters/XRequestId'
      - $ref: '#/components/parameters/Ids_2'
      - $ref: '#/components/parameters/Local_only_ad'
      - $ref: '#/components/parameters/Names'
      responses:
        '200':
          description: OK
          headers:
            X-Request-ID:
              description: Supplied by client during request or generated by server.
              schema:
                type: string
          content: {}
    patch:
      tags:
      - Active Directory
      summary: Pure Storage PATCH Active-directory
      description: Modify the configuration of an Active Directory account.
      parameters:
      - $ref: '#/components/parameters/XRequestId'
      - $ref: '#/components/parameters/Ids_2'
      - $ref: '#/components/parameters/Names'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActiveDirectoryPatch_2'
        required: true
        x-codegen-request-body-name: active-directory
      responses:
        '200':
          description: OK
          headers:
            X-Request-ID:
              description: Supplied by client during request or generated by server.
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryResponse_2'
      x-codegen-request-body-name: active-directory
  /api/2.26/active-directory/test:
    get:
      tags:
      - Active Directory
      summary: Pure Storage GET Active-directory/test
      description: 'Executes a series of tests to verify if the configuration of one or more Active Directory accounts are functioning properly. Each test verifies a different aspect of the configuration.

        '
      parameters:
      - $ref: '#/components/parameters/XRequestId'
      - $ref: '#/components/parameters/Allow_errors'
      - $ref: '#/components/parameters/Context_names_get'
      - $ref: '#/components/parameters/Continuation_token'
      - $ref: '#/components/parameters/Filter'
      - $ref: '#/components/parameters/Ids_2'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Names'
      - $ref: '#/components/parameters/Sort_2'
      responses:
        '200':
          description: OK
          headers:
            X-Request-ID:
              description: Supplied by client during request or generated by server.
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TestResultRemoteExecutionGet'
        '207':
          description: 'Partial success. Some resources were returned, but there

            were also errors possibly preventing some resources from

            being returned.

            '
          headers:
            X-Request-ID:
              description: Supplied by client during request or generated by server.
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TestResultRemoteExecutionGet'
components:
  schemas:
    _fixedReference_2:
      allOf:
      - $ref: '#/components/schemas/_fixedReferenceWithoutType'
      - type: object
        properties:
          resource_type:
            description: 'Type of the object (full name of the endpoint).

              Valid values are the unique part of the resource''s REST endpoint.

              For example, a reference to a file system would have a

              `resource_type` of `file-systems`.

              '
            type: string
            readOnly: true
    _serverReference:
      description: 'An object that is server-aware and can be associated to a server.

        '
      type: object
      properties:
        server:
          description: 'Reference to the server the object belongs to. When the value is empty or set to `null`

            it means the object lives outside of a server scope.

            '
          readOnly: true
          title: FixedReferenceWithType
          allOf:
          - $ref: '#/components/schemas/_fixedReferenceWithType'
    ActiveDirectoryPost_2:
      allOf:
      - $ref: '#/components/schemas/ActiveDirectoryDirectoryServers'
      - type: object
        required:
        - domain
        - password
        - user
        properties:
          computer_name:
            description: 'The common name of the computer account to be created in the Active Directory

              domain.

              If not specified, defaults to the name of the Active Directory

              configuration.

              '
            type: string
            example: FLASHBLADE01
          directory_servers:
            description: 'A list of directory servers that will be used for lookups related to user authorization.

              Accepted server formats are IP address and DNS name.

              All specified servers must be registered to the domain appropriately in the array''s

              configured DNS and will only be communicated with over the secure LDAP (LDAPS) protocol.

              If not specified, servers are resolved for the domain in DNS.

              The specified list can have a maximum length of 5.

              '
            type: array
            maxItems: 5
            items:
              type: string
              example: ldap.my-corporation.com
          domain:
            description: The Active Directory domain to join.
            type: string
            example: my-corporation.com
          encryption_types:
            description: 'The encryption types that will be supported for use by clients for Kerberos

              authentication.

              Defaults to `aes256-cts-hmac-sha1-96`.

              Valid values include `aes256-cts-hmac-sha1-96`, `aes128-cts-hmac-sha1-96`, and

              `arcfour-hmac`.

              Cannot be provided if using an existing machine account.

              '
            type: array
            items:
              type: string
              example: aes256-cts-hmac-sha1-96
          fqdns:
            description: 'A list of fully qualified domain names to use to register service principal

              names for the machine account. If specified, every service principal that

              is supported by the array will be registered for each fully qualified domain

              name specified. If neither `fqdns` nor `service_principal_names` is specified,

              the default `service_principal_names` are constructed using

              the `computer_name` and `domain` fields.

              Cannot be provided in combination with `service_principal_names`.

              Cannot be provided if using an existing machine account.

              '
            type: array
            maxItems: 32
            items:
              type: string
              example: vip1.my-array.my-corporation.com
          join_ou:
            description: 'The relative distinguished name of the organizational unit in which the

              computer account should be created when joining the domain.

              Cannot be provided if using an existing machine account.

              If not specified, defaults to `CN=Computers`.

              '
            type: string
            example: CN=Computers
          kerberos_servers:
            description: 'A list of key distribution servers to use for Kerberos protocol.

              Accepted server formats are IP address and DNS name.

              All specified servers must be registered to the domain appropriately in the array''s

              configured DNS.

              If not specified, servers are resolved for the domain in DNS.

              The specified list can have a maximum length of 5.

              '
            type: array
            maxItems: 5
            items:
              type: string
              example: kdc.my-corporation.com
          password:
            description: 'The login password of the user with privileges to create the computer account

              in the domain. If using an existing computer account, the user must have privileges to

              read attributes from the computer account and reset the password on that account.

              This is not persisted on the array.

              '
            type: string
            example: Anything#but$adMinistrat0r
          service_principal_names:
            description: 'A list of service principal names to register for the machine account,

              which can be used for the creation of keys for Kerberos authentication.

              If neither `service_principal_names` nor `fqdns` is specified,

              the default `service_principal_names` are constructed using

              the `computer_name` and `domain` fields.

              Cannot be provided in combination with `fqdns`.

              Cannot be provided if using an existing machine account.

              '
            type: array
            maxItems: 32
            items:
              pattern: (service)/(fqdn)
              type: string
              example: nfs/vip1.my-array.my-corporation.com
          user:
            description: 'The login name of the user with privileges to create the computer account in

              the domain. If using an existing computer account, the user must have privileges to

              read attributes from the computer account and reset the password on that account.

              This is not persisted on the array.

              '
            type: string
            example: Administrator
    TestResultWithResource:
      allOf:
      - $ref: '#/components/schemas/TestResult'
      - $ref: '#/components/schemas/_context'
      - type: object
        properties:
          resource:
            description: A reference to the object being tested.
            title: FixedReferenceNoId
            allOf:
            - $ref: '#/components/schemas/_fixedReferenceNoId'
    _errorContextResponse_2:
      type: object
      properties:
        errors:
          description: The list of errors encountered when attempting to perform an operation.
          type: array
          readOnly: true
          items:
            $ref: '#/components/schemas/_errorContextResponseErrors'
    ActiveDirectoryPatch:
      type: object
      properties:
        sources:
          description: 'List of network interfaces used for egress. For directory services

            at the array level, the list can be empty.

            If the list is empty, the system will use VIFs with the "ds" service

            (or if none, the "management" service) for egress.

            '
          type: array
          items:
            $ref: '#/components/schemas/_reference'
        tls:
          description: 'TLS mode for communication with domain controllers.

            Valid values are `required` and `optional`.

            `required` forces TLS communication with domain controller.

            `optional` allows the use of non-TLS communication,

            TLS will still be preferred, if available.

            If not specified, defaults to `required`.

            '
          type: string
          example: required
    _referenceWithType:
      allOf:
      - $ref: '#/components/schemas/_reference'
      - type: object
        properties:
          resource_type:
            description: 'Type of the object (full name of the endpoint).

              Valid values are `hosts`, `host-groups`, `network-interfaces`, `pods`,

              `ports`, `pod-replica-links`, `subnets`, `volumes`, `volume-snapshots`,

              `volume-groups`, `directories`, `policies/nfs`, `policies/smb`, and

              `policies/snapshot`, etc.

              '
            type: string
      x-aliases:
      - _reference
    _fixedReferenceWithoutType:
      type: object
      properties:
        id:
          description: 'A globally unique, system-generated ID.

            The ID cannot be modified.

            '
          type: string
          readOnly: true
        name:
          description: 'The resource name, such as volume name, file system name,

            snapshot name, and so on.

            '
          type: string
          readOnly: true
      x-readOnly: true
    ActiveDirectoryPost:
      type: object
      properties:
        computer_name:
          description: 'The name of the computer account to be created in the Active Directory

            domain.

            If not specified, defaults to the name of the Active Directory

            configuration.

            '
          type: string
          example: FLASHARRAY01
        directory_servers:
          description: 'A list of directory servers used for lookups related to user authorization.

            Servers must be specified in FQDN format.

            All specified servers must be registered to the domain appropriately in the configured DNS

            of the array and are only communicated with over the secure LDAP (LDAPS) protocol.

            If not specified, servers are resolved for the domain in DNS.

            '
          type: array
          items:
            type: string
            example: ldap.my-corporation.com
        domain:
          description: The Active Directory domain to join.
          type: string
          example: my-corporation.com
        join_ou:
          description: 'The distinguished name of the organizational unit in which the

            computer account should be created when joining the domain.

            The `DC=...` components of the distinguished name can be optionally omitted.

            If not specified, defaults to `CN=Computers`.

            '
          type: string
          example: OU=Dev,OU=Sweden,DC=purestorage,DC=com
        kerberos_servers:
          description: 'A list of key distribution servers to use for Kerberos protocol.

            Servers must be specified in FQDN format.

            All specified servers must be registered to the domain appropriately in the configured DNS

            of the array.

            If not specified, servers are resolved for the domain in DNS.

            '
          type: array
          items:
            type: string
            example: kdc.my-corporation.com
        password:
          description: 'The login password of the user with privileges to create the computer account

            in the domain.

            This is not persisted on the array.

            '
          type: string
          example: password
        sources:
          description: 'List of network interfaces used for egress. For directory services

            at the array level, this list can be empty. If

            the list is empty, the system will use VIFs with the "ds" service

            (or if none, the "management" service) for egress.

            '
          type: array
          items:
            $ref: '#/components/schemas/_reference'
        tls:
          description: 'TLS mode for communication with domain controllers.

            Valid values are `required` and `optional`.

            `required` forces TLS communication with a domain controller.

            `optional` allows the use of non-TLS communication,

            TLS will still be preferred, if available.

            If not specified, defaults to `required`.

            '
          type: string
          example: required
        user:
          description: 'The login name of the user with privileges to create the computer account in

            the domain.

            This is not persisted on the array.

            '
          type: string
          example: Administrator
    _context_2:
      type: object
      properties:
        context:
          description: 'The context in which the operation was performed.


            Valid values include a reference to any array which is a member of the same fleet

            or to the fleet itself.


            Other parameters provided with the request, such as names of volumes or snapshots,

            are resolved relative to the provided `context`.

            '
          readOnly: true
          title: FixedReference
          allOf:
          - $ref: '#/components/schemas/_fixedReference_2'
    _realmsReference:
      type: object
      properties:
        realms:
          description: 'Reference to the realms this resource belongs to.

            The value is set to empty array when the resource

            lives outside of a realm.

            '
          type: array
          readOnly: true
          items:
            $ref: '#/components/schemas/_fixedReference_2'
    ActiveDirectoryDirectoryServers:
      type: object
      properties:
        directory_servers:
          description: 'A list of directory servers that will be used for lookups related to user authorization.

            Accepted server formats are IP address and DNS name with optional @domain suffix.

            If the suffix is ommited, the joined domain is assumed.

            All specified servers must be registered to the domain appropriately in the array''s

            configured DNS and will only be communicated with over the secure LDAP (LDAPS) protocol.

            The specified list can have a maximum length of 50.

            '
          type: array
          maxItems: 50
          items:
            type: string
            example: ldap.my-corporation.com
        global_catalog_servers:
          description: 'A list of global catalog servers that will be used for lookups related to user authorization.

            Accepted server formats are IP address and DNS name with optional @domain suffix.

            If the suffix is ommited, the joined domain is assumed.

            All specified servers must be registered to the domain appropriately in the array''s

            configured DNS and will only be communicated with over the secure LDAP (LDAPS) protocol.

            The specified list can have a maximum length of 50.

            '
          type: array
          maxItems: 50
          items:
            type: string
            example: gc.my-corporation.com
    ActiveDirectoryResponse_2:
      type: object
      properties:
        items:
          description: A list of Active Directory computer account configuration objects.
          type: array
          items:
            $ref: '#/components/schemas/ActiveDirectory_2'
    _reference:
      type: object
      properties:
        id:
          description: 'A globally unique, system-generated ID.

            The ID cannot be modified.

            '
          type: string
        name:
          description: 'The resource name, such as volume name, pod name,

            snapshot name, and so on.

            '
          type: string
      x-aliases:
      - _referenceWithoutType
    ActiveDirectory_2:
      allOf:
      - $ref: '#/components/schemas/_builtIn'
      - $ref: '#/components/schemas/_realmsReference'
      - type: object
        properties:
          computer_name:
            description: 'The common name of the computer account to be created in the Active Directory

              domain.

              If not specified, defaults to the name of the Active Directory

              configuration.

              '
            type: string
            example: FLASHBLADE01
          directory_servers:
            description: 'A list of directory servers that will be used for lookups related to user authorization.

              Accepted server formats are IP address and DNS name with optional @domain suffix.

              If the suffix is ommited, the joined domain is assumed.

              All specified servers must be registered to the domain appropriately in the array''s

              configured DNS and will only be communicated with over the secure LDAP (LDAPS) protocol.

              '
            type: array
            items:
              type: string
              example: ldap.my-corporation.com
          domain:
            description: The Active Directory domain to join.
            type: string
            example: my-corporation.com
          encryption_types:
            description: 'The encryption types that are supported for use by clients for Kerberos

              authentication.

              '
            type: array
            items:
              type: string
              example: aes256-cts-hmac-sha1-96
          global_catalog_servers:
            description: 'A list of global catalog servers that will be used

              for lookups related to user authorization.

              Accepted server formats are IP address and DNS name with optional @domain suffix.

              If the suffix is ommited, the joined domain is assumed.

              All specified servers must be registered to the domain appropriately in the array''s

              configured DNS and will only be communicated with over the secure LDAP (LDAPS) protocol.

              '
            type: array
            items:
              type: string
              example: gc.my-corporation.com
          join_ou:
            description: 'The relative distinguished name of the organizational unit in which the

              computer account was created when joining the domain.

              '
            type: string
            example: CN=Computers
          kerberos_servers:
            description: 'A list of key distribution servers to use for Kerberos protocol.

              Accepted server formats are IP address and DNS name.

              All specified servers must be registered to the domain appropriately in the array''s

              configured DNS.

              '
            type: array
            items:
              type: string
              example: krb-host.my-corporation.com
          server:
            description: 'The server containing this active directory account.

              '
            title: FixedReference
            allOf:
            - $ref: '#/components/schemas/_fixedReference_2'
          service_principal_names:
            description: 'A list of service principal names registered for the machine account,

              which can be used for the creation of keys for Kerberos authentication.

              '
            type: array
            items:
              pattern: (service)/(fqdn)
              type: string
              example: nfs/vip1.my-array.my-corporation.com
    TestResult:
      type: object
      properties:
        component_address:
          description: Address of the component running the test.
          type: string
          example: 10.230.94.21
        component_name:
          description: Name of the component running the test.
          type: string
          example: CT0
        description:
          description: What the test is doing.
          type: string
          example: Testing phonehome connectivity
        destination:
          description: The URI of the target server being tested.
          type: string
          example: ra.cloud-support.purestorage.com
        enabled:
          description: 'Whether the object being tested is enabled or not.

            Returns a value of `true` if the the service is enabled.

            Returns a value of `false` if the service is disabled.

            '
          type: boolean
          example: true
        result_details:
          description: Additional information about the test result.
          type: string
          example: Timeout connecting to phonehome endpoint
        success:
          description: 'Whether the object being tested passed the test or not.

            Returns a value of `true` if the specified test has succeeded.

            Returns a value of `false` if the specified test has failed.

            '
          type: boolean
        test_type:
          description: 'Displays the type of test being performed. The returned values are determined

            by the `resource` being tested and its configuration.

            Values include `array-admin-group-searching`, `binding`, `connecting`, `phonehome`,

            `phonehome-ping`, `remote-assist`, `rootdse-searching`, `read-only-g

# --- truncated at 32 KB (58 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/pure-storage/refs/heads/main/openapi/pure-storage-active-directory-api-openapi.yml