openapi: 3.0.1
info:
title: FlashArray REST Active Directory Policies - TLS API
version: '2.52'
description: 'Active Directory configuration authenticates users for NFS using Kerberos or SMB using Kerberos
or New Technology LAN Manager (NTLM). Active Directory is also used to authorize users by
mapping identities across the NFS and SMB protocols by using LDAP queries.
'
servers:
- url: /
tags:
- name: Policies - TLS
description: A TLS policy manages the allowed TLS versions and ciphers for incoming network traffic to the system. These policies can be applied at the array level, or to individual network IPs.
paths:
/api/2.26/network-interfaces/tls-policies:
get:
tags:
- Policies - TLS
summary: Pure Storage GET Network-interfaces/tls-policies
description: List network interface TLS policies.
parameters:
- $ref: '#/components/parameters/XRequestId'
- $ref: '#/components/parameters/Continuation_token'
- $ref: '#/components/parameters/Filter'
- $ref: '#/components/parameters/Limit'
- $ref: '#/components/parameters/Member_ids'
- $ref: '#/components/parameters/Member_names'
- $ref: '#/components/parameters/Offset'
- $ref: '#/components/parameters/Policy_ids'
- $ref: '#/components/parameters/Policy_names'
- $ref: '#/components/parameters/Sort'
responses:
'200':
description: OK
headers:
X-Request-ID:
description: Supplied by client during request or generated by server.
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/PolicyMemberGetResponse'
post:
tags:
- Policies - TLS
summary: Pure Storage POST Network-interfaces/tls-policies
description: Apply a TLS policy to a specific network interface. A given network interface may only have 1 TLS policy applied to it at any given time.
parameters:
- $ref: '#/components/parameters/XRequestId'
- $ref: '#/components/parameters/Member_ids'
- $ref: '#/components/parameters/Member_names'
- $ref: '#/components/parameters/Policy_ids'
- $ref: '#/components/parameters/Policy_names'
responses:
'200':
description: OK
headers:
X-Request-ID:
description: Supplied by client during request or generated by server.
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/PolicyMemberResponse'
delete:
tags:
- Policies - TLS
summary: Pure Storage DELETE Network-interfaces/tls-policies
description: Remove a TLS policy from a network interface.
parameters:
- $ref: '#/components/parameters/XRequestId'
- $ref: '#/components/parameters/Member_ids'
- $ref: '#/components/parameters/Member_names'
- $ref: '#/components/parameters/Policy_ids'
- $ref: '#/components/parameters/Policy_names'
responses:
'200':
description: OK
headers:
X-Request-ID:
description: Supplied by client during request or generated by server.
schema:
type: string
content: {}
/api/2.26/tls-policies:
get:
tags:
- Policies - TLS
summary: Pure Storage List TLS Policies
description: List TLS policies
parameters:
- $ref: '#/components/parameters/XRequestId'
- $ref: '#/components/parameters/Continuation_token'
- $ref: '#/components/parameters/Effective_tls_policy'
- $ref: '#/components/parameters/Filter'
- $ref: '#/components/parameters/Ids'
- $ref: '#/components/parameters/Limit'
- $ref: '#/components/parameters/Names'
- $ref: '#/components/parameters/Offset'
- $ref: '#/components/parameters/Purity_defined'
- $ref: '#/components/parameters/Sort'
responses:
'200':
description: OK
headers:
X-Request-ID:
description: Supplied by client during request or generated by server.
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/TlsPolicyGetResponse'
post:
tags:
- Policies - TLS
summary: Pure Storage Create TLS Policies
description: Creates TLS policies.
parameters:
- $ref: '#/components/parameters/XRequestId'
- $ref: '#/components/parameters/Names_required'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/TlsPolicyPost'
required: true
x-codegen-request-body-name: policy
responses:
'200':
description: OK
headers:
X-Request-ID:
description: Supplied by client during request or generated by server.
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/TlsPolicyResponse'
x-codegen-request-body-name: policy
delete:
tags:
- Policies - TLS
summary: Pure Storage Delete TLS Policies
description: Deletes TLS policies.
parameters:
- $ref: '#/components/parameters/XRequestId'
- $ref: '#/components/parameters/Ids'
- $ref: '#/components/parameters/Names'
responses:
'200':
description: OK
headers:
X-Request-ID:
description: Supplied by client during request or generated by server.
schema:
type: string
content: {}
patch:
tags:
- Policies - TLS
summary: Pure Storage Modify TLS Policies
description: Modifies one or more attributes of TLS policies.
parameters:
- $ref: '#/components/parameters/XRequestId'
- $ref: '#/components/parameters/Ids'
- $ref: '#/components/parameters/Names'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/TlsPolicy'
required: true
x-codegen-request-body-name: policy
responses:
'200':
description: OK
headers:
X-Request-ID:
description: Supplied by client during request or generated by server.
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/TlsPolicyResponse'
x-codegen-request-body-name: policy
/api/2.26/tls-policies/members:
get:
tags:
- Policies - TLS
summary: Pure Storage GET Tls-policies/members
description: List TLS policies mapped to the array as a whole, or to one or more specific objects on the array (such as network interfaces).
parameters:
- $ref: '#/components/parameters/XRequestId'
- $ref: '#/components/parameters/Continuation_token'
- $ref: '#/components/parameters/Filter'
- $ref: '#/components/parameters/Limit'
- $ref: '#/components/parameters/Member_ids'
- $ref: '#/components/parameters/Member_names'
- $ref: '#/components/parameters/Offset'
- $ref: '#/components/parameters/Policy_ids'
- $ref: '#/components/parameters/Policy_names'
- $ref: '#/components/parameters/Sort'
responses:
'200':
description: OK
headers:
X-Request-ID:
description: Supplied by client during request or generated by server.
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/PolicyMemberGetResponse'
/api/2.26/tls-policies/network-interfaces:
get:
tags:
- Policies - TLS
summary: Pure Storage GET Tls-policies/network-interfaces
description: List network interface TLS policies.
parameters:
- $ref: '#/components/parameters/XRequestId'
- $ref: '#/components/parameters/Continuation_token'
- $ref: '#/components/parameters/Filter'
- $ref: '#/components/parameters/Limit'
- $ref: '#/components/parameters/Member_ids'
- $ref: '#/components/parameters/Member_names'
- $ref: '#/components/parameters/Offset'
- $ref: '#/components/parameters/Policy_ids'
- $ref: '#/components/parameters/Policy_names'
- $ref: '#/components/parameters/Sort'
responses:
'200':
description: OK
headers:
X-Request-ID:
description: Supplied by client during request or generated by server.
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/PolicyMemberGetResponse'
post:
tags:
- Policies - TLS
summary: Pure Storage POST Tls-policies/network-interfaces
description: Apply a TLS policy to a specific network interface. A given network interface may only have 1 TLS policy applied to it at any given time.
parameters:
- $ref: '#/components/parameters/XRequestId'
- $ref: '#/components/parameters/Member_ids'
- $ref: '#/components/parameters/Member_names'
- $ref: '#/components/parameters/Policy_ids'
- $ref: '#/components/parameters/Policy_names'
responses:
'200':
description: OK
headers:
X-Request-ID:
description: Supplied by client during request or generated by server.
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/PolicyMemberResponse'
delete:
tags:
- Policies - TLS
summary: Pure Storage DELETE Tls-policies/network-interfaces
description: Remove a TLS policy from a network interface.
parameters:
- $ref: '#/components/parameters/XRequestId'
- $ref: '#/components/parameters/Member_ids'
- $ref: '#/components/parameters/Member_names'
- $ref: '#/components/parameters/Policy_ids'
- $ref: '#/components/parameters/Policy_names'
responses:
'200':
description: OK
headers:
X-Request-ID:
description: Supplied by client during request or generated by server.
schema:
type: string
content: {}
components:
schemas:
TlsPolicy:
allOf:
- $ref: '#/components/schemas/TlsPolicyPost'
- $ref: '#/components/schemas/PolicyBaseRenameable'
_referenceWithoutType:
type: object
properties:
id:
description: 'A globally unique, system-generated ID.
The ID cannot be modified.
'
type: string
name:
description: 'The resource name, such as volume name, pod name,
snapshot name, and so on.
'
type: string
PolicyBase:
allOf:
- $ref: '#/components/schemas/PolicyBaseRenameable'
_resource:
description: 'An ordinary (as opposed to built-in) resource that can be created, named,
renamed or deleted by the user. This might be a virtual resource (e.g., a
file system), or correspond to something in the environment, like a host or a
server.
'
type: object
properties:
id:
description: 'A globally unique, system-generated ID.
The ID cannot be modified and cannot refer to another resource.
'
type: string
readOnly: true
name:
description: 'A user-specified name.
The name must be locally unique and can be changed.
'
type: string
_fixedReferenceWithoutType:
type: object
properties:
id:
description: 'A globally unique, system-generated ID.
The ID cannot be modified.
'
type: string
readOnly: true
name:
description: 'The resource name, such as volume name, file system name,
snapshot name, and so on.
'
type: string
readOnly: true
x-readOnly: true
_referenceWritable:
allOf:
- $ref: '#/components/schemas/_referenceWithoutType'
- type: object
properties:
resource_type:
description: 'Type of the object (full name of the endpoint).
Valid values are `hosts`, `host-groups`, `network-interfaces`, `pods`,
`ports`, `pod-replica-links`, `subnets`, `volumes`, `volume-snapshots`,
`volume-groups`, `directories`, `policies/nfs`, `policies/smb`, `policies/snapshot`, etc.
'
type: string
x-aliases:
- _reference
TlsPolicyResponse:
type: object
properties:
items:
description: A list of TLS policy objects.
type: array
items:
$ref: '#/components/schemas/TlsPolicy'
TlsPolicyPost:
allOf:
- $ref: '#/components/schemas/PolicyBase'
- type: object
properties:
appliance_certificate:
description: 'A reference to a certificate that will be presented as the server certificate
in TLS negotiations with any clients that connect to appliance network addresses
to which this policy applies.
'
title: ReferenceWritable
allOf:
- $ref: '#/components/schemas/_referenceWritable'
client_certificates_required:
description: 'If `true`, then all clients negotiating TLS connections with network
interfaces to which this policy applies will be required to provide
their client certificates during TLS negotiation. Any client''s failure
to provide a certificate will cause the TLS negotiation to be
rejected.
If `false`, then providing a client certificate in TLS negotiation is
not mandatory, and TLS negotiation can succeed when none is provided.
If not specified, defaults to `false`.
'
type: boolean
disabled_tls_ciphers:
description: 'If specified, disables the specific TLS ciphers. If all TLS ciphers
that are available for a specific TLS version on the system are disabled, then client
access over that TLS version is not possible. As such, disabled ciphers must still
result in at least one cipher being available for each enabled TLS version.
Changes to this setting can disrupt traffic for any clients relying on disabled
ciphers.
'
type: array
maxItems: 16
items:
maxLength: 128
type: string
description: 'A specific TLS cipher or TLS cipher component to disable, in openssl format.
For example, `AES128` would disable all TLS ciphers that utilize the `AES128`
algorithm for encryption, while `ECDHE-ECDSA-AES256-CCM` would disable
that specific cipher.
'
enabled_tls_ciphers:
description: 'If specified, enables only the specified TLS ciphers. If all TLS ciphers
that are available for a specific TLS version on the system are disabled, then client
access over that TLS version is not possible. As such, the enabled ciphers must always
contain at least one cipher for each enabled TLS version.
Changes to this setting can disrupt traffic for any clients relying on ciphers that
are removed. If set to `default`, then the enabled ciphers may be automatically adjusted
upon upgrade to newer software in order to align with the best known practices at the
time of software release.
'
type: array
maxItems: 16
items:
maxLength: 128
type: string
description: 'A specific TLS cipher or TLS cipher component to enable, in openssl format.
For example, `AES128` would enable all strong TLS ciphers that utilize the `AES128`
algorithm for encryption, while `AES128-SHA` would enable that specific cipher.
'
min_tls_version:
description: 'The minimum TLS version that will be allowed for inbound connections on IPs to
which this policy applies. Changing this setting can disrupt connections for
any clients relying on older TLS versions that are disabled.
If set to `default`, then the lowest TLS version permitted may be automatically
raised upon upgrade to newer software in order to align with the best known
practices at the time of software release.
Configuring an explicit, low value can prevent upgrades to newer software
versions that no longer support older TLS versions.
Valid values include `default`, `TLSv1.1`, `TLSv1.0`, `TLSv1.2`,
and `TLSv1.3`.
'
type: string
trusted_client_certificate_authority:
description: 'A reference to a certificate or certificate group.
The certificate referenced, or the certificates in the referenced group,
will be used to verify the certificates presented by clients when
`verify_client_certificate_trust` is `true`.
'
title: ReferenceWritable
allOf:
- $ref: '#/components/schemas/_referenceWritable'
verify_client_certificate_trust:
description: 'If `true`, then any certificate presented by a client in TLS negotiation
will undergo strict trust verification using the certificate(s) referenced
by `trusted_client_certificate_authority`.
If `false`, then certificates presented by clients in TLS negotiation
will only be checked to ensure they''re properly constructed and non-expired,
and the certificates specified by `trusted_client_certificate_authority` will
not be used. Details of client certificates may still be recorded for certain
audit purposes, even if they do not undergo trust verification.
If `client_certificates_required` is `false`, and no client certificate is
provided during TLS negotiation, then no trust verification will be performed;
if a client chooses to provide a certificate, even when not required, and
this field is `true`, then the certificate will undergo trust verification.
If not specified, defaults to `false`.
'
type: boolean
PolicyMemberResponse:
type: object
properties:
items:
description: A list of members for policies.
type: array
items:
$ref: '#/components/schemas/PolicyMember'
PolicyMemberGetResponse:
allOf:
- $ref: '#/components/schemas/PageInfo'
- $ref: '#/components/schemas/PolicyMemberResponse'
PolicyBaseRenameable:
allOf:
- $ref: '#/components/schemas/_resource'
- $ref: '#/components/schemas/_realmsReference'
- type: object
properties:
enabled:
description: 'If `true`, the policy is enabled. If not specified, defaults to `true`.
'
type: boolean
is_local:
description: Whether the policy is defined on the local array.
type: boolean
readOnly: true
location:
description: Reference to the array where the policy is defined.
title: FixedReference
allOf:
- $ref: '#/components/schemas/_fixedReference'
policy_type:
description: 'Type of the policy. Valid values include `alert`, `audit`, `bucket-access`,
`cross-origin-resource-sharing`, `network-access`, `nfs`, `object-access`,
`s3-export`, smb-client`, `smb-share`, `ssh-certificate-authority`, and
`telemetry-metrics`.
'
type: string
readOnly: true
TlsPolicyGetResponse:
allOf:
- $ref: '#/components/schemas/PageInfo'
- $ref: '#/components/schemas/TlsPolicyResponse'
_realmsReference:
type: object
properties:
realms:
description: 'Reference to the realms this resource belongs to.
The value is set to empty array when the resource
lives outside of a realm.
'
type: array
readOnly: true
items:
$ref: '#/components/schemas/_fixedReference'
_fixedReference:
allOf:
- $ref: '#/components/schemas/_fixedReferenceWithoutType'
- type: object
properties:
resource_type:
description: 'Type of the object (full name of the endpoint).
Valid values are the unique part of the resource''s REST endpoint.
For example, a reference to a file system would have a
`resource_type` of `file-systems`.
'
type: string
readOnly: true
PageInfo:
type: object
properties:
continuation_token:
description: 'Continuation token that can be provided in the `continuation_token` query
param to get the next page of data.
If you use the `continuation_token` to page through data you
are guaranteed to get all items exactly once regardless of
how items are modified. If an item is added or deleted during
the pagination then it may or may not be returned.
The `continuation_token` is generated if the `limit` is less
than the remaining number of items, and the default sort is used
(no sort is specified).
'
type: string
total_item_count:
description: Total number of items after applying `filter` params.
type: integer
format: int32
PolicyMember:
type: object
properties:
member:
description: Reference to the resource the policy is applied to.
title: FixedReference
allOf:
- $ref: '#/components/schemas/_fixedReference'
policy:
description: Reference to the policy.
title: FixedReference
allOf:
- $ref: '#/components/schemas/_fixedReference'
parameters:
Offset:
name: offset
in: query
description: 'The offset of the first resource to return from a collection.
'
schema:
type: integer
format: int32
minimum: 0
example: 10
Filter:
name: filter
in: query
description: 'Narrows down the results to only the response objects
that satisfy the filter criteria.
'
schema:
type: string
Purity_defined:
name: purity_defined
in: query
description: 'If `true`, then the results returned will be include the specification
for purity-defined values on the current purity version. These values
may be used in configurations in order to dynamically adopt new behavior
across upgrades, and this option allows the exact behavior for the current
version to be returned.
Defaults to `false`.
'
schema:
type: boolean
Policy_ids:
name: policy_ids
in: query
description: 'A comma-separated list of policy IDs.
If after filtering, there is not at least one resource that matches
each of the elements of `policy_ids`, then an error is returned.
This cannot be provided together with the `policy_names` query parameter.
'
style: form
explode: false
schema:
type: array
items:
type: string
Continuation_token:
name: continuation_token
in: query
description: 'A token used to retrieve the next page of data
with some consistency guaranteed.
The token is a Base64 encoded value.
Set `continuation_token` to the system-generated token taken from the `x-next-token`
header field of the response.
A query has reached its last page when the response does not include a token.
Pagination requires the `limit` and `continuation_token`
query parameters.
'
schema:
type: string
Policy_names:
name: policy_names
in: query
description: 'A comma-separated list of policy names.
'
style: form
explode: false
schema:
type: array
items:
type: string
XRequestId:
name: X-Request-ID
in: header
description: 'Supplied by client during request or generated by server.
'
schema:
type: string
Limit:
name: limit
in: query
description: 'Limits the size of the response to the specified number of objects on each page.
To return the total number of resources, set `limit=0`.
The total number of resources is returned as a `total_item_count` value.
If the page size requested is larger than the system maximum limit,
the server returns the maximum limit, disregarding the requested page size.
'
schema:
type: integer
format: int32
minimum: 0
example: 10
Names:
name: names
in: query
description: 'Performs the operation on the unique names specified.
Enter multiple names in comma-separated format.
For example, `name01,name02`.
If there is not at least one resource that matches
each of the elements of `names`, then an error is returned,
except when creating new resources.
'
style: form
explode: false
schema:
type: array
items:
type: string
Effective_tls_policy:
name: effective
in: query
description: 'If `true`, then the TLS policies returned will be fully evaluated. This
involves expanding shortened TLS ciphers, removing disabled TLS ciphers from
the list of expanded enabled TLS ciphers, and converting values such as
`default` and `legacy` into concrete values, in order to return the discrete
effective TLS settings that the policies encode.
Defaults to `false`.
'
schema:
type: boolean
Member_ids:
name: member_ids
in: query
description: 'A comma-separated list of member IDs.
If after filtering, there is not at least one resource that matches
each of the elements of `member_ids`, then an error is returned.
This cannot be provided together with the `member_names` query parameter.
'
style: form
explode: false
schema:
type: array
items:
type: string
Member_names:
name: member_names
in: query
description: 'A comma-separated list of member names.
'
style: form
explode: false
schema:
type: array
items:
type: string
Ids:
name: ids
in: query
description: 'A comma-separated list of resource IDs.
If after filtering, there is not at least one resource that matches
each of the elements of `ids`, then an error is returned.
This cannot be provided together with the `name` or `names` query parameters.
'
style: form
explode: false
schema:
type: array
items:
type: string
Sort:
name: sort
in: query
description: 'Sort the response by the specified fields (in descending order if ''-''
is appended to the field name).
NOTE: If you provide a sort you will not get a `continuation_token` in
the response.
'
style: form
explode: false
schema:
type: array
items:
pattern: ^[a-z]+(_[a-z]+)*-?
type: string
Names_required:
name: names
in: query
description: 'A comma-separated list of resource names.
'
required: true
style: form
explode: false
schema:
type: array
items:
type: string