NVIDIA Run:ai Idps API

openapi: 3.0.3
info:
  version: latest
  description: '# Introduction


    The NVIDIA Run:ai Control-Plane API reference is a guide that provides an easy-to-use programming interface for adding various tasks to your application, including workload submission, resource management, and administrative operations.


    NVIDIA Run:ai APIs are accessed using *bearer tokens*. To obtain a token, you need to create a **Service account** through the NVIDIA Run:ai user interface.

    To create a service account, in your UI, go to Access → Service Accounts (for organization-level service accounts) or User settings → Access Keys (for user access keys), and create a new one.


    After you have created a new service account, you will need to assign it access rules.

    To assign access rules to the service account, see [Create access rules](https://run-ai-docs.nvidia.com/saas/infrastructure-setup/authentication/accessrules#create-or-delete-rules).

    Make sure you assign the correct rules to your service account. Use the [Roles](https://run-ai-docs.nvidia.com/saas/infrastructure-setup/authentication/roles) to assign the correct access rules.


    To get your access token, follow the instructions in [Request a token](https://run-ai-docs.nvidia.com/saas/reference/api/rest-auth/#request-an-api-token).

    '
  title: NVIDIA Run:ai Access Keys Idps API
  x-logo:
    url: https://api.redocly.com/registry/raw/runai-xq8/saas/latest/public/runai-logo-api.png
    altText: NVIDIA Run:ai
    href: https://run.ai
  license:
    name: NVIDIA Run:ai
    url: https://www.nvidia.com/en-us/agreements/enterprise-software/nvidia-software-license-agreement/
servers:
- url: https://app.run.ai
security:
- bearerAuth: []
tags:
- name: Idps
paths:
  /api/v1/idps:
    get:
      summary: Get external idps list
      operationId: get_idps
      tags:
      - Idps
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Idps'
              examples:
                saml:
                  value:
                  - alias: saml
                    type: saml
                    redirectUri: https://domain/auth/realms/name/broker/saml/endpoint
                    samlData:
                      signingCertificate: signingCertificateExample
                      singleSignOnServiceUrl: https://authhost/protocol/saml
                      entityId: example.run.ai/runai
                      serviceProviderMetadataUrl: https://example.runai.com/auth/realms/runai/broker/saml/endpoint/descriptor
                    mappers:
                      gid: GID
                      groups: GROUPS
                      supplementaryGroups: SUPPLEMENTARYGROUPS
                      uid: UID
                      email: email
                oidc:
                  value:
                  - alias: oidc
                    type: oidc
                    redirectUri: https://domain/auth/realms/name/broker/oidc/endpoint
                    oidcData:
                      clientId: my-client-id
                      clientSecret: '*******'
                      scopes:
                      - scope1
                      - scope2
                      mandatoryClaim:
                        claim: my-claim
                        values:
                        - val1
                        - val2
                    mappers:
                      gid: GID
                      groups: GROUPS
                      supplementaryGroups: SUPPLEMENTARYGROUPS
                      uid: UID
                      email: email
                openshift-v4:
                  value:
                  - alias: openshift-v4
                    type: openshift-v4
                    redirectUri: https://domain/auth/realms/name/broker/openshift-v4/endpoint
                    ocpData:
                      clientId: my-client-id
                      clientSecret: '*******'
                      idpBaseUrl: https://authhost/ocp
                      scopes:
                      - scope1
                      - scope2
                    mappers:
                      gid: metadata.gid
                      groups: groups
                      supplementaryGroups: supplementarygroups
                      uid: metadata.uid
                      email: metadata.name
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      summary: Configure external idp
      operationId: create_idp
      tags:
      - Idps
      requestBody:
        description: Idp configuration
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IdpCreationRequest'
            examples:
              saml (by url):
                value:
                  type: saml
                  samlData:
                    metadataXmlType: url
                    metadataXmlUrl: https://authhost/saml/metadata.xml
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              saml (by file):
                value:
                  type: saml
                  samlData:
                    metadataXmlType: file
                    fileName: descriptor.xml
                    metadataXmlFile: <file content in base64>
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              oidc:
                value:
                  type: oidc
                  oidcData:
                    clientId: my-client-id
                    clientSecret: my-client-secret
                    discoverDocumentUrl: https://authhost/openid-configuration
                    mandatoryClaim:
                      claim: my-claim
                      values:
                      - val1
                      - val2
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              openshift-v4:
                value:
                  type: openshift-v4
                  ocpData:
                    clientId: my-client-id
                    clientSecret: my-client-secret
                    idpBaseUrl: https://authhost/ocp
                  mappers:
                    gid: metadata.gid
                    groups: groups
                    supplementaryGroups: supplementarygroups
                    uid: metadata.uid
                    email: metadata.name
      responses:
        '201':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdpPostResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '409':
          $ref: '#/components/responses/409Conflict'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/idps/{idp}:
    get:
      summary: Get external idp by alias
      operationId: get_idp
      tags:
      - Idps
      parameters:
      - $ref: '#/components/parameters/idp'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              examples:
                saml:
                  value:
                    alias: saml
                    type: saml
                    redirectUri: https://domain/auth/realms/name/broker/saml/endpoint
                    samlData:
                      signingCertificate: signingCertificateExample
                      singleSignOnServiceUrl: https://authhost/protocol/saml
                      entityId: example.run.ai/runai
                      serviceProviderMetadataUrl: https://example.runai.com/auth/realms/runai/broker/saml/endpoint/descriptor
                    mappers:
                      gid: GID
                      groups: GROUPS
                      supplementaryGroups: SUPPLEMENTARYGROUPS
                      uid: UID
                      email: email
                oidc:
                  value:
                    alias: oidc
                    type: oidc
                    redirectUri: https://domain/auth/realms/name/broker/oidc/endpoint
                    oidcData:
                      clientId: my-client-id
                      clientSecret: '*******'
                      scopes:
                      - scope1
                      - scope2
                      mandatoryClaim:
                        claim: my-claim
                        values:
                        - val1
                        - val2
                    mappers:
                      gid: GID
                      groups: GROUPS
                      supplementaryGroups: SUPPLEMENTARYGROUPS
                      uid: UID
                      email: email
                openshift-v4:
                  value:
                    alias: openshift-v4
                    type: openshift-v4
                    redirectUri: https://domain/auth/realms/name/broker/openshift-v4/endpoint
                    ocpData:
                      clientId: my-client-id
                      clientSecret: '*******'
                      idpBaseUrl: https://authhost/ocp
                      scopes:
                      - scope1
                      - scope2
                    mappers:
                      gid: metadata.gid
                      groups: groups
                      supplementaryGroups: supplementarygroups
                      uid: metadata.uid
                      email: metadata.name
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: Delete external idp by alias
      operationId: delete_idp
      tags:
      - Idps
      parameters:
      - $ref: '#/components/parameters/idp'
      responses:
        '200':
          description: Idp successfully deleted
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    put:
      summary: Update external idp by alias
      operationId: update_idp
      tags:
      - Idps
      parameters:
      - $ref: '#/components/parameters/idp'
      requestBody:
        description: Updated idp object
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IdpCreationRequest'
            examples:
              saml (by url):
                value:
                  type: saml
                  samlData:
                    metadataXmlType: url
                    metadataXmlUrl: https://authhost/saml/metadata.xml
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              saml (by file):
                value:
                  type: saml
                  samlData:
                    metadataXmlType: file
                    fileName: descriptor.xml
                    metadataXmlFile: <file content in base64>
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              oidc:
                value:
                  type: oidc
                  oidcData:
                    clientId: my-client-id
                    clientSecret: my-client-secret
                    discoverDocumentUrl: https://authhost/openid-configuration
                    mandatoryClaim:
                      claim: my-claim
                      values:
                      - val1
                      - val2
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              openshift-v4:
                value:
                  type: openshift-v4
                  ocpData:
                    clientId: my-client-id
                    clientSecret: my-client-secret
                    idpBaseUrl: https://authhost/ocp
                  mappers:
                    gid: metadata.gid
                    groups: groups
                    supplementaryGroups: supplementarygroups
                    uid: metadata.uid
                    email: metadata.name
      responses:
        '200':
          description: Idp successfully updated
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/idps/{idp}/mappers:
    get:
      summary: Get idp mappers
      operationId: get_idp_mappers
      tags:
      - Idps
      parameters:
      - $ref: '#/components/parameters/idp'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Mappers'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    put:
      summary: Update idp mappers
      operationId: update_idp_mappers
      tags:
      - Idps
      parameters:
      - $ref: '#/components/parameters/idp'
      requestBody:
        description: Map of our mappers and their source in the external idp
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Mappers'
      responses:
        '202':
          description: Request accepted successfully.
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
components:
  schemas:
    Idp1:
      type: object
      required:
      - alias
      - type
      - redirectUri
      properties:
        alias:
          type: string
          pattern: ^[a-z0-9_-]+$
        type:
          type: string
          enum:
          - saml
          - oidc
          - openshift-v4
        redirectUri:
          type: string
        samlData:
          $ref: '#/components/schemas/SamlData'
        oidcData:
          $ref: '#/components/schemas/OidcData'
        ocpData:
          $ref: '#/components/schemas/OcpData'
        mappers:
          $ref: '#/components/schemas/Mappers'
    SamlCreationDataMetadataXmlTypeEnum:
      type: string
      enum:
      - url
      - file
    Idps:
      type: array
      items:
        $ref: '#/components/schemas/Idp1'
    Error:
      required:
      - code
      - message
      properties:
        code:
          type: integer
          minimum: 100
          maximum: 599
        message:
          type: string
        details:
          type: string
      example:
        code: 400
        message: Bad request - Resource should have a name
    OidcCreationData:
      type: object
      nullable: true
      required:
      - clientId
      - clientSecret
      - discoverDocumentUrl
      properties:
        clientId:
          type: string
          minLength: 1
        clientSecret:
          type: string
          minLength: 1
        discoverDocumentUrl:
          type: string
          pattern: /^(https?://)?([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(:[0-9]{1,5})?(/[^\s]*)?$|^$/
        scopes:
          type: array
          items:
            type: string
            pattern: ^([a-zA-Z0-9-._:]+)(\s[a-zA-Z0-9-._:]+)*$
        mandatoryClaim:
          $ref: '#/components/schemas/MandatoryClaim'
    OcpData:
      type: object
      nullable: true
      properties:
        idpBaseUrl:
          type: string
        clientId:
          type: string
        clientSecret:
          type: string
        scopes:
          type: array
          items:
            type: string
    OcpCreationData:
      type: object
      nullable: true
      required:
      - idpBaseUrl
      - clientSecret
      properties:
        clientId:
          type: string
          minLength: 1
        idpBaseUrl:
          type: string
          pattern: /^(https?://)?([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(:[0-9]{1,5})?(/[^\s]*)?$|^$/
        clientSecret:
          type: string
          minLength: 1
        scopes:
          type: array
          items:
            type: string
            pattern: ^([a-zA-Z0-9-._:]+)(\s[a-zA-Z0-9-._:]+)*$
    IdpPostResponse:
      type: object
      required:
      - alias
      properties:
        alias:
          type: string
      example:
        alias: oidc
    SamlCreationData:
      type: object
      nullable: true
      properties:
        metadataXmlUrl:
          type: string
          pattern: /^(https?://)?([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(:[0-9]{1,5})?(/[^\s]*)?$|^$/
        metadataXmlFile:
          type: string
        fileName:
          type: string
        metadataXmlType:
          allOf:
          - $ref: '#/components/schemas/SamlCreationDataMetadataXmlTypeEnum'
        entityId:
          type: string
    MandatoryClaim:
      type: object
      nullable: true
      required:
      - claim
      - values
      properties:
        claim:
          type: string
          pattern: .*[a-zA-Z].*
        values:
          type: array
          minItems: 1
          items:
            type: string
            minLength: 1
            pattern: ^(?!.*\s).*?[a-zA-Z].*$
    OidcData:
      type: object
      nullable: true
      required:
      - clientId
      - clientSecret
      - discoverDocumentUrl
      properties:
        clientId:
          type: string
        clientSecret:
          type: string
        scopes:
          type: array
          items:
            type: string
            pattern: ^([a-zA-Z0-9-._:]+)(\s[a-zA-Z0-9-._:]+)*$
        mandatoryClaim:
          $ref: '#/components/schemas/MandatoryClaim'
    Mappers:
      type: object
      required:
      - alias
      properties:
        gid:
          type: string
        uid:
          type: string
        groups:
          type: string
        supplementaryGroups:
          type: string
        email:
          type: string
    SamlData:
      type: object
      nullable: true
      properties:
        signingCertificate:
          type: string
        singleSignOnServiceUrl:
          type: string
        entityId:
          type: string
        serviceProviderMetadataUrl:
          type: string
          description: Service Provider (SP) metadata url
    IdpCreationRequest:
      type: object
      required:
      - type
      - data
      properties:
        name:
          type: string
        type:
          allOf:
          - $ref: '#/components/schemas/IdpCreationRequestTypeEnum'
        samlData:
          $ref: '#/components/schemas/SamlCreationData'
        oidcData:
          $ref: '#/components/schemas/OidcCreationData'
        ocpData:
          $ref: '#/components/schemas/OcpCreationData'
        mappers:
          $ref: '#/components/schemas/Mappers'
    IdpCreationRequestTypeEnum:
      type: string
      enum:
      - oidc
      - saml
      - openshift-v4
  parameters:
    idp:
      name: idp
      in: path
      required: true
      description: The alias of the idp
      schema:
        type: string
  responses:
    404NotFound:
      description: The specified resource was not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 404
            message: Resource id not found.
    500InternalServerError:
      description: unexpected error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 500
            message: Something went wrong.
    403Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 403
            message: You do not have sufficient permissions.
    503ServiceUnavailable:
      description: unexpected error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 503
            message: Please try again in few minutes.
    409Conflict:
      description: The specified resource already exists
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 409
            message: Resource with this name already exists
    401Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 401
            message: Issuer is not familiar.
    400BadRequest:
      description: Bad request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 400
            message: Required parameter is missing
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer authentication
x-tagGroups:
- name: Organizations
  tags:
  - Clusters
  - Departments
  - Reports
  - NodePools
  - Nodes
  - Projects
  - Tenant
  - Logo
  - Researcher Command Line Interface
  - Researcher Command Line Interface Deprecated
  - Administrator Command Line Interface
  - Network Topologies
- name: Authentication and Authorization
  tags:
  - Access Keys
  - Access rules
  - Permissions
  - Applications
  - Service Accounts
  - Roles
  - Tokens
  - Users
  - User Applications
  - Idps
  - Me
  - Settings
  - Org unit
- name: Audit
  tags:
  - AuditLogs
- name: Datavolumes
  tags:
  - Datavolumes
- name: Workloads
  tags:
  - Events
  - Pods
  - Workloads
  - Workloads V2
  - NVIDIA NIM
  - Workspaces
  - Trainings
  - Inferences
  - Revisions
  - Distributed
  - Workloads batch
  - Workload properties
  - Workload templates
  - Distributed Inferences
- name: Workload assets
  tags:
  - Compute
  - Credentials
  - Datasources
  - Environment
  - Storage Classes
  - Storage Class Configuration
  - Git
  - HostPath
  - NFS
  - PVC
  - Registry
  - S3
  - ConfigMap
  - Secret
  - Template
- name: Policies
  tags:
  - Policy
- name: Notifications
  tags:
  - Notification State
  - Notification Types
  - NotificationChannels
  - Subscriptions
- name: AI Applications
  tags:
  - AI Applications