SpecterOps Auth API

openapi: 3.2.0
info:
  title: BloodHound Auth API
  contact:
    name: BloodHound Enterprise Support
    url: https://bloodhound.specterops.io/
    email: support@specterops.io
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
  version: v2
  description: "This is the API that drives BloodHound Enterprise and Community Edition.\nEndpoint availability is denoted using the `Community` and `Enterprise` tags.\n\nContact information listed is for BloodHound Enterprise customers. To get help with\nBloodHound Community Edition, please join our\n[Slack community](https://ghst.ly/BHSlack/).\n\n## Authentication\n\nThe BloodHound API supports two kinds of authentication: JWT bearer tokens and Signed Requests.\nFor quick tests or one-time calls, the JWT used by your browser may be the simplest route. For\nmore secure and long lived API integrations, the recommended option is signed requests.\n\n### JWT Bearer Token\n\nThe API will accept calls using the following header structure in the HTTP request:\n```\nAuthorization: Bearer $JWT_TOKEN\n```\nIf you open the Network tab within your browser, you will see calls against the API made utilizing\nthis structure. JWT bearer tokens are supported by the BloodHound API, however it is recommended\nthey only be used for temporary access. JWT tokens expire after a set amount of time and require\nre-authentication using secret credentials.\n\n### Signed Requests\n\nSigned requests are the recommended form of authentication for the BloodHound API. Not only are\nsigned requests better for long lived integrations, they also provide more security for the\nrequests being sent. They provide authentication of the client, as well as verification of request\nintegrity when received by the server.\n\nSigned requests consist of three main parts: The client token ID, the request timestamp, and a\nbase64 encoded HMAC signature. These three pieces of information are sent with the request using\nthe following header structure:\n\n```\nAuthorization: bhesignature $TOKEN_ID\nRequestDate: $RFC3339_DATETIME\nSignature: $BASE64ENCODED_HMAC_SIGNATURE\n```\n\nTo use signed requests, you will need to generate an API token. Each API token generated in the\nBloodHound API comes with two parts: The Token ID, which is used in the `Authorization` header,\nand the Token Key, which is used as part of the HMAC hashing process. The token ID should be\nconsidered as public (like a username) and the token key should be considered secret (like a\npassword). Once an API token is generated, you can use the key to sign requests.\n\nFor more documentation about how to work with authentication in the API, including examples\nof how to generate an API token in the BloodHound UI, please refer to this support doc:\n[Working with the BloodHound API](https://bloodhound.specterops.io/integrations/bloodhound-api/working-with-api).\n\n#### Signed Request Pseudo-code Example\n\nFirst, a digest is initiated with HMAC-SHA-256 using the token key as the digest key:\n```python\ndigester = hmac.new(sha256, api_token_key)\n```\n\nOperationKey is the first HMAC digest link in the signature chain. This prevents replay attacks that\nseek to modify the request method or URI. It is composed of concatenating the request method and\nthe request URI with no delimiter and computing the HMAC digest using the token key as the digest\nsecret:\n```python\n# Example: GET /api/v2/test/resource HTTP/1.1\n# Signature Component: GET/api/v2/test/resource\ndigester.write(request_method + request_uri)\n\n# Update the digester for further chaining\ndigester = hmac.New(sha256, digester.hash())\n```\n\nDateKey is the next HMAC digest link in the signature chain. This encodes the RFC3339\nformatted datetime value as part of the signature to the hour to prevent replay\nattacks that are older than max two hours. This value is added to the signature chain\nby cutting off all values from the RFC3339 formatted datetime from the hours value\nforward:\n```python\n# Example: 2020-12-01T23:59:60Z\n# Signature Component: 2020-12-01T23\nrequest_datetime = date.now()\ndigester.write(request_datetime[:13])\n\n# Update the digester for further chaining\ndigester = hmac.New(sha256, digester.hash())\n```\n\nBody signing is the last HMAC digest link in the signature chain. This encodes the\nrequest body as part of the signature to prevent replay attacks that seek to modify\nthe payload of a signed request. In the case where there is no body content the\nHMAC digest is computed anyway, simply with no values written to the digester:\n```python\nif request.body is not empty:\n  digester.write(request.body)\n```\n\nFinally, base64 encode the final hash and write the three required headers before\nsending the request:\n```python\nencoded_hash = base64_encode(digester.hash())\nrequest.header.write('Authorization', 'bhesignature ' + token_id)\nrequest.header.write('RequestDate', request_datetime)\nrequest.header.write('Signature', encoded_hash)\n```\n"
servers:
- url: /
  description: This is the base path for all endpoints, relative to the domain where the API is being hosted.
security:
- JWTBearerToken: []
- SignedRequest: []
  RequestDate: []
  HMACSignature: []
tags:
- name: Auth
paths:
  /api/v2/login:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    post:
      operationId: Login
      summary: Login to BloodHound
      description: Login to BloodHound with user credentials or a one time password.
      tags:
      - Auth
      security: []
      requestBody:
        description: 'The request body for logging into the application. `secret` *or* `otp` is required, but not both.

          '
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - login_method
              - username
              properties:
                login_method:
                  description: The type of login. Currently only `secret` is supported.
                  type: string
                  enum:
                  - secret
                username:
                  type: string
                secret:
                  description: The password for the user. This field can be used instead of `otp`.
                  type: string
                otp:
                  description: The One Time Password for a single login. This field can be used instead of `secret`
                  type: string
            example:
              login_method: secret
              username: cool_user@bloodhoundenterprise.io
              secret: MySup3rS3cr3tPassw0rd!!!
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      user_id:
                        type: string
                        format: uuid
                      auth_expired:
                        type: boolean
                      session_token:
                        type: string
                        format: jwt
              example:
                data:
                  user_id: 54623566-213a-4490-9c68-ac44c39b6590
                  auth_expired: false
                  session_token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoiNTQ2MjM1NjYtMjEzYS00NDkwLTljNjgtYWM0NGMzOWI2NTkwIiwidXNlciI6ImNvb2xfdXNlckBibG9vZGhvdW5kZW50ZXJwcmlzZS5pbyIsImlhdCI6MTUxNjIzOTAyMn0.1WWo7XpE9a-v6MQ9tHC8ikxmvmS3PuD7bJyNi4hPr_Y
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/logout:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    post:
      operationId: Logout
      summary: Logout of BloodHound
      description: Logout of BloodHound and delete the user session JWT.
      tags:
      - Auth
      security: []
      responses:
        '200':
          description: '**Success**

            This response will contain no response body.

            '
          content:
            text/plain:
              schema:
                type: string
              example: '[this request has no response data]'
          headers:
            Location:
              description: This is the location you will be redirected to after logging out.
              schema:
                type: string
        '429':
          $ref: '#/components/responses/too-many-requests'
  /api/v2/self:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    get:
      operationId: GetSelf
      summary: Get self
      description: 'Get the currently authenticated requester details. For Community, this will only ever be valid for users. In Enterprise, this could be either a BloodHound user or a client (collector).

        '
      tags:
      - Auth
      security: []
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api.response.authenticated-requester'
        '429':
          $ref: '#/components/responses/too-many-requests'
  /api/v2/saml:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    get:
      operationId: ListSamlProviders
      summary: List SAML Providers
      description: '**Deprecated**: This endpoint will no longer be supported in a future release. Please use `GET /api/v2/sso-providers` instead.

        '
      deprecated: true
      tags:
      - Auth
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      saml_providers:
                        type: array
                        items:
                          $ref: '#/components/schemas/model.saml-provider'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/saml/sso:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    get:
      operationId: GetSamlSignSignOnEndpoints
      summary: Get all SAML sign on endpoints
      description: '**Deprecated**: This endpoint will no longer be supported in a future release. Please use `GET /api/v2/sso-providers` instead to list available SSO endpoints.

        '
      deprecated: true
      tags:
      - Auth
      security: []
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      endpoints:
                        type: array
                        items:
                          $ref: '#/components/schemas/model.saml-sign-on-endpoint'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/saml/providers:
    post:
      operationId: CreateSamlProvider
      summary: Create a New SAML Provider from Metadata
      description: '**Deprecated**: This endpoint will no longer be supported in a future release. Please use `POST /api/v2/sso-providers/saml` instead.

        '
      deprecated: true
      tags:
      - Auth
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              properties:
                name:
                  type: string
                  description: Name of the new SAML provider.
                metadata:
                  type: string
                  format: binary
                  description: Metadata XML file.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/model.saml-provider'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/saml/providers/{saml_provider_id}:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    - description: SAML Provider ID
      name: saml_provider_id
      in: path
      required: true
      schema:
        type: integer
        format: int32
    get:
      operationId: GetSamlProvider
      summary: Get SAML Provider
      description: '**Deprecated**: This endpoint will no longer be supported in a future release. Please use `GET /api/v2/sso-providers` to list all SAML providers instead.

        '
      deprecated: true
      tags:
      - Auth
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/model.saml-provider'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
    delete:
      operationId: DeleteSamlProvider
      summary: Delete a SAML Provider
      description: '**Deprecated**: This endpoint will no longer be supported in a future release. Please use `DELETE /api/v2/sso-providers/{sso_provider_id}` instead.

        '
      deprecated: true
      tags:
      - Auth
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      affected_user:
                        type: array
                        items:
                          $ref: '#/components/schemas/model.user'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '409':
          description: Conflict. The user is trying to delete their own SAML provider.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api.error-wrapper'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/sso-providers:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    get:
      operationId: ListAuthProviders
      summary: List SSO Providers
      description: Lists all available SSO providers (SAML and OIDC)
      tags:
      - Auth
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/model.auth-provider'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/sso-providers/oidc:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    post:
      operationId: CreateOIDCProvider
      summary: Create OIDC Provider
      description: Creates a new OIDC provider for SSO authentication
      tags:
      - Auth
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - name
              - issuer
              - client_id
              - config
              properties:
                name:
                  type: string
                  description: Name of the OIDC provider
                issuer:
                  type: string
                  format: url
                  description: URL of the OIDC issuer
                client_id:
                  type: string
                  description: Client ID for the OIDC provider
                config:
                  type: object
                  properties:
                    auto_provision:
                      type: object
                      properties:
                        enabled:
                          type: boolean
                          description: boolean that, if enabled, allows SSO providers to auto provision bloodhound users on initial login
                        default_role_id:
                          type: integer
                          format: int32
                          description: default role id for the user created from SSO provider auto provision
                        role_provision:
                          type: boolean
                          description: boolean that, if enabled, allows sso providers to manage roles for newly created users
      responses:
        '201':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/model.oidc-provider'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/sso-providers/saml:
    post:
      operationId: CreateSSOSAMLProvider
      summary: Create a New SAML Provider from Metadata
      description: Creates a new SAML provider with the given name and metadata XML.
      tags:
      - Auth
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              required:
              - name
              - metadata
              - config.auto_provision.enabled
              - config.auto_provision.default_role_id
              - config.auto_provision.role_provision
              properties:
                name:
                  type: string
                  description: Name of the new SAML provider.
                metadata:
                  type: string
                  format: binary
                  description: Metadata XML file.
                config.auto_provision.enabled:
                  type: string
                  example: 'true'
                  description: boolean that, if enabled, allows SSO providers to auto provision bloodhound users on initial login
                config.auto_provision.default_role_id:
                  type: string
                  example: '3'
                  description: default role id for the user created from SSO provider auto provision
                config.auto_provision.role_provision:
                  type: string
                  example: 'false'
                  description: boolean that, if enabled, allows sso providers to manage roles for newly created users
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/model.saml-provider'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/sso-providers/{sso_provider_id}:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    - description: SSO Provider ID
      name: sso_provider_id
      in: path
      required: true
      schema:
        type: integer
        format: int32
    patch:
      operationId: PatchSSOProvider
      summary: Update SSO Provider
      description: Updates an existing SSO provider. Updating saml provider requires a "multipart/form-data" body. Updating oidc provider requires "application/json" body. Response is respective provider
      tags:
      - Auth
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              properties:
                name:
                  type: string
                  description: Name of the new SAML provider.
                metadata:
                  type: string
                  format: binary
                  description: Metadata XML file.
                config.auto_provision.enabled:
                  type: string
                  example: 'true'
                  description: boolean that, if enabled, allows SSO providers to auto provision bloodhound users on initial login
                config.auto_provision.default_role_id:
                  type: string
                  example: '3'
                  description: default role id for the user created from SSO provider auto provision
                config.auto_provision.role_provision:
                  type: string
                  example: 'false'
                  description: boolean that, if enabled, allows sso providers to manage roles for newly created users
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  description: Name of the OIDC provider
                issuer:
                  type: string
                  format: url
                  description: URL of the OIDC issuer
                client_id:
                  type: string
                  description: Client ID for the OIDC provider
                config:
                  type: object
                  properties:
                    auto_provision:
                      type: object
                      properties:
                        enabled:
                          type: boolean
                          description: boolean that, if enabled, allows SSO providers to auto provision bloodhound users on initial login
                        default_role_id:
                          type: integer
                          format: int32
                          description: default role id for the user created from SSO provider auto provision
                        role_provision:
                          type: boolean
                          description: boolean that, if enabled, allows sso providers to manage roles for newly created users
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  properties:
                    data:
                      $ref: '#/components/schemas/model.saml-provider'
                - type: object
                  properties:
                    data:
                      $ref: '#/components/schemas/model.oidc-provider'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
    delete:
      operationId: DeleteSSOProvider
      summary: Delete SSO Provider
      description: Deletes an existing SSO provider
      tags:
      - Auth
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      affected_users:
                        type: array
                        items:
                          $ref: '#/components/schemas/model.user'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '409':
          description: Conflict. The user is trying to delete their own SSO provider.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api.error-wrapper'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/sso-providers/{sso_provider_id}/signing-certificate:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    - description: SSO Provider ID for a SAML provider
      name: sso_provider_id
      in: path
      required: true
      schema:
        type: integer
        format: int32
    get:
      operationId: GetSSOProviderSAMLSigningCertificate
      summary: Get SAML Provider Signing Certificate
      description: Download the SAML Provider Signing Certificate. Only applies to SAML providers.
      tags:
      - Auth
      responses:
        '200':
          description: OK
          headers:
            content-disposition:
              schema:
                type: string
              description: Suggested filename of structure "{saml-slug}-signing-certificate.pem"
          content:
            text/plain:
              schema:
                type: string
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
components:
  responses:
    not-found:
      description: '**Not Found**

        This error typically comes from operations where a valid ID was passed to the request

        to look up an entity but the entity could not be found.

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/api.error-wrapper'
          example:
            http_status: 404
            timestamp: '2024-02-19T19:27:43.866Z'
            request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
            errors:
            - context: clients
              message: The requested client could not be found.
    bad-request:
      description: '**Bad Request**

        This could be due to one of the following reasons:

        - JSON payload is missing or malformed

        - Path or query parameters are missing or invalid/malformed

        - The data sent is not valid (ex- sending a `string` in an `integer` field)

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/api.error-wrapper'
          example:
            http_status: 400
            timestamp: '2024-02-19T19:27:43.866Z'
            request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
            errors:
            - context: clients
              message: The JSON payload could not be unmarshalled.
    forbidden:
      description: '**Forbidden**

        This is most commonly caused by an authenticated client trying to

        access a resource that it does not have permission for.

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/api.error-wrapper'
          example:
            http_status: 403
            timestamp: '2024-02-19T19:27:43.866Z'
            request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
            errors:
            - context: clients
              message: You do not have permission to access this resource
    internal-server-error:
      description: '**Internal Server Error**

        This is usually the result of either an unexpected database or application error.

        The client may try modifying or resending the request, but the error is likely not related to the client

        doing something wrong.

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/api.error-wrapper'
          example:
            http_status: 500
            timestamp: '2024-02-19T19:27:43.866Z'
            request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
            errors:
            - context: clients
              message: The request could not be handled due to an unexpected database error.
    too-many-requests:
      description: '**Too Many Requests**

        The client has sent too many requests within a certain time window

        and tripped the rate limiting middleware.

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/api.error-wrapper'
          example:
            http_status: 429
            timestamp: '2024-02-19T19:27:43.866Z'
            request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
            errors:
            - context: middleware
              message: Too many requests. Please try again later.
    unauthorized:
      description: '**Unauthorized**

        This endpoint failed an authentication requirement. Either the client tried to access

        a protected endpoint without being authenticated, or an auth validation failed (ex- invalid

        credentials or expired token).

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/api.error-wrapper'
          example:
            http_status: 401
            timestamp: '2024-02-19T19:27:43.866Z'
            request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
            errors:
            - context: login
              message: Unauthorized
  schemas:
    model.client:
      allOf:
      - $ref: '#/components/schemas/model.components.uuid'
      - $ref: '#/components/schemas/model.components.timestamps'
      - type: object
        properties:
          name:
            type: string
            readOnly: true
          ip_address:
            type: string
            format: ipv4
            readOnly: true
          hostname:
            type: string
            format: hostname
            readOnly: true
          configured_user:
            type: string
            readOnly: true
          last_checkin:
            type: string
            format: date-time
            readOnly: true
          events:
            type: array
            readOnly: true
            items:
              $ref: '#/components/schemas/model.client-schedule'
          token:
            readOnly: true
            allOf:
            - $ref: '#/components/schemas/model.auth-token'
          current_job_id:
            readOnly: true
            allOf:
            - $ref: '#/components/schemas/null.int64'
          current_job:
            readOnly: true
            allOf:
            - $ref: '#/components/schemas/model.client-scheduled-job'
          completed_job_count:
            type: integer
            format: int32
            readOnly: true
          domain_controller:
            readOnly: true
            allOf:
            - $ref: '#/components/schemas/null.string'
          version:
            type: strin

# --- truncated at 32 KB (48 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/specterops/refs/heads/main/openapi/specterops-auth-api-openapi.yml