Synack webapps API

openapi: 3.1.0
info:
  title: Assessment Service Assessment Groups webapps API
  version: 1.0.0
  description: 'APIs for managing Assessment and related operations on the Synack.

    '
  contact:
    name: Synack Engineering
    email: engineering@synack.com
servers:
- url: https://client.synack.com/api/assessment
  description: Commercial
- url: https://client.synack.us/api/assessment
  description: FedRAMP (Medium)
security:
- bearerAuth: []
tags:
- name: webapps
  description: Web application assets.
paths:
  /v2/bulk/assets:
    post:
      operationId: postAssetBulk
      tags:
      - webapps
      description: 'Creates Assets in my Synack org. Note: In the Body, choose the Object pull down that corresponds to the asset type you want to add; Object 1 for Cloud, Object 2 for Hosts, Object 3 for Mobile, Object 4 for Networks, Object 5 for Web. For example; to add more than 1 Host IP address, choose Option 2, then specify multiple IP ranges with /32 CIDRs (adding a new Item for each).

        '
      x-mint:
        metadata:
          title: Bulk Create Assets
      requestBody:
        description: Supply Asset UID for the asset to upsert
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SingleOrMultiAsset'
      responses:
        '201':
          $ref: '#/components/responses/SingleOrMultiAssetResponse'
        '202':
          $ref: '#/components/responses/202StatusAccepted'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '409':
          $ref: '#/components/responses/409Conflict'
        '413':
          $ref: '#/components/responses/413RequestEntityTooLarge'
        '422':
          $ref: '#/components/responses/422EntityNotProcessable'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gw
        - asset_client_ow
        - asset_boss_ow
        - asset_client_lw
        - asset_boss_lw
  /v2/bulk/assets/lifecycle-state:update:
    post:
      operationId: bulkUpdateAssetLifecycleState
      tags:
      - webapps
      description: 'Bulk updates the asset life cycle property. Checks the validity of assets and returns 409 Conflict if rules are violated.

        '
      x-mint:
        metadata:
          title: Bulk Update Asset Lifecycle State
      requestBody:
        description: Supply Organization UID, Asset UIDs for the assets to update, and the lifecycle state to update to.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssetBulkLifecycleStateUpdate'
      responses:
        '200':
          $ref: '#/components/responses/AssetBulkLifecycleStateUpdateResponse'
        '202':
          $ref: '#/components/responses/202StatusAccepted'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '409':
          $ref: '#/components/responses/409Conflict'
        '413':
          $ref: '#/components/responses/413RequestEntityTooLarge'
        '422':
          $ref: '#/components/responses/422EntityNotProcessable'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gw
        - asset_client_ow
        - asset_boss_ow
        - asset_client_lw
        - asset_boss_lw
  /v2/bulk/assets/criticality:update:
    post:
      operationId: bulkUpdateAssetCriticality
      tags:
      - webapps
      description: 'Bulk update the criticality of multiple assets.

        '
      x-mint:
        metadata:
          title: Bulk Update Asset Criticality
      requestBody:
        description: The Organization UID, Asset UIDs to be updated, and the criticality value to be set on the assets.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssetBulkCriticalityUpdate'
      responses:
        '200':
          $ref: '#/components/responses/AssetBulkCriticalityUpdateResponse'
        '202':
          $ref: '#/components/responses/202StatusAccepted'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '409':
          $ref: '#/components/responses/409Conflict'
        '413':
          $ref: '#/components/responses/413RequestEntityTooLarge'
        '422':
          $ref: '#/components/responses/422EntityNotProcessable'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gw
        - asset_client_ow
        - asset_boss_ow
        - asset_client_lw
        - asset_boss_lw
  /v2/assets:
    get:
      operationId: getAssets
      tags:
      - webapps
      description: 'Retrieve the list of assets for one or more organizations, considering filtering and pagination query parameters. When an organization-level OAuth2 scope is provided, the results will be restricted to those organizations the user is authorized for. Similarly, if a listing- level OAuth2 scope is provided, the results will be restricted to those listings the user is authorized for.

        Additional query parameters generally restrict the resulting set of assets according to AND semantics.

        Use of organizationUid and listingUid query parameters will further restrict the results.

        If neither are specified, the returned assets are the set of assets the user is allowed to access with organization OR listing specific privileges.

        If listing UIDs are supplied without organization UIDs, then only the assets assigned to those listings (which the user is authorized for) will be returned. Conversely, if organization UIDs are supplied without listing UIDs, then only the assets owned by those organizations (which the the user is authorized for) will be returned.

        Should both organization UIDs and listing UIDs be supplied, then the set of assets returned is restricted to assets assigned to any of the supplied listings, AND owned by any of the supplied organizations, further restricted to only those the user is authorized to access.

        Researcher users are restricted to only viewing credentials of in scope assets for listings to which they have been assigned.

        '
      x-mint:
        metadata:
          title: Get Assets
      parameters:
      - $ref: '#/components/parameters/OrganizationUIDQuery'
      - $ref: '#/components/parameters/ListingUIDQuery'
      - $ref: '#/components/parameters/AssetTypeQuery'
      - $ref: '#/components/parameters/HostTypeQuery'
      - in: query
        name: search
        schema:
          type: string
        required: false
        description: 'Optional query parameter for a search string that will be used to match within the label or location properties of assets. If this query parameter is provided, any location query parameter will be ignored.

          '
      - in: query
        name: active
        schema:
          type: boolean
        required: false
        description: 'Optional parameter that determines whether the response includes assets regardless of active state (the default, if this query parameter is not provided); active assets only if true; or inactive assets only if false.

          '
      - in: query
        name: inProduction
        schema:
          type: boolean
        required: false
        description: 'Optional query parameter that determines whether production or non-production assets will be included in the response.

          '
      - in: query
        name: maxHostDiscoveryAgeMins
        schema:
          type: integer
          default: 0
        required: false
        description: 'Optional query parameter to get host assets which are discovered by cloudEnumeration scanner shifted by maxHostDiscoveryAgeMins. Assets which are added via boss or discovered by other type of scanners will be included in response. E.g. CloudEnumeration hosts are valid for 1 hour from each time they are discovered, maxHostDiscoveryAgeMins=0 means that if the end time of the relationship has passed, the asset will not be returned - maxHostDiscoveryAgeMins=60 however, would return assets that were still valid 60 minutes ago

          '
      - in: query
        name: scope[]
        schema:
          type: array
          items:
            $ref: '#/components/schemas/Scope'
        required: false
        explode: true
        description: Restrict the returned assets to only assets associated to listings by the specified scopes.
      - in: query
        name: cloudPlatform[]
        schema:
          type: array
          items:
            $ref: '#/components/schemas/CloudPlatform'
        required: false
        explode: true
        description: Restrict the returned assets to only assets enumerated from a particular cloud platform.
      - in: query
        name: location
        schema:
          type: string
        required: false
        description: 'Prefix search of the derived location property.

          '
      - in: query
        name: errorCode[]
        schema:
          type: array
          items:
            $ref: '#/components/schemas/ErrorCode'
        required: false
        explode: true
        description: Filter assets to only include assets with matching error codes.
      - in: query
        name: portNumber[]
        schema:
          type: array
          items:
            $ref: '#/components/schemas/PortNumber'
        required: false
        explode: true
        description: Filter assets to only include hosts with open ports matching the port number.
      - in: query
        name: maxOpenPorts
        schema:
          type: integer
          format: int32
          minimum: 0
          maximum: 65535
        required: false
        description: Max open ports from a single IP address.
      - in: query
        name: hasNetwork
        schema:
          type: boolean
        required: false
        description: 'Filter assets to include/exclude those with networks.

          Deprecating.

          '
      - in: query
        name: networkUid[]
        schema:
          type: array
          items:
            $ref: '#/components/schemas/UID'
        required: false
        explode: true
        description: 'Unique identifier for a network.

          If not supplied the request will apply to all networks the user is authorized to access.

          Deprecating.

          '
      - in: query
        name: gatewayId[]
        schema:
          type: array
          items:
            $ref: '#/components/schemas/GatewayID'
        required: false
        explode: true
        description: 'Unique gateway id.

          If not supplied the request will apply to all gateways.

          '
      - in: query
        name: earliestCreatedAt
        schema:
          type: string
          format: date-time
        required: false
        description: Filter assets with a createdAt date greater or equal to this value
      - in: query
        name: latestCreatedAt
        schema:
          type: string
          format: date-time
        required: false
        description: Filter assets with a createdAt date less than or equal to this value
      - in: query
        name: userUid
        schema:
          $ref: '#/components/schemas/UserUID'
        required: false
        description: Restricts the credentials to only those available to the user. This query parameter is ignored if the user is a researcher.
      - in: query
        name: relationshipTargetAssetUid
        schema:
          $ref: '#/components/schemas/AssetUID'
        required: false
        description: 'Filter assets which have a relationship with targetAssetUid equal to this value.

          '
      - in: query
        name: relationshipType
        schema:
          $ref: '#/components/schemas/AssetRelationshipType'
        required: false
        description: 'Filter assets which have a relationship of this type.

          '
      - $ref: '#/components/parameters/PerPageQuery'
      - $ref: '#/components/parameters/PageQuery'
      - in: query
        name: sort
        schema:
          type: string
          enum:
          - location
          - label
          - createdAt
          - updatedAt
          - lastReachableAt
          - lastScan
        description: Optional property to sort results by.
        required: false
      - $ref: '#/components/parameters/SortDirQuery'
      - in: query
        name: origin
        schema:
          type: string
          enum:
          - provided
          - discovered
        description: Optional property to filter results by human created or system discovered assets.
        required: false
      - name: lifecycleState[]
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - confirmed
            - unconfirmed
            - archived
            - ignored
        description: Optional property to filter results by asset lifecycle state. When not supplied, all assets except `archived` will be returned.
      - in: query
        name: omitFields
        description: Fields to omit from response.
        schema:
          type: array
          items:
            type: string
            enum:
            - ALL
            - relationships
            - externalRelationships
            - ports
            - networks
            - scopeRules
            - binaries
            - userRoles
      - $ref: '#/components/parameters/IpRanges'
      responses:
        '200':
          $ref: '#/components/responses/PaginatedArrayOfAssets'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gr
        - asset_or
        - asset_lr
        - asset_srt_lr
        - asset_scan_gr
    post:
      operationId: postAsset
      tags:
      - webapps
      description: 'Creates an asset in my Synack org. In the Body, choose the Object pull down that corresponds to the asset type you want to add; Object 1 for Cloud, Object 2 for Host, Object 3 for Mobile, Object 4 for Network, Object 5 for Web

        '
      x-mint:
        metadata:
          title: Create Asset
      requestBody:
        description: Asset to create. If the asset is of cloud account type, only its metadata returned in the response as credential data is restricted to asset_scan_gr scope. If the asset is of webapp type, corresponding FQDN or IP host asset will also be created.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SingleOrMultiAsset'
      responses:
        '201':
          $ref: '#/components/responses/SingleOrMultiAssetResponse'
        '202':
          $ref: '#/components/responses/202StatusAccepted'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '409':
          $ref: '#/components/responses/409Conflict'
        '413':
          $ref: '#/components/responses/413RequestEntityTooLarge'
        '422':
          $ref: '#/components/responses/422EntityNotProcessable'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gw
        - asset_client_ow
        - asset_boss_ow
        - asset_client_lw
        - asset_boss_lw
  /v2/assets/{assetUid}:
    parameters:
    - $ref: '#/components/parameters/AssetUIDPath'
    get:
      operationId: getAsset
      tags:
      - webapps
      description: 'Retrieves a single asset. If the user is a researcher, only the credentials they are authorized to access will be returned. If the asset is of cloud account type, only a user with asset_scan_gr scope can access its credential data.

        '
      x-mint:
        metadata:
          title: Get Asset
      parameters:
      - in: query
        name: userUid
        schema:
          $ref: '#/components/schemas/UserUID'
        required: false
        description: Restricts the credentials to only those available to the user. This query parameter is ignored if the user is a researcher.
      responses:
        '200':
          $ref: '#/components/responses/SingleAssetResponse'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gr
        - asset_scan_gr
        - asset_or
        - asset_lr
        - asset_srt_lr
    patch:
      operationId: patchAsset
      tags:
      - webapps
      description: 'Patches the properties of a single asset.

        '
      x-mint:
        metadata:
          title: Patch Asset
      requestBody:
        description: Asset properties to patch.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SingleAsset'
      responses:
        '200':
          $ref: '#/components/responses/SingleAssetResponse'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gw
        - asset_client_ow
        - asset_boss_ow
        - asset_client_lw
        - asset_boss_lw
    delete:
      x-excluded: true
      operationId: deleteAsset
      tags:
      - webapps
      description: 'Deletes an asset. This is intended to be a privileged operation. Regular use should be to mark the asset as inactive. Any relationships that involve the deleted asset will be also be deleted, as will any association to listings.

        '
      responses:
        '204':
          $ref: '#/components/responses/204NoContent'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gw
        - asset_client_ow
        - asset_boss_ow
        - asset_client_lw
        - asset_boss_lw
  /v2/assets/{assetUid}/tools/burp/target-scope.json:
    parameters:
    - $ref: '#/components/parameters/AssetUIDPath'
    get:
      x-excluded: true
      operationId: getBurpTargetScopeForAsset
      tags:
      - webapps
      description: 'Retrieve a Burp target scope file, if the asset is a webapp.

        '
      responses:
        '200':
          description: JSON Target Scope file for Burp.
          content:
            application/json: {}
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gr
        - asset_or
        - asset_lr
        - asset_srt_lr
  /v2/assets/{assetUid}/scripts:
    parameters:
    - $ref: '#/components/parameters/AssetUIDPath'
    get:
      x-excluded: true
      operationId: getAssetScripts
      tags:
      - webapps
      description: Gets all scripts owned by the mobile or web application asset. Returns 409 status if the asset is not of one of these types.
      parameters:
      - $ref: '#/components/parameters/PerPageQuery'
      - $ref: '#/components/parameters/PageQuery'
      - in: query
        name: sort
        schema:
          type: string
          enum:
          - name
          - scriptRole
          - createdAt
          - updatedAt
        description: Optional property to sort results by.
        required: false
      - $ref: '#/components/parameters/SortDirQuery'
      responses:
        '200':
          $ref: '#/components/responses/PaginatedArrayOfAssetScripts'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '409':
          $ref: '#/components/responses/409Conflict'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gr
        - asset_or
    post:
      x-excluded: true
      operationId: postAssetScript
      tags:
      - webapps
      description: 'Adds a script to a mobile or web application asset. Returns 409 status if the asset is of any other type..

        '
      requestBody:
        description: Script to add.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssetScript'
      responses:
        '201':
          $ref: '#/components/responses/SingleAssetScript'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '409':
          $ref: '#/components/responses/409Conflict'
        '412':
          $ref: '#/components/responses/412PreconditionFailed'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gw
        - asset_client_ow
        - asset_boss_ow
        - asset_client_lw
        - asset_boss_lw
  /v2/assets/{assetUid}/credentials:
    parameters:
    - $ref: '#/components/parameters/AssetUIDPath'
    get:
      x-excluded: true
      operationId: getAssetCredentials
      tags:
      - webapps
      description: Gets all credentials owned by web application asset. Returns 409 status if the asset is not of this type.
      parameters:
      - $ref: '#/components/parameters/PerPageQuery'
      - $ref: '#/components/parameters/PageQuery'
      - in: query
        name: sort
        schema:
          type: string
          enum:
          - name
          - createdAt
          - updatedAt
        description: Optional property to sort results by.
        required: false
      - $ref: '#/components/parameters/SortDirQuery'
      responses:
        '200':
          $ref: '#/components/responses/PaginatedArrayOfAssetCredentials'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '409':
          $ref: '#/components/responses/409Conflict'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gr
        - asset_scan_gr
        - asset_or
  /v2/scripts/{scriptUid}:
    parameters:
    - $ref: '#/components/parameters/ScriptUIDPath'
    get:
      x-excluded: true
      operationId: getAssetScript
      tags:
      - webapps
      description: Gets an asset script.
      responses:
        '200':
          $ref: '#/components/responses/SingleAssetScript'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gr
        - asset_scan_gr
        - asset_or
        - asset_lr
    delete:
      x-excluded: true
      operationId: deleteAssetScript
      tags:
      - webapps
      description: 'Delete a script from a asset.

        '
      responses:
        '204':
          $ref: '#/components/responses/204NoContent'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gw
        - asset_client_ow
        - asset_boss_ow
        - asset_client_lw
        - asset_boss_lw
    patch:
      x-excluded: true
      operationId: patchAssetScript
      tags:
      - webapps
      description: 'Patch the properties of an asset script.

        '
      requestBody:
        description: Script properties to patch.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserRoleScriptUpdate'
      responses:
        '200':
          $ref: '#/components/responses/SingleUserRoleScript'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '422':
          $ref: '#/components/responses/422EntityNotProcessable'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gw
        - asset_client_ow
        - asset_boss_ow
        - asset_client_lw
        - asset_boss_lw
  /v2/scripts/{scriptUid}/script-data:
    parameters:
    - $ref: '#/components/parameters/ScriptUIDPath'
    get:
      x-excluded: true
      operationId: getAssetScriptData
      tags:
      - webapps
      description: Gets the script data for an asset script.
      responses:
        '200':
          description: JSON-representation of the asset script data
          content:
            application/json: {}
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gr
        - asset_or
        - asset_lr
  /v2/assets/{assetUid}/user-roles:
    parameters:
    - $ref: '#/components/parameters/AssetUIDPath'
    get:
      x-excluded: true
      operationId: getUserRoles
      tags:
      - webapps
      description: Gets a paginated list of all user roles for a mobile or web application. Returns a 409 status code if the asset is not one of these expected types.
      parameters:
      - $ref: '#/components/parameters/PerPageQuery'
      - $ref: '#/components/parameters/PageQuery'
      - in: query
        name: sort
        schema:
          type: string
          enum:
          - name
          - scannable
          - createdAt
          - updatedAt
        description: Optional property to sort results by.
        required: false
      - $ref: '#/components/parameters/SortDirQuery'
      - $ref: '#/components/parameters/ScannableQuery'
      responses:
        '200':
          $ref: '#/components/responses/PaginatedArrayOfUserRoles'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '409':
          $ref: '#/components/responses/409Conflict'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gr
        - asset_or
        - asset_lr
        - asset_srt_lr
    post:
      x-excluded: true
      operationId: postUserRole
      tags:
      - webapps
      description: Adds a user role to a mobile or web application asset. Returns a 409 status code if the asset is not one of these expected types.
      requestBody:
        description: Mobile or web application user role to create.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserRole'
      responses:
        '201':
          $ref: '#/components/responses/SingleUserRole'
        '204':
          $ref: '#/components/responses/204NoContent'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '409':
          $ref: '#/components/responses/409Conflict'
        '422':
          $ref: '#/components/responses/422EntityNotProcessable'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gw
        - asset_client_ow
        - asset_boss_ow
        - asset_client_lw
        - asset_boss_lw
  /v2/user-roles/{userRoleUid}:
    parameters:
    - $ref: '#/components/parameters/UserRoleUIDPath'
    get:
      x-excluded: true
      operationId: getUserRole
      tags:
      - webapps
      description: Retrieves the properties of the supplied user role.
      responses:
        '200':
          $ref: '#/components/responses/SingleUserRole'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gr
        - asset_or
        - asset_lr
        - asset_srt_lr
    patch:
      x-excluded: true
      operationId: patchUserRole
      tags:
      - webapps
      description: Patch properties of a user role for a mobile or web application asset. Will return a 409 status code if the type is not one of these expected types.
      requestBody:
        description: User role to patch.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserRole'
      responses:
        '200':
          $ref: '#/components/responses/SingleUserRole'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '409':
          $ref: '#/components/responses/409Conflict'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
      security:
      - OAuth2:
        - asset_gw
        - asset_client_ow
       

# --- truncated at 32 KB (126 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/synack/refs/heads/main/openapi/synack-webapps-api-openapi.yml