Tracebit Canary Credentials API

openapi: 3.2.0
info:
  title: Tracebit Alerts Canary Credentials API
  description: API for interacting with the Tracebit platform.
  version: v1
servers:
- url: https://community.tracebit.com
  description: Tracebit Community Edition server
tags:
- name: Canary Credentials
paths:
  /api/v1/credentials/issue-credentials:
    post:
      tags:
      - Canary Credentials
      summary: Issue credentials
      description: 'Issue canary credentials of the requested types. The credentials should be confirmed via the /confirm-credentials endpoint after their appropriate deployment.


        Required permission: `canary-credentials:all:create`.'
      operationId: IssueCredentials
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IssueCredentialsRequest'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IssueCredentialsResponse'
        '400':
          description: Bad Request
          content:
            text/plain:
              schema:
                type: string
      security:
      - TracebitApiToken: []
  /api/v1/credentials/confirm-credentials:
    post:
      tags:
      - Canary Credentials
      summary: Confirm credentials deployment
      description: 'Confirm the successful deployment of canary credentials. Should be called with the confirmationId of the credentials issued via the /issue-credentials endpoint.


        Required permission: `canary-credentials:all:create`.'
      operationId: ConfirmCredentials
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConfirmCredentialsRequest'
        required: true
      responses:
        '204':
          description: No Content
        '404':
          description: Not Found
      security:
      - TracebitApiToken: []
components:
  schemas:
    SshCanaryCredentials:
      required:
      - sshConfirmationId
      - sshIp
      - sshPrivateKey
      - sshPublicKey
      - sshExpiration
      type: object
      properties:
        sshConfirmationId:
          type: string
          description: The ID to use for confirming these credentials' deployment
          format: uuid
        sshIp:
          type: string
          description: The IP address of the SSH server
        sshPrivateKey:
          type: string
          description: Base64-encoded private key for connecting to the SSH server
        sshPublicKey:
          type: string
          description: Base64-encoded public key of the SSH server
        sshExpiration:
          type: string
          description: The date when these credentials will expire
          format: date-time
    AwsCanaryCredentials:
      required:
      - awsConfirmationId
      - awsAccessKeyId
      - awsExpiration
      - awsSecretAccessKey
      - awsSessionToken
      type: object
      properties:
        awsConfirmationId:
          type: string
          description: The ID to use for confirming these credentials' deployment
          format: uuid
        awsAccessKeyId:
          type: string
          description: The AWS access key ID
        awsExpiration:
          type: string
          description: The date when these credentials will expire
          format: date-time
        awsSecretAccessKey:
          type: string
          description: The AWS secret access key
        awsSessionToken:
          type: string
          description: The AWS session token
    HttpCanaryCredentials:
      required:
      - confirmationId
      - browserDeploymentId
      - hostNames
      - expiresAt
      - credentials
      type: object
      properties:
        confirmationId:
          type: string
          description: The ID to use for confirming these credentials' deployment
          format: uuid
        browserDeploymentId:
          type: string
          description: The ID of the browser deployment
          format: uuid
        hostNames:
          type: array
          items:
            type: string
          description: The hostnames for which these credentials are valid
        expiresAt:
          type:
          - 'null'
          - string
          description: The date when these credentials will expire
          format: date-time
        credentials:
          description: The perimeter canary credentials
          $ref: '#/components/schemas/JsonElement'
    IssueCredentialsRequest:
      required:
      - name
      - source
      - sourceType
      type: object
      properties:
        name:
          type: string
          description: A name to identify the credentials
        types:
          type:
          - 'null'
          - array
          items:
            type: string
          description: The credential types to issue. Valid values are 'aws', 'ssh', 'gitlab-cookie', 'gitlab-username-password'
        source:
          type: string
          description: The value for the 'source' label, representing the system used to deploy the credentials, for example 'custom' or 'script'
        sourceType:
          type: string
          description: The value for the 'source_type' label, representing the type of system in which the credentials will be deployed, for example 'endpoint', 'container', 'ci/cd'
        labels:
          type: array
          items:
            $ref: '#/components/schemas/DecoyTokenLabel'
          description: Additional label names and values for the credentials, typically metadata about how and where the credential is being deployed
      example:
        name: home-canary
        types:
        - aws
        - ssh
        source: custom
        sourceType: endpoint
        labels:
        - name: machine
          value: home
    DecoyTokenLabel:
      required:
      - name
      - value
      type: object
      properties:
        name:
          type: string
        value:
          type: string
    ConfirmCredentialsRequest:
      required:
      - id
      type: object
      properties:
        id:
          type: string
          description: The confirmation ID for the deployed credentials
          format: uuid
    JsonElement: {}
    IssueCredentialsResponse:
      type: object
      properties:
        aws:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/AwsCanaryCredentials'
        ssh:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/SshCanaryCredentials'
        http:
          type: object
          anyOf:
          - title: gitlab-cookie
            required:
            - gitlab-cookie
            type: object
            properties:
              gitlab-cookie:
                $ref: '#/components/schemas/HttpCanaryCredentials'
          - title: gitlab-username-password
            required:
            - gitlab-username-password
            type: object
            properties:
              gitlab-username-password:
                $ref: '#/components/schemas/HttpCanaryCredentials'
          description: An object containing the perimeter canary credentials where the key is the credential type and the value is the HttpCanaryCredentials object. The schema of the 'credentials' value depends on the credential type.
  securitySchemes:
    TracebitApiToken:
      type: http
      scheme: bearer