Tyk UserGroup API

openapi: 3.2.0
info:
  contact:
    email: support@tyk.io
    name: Tyk Technologies
    url: https://tyk.io/contact
  description: '

    ## <a name="introduction"></a> Introduction


    The Tyk Dashboard API offers granular, programmatic access to a centralised database of resources that your Tyk nodes can pull from. This API has a dynamic user administrative structure which means the secret key that is used to communicate with your Tyk nodes can be kept secret and access to the wider management functions can be handled on a user-by-user and organisation-by-organisation basis.


    A common question around using a database-backed configuration is how to programmatically add API definitions to your Tyk nodes, the Dashboard API allows much more fine-grained, secure and multi-user access to your Tyk cluster, and should be used to manage a database-backed Tyk node.


    The Tyk Dashboard API works seamlessly with the Tyk Dashboard (and the two come bundled together).


    ## <a name="security-hierarchy"></a> Security Hierarchy


    The Dashboard API provides a more structured security layer to managing Tyk nodes.


    ### Organisations, APIs and Users


    With the Dashboard API and a database-backed Tyk setup, (and to an extent with file-based API setups - if diligence is used in naming and creating definitions), the following security model is applied to the management of Upstream APIs:


    * **Organisations**: All APIs are *owned* by an organisation, this is designated by the ''OrgID'' parameter in the API Definition.

    * **Users**: All users created in the Dashboard belong to an organisation (unless an exception is made for super-administrative access).

    * **APIs**: All APIs belong to an Organisation and only Users that belong to that organisation can see the analytics for those APIs and manage their configurations.

    * **API Keys**: API Keys are designated by organisation, this means an API key that has full access rights will not be allowed to access the APIs of another organisation on the same system, but can have full access to all APIs within the organisation.

    * **Access Rights**: Access rights are stored with the key, this enables a key to give access to multiple APIs, this is defined by the session object in the core Tyk API.


    In order to use the Dashboard API, you''ll need to get the ''Tyk Dashboard API Access Credentials'' secret from your user profile on the Dashboard UI.


    The secret you set should then be sent along as a header with each Dashboard API Request in order for it to be successful:



    authorization: <your-secret>

    '
  license:
    name: Mozilla Public License Version 2.0
    url: https://github.com/TykTechnologies/tyk/blob/master/LICENSE.md
  title: Tyk Dashboard User Group API
  version: 5.7.1
servers:
- url: https://{tenant}
  variables:
    tenant:
      default: localhost:8080
      description: Your dashboard host
security:
- bearerAuth: []
tags:
- description: When you have a large number of users and teams with different access requirements, instead of setting permissions per user, you can create a user group and configure the permissions for all users in the group. Note that a user can only belong to one group.
  externalDocs:
    description: Manage Tyk Dashboard User Groups.
    url: https://tyk.io/docs/basic-config-and-security/security/dashboard/create-user-groups/
  name: UserGroup
paths:
  /api/usergroups:
    get:
      description: This will return a list of all the user groups. The returned user groups are paginated.
      operationId: listUserGroups
      parameters:
      - description: Use p query parameter to say which page you want returned. Send number less than 0 to return all items.
        example: 1
        in: query
        name: p
        required: false
        schema:
          type: integer
      responses:
        '200':
          content:
            application/json:
              example:
                groups:
                - active: true
                  description: devs company
                  id: '363634393938366435373135656334633936636265663262'
                  name: devs
                  org_id: 5e9d9544a1dcd60001d0ed20
                  password_max_days: 0
                  user_permissions:
                    analytics: read
                    api_assets: write
                    apis: write
                    certs: write
                    hooks: write
                    idm: write
                    keys: write
                    log: read
                    oauth: write
                    owned_analytics: deny
                    policies: write
                    portal: write
                    system: write
                    user_groups: write
                    users: write
                    websockets: read
                - active: true
                  description: Devops logs and analytics access
                  id: '363634396664346235373135656334633936636265663338'
                  name: Devops
                  org_id: 5e9d9544a1dcd60001d0ed20
                  password_max_days: 0
                  user_permissions:
                    analytics: read
                    log: read
                pages: 1
              schema:
                $ref: '#/components/schemas/UserGroups'
          description: User groups fetched.
        '401':
          content:
            application/json:
              example:
                Message: Not authorised
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Unauthorized
        '403':
          content:
            application/json:
              example:
                Message: 'access denied: You do not have permission to access  /api/usergroups'
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              example:
                Message: Could not retrieve user groups.
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Unable to fetch groups.
        '500':
          content:
            application/json:
              example:
                Message: Failed to unmarshal keys data from Tyk API.
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Internal server error.
      summary: List user groups.
      tags:
      - UserGroup
    post:
      description: Instead of assigning permission to each individual users, per user, you can create a user group and configure the permissions for all users in the group. This endpoint allow you to create a user group and set permission for the user group.
      operationId: createUserGroup
      requestBody:
        content:
          application/json:
            example:
              active: true
              description: Devops logs and analytics access
              name: Devops
              org_id: 5e9d9544a1dcd60001d0ed20
              user_permissions:
                analytics: read
                log: read
            schema:
              $ref: '#/components/schemas/UserGroup'
      responses:
        '200':
          content:
            application/json:
              example:
                Message: User group created
                Meta: 6649fb3e5715ec4c96cbef36
                Status: OK
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: User group created.
        '401':
          content:
            application/json:
              example:
                Message: Not authorised
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Unauthorized
        '403':
          content:
            application/json:
              example:
                Message: Request body malformed.
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Malformed request data.
        '500':
          content:
            application/json:
              example:
                Message: Failed to read response body, body empty.
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Internal server error.
      summary: Create user group.
      tags:
      - UserGroup
  /api/usergroups/{groupId}:
    delete:
      description: Delete user group using the group ID.
      operationId: deleteUserGroup
      parameters:
      - description: ID of the group you want to delete.
        example: 6649fd535715ec4c96cbef39
        in: path
        name: groupId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              example:
                Message: User group deleted
                Meta: null
                Status: OK
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: OK
        '400':
          content:
            application/json:
              example:
                Message: Could not delete the user group.
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Failed to delete user group.
        '401':
          content:
            application/json:
              example:
                Message: Not authorised
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Unauthorized
        '403':
          content:
            application/json:
              example:
                Message: 'access denied: You do not have permission to access  /api/usergroups/{groupId}'
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              example:
                Message: Could not retrieve user detail.
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Group not found.
        '500':
          content:
            application/json:
              example:
                Message: Attempted unauthorised access.
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Internal server error.
      summary: Delete user group.
      tags:
      - UserGroup
    get:
      description: Return a user group object with all the details of a specified group.
      operationId: getUserGroup
      parameters:
      - description: ID of the group you want to fetch.
        example: 6649fd535715ec4c96cbef39
        in: path
        name: groupId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              example:
                active: true
                description: Devops logs and analytics access
                id: '363634396664346235373135656334633936636265663338'
                name: Devops
                org_id: 5e9d9544a1dcd60001d0ed20
                password_max_days: 0
                user_permissions:
                  analytics: read
                  log: read
              schema:
                $ref: '#/components/schemas/UserGroup'
          description: User grouped fetched.
        '401':
          content:
            application/json:
              example:
                Message: Not authorised
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Unauthorized
        '403':
          content:
            application/json:
              example:
                Message: 'access denied: You do not have permission to access  /api/usergroups/{groupId}'
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Forbidden
        '404':
          content:
            application/json:
              example:
                Message: Could not retrieve user group detail.
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Group not found.
        '500':
          content:
            application/json:
              example:
                Message: Attempted unauthorised access.
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Internal server error.
      summary: Get user group details.
      tags:
      - UserGroup
    put:
      description: Update the details of a user group. You must have either admin or user groups permission to be able to modify user groups. Note you cannot update the ResetPassword permission with this endpoint. For that you need to use Admin API. When updating a user group you also need to specify at least one permission in the user_permissions field.
      operationId: updateUserGroup
      parameters:
      - description: ID of the group you want to update.
        example: 6649fd535715ec4c96cbef39
        in: path
        name: groupId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            example:
              active: true
              description: Devops logs and analytics access
              name: Devops
              org_id: 5e9d9544a1dcd60001d0ed20
              user_permissions:
                analytics: read
                log: read
            schema:
              $ref: '#/components/schemas/UserGroup'
      responses:
        '200':
          content:
            application/json:
              example:
                Message: User group updated
                Meta: null
                Status: OK
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: OK
        '400':
          content:
            application/json:
              example:
                Message: Group ID does not exist
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Group not found or malformed request body.
        '401':
          content:
            application/json:
              example:
                Message: Not authorised
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Unauthorized
        '403':
          content:
            application/json:
              example:
                Message: 'access denied: You do not have permission to access  /api/usergroups/{groupId}'
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Forbidden
        '500':
          content:
            application/json:
              example:
                Message: Attempted unauthorised access.
                Meta: null
                Status: Error
              schema:
                $ref: '#/components/schemas/ApiResponse'
          description: Internal server error.
      summary: Update user group.
      tags:
      - UserGroup
components:
  schemas:
    UserGroup:
      properties:
        active:
          example: true
          type: boolean
        description:
          example: Devops logs and analytics access
          type: string
        id:
          example: 6649986d5715ec4c96cbef2b
          type: string
        name:
          example: 66498cd1e2fcd1000184ecb8
          type: string
        org_id:
          example: 5e9d9544a1dcd60001d0ed20
          type: string
        password_max_days:
          example: 0
          type: integer
        user_permissions:
          $ref: '#/components/schemas/UserPermissionObject'
      type: object
    ApiResponse:
      properties:
        ID:
          type: string
        Message:
          type: string
        Meta: {}
        Status:
          type: string
      type: object
    UserGroups:
      properties:
        groups:
          items:
            $ref: '#/components/schemas/UserGroup'
          type:
          - array
          - 'null'
        pages:
          type: integer
      type: object
    UserPermissionObject:
      additionalProperties:
        type: string
      type: object
  securitySchemes:
    bearerAuth:
      description: The Tyk Dashboard API Access Credentials
      scheme: bearer
      type: http