The access-management API from Upwind — 10 operation(s) for access-management.
openapi: 3.0.3
info:
title: Upwind Management REST API v1 access-management API
version: '1.0'
description: Upwind Management REST API — administrative and data endpoints for the Upwind cloud security platform (threats, vulnerabilities, configurations, inventory, API security, workflows, access management). Reconstructed faithfully from the embedded OpenAPI operation definitions published in the Upwind docs (docs.upwind.io) by the API Evangelist enrichment pipeline; operation content is verbatim from the provider.
contact:
name: Upwind Support
email: support@upwind.io
url: https://docs.upwind.io/
x-apievangelist:
generated: '2026-07-21'
method: searched
source: https://docs.upwind.io/restapi/v1/introduction (embedded docusaurus-plugin-openapi-docs operation JSON)
servers:
- url: https://api.upwind.io
description: Production endpoint (US)
- url: https://api.eu.upwind.io
description: Production endpoint (EU)
- url: https://api.me.upwind.io
description: Production endpoint (ME)
security:
- OAuth2ClientCredentials: []
tags:
- name: access-management
paths:
/v2/organizations/{organization-id}/access-management/groups/{group-id}/members/bulk:
post:
operationId: addGroupMembers
summary: Add members to a group
description: A POST request adds the specified members to an access-management group.
tags:
- access-management
parameters:
- description: The unique identifier for the Upwind organization.
example: org_Xk9mPq7RtYwN2vLs
in: path
name: organization-id
required: true
schema:
type: string
- description: The unique identifier for the group.
in: path
name: group-id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
properties:
emails:
type: array
description: List of member email addresses to add or remove.
example:
- user@example.com
items:
type: string
format: email
minLength: 1
minItems: 1
required:
- emails
title: ApiBulkGroupMembersRequest
required: true
responses:
'200':
description: OK
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'429':
description: Rate Limit Exceeded
security:
- OAuth2ClientCredentials: []
delete:
operationId: removeGroupMembers
summary: Remove members from a group
description: A DELETE request removes the specified members from an access-management group.
tags:
- access-management
parameters:
- description: The unique identifier for the Upwind organization.
example: org_Xk9mPq7RtYwN2vLs
in: path
name: organization-id
required: true
schema:
type: string
- description: The unique identifier for the group.
in: path
name: group-id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
properties:
emails:
type: array
description: List of member email addresses to add or remove.
example:
- user@example.com
items:
type: string
format: email
minLength: 1
minItems: 1
required:
- emails
title: ApiBulkGroupMembersRequest
required: true
responses:
'200':
description: OK
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'429':
description: Rate Limit Exceeded
security:
- OAuth2ClientCredentials: []
/v2/organizations/{organization-id}/access-management/members:
post:
operationId: addMember
summary: Add a member
description: A POST request sent to the endpoint root invites a new member to the organization with optional permissions and group assignments.
tags:
- access-management
parameters:
- description: The unique identifier for the Upwind organization.
example: org_Xk9mPq7RtYwN2vLs
in: path
name: organization-id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
description: Request to add (invite) a new member to the organization
properties:
connection_type:
type: string
description: Connection type for authentication
enum:
- social-google
- social-microsoft
- otp
- saml
example: social-google
minLength: 1
email:
type: string
description: Email of the member to invite
example: user@example.com
minLength: 1
first_name:
type: string
description: First name of the member
example: John
group_ids:
type: array
description: Group IDs to add the member to
items:
type: string
last_name:
type: string
description: Last name of the member
example: Doe
permissions:
type: array
description: Permission bindings to assign to the member
items:
type: object
description: A permission binding for adding a member, associating a scope with role IDs
properties:
role_ids:
type: array
description: List of role IDs to assign for this scope
items:
type: string
minItems: 1
scope_id:
type: string
description: Scope identifier
example: scope-prod-123
minLength: 1
required:
- role_ids
- scope_id
title: ApiAddMemberPermission
required:
- connection_type
- email
title: ApiAddMemberRequest
required: true
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful API response containing items
properties:
items:
type: array
description: The list of items in the response
items:
type: object
description: Response containing details of the invited member
properties:
email:
type: string
description: Email of the invited member
example: user@example.com
title: ApiAddMemberResponse
title: RestApiResponseApiAddMemberResponse
description: OK
'401':
description: Unauthorized
'403':
description: Forbidden
'429':
description: Rate Limit Exceeded
security:
- OAuth2ClientCredentials: []
/v2/organizations/{organization-id}/access-management/scopes:
post:
operationId: createScope
summary: Create a scope
description: A POST request sent to the endpoint root creates a new access-management scope with the specified name, description, and resource filters.
tags:
- access-management
parameters:
- description: The unique identifier for the Upwind organization.
example: org_Xk9mPq7RtYwN2vLs
in: path
name: organization-id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
properties:
description:
type: string
name:
type: string
minLength: 1
resource_filters:
type: array
items:
type: object
properties:
attribute:
type: string
minLength: 1
operator:
type: string
minLength: 1
values:
type: array
items:
type: string
minItems: 1
required:
- attribute
- operator
- values
title: ApiScopeRequestResourceFilter
required:
- name
- resource_filters
title: ApiCreateScopeRequest
required: true
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful API response containing items
properties:
items:
type: array
description: The list of items in the response
items:
type: object
description: The scope defining resource boundaries for access control.
properties:
create_time:
type: string
format: date-time
description: The timestamp when the scope was created (in ISO8601 format).
example: '2024-01-15T10:30:00Z'
creator_id:
type: string
description: The identifier of the user who created this scope.
example: user-456
description:
type: string
description: The description of the scope.
example: All production resources
id:
type: string
description: The unique identifier for this scope.
example: scope-123
name:
type: string
description: The name of the scope.
example: Production Environment
resource_filters:
type: array
description: The list of resource filters that define the scope boundaries.
items:
type: object
description: The resource filter within a scope definition.
properties:
attribute:
type: string
description: The resource attribute the scope applies to.
example: cloud_account_id
operator:
type: string
description: The filter operator.
example: in
values:
type: array
description: The values to include or exclude based on the operator.
example:
- aws-acc-prod-001
items:
type: string
title: ApiResourceFilter
update_time:
type: string
format: date-time
description: The timestamp when the scope was last updated (in ISO8601 format).
example: '2024-01-20T14:45:00Z'
title: ApiScope
title: RestApiResponseApiScope
description: OK
'401':
description: Unauthorized
'403':
description: Forbidden
'429':
description: Rate Limit Exceeded
security:
- OAuth2ClientCredentials: []
/v2/organizations/{organization-id}/access-management/scopes/{scope-id}:
delete:
operationId: deleteScope
summary: Delete a scope
description: A DELETE request sent to the endpoint root followed by a unique identifier deletes a specific access-management scope.
tags:
- access-management
parameters:
- description: The unique identifier for the Upwind organization.
example: org_Xk9mPq7RtYwN2vLs
in: path
name: organization-id
required: true
schema:
type: string
- description: The unique identifier for the scope.
in: path
name: scope-id
required: true
schema:
type: string
responses:
'200':
description: OK
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'429':
description: Rate Limit Exceeded
security:
- OAuth2ClientCredentials: []
get:
operationId: getScope
summary: Get a scope
description: A GET request sent to the endpoint root followed by a unique identifier returns detailed information about a specific access-management scope.
tags:
- access-management
parameters:
- description: The unique identifier for the Upwind organization.
example: org_Xk9mPq7RtYwN2vLs
in: path
name: organization-id
required: true
schema:
type: string
- description: The unique identifier for the scope.
in: path
name: scope-id
required: true
schema:
type: string
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful API response containing items
properties:
items:
type: array
description: The list of items in the response
items:
type: object
description: The scope defining resource boundaries for access control.
properties:
create_time:
type: string
format: date-time
description: The timestamp when the scope was created (in ISO8601 format).
example: '2024-01-15T10:30:00Z'
creator_id:
type: string
description: The identifier of the user who created this scope.
example: user-456
description:
type: string
description: The description of the scope.
example: All production resources
id:
type: string
description: The unique identifier for this scope.
example: scope-123
name:
type: string
description: The name of the scope.
example: Production Environment
resource_filters:
type: array
description: The list of resource filters that define the scope boundaries.
items:
type: object
description: The resource filter within a scope definition.
properties:
attribute:
type: string
description: The resource attribute the scope applies to.
example: cloud_account_id
operator:
type: string
description: The filter operator.
example: in
values:
type: array
description: The values to include or exclude based on the operator.
example:
- aws-acc-prod-001
items:
type: string
title: ApiResourceFilter
update_time:
type: string
format: date-time
description: The timestamp when the scope was last updated (in ISO8601 format).
example: '2024-01-20T14:45:00Z'
title: ApiScope
title: RestApiResponseApiScope
description: OK
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'429':
description: Rate Limit Exceeded
security:
- OAuth2ClientCredentials: []
patch:
operationId: updateScope
summary: Update a scope
description: A PATCH request sent to the endpoint root followed by a unique identifier updates an existing access-management scope's name, description, and/or resource filters.
tags:
- access-management
parameters:
- description: The unique identifier for the Upwind organization.
example: org_Xk9mPq7RtYwN2vLs
in: path
name: organization-id
required: true
schema:
type: string
- description: The unique identifier for the scope.
in: path
name: scope-id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
properties:
description:
type: string
name:
type: string
resource_filters:
type: array
items:
type: object
properties:
attribute:
type: string
minLength: 1
operator:
type: string
minLength: 1
values:
type: array
items:
type: string
minItems: 1
required:
- attribute
- operator
- values
title: ApiScopeRequestResourceFilter
title: ApiUpdateScopeRequest
required: true
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful API response containing items
properties:
items:
type: array
description: The list of items in the response
items:
type: object
description: The scope defining resource boundaries for access control.
properties:
create_time:
type: string
format: date-time
description: The timestamp when the scope was created (in ISO8601 format).
example: '2024-01-15T10:30:00Z'
creator_id:
type: string
description: The identifier of the user who created this scope.
example: user-456
description:
type: string
description: The description of the scope.
example: All production resources
id:
type: string
description: The unique identifier for this scope.
example: scope-123
name:
type: string
description: The name of the scope.
example: Production Environment
resource_filters:
type: array
description: The list of resource filters that define the scope boundaries.
items:
type: object
description: The resource filter within a scope definition.
properties:
attribute:
type: string
description: The resource attribute the scope applies to.
example: cloud_account_id
operator:
type: string
description: The filter operator.
example: in
values:
type: array
description: The values to include or exclude based on the operator.
example:
- aws-acc-prod-001
items:
type: string
title: ApiResourceFilter
update_time:
type: string
format: date-time
description: The timestamp when the scope was last updated (in ISO8601 format).
example: '2024-01-20T14:45:00Z'
title: ApiScope
title: RestApiResponseApiScope
description: OK
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'429':
description: Rate Limit Exceeded
security:
- OAuth2ClientCredentials: []
/v2/organizations/{organization-id}/access-management/groups/{group-id}:
get:
operationId: getGroup
summary: Get a group
description: A GET request sent to the endpoint root followed by a unique identifier returns detailed information about a specific access-management group.
tags:
- access-management
parameters:
- description: The unique identifier for the Upwind organization.
example: org_Xk9mPq7RtYwN2vLs
in: path
name: organization-id
required: true
schema:
type: string
- description: The unique identifier for the group.
in: path
name: group-id
required: true
schema:
type: string
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful API response containing items
properties:
items:
type: array
description: The list of items in the response
items:
type: object
description: A group representing a collection of users with assigned permissions
properties:
create_time:
type: string
format: date-time
description: Timestamp when the group was created (in ISO8601 format).
example: '2024-01-15T10:30:00Z'
id:
type: string
description: Unique identifier for this group
example: upwind_readers
identity_provider_name:
type: string
description: Identity provider name for this group
example: okta
name:
type: string
description: Group name
example: Upwind Readers
permissions:
type: array
description: List of permission bindings (scope-roles) for this group
items:
type: object
description: A permission binding for a group, associating a scope with role IDs
properties:
role_ids:
type: array
description: List of role IDs assigned for this scope
example:
- uamr_security_architect
items:
type: string
scope_id:
type: string
description: Scope identifier
example: scope-prod-123
scope_name:
type: string
description: Scope name
example: Production Environment
title: ApiGroupPermission
update_time:
type: string
format: date-time
description: Timestamp when the group was last updated (in ISO8601 format).
example: '2024-01-20T14:45:00Z'
user_count:
type: integer
format: int32
description: Number of users in this group
example: 25
title: ApiGroup
title: RestApiResponseApiGroup
description: OK
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'429':
description: Rate Limit Exceeded
security:
- OAuth2ClientCredentials: []
patch:
operationId: updateGroup
summary: Update a group
description: A PATCH request sent to the endpoint root followed by a unique identifier updates the properties of a specific access-management group.
tags:
- access-management
parameters:
- description: The unique identifier for the Upwind organization.
example: org_Xk9mPq7RtYwN2vLs
in: path
name: organization-id
required: true
schema:
type: string
- description: The unique identifier for the group.
in: path
name: group-id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
properties:
permissions:
type: array
items:
type: object
properties:
role_ids:
type: array
items:
type: string
minItems: 1
scope_id:
type: string
minLength: 1
required:
- role_ids
- scope_id
title: ApiUpdateGroupPermission
title: ApiUpdateAccessManagementGroupRequest
required: true
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful API response containing items
properties:
items:
type: array
description: The list of items in the response
items:
type: object
description: A group representing a collection of users with assigned permissions
properties:
create_time:
type: string
format: date-time
description: Timestamp when the group was created (in ISO8601 format).
example: '2024-01-15T10:30:00Z'
id:
type: string
description: Unique identifier for this group
example: upwind_readers
identity_provider_name:
type: string
description: Identity provider name for this group
example: okta
name:
type: string
description: Group name
example: Upwind Readers
permissions:
type: array
description: List of permission bindings (scope-roles) for this group
items:
type: object
description: A permission binding for a group, associating a scope with role IDs
properties:
role_ids:
type: array
description: List of role IDs assigned for this scope
example:
- uamr_security_architect
items:
type: string
scope_id:
type: string
description: Scope identifier
example: scope-prod-123
scope_name:
type: string
description: Scope name
example: Production Environment
title: ApiGroupPermission
update_time:
type: string
format: date-time
description: Timestamp when the group was last updated (in ISO8601 format).
example: '2024-01-20T14:45:00Z'
user_count:
type: integer
format: int32
description: Number of users in this group
example: 25
title: ApiGroup
title: RestApiResponseApiGroup
description: OK
'401':
description: Unauthorized
'403':
description: Forbidden
'4
# --- truncated at 32 KB (63 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/upwind/refs/heads/main/openapi/upwind-access-management-api-openapi.yml