VAST Data Tenants API

openapi: 3.0.3
info:
  description: VAST Management API definition
  title: VAST API Swagger Schema activedirectory Tenants API
  version: '1.0'
security:
- ApiToken: []
tags:
- name: Tenants
paths:
  /tenants/{id}/views_count:
    get:
      description: Returns the number of views in the tenant.
      operationId: get_tenant_views_count
      parameters:
      - $ref: '#/components/parameters/TenantId'
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  current_views_count:
                    description: The number of views in this tenant
                    type: integer
                  max_views:
                    description: Maximum views allowed in this tenant
                    type: integer
                type: object
          description: ''
      summary: Get the number of views in the tenant
      tags:
      - Tenants
  /tenants/:
    get:
      description: This endpoint lists tenants.
      operationId: tenants_list
      parameters:
      - $ref: '#/components/parameters/Page'
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/NameIContainsQP'
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/Tenant'
                title: Tenants
                type: array
          description: Tenant information
      summary: List Tenants
      tags:
      - Tenants
    post:
      description: This endpoint creates a tenant.
      operationId: tenants_create
      requestBody:
        content:
          application/json:
            schema:
              properties:
                access_ip_ranges:
                  description: Restricts tenant login access to specified source IP ranges. Enter as single IPs (1.1.1.1), ranges (1.2.3.4 - 1.2.3.6), or CIDR (1.1.1.0/24).
                  items:
                    type: string
                  type: array
                ad_provider_id:
                  description: The ID of an Active Directory provider configured on the cluster. Enables the specified provider for the tenant.
                  type: integer
                allow_disabled_users:
                  description: Allow IO from users whose Active Directory accounts are explicitly disabled.
                  type: boolean
                allow_locked_users:
                  description: Allow IO from users whose Active Directory accounts are locked out by lockout policies due to unsuccessful login attempts.
                  type: boolean
                allowed_delegations:
                  description: Defines the possible types of NFSv4 delegations
                  enum:
                  - NONE
                  - READ
                  - WRITE
                  - READ_WRITE
                  type: string
                application_users_group_name:
                  description: The name of the group that will be used for application users
                  type: string
                capacity_rules:
                  $ref: '#/components/schemas/CapacityRules'
                client_ip_ranges:
                  description: 'Array of ranges of client IPs to be served by the tenant. For client requests made to a VIP that belongs to a VIP Pool that is not associated to a specific tenant, the client''s source IP is checked against the Client IPs that are defined within each tenant. That check determines access. The client IPs that you associate with each tenant must be unique per tenant. '
                  items:
                    items:
                      type: string
                    type: array
                  type: array
                default_others_share_level_perm:
                  description: Default Share-level permissions for Others
                  enum:
                  - READ
                  - CHANGE
                  - FULL
                  type: string
                domain_name:
                  description: Domain name to incorporate into the VMS tenant login page URL.
                  type: string
                encryption_crn:
                  description: Tenant's encryption group unique identifier (deprecated)
                  type: string
                encryption_group:
                  description: Tenant's encryption group unique identifier
                  type: string
                grant_unrequested_delegations_by_default:
                  description: When enabled, the server may grant delegations based on share access even if not explicitly requested by the client
                  type: boolean
                identity_provider_name:
                  description: The ID of a SAML provider configured on the cluster. Connects the specified provider to the tenant.
                  type: string
                is_nfsv42_supported:
                  description: Enable NFSv4.2
                  type: boolean
                krb_provider_id:
                  description: Kerberos provider ID
                  type: integer
                ldap_provider_id:
                  description: The ID of an LDAP provider configured on the cluster. Enables the specified provider for the tenant.
                  type: integer
                local_provider_id:
                  description: The ID of a local provider configured on the cluster. Connects the specified provider to the tenant.
                  type: integer
                login_name_primary_provider:
                  description: Login name primary provider type
                  enum:
                  - NONE
                  - LDAP
                  - NIS
                  - AD
                  - LOCAL
                  type: string
                max_views:
                  description: Max views we can create on this tenant (0:unlimted as default)
                  type: integer
                  x-cli-header: Max Views
                mtls_identifier:
                  description: The mTLS identifier of the tenant
                  type: string
                name:
                  description: A name for the tenant
                  type: string
                nis_provider_id:
                  description: The ID of a NIS provider configured on the cluster. Enables the specified provider for the tenant.
                  type: integer
                oidc_provider_id:
                  description: OIDC provider ID
                  type: integer
                posix_primary_provider:
                  description: Specifies which provider takes precedence over other providers in case of any conflicts between attribute values when user information is retrieved from the providers. Relevant only if more than one provider is enabled for the tenant.
                  enum:
                  - NONE
                  - LDAP
                  - NIS
                  - AD
                  type: string
                preferred_owning_group:
                  description: Set to prefer GID of the user as the owning group of the file
                  enum:
                  - PROTOCOL_BASED
                  - POSIX_GID
                  type: string
                qos:
                  $ref: '#/components/schemas/RequestTruncatedQOS'
                require_smb_signing:
                  description: Require SMB signing
                  type: boolean
                smb_administrators_group_name:
                  description: Optional custom name to specify a non default privileged group. If not set, privileged group is the Backup Operators domain group.
                  type: string
                smb_encryption_state:
                  description: Defines the encryption level for SMB
                  enum:
                  - 'OFF'
                  - AVAILABLE
                  - DESIRED
                  - REQUIRED
                  type: string
                smb_privileged_group_full_access:
                  description: True=The SMB privileged user group has read and write control access. Members of the group can perform backup and restore operations on all files and directories, without requiring read or write access to the specific files and directories. False=the privileged group has read only access.
                  type: boolean
                  x-cli-header: Enable privileged domain group restore access
                smb_privileged_group_sid:
                  description: Optional custom SID to specify a non default SMB privileged group. If not set, SMB privileged group is the Backup Operators domain group.
                  type: string
                smb_privileged_user_name:
                  description: Optional custom username for the SMB privileged user. If not set, the SMB privileged user name is 'vastadmin'
                  type: string
                tenant_admins_group_name:
                  description: Specifies a group on an AD or LDAP provider. Enables users in the group to log into the tenant VMS as Tenant Admin users. In order to be granted permissions to do any configuration, the same users need to belong to groups on the provider that are associated with VMS manager user roles for tenant admin type users on the tenant.
                  type: string
                trash_gid:
                  description: GID of group of NFSv3 users to which to grant permission to move files into the trash folder. If not set, the operation of moving files into the trash folder is supported for the root user only.
                  type: integer
                use_smb_native:
                  description: Use native SMB authentication
                  type: boolean
                use_smb_privileged_group:
                  description: Enables SMB privileged user group
                  type: boolean
                  x-cli-header: Enable privileged domain group backup access
                use_smb_privileged_user:
                  description: Enables SMB privileged user
                  type: boolean
              required:
              - name
              type: object
        x-originalParamName: TenantCreateParams
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Tenant'
          description: ''
      summary: Create Tenant
      tags:
      - Tenants
  /tenants/configured_idp/:
    get:
      description: This endpoint returns a tenant's configured SAML identity provider.
      operationId: get_configured_idp_for_tenant
      parameters:
      - description: Tenant name
        in: query
        name: name
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  identity_provider_name:
                    type: string
                title: Identity Provider
                type: object
          description: ''
      summary: Return Configured Identity Provider for Tenant
      tags:
      - Tenants
  /tenants/metric_labels/:
    get:
      description: This endpoint lists all available tenant metric labels.
      operationId: tenant_metric_labels_list
      parameters:
      - $ref: '#/components/parameters/Page'
      - $ref: '#/components/parameters/PageSize'
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/TenantMetricLabel'
                type: array
          description: A list of tenant metric labels.
      summary: List Tenant Metric Labels
      tags:
      - Tenants
    post:
      description: This endpoint creates a new tenant metric label.
      operationId: tenant_metric_labels_create
      requestBody:
        content:
          '*/*':
            schema:
              properties:
                default_value:
                  description: The default value for this metric label.
                  maxLength: 64
                  type: string
                description:
                  description: Description of the metric label purpose.
                  maxLength: 1024
                  type: string
                key:
                  description: The unique key for the metric label.
                  maxLength: 32
                  type: string
              required:
              - key
              type: object
        x-originalParamName: TenantMetricLabelCreateParams
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantMetricLabel'
          description: Metric label created successfully.
      summary: Create Tenant Metric Label
      tags:
      - Tenants
  /tenants/metric_labels/{id}/:
    delete:
      description: This endpoint deletes a tenant metric label.
      operationId: tenant_metric_labels_delete
      parameters:
      - $ref: '#/components/parameters/PathObjectId'
      responses:
        '204':
          description: Metric label deleted successfully.
      summary: Delete Tenant Metric Label
      tags:
      - Tenants
    get:
      description: This endpoint retrieves a specific tenant metric label.
      operationId: tenant_metric_labels_get
      parameters:
      - $ref: '#/components/parameters/PathObjectId'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantMetricLabel'
          description: Metric label details.
      summary: Get Tenant Metric Label
      tags:
      - Tenants
  /tenants/remote_objects/:
    get:
      description: Returns details of remote tenants.
      operationId: get_remote_tenants
      parameters:
      - description: Filter remote tenants by name
        in: query
        name: name
        schema:
          type: string
      - description: Filter remote tenants by target
        in: query
        name: target_id
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/RemoteTenant'
                title: Tenants
                type: array
          description: ''
      summary: Return Details of Remote Tenants
      tags:
      - Tenants
  /tenants/{id}/:
    delete:
      description: Deletes a specified tenant.
      operationId: tenants_delete
      parameters:
      - $ref: '#/components/parameters/TenantId'
      - description: Forces deletion of the tenant, even if files exist in the tenant directory.
        in: query
        name: force_remove
        schema:
          type: boolean
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AsyncTaskInResponse'
          description: ''
        '204':
          description: ''
      summary: Delete Tenant
      tags:
      - Tenants
    get:
      description: Returns details of a specified tenant.
      operationId: tenants_read
      parameters:
      - $ref: '#/components/parameters/TenantId'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Tenant'
          description: ''
      summary: Return Details of Tenant
      tags:
      - Tenants
    patch:
      description: Modifies a specified tenant.
      operationId: tenants_partial_update
      parameters:
      - $ref: '#/components/parameters/TenantId'
      requestBody:
        content:
          application/json:
            schema:
              properties:
                access_ip_ranges:
                  description: Restricts tenant login access to specified source IP ranges. Enter as single IPs (1.1.1.1), ranges (1.2.3.4 - 1.2.3.6), or CIDR (1.1.1.0/24).
                  items:
                    type: string
                  type: array
                ad_provider_id:
                  description: Active Directory provider ID
                  type: integer
                allow_disabled_users:
                  description: Allow IO from users whose Active Directory accounts are explicitly disabled.
                  type: boolean
                allow_locked_users:
                  description: Allow IO from users whose Active Directory accounts are locked out by lockout policies due to unsuccessful login attempts.
                  type: boolean
                allowed_delegations:
                  description: Defines the possible types of NFSv4 delegations
                  enum:
                  - NONE
                  - READ
                  - WRITE
                  - READ_WRITE
                  type: string
                application_users_group_name:
                  description: The name of the group that will be used for application users
                  type: string
                capacity_rules:
                  $ref: '#/components/schemas/CapacityRules'
                client_ip_ranges:
                  description: Array of ranges of client IPs to be served by the tenant. For client requests made to a VIP that belongs to a VIP Pool that is not associated to a specific tenant, the client's source IP is checked against the Client IPs that are defined within each tenant. That check determines access. The client IPs that you associate with each tenant must be unique per tenant.
                  items:
                    items:
                      type: string
                    type: array
                  type: array
                data_engine_role_enabled:
                  description: Whether to create dedicated Role for application users group
                  type: boolean
                data_engine_s3_policy_enabled:
                  description: Whether to create dedicated Identity Policy for application users group
                  type: boolean
                default_others_share_level_perm:
                  description: Default Share-level permissions for Others
                  enum:
                  - READ
                  - CHANGE
                  - FULL
                  type: string
                domain_name:
                  description: Domain name to incorporate into the VMS tenant login page URL.
                  type: string
                grant_unrequested_delegations_by_default:
                  description: When enabled, the server may grant delegations based on share access even if not explicitly requested by the client
                  type: boolean
                identity_provider_name:
                  description: Sets a configured SAML login provider to enable for the tenant. When set, users defined on the specified SAML provider can login to the tenant VMS as tenant admin users.
                  type: string
                is_nfsv42_supported:
                  description: Enable NFSv4.2
                  type: boolean
                krb_provider_id:
                  description: Kerberos provider ID
                  type: integer
                ldap_provider_id:
                  description: Open-LDAP provider ID specified separately by the user
                  type: integer
                local_provider_id:
                  description: Local provider ID
                  type: integer
                login_name_primary_provider:
                  description: Login name primary provider type
                  enum:
                  - NONE
                  - LDAP
                  - NIS
                  - AD
                  - LOCAL
                  type: string
                max_views:
                  description: Max views we can create on this tenant (0:unlimted as default)
                  type: integer
                  x-cli-header: Max Views
                mtls_identifier:
                  description: The mTLS identifier of the tenant
                  type: string
                nis_provider_id:
                  description: NIS provider ID
                  type: integer
                oidc_provider_id:
                  description: OIDC provider ID
                  type: integer
                posix_primary_provider:
                  description: POSIX primary provider type
                  enum:
                  - NONE
                  - LDAP
                  - NIS
                  - AD
                  type: string
                preferred_owning_group:
                  description: Set to prefer GID of the user as the owning group of the file
                  enum:
                  - PROTOCOL_BASED
                  - POSIX_GID
                  type: string
                qos:
                  $ref: '#/components/schemas/RequestTruncatedQOS'
                require_smb_signing:
                  description: Require SMB signing
                  type: boolean
                smb_administrators_group_name:
                  description: Optional custom name to specify a non default privileged group. If not set, privileged group is the Backup Operators domain group.
                  type: string
                smb_encryption_state:
                  description: Defines the encryption level for SMB
                  enum:
                  - 'OFF'
                  - AVAILABLE
                  - DESIRED
                  - REQUIRED
                  type: string
                smb_privileged_group_full_access:
                  description: True=The SMB privileged user group has read and write control access. Members of the group can perform backup and restore operations on all files and directories, without requiring read or write access to the specific files and directories. False=the privileged group has read only access.
                  type: boolean
                  x-cli-header: Enable privileged domain group restore access
                smb_privileged_group_sid:
                  description: Optional custom SID to specify a non default SMB privileged group. If not set, SMB privileged group is the Backup Operators domain group.
                  type: string
                smb_privileged_user_name:
                  description: Optional custom username for the SMB privileged user. If not set, the SMB privileged user name is 'vastadmin'
                  type: string
                tenant_admins_group_name:
                  description: Specifies a group on an AD or LDAP provider. Enables users in the group to log into the tenant VMS as Tenant Admin users. In order to be granted permissions to do any configuration, the same users need to belong to groups on the provider that are associated with VMS manager user roles for tenant admin type users on the tenant.
                  type: string
                trash_gid:
                  description: GID with permissions to the trash folder
                  type: integer
                use_smb_native:
                  description: Use native SMB authentication
                  type: boolean
                use_smb_privileged_group:
                  description: Enables SMB privileged user group
                  type: boolean
                  x-cli-header: Enable privileged domain group backup access
                use_smb_privileged_user:
                  description: Enables SMB privileged user
                  type: boolean
              type: object
        x-originalParamName: TenantModifyParams
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Tenant'
          description: ''
      summary: Modify Tenant
      tags:
      - Tenants
  /tenants/{id}/client_ip_ranges/:
    patch:
      description: Updates Client IP ranges of a Tenant.
      operationId: tenant_update_client_ip_ranges
      parameters:
      - $ref: '#/components/parameters/TenantId'
      requestBody:
        content:
          '*/*':
            schema:
              properties:
                client_ip_ranges_to_add:
                  description: Array of source IP ranges to allow for the tenant.
                  items:
                    items:
                      type: string
                    type: array
                  type: array
                client_ip_ranges_to_remove:
                  description: Array of source IP ranges to disallow for the tenant.
                  items:
                    items:
                      type: string
                    type: array
                  type: array
              type: object
        x-originalParamName: TenantClientIpRangesModifyParams
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Tenant'
          description: ''
      summary: Update tenant Client IP ranges
      tags:
      - Tenants
  /tenants/{id}/client_metrics/:
    get:
      description: this endpoint returns tenant client metrics settings.
      operationId: tenant_get_client_metrics
      parameters:
      - $ref: '#/components/parameters/TenantId'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantClientMetrics'
          description: ''
      summary: get tenant client metrics settings
      tags:
      - Tenants
    patch:
      description: This endpoint updates client metrics settings for a tenant.
      operationId: tenant_update_client_metrics
      parameters:
      - $ref: '#/components/parameters/TenantId'
      requestBody:
        content:
          '*/*':
            schema:
              properties:
                config:
                  properties:
                    bucket_name:
                      description: The name of the client metrics database S3 bucket
                      type: string
                    bucket_owner:
                      description: The user designated as the S3 bucket owner for the client metrics database for the tenant.
                      type: string
                    enabled:
                      description: Enables collection of client metrics. If you enable the collection of client metrics, make sure bucket_owner and bucket_name are set as well.
                      type: boolean
                    max_capacity_mb:
                      description: The maximum size of the client metrics database, in MBB. If the limit is reached, older data is deleted from the database.
                      type: integer
                    retention_time_sec:
                      description: The retention period, in seconds, for client metrics data that is stored in the client metrics database. Data older than this time is deleted from the database.
                      type: integer
                  required:
                  - enabled
                  type: object
                user_defined_columns:
                  description: Description of table columns
                  items:
                    $ref: '#/components/schemas/TabularColumnArrowSchema'
                  type: array
              type: object
        x-originalParamName: TenantClientMetricsModifyParams
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantClientMetrics'
          description: ''
      summary: Update Tenant Client Metrics Settings
      tags:
      - Tenants
  /tenants/{id}/deactivate_encryption_group/:
    post:
      description: This endpoint deactivates a tenant's encryption group. Deactivated keys are revoked and destroyed. They cannot be reinstated. The encrypted data becomes inaccessible forever.
      operationId: tenant_deactivate_encryption_group
      parameters:
      - $ref: '#/components/parameters/TenantId'
      responses:
        '204':
          description: Tenant's encryption group was deactivated successfully.
        '409':
          content:
            application/json:
              schema:
                properties:
                  detail:
                    example: Encryption group was not found by its key <encryption_group>.
                    type: string
                type: object
          description: The request could not be completed due to a conflict with the current state.
        '503':
          content:
            application/json:
              schema:
                properties:
                  detail:
                    example: Failed to deactivate encryption group.
                    type: string
                type: object
          description: Service temporarily unavailable, try again later.
      summary: Deactivate tenant's encryption group.
      tags:
      - Tenants
  /tenants/{id}/is_operation_healthy:
    post:
      description: Returns warnings about the future state if operation is performed.
      operationId: tenants_is_operation_healthy
      parameters:
      - $ref: '#/components/parameters/TenantId'
      - in: query
        name: operation
        schema:
          enum:
          - modify
          type: string
      requestBody:
        content:
          application/json:
            schema:
              properties:
                ad_provider_id:
                  description: Active Directory provider ID
                  type: integer
                client_ip_ranges:
                  description: Array of source IP ranges to allow for the tenant.
                  items:
                    items:
                      type: string
                    type: array
                  type: array
                default_others_share_level_perm:
                  description: Default Share-level permissions for Others
                  enum:
                  - READ
                  - CHANGE
                  - FULL
                  type: string
                ldap_provider_id:
                  description: Open-LDAP provider ID specified separately by the user
                  type: integer
                local_provider_id:
                  description: Local provider ID
                  type: integer
                nis_provider_id:
                  description: NIS provider ID
                  type: integer
                posix_primary_provider:
                  description: POSIX primary provider type
                  enum:
                  - NONE
                  - LDAP
                  - NIS
                  - AD
                  type: string
                smb_administrators_group_name:
                  description: Optional custom name to specify a non default privileged group. If not set, privileged group is the BUILTIN\Administrators group.
                  type: string
                smb_privileged_group_full_access:
                  description: If true, the privileged group has full access. Otherwise, read only
                  type: boolean
                  x-cli-header: Enable privileged domain group restore access
                smb_privileged_group_sid:
                  description: Optional custom SID to specify a non default SMB privileged group. If not set, SMB privileged group is the Backup Operators domain group.
                  type: string
                smb_privileged_user_name:
                  description: Optional custom username for the SMB privileged user. If not set, the SMB privileged user name is 'vastadmin'
                  type: string
                trash_gid:
                  description: GID with permissions to the trash folder
                  type: integer
                use_smb_privileged_group:
                  description: If true, the privileged group is enabled
                  type: boolean
                  x-cli-header: Enable privileged domain group backup access
                use_smb_privileged_user:
                  description: If true, the privileged user is enabled
                  type: boolean
              type: object
        x-originalParamName: TenantIsOperationHealthyParams
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Warnings'
          description: ''
      summary: Check whether an operation may be successfully performed
      tags:
      - Tenants
  /tenants/{id}/nfs4_deleg/:
    delete:
      description: Remove NFSv4 deleg

# --- truncated at 32 KB (68 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/vastdata/refs/heads/main/openapi/vastdata-tenants-api-openapi.yml