Verta AuthzService API

openapi: 3.2.0
info:
  title: deployment/APISync.proto Authz Service API
  version: version not set
servers:
- url: /v1
tags:
- name: AuthzService
paths:
  /authz/getAllowedEntities:
    post:
      operationId: AuthzService_getAllowedEntities
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/uacGetAllowedEntitiesResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/runtimeError'
      tags:
      - AuthzService
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/uacGetAllowedEntities'
        required: true
  /authz/getSelfAllowedActionsBatch:
    post:
      operationId: AuthzService_getSelfAllowedActionsBatch
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/uacGetSelfAllowedActionsBatchResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/runtimeError'
      tags:
      - AuthzService
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/uacGetSelfAllowedActionsBatch'
        required: true
  /authz/getSelfAllowedResources:
    post:
      operationId: AuthzService_getSelfAllowedResources
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/uacGetSelfAllowedResourcesResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/runtimeError'
      tags:
      - AuthzService
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/uacGetSelfAllowedResources'
        required: true
  /authz/isSelfAllowed:
    post:
      operationId: AuthzService_isSelfAllowed
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/uacIsSelfAllowedResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/runtimeError'
      tags:
      - AuthzService
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/uacIsSelfAllowed'
        required: true
components:
  schemas:
    uacGetAllowedEntitiesResponse:
      type: object
      properties:
        entities:
          type: array
          items:
            $ref: '#/components/schemas/uacEntities'
        total_records:
          type: string
          format: int64
    DeploymentActionEnumDeploymentServiceActions:
      type: string
      enum:
      - UNKNOWN
      - ALL
      - CREATE
      - READ
      - UPDATE
      - DELETE
      - UPDATE_PERMISSIONS
      - PREDICT
      - CONTROL
      default: UNKNOWN
    commonPagination:
      type: object
      properties:
        page_number:
          type: integer
          format: int32
        page_limit:
          type: integer
          format: int32
      title: For pagination
    AuthzActionEnumAuthzServiceActions:
      type: string
      enum:
      - UNKNOWN
      - ALL
      - IS_ALLOWED
      - GET
      - CREATE
      - READ
      - UPDATE
      - DELETE
      - READ_SECRETS
      - CREATE_SERVICE_ACCOUNT
      - CREATE_CONTAINER_REGISTRY
      - CREATE_WEBHOOK
      - CREATE_GROUP
      default: UNKNOWN
    ModelDBActionEnumModelDBServiceActions:
      type: string
      enum:
      - UNKNOWN
      - ALL
      - CREATE
      - READ
      - UPDATE
      - DELETE
      - DEPLOY
      - PUBLIC_READ
      - UPDATE_PERMISSIONS
      - LOCK
      - UNLOCK
      - UPDATE_REDACT
      - ALERTER
      - PREDICT
      - CONTROL
      - IS_ALLOWED
      - GET
      - READ_SECRETS
      - CREATE_SERVICE_ACCOUNT
      - CREATE_CONTAINER_REGISTRY
      - PROMOTE
      default: UNKNOWN
    uacEntities:
      type: object
      properties:
        user_ids:
          type: array
          items:
            type: string
        org_ids:
          type: array
          items:
            type: string
        team_ids:
          type: array
          items:
            type: string
        group_ids:
          type: array
          items:
            type: string
      description: Entities that can be bound to a role. All users in all scopes given are considered a match.
    uacActions:
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/uacAction'
    uacGetAllowedEntities:
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/uacAction'
        resources:
          type: array
          items:
            $ref: '#/components/schemas/uacResources'
        pagination:
          $ref: '#/components/schemas/commonPagination'
      title: 'Answers the question "what `entities` are allowed to perform any of `actions` on any of `resources`?"

        Lists all entities that are allowed to perform a certain action on certain resources'
    uacResourceType:
      type: object
      properties:
        role_service_resource_type:
          $ref: '#/components/schemas/RoleResourceEnumRoleServiceResourceTypes'
          title: Separate based on the service itself
        authz_service_resource_type:
          $ref: '#/components/schemas/AuthzResourceEnumAuthzServiceResourceTypes'
        modeldb_service_resource_type:
          $ref: '#/components/schemas/ModelDBResourceEnumModelDBServiceResourceTypes'
        deployment_service_resource_type:
          $ref: '#/components/schemas/DeploymentResourceEnumDeploymentServiceResourceTypes'
    RoleActionEnumRoleServiceActions:
      type: string
      enum:
      - UNKNOWN
      - ALL
      - GET_BY_ID
      - GET_BY_NAME
      - CREATE
      - UPDATE
      - LIST
      - DELETE
      default: UNKNOWN
    uacAction:
      type: object
      properties:
        service:
          $ref: '#/components/schemas/ServiceEnumService'
        role_service_action:
          $ref: '#/components/schemas/RoleActionEnumRoleServiceActions'
        authz_service_action:
          $ref: '#/components/schemas/AuthzActionEnumAuthzServiceActions'
        modeldb_service_action:
          $ref: '#/components/schemas/ModelDBActionEnumModelDBServiceActions'
        deployment_service_action:
          $ref: '#/components/schemas/DeploymentActionEnumDeploymentServiceActions'
      title: An action describes a specific operation that can be performed on a service
    uacGetSelfAllowedActionsBatch:
      type: object
      properties:
        resources:
          $ref: '#/components/schemas/uacResources'
    runtimeError:
      type: object
      properties:
        error:
          type: string
        code:
          type: integer
          format: int32
        message:
          type: string
        details:
          type: array
          items:
            $ref: '#/components/schemas/protobufAny'
    AuthzResourceEnumAuthzServiceResourceTypes:
      type: string
      enum:
      - UNKNOWN
      - ALL
      - ORGANIZATION
      - TEAM
      - WORKSPACE
      - USER
      - SERVICE_ACCOUNT
      - CONTAINER_REGISTRY_CONFIGURATION
      - EVENT
      - WEBHOOK
      - SYSTEM_ADMIN
      - PYPI_CONFIGURATION
      - KAFKA_CONFIGURATION
      - SCIM_CONFIGURATION
      - GROUP
      default: UNKNOWN
    uacGetSelfAllowedResourcesResponse:
      type: object
      properties:
        resources:
          type: array
          items:
            $ref: '#/components/schemas/uacResources'
        total_records:
          type: string
          format: int64
    uacIsSelfAllowed:
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/uacAction'
        resources:
          type: array
          items:
            $ref: '#/components/schemas/uacResources'
      title: Same as IsAllowed, but infers entities from the current logged user
    uacGetSelfAllowedActionsBatchResponse:
      type: object
      properties:
        actions:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/uacActions'
    uacGetSelfAllowedResources:
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/uacAction'
        resource_type:
          $ref: '#/components/schemas/uacResourceType'
        service:
          $ref: '#/components/schemas/ServiceEnumService'
        pagination:
          $ref: '#/components/schemas/commonPagination'
      title: Same as GetAllowedResources, but infers entities from the current logged user
    protobufAny:
      type: object
      properties:
        type_url:
          type: string
          description: "A URL/resource name that uniquely identifies the type of the serialized\nprotocol buffer message. This string must contain at least\none \"/\" character. The last segment of the URL's path must represent\nthe fully qualified name of the type (as in\n`path/google.protobuf.Duration`). The name should be in a canonical form\n(e.g., leading \".\" is not accepted).\n\nIn practice, teams usually precompile into the binary all types that they\nexpect it to use in the context of Any. However, for URLs which use the\nscheme `http`, `https`, or no scheme, one can optionally set up a type\nserver that maps type URLs to message definitions as follows:\n\n* If no scheme is provided, `https` is assumed.\n* An HTTP GET on the URL must yield a [google.protobuf.Type][]\n  value in binary format, or produce an error.\n* Applications are allowed to cache lookup results based on the\n  URL, or have them precompiled into a binary to avoid any\n  lookup. Therefore, binary compatibility needs to be preserved\n  on changes to types. (Use versioned type names to manage\n  breaking changes.)\n\nNote: this functionality is not currently available in the official\nprotobuf release, and it is not used for type URLs beginning with\ntype.googleapis.com.\n\nSchemes other than `http`, `https` (or the empty scheme) might be\nused with implementation specific semantics."
        value:
          type: string
          format: byte
          description: Must be a valid serialized protocol buffer of the above specified type.
      description: "`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nProtobuf library provides support to pack/unpack Any values in the form\nof utility functions or additional generated methods of the Any type.\n\nExample 1: Pack and unpack a message in C++.\n\n    Foo foo = ...;\n    Any any;\n    any.PackFrom(foo);\n    ...\n    if (any.UnpackTo(&foo)) {\n      ...\n    }\n\nExample 2: Pack and unpack a message in Java.\n\n    Foo foo = ...;\n    Any any = Any.pack(foo);\n    ...\n    if (any.is(Foo.class)) {\n      foo = any.unpack(Foo.class);\n    }\n\n Example 3: Pack and unpack a message in Python.\n\n    foo = Foo(...)\n    any = Any()\n    any.Pack(foo)\n    ...\n    if any.Is(Foo.DESCRIPTOR):\n      any.Unpack(foo)\n      ...\n\n Example 4: Pack and unpack a message in Go\n\n     foo := &pb.Foo{...}\n     any, err := ptypes.MarshalAny(foo)\n     ...\n     foo := &pb.Foo{}\n     if err := ptypes.UnmarshalAny(any, foo); err != nil {\n       ...\n     }\n\nThe pack methods provided by protobuf library will by default use\n'type.googleapis.com/full.type.name' as the type URL and the unpack\nmethods only use the fully qualified type name after the last '/'\nin the type URL, for example \"foo.bar.com/x/y.z\" will yield type\nname \"y.z\".\n\n\nJSON\n====\nThe JSON representation of an `Any` value uses the regular\nrepresentation of the deserialized, embedded message, with an\nadditional field `@type` which contains the type URL. Example:\n\n    package google.profile;\n    message Person {\n      string first_name = 1;\n      string last_name = 2;\n    }\n\n    {\n      \"@type\": \"type.googleapis.com/google.profile.Person\",\n      \"firstName\": <string>,\n      \"lastName\": <string>\n    }\n\nIf the embedded message type is well-known and has a custom JSON\nrepresentation, that representation will be embedded adding a field\n`value` which holds the custom JSON in addition to the `@type`\nfield. Example (for message [google.protobuf.Duration][]):\n\n    {\n      \"@type\": \"type.googleapis.com/google.protobuf.Duration\",\n      \"value\": \"1.212s\"\n    }"
    RoleResourceEnumRoleServiceResourceTypes:
      type: string
      enum:
      - UNKNOWN
      - ALL
      - ROLE
      - ROLE_BINDING
      default: UNKNOWN
    uacIsSelfAllowedResponse:
      type: object
      properties:
        allowed:
          type: boolean
    ModelDBResourceEnumModelDBServiceResourceTypes:
      type: string
      enum:
      - UNKNOWN
      - ALL
      - PROJECT
      - EXPERIMENT
      - EXPERIMENT_RUN
      - DATASET
      - DATASET_VERSION
      - DASHBOARD
      - REPOSITORY
      - REGISTERED_MODEL
      - REGISTERED_MODEL_VERSION
      - MONITORED_ENTITY
      - NOTIFICATION_CHANNEL
      - ENDPOINT
      - BUILD
      - ORGANIZATION
      - TEAM
      - WORKSPACE
      - USER
      - SERVICE_ACCOUNT
      - CONTAINER_REGISTRY_CONFIGURATION
      - STAGE
      - PROFILER
      default: UNKNOWN
    uacResources:
      type: object
      properties:
        service:
          $ref: '#/components/schemas/ServiceEnumService'
        resource_ids:
          type: array
          items:
            type: string
          title: Internal ID for the resource in the service, whose meaning doesn't matter for other services
        all_resource_ids:
          type: boolean
        resource_type:
          $ref: '#/components/schemas/uacResourceType'
      title: A resource describes a specific object in a service that can receive an action
    ServiceEnumService:
      type: string
      enum:
      - UNKNOWN
      - ALL
      - ROLE_SERVICE
      - AUTHZ_SERVICE
      - MODELDB_SERVICE
      - DEPLOYMENT_SERVICE
      - REGISTRY_SERVICE
      - MONITORING_SERVICE
      default: UNKNOWN
    DeploymentResourceEnumDeploymentServiceResourceTypes:
      type: string
      enum:
      - UNKNOWN
      - ALL
      - ENDPOINT
      - BUILD
      default: UNKNOWN