OpenAPI Specification
openapi: 3.1.0
info:
title: authorization authorization.AuthorizationService policy.obligations.Service API
description: '/
/ Obligation Service
/'
security: []
tags:
- name: policy.obligations.Service
description: '/
/ Obligation Service
/'
paths:
/policy.obligations.Service/ListObligations:
post:
tags:
- policy.obligations.Service
summary: ListObligations
operationId: policy.obligations.Service.ListObligations
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.ListObligationsRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.ListObligationsResponse'
/policy.obligations.Service/GetObligation:
post:
tags:
- policy.obligations.Service
summary: GetObligation
operationId: policy.obligations.Service.GetObligation
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.GetObligationRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.GetObligationResponse'
/policy.obligations.Service/GetObligationsByFQNs:
post:
tags:
- policy.obligations.Service
summary: GetObligationsByFQNs
operationId: policy.obligations.Service.GetObligationsByFQNs
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.GetObligationsByFQNsRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.GetObligationsByFQNsResponse'
/policy.obligations.Service/CreateObligation:
post:
tags:
- policy.obligations.Service
summary: CreateObligation
operationId: policy.obligations.Service.CreateObligation
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.CreateObligationRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.CreateObligationResponse'
/policy.obligations.Service/UpdateObligation:
post:
tags:
- policy.obligations.Service
summary: UpdateObligation
operationId: policy.obligations.Service.UpdateObligation
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.UpdateObligationRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.UpdateObligationResponse'
/policy.obligations.Service/DeleteObligation:
post:
tags:
- policy.obligations.Service
summary: DeleteObligation
operationId: policy.obligations.Service.DeleteObligation
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.DeleteObligationRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.DeleteObligationResponse'
/policy.obligations.Service/GetObligationValue:
post:
tags:
- policy.obligations.Service
summary: GetObligationValue
operationId: policy.obligations.Service.GetObligationValue
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.GetObligationValueRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.GetObligationValueResponse'
/policy.obligations.Service/GetObligationValuesByFQNs:
post:
tags:
- policy.obligations.Service
summary: GetObligationValuesByFQNs
operationId: policy.obligations.Service.GetObligationValuesByFQNs
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.GetObligationValuesByFQNsRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.GetObligationValuesByFQNsResponse'
/policy.obligations.Service/CreateObligationValue:
post:
tags:
- policy.obligations.Service
summary: CreateObligationValue
operationId: policy.obligations.Service.CreateObligationValue
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.CreateObligationValueRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.CreateObligationValueResponse'
/policy.obligations.Service/UpdateObligationValue:
post:
tags:
- policy.obligations.Service
summary: UpdateObligationValue
operationId: policy.obligations.Service.UpdateObligationValue
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.UpdateObligationValueRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.UpdateObligationValueResponse'
/policy.obligations.Service/DeleteObligationValue:
post:
tags:
- policy.obligations.Service
summary: DeleteObligationValue
operationId: policy.obligations.Service.DeleteObligationValue
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.DeleteObligationValueRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.DeleteObligationValueResponse'
/policy.obligations.Service/GetObligationTrigger:
post:
tags:
- policy.obligations.Service
summary: GetObligationTrigger
operationId: policy.obligations.Service.GetObligationTrigger
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.GetObligationTriggerRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.GetObligationTriggerResponse'
/policy.obligations.Service/AddObligationTrigger:
post:
tags:
- policy.obligations.Service
summary: AddObligationTrigger
operationId: policy.obligations.Service.AddObligationTrigger
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.AddObligationTriggerRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.AddObligationTriggerResponse'
/policy.obligations.Service/RemoveObligationTrigger:
post:
tags:
- policy.obligations.Service
summary: RemoveObligationTrigger
operationId: policy.obligations.Service.RemoveObligationTrigger
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.RemoveObligationTriggerRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.RemoveObligationTriggerResponse'
/policy.obligations.Service/ListObligationTriggers:
post:
tags:
- policy.obligations.Service
summary: ListObligationTriggers
operationId: policy.obligations.Service.ListObligationTriggers
parameters:
- name: Connect-Protocol-Version
in: header
required: true
schema:
$ref: '#/components/schemas/connect-protocol-version'
- name: Connect-Timeout-Ms
in: header
schema:
$ref: '#/components/schemas/connect-timeout-header'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.ListObligationTriggersRequest'
required: true
responses:
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/connect.error'
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/policy.obligations.ListObligationTriggersResponse'
components:
schemas:
policy.Algorithm:
type: string
title: Algorithm
enum:
- ALGORITHM_UNSPECIFIED
- ALGORITHM_RSA_2048
- ALGORITHM_RSA_4096
- ALGORITHM_EC_P256
- ALGORITHM_EC_P384
- ALGORITHM_EC_P521
- ALGORITHM_HPQT_XWING
- ALGORITHM_HPQT_SECP256R1_MLKEM768
- ALGORITHM_HPQT_SECP384R1_MLKEM1024
- ALGORITHM_MLKEM_768
- ALGORITHM_MLKEM_1024
description: Supported key algorithms.
policy.SubjectMapping:
type: object
properties:
id:
type: string
title: id
attributeValue:
title: attribute_value
description: 'the Attribute Value mapped to; aka: "The Entity Entitlement Attribute"'
$ref: '#/components/schemas/policy.Value'
subjectConditionSet:
title: subject_condition_set
description: the reusable SubjectConditionSet mapped to the given Attribute Value
$ref: '#/components/schemas/policy.SubjectConditionSet'
actions:
type: array
items:
$ref: '#/components/schemas/policy.Action'
title: actions
description: The actions permitted by subjects in this mapping
namespace:
title: namespace
description: "the namespace containing this subject mapping\n possible this is empty. If so that means\n the Subject Mapping has not been migrated to a namespace."
$ref: '#/components/schemas/policy.Namespace'
metadata:
title: metadata
$ref: '#/components/schemas/common.Metadata'
title: SubjectMapping
additionalProperties: false
description: 'Subject Mapping: A Policy assigning Subject Set(s) to a permitted attribute
value + action(s) combination'
common.Metadata:
type: object
properties:
createdAt:
title: created_at
description: created_at set by server (entity who created will recorded in an audit event)
$ref: '#/components/schemas/google.protobuf.Timestamp'
updatedAt:
title: updated_at
description: updated_at set by server (entity who updated will recorded in an audit event)
$ref: '#/components/schemas/google.protobuf.Timestamp'
labels:
type: object
title: labels
additionalProperties:
type: string
title: value
description: optional short description
title: Metadata
additionalProperties: false
description: Struct to uniquely identify a resource with optional additional metadata
policy.obligations.AddObligationTriggerRequest:
type: object
properties:
obligationValue:
title: obligation_value
description: Required
$ref: '#/components/schemas/common.IdFqnIdentifier'
action:
title: action
description: Required
$ref: '#/components/schemas/common.IdNameIdentifier'
attributeValue:
title: attribute_value
description: Required
$ref: '#/components/schemas/common.IdFqnIdentifier'
context:
title: context
description: "Optional\n The request context for this obligation value policy decisioning."
$ref: '#/components/schemas/policy.RequestContext'
metadata:
title: metadata
description: "Optional\n Common metadata"
$ref: '#/components/schemas/common.MetadataMutable'
title: AddObligationTriggerRequest
required:
- obligationValue
- action
- attributeValue
additionalProperties: false
description: "Obligation Triggers are owned by the namespace that owns the action and attribute value, which must\n be the same. In this way, a trigger can intentionally cross namespace boundaries: associating\n obligation values of a different namespace than the one that owns the action being taken or the attribute value."
policy.PolicyEnforcementPoint:
type: object
properties:
clientId:
type: string
title: client_id
minLength: 1
title: PolicyEnforcementPoint
additionalProperties: false
policy.obligations.AddObligationTriggerResponse:
type: object
properties:
trigger:
title: trigger
$ref: '#/components/schemas/policy.ObligationTrigger'
title: AddObligationTriggerResponse
additionalProperties: false
policy.obligations.CreateObligationValueResponse:
type: object
properties:
value:
title: value
$ref: '#/components/schemas/policy.ObligationValue'
title: CreateObligationValueResponse
additionalProperties: false
policy.obligations.ListObligationsRequest:
type: object
properties:
namespaceId:
type: string
title: namespace_id
format: uuid
namespaceFqn:
type: string
title: namespace_fqn
minLength: 1
format: uri
pagination:
title: pagination
description: Optional
$ref: '#/components/schemas/policy.PageRequest'
sort:
type: array
items:
$ref: '#/components/schemas/policy.obligations.ObligationsSort'
title: sort
maxItems: 1
description: "Optional - CONSTRAINT: max 1 item\n Sort defaults:\n - direction UNSPECIFIED defaults to DESC for the specified field\n - field UNSPECIFIED defaults to created_at with the specified direction\n - both UNSPECIFIED or sort omitted defaults to created_at DESC"
search:
title: search
description: Optional
$ref: '#/components/schemas/policy.Search'
title: ListObligationsRequest
additionalProperties: false
policy.obligations.GetObligationRequest:
type: object
properties:
id:
type: string
title: id
format: uuid
fqn:
type: string
title: fqn
minLength: 1
format: uri
title: GetObligationRequest
additionalProperties: false
policy.Condition:
type: object
properties:
subjectExternalSelectorValue:
type: string
title: subject_external_selector_value
description: "a selector for a field value on a flattened Entity Representation (such as\n from idP/LDAP)"
operator:
title: operator
description: the evaluation operator of relation
$ref: '#/components/schemas/policy.SubjectMappingOperatorEnum'
subjectExternalValues:
type: array
items:
type: string
minItems: 1
title: subject_external_values
minItems: 1
description: "list of comparison values for the result of applying the\n subject_external_selector_value on a flattened Entity Representation\n (Subject), evaluated by the operator"
title: Condition
required:
- subjectExternalSelectorValue
- operator
additionalProperties: false
description: '*
A Condition defines a rule of <the value at the flattened ''selector value''
location> <operator> <subject external values>'
policy.obligations.GetObligationValuesByFQNsRequest:
type: object
properties:
fqns:
type: array
items:
type: string
minLength: 1
format: uri
maxItems: 250
minItems: 1
uniqueItems: true
title: fqns
maxItems: 250
minItems: 1
uniqueItems: true
title: GetObligationValuesByFQNsRequest
additionalProperties: false
policy.obligations.ListObligationTriggersRequest:
type: object
properties:
namespaceId:
type: string
title: namespace_id
format: uuid
namespaceFqn:
type: string
title: namespace_fqn
minLength: 1
format: uri
pagination:
title: pagination
description: Optional
$ref: '#/components/schemas/policy.PageRequest'
title: ListObligationTriggersRequest
additionalProperties: false
policy.SimpleKasKey:
type: object
properties:
kasUri:
type: string
title: kas_uri
description: The URL of the Key Access Server
publicKey:
title: public_key
description: The public key of the Key that belongs to the KAS
$ref: '#/components/schemas/policy.SimpleKasPublicKey'
kasId:
type: string
title: kas_id
description: The ID of the Key Access Server
title: SimpleKasKey
additionalProperties: false
common.MetadataMutable:
type: object
properties:
labels:
type: object
title: labels
additionalProperties:
type: string
title: value
description: optional labels
title: MetadataMutable
additionalProperties: false
policy.obligations.CreateObligationResponse:
type: object
properties:
obligation:
title: obligation
$ref: '#/components/schemas/policy.Obligation'
title: CreateObligationResponse
additionalProperties: false
policy.ObligationValue:
type: object
properties:
id:
type: string
title: id
obligation:
title: obligation
$ref: '#/components/schemas/policy.Obligation'
value:
type: string
title: value
triggers:
type: array
items:
$ref: '#/components/schemas/policy.ObligationTrigger'
title: triggers
fqn:
type: string
title: fqn
metadata:
title: metadata
$ref: '#/components/schemas/common.Metadata'
title: ObligationValue
additionalProperties: false
policy.Search:
type: object
properties:
term:
type: string
title: term
maxLength: 253
minLength: 1
title: Search
additionalProperties: false
policy.Namespace:
type: object
properties:
id:
type: string
title: id
description: generated uuid in database
name:
type: string
title: name
description: "used to partition Attribute Definitions, support by namespace AuthN and\n enable federation"
fqn:
type: string
title: fqn
active:
title: active
description: active by default until explicitly deactivated
$ref: '#/components/schemas/google.protobuf.BoolValue'
metadata:
title: metadata
$ref: '#/components/schemas/common.Metadata'
grants:
type: array
items:
$ref: '#/components/schemas/policy.KeyAccessServer'
title: grants
description: Deprecated KAS grants for the namespace. Use kas_keys instead.
kasKeys:
type: array
items:
$ref: '#/components/schemas/policy.SimpleKasKey'
title: kas_keys
description: Keys for the namespace
title: Namespace
additionalProperties: false
policy.obligations.GetObligationValueResponse:
type: object
properties:
value:
title: value
$ref: '#/components/schemas/policy.ObligationValue'
title: GetObligationValueResponse
additionalProperties: false
policy.obligations.GetObligationResponse:
type: object
properties:
obligation:
title: obligation
$ref: '#/components/schemas/policy.Obligation'
title: GetObligationResponse
additionalProperties: false
policy.obligations.DeleteObligationResponse:
type: object
properties:
obligation:
title: obligation
$ref: '#/components/schemas/policy.Obligation'
title: DeleteObligationResponse
additionalProperties: false
policy.obligations.DeleteObligationRequest:
type: object
properties:
id:
type: string
title: id
format: uuid
fqn:
type: string
title: fqn
minLength: 1
format: uri
title: DeleteObligationRequest
additionalProperties: false
policy.obligations.GetObligationsByFQNsRequest:
type: object
properties:
fqns:
type: array
items:
type: string
minLength: 1
format: uri
maxItems: 250
minItems: 1
uniqueItems: true
title: fqns
maxItems: 250
minItems: 1
uniqueItems: true
title: GetObligationsByFQNsRequest
additionalProperties: false
policy.KasPublicKey:
type: object
properties:
pem:
type: string
title: pem
maxLength: 8192
minLength: 1
description: x509 ASN.1 content in PEM envelope, usually
kid:
type: string
title: kid
maxLength: 32
minLength: 1
description: A unique string identifier for this key
alg:
not:
enum:
- 0
title: alg
description: "A known algorithm type with any additional parameters encoded.\n To start, these may be `rsa:2048` for RSA-based wrapping and\n `ec:secp256r1` for EC-based wrapping, but more formats may be added as needed."
$ref: '#/components/schemas/policy.KasPublicKeyAlgEnum'
title: KasPublicKey
additionalProperties: false
description: "Deprecated\n A KAS public key and some associated metadata for further identifcation"
google.protobuf.Timestamp:
type: string
examples:
- 1s
- 1.000340012s
format: date-time
description: "A Timestamp represents a point in time independent of any time zone or local\n calendar, encoded as a count of seconds and fractions of seconds at\n nanosecond resolution. The count is relative to an epoch at UTC midnight on\n January 1, 1970, in the proleptic Gregorian calendar which extends the\n Gregorian calendar backwards to year one.\n\n All minutes are 60 seconds long. Leap seconds are \"smeared\" so that no leap\n second table is needed for interpretation, using a [24-hour linear\n smear](https://developers.google.com/time/smear).\n\n The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By\n restricting to that range, we ensure that we can convert to and from [RFC\n 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.\n\n # Examples\n\n Example 1: Compute Timestamp from POSIX `time()`.\n\n Timestamp timestamp;\n timestamp.set_seconds(time(NULL));\n timestamp.set_nanos(0);\n\n Example 2: Compute Timestamp from POSIX `gettimeofday()`.\n\n struct timeval tv;\n gettimeofday(&tv, NULL);\n\n Timestamp timestamp;\n timestamp.set_seconds(tv.tv_sec);\n timestamp.set_nanos(tv.tv_usec * 1000);\n\n Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.\n\n FILETIME ft;\n GetSystemTimeAsFileTime(&ft);\n UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;\n\n // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z\n // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.\n Timestamp timestamp;\n timestamp.set_seconds((INT64) ((
# --- truncated at 32 KB (64 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/virtru/refs/heads/main/openapi/virtru-policy-obligations-service-api-openapi.yml