swagger: '2.0'
info:
  description: Configuration for RBA Policy resource.
  version: 'v2'
  title: rba_policy
host: 'adm.cloud.com'
schemes:
 - https
# tags are used for organizing operations
tags:
  - name: rba_policy
    description: RBA Policy
consumes:
  - application/json
produces:
  - application/json
securityDefinitions:
  UserSecurity:
    type: basic
security:
  - UserSecurity: []
parameters:
  idParam:
   name: id
   in: path
   type: string
   description: Id is system generated key for all the system policys
   required: true
  authParam:
      in: header
      name: Authorization
      type: string
      required: true
      description: Session Id for authentication.Should be mentioned in the format CwsAuth bearer=sessionIdValue
  cloudParam:
      in: header
      name: isCloud
      type: string
      required: true
      description: set the value to true in case of Cloud services, false for on-prem deployment
paths:
  /massvc/{customerid}/nitro/v2/config/rba_policy:
    get:
      tags:
        - rba_policy
      summary: GET all rba_policy
      operationId: getall_rba_policy
      description: Use this operation to get system policies
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: path
          name: customerid
          type: string
          required: true
          description: Customer Id of the user
        - in: header
          name: Authorization
          type: string
          required: true
          description: Session Id for authentication.Should be mentioned in the format CwsAuth bearer=sessionIdValue
        - in: header
          name: isCloud
          type: string
          required: true
          description: set the value to true in case of Cloud services, false for on-prem deployment
        - in: query
          name: filter
          type: string
          required: false
          description: "Use this query-parameter to get the filtered set of vm_device resources configured on the system. You can set a filter on any property of the resource.Example:  property-name1:property-value1 "
        - in: query
          name: pagesize
          type: integer
          required: false
          description: Use this query-parameter to get the rba_policy resources in chunks.To be used along with pageno query parameter.
        - in: query
          name: pageno
          type: integer
          required: false
          description: Use this query-parameter to get the rba_policy resources in chunks.To be used along with pagesize query parameter.
        - in: query
          name: count
          type: string
          required: false
          description: Use this query-parameter to get the count of rba_policy resources.
          enum:
            - yes
      responses:
        200:
          description:  for rba_policy
          schema: 
              $ref: '#/definitions/getrba_policysResponse'
        400:
          description: Bad input parameter
          schema: 
              $ref: '#/definitions/Error'
        401:
          description: Failed Authentication
          schema: 
              $ref: '#/definitions/Error'
        403:
          description: Unauthorized
          schema: 
              $ref: '#/definitions/Error'
        404:
          description: Item not found
          schema: 
              $ref: '#/definitions/Error'
        409:
          description: Resource Conflict
          schema: 
              $ref: '#/definitions/Error'
        500:
          description: Server Error
          schema: 
              $ref: '#/definitions/Error'
        504:
          description: Gateway Timeout
          schema: 
              $ref: '#/definitions/Error'

    post:
      tags:
        - rba_policy
      summary: POST operation for rba_policy
      operationId: post_rba_policy
      description: POST operation for rba_policy
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: path
          name: customerid
          type: string
          required: true
          description: Customer Id of the user
        - in: header
          name: Authorization
          type: string
          required: true
          description: Session Id for authentication.Should be mentioned in the format CwsAuth bearer=sessionIdValue
        - in: header
          name: isCloud
          type: string
          required: true
          description: set the value to true in case of Cloud services, false for on-prem deployment
        - in: query
          name: onerror
          description: Use this parameter to set the onerror status for nitro request. Applicable only for bulk requests.
          required: false
          type: string
          default: CONTINUE
          enum:
            - EXIT
            - CONTINUE
        - in: body
          name: rba_policy
          description: rba_policy object
          schema:
              $ref: '#/definitions/addrba_policyRequest'
      responses:
        200:
          description: add for rba_policy
          schema: 
              $ref: '#/definitions/addrba_policyResponse'
        400:
          description: Bad input parameter
          schema: 
              $ref: '#/definitions/Error'
        401:
          description: Failed Authentication
          schema: 
              $ref: '#/definitions/Error'
        403:
          description: Unauthorized
          schema: 
              $ref: '#/definitions/Error'
        404:
          description: Item not found
          schema: 
              $ref: '#/definitions/Error'
        409:
          description: Resource Conflict
          schema: 
              $ref: '#/definitions/Error'
        500:
          description: Server Error
          schema: 
              $ref: '#/definitions/Error'
        504:
          description: Gateway Timeout
          schema: 
              $ref: '#/definitions/Error'

  /massvc/{customerid}/nitro/v2/config/rba_policy/{id}:
    get:
      tags:
        - rba_policy
      summary: GET by key for rba_policy
      operationId: getbykey_rba_policy
      description: Use this operation to get system policies
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - $ref: '#/parameters/idParam'
        - in: path
          name: customerid
          type: string
          required: true
          description: Customer Id of the user
        - in: header
          name: Authorization
          type: string
          required: true
          description: Session Id for authentication.Should be mentioned in the format CwsAuth bearer=sessionIdValue
        - in: header
          name: isCloud
          type: string
          required: true
          description: set the value to true in case of Cloud services, false for on-prem deployment
      responses:
        200:
          description: add for rba_policy
          schema: 
              $ref: '#/definitions/getrba_policyResponse'
        400:
          description: Bad input parameter
          schema: 
              $ref: '#/definitions/Error'
        401:
          description: Failed Authentication
          schema: 
              $ref: '#/definitions/Error'
        403:
          description: Unauthorized
          schema: 
              $ref: '#/definitions/Error'
        404:
          description: Item not found
          schema: 
              $ref: '#/definitions/Error'
        409:
          description: Resource Conflict
          schema: 
              $ref: '#/definitions/Error'
        500:
          description: Server Error
          schema: 
              $ref: '#/definitions/Error'
        504:
          description: Gateway Timeout
          schema: 
              $ref: '#/definitions/Error'

    put:
      tags:
        - rba_policy
      summary: PUT for rba_policy
      operationId: putbykey_rba_policy
      description: Use this operation to modify system policy
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - $ref: '#/parameters/idParam'
        - in: path
          name: customerid
          type: string
          required: true
          description: Customer Id of the user
        - in: header
          name: Authorization
          type: string
          required: true
          description: Session Id for authentication.Should be mentioned in the format CwsAuth bearer=sessionIdValue
        - in: header
          name: isCloud
          type: string
          required: true
          description: set the value to true in case of Cloud services, false for on-prem deployment
        - in: body
          name: rba_policy
          description: rba_policy object
          schema:
              $ref: '#/definitions/modifyrba_policyRequest'
      responses:
        200:
          description: add for rba_policy
          schema: 
              $ref: '#/definitions/modifyrba_policyResponse'
        400:
          description: Bad input parameter
          schema: 
              $ref: '#/definitions/Error'
        401:
          description: Failed Authentication
          schema: 
              $ref: '#/definitions/Error'
        403:
          description: Unauthorized
          schema: 
              $ref: '#/definitions/Error'
        404:
          description: Item not found
          schema: 
              $ref: '#/definitions/Error'
        409:
          description: Resource Conflict
          schema: 
              $ref: '#/definitions/Error'
        500:
          description: Server Error
          schema: 
              $ref: '#/definitions/Error'
        504:
          description: Gateway Timeout
          schema: 
              $ref: '#/definitions/Error'

    delete:
      tags:
        - rba_policy
      summary: Delete for rba_policy
      operationId: deletebykey_rba_policy
      description: Use this operation to delete system policy(s)
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - $ref: '#/parameters/idParam'
        - in: path
          name: customerid
          type: string
          required: true
          description: Customer Id of the user
        - in: header
          name: Authorization
          type: string
          required: true
          description: Session Id for authentication.Should be mentioned in the format CwsAuth bearer=sessionIdValue
        - in: header
          name: isCloud
          type: string
          required: true
          description: set the value to true in case of Cloud services, false for on-prem deployment
      responses:
        204:
          description: add for rba_policy
        400:
          description: Bad input parameter
          schema: 
              $ref: '#/definitions/Error'
        401:
          description: Failed Authentication
          schema: 
              $ref: '#/definitions/Error'
        403:
          description: Unauthorized
          schema: 
              $ref: '#/definitions/Error'
        404:
          description: Item not found
          schema: 
              $ref: '#/definitions/Error'
        409:
          description: Resource Conflict
          schema: 
              $ref: '#/definitions/Error'
        500:
          description: Server Error
          schema: 
              $ref: '#/definitions/Error'
        504:
          description: Gateway Timeout
          schema: 
              $ref: '#/definitions/Error'

definitions:
  addrba_policyRequest:
    type: object
    required:
      - rba_policy
    properties:
      rba_policy:
        $ref: '#/definitions/rba_policy_readwrite'
    title: addrba_policyRequest
    example:
      rba_policy:
        tenant_id: "7ed7946f-4af7-11e9-99d2-b6fe81a85d18"
        statement: [{        id: "string_value"
,        dependent_resources: "string_value"
,        access_type: "boolean_value"
,        operation_name: "string_value"
,        resource_type: "string_value"
}]
        ui: [{        name: "string_value"
,        id: "string_value"
,        display_name: "string_value"
,        access_type: "boolean_value"
}]
        name: "adminPolicy"
        description: "This policy has been created for SSL dashboard admins."

  addrba_policyResponse:
    type: object
    required:
      - rba_policy
    properties:
      rba_policy:
        $ref: '#/definitions/rba_policy'
    title: addrba_policyResponse
    example:
      rba_policy:
        is_default: "false"
        tenant_id: "7ed7946f-4af7-11e9-99d2-b6fe81a85d18"
        statement: [{        parent_name: "string_value"
,        id: "string_value"
,        dependent_resources: "string_value"
,        access_type: "boolean_value"
,        parent_id: "string_value"
,        operation_name: "string_value"
,        resource_type: "string_value"
}]
        ui: [{        parent_name: "string_value"
,        name: "string_value"
,        id: "string_value"
,        display_name: "string_value"
,        access_type: "boolean_value"
,        parent_id: "string_value"
}]
        name: "adminPolicy"
        id: "c970e730-6bc5-44c2-a2bf-8dd1382ffb5f"
        description: "This policy has been created for SSL dashboard admins."
        tenant_name: "AppSecDelta"
        roles: "ARRAY(0x2c2b394)"

  getrba_policyResponse:
    type: object
    required:
      - rba_policy
    properties:
      rba_policy:
        $ref: '#/definitions/rba_policy'
    title: getrba_policyResponse
    example:
      rba_policy:
        is_default: "false"
        tenant_id: "7ed7946f-4af7-11e9-99d2-b6fe81a85d18"
        statement: [{        parent_name: "string_value"
,        id: "string_value"
,        dependent_resources: "string_value"
,        access_type: "boolean_value"
,        parent_id: "string_value"
,        operation_name: "string_value"
,        resource_type: "string_value"
}]
        ui: [{        parent_name: "string_value"
,        name: "string_value"
,        id: "string_value"
,        display_name: "string_value"
,        access_type: "boolean_value"
,        parent_id: "string_value"
}]
        name: "adminPolicy"
        id: "c970e730-6bc5-44c2-a2bf-8dd1382ffb5f"
        description: "This policy has been created for SSL dashboard admins."
        tenant_name: "AppSecDelta"
        roles: "ARRAY(0x2c2b394)"

  getrba_policysResponse:
    type: object
    required:
      - rba_policy
    properties:
      rba_policy:
        type: array
        items:
          $ref: '#/definitions/rba_policy'
    title: getrba_policysResponse
    example:
      rba_policy:
        is_default: "false"
        tenant_id: "7ed7946f-4af7-11e9-99d2-b6fe81a85d18"
        statement: [{        parent_name: "string_value"
,        id: "string_value"
,        dependent_resources: "string_value"
,        access_type: "boolean_value"
,        parent_id: "string_value"
,        operation_name: "string_value"
,        resource_type: "string_value"
}]
        ui: [{        parent_name: "string_value"
,        name: "string_value"
,        id: "string_value"
,        display_name: "string_value"
,        access_type: "boolean_value"
,        parent_id: "string_value"
}]
        name: "adminPolicy"
        id: "c970e730-6bc5-44c2-a2bf-8dd1382ffb5f"
        description: "This policy has been created for SSL dashboard admins."
        tenant_name: "AppSecDelta"
        roles: "ARRAY(0x2c2b394)"

  modifyrba_policyRequest:
    type: object
    required:
      - rba_policy
    properties:
      rba_policy:
        $ref: '#/definitions/rba_policy_readwrite'
    title: modifyrba_policyRequest
    example:
      rba_policy:
        tenant_id: "7ed7946f-4af7-11e9-99d2-b6fe81a85d18"
        statement: [{        id: "string_value"
,        dependent_resources: "string_value"
,        access_type: "boolean_value"
,        operation_name: "string_value"
,        resource_type: "string_value"
}]
        ui: [{        name: "string_value"
,        id: "string_value"
,        display_name: "string_value"
,        access_type: "boolean_value"
}]
        name: "adminPolicy"
        description: "This policy has been created for SSL dashboard admins."

  modifyrba_policyResponse:
    type: object
    required:
      - rba_policy
    properties:
      rba_policy:
        $ref: '#/definitions/rba_policy'
    title: modifyrba_policyResponse
    example:
      rba_policy:
        is_default: "false"
        tenant_id: "7ed7946f-4af7-11e9-99d2-b6fe81a85d18"
        statement: [{        parent_name: "string_value"
,        id: "string_value"
,        dependent_resources: "string_value"
,        access_type: "boolean_value"
,        parent_id: "string_value"
,        operation_name: "string_value"
,        resource_type: "string_value"
}]
        ui: [{        parent_name: "string_value"
,        name: "string_value"
,        id: "string_value"
,        display_name: "string_value"
,        access_type: "boolean_value"
,        parent_id: "string_value"
}]
        name: "adminPolicy"
        id: "c970e730-6bc5-44c2-a2bf-8dd1382ffb5f"
        description: "This policy has been created for SSL dashboard admins."
        tenant_name: "AppSecDelta"
        roles: "ARRAY(0x2c2b394)"

  rba_policy_readwrite:
    type: object
    properties:
      tenant_id:
        description: "Tenant Id of the system policys"
        type: string
        format: uuid
        minLength: 1
        maxLength: 128
      statement:
        type: array
        items:
          $ref: '#/definitions/rba_statement_readwrite'
      ui:
        type: array
        items:
          $ref: '#/definitions/rba_ui_readwrite'
      name:
        description: "Policy Name"
        type: string
        format: string
        minLength: 1
        maxLength: 128
      description:
        description: "Description of Policy"
        type: string
        format: string
        minLength: 1
        maxLength: 1024

  rba_policy:
    allOf:
      -
        properties:
          id:
            description: Id is system generated key for all the system policys
            type: string
            format: uuid
          roles:
             description: "Roles to which this policy attached"
             type: array
             items:
               type: string
               format: string
      - $ref: '#/definitions/rba_policy_readwrite'

  rba_statement_readwrite:
    type: object
    properties:
      dependent_resources:
        description: "Comma separated names of resources, permission of these resources is dependent upon permission of whatever is given in resource_type."
        type: string
        format: string
      access_type:
        description: "true, if access is allowed"
        type: boolean
        format: boolean
      operation_name:
        description: "Operation for a resource"
        type: string
        format: string
      resource_type:
        description: "Resource Type"
        type: string
        format: string

  rba_statement:
    allOf:
      -
        properties:
          id:
            description: Id is system generated key for all the permission statements
            type: string
            format: uuid
          parent_name:
             type: string
             format: string
          parent_id:
             type: string
             format: string
      - $ref: '#/definitions/rba_statement_readwrite'

  rba_ui_readwrite:
    type: object
    properties:
      name:
        description: "Unique name for UI tree node"
        type: string
        format: string
      display_name:
        description: "Display name for UI tree node"
        type: string
        format: string
      access_type:
        description: "true, if access is allowed"
        type: boolean
        format: boolean

  rba_ui:
    allOf:
      -
        properties:
          id:
            description: Id is system generated key for all the permission statements
            type: string
            format: string
          parent_name:
             description: "Parent node name for UI tree node"
             type: string
             format: string
          parent_id:
             description: "Parent id for UI tree node"
             type: string
             format: string
      - $ref: '#/definitions/rba_ui_readwrite'

  Error:
    properties:
      errorcode:
        type: number
        format: int32
        example: 1001
      errormessage:
        type: string
        format: string
        example: "id cannot be found"
