> ## Documentation Index > Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL. > Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other. > Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking. > Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify. # Query AAA profiles > GET /api/v1/authorization/profiles. Identity and access API reference. Sign in to try this endpointExplore the parameters, examples, and responses below. Connect your ZedCloud session when you’re ready to send a request. > [accordion] Connect your console > > Sign in to your usual ZedCloud console, then open: > >
    >
  1. Profile menu
  2. Help & Documentation
  3. API Reference
    4. >
> > Your cluster and authorization are filled in automatically. No token to copy. > [More about signing in ](https://zededa.mintlify.site/api-reference/authentication.md#sign-in-to-the-api-reference) Modifying requests stay off until you enable them. [Authentication](https://zededa.mintlify.site/api-reference/authentication.md) · [API availability](https://zededa.mintlify.site/api-reference/clusters.md) · [Download OpenAPI](https://zededa.mintlify.site/openapi/services/iam.json) A successful response. Bad Request. The API gateway did not process the request because of invalid value of filter parameters. Unauthorized. The API gateway did not process the request because it lacks valid authentication credentials for the target resource. The request header has either no authorization details or an authorization that has been refused. Forbidden. The API gateway did not process the request because the requestor does not have edge-node level access permission for the operation or does not have access scope to the project. Internal Server Error. The API gateway experienced an unexpected condition. Specific error condition is indicated in error codes. Gateway Timeout. The API gateway did not receive a timely response from an upstream microservice it needed to communicate with in order to complete the request. An unexpected error response. ## OpenAPI ````yaml openapi/services/iam.json GET /v1/authorization/profiles openapi: 3.0.0 info: title: ZEDEDA IAM Service description: >- ZEDEDA Identity and Access Management (IAM) Service helps you securely control access to zedcontrol resources. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources. ZEDEDA IAM Service helps you set up users and roles, and shows you how to protect your resources with role-based access control (RBAC). It also shows how to connect to other identity services to grant external users access to your enterprise resources. termsOfService: https://www.zededa.com/terms version: '1.0' contact: name: ZEDEDA API Support url: https://www.zededa.com/support email: support@zededa.com license: name: Apache 2.0 url: http://www.apache.org/licenses/LICENSE-2.0.html servers: - url: https://{apiHost}/api variables: apiHost: default: invalid.invalid description: Connect from ZedUI to supply your verified API destination. security: - BearerToken: [] tags: - name: IdentityAccessManagement - name: EnterpriseEntitlementsReport externalDocs: description: ZEDEDA Product Documentation url: https://docs.zededa.com/-M-8m8d8KqdLpfOgY_jo/iam paths: /v1/authorization/profiles: get: tags: - IdentityAccessManagement summary: Query AAA profiles description: Query the AAA profile records. operationId: IdentityAccessManagement_QueryAuthProfiles parameters: - name: summary in: query required: false schema: type: boolean - name: SfdcId in: query required: false schema: type: string - name: HubspotId in: query required: false schema: type: string - name: project in: query required: false schema: type: string - name: namePattern in: query required: false schema: type: string - name: all in: query required: false schema: type: boolean - name: roleName in: query required: false schema: type: string - name: size in: query required: false schema: type: string - name: emailPattern in: query required: false schema: type: string - name: titlePattern in: query required: false schema: type: string - name: next.pageToken description: Page Token in: query required: false schema: type: string - name: next.orderBy description: OrderBy helps in sorting the list response in: query required: false explode: true schema: type: array items: type: string - name: next.pageNum description: Page Number in: query required: false schema: type: number format: int64 - name: next.pageSize description: Defines the page size in: query required: false schema: type: number format: int64 - name: next.totalPages description: Total number of pages to be fetched. in: query required: false schema: type: number format: int64 - name: X-Request-Id in: header required: false description: User-Agent specified id to track a request schema: type: string responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/CrudResponse' '400': description: >- Bad Request. The API gateway did not process the request because of invalid value of filter parameters. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' '401': description: >- Unauthorized. The API gateway did not process the request because it lacks valid authentication credentials for the target resource. The request header has either no authorization details or an authorization that has been refused. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' '403': description: >- Forbidden. The API gateway did not process the request because the requestor does not have edge-node level access permission for the operation or does not have access scope to the project. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' '500': description: >- Internal Server Error. The API gateway experienced an unexpected condition. Specific error condition is indicated in error codes. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' '504': description: >- Gateway Timeout. The API gateway did not receive a timely response from an upstream microservice it needed to communicate with in order to complete the request. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/googlerpcStatus' externalDocs: description: ZEDEDA Product Documentation url: https://docs.zededa.com/-M-8m8d8KqdLpfOgY_jo/iam components: schemas: CrudResponse: type: object properties: token: $ref: '#/components/schemas/OpaqueToken64' action: $ref: '#/components/schemas/CrudAction' result: $ref: '#/components/schemas/ZsrvResponse' read: $ref: '#/components/schemas/CrudResponseRead' query: $ref: '#/components/schemas/CrudResponseQuery' ZsrvResponse: type: object properties: operationType: title: |- Describes one of the operations type : possible values Read/Delete/Create/Update/List allOf: - $ref: '#/components/schemas/ZcOpsType' operationStatus: title: if this is log running job allOf: - $ref: '#/components/schemas/ZcOpsStatus' objectKind: type: string title: zedcloud object kind on which the operation was performed objectId: type: string title: Unique value identifies the object that was operated on objectName: type: string title: name of the object objectRevision: type: string title: |- object revision post the operation, note Read operation doesn't change the revision objectType: $ref: '#/components/schemas/ObjectType' operationTime: type: string title: time of operation startTime: type: string title: total time taken by operations endTime: type: string user: type: string title: the operation is performed on behalf of this user httpStatusCode: type: integer format: int32 title: http response httpStatusMsg: type: string title: summary of the error in text format jobId: type: string title: for tracking asynchronous tasks error: type: array items: $ref: '#/components/schemas/ZsrvError' title: |- one or more errors will be set if the operation failed i.e. httpStatusCode != 2xx googlerpcStatus: type: object properties: code: type: integer format: int32 message: type: string details: type: array items: $ref: '#/components/schemas/protobufAny' OpaqueToken64: type: object properties: base64: type: string title: Base64 encoded opaque token CrudAction: type: string enum: - CrudAction__INVALID__ - CrudActionNotApplicable - CrudActionCreate - CrudActionRead - CrudActionUpdate - CrudActionDelete - CrudActionQuery - CrudActionQueryNext - CrudActionReadSelf - CrudActionUpdateSelf default: CrudAction__INVALID__ CrudResponseRead: type: object properties: result: $ref: '#/components/schemas/CrudResultWithContent' CrudResponseQuery: type: object properties: queryToken: title: The unique id of the query allOf: - $ref: '#/components/schemas/OpaqueToken64' code: title: Was there anything that matches allOf: - $ref: '#/components/schemas/CrudResultCode' position: type: integer format: int64 title: The index of the first result size: type: integer format: int64 title: >- The number of results returned, could be less than the requested size total: type: integer format: int64 title: The total number of result items for this query list: type: array items: $ref: '#/components/schemas/CrudResultWithContent' title: List of the results globalStatistics: type: array items: $ref: '#/components/schemas/CrudStatisticsContainer' title: Global statistics queryStatistics: type: array items: $ref: '#/components/schemas/CrudStatisticsContainer' title: Global statistics clazz: $ref: '#/components/schemas/ModelClazz' profiles: $ref: '#/components/schemas/AuthorizationProfiles' enterprises: $ref: '#/components/schemas/Enterprises' roles: $ref: '#/components/schemas/Roles' realms: $ref: '#/components/schemas/Realms' credentials: $ref: '#/components/schemas/Credentials' users: $ref: '#/components/schemas/DetailedUsers' policies: $ref: '#/components/schemas/Policies' docPolicies: $ref: '#/components/schemas/DocPolicies' allowedEnterpriseList: $ref: '#/components/schemas/AllowedEnterpriseList' userSummaryReport: $ref: '#/components/schemas/UserSummaryReport' userUsagePerEnterpriseList: $ref: '#/components/schemas/UserUsagePerEnterpriseList' ZcOpsType: type: string enum: - OPS_TYPE_UNSPECIFIED - OPS_TYPE_READ - OPS_TYPE_DELETE - OPS_TYPE_CREATE - OPS_TYPE_UPDATE - OPS_TYPE_LIST default: OPS_TYPE_UNSPECIFIED title: ZedCloud internal operation type ZcOpsStatus: type: string enum: - OPS_STATUS_UNSPECIFIED - OPS_STATUS_PENDING - OPS_STATUS_ONGOING - OPS_STATUS_COMPLETE default: OPS_STATUS_UNSPECIFIED description: >- - OPS_STATUS_PENDING: In rare cases, system may not start operation when it was requested. Client will be notified that operation is PENDING - OPS_STATUS_ONGOING: system will start the operation, but at the time response was generated, operation is still ONGOING. - OPS_STATUS_COMPLETE: Even if the result of the operations may result in failure, but the OpsStatus will marked COMPLETE for almost all cases. title: ZedCloud internal operation status ObjectType: type: string enum: - OBJECT_TYPE_UNSPECIFIED - OBJECT_TYPE_USER - OBJECT_TYPE_EDGE_NODE - OBJECT_TYPE_EDGE_APP - OBJECT_TYPE_IMAGE - OBJECT_TYPE_EDGE_APP_INSTANCE - OBJECT_TYPE_PROJECT - OBJECT_TYPE_NETWORK - OBJECT_TYPE_DATASTORE - OBJECT_TYPE_SERVICE - OBJECT_TYPE_SERVICE_INSTANCE - OBJECT_TYPE_ENTERPRISE - OBJECT_TYPE_ROLE - OBJECT_TYPE_CREDENTIAL - OBJECT_TYPE_NETWORK_INSTANCE - OBJECT_TYPE_VOLUME_INSTANCE - OBJECT_TYPE_REALM - OBJECT_TYPE_AUTHPROFILE - OBJECT_TYPE_POLICY - OBJECT_TYPE_APP_POLICY - OBJECT_TYPE_CLUSTER_INSTANCE - OBJECT_TYPE_PLUGIN - OBJECT_TYPE_DOC_POLICY - OBJECT_TYPE_ORCHESTRATOR_CLUSTER - OBJECT_TYPE_TAGS - OBJECT_TYPE_EDGE_NODE_INTERFACE - OBJECT_TYPE_DEPLOYMENT - OBJECT_TYPE_ENTITLEMENTS - OBJECT_TYPE_DATA_STREAM - OBJECT_TYPE_API_USAGE - OBJECT_TYPE_APP_INSTANCE_SNAPSHOT - OBJECT_TYPE_PATCH_ENVELOPE - OBJECT_TYPE_RESOURCE_USAGE_TRACK - OBJECT_TYPE_PATCH_ENVELOPE_REFERENCE - OBJECT_TYPE_DEV_PASSTHROUGH - OBJECT_TYPE_EDGE_NODE_CLUSTER - OBJECT_TYPE_ASSET_GROUP - OBJECT_TYPE_APP_PROFILE - OBJECT_TYPE_PROFILE_DEPLOYMENT - OBJECT_TYPE_ZKS_INSTANCE - OBJECT_TYPE_CLUSTER_GROUP default: OBJECT_TYPE_UNSPECIFIED ZsrvError: type: object properties: ec: title: |- Enumrated error code, describes more granular numerical value than just httpStatus allOf: - $ref: '#/components/schemas/ZsrvErrorCode' location: type: string title: 'Ignore: Internal field only' details: type: string title: Field captures string description of details protobufAny: type: object properties: typeUrl: type: string value: type: string format: byte CrudResultWithContent: type: object properties: code: $ref: '#/components/schemas/CrudResultCode' content: $ref: '#/components/schemas/CrudContent' identifier: $ref: '#/components/schemas/Identifier64' CrudResultCode: type: string enum: - CrudResultCode__INVALID__ - CrudResultCodeSuccess - CrudResultCodeAuthentication - CrudResultCodeAlreadyExists - CrudResultCodeException - CrudResultCodeHasDependencies - CrudResultCodeIllegalArgument - CrudResultCodeIllegalRequest - CrudResultCodeIncomplete - CrudResultCodeInternalError - CrudResultCodeNotFound - CrudResultCodeNotIdentified - CrudResultCodePermissionDenied - CrudResultCodeQueryExpired - CrudResultCodeUnknown default: CrudResultCode__INVALID__ title: Responses to the action requests CrudStatisticsContainer: type: object properties: clazz: $ref: '#/components/schemas/ModelClazz' user: $ref: '#/components/schemas/CrudStatisticsUser' title: Container for per-clazz statistics ModelClazz: type: string enum: - ModelClazzUnspecified - ModelClazzDetailedUser - ModelClazzSimpleUser - ModelClazzEnterprise - ModelClazzRealm - ModelClazzCredential - ModelClazzPolicy - ModelClazzRole - ModelClazzProfile - ModelClazzDocPolicy - ModelClazzAllowedEnterpriseList - ModelClazzTotalUserCount - ModelClazzLastLoggedInUserInfo - ModelClazzUserActivitySummary - ModelClazzUserUsagePerEnterprise - ModelClazzEnterpriseGithubRepository default: ModelClazzUnspecified title: Global identifier of clazz types AuthorizationProfiles: type: object properties: summaryByState: description: Summary of filtered profiles allOf: - $ref: '#/components/schemas/Summary' list: type: array items: $ref: '#/components/schemas/AuthorizationProfile' description: List of profiles next: description: Page details of the filtered records allOf: - $ref: '#/components/schemas/Cursor' Enterprises: type: object properties: summaryByState: description: Summary of filtered enterprises allOf: - $ref: '#/components/schemas/Summary' list: type: array items: $ref: '#/components/schemas/Enterprise' description: List of enterprises next: description: Page details of the filtered records allOf: - $ref: '#/components/schemas/Cursor' Roles: type: object properties: summaryByState: description: Summary of filtered roles allOf: - $ref: '#/components/schemas/Summary' list: type: array items: $ref: '#/components/schemas/Role' description: List of roles next: description: Page details of the filtered records allOf: - $ref: '#/components/schemas/Cursor' Realms: type: object properties: summaryByState: description: Summary of filtered realms allOf: - $ref: '#/components/schemas/Summary' list: type: array items: $ref: '#/components/schemas/Realm' description: List of realms next: description: Page details of the filtered records allOf: - $ref: '#/components/schemas/Cursor' Credentials: type: object properties: summaryByState: $ref: '#/components/schemas/Summary' list: type: array items: $ref: '#/components/schemas/Credential' next: $ref: '#/components/schemas/Cursor' DetailedUsers: type: object properties: summaryByState: description: Summary of filtered users allOf: - $ref: '#/components/schemas/Summary' list: type: array items: $ref: '#/components/schemas/DetailedUser' description: List of users summaryByUserActivity: description: Count of online/offline users allOf: - $ref: '#/components/schemas/Summary' summaryByRoleDistribution: description: User distribution by role allOf: - $ref: '#/components/schemas/Summary' next: description: Page details of the filtered records allOf: - $ref: '#/components/schemas/Cursor' Policies: type: object properties: summaryByState: $ref: '#/components/schemas/Summary' list: type: array items: $ref: '#/components/schemas/Policy' next: $ref: '#/components/schemas/Cursor' DocPolicies: type: object properties: summaryByState: description: Summary of filtered docpolicy allOf: - $ref: '#/components/schemas/Summary' list: type: array items: $ref: '#/components/schemas/DocPolicySummary' description: List of docpolicy next: description: Page details of the filtered records allOf: - $ref: '#/components/schemas/Cursor' AllowedEnterpriseList: type: object properties: enterprises: type: array items: $ref: '#/components/schemas/AllowedEnterprise' description: List of child enterprises error: type: string description: Error while fetching list of child enterprises, if any next: description: >- Next page information **Source definition conflict:** this property declares type `"string"`, while the referenced definition declares `"object"`. The referenced schema is shown; the conflicting declaration needs correction in ZEDEDA's Swagger definition. allOf: - $ref: '#/components/schemas/Cursor' x-zededa-source-issues: - code: conflicting-reference pointer: '#/definitions/AllowedEnterpriseList/properties/next' keyword: type sourceValue: string reference: '#/definitions/Cursor' referencedValue: object total: type: string format: int64 description: Total number of allowed enterprises enterpriseEntitlements: type: array items: $ref: '#/components/schemas/Entitlement' description: Enterprises entitlement data description: Get list of child enterprises title: Get child enterprises UserSummaryReport: type: object properties: users: type: integer format: int64 activeUsersCount: type: integer format: int64 lastLoggedinUserInfo: $ref: '#/components/schemas/LastLoggedinUserInfo' UserUsagePerEnterpriseList: type: object properties: userUsagePerEntp: type: array items: $ref: '#/components/schemas/UserUsagePerEnterprise' description: user usage per enterprise list ZsrvErrorCode: type: string enum: - zMsgErrorNone - zMsgSucess - NotFound - AlreadyExists - VersionMismatch - RangeError - LargeResult - IncompleteData - InvalidData - FunctionUnsupported - NoMemory - SendFailure - Timeout - BadReqBody - BadReqParam - InvalidFieldFormat - UrlNotFound - ApiVersionNotSupported - Unauthorized - Forbidden - Conflict - NotModified - DependencyConflict - JsonFmtError - ProtoFmtError - CertError - DataBaseConnection - DBError - zMsgAccepted - zMsgCreated - PreConditionFailed - InternalServerError default: zMsgErrorNone description: |- - zMsgErrorNone: common validation errors - IncompleteData: message had fields that weren't filled in - InvalidData: message contained the field that wasn't expected - FunctionUnsupported: this feature unavailable on this version of device - InvalidFieldFormat: message contained the field that wasn't correctly formatted - JsonFmtError: Marshal / Unmarshal errors - DataBaseConnection: generic DB error title: ZedCould internal error code CrudContent: type: object properties: oid: $ref: '#/components/schemas/Identifier64' encoding: $ref: '#/components/schemas/CrudContentEncoding' clazz: $ref: '#/components/schemas/ModelClazz' protobuf: $ref: '#/components/schemas/CrudContentProtobuf' json: $ref: '#/components/schemas/CrudContentJSON' title: Content, with a type encoded either as protobuf or json Identifier64: type: object properties: base64: type: string title: Generic identifier, base64 encoding CrudStatisticsUser: type: object properties: total: type: integer format: int64 suspended: type: integer format: int64 deleted: type: integer format: int64 title: User related statistics Summary: type: object properties: description: type: string description: Summary description total: type: number format: int64 description: Total values: type: object additionalProperties: type: integer format: int64 description: 'Values: Map for storing ' description: Summary is used to store the Summary details title: Summary is used to store the Summary details AuthorizationProfile: type: object properties: id: type: string description: Unique system defined profile ID readOnly: true pattern: '[0-9A-Za-z_=-]{28}' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/AuthorizationProfile/properties/id' keyword: uniqueItems sourceValue: true enterpriseId: type: string description: Parent enterprise ID of the authorization profile pattern: '[0-9A-Za-z_=-]{28}' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/AuthorizationProfile/properties/enterpriseId' keyword: uniqueItems sourceValue: true name: type: string description: >- User defined name of the profile. Profile name is unique within an enterprise. Name can't be changed once created maxLength: 256 minLength: 3 pattern: '[a-zA-Z0-9][a-zA-Z0-9_.-]+' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/AuthorizationProfile/properties/name' keyword: uniqueItems sourceValue: true type: description: Type of the profile allOf: - $ref: '#/components/schemas/AuthType' oauthProfile: description: Oauth profile configuration details allOf: - $ref: '#/components/schemas/OAUTHProfile' passwordProfile: $ref: '#/components/schemas/PasswordProfile' testOnly: type: boolean active: type: boolean description: >- Mark this profile as active. Only one profile can be active in a given enterprise defaultRoleId: type: string description: Default Role ID to associate with the profile pattern: '[0-9A-Za-z_=-]{28}' title: type: string description: User defined title for the profile. Title can be changed anytime maxLength: 256 minLength: 3 pattern: '[a-zA-Z0-9]+[a-zA-Z0-9!-~ ]+' description: type: string description: Detailed description of the profile maxLength: 256 profileType: description: Authorization profile type allOf: - $ref: '#/components/schemas/AuthProfileType' disableAutoUserCreate: type: boolean description: Do not automatically create new users if this is set revision: description: system defined info readOnly: true allOf: - $ref: '#/components/schemas/ObjectRevision' description: Authorization profile meta data title: Authorization profile detail required: - name - title - defaultRoleId Cursor: type: object properties: pageToken: type: string description: Page Token orderBy: type: array items: type: string description: OrderBy helps in sorting the list response pageNum: type: number format: int64 description: Page Number pageSize: type: number format: int64 description: Defines the page size totalPages: type: number format: int64 description: Total number of pages to be fetched. description: >- Cursor helps in filtering the various list response like edge-app bundle list, model list, bundle list etc. title: Cursor is used as filter in list operation. Enterprise: type: object properties: id: type: string description: Unique system defined enterprise ID readOnly: true pattern: '[0-9A-Za-z_=-]{28}' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/Enterprise/properties/id' keyword: uniqueItems sourceValue: true name: type: string description: >- User defined name of the enterprise. Once enterprise is created, name can’t be changed maxLength: 256 minLength: 3 pattern: '[a-zA-Z0-9][a-zA-Z0-9_.-]+' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/Enterprise/properties/name' keyword: uniqueItems sourceValue: true SfdcId: type: string HubspotId: type: string state: description: Enterprise state allOf: - $ref: '#/components/schemas/EnterpriseState' type: description: Enterprise type allOf: - $ref: '#/components/schemas/EnterpriseType' policyList: description: Policy version list allOf: - $ref: '#/components/schemas/PolicyVersionList' parentEntpId: type: string description: Parent enterprise ID title: |- string id = 100; string name = 101; pattern: '[0-9A-Za-z_=-]{28}' azureSubId: type: string description: Azure subscription ID tied to this enterprise title: type: string description: User defined title for the enterprise. Title can be changed any time maxLength: 256 minLength: 3 pattern: '[a-zA-Z0-9]+[a-zA-Z0-9!-~ ]+' description: type: string description: Detailed description of the enterprise maxLength: 256 revision: description: system defined info readOnly: true allOf: - $ref: '#/components/schemas/ObjectRevision' realms: type: array items: type: string description: List of realms associated with the enterprise attributes: type: object additionalProperties: type: string description: enterprise level key-value pairs inheritAuthFromParent: type: boolean description: Perform authorization using parent enterprise childEnterprises: type: array items: $ref: '#/components/schemas/EnterpriseSummary' description: List of all child enterprises controllerHostURL: type: string description: zedcontrol host streamEvents: description: Enable / Disable streaming of events to 3rd party end point allOf: - $ref: '#/components/schemas/DataStream' totpSettings: description: Enterprise settings to enforce TOTP allOf: - $ref: '#/components/schemas/TOTPSettings' apiTokenExpiryInSeconds: type: integer format: int64 description: Enterprise settings for API Token expiry to be set in seconds description: Enterprise meta data title: Enterprise detail required: - name - title Role: type: object example: id: AAGFABAEqnH4je5PHZTXSmHOs-XC name: SysRoot title: SysRoot description: '' revision: prev: '' curr: '1' createdAt: '2020-07-16T18:19:56Z' createdBy: SYSTEM_ROOT updatedAt: '1970-01-01T00:00:01Z' updatedBy: SYSTEM_ROOT type: USER_ROLE_CLUSTER state: ROLE_STATE_ACTIVE scopes: - accessDevice: PermissionAccessCreateReadUpdateDelete accessApp: PermissionAccessCreateReadUpdateDelete accessUser: PermissionAccessCreateReadUpdateDelete accessStorage: PermissionAccessCreateReadUpdateDelete accessEnterprise: PermissionAccessCreateReadUpdateDelete enterpriseFilter: - srAll projectFilter: - srAll properties: id: type: string description: Unique system defined role ID readOnly: true pattern: '[0-9A-Za-z_=-]{28}' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/Role/properties/id' keyword: uniqueItems sourceValue: true name: type: string description: User defined name of the role. Name cannot be changed once created maxLength: 256 minLength: 3 pattern: '[a-zA-Z0-9][a-zA-Z0-9_.-]+' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/Role/properties/name' keyword: uniqueItems sourceValue: true title: type: string description: User defined title of the role. Title can be changed anytime maxLength: 256 minLength: 3 pattern: '[a-zA-Z0-9]+[a-zA-Z0-9!-~ ]+' description: type: string description: Detailed description of the role maxLength: 256 revision: description: System defined info readOnly: true allOf: - $ref: '#/components/schemas/ObjectRevision' type: description: Type of the role allOf: - $ref: '#/components/schemas/UserRole' state: description: State of the role allOf: - $ref: '#/components/schemas/RoleState' scopes: type: array items: $ref: '#/components/schemas/Scope' description: Scopes/Permissions associated with the role projectTags: type: string additionalProperties: type: string description: Map of project tags filter description: Role meta data title: Role detail required: - name - title - type - scopes Realm: type: object example: id: EAJ1ABAi-KOom7dJlrBoE8eq1pj9 name: zededa.com enterpriseId: AAFlABDe6Nm63ixF5LJBbk9Keqp6 title: zededa description: Test realm revision: prev: '' curr: '1' createdAt: '2020-07-17T06:03:14Z' createdBy: us.root@zededa.com updatedAt: '2020-07-17T06:03:14Z' updatedBy: us.root@zededa.com properties: id: type: string description: Unique system defined realm ID readOnly: true pattern: '[0-9A-Za-z_=-]{28}' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/Realm/properties/id' keyword: uniqueItems sourceValue: true name: type: string description: User defined name of the realm. Name cannot be changed once created maxLength: 256 minLength: 3 pattern: '[a-zA-Z0-9][a-zA-Z0-9_.-]+' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/Realm/properties/name' keyword: uniqueItems sourceValue: true enterpriseId: type: string description: Enterprise ID of the enterprise where the realm is to be created pattern: '[0-9A-Za-z_=-]{28}' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/Realm/properties/enterpriseId' keyword: uniqueItems sourceValue: true title: type: string description: User defined title of the realm. Title can be changed anytime maxLength: 256 minLength: 3 pattern: '[a-zA-Z0-9]+[a-zA-Z0-9!-~ ]+' description: type: string description: Detailed description of the realm maxLength: 256 revision: description: System defined info readOnly: true allOf: - $ref: '#/components/schemas/ObjectRevision' description: Realm meta data title: Realm detail required: - name - title - enterpriseId Credential: type: object properties: id: type: string owner: type: string type: $ref: '#/components/schemas/CredentialType' currentCred: type: string newCred: type: string forgot: type: boolean salt: type: integer format: int64 DetailedUser: type: object properties: id: type: string description: Unique system defined user ID readOnly: true pattern: '[0-9A-Za-z_=-]{28}' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/DetailedUser/properties/id' keyword: uniqueItems sourceValue: true username: type: string description: User defined name maxLength: 256 minLength: 3 pattern: '[a-zA-Z0-9][a-zA-Z0-9_.-]+' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/DetailedUser/properties/username' keyword: uniqueItems sourceValue: true SfdcId: type: string HubspotId: type: string revision: description: system defined info readOnly: true allOf: - $ref: '#/components/schemas/ObjectRevision' state: description: User state readOnly: true allOf: - $ref: '#/components/schemas/UserState' firstName: type: string description: First name of the user locale: type: string description: Locale of the user fullName: type: string description: Full name of the user timeZone: type: string description: Preferred time zone of the user roleId: type: string description: Role associated with the user pattern: '[0-9A-Za-z_=-]{28}' type: description: Type of the user allOf: - $ref: '#/components/schemas/AuthType' email: type: string description: Email of the user phone: type: string description: Phone number of the user notifyPref: type: string description: Notification preference of the user LastLoginTime: type: string format: date-time description: Last login time of the user title: Operational Status to be returned to CLI/UI LastLogoutTime: type: string format: date-time description: Last logout time of the user emailState: description: Email state readOnly: true allOf: - $ref: '#/components/schemas/IdState' phoneState: description: Phone state readOnly: true allOf: - $ref: '#/components/schemas/IdState' customUserInput: type: object additionalProperties: type: string description: Custom user parameters allowedEnterprises: type: array items: $ref: '#/components/schemas/AllowedEnterprise' description: Permitted list of enterprises with their associated roles enterpriseId: type: string description: Origin enterprise of the user readOnly: true totpEnabled: type: boolean description: Is TOTP enrolment enabled readOnly: true allowedEntpProjectList: type: object additionalProperties: $ref: '#/components/schemas/ProjectList' description: Allowed enterprise project title: internal zksSyncStatus: description: ZKS Servers Sync Status allOf: - $ref: '#/components/schemas/ZksSyncStatus' tokenZksSyncStatus: type: object additionalProperties: $ref: '#/components/schemas/ZksSyncStatus' description: User session token sync status passwordExpiryNotificationPeriodInSeconds: type: integer format: int64 description: Password expiry notification period in seconds description: User meta data title: User detail required: - username - email - roleId Policy: type: object properties: id: type: string zone: type: string scope: $ref: '#/components/schemas/PolicyScope' access: $ref: '#/components/schemas/PolicyAccess' ownerId: type: string external: type: boolean DocPolicySummary: type: object example: policyName: xxxxxxxxx version: xxxxxxx fileURL: xxxxxxxx revision: prev: '' curr: '1' createdAt: '2020-07-17T06:03:14Z' createdBy: us.root@zededa.com updatedAt: '2020-07-17T06:03:14Z' updatedBy: us.root@zededa.com properties: policy: type: string description: >- User defined name of the docpolicy. Name cannot be changed once created maxLength: 256 minLength: 3 pattern: '[a-zA-Z0-9][a-zA-Z0-9_.-]+' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/DocPolicySummary/properties/policy' keyword: uniqueItems sourceValue: true version: type: string description: Policy doc version fileURL: type: string description: Policy doc fileURL revision: description: System defined info readOnly: true allOf: - $ref: '#/components/schemas/ObjectRevision' description: DocPolicy meta data title: DocPolicy detail AllowedEnterprise: type: object properties: id: type: string name: type: string roleId: type: string Entitlement: type: object properties: entpId: type: string description: Enterprise id for which we want to post/get enforce entitlement pattern: '[0-9A-Za-z-]+' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/Entitlement/properties/entpId' keyword: uniqueItems sourceValue: true entpName: type: string description: Enterprise name for which we want to post/get enforce entitlement pattern: '[0-9A-Za-z-]+' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/Entitlement/properties/entpName' keyword: uniqueItems sourceValue: true devices: type: array items: $ref: '#/components/schemas/DeviceEntitlement' description: Device entitlement data userCount: description: User entitlement data allOf: - $ref: '#/components/schemas/UserEntitlement' plugins: description: Plugin entitlement data allOf: - $ref: '#/components/schemas/PluginEntitlement' features: type: array items: $ref: '#/components/schemas/FeatureEntitlement' description: Features entitlement data description: Get Entitlement data title: Entitlement data LastLoggedinUserInfo: type: object properties: name: type: string lastLoginTime: type: string format: date-time UserUsagePerEnterprise: type: object properties: entpId: type: string description: Enterprise id readOnly: true pattern: '[0-9A-Za-z-]+' userUsage: type: string format: int64 description: User usage for that enterprise CrudContentEncoding: type: string enum: - CrudPayloadEncoding__INVALID__ - CrudPayloadEncodingProtobuf - CrudPayloadEncodingJSON default: CrudPayloadEncoding__INVALID__ CrudContentProtobuf: type: object properties: detailedUser: $ref: '#/components/schemas/DetailedUser' simpleUser: $ref: '#/components/schemas/SimpleUser' enterprise: $ref: '#/components/schemas/Enterprise' realm: $ref: '#/components/schemas/Realm' user: $ref: '#/components/schemas/DetailedUser' credential: $ref: '#/components/schemas/Credential' role: $ref: '#/components/schemas/Role' policy: $ref: '#/components/schemas/Policy' profile: $ref: '#/components/schemas/AuthorizationProfile' docPolicy: $ref: '#/components/schemas/DocPolicy' encryptedSecrets: type: object additionalProperties: type: string cryptoKey: type: string CrudContentJSON: type: object properties: json: type: string AuthType: type: string enum: - AUTH_TYPE_UNSPECIFIED - AUTH_TYPE_LOCAL - AUTH_TYPE_OAUTH - AUTH_TYPE_SAML default: AUTH_TYPE_UNSPECIFIED OAUTHProfile: type: object properties: OIDCEndPoint: type: string description: OIDC endpoint for oauth validation clientID: type: string description: OAUTH client ID clientSecret: type: string description: OAUTH client secret encryptedSecrets: type: object additionalProperties: type: string cryptoKey: type: string roleScope: type: string description: OIDC scope to fetch application role jwtAuthProfile: description: >- Config for JWT based authentication, jwks_uri is derived from OIDC Well Known Endpoints allOf: - $ref: '#/components/schemas/OAUTHProfileJWTAuthProfile' idpId: type: string description: id for Vmware IDP additionalParameters: type: string additionalProperties: type: string description: >- pass additional url parameters during the exchange and authorization process PasswordProfile: type: object properties: minLength: type: integer format: int64 maxLength: type: integer format: int64 minNumericChars: type: integer format: int64 minSymbolChars: type: integer format: int64 minUppercaseChars: type: integer format: int64 minLowercaseChars: type: integer format: int64 maxPasswordAge: type: integer format: int64 minPasswordAge: type: integer format: int64 numPrevPasswordCheck: type: integer format: int64 passwordExpiryNotificationPeriodInSeconds: type: integer format: int64 AuthProfileType: type: string enum: - AUTH_PROFILE_TYPE_UNSPECIFIED - AUTH_PROFILE_TYPE_OAUTH_AZURE_AD - AUTH_PROFILE_TYPE_OAUTH_GOOGLE - AUTH_PROFILE_TYPE_OAUTH_CUSTOM - AUTH_PROFILE_TYPE_LOCAL default: AUTH_PROFILE_TYPE_UNSPECIFIED ObjectRevision: type: object properties: prev: type: string description: Previous curr: type: string description: Current Database version of the record createdAt: type: object format: date-time description: >- The time, in milliseconds since the epoch, when the record was created. createdBy: type: string description: 'User data: Created By' updatedAt: type: object format: date-time description: >- The time, in milliseconds since the epoch, when the record was last updated. updatedBy: type: string description: 'User data: Updated By' description: >- ObjectRevision store the user details, who has doent the necessary operation like Create Operation or update operation title: ObjectRevision is used to store the user information. required: - curr - createdAt - createdBy - updatedAt - updatedBy EnterpriseState: type: string enum: - ENTERPRISE_STATE_UNSPECIFIED - ENTERPRISE_STATE_CREATED - ENTERPRISE_STATE_DELETED - ENTERPRISE_STATE_ACTIVE - ENTERPRISE_STATE_INACTIVE - ENTERPRISE_STATE_SIGNEDUP default: ENTERPRISE_STATE_UNSPECIFIED EnterpriseType: type: string enum: - ENTERPRISE_TYPE_UNSPECIFIED - ENTERPRISE_TYPE_SELFSIGNUP default: ENTERPRISE_TYPE_UNSPECIFIED PolicyVersionList: type: object properties: list: type: array items: $ref: '#/components/schemas/PolicyVersion' EnterpriseSummary: type: object properties: name: type: string id: type: string DataStream: type: object properties: pluginId: type: string enabled: type: boolean TOTPSettings: type: object properties: enforce: type: boolean enforceInChildren: type: boolean enforcedByParent: type: boolean UserRole: type: string enum: - USER_ROLE_UNSPECIFIED - USER_ROLE_SYSTEM_DEFINED - USER_ROLE_USER_DEFINED - USER_ROLE_CLUSTER default: USER_ROLE_UNSPECIFIED RoleState: type: string enum: - ROLE_STATE_UNSPECIFIED - ROLE_STATE_CREATED - ROLE_STATE_ACTIVE - ROLE_STATE_INACTIVE - ROLE_STATE_ARCHIVED default: ROLE_STATE_UNSPECIFIED description: >- Values for this needs to match the const defined in libs/database/datamodel.go for backward compatibility. Scope: type: object properties: accessDevice: type: string description: Device access permission accessApp: type: string description: >- Application access permission, this will be deprecated in further release - please use accessEdgeApp and accessAppInstance for granular permission access scope. accessUser: type: string description: User access permission accessStorage: type: string description: Storage access permission accessEnterprise: type: string description: Enterprise access permission enterpriseFilter: type: array items: type: string description: List of enterprise filters projectFilter: type: array items: type: string description: List of project filters accessEdgeApp: type: string description: Edge app access permission accessAppInstance: type: string description: Application Instance access permission accessEnterpriseIntegrationItems: type: string description: datastream and 3rd party integration access permission uuid: type: string description: Unique system defined scope ID readOnly: true pattern: '[0-9A-Za-z_=-]{28}' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/Scope/properties/uuid' keyword: uniqueItems sourceValue: true CredentialType: type: string enum: - CREDENTIAL_TYPE_UNSPECIFIED - CREDENTIAL_TYPE_PASSWORD - CREDENTIAL_TYPE_CHAP - CREDENTIAL_TYPE_PUBLIC_KEY - CREDENTIAL_TYPE_NONE default: CREDENTIAL_TYPE_UNSPECIFIED UserState: type: string enum: - USER_STATE_UNSPECIFIED - USER_STATE_CREATED - USER_STATE_ACTIVE - USER_STATE_INACTIVE - USER_STATE_SIGNEDUP - USER_STATE_SUSPENDED default: USER_STATE_UNSPECIFIED title: General well being of the user IdState: type: string enum: - ID_STATE_UNSPECIFIED - ID_STATE_NOT_VERIFIED - ID_STATE_VERIFIED default: ID_STATE_UNSPECIFIED ProjectList: type: object properties: project: type: array items: type: string ZksSyncStatus: type: object properties: status: $ref: '#/components/schemas/ZksSyncStatusCode' serverStatuses: type: array items: $ref: '#/components/schemas/ServerSyncStatus' PolicyScope: type: string enum: - PermissionScope__INVALID__ - PermissionScopeOther - PermissionScopeGroup - PermissionScopeOtherGroup - PermissionScopeOwner - PermissionScopeOtherOwner - PermissionScopeGroupOwner - PermissionScopeOtherGroupOwner - PermissionScopeEnterprise - PermissionScopeOtherEnterprise - PermissionScopeGroupEnterprise - PermissionScopeOtherGroupEnterprise - PermissionScopeOwnerEnterprise - PermissionScopeOtherOwnerEnterprise - PermissionScopeGroupOwnerEnterprise - PermissionScopeOtherGroupOwnerEnterprise default: PermissionScope__INVALID__ title: Scope of the permission, similar to Unix file system PolicyAccess: type: string enum: - PermissionAccess__INVALID__ - PermissionAccessCreate - PermissionAccessRead - PermissionAccessCreateRead - PermissionAccessUpdate - PermissionAccessCreateUpdate - PermissionAccessReadUpdate - PermissionAccessCreateReadUpdate - PermissionAccessDelete - PermissionAccessCreateDelete - PermissionAccessReadDelete - PermissionAccessCreateReadDelete - PermissionAccessUpdateDelete - PermissionAccessCreateUpdateDelete - PermissionAccessReadUpdateDelete - PermissionAccessCreateReadUpdateDelete - PermissionAccessExecute - PermissionAccessCreateExecute - PermissionAccessReadExecute - PermissionAccessCreateReadExecute - PermissionAccessUpdateExecute - PermissionAccessCreateUpdateExecute - PermissionAccessReadUpdateExecute - PermissionAccessCreateReadUpdateExecute - PermissionAccessDeleteExecute - PermissionAccessCreateDeleteExecute - PermissionAccessReadDeleteExecute - PermissionAccessCreateReadDeleteExecute - PermissionAccessUpdateDeleteExecute - PermissionAccessCreateUpdateDeleteExecute - PermissionAccessReadUpdateDeleteExecute - PermissionAccessCreateReadUpdateDeleteExecute - PermissionAccessQuery - PermissionAccessCreateQuery - PermissionAccessReadQuery - PermissionAccessCreateReadQuery - PermissionAccessUpdateQuery - PermissionAccessCreateUpdateQuery - PermissionAccessReadUpdateQuery - PermissionAccessCreateReadUpdateQuery - PermissionAccessDeleteQuery - PermissionAccessCreateDeleteQuery - PermissionAccessReadDeleteQuery - PermissionAccessCreateReadDeleteQuery - PermissionAccessUpdateDeleteQuery - PermissionAccessCreateUpdateDeleteQuery - PermissionAccessReadUpdateDeleteQuery - PermissionAccessCreateReadUpdateDeleteQuery - PermissionAccessExecuteQuery - PermissionAccessCreateExecuteQuery - PermissionAccessReadExecuteQuery - PermissionAccessCreateReadExecuteQuery - PermissionAccessUpdateExecuteQuery - PermissionAccessCreateUpdateExecuteQuery - PermissionAccessReadUpdateExecuteQuery - PermissionAccessCreateReadUpdateExecuteQuery - PermissionAccessDeleteExecuteQuery - PermissionAccessCreateDeleteExecuteQuery - PermissionAccessReadDeleteExecuteQuery - PermissionAccessCreateReadDeleteExecuteQuery - PermissionAccessUpdateDeleteExecuteQuery - PermissionAccessCreateUpdateDeleteExecuteQuery - PermissionAccessReadUpdateDeleteExecuteQuery - PermissionAccessCreateReadUpdateDeleteExecuteQuery default: PermissionAccess__INVALID__ DeviceEntitlement: type: object properties: size: $ref: '#/components/schemas/DeviceSize' limit: type: integer format: int32 usage: type: integer format: int64 UserEntitlement: type: object properties: limit: type: integer format: int32 usage: type: integer format: int64 PluginEntitlement: type: object properties: pluginTotalLimit: type: integer format: int32 pluginTotalUsage: type: integer format: int64 pluginTypeEntitlement: type: array items: $ref: '#/components/schemas/PluginTypeEntitlement' FeatureEntitlement: type: object properties: name: type: string active: type: boolean subFeatureEntitlement: type: array items: $ref: '#/components/schemas/FeatureEntitlement' title: SubFeatureEntitlement represents nested sub-features entitlement SimpleUser: type: object properties: id: type: string title: BEGIN-SYNC(SimpleUser) username: type: string realmId: type: string state: $ref: '#/components/schemas/UserState' firstName: type: string DocPolicy: type: object example: id: EAJ1ABAi-KOom7dJlrBoE8eq1pj9 policyName: xxxxxxxxx version: xxxxxxx fileURL: xxxxxxxx serverHost: zedcontrol.local.zededa.net latest: false revision: prev: '' curr: '1' createdAt: '2020-07-17T06:03:14Z' createdBy: us.root@zededa.com updatedAt: '2020-07-17T06:03:14Z' updatedBy: us.root@zededa.com properties: id: type: string description: Unique system defined docpolicy ID readOnly: true pattern: '[0-9A-Za-z_=-]{28}' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/DocPolicy/properties/id' keyword: uniqueItems sourceValue: true policyName: type: string description: >- User defined name of the docpolicy. Name cannot be changed once created maxLength: 256 minLength: 3 pattern: '[a-zA-Z0-9][a-zA-Z0-9_.-]+' x-zededa-source-issues: - code: inapplicable-constraint pointer: '#/definitions/DocPolicy/properties/policyName' keyword: uniqueItems sourceValue: true version: type: string description: Policy doc version fileURL: type: string description: Policy doc fileURL serverHost: type: string description: Server Host latest: type: boolean description: Mark latest docpolicy check revision: description: System defined info readOnly: true allOf: - $ref: '#/components/schemas/ObjectRevision' description: DocPolicy meta data title: DocPolicy detail required: - policyName OAUTHProfileJWTAuthProfile: type: object properties: alg: description: Algorithm for JWT signature verification allOf: - $ref: '#/components/schemas/JWTAuthProfileAlgorithm' description: >- Config for JWT based authentication, jwks_uri is derived from OIDC Well Known Endpoints title: JWT Authentication profile detail PolicyVersion: type: object properties: Policy: type: string Version: type: string AcceptedAt: type: string format: date-time AcceptedBy: type: string EffectiveFrom: type: string format: date-time ZksSyncStatusCode: type: string enum: - ZKS_SYNC_STATUS_CODE_UNSPECIFIED - ZKS_SYNC_STATUS_CODE_HEALTHY - ZKS_SYNC_STATUS_CODE_PARTIALLY_HEALTHY - ZKS_SYNC_STATUS_CODE_UNHEALTHY default: ZKS_SYNC_STATUS_CODE_UNSPECIFIED ServerSyncStatus: type: object properties: serverName: type: string status: type: string error: type: string DeviceSize: type: string enum: - DEFAULT_SIZE - SMALL_SIZE - MEDIUM_SIZE - LARGE_SIZE - XLARGE_SIZE default: DEFAULT_SIZE PluginTypeEntitlement: type: object properties: pluginType: $ref: '#/components/schemas/PluginType' pluginTypeLimit: type: integer format: int32 pluginTypeUsage: type: integer format: int64 JWTAuthProfileAlgorithm: type: string enum: - None - RS256 - RS384 - RS512 default: None PluginType: type: string enum: - PLUGIN_TYPE_UNSPECIFIED - PLUGIN_TYPE_SPLUNK - PLUGIN_TYPE_HTTP - PLUGIN_TYPE_RANCHER - PLUGIN_TYPE_VMWARE_VCO - PLUGIN_TYPE_VMWARE_TMC - PLUGIN_TYPE_OTEL default: PLUGIN_TYPE_UNSPECIFIED securitySchemes: BearerToken: type: http description: Bearer token for user session scheme: bearer ````