{ "openapi": "3.0.3", "info": { "title": "Netwrix Privilege Secure for Access Management API", "description": "REST API for Netwrix Privilege Secure for Access Management. Operations available in the web console are available through this API. Sign in to get a JSON Web Token (JWT) and send it in the Authorization header as a bearer token.", "version": "26.07.3" }, "servers": [ { "url": "https://{host}:6500", "description": "Your Privilege Secure server. The console and the API use port 6500.", "variables": { "host": { "default": "server.example.com", "description": "Host name or address of your Privilege Secure server." } } } ], "security": [ { "bearerAuth": [] } ], "tags": [ { "name": "Access Certification Denial", "description": "Review and manage denied access certification requests." }, { "name": "Access Certification Task", "description": "Manage the tasks that ask reviewers to certify access." }, { "name": "Access Control Policy", "description": "Manage the policies that control who can access which resources." }, { "name": "Action Group", "description": "Manage groups of actions." }, { "name": "Action Job", "description": "View and manage action jobs and their results." }, { "name": "Action Queue", "description": "View and manage the queue of pending actions." }, { "name": "Action Template", "description": "Manage the templates that define actions." }, { "name": "Active Directory", "description": "Manage Active Directory domains and their settings." }, { "name": "Activity", "description": "Manage activities that users can run on resources." }, { "name": "Activity Group", "description": "Manage groups of activities." }, { "name": "Activity Session", "description": "View and manage activity sessions." }, { "name": "AD Configuration", "description": "Manage Active Directory configuration settings." }, { "name": "Approval Workflow", "description": "Manage the workflows that approve access requests." }, { "name": "Audit Change", "description": "Read the audit trail of configuration changes." }, { "name": "Azure AD", "description": "Manage Azure AD tenants." }, { "name": "Command Plan", "description": "Manage command plans." }, { "name": "Command Restriction", "description": "Manage the restrictions that limit which commands can run." }, { "name": "Connection Profile", "description": "Manage the profiles that define how to connect to resources." }, { "name": "Console Access", "description": "Manage who can sign in to the console." }, { "name": "Credential", "description": "Manage stored credentials." }, { "name": "Credential Group", "description": "Manage groups of credentials." }, { "name": "Credential Password History", "description": "View the password history of credentials." }, { "name": "Domain Sync", "description": "Manage domain synchronization." }, { "name": "Email", "description": "Manage email settings and notifications." }, { "name": "Encrypted File", "description": "Manage encrypted files." }, { "name": "Event Message", "description": "Read event messages." }, { "name": "Group", "description": "Manage groups." }, { "name": "Group Role", "description": "Manage the roles assigned to groups." }, { "name": "Host", "description": "Manage hosts." }, { "name": "Host Database", "description": "View the databases found on hosts." }, { "name": "Host Feature", "description": "View the features found on hosts." }, { "name": "Host Group", "description": "Manage groups of hosts." }, { "name": "Host Scan Job", "description": "Manage jobs that scan hosts." }, { "name": "Host Scan Service", "description": "Manage the service that scans hosts." }, { "name": "Host Scheduled Task", "description": "View the scheduled tasks found on hosts." }, { "name": "Host Service", "description": "View the services found on hosts." }, { "name": "Host User", "description": "View the local users found on hosts." }, { "name": "Integration Connector", "description": "Manage connectors to other products." }, { "name": "Integration Connector Template", "description": "Manage the templates for integration connectors." }, { "name": "IP Address Rule", "description": "Manage the IP address rules that allow or block connections." }, { "name": "License", "description": "Read license information." }, { "name": "Log", "description": "Read server logs." }, { "name": "Managed Account", "description": "Manage accounts that the product controls." }, { "name": "Managed Account Group", "description": "Manage groups of managed accounts." }, { "name": "Managed Database", "description": "Manage databases that the product controls." }, { "name": "Managed Resource", "description": "Manage resources that the product controls." }, { "name": "Managed Resource Group", "description": "Manage groups of managed resources." }, { "name": "Managed User", "description": "Manage users that the product controls." }, { "name": "MFA Connector", "description": "Manage connectors to multi-factor authentication providers." }, { "name": "Node Status", "description": "Read the status of server nodes." }, { "name": "Override Policy", "description": "Manage policies that override default behavior." }, { "name": "Password Complexity", "description": "Manage password complexity rules." }, { "name": "Password Options", "description": "Manage password options." }, { "name": "Permissions", "description": "Manage permissions." }, { "name": "Platform", "description": "Manage platforms and their settings." }, { "name": "PostgreSQL", "description": "Manage the PostgreSQL database connection." }, { "name": "Protection Policy", "description": "Manage the policies that protect resources." }, { "name": "Registered Service", "description": "Manage registered services." }, { "name": "Replay Session", "description": "View and replay recorded sessions." }, { "name": "Report", "description": "Manage and run reports." }, { "name": "Report Source", "description": "Manage the data sources that reports use." }, { "name": "Roles", "description": "Manage roles." }, { "name": "Scheduled Change Policy", "description": "Manage policies that schedule changes." }, { "name": "Secret Vault", "description": "Manage secret vaults." }, { "name": "SIEM Server", "description": "Manage SIEM servers." }, { "name": "SIEM Settings", "description": "Manage SIEM settings." }, { "name": "SIEM Template", "description": "Manage the message templates for SIEM servers." }, { "name": "System Settings", "description": "Read and change system settings." }, { "name": "User", "description": "Manage users." }, { "name": "User and Group Collection", "description": "Manage collections of users and groups." }, { "name": "User Role", "description": "Manage the roles assigned to users." }, { "name": "User Token", "description": "Manage tokens issued to users." }, { "name": "Version", "description": "Read the product version." }, { "name": "Website", "description": "Manage websites that users can reach." }, { "name": "Website URL", "description": "Manage the URLs that belong to websites." } ], "paths": { "/api/v1/AccessCertificationDenial/AccessPolicy/{policyId}": { "get": { "tags": [ "Access Certification Denial" ], "summary": "List access certification denials for an access policy", "description": "Returns the access certification decisions recorded for one access policy, with the resource, credential, activity and task names filled in. By default it returns only decisions that have been resolved as approved or denied.\n\nPermission required: Access Policies permission, and the Admin or UserPlus role.\n\nValues for `[].status`: 0 = NotSet, 1 = Requested, 2 = Approved, 3 = Denied.", "operationId": "AccessCertificationDenial_GetDenialsForAccessPolicy", "parameters": [ { "name": "policyId", "in": "path", "description": "The ID of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "includeAll", "in": "query", "description": "Set to true to include decisions that are still pending. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "Returns an array of denials. The array is empty when the policy has none.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AccessCertificationDenial" } } } } }, "400": { "description": "The denials could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationDenial/User/{userId}": { "get": { "tags": [ "Access Certification Denial" ], "summary": "List access certification denials for a user", "description": "Returns the access certification decisions recorded for one managed user account.\n\nPermission required: Any signed-in user.\n\nValues for `[].status`: 0 = NotSet, 1 = Requested, 2 = Approved, 3 = Denied.\n\nCaution: The response lists access certification decisions for the named account.", "operationId": "AccessCertificationDenial_GetDenialsForUser", "parameters": [ { "name": "userId", "in": "path", "description": "The ID of the managed user account.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "Returns an array of denials. The array is empty when the user has none.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AccessCertificationDenial" } } } } }, "400": { "description": "The denials could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationDenial/{denialId}": { "delete": { "tags": [ "Access Certification Denial" ], "summary": "Delete an access certification denial", "description": "Deletes one denial that an access certification review recorded. Use it to remove a denial you no longer want to apply.\n\nPermission required: Admin role.\n\nCaution: The denial is deleted immediately and the call cannot be undone.", "operationId": "AccessCertificationDenial_DeleteDenial", "parameters": [ { "name": "denialId", "in": "path", "description": "The ID of the denial to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "responses": { "202": { "description": "The delete was accepted. The body is the denial ID. The call also returns 202 when no denial has that ID.", "content": { "application/json": { "schema": { "type": "string", "format": "uuid" } } } }, "400": { "description": "The denial could not be deleted." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationTask/Csv/{taskId}": { "get": { "tags": [ "Access Certification Task" ], "summary": "Export an access certification task as CSV", "description": "Returns the task details followed by every activity row selected for the task, as comma-separated text. Commas inside values are replaced with spaces, and a pipe character (|) inside a value becomes a comma, which shifts the columns. Use it to export a task for reporting.\n\nPermission required: Admin or Reviewer role.", "operationId": "AccessCertificationTask_GetTaskAsCsv", "parameters": [ { "name": "taskId", "in": "path", "description": "The ID of the task to export.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "Returns the CSV text as a JSON string.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "The export failed." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The task does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationTask/Review/{taskId}": { "put": { "tags": [ "Access Certification Task" ], "summary": "Submit a review for an access certification task", "description": "Records the reviewer's approve or deny decisions for activity rows and sets the task status. When the status is Complete (3), the task is closed and each row's decision is recorded as a certification decision for that user's access.\n\nPermission required: Reviewer role, and the signed-in user must be the task's reviewer.\n\nValues for `summary.status`: 0 = Setup, 1 = ReadyToStart, 2 = Incomplete, 3 = Complete.\n\nValues for `activitiesDetail[].status`: 0 = NotSet, 1 = Requested, 2 = Approved, 3 = Denied.\n\nCaution: Setting the status to Complete closes the task and records its decisions immediately, and the task can no longer be reviewed. Sending 0 (Setup) or leaving the status out puts the task back into setup, so the reviewer can no longer see or review it.", "operationId": "AccessCertificationTask_ReviewTask", "parameters": [ { "name": "taskId", "in": "path", "description": "The ID of the task being reviewed.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "status", "in": "query", "description": "The status number to set on the task. Send 2 (Incomplete) while saving decisions, and 3 (Complete) to finish the review. Always send it: the server does not check which status you send, and if you leave it out it is treated as 0 (Setup), which puts the task back into setup.", "required": true, "schema": { "$ref": "#/components/schemas/AccessCertificationTaskStatus" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AccessCertificationTaskRowReview" } } } }, "required": true, "description": "A JSON array of row decisions (not an object). Send an empty array with status 3 to complete the task with the decisions already saved.\n\n- `id` (string (GUID), required): ID of the activity row. Rows that are not in the task are ignored.\n- `status` (integer, required): Decision for the row: 2 (Approved) or 3 (Denied). Rows with status NotSet (0) are left unchanged. Send only 2 or 3." }, "responses": { "200": { "description": "Returns the task summary and the detail of each activity row.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessCertificationTaskRequestResponse" } } } }, "400": { "description": "The task is in setup or already complete, or the review failed." }, "401": { "description": "The signed-in user is not the reviewer for this task." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The task does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationTask/Rows/Review/{taskId}": { "get": { "tags": [ "Access Certification Task" ], "summary": "List task activity rows for review", "description": "Returns a page of the activity rows in a task that is released for review, so the assigned reviewer can approve or deny them. Each row shows the user, access policy, resource, credential, activity and last access time.\n\nPermission required: Reviewer role.\n\nValues for `data[].status`: 0 = NotSet, 1 = Requested, 2 = Approved, 3 = Denied.", "operationId": "AccessCertificationTask_SearchTaskRowsForReview", "parameters": [ { "name": "taskId", "in": "path", "description": "The ID of the access certification task.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "filterText", "in": "query", "description": "Text to search for, ignoring case. Returns only rows whose user, access policy, resource, credential, activity or connection profile contains this text.", "required": false, "schema": { "type": "string" }, "example": "smith" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. Applies only when orderBy is set.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "skip", "in": "query", "description": "Number of items to skip before returning results. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Number of items to return. The default is 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort the results by, ignoring case. When omitted, results sort by user name in ascending order.", "required": false, "schema": { "type": "string", "default": "" }, "example": "userName" } ], "responses": { "200": { "description": "Returns a table object with the page of items in data and the total number of matching items in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfAccessCertRowTable" } } } }, "400": { "description": "The request failed, or the task is still being set up." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The task does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationTask/Rows/Update/{taskId}": { "put": { "tags": [ "Access Certification Task" ], "summary": "Select the activity rows for a task", "description": "Adds or removes activity rows in a task. A row with no ID and status Requested (1) is added, and a row with an ID and status NotSet (0) is removed. Build the rows from the activitiesDetail list that the create, update or get task call returns.\n\nPermission required: Admin role.\n\nValues for `rows[].status and activitiesDetail[].status`: 0 = NotSet, 1 = Requested, 2 = Approved, 3 = Denied.\n\nValues for `summary.status`: 0 = Setup, 1 = ReadyToStart, 2 = Incomplete, 3 = Complete.\n\nCaution: Changes are saved immediately. The server does not check the task's status, so rows can still be added or removed after the task is released for review.", "operationId": "AccessCertificationTask_UpdateRowStatus", "parameters": [ { "name": "taskId", "in": "path", "description": "The ID of the access certification task.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "requestBody": { "description": "The task ID and the rows to add or remove.\n\n- `taskId` (string (GUID), required): ID of the task. It must match the ID in the path.\n- `rows` (array of row objects, required): The rows to change, in the same shape as activitiesDetail in the task response. Set status on each row to add or remove it. Each row's userId is the task's own user entry, as returned in activitiesDetail, not the user account ID. To add a row, leave id empty (or omit it), set status to 1 (Requested), and copy accessPolicyId, activityId, resourceId, credentialId and userId from an available row. To remove a row, send its id with status 0 (NotSet). Rows that do not match a row available to the task are ignored.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessCertificationTaskRowUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the task summary and the detail of each activity row, selected and available.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessCertificationTaskRequestResponse" } } } }, "400": { "description": "The ID in the path does not match the body, or the update failed." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The task does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationTask/Rows/{taskId}": { "get": { "tags": [ "Access Certification Task" ], "summary": "List task activity rows", "description": "Returns a page of the activity rows selected for a task. Each row shows the user, access policy, resource, credential, activity and last access time.\n\nPermission required: Admin role.\n\nValues for `data[].status`: 0 = NotSet, 1 = Requested, 2 = Approved, 3 = Denied.", "operationId": "AccessCertificationTask_SearchTaskRowsForAdmin", "parameters": [ { "name": "taskId", "in": "path", "description": "The ID of the access certification task.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "filterText", "in": "query", "description": "Text to search for, ignoring case. Returns only rows whose user, access policy, resource, credential, activity or connection profile contains this text.", "required": false, "schema": { "type": "string" }, "example": "smith" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. Applies only when orderBy is set.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "skip", "in": "query", "description": "Number of items to skip before returning results. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Number of items to return. The default is 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort the results by, ignoring case. When omitted, results sort by user name in ascending order.", "required": false, "schema": { "type": "string", "default": "" }, "example": "userName" } ], "responses": { "200": { "description": "Returns a table object with the page of items in data and the total number of matching items in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfAccessCertRowTable" } } } }, "400": { "description": "The request failed." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The task does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationTask/Summary": { "get": { "tags": [ "Access Certification Task" ], "summary": "List access certification tasks", "description": "Returns every access certification task with its name, status, reviewer and dates, sorted by name.\n\nPermission required: Admin role.\n\nValues for `[].status`: 0 = Setup, 1 = ReadyToStart, 2 = Incomplete, 3 = Complete.", "operationId": "AccessCertificationTask_GetSummary", "responses": { "200": { "description": "Returns an array of task summaries. The array is empty when there are no tasks.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AccessCertificationTaskSummary" } } } } }, "400": { "description": "The tasks could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationTask/Tasks/Delete/{taskId}": { "delete": { "tags": [ "Access Certification Task" ], "summary": "Delete an access certification task", "description": "Deletes an access certification task. A task that is already complete cannot be deleted.\n\nPermission required: Admin role.\n\nCaution: The task is deleted immediately and the call cannot be undone.", "operationId": "AccessCertificationTask_DeleteTask", "parameters": [ { "name": "taskId", "in": "path", "description": "The ID of the task to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "202": { "description": "The delete was accepted." }, "400": { "description": "The task is complete or could not be deleted." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The task does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationTask/Tasks/New": { "post": { "tags": [ "Access Certification Task" ], "summary": "Create an access certification task", "description": "Creates a task in the Setup (0) state and returns it with the activity rows available for its users. Use the rows update call afterward to choose which rows to include.\n\nPermission required: Admin role.\n\nValues for `summary.status`: 0 = Setup, 1 = ReadyToStart, 2 = Incomplete, 3 = Complete.\n\nValues for `activitiesDetail[].status`: 0 = NotSet, 1 = Requested, 2 = Approved, 3 = Denied.\n\nCaution: The task is created immediately.", "operationId": "AccessCertificationTask_NewTask", "requestBody": { "description": "The task to create.\n\n- `name` (string, required): Name of the task. Must be unique across tasks, ignoring case.\n- `description` (string): Description of the task.\n- `reviewerId` (string (GUID), required): ID of the user who reviews the task. Only this user can see and review the task. The server does not check this value, so always set it.\n- `userIds` (array of string (GUID)): IDs of the users whose access the task covers.\n- `groupIds` (array of string (GUID)): IDs of the user groups whose members' access the task covers. The members of each group are added as users of the task when it is saved.\n- `scheduledStartDateTimeUtc` (string (date-time)): Scheduled start time in UTC. Ignored on create. The server sets the scheduled start to the creation time.\n- `startDateTimeUtc` (string (date-time)): Start time in UTC. Leave it out. A value sent on create is stored as given; otherwise the server sets it when the reviewer first saves a review with status Incomplete (2).\n- `id` (string (GUID)): ID of the task. Leave it out when creating a task.\n- `status` (integer): Task status. Ignored on create. The server sets the status to Setup (0).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessCertificationTaskCreateRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the task summary and the detail of each available activity row.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessCertificationTaskRequestResponse" } } } }, "400": { "description": "The name is missing or the task could not be created." }, "403": { "description": "The signed-in user does not have the required role." }, "409": { "description": "A task with this name already exists. Names are compared ignoring case." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationTask/Tasks/Update/{taskId}": { "put": { "tags": [ "Access Certification Task" ], "summary": "Update or release an access certification task", "description": "Replaces the settings of a task that is still in the Setup (0) state, including its name, description, reviewer, users and status. Set status to ReadyToStart (1) to release the task for review; after that, this call no longer accepts changes. Changing the users can change which activity rows are available, so check the row selection afterward with the rows update call, using the rows this call returns.\n\nPermission required: Admin role.\n\nValues for `summary.status`: 0 = Setup, 1 = ReadyToStart, 2 = Incomplete, 3 = Complete.\n\nValues for `activitiesDetail[].status`: 0 = NotSet, 1 = Requested, 2 = Approved, 3 = Denied.\n\nCaution: The call replaces the whole task immediately, so any field or user you leave out is cleared. Send the same task ID in the path and the body: only the task in the path is checked for the Setup state, but the task in the body is the one changed.", "operationId": "AccessCertificationTask_Put", "parameters": [ { "name": "taskId", "in": "path", "description": "The ID of the task to update.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "requestBody": { "description": "The complete task. Values you leave out are cleared, so send every field you want to keep.\n\n- `id` (string (GUID), required): ID of the task. Send the same ID as in the path. The server does not check that this matches the ID in the path. The task with this ID is the one updated, so always send the path ID.\n- `name` (string, required): Name of the task. The server does not check that the new name is unique.\n- `description` (string): Description of the task.\n- `reviewerId` (string (GUID), required): ID of the user who reviews the task. The server does not check this value, so always set it.\n- `status` (integer): Task status. Send 0 (Setup) to keep editing, or 1 (ReadyToStart) to release the task for review. If you leave it out, it is set to Setup (0).\n- `userIds` (array of string (GUID)): IDs of the users whose access the task covers. Replaces the task's current users. An empty or missing list removes all users.\n- `groupIds` (array of string (GUID)): IDs of the user groups whose members' access the task covers. The members of each group are added as users of the task when it is saved.\n- `scheduledStartDateTimeUtc` (string (date-time)): Scheduled start time in UTC. Send the current value to keep it.\n- `startDateTimeUtc` (string (date-time)): Start time in UTC. Ignored. The server keeps the stored value.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessCertificationTaskUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the task summary and the detail of each available activity row.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessCertificationTaskRequestResponse" } } } }, "400": { "description": "The task has already been released for review, or the update failed." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The task does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationTask/Tasks/{reviewerId}": { "get": { "tags": [ "Access Certification Task" ], "summary": "List access certification tasks for a reviewer", "description": "Returns the tasks assigned to one reviewer, sorted by name. Tasks that are still in setup are never returned.\n\nPermission required: Reviewer role.\n\nValues for `[].status`: 0 = Setup, 1 = ReadyToStart, 2 = Incomplete, 3 = Complete.\n\nCaution: The response lists the tasks assigned to the reviewer ID you supply.", "operationId": "AccessCertificationTask_GetTasksByReviewer", "parameters": [ { "name": "reviewerId", "in": "path", "description": "The ID of the reviewer.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "status", "in": "query", "description": "Return only tasks with this status number. Omit it to return all tasks that are not in setup.", "required": false, "schema": { "$ref": "#/components/schemas/AccessCertificationTaskStatus" } } ], "responses": { "200": { "description": "Returns an array of task summaries.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AccessCertificationTaskSummary" } } } } }, "400": { "description": "The tasks could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationTask/Users/Review/{taskId}": { "get": { "tags": [ "Access Certification Task" ], "summary": "List task users for review", "description": "Returns a page of the users covered by a task that is released for review, with their email address and account name.\n\nPermission required: Reviewer role.\n\nValues for `data[].type`: 0 = User, 1 = Application, 2 = Local.", "operationId": "AccessCertificationTask_SearchTaskUsersReview", "parameters": [ { "name": "taskId", "in": "path", "description": "The ID of the access certification task.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "filterText", "in": "query", "description": "Text to search for, ignoring case. Returns only users whose name, email address or account name contains this text.", "required": false, "schema": { "type": "string" }, "example": "smith" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. Applies only when orderBy is set.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "skip", "in": "query", "description": "Number of items to skip before returning results. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Number of items to return. The default is 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort the results by, ignoring case. When omitted, results sort by user name in ascending order.", "required": false, "schema": { "type": "string", "default": "" }, "example": "userName" } ], "responses": { "200": { "description": "Returns a table object with the page of items in data and the total number of matching items in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfAccessCertUserTable" } } } }, "400": { "description": "The request failed, or the task is still being set up." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The task does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationTask/Users/{taskId}": { "get": { "tags": [ "Access Certification Task" ], "summary": "List task users", "description": "Returns a page of the users covered by a task, with their email address and account name.\n\nPermission required: Admin role.\n\nValues for `data[].type`: 0 = User, 1 = Application, 2 = Local.", "operationId": "AccessCertificationTask_SearchTaskUsersAdmin", "parameters": [ { "name": "taskId", "in": "path", "description": "The ID of the access certification task.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "filterText", "in": "query", "description": "Text to search for, ignoring case. Returns only users whose name, email address or account name contains this text.", "required": false, "schema": { "type": "string" }, "example": "smith" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. Applies only when orderBy is set.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "skip", "in": "query", "description": "Number of items to skip before returning results. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Number of items to return. The default is 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort the results by, ignoring case. When omitted, results sort by user name in ascending order.", "required": false, "schema": { "type": "string", "default": "" }, "example": "userName" } ], "responses": { "200": { "description": "Returns a table object with the page of items in data and the total number of matching items in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfAccessCertUserTable" } } } }, "400": { "description": "The request failed." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The task does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessCertificationTask/{taskId}": { "get": { "tags": [ "Access Certification Task" ], "summary": "Get an access certification task", "description": "Returns one task with its summary and the detail of each activity row.\n\nPermission required: Admin or Reviewer role.\n\nValues for `summary.status`: 0 = Setup, 1 = ReadyToStart, 2 = Incomplete, 3 = Complete.\n\nValues for `activitiesDetail[].status`: 0 = NotSet, 1 = Requested, 2 = Approved, 3 = Denied.", "operationId": "AccessCertificationTask_Get", "parameters": [ { "name": "taskId", "in": "path", "description": "The ID of the task to retrieve.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "Returns the task summary and the detail of each activity row.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessCertificationTaskRequestResponse" } } } }, "400": { "description": "The task could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The task does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy": { "get": { "tags": [ "Access Control Policy" ], "summary": "List access policies", "description": "Returns the access policies. With no options it returns every access policy, including deleted and disabled ones. Use isDeleted or isDisabled to return only those.\n\nPermission required: Administrator role or application role.", "operationId": "AccessControlPolicy_GetAll", "parameters": [ { "name": "isDeleted", "in": "query", "description": "Set to true to return only deleted access policies. False has no effect.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "isDisabled", "in": "query", "description": "Set to true to return only disabled access policies. If isDeleted is also true, isDeleted wins. False has no effect.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "ignoreStatus", "in": "query", "description": "Returns all access policies, the same as leaving all three options off.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "Returns an array of access policies.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/SimpleAccessControlPolicy" } } } } }, "400": { "description": "The access policies could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Access Control Policy" ], "summary": "Create an access policy", "description": "Creates an access policy and returns it with its new id. A policy is either Resource based, which lets users run the policy activities on its resources, or Credential based, which lets users release a credential during a session. A Credential based policy automatically gets the Credential Release and File Release activities. The name must be unique among all access policies. Add members afterwards with the add routes.\n\nPermission required: Administrator or application.\n\nValues for `policyType`: 0 = Resource, 1 = Credential.", "operationId": "AccessControlPolicy_Post", "requestBody": { "description": "The access policy to create. The notesRequired, ticketRequired and approvalTypeRequired fields that appear in responses are ignored when sent.\n\n- `name` (string, required): Unique name of the policy. A duplicate name is rejected. The check ignores upper and lower case.\n- `description` (string): Description of the policy.\n- `policyType` (integer (enum)): Whether the policy is Resource based or Credential based. 0 = Resource, 1 = Credential. If omitted, the policy is Resource based.\n- `activityConfigurationId` (string (GUID), required): Id of the connection profile that the policy uses, as returned by the connection profile list. Required.\n- `priority` (integer): Priority of the policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleAccessControlPolicyCreateRequest" }, "example": { "name": "", "policyType": 0, "activityConfigurationId": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } } }, "required": true }, "responses": { "200": { "description": "The policy was created. The body is the new policy with its id. In it, approvalTypeRequired is always 0, notesRequired and ticketRequired are false and activityConfiguration is null; read the policy back with the Get route for current values.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleAccessControlPolicy" } } } }, "400": { "description": "The name is missing or already used by another policy, the connection profile id is missing, or the policy could not be created." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/ActivityCardWithPolicies": { "get": { "tags": [ "Access Control Policy" ], "summary": "List activity cards with their access policies", "description": "Returns the activities available to a managed account as cards, together with the access policy details for each. Administrators can request another account; other users always see their own.\n\nPermission required: Any signed-in user.", "operationId": "AccessControlPolicy_GetActivityCardsWithPolicies", "parameters": [ { "name": "managedAccountId", "in": "query", "description": "ID of the managed account. Only administrators can use it to view another account; for other users it is ignored.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "Skip", "in": "query", "description": "Number of records to skip before returning results. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "Maximum number of records to return. Default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. Default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only cards whose activity name or access policy name contains this text.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route. The server accepts it but ignores it.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "groupByPolicy", "in": "query", "description": "Set to true to group the cards by access policy.", "required": false, "schema": { "type": "boolean" }, "example": true }, { "name": "includeCount", "in": "query", "description": "Not used in this release. The server accepts it but ignores it.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "includeData", "in": "query", "description": "Not used in this release. The server accepts it but ignores it; the card data is always returned.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true } ], "responses": { "200": { "description": "Returns a table object with the total record count and the requested page of activity cards.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfActivityCardWithPolicies" } } } }, "400": { "description": "No managed account could be determined, for example when an administrator signs in without a managed account and passes no managedAccountId." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/ActivitySessionResources": { "get": { "tags": [ "Access Control Policy" ], "summary": "List resources a user can start an activity session on", "description": "Returns the resources that the signed-in user can use to start an activity session, optionally narrowed to one activity and one access policy. Administrators can pass a managed account to see the list for that account.\n\nPermission required: Any signed-in user.", "operationId": "AccessControlPolicy_ActivitySessionCandidateResources", "parameters": [ { "name": "activityId", "in": "query", "description": "Limit results to resources usable for this activity.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" }, { "name": "policyId", "in": "query", "description": "Limit results to this access policy.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "managedAccountId", "in": "query", "description": "ID of the managed account to list resources for. Only administrators can use it; for other users it is ignored.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "Skip", "in": "query", "description": "Number of records to skip before returning results. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "Maximum number of records to return. Default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. Default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only records that contain this text. The properties searched depend on the route.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route. The server accepts it but ignores it.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns a table object with the total record count and the requested page of resources.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfAccessPolicyObject" } } } }, "400": { "description": "No managed account could be determined for the request." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/AddManagedAccountGroupToMultiplePolicies/{managedAccountGroupId}": { "post": { "tags": [ "Access Control Policy" ], "summary": "Add managed account group to multiple access policies", "description": "Adds the managed account group to every access policy in the list that exists, in one call. Ids that match no policy are ignored. Use it to give the managed account group access through several policies at once.\n\nPermission required: Administrator.\n\nCaution: The change applies immediately and affects who can access resources through each listed policy.", "operationId": "AccessControlPolicy_AddManagedAccountGroupToMultiplePolicies", "parameters": [ { "name": "managedAccountGroupId", "in": "path", "description": "The id of the managed account group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" } ], "requestBody": { "description": "The ids of the access policies to add the managed account group to.\n\n- `(array item)` (string (GUID), required): Id of an access policy. The body is a JSON array of ids and must not be empty.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "The call finished. The body is a short text message that says the group was added to one policy or N policies, where N is the number of listed policies that exist, including ones where nothing needed to change. An unknown group id also returns this message, and nothing is added.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "No group or no policies were supplied, none of the listed ids is an existing policy, or the change failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/AddManagedAccountToMultiplePolicies/{managedAccountId}": { "post": { "tags": [ "Access Control Policy" ], "summary": "Add managed account to multiple access policies", "description": "Adds the managed account to every access policy in the list that exists, in one call. Ids that match no policy are ignored. Use it to give the managed account access through several policies at once.\n\nPermission required: Administrator.\n\nCaution: The change applies immediately and affects who can access resources through each listed policy.", "operationId": "AccessControlPolicy_AddManagedAccountToMultiplePolicies", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The id of the managed account.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "description": "The ids of the access policies to add the managed account to.\n\n- `(array item)` (string (GUID), required): Id of an access policy. The body is a JSON array of ids and must not be empty.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "The change was made. The body is a short text message that says the account was added to one policy or N policies, where N is the number of listed policies that exist, including ones where nothing needed to change.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "No account or no policies were supplied, none of the listed ids is an existing policy, the managed account does not exist, or the change failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/Copy": { "put": { "tags": [ "Access Control Policy" ], "summary": "Copy an access policy", "description": "Creates a new access policy from an existing one and returns it. The new policy takes its settings from the body you send, and keeps the accounts, account groups, user and group collections and credentials of the source policy; a resource-based copy also keeps the resources, resource groups and activities.\n\nPermission required: Administrator.\n\nValues for `policyType`: 0 = Resource, 1 = Credential.", "operationId": "AccessControlPolicy_CopyAccessControlPolicy", "requestBody": { "description": "The source policy id and the settings of the new policy. The new policy takes its name, description, priority, connection profile and policy type from the body, not from the source.\n\n- `id` (string (GUID), required): Id of the policy to copy.\n- `name` (string, required): Name for the new policy. The server does not check that the name is unique, so use a name that is not already taken.\n- `activityConfigurationId` (string (GUID), required): Id of the connection profile for the new policy. A copy without it fails.\n- `description` (string): Description of the new policy.\n- `priority` (integer): Priority of the new policy. If omitted, the priority is 0.\n- `policyType` (integer (enum)): Whether the new policy is Resource based or Credential based. 0 = Resource, 1 = Credential. If omitted, the copy is Resource based even when the source is Credential based, so send the type of the source policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleAccessControlPolicyUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The copy was created. The body is the new policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccessControlPolicy" } } } }, "400": { "description": "No policy id was sent, a required value such as the name or connection profile is missing, or the copy failed." }, "403": { "description": "The caller is not an administrator." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/Lookup/{policyId}/Activity": { "get": { "tags": [ "Access Control Policy" ], "summary": "Look up the activities in an access policy", "description": "Returns a map of activity ID to activity name for the activities in the access policy, including activities that come from activity groups. A deleted activity appears with the name \"Deleted Activity\".\n\nPermission required: Administrator role, or a user whose custom role grants the Access Policies permission for this access policy.", "operationId": "AccessControlPolicy_GetActivityLookupForPolicy", "parameters": [ { "name": "policyId", "in": "path", "description": "ID of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "Returns an object whose keys are activity IDs and whose values are activity names.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "string" } } } } }, "400": { "description": "The lookup failed. The body contains an error message." }, "401": { "description": "The signed-in user is not allowed to work with this access policy." }, "403": { "description": "The signed-in user does not have the required role or permission." }, "404": { "description": "The access policy does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/Lookup/{policyId}/Credential": { "get": { "tags": [ "Access Control Policy" ], "summary": "Look up the credentials in an access policy", "description": "Returns a map of credential ID to credential name for a credential access policy, including credentials that come from credential groups. Calling it on a policy of another type returns an error.\n\nPermission required: Administrator role, or a user whose custom role grants the Access Policies permission for this access policy.", "operationId": "AccessControlPolicy_GetCredentialLookupForPolicy", "parameters": [ { "name": "policyId", "in": "path", "description": "ID of the credential access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "Returns an object whose keys are credential IDs and whose values are credential names.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "string" } } } } }, "400": { "description": "The lookup failed, for example because the policy is not a credential policy." }, "401": { "description": "The signed-in user is not allowed to work with this access policy." }, "403": { "description": "The signed-in user does not have the required role or permission." }, "404": { "description": "The access policy does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/Lookup/{policyId}/Resource": { "get": { "tags": [ "Access Control Policy" ], "summary": "Look up the resources in an access policy", "description": "Returns a map of resource ID to resource name for a resource access policy, including resources that come from resource groups. Calling it on a policy of another type returns an error.\n\nPermission required: Administrator role, or a user whose custom role grants the Access Policies permission for this access policy.", "operationId": "AccessControlPolicy_GetResourceLookupForPolicy", "parameters": [ { "name": "policyId", "in": "path", "description": "ID of the resource access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "Returns an object whose keys are resource IDs and whose values are resource names.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "string" } } } } }, "400": { "description": "The lookup failed, for example because the policy is not a resource policy." }, "401": { "description": "The signed-in user is not allowed to work with this access policy." }, "403": { "description": "The signed-in user does not have the required role or permission." }, "404": { "description": "The access policy does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/ManagedAccount/{managedAccountId}": { "delete": { "tags": [ "Access Control Policy" ], "summary": "Remove a managed account from all access policies", "description": "Removes the managed account's direct assignment from every enabled access policy that applies to it. Access the account gets through a managed account group or collection is not changed. The response lists the access policies that were found for the account.\n\nPermission required: Administrator role.", "operationId": "AccessControlPolicy_RemoveManagedAccountFromAllPolicies", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "ID of the managed account to remove from access policies.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "202": { "description": "The removal finished. The body lists the access policies that were found for the account.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/SimpleAccessControlPolicy" } } } } }, "400": { "description": "The managed account was not found or the removal failed." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Access Control Policy" ], "summary": "List activity cards for a managed account", "description": "Returns the activity cards and access policy details for a managed account. Administrators can view any account; other users can view only their own.\n\nPermission required: Any signed-in user (own account), or Administrator role for any account.", "operationId": "AccessControlPolicy_GetPoliciesForAccount", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "ID of the managed account.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "Skip", "in": "query", "description": "Number of records to skip before returning results. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "Maximum number of records to return. Default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. Default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only cards whose activity name or access policy name contains this text.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route. The server accepts it but ignores it.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "groupByPolicy", "in": "query", "description": "Set to false to list each activity separately instead of grouping by access policy. Default is true.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true } ], "responses": { "200": { "description": "Returns a table object with the total record count and the requested page of activity cards.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfActivityCard" } } } }, "400": { "description": "No managed account has this ID, or the cards could not be retrieved." }, "403": { "description": "The user is not an administrator and the ID is not their own account." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/ManagedAccount/{managedAccountId}/ManagedResource/{managedResourceId}": { "get": { "tags": [ "Access Control Policy" ], "summary": "Find access policies for an account and resource", "description": "Returns the access policies that give a managed account access to a resource. If the account ID matches no account, the result is based on the resource alone.\n\nPermission required: Administrator role.", "operationId": "AccessControlPolicy_FindPolicies", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "ID of the managed account.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "managedResourceId", "in": "path", "description": "ID of the resource.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "Returns an array of access policies.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/SimpleAccessControlPolicy" } } } } }, "400": { "description": "No resource has this ID, or the search failed." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/ManagedAccountGroup/{managedAccountGroupId}": { "get": { "tags": [ "Access Control Policy" ], "summary": "List access policies for a managed account group", "description": "Returns the activity cards for the access policies that include a managed account group.\n\nPermission required: Administrator role.", "operationId": "AccessControlPolicy_SearchPoliciesForAccountGroup", "parameters": [ { "name": "managedAccountGroupId", "in": "path", "description": "ID of the managed account group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" }, { "name": "includeLastRun", "in": "query", "description": "Set to true to include when each activity last ran. This makes the request slower.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "Skip", "in": "query", "description": "Number of records to skip before returning results. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "Maximum number of records to return. Default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. Default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only cards whose activity name or access policy name contains this text.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route. The server accepts it but ignores it.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns a table object with the total record count and the requested page of group activity cards.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfGroupActivityCard" } } } }, "400": { "description": "No group was supplied, no managed account group has this ID, or the search failed." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/ManagedGroupAccount/{managedAccountId}": { "delete": { "tags": [ "Access Control Policy" ], "summary": "Remove a managed account group from all access policies", "description": "Intended to remove a managed account group from the access policies that include it. The policies are looked up by treating the ID as a managed account ID, so for a group ID the lookup normally finds no policies; the call then returns 202 with an empty array and changes nothing. Use the other delete route for a managed account.\n\nPermission required: Administrator role.", "operationId": "AccessControlPolicy_RemoveManagedGroupAccountFromAllPolicies", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "ID of the managed account group to remove from access policies.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" } ], "responses": { "202": { "description": "The call finished. The body lists the access policies that were found, which is normally an empty array for a group ID.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/SimpleAccessControlPolicy" } } } } }, "400": { "description": "No managed account group has this ID, or the call failed." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/ManagedResource/{managedResourceId}": { "get": { "tags": [ "Access Control Policy" ], "summary": "List access policies for a resource", "description": "Returns the access policies that apply to a resource, whether assigned to the resource directly or through a resource group it belongs to. Deleted and disabled policies are left out.\n\nPermission required: Administrator role or application role.", "operationId": "AccessControlPolicy_FindResourcePolicies", "parameters": [ { "name": "managedResourceId", "in": "path", "description": "ID of the resource.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "directOnly", "in": "query", "description": "Intended to leave out policies that apply through resource groups. In this release it has no effect: policies assigned to a resource group the resource belongs to are returned either way.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "Skip", "in": "query", "description": "Number of records to skip before returning results. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "Maximum number of records to return. Default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. Default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only policies whose name or description contains this text.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route. The server accepts it but ignores it.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns a table object with the total record count and the requested page of access policies. The filter text matches policy name and description.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfSimpleAccessControlPolicy" } } } }, "400": { "description": "The search failed." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/Names": { "get": { "tags": [ "Access Control Policy" ], "summary": "List access policy names and IDs", "description": "Returns the ID and name of each access policy, sorted by name. Deleted policies are left out; disabled ones are included. Users with a custom role see only the access policies the role covers.\n\nPermission required: Administrator role, or a user whose custom role grants the Access Policies permission.", "operationId": "AccessControlPolicy_ListNames", "responses": { "200": { "description": "Returns an array of objects, each with an access policy ID and name.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } }, "400": { "description": "The names could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/PolicySearch": { "get": { "tags": [ "Access Control Policy" ], "summary": "Find the access policy for an account, resource and activity", "description": "Returns the access policy that lets a managed account run an activity on a resource. The resource is matched by host name, name or IP address, and the activity by name. Use getAll to return every matching policy instead of the first.\n\nPermission required: Any signed-in user (own account), or Administrator or application role for any account.", "operationId": "AccessControlPolicy_SearchForPolicy", "parameters": [ { "name": "managedAccountId", "in": "query", "description": "ID of the managed account to check.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "activityName", "in": "query", "description": "Name of the activity.", "required": true, "schema": { "type": "string" }, "example": "" }, { "name": "resourceName", "in": "query", "description": "Name, host name or IP address of the resource.", "required": true, "schema": { "type": "string" }, "example": "" }, { "name": "replacementChar", "in": "query", "description": "A character in activityName to replace with a single-character wildcard when matching the activity name, for example for a space you cannot send. It does not change resourceName.", "required": false, "schema": { "type": "string" }, "example": "_" }, { "name": "getAll", "in": "query", "description": "Set to true to return all matching policies as an array. Default is false, which returns the first match.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "Returns one access policy, or an array when getAll is true.", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/SimpleAccessControlPolicy" }, { "type": "array", "items": { "$ref": "#/components/schemas/SimpleAccessControlPolicy" } } ] } } } }, "400": { "description": "activityName or resourceName is missing, no resource or activity matches, or the search failed." }, "403": { "description": "The user is not an administrator or application and the ID is not their own account." }, "404": { "description": "No matching access policy was found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/RemoveManagedAccountFromMultiplePolicies/{managedAccountId}": { "post": { "tags": [ "Access Control Policy" ], "summary": "Remove managed account from multiple access policies", "description": "Removes the managed account from every access policy in the list that exists, in one call. Ids that match no policy are ignored. Use it to withdraw access that the managed account has through several policies at once.\n\nPermission required: Administrator.\n\nCaution: In this release, removing an account from a policy fails: whenever at least one listed id is an existing policy, the call returns 400 and the account is not removed. When the change succeeds, it applies immediately and affects who can access resources through each listed policy.", "operationId": "AccessControlPolicy_RemoveManagedAccountFromMultiplePolicies", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The id of the managed account.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "description": "The ids of the access policies to remove the managed account from.\n\n- `(array item)` (string (GUID), required): Id of an access policy. The body is a JSON array of ids and must not be empty.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "The change was made. The body is a short text message that says the account was removed from one policy or N policies, where N is the number of listed policies that exist, including ones where nothing needed to change.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "No account or no policies were supplied, none of the listed ids is an existing policy, the managed account does not exist, or the change failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/RemoveManagedAccountGroupFromMultiplePolicies/{managedAccountGroupId}": { "post": { "tags": [ "Access Control Policy" ], "summary": "Remove managed account group from multiple access policies", "description": "Removes the managed account group from every access policy in the list that exists, in one call. Ids that match no policy are ignored. Use it to withdraw access that the managed account group has through several policies at once.\n\nPermission required: Administrator.\n\nCaution: The change applies immediately and affects who can access resources through each listed policy.", "operationId": "AccessControlPolicy_RemoveManagedAccountGroupFromMultiplePolicies", "parameters": [ { "name": "managedAccountGroupId", "in": "path", "description": "The id of the managed account group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" } ], "requestBody": { "description": "The ids of the access policies to remove the managed account group from.\n\n- `(array item)` (string (GUID), required): Id of an access policy. The body is a JSON array of ids and must not be empty.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "The change was made. The body is a short text message that says the group was removed from one policy or N policies, where N is the number of listed policies that exist, including ones where nothing needed to change.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "No group or no policies were supplied, none of the listed ids is an existing policy, the managed account group does not exist, or the change failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/RolesForPolicy/{policyId}": { "get": { "tags": [ "Access Control Policy" ], "summary": "List the roles for an access policy", "description": "Returns the ID and name of each role associated with the access policy.\n\nPermission required: Administrator role, or a user whose custom role grants the Access Policies permission for this access policy.", "operationId": "AccessControlPolicy_GetRolesForPolicy", "parameters": [ { "name": "policyId", "in": "path", "description": "ID of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "Returns an array of objects, each with a role ID and name.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } }, "400": { "description": "The roles could not be retrieved." }, "401": { "description": "The signed-in user is not allowed to work with this access policy." }, "403": { "description": "The signed-in user does not have the required role or permission." }, "404": { "description": "The access policy does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/SearchActivities/{accessPolicyId}": { "get": { "tags": [ "Access Control Policy" ], "summary": "Search the activities in an access policy", "description": "Returns the activities and activity groups that belong to the access policy.\n\nPermission required: Administrator role, or a user whose custom role grants the Access Policies permission for this access policy.\n\nValues for `entityType`: 0 = Activity, 1 = ActivityGroup.", "operationId": "AccessControlPolicy_SearchActivities", "parameters": [ { "name": "accessPolicyId", "in": "path", "description": "ID of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "Skip", "in": "query", "description": "Number of records to skip before returning results. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "Maximum number of records to return. Default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. Default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only records that contain this text. The properties searched depend on the route.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route. The server accepts it but ignores it.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "entityType", "in": "query", "description": "Return only activities or only activity groups. See the values of `entityType`.", "required": false, "schema": { "$ref": "#/components/schemas/ActivityOrGroupKind" } } ], "responses": { "200": { "description": "Returns a table object with the total record count and the requested page of activities and activity groups.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfActivityAndGroupView" } } } }, "400": { "description": "The access policy ID is missing or the search failed." }, "401": { "description": "The signed-in user is not allowed to work with this access policy." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/SearchActivityCandidates/{accessPolicyId}": { "get": { "tags": [ "Access Control Policy" ], "summary": "Search activities that can be added to an access policy", "description": "Returns the activities and activity groups that are not yet in the access policy and could be added to it.\n\nPermission required: Administrator role, or a user whose custom role grants the Access Policies permission for this access policy.\n\nValues for `entityType`: 0 = Activity, 1 = ActivityGroup.", "operationId": "AccessControlPolicy_SearchActivityCandidates", "parameters": [ { "name": "accessPolicyId", "in": "path", "description": "ID of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "Skip", "in": "query", "description": "Number of records to skip before returning results. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "Maximum number of records to return. Default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. Default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only records that contain this text. The properties searched depend on the route.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route. The server accepts it but ignores it.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "entityType", "in": "query", "description": "Return only activities or only activity groups. See the values of `entityType`.", "required": false, "schema": { "$ref": "#/components/schemas/ActivityOrGroupKind" } } ], "responses": { "200": { "description": "Returns a table object with the total record count and the requested page of candidate activities and activity groups.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfActivityAndGroupView" } } } }, "400": { "description": "The access policy ID is missing or the search failed." }, "401": { "description": "The signed-in user is not allowed to work with this access policy." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/SearchCredentialCandidates/{accessPolicyId}": { "get": { "tags": [ "Access Control Policy" ], "summary": "Search credentials that can be added to an access policy", "description": "Returns the credentials, credential groups or host users that could be added to a credential access policy.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = Credential, 1 = CredentialGroup, 2 = HostUser.", "operationId": "AccessControlPolicy_SearchCredentialCandidates", "parameters": [ { "name": "accessPolicyId", "in": "path", "description": "ID of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "filterText", "in": "query", "description": "Returns only records that contain this text.", "required": false, "schema": { "type": "string", "default": "" }, "example": "" }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. Default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "Number of records to skip. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of records to return. Default is 30.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 30 }, "example": 30 }, { "name": "entityType", "in": "query", "description": "Return only one kind of credential. See the values of `entityType`.", "required": false, "schema": { "$ref": "#/components/schemas/CredentialOrHostUser" } } ], "responses": { "200": { "description": "Returns a table object with the total record count and the requested page of candidate credentials.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfCredentialPolicyCandidateView" } } } }, "400": { "description": "The access policy ID is missing or the search failed." }, "401": { "description": "The signed-in user is not allowed to work with this access policy. A user with only a custom role always gets this response." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/SearchCredentials/{accessPolicyId}": { "get": { "tags": [ "Access Control Policy" ], "summary": "Search the credentials in an access policy", "description": "Returns the credentials, credential groups or host users that belong to a credential access policy.\n\nPermission required: Administrator role or application role.\n\nValues for `entityType`: 0 = Credential, 1 = CredentialGroup, 2 = HostUser.", "operationId": "AccessControlPolicy_SearchCredentials", "parameters": [ { "name": "accessPolicyId", "in": "path", "description": "ID of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "Skip", "in": "query", "description": "Number of records to skip before returning results. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "Maximum number of records to return. Default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. Default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only records that contain this text. The properties searched depend on the route.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route. The server accepts it but ignores it.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "entityType", "in": "query", "description": "Return only one kind of credential. See the values of `entityType`.", "required": false, "schema": { "$ref": "#/components/schemas/CredentialOrHostUser" } } ], "responses": { "200": { "description": "Returns a table object with the total record count and the requested page of credentials.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfCredentialPolicyCredentialView" } } } }, "400": { "description": "The access policy ID is missing or the search failed." }, "401": { "description": "The signed-in user is not allowed to work with this access policy. A user with only a custom role always gets this response." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/SearchManagedAccountCandidates/{accessPolicyId}": { "get": { "tags": [ "Access Control Policy" ], "summary": "Search accounts that can be added to an access policy", "description": "Returns the managed accounts, groups and other account types that could be added to the access policy.\n\nPermission required: Administrator role, or a user whose custom role grants the Access Policies permission for this access policy.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "AccessControlPolicy_SearchManagedAccountCandidates", "parameters": [ { "name": "accessPolicyId", "in": "path", "description": "ID of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "Skip", "in": "query", "description": "Number of records to skip before returning results. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "Maximum number of records to return. Default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. Default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only records that contain this text. The properties searched depend on the route.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route. The server accepts it but ignores it.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "entityType", "in": "query", "description": "Return only one kind of account. See the values of `entityType`.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedAccountKind" } } ], "responses": { "200": { "description": "Returns a table object with the total record count and the requested page of candidate accounts.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedAccountAndCollectionsView" } } } }, "400": { "description": "The access policy ID is missing or the search failed." }, "401": { "description": "The signed-in user is not allowed to work with this access policy." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/SearchManagedAccounts/{accessPolicyId}": { "get": { "tags": [ "Access Control Policy" ], "summary": "Search the accounts in an access policy", "description": "Returns the managed accounts, groups and other account types that belong to the access policy.\n\nPermission required: Administrator role, or a user whose custom role grants the Access Policies permission for this access policy.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "AccessControlPolicy_SearchManagedAccounts", "parameters": [ { "name": "accessPolicyId", "in": "path", "description": "ID of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "filterText", "in": "query", "description": "Returns only records that contain this text.", "required": false, "schema": { "type": "string", "default": "" }, "example": "" }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. Default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "Number of records to skip. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of records to return. Default is 30.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 30 }, "example": 30 }, { "name": "entityType", "in": "query", "description": "Return only one kind of account. See the values of `entityType`.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedAccountKind" } } ], "responses": { "200": { "description": "Returns a table object with the total record count and the requested page of accounts.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedAccountView" } } } }, "400": { "description": "The access policy ID is missing or the search failed." }, "401": { "description": "The signed-in user is not allowed to work with this access policy." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/SearchResourceCandidates/{accessPolicyId}": { "get": { "tags": [ "Access Control Policy" ], "summary": "Search resources that can be added to an access policy", "description": "Lists the resources and resource groups that are not yet part of an access policy and can be added to it. Secret vaults and entries on the Active Directory platform are not included. Use it to build a resource picker, with paging, sorting and text filtering. For a custom-role user, the results are limited to the resources their role allows.\n\nPermission required: Administrator, or a custom role with the Access Policies permission on this policy.\n\nValues for `entityType`: 0 = Resource, 1 = ResourceGroup, 2 = SecretVault.", "operationId": "AccessControlPolicy_SearchResourceCandidates", "parameters": [ { "name": "accessPolicyId", "in": "path", "description": "The id of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "Skip", "in": "query", "description": "Number of items to skip before returning results.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "Maximum number of items to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 30 }, { "name": "OrderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only entries whose name or operating system contains this text.", "required": false, "schema": { "type": "string" }, "example": "web" }, { "name": "entityType", "in": "query", "description": "Restricts the results to resources (0) or resource groups (1). Secret vaults (2) are never returned by this route.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedResourceOrGroupKind" } }, { "name": "FilterColumns", "in": "query", "description": "Accepted but not used by this route. The text filter always searches a fixed set of columns.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "A page of resources and resource groups, with the total number of matches.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedResourceAndGroupView" } } } }, "400": { "description": "The access policy id is empty." }, "401": { "description": "Returned to a custom-role user who is not allowed to work with this policy." }, "403": { "description": "The caller is not an administrator and has no access-policy custom role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/SearchResources/{accessPolicyId}": { "get": { "tags": [ "Access Control Policy" ], "summary": "Search the resources in an access policy", "description": "Lists the resources, resource groups and secret vaults that are already part of an access policy, with paging, sorting and text filtering.\n\nPermission required: Administrator, or a custom role with the Access Policies permission on this policy.\n\nValues for `entityType`: 0 = Resource, 1 = ResourceGroup, 2 = SecretVault.", "operationId": "AccessControlPolicy_SearchResources", "parameters": [ { "name": "accessPolicyId", "in": "path", "description": "The id of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "Skip", "in": "query", "description": "Number of items to skip before returning results.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "Maximum number of items to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 30 }, { "name": "OrderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only entries whose name or operating system contains this text.", "required": false, "schema": { "type": "string" }, "example": "web" }, { "name": "entityType", "in": "query", "description": "Restricts the results to resources, resource groups or secret vaults. Omit it to return all three.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedResourceOrGroupKind" } }, { "name": "FilterColumns", "in": "query", "description": "Accepted but not used by this route. The text filter always searches a fixed set of columns.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "A page of resources, resource groups or secret vaults, with the total number of matches.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedResourceAndGroupView" } } } }, "400": { "description": "No access policy id was supplied or the search failed." }, "401": { "description": "Returned to a custom-role user who is not allowed to work with this policy." }, "403": { "description": "The caller is not an administrator and has no access-policy custom role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/{accessControlPolicyId}": { "delete": { "tags": [ "Access Control Policy" ], "summary": "Delete an access policy", "description": "Permanently deletes the access policy. The call returns 202 Accepted with no body once the deletion is complete. An ID that matches no access policy also returns 202.\n\nPermission required: Administrator role.", "operationId": "AccessControlPolicy_Delete", "parameters": [ { "name": "accessControlPolicyId", "in": "path", "description": "ID of the access policy to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "202": { "description": "The access policy was deleted, or no access policy has this ID. The response has no body." }, "400": { "description": "The access policy could not be deleted. The body contains an error message." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Access Control Policy" ], "summary": "Get an access policy by id", "description": "Returns one access policy with its settings and the ids of the resources, resource groups, credentials and activities it contains. The managedAccountIds and managedAccountGroupIds lists in the response are always empty; list the policy's accounts and account groups with their own list routes. The policy is returned whether or not it is deleted or disabled.\n\nPermission required: Administrator, application, or a custom role with the Access Policies permission on this policy. Multi-factor sign-in is required.\n\nValues for `policyType`: 0 = Resource, 1 = Credential.\n\nValues for `approvalTypeRequired`: 0 = Deny, 1 = Allow, 2 = Workflow, 3 = External.\n\nCaution: In the response, approvalTypeRequired is always 0, notesRequired and ticketRequired are always false, and activityConfiguration and activityConfigurationMaxSessionLength are null, whatever the policy's connection profile. Read the connection profile with its own route.", "operationId": "AccessControlPolicy_Get", "parameters": [ { "name": "accessControlPolicyId", "in": "path", "description": "The id of the access policy to return.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "ignoreStatus", "in": "query", "description": "When true, the response also leaves out the resource, resource group and credential ids. The policy is returned whatever its deleted or disabled state, with or without this option. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "The access policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleAccessControlPolicy" } } } }, "400": { "description": "The policy could not be retrieved, for example because no policy has this id." }, "401": { "description": "Returned to a custom-role user who is not allowed to work with this policy." }, "403": { "description": "The caller is not allowed to view this policy." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Access Control Policy" ], "summary": "Update an access policy", "description": "Updates the settings of an access policy and returns the updated policy. The id in the body must match the id in the path, and the name must stay unique. The settings you send replace the stored values. The member lists in the body only add members; change membership with the add and remove routes.\n\nPermission required: Administrator, application, or a custom role with the Modify Name, Modify Description or Modify Connection Profile permission on this policy.\n\nValues for `policyType`: 0 = Resource, 1 = Credential.\n\nCaution: Settings left out of the body are reset: the description is cleared, the priority becomes 0 and the policy type becomes Resource. The update also clears the disabled and deleted flags, and removes members that do not fit the policy type: a Resource policy loses its credentials, secret vaults and Credential Release and File Release activities; a Credential policy loses its resource groups, its resources other than secret vaults, its activity groups and its activities other than Credential Release and File Release. Members listed in the body are added before the name is checked, so a request rejected for a duplicate name can still add them. Send every setting you want to keep.", "operationId": "AccessControlPolicy_Put", "parameters": [ { "name": "accessControlPolicyId", "in": "path", "description": "The id of the access policy to update.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "requestBody": { "description": "The access policy settings. Start from the policy returned by the Get route and change only what you need; the settings you send replace the stored ones.\n\n- `id` (string (GUID), required): Id of the policy. It must match the id in the path.\n- `name` (string, required): Unique name of the policy. A duplicate name is rejected. The check ignores upper and lower case.\n- `description` (string): Description of the policy. If omitted, the description is cleared.\n- `policyType` (integer (enum)): Whether the policy is Resource based or Credential based. 0 = Resource, 1 = Credential. If omitted, the policy becomes Resource based.\n- `priority` (integer): Priority of the policy. If omitted, the priority is set to 0.\n- `activityConfigurationId` (string (GUID), required): Id of the connection profile that the policy uses. If omitted, the update fails.\n- `managedAccountIds` (array of string (GUID)): Ids of accounts to add to the policy. Ids already in the policy are kept. Accounts left out of the list are not removed by this route; use the Remove routes for that.\n- `managedAccountGroupIds` (array of string (GUID)): Ids of account groups to add to the policy. Ids already in the policy are kept. Account groups left out of the list are not removed by this route; use the Remove routes for that.\n- `managedResourceIds` (array of string (GUID)): Ids of resources to add to the policy. Ids already in the policy are kept. Resources left out of the list are not removed by this route; use the Remove routes for that.\n- `managedResourceGroupIds` (array of string (GUID)): Ids of resource groups to add to the policy. Ids already in the policy are kept. Resource groups left out of the list are not removed by this route; use the Remove routes for that.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleAccessControlPolicyUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The updated policy. In it, approvalTypeRequired is always 0, notesRequired and ticketRequired are false and activityConfiguration is null; read the connection profile with its own route.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleAccessControlPolicy" } } } }, "400": { "description": "The id in the body does not match the path, the name is missing or not unique, the connection profile is missing, a listed member does not exist or does not fit the policy type, or the update failed." }, "401": { "description": "A custom-role user is not allowed to change this policy." }, "403": { "description": "The caller is not allowed to update policies." }, "404": { "description": "The access policy was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/{accessControlPolicyId}/ManagedAccount": { "get": { "tags": [ "Access Control Policy" ], "summary": "List accounts assigned directly to an access policy", "description": "Returns the managed accounts that are directly assigned to an access policy. Use it to see who the policy applies to.\n\nPermission required: Administrator, or a custom role with the Access Policies permission on this policy.", "operationId": "AccessControlPolicy_GetManagedAccounts", "parameters": [ { "name": "accessControlPolicyId", "in": "path", "description": "The id of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "The managed accounts assigned to the policy.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountView" } } } } }, "400": { "description": "The accounts could not be retrieved." }, "401": { "description": "A custom-role user is not allowed to work with this policy." }, "404": { "description": "The access policy was not found." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Access Control Policy" ], "summary": "Add accounts or account groups to an access policy", "description": "Adds accounts, account groups or user and group collections to an access policy and returns how many items passed and how many failed. Items already in the policy count as passed. Items whose id is not found are counted as failed. For a custom-role user, items outside their role are skipped and counted as failed.\n\nPermission required: Administrator, or a custom role with the [AP] Modify Users permission on this policy.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "AccessControlPolicy_AddMultipleManagedAccountsToPolicy", "parameters": [ { "name": "accessControlPolicyId", "in": "path", "description": "The id of the access policy.", "required": true, "schema": { "type": "string" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "requestBody": { "description": "The accounts, account groups or user and group collections to add.\n\n- `id` (string (GUID), required): Id of the item.\n- `entityType` (integer (enum), required): Kind of item that the id refers to. 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local. Application and Local ids are handled as accounts; Collection ids refer to user and group collections.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AccountReference" } }, "example": [ { "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6", "entityType": 0 } ] } }, "required": true }, "responses": { "200": { "description": "The result: passed (number of items changed), failed (number of items not changed) and report (a list of messages, which this route leaves empty).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "400": { "description": "The list was empty or the change failed." }, "401": { "description": "Returned to a custom-role user who is not allowed to work with this policy." }, "403": { "description": "The caller is not allowed to change this policy." }, "404": { "description": "The access policy was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/{accessControlPolicyId}/Status": { "put": { "tags": [ "Access Control Policy" ], "summary": "Disable, enable, delete or restore an access policy", "description": "Sets the disabled flag, the deleted flag or both on an access policy and returns the updated policy. Only the flags you send are changed.\n\nPermission required: Administrator.\n\nCaution: The change takes effect immediately; a disabled or deleted policy stops granting access.", "operationId": "AccessControlPolicy_PutStatus", "parameters": [ { "name": "accessControlPolicyId", "in": "path", "description": "The id of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "isDeleted", "in": "query", "description": "Set to true to mark the policy as deleted or false to restore it.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "isDisabled", "in": "query", "description": "Set to true to disable the policy or false to enable it.", "required": false, "schema": { "type": "boolean" }, "example": true } ], "responses": { "200": { "description": "The updated policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleAccessControlPolicy" } } } }, "204": { "description": "No policy has this id. The response body is empty." }, "400": { "description": "The status could not be changed." }, "403": { "description": "The caller is not an administrator." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/{policyId}/Activity": { "put": { "tags": [ "Access Control Policy" ], "summary": "Add activities to an access policy", "description": "Adds activities or activity groups to an access policy and returns how many items passed and how many failed. Items already in the policy count as passed. Items whose id is not found or whose type is not 0 or 1 are counted as failed. For a custom-role user, items outside their role are skipped and counted as failed.\n\nPermission required: Administrator, or a custom role with the [AP] Modify Activities permission on this policy.\n\nValues for `entityType`: 0 = Activity, 1 = ActivityGroup.", "operationId": "AccessControlPolicy_AddMultipleActivitiesToPolicy", "parameters": [ { "name": "policyId", "in": "path", "description": "The id of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "requestBody": { "description": "The activities or activity groups to add.\n\n- `id` (string (GUID), required): Id of the item.\n- `entityType` (integer (enum), required): Kind of item that the id refers to. 0 = Activity, 1 = ActivityGroup.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityReference" } }, "example": [ { "id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "entityType": 0 } ] } }, "required": true }, "responses": { "200": { "description": "The result: passed (number of items changed), failed (number of items not changed) and report (a list of messages, which this route leaves empty).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "400": { "description": "The list was empty or the change failed. On a Credential based policy only the Credential Release and File Release activities can be added; any other activity or an activity group makes the call fail, and items processed before it stay added." }, "401": { "description": "Returned to a custom-role user who is not allowed to work with this policy." }, "403": { "description": "The caller is not allowed to change this policy." }, "404": { "description": "The access policy was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/{policyId}/Activity/Remove": { "put": { "tags": [ "Access Control Policy" ], "summary": "Remove activities from an access policy", "description": "Removes activities or activity groups from an access policy and returns how many items passed and how many failed. Items that exist but are not in the policy count as passed. Items whose id is not found are counted as failed. For a custom-role user, items outside their role are skipped and counted as failed.\n\nPermission required: Administrator, or a custom role with the [AP] Modify Activities permission on this policy.\n\nValues for `entityType`: 0 = Activity, 1 = ActivityGroup.", "operationId": "AccessControlPolicy_RemoveMultipleActivitiesFromPolicy", "parameters": [ { "name": "policyId", "in": "path", "description": "The id of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "requestBody": { "description": "The activities or activity groups to remove.\n\n- `id` (string (GUID), required): Id of the item.\n- `entityType` (integer (enum), required): Kind of item that the id refers to. 0 = Activity, 1 = ActivityGroup.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityReference" } } } }, "required": true }, "responses": { "200": { "description": "The result: passed (number of items changed), failed (number of items not changed) and report (a list of messages, which this route leaves empty).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "400": { "description": "The list was empty or the change failed, for example because the policy is Credential based; only Resource based policies accept this route." }, "401": { "description": "Returned to a custom-role user who is not allowed to work with this policy." }, "403": { "description": "The caller is not allowed to change this policy." }, "404": { "description": "The access policy was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/{policyId}/Credential": { "put": { "tags": [ "Access Control Policy" ], "summary": "Add credentials to an access policy", "description": "Adds credentials or credential groups to a Credential based access policy and returns how many items passed and how many failed. Items already in the policy count as passed. Items whose id is not found, items sent as 2 (HostUser), and credentials of internal types such as configuration, activity token and application credentials are not added and are counted as failed.\n\nPermission required: Administrator.\n\nValues for `entityType`: 0 = Credential, 1 = CredentialGroup, 2 = HostUser.", "operationId": "AccessControlPolicy_AddMultipleCredentialsToPolicy", "parameters": [ { "name": "policyId", "in": "path", "description": "The id of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "requestBody": { "description": "The credentials or credential groups to add.\n\n- `id` (string (GUID), required): Id of the item.\n- `entityType` (integer (enum), required): Kind of item that the id refers to. 0 = Credential, 1 = CredentialGroup. 2 = HostUser is accepted but not added.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialOrHostUserId" } }, "example": [ { "id": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "entityType": 0 } ] } }, "required": true }, "responses": { "200": { "description": "The result: passed (number of items changed), failed (number of items not changed) and report (a list of messages, which this route leaves empty).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "400": { "description": "The list was empty, the policy is not Credential based, or the change failed." }, "403": { "description": "The caller is not allowed to change this policy." }, "404": { "description": "The access policy was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/{policyId}/Credential/Remove": { "put": { "tags": [ "Access Control Policy" ], "summary": "Remove credentials from an access policy", "description": "Removes credentials or credential groups from a Credential based access policy and returns how many items passed and how many failed. Items that exist but are not in the policy count as passed. Items sent as 2 (HostUser) are not removed and are counted as failed.\n\nPermission required: Administrator.\n\nValues for `entityType`: 0 = Credential, 1 = CredentialGroup, 2 = HostUser.", "operationId": "AccessControlPolicy_RemoveMultipleCredentialsFromPolicy", "parameters": [ { "name": "policyId", "in": "path", "description": "The id of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "requestBody": { "description": "The credentials or credential groups to remove.\n\n- `id` (string (GUID), required): Id of the item.\n- `entityType` (integer (enum), required): Kind of item that the id refers to. 0 = Credential, 1 = CredentialGroup. 2 = HostUser is accepted but not removed.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialOrHostUserId" } } } }, "required": true }, "responses": { "200": { "description": "The result: passed (number of items changed), failed (number of items not changed) and report (a list of messages, which this route leaves empty).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "400": { "description": "The list was empty, the policy is not Credential based, or the change failed." }, "403": { "description": "The caller is not allowed to change this policy." }, "404": { "description": "The access policy, or one of the listed credentials or credential groups, was not found. Items earlier in the list may already have been removed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/{policyId}/ManagedAccount/Remove": { "put": { "tags": [ "Access Control Policy" ], "summary": "Remove accounts or account groups from an access policy", "description": "Removes accounts, account groups or user and group collections from an access policy and returns how many items passed and how many failed. Items that exist but are not in the policy count as passed. Items whose id is not found are counted as failed. For a custom-role user, items outside their role are skipped and counted as failed.\n\nPermission required: Administrator, or a custom role with the [AP] Modify Users permission on this policy.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.\n\nCaution: In this release, removing an individual account (entityType 0, 2 or 4) fails: the call returns 400 and, because accounts are processed first, nothing in the request is removed. Account groups (1) and collections (3) can still be removed when the request contains no individual accounts.", "operationId": "AccessControlPolicy_RemoveMultipleManagedAccountsFromPolicy", "parameters": [ { "name": "policyId", "in": "path", "description": "The id of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "requestBody": { "description": "The accounts, account groups or user and group collections to remove.\n\n- `id` (string (GUID), required): Id of the item.\n- `entityType` (integer (enum), required): Kind of item that the id refers to. 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local. Application and Local ids are handled as accounts; Collection ids refer to user and group collections.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AccountReference" } } } }, "required": true }, "responses": { "200": { "description": "The result: passed (number of items changed), failed (number of items not changed) and report (a list of messages, which this route leaves empty).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "400": { "description": "The list was empty or the change failed." }, "401": { "description": "Returned to a custom-role user who is not allowed to work with this policy." }, "403": { "description": "The caller is not allowed to change this policy." }, "404": { "description": "The access policy was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/{policyId}/ManagedAccountGroup": { "get": { "tags": [ "Access Control Policy" ], "summary": "List account groups assigned to an access policy", "description": "Returns the managed account groups that are assigned to an access policy. Use it to see which groups the policy applies to.\n\nPermission required: Administrator, or a custom role with the Access Policies permission on this policy.", "operationId": "AccessControlPolicy_GetManagedAccountGroups", "parameters": [ { "name": "policyId", "in": "path", "description": "The id of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "A list of account groups, each with its id, name, group type and directory details such as domain and distinguished name.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountGroupInfo" } } } } }, "400": { "description": "The groups could not be retrieved." }, "401": { "description": "A custom-role user is not allowed to work with this policy." }, "404": { "description": "The access policy was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/{policyId}/ManagedResource": { "put": { "tags": [ "Access Control Policy" ], "summary": "Add resources or resource groups to an access policy", "description": "Adds resources or resource groups to a Resource based access policy and returns how many items passed and how many failed. Items already in the policy count as passed. Items whose id is not found are counted as failed.\n\nPermission required: Administrator, or a custom role with the [AP] Modify Resources permission on this policy.\n\nValues for `entityType`: 0 = Resource, 1 = ResourceGroup, 2 = SecretVault.\n\nCaution: Adding resources to a policy immediately lets the policy users act on those resources.", "operationId": "AccessControlPolicy_AddMultipleManagedResourcesToPolicy", "parameters": [ { "name": "policyId", "in": "path", "description": "The id of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "requestBody": { "description": "The resources or resource groups to add.\n\n- `id` (string (GUID), required): Id of the item.\n- `entityType` (integer (enum), required): Kind of item that the id refers to. 0 = Resource, 1 = ResourceGroup. Items sent as 2 (SecretVault) are not changed by this route and are counted as failed; use the secret vault routes instead.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceReference" } }, "example": [ { "id": "7c9e6679-7425-40de-944b-e07fc1f90ae7", "entityType": 0 } ] } }, "required": true }, "responses": { "200": { "description": "The result: passed (number of items changed), failed (number of items not changed) and report (a list of messages, which this route leaves empty).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "400": { "description": "The list was empty, a listed item does not fit the policy type (the policy is not Resource based), or the change failed. Items processed before the failure stay added." }, "401": { "description": "Returned to a custom-role user who is not allowed to work with this policy." }, "403": { "description": "The caller is not allowed to change this policy." }, "404": { "description": "The access policy was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/{policyId}/ManagedResource/Remove": { "put": { "tags": [ "Access Control Policy" ], "summary": "Remove resources or resource groups from an access policy", "description": "Removes resources or resource groups from a Resource based access policy and returns how many items passed and how many failed. Items that exist but are not in the policy count as passed. Items whose id is not found are counted as failed.\n\nPermission required: Administrator, or a custom role with the [AP] Modify Resources permission on this policy.\n\nValues for `entityType`: 0 = Resource, 1 = ResourceGroup, 2 = SecretVault.", "operationId": "AccessControlPolicy_RemoveMultipleManagedResourcesFromPolicy", "parameters": [ { "name": "policyId", "in": "path", "description": "The id of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "requestBody": { "description": "The resources or resource groups to remove.\n\n- `id` (string (GUID), required): Id of the item.\n- `entityType` (integer (enum), required): Kind of item that the id refers to. 0 = Resource, 1 = ResourceGroup. Items sent as 2 (SecretVault) are not changed by this route and are counted as failed; use the secret vault routes instead.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceReference" } } } }, "required": true }, "responses": { "200": { "description": "The result: passed (number of items changed), failed (number of items not changed) and report (a list of messages, which this route leaves empty).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "400": { "description": "The list was empty, the policy is not Resource based, or the change failed." }, "401": { "description": "Returned to a custom-role user who is not allowed to work with this policy." }, "403": { "description": "The caller is not allowed to change this policy." }, "404": { "description": "The access policy was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AccessControlPolicy/{policyId}/SecretVault": { "delete": { "tags": [ "Access Control Policy" ], "summary": "Remove secret vaults from an access policy", "description": "Removes the listed secret vaults from the access policy. The response is the number of listed secret vaults that exist and were processed. The access policy must be a credential access policy. The server reads the list from the request body of this DELETE request, so the body is required. Some HTTP clients and API tools drop the body of a DELETE request; check that yours sends it.\n\nPermission required: Administrator role.\n\nCaution: The removal takes effect immediately; to undo it, add the secret vaults to the access policy again.", "operationId": "AccessControlPolicy_RemoveVaultFromPolicyMultiple", "parameters": [ { "name": "policyId", "in": "path", "description": "ID of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "requestBody": { "description": "A JSON array of secret vault IDs to remove from the access policy. The list must not be empty.\n\n- `(array item)` (string (GUID), required): ID of a secret vault to remove from the access policy. The request body is the array itself, not an object. IDs that match no secret vault are skipped.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of secret vaults processed. A vault that existed but was not attached to the policy is still counted.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The list is missing or empty, no vaults were removed (for example none of the IDs matched a secret vault, or the access policy is not a credential policy), or the call failed." }, "403": { "description": "The signed-in user does not have the required role or permission." }, "404": { "description": "The access policy does not exist." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Access Control Policy" ], "summary": "Add secret vaults to an access policy", "description": "Adds secret vaults to a Credential based access policy and returns the number of vaults added. Vaults already in the policy are counted. Ids that are not secret vaults are skipped.\n\nPermission required: Administrator.\n\nCaution: The change applies immediately and extends the policy to the added vaults.", "operationId": "AccessControlPolicy_AddVaultToPolicyMultiple", "parameters": [ { "name": "policyId", "in": "path", "description": "The id of the access policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "requestBody": { "description": "The ids of the secret vaults to add.\n\n- `(array item)` (string (GUID), required): Id of a secret vault. The body is a JSON array of ids and must not be empty.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "The number of vaults added or already present.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The list was empty, no vault was added (for example the policy is not Credential based or no id is a secret vault), or the request failed." }, "403": { "description": "The caller is not an administrator." }, "404": { "description": "The access policy was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionGroup": { "get": { "tags": [ "Action Group" ], "summary": "List all action groups", "description": "Returns every action group, each with its actions. An action group is an ordered set of actions that an activity runs before, during or after a session.\n\nPermission required: Administrator role or the application role.\n\nValues for `classification`: 0 = PreSession, 1 = Session, 2 = PostSession, 3 = Internal, 4 = Any.", "operationId": "ActionGroup_GetAll", "responses": { "200": { "description": "An array of action groups.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActionGroup" } } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in account does not have the required role." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Action Group" ], "summary": "Create an action group", "description": "Creates an action group. The server sets the creation and modification details from the signed-in account.\n\nPermission required: Administrator role or the application role.", "operationId": "ActionGroup_Post", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionGroup" } } }, "required": true, "description": "The action group to create.\n\n- `name` (string): The name of the action group.\n- `description` (string): A description of the action group.\n- `action` (array): The actions in the group, each in the action format. Leave this empty and add actions after the group exists with the create action route." }, "responses": { "201": { "description": "The action group was created. The body is the new group and the Location value points to it.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionGroup" } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in account does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionGroup/Action": { "post": { "tags": [ "Action Group" ], "summary": "Create an action in an action group", "description": "Adds a new action to the end of an existing action group and updates the group modified details. If you send no parameters, the action gets the template's default parameter values. When the template needs a paired action and you include pairedAction, the paired action is created as well.\n\nPermission required: Administrator role or the application role.\n\nValues for `classification`: 0 = PreSession, 1 = Session, 2 = PostSession, 3 = Internal, 4 = Any.\n\nCaution: This call takes effect immediately and changes the steps that run in later sessions for the activity that uses the action group.", "operationId": "ActionGroup_PostAction", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionCreateRequest" }, "example": { "actionGroupId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "actionTemplateId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "actionParameter": [ { "actionTemplateParameterId": "3fa85f64-5717-4562-b3fc-2c963f66afa6", "value": "" } ], "classification": 0, "continueOnFail": false, "displayName": "Add to ", "pairedAction": { "displayName": "Remove from " } } } }, "required": true, "description": "The action to create.\n\n- `actionGroupId` (string (GUID), required): The action group the action belongs to. The group must already exist.\n- `actionTemplateId` (string (GUID), required): The action template the action is built from. Get template IDs from the action template list.\n- `actionParameter` (array): One entry per template parameter, each with actionTemplateParameterId and value. If you send no entries, the server creates one per template parameter with its default value. If you send entries, they replace the defaults.\n- `displayName` (string): The name shown for the action.\n- `classification` (integer): When the action runs relative to the session. Send the classification of the action template. The server sets the classification from the action template and the response shows the template value. See classification values.\n- `continueOnFail` (boolean): When true, the next action in the group still runs if this one fails.\n- `executionOrder` (integer): Ignored on create. The new action is always added at the end of the group. Change the position afterwards with the update action route.\n- `timeout` (integer): Seconds after which the action is failed if it has not completed. The default is 300 when you leave the field out.\n- `pairedActionId` (string (GUID)): The identifier of an existing action to record as the pair of this one. It is set to null if no action has that identifier. Usually left out; send pairedAction instead.\n- `pairedAction` (object): For templates that come in pairs, an object with a displayName for the paired action that the server creates. Used only when the action template requires a pair. The action group must belong to an activity, or the request fails.\n- `executionPath` (string): Runs the action only when an earlier action in the group returned this execution path. Leave it empty to run the action on every path." }, "responses": { "201": { "description": "The action was created. The body is the new action and the Location value points to it.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Action" } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in account does not have the required role." }, "500": { "description": "The request failed, for example because the action group does not exist, or a paired action is needed and the action group does not belong to an activity." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionGroup/Action/{actionId}": { "delete": { "tags": [ "Action Group" ], "summary": "Delete an action from an action group", "description": "Removes one action from its action group and renumbers the remaining actions. If the action is paired with another action, the paired action is removed too. The request succeeds even if the action no longer exists.\n\nPermission required: Administrator role or the application role.", "operationId": "ActionGroup_DeleteAction", "parameters": [ { "name": "actionId", "in": "path", "description": "The unique identifier of the action.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "202": { "description": "The delete was accepted. No body is returned." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in account does not have the required role." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Action Group" ], "summary": "Get one action", "description": "Returns a single action, including its parameters and the template it is built from.\n\nPermission required: Administrator role or the application role.\n\nValues for `classification`: 0 = PreSession, 1 = Session, 2 = PostSession, 3 = Internal, 4 = Any.", "operationId": "ActionGroup_GetAction", "parameters": [ { "name": "actionId", "in": "path", "description": "The unique identifier of the action.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The action.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Action" } } } }, "204": { "description": "No action matches the identifier." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in account does not have the required role." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Action Group" ], "summary": "Update an action", "description": "Replaces the settings of an existing action, including its parameters. Parameters with an identifier are updated and parameters without one are created; parameters you leave out are not removed. If the action is paired, parameter values it shares with the paired action are copied to that action.\n\nPermission required: Administrator role or the application role.\n\nValues for `classification`: 0 = PreSession, 1 = Session, 2 = PostSession, 3 = Internal, 4 = Any.\n\nCaution: This call takes effect immediately and changes the steps that run in later sessions for the activity that uses the action.", "operationId": "ActionGroup_PutAction", "parameters": [ { "name": "actionId", "in": "path", "description": "The unique identifier of the action.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionUpdateRequest" } } }, "required": true, "description": "The full action with your changes.\n\n- `id` (string (GUID), required): The identifier of the action. Use the same identifier as in the path.\n- `actionGroupId` (string (GUID), required): The action group the action belongs to. The group must already exist.\n- `actionTemplateId` (string (GUID), required): The action template the action is built from. Get template IDs from the action template list.\n- `actionParameter` (array): One entry per template parameter, each with actionTemplateParameterId and value. Use a null value for parameters you do not set.\n- `displayName` (string): The name shown for the action.\n- `classification` (integer): When the action runs relative to the session. See classification values.\n- `continueOnFail` (boolean): When true, the next action in the group still runs if this one fails.\n- `executionOrder` (integer): The position of the action in its group, starting at 1. The other actions in the group are renumbered around it. Values outside the range are moved to the first or last position.\n- `timeout` (integer): Seconds after which the action is failed if it has not completed. The default is 300.\n- `pairedActionId` (string (GUID)): The identifier of the action paired with this one, if any. Send the current value back unchanged.\n- `executionPath` (string): Runs the action only when an earlier action in the group returned this execution path. Leave it empty to run the action on every path.\n- `actionParameter[].id` (string (GUID)): The identifier of an existing parameter to update. Omit it to create a parameter. To create a parameter, omit id and set actionId to the identifier of this action." }, "responses": { "200": { "description": "The updated action.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Action" } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in account does not have the required role." }, "404": { "description": "No action matches the identifier." }, "500": { "description": "The request failed, for example because a new parameter does not carry the identifier of this action." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionGroup/{actionGroupId}": { "delete": { "tags": [ "Action Group" ], "summary": "Delete an action group", "description": "Deletes an action group and its actions. The request succeeds even if the group no longer exists. The delete fails if an activity or a scheduled job still uses the group.\n\nPermission required: Administrator role or the application role.", "operationId": "ActionGroup_Delete", "parameters": [ { "name": "actionGroupId", "in": "path", "description": "The unique identifier of the action group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "202": { "description": "The delete was accepted. No body is returned." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in account does not have the required role." }, "500": { "description": "The group could not be deleted, for example because an activity or a scheduled job still uses it." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Action Group" ], "summary": "Get one action group", "description": "Returns a single action group with its actions.\n\nPermission required: Administrator role or the application role.\n\nValues for `classification`: 0 = PreSession, 1 = Session, 2 = PostSession, 3 = Internal, 4 = Any.", "operationId": "ActionGroup_Get", "parameters": [ { "name": "actionGroupId", "in": "path", "description": "The unique identifier of the action group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The action group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionGroup" } } } }, "204": { "description": "No action group matches the identifier." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in account does not have the required role." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Action Group" ], "summary": "Update an action group", "description": "Replaces the details of an action group. Actions that are in the request but not yet in the group are added, and actions in the group but missing from the request are removed. Actions that stay in the group are not changed by this route; use the update action route for them.\n\nPermission required: Administrator role or the application role.\n\nValues for `classification`: 0 = PreSession, 1 = Session, 2 = PostSession, 3 = Internal, 4 = Any.\n\nCaution: Any action left out of the request is removed from the group immediately.", "operationId": "ActionGroup_Update", "parameters": [ { "name": "actionGroupId", "in": "path", "description": "The unique identifier of the action group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionGroupUpdateRequest" } } }, "required": true, "description": "The full action group with your changes.\n\n- `id` (string (GUID), required): The identifier of the action group. Use the same identifier as in the path.\n- `name` (string): The name of the action group.\n- `description` (string): A description of the action group.\n- `action` (array): The actions in the group, each in the action format. Actions missing from this list are removed from the group and new ones are added. If you leave the field out, every action is removed." }, "responses": { "200": { "description": "The updated action group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionGroup" } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in account does not have the required role." }, "404": { "description": "No action group matches the identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionGroup/{actionGroupId}/Action": { "get": { "tags": [ "Action Group" ], "summary": "List the actions in an action group", "description": "Returns the actions that belong to one action group.\n\nPermission required: Administrator role or the application role.\n\nValues for `classification`: 0 = PreSession, 1 = Session, 2 = PostSession, 3 = Internal, 4 = Any.", "operationId": "ActionGroup_GetAllActions", "parameters": [ { "name": "actionGroupId", "in": "path", "description": "The unique identifier of the action group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "An array of actions. The array is empty when the group has none.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Action" } } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in account does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionJob": { "get": { "tags": [ "Action Job" ], "summary": "List all scheduled jobs", "description": "Returns every job, including one-time, recurring and disabled jobs. The list can be long on large installations. To page through the recurring schedules shown in the console, use the search route.\n\nPermission required: Administrator role with multi-factor authentication completed, or the application role.\n\nValues for `type`: 0 = None, 1 = Protection, 2 = PasswordRotation, 3 = PasswordVerification, 4 = HostScan, 5 = DomainSync, 6 = DomainSyncTest, 7 = ActivitySession, 8 = RemoteServiceRegistration, 9 = ServiceRotation, 10 = PasswordRollback, 11 = DomainOUMapping, 12 = ResourceConnectionTest, 13 = WinRmHttp, 14 = Report, 15 = Debug, 16 = CommandPlanRun.\n\nValues for `recurrenceType`: 0 = None, 1 = Minutes, 2 = Daily, 3 = Weekly, 4 = Monthly.\n\nValues for `dayOfWeek`: 0 = Sunday, 1 = Monday, 2 = Tuesday, 3 = Wednesday, 4 = Thursday, 5 = Friday, 6 = Saturday.\n\nValues for `managedObjectType`: 0 = HostUser, 1 = HostService, 2 = HostScheduledTask.", "operationId": "ActionJob_GetAll", "responses": { "200": { "description": "An array of jobs.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActionJob" } } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in account does not have the required role, or an administrator has not completed multi-factor authentication." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionJob/Search": { "get": { "tags": [ "Action Job" ], "summary": "Search scheduled jobs with paging", "description": "Returns a page of recurring job schedules that are enabled. Filter by name, sort by a schedule property, and limit results to the protection jobs for one protection policy.\n\nPermission required: Administrator role with multi-factor authentication completed, or the application role.\n\nValues for `recurrenceType`: 0 = None, 1 = Minutes, 2 = Daily, 3 = Weekly, 4 = Monthly.\n\nValues for `dayOfWeek`: 0 = Sunday, 1 = Monday, 2 = Tuesday, 3 = Wednesday, 4 = Thursday, 5 = Friday, 6 = Saturday.\n\nValues for `status`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.\n\nValues for `lastRunStatus`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.", "operationId": "ActionJob_Search", "parameters": [ { "name": "filterText", "in": "query", "description": "Returns only schedules whose name contains this text. The match ignores case.", "required": false, "schema": { "type": "string" }, "example": "backup" }, { "name": "orderBy", "in": "query", "description": "The schedule property to sort by, such as name or recurrenceType. Unknown names are ignored.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "The number of schedules to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The maximum number of schedules to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 }, { "name": "protectionPolicyId", "in": "query", "description": "Returns only the protection jobs for hosts that use this protection policy.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "An object with data (the page of schedules) and recordsTotal (the total number that match, before paging).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfActionJobSchedule" } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in account does not have the required role, or an administrator has not completed multi-factor authentication." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionJob/Statistics/{days}": { "get": { "tags": [ "Action Job" ], "summary": "Get job action counts by status", "description": "Counts job actions by their current status, for actions updated within the number of days you specify. Each entry has a status, a count and the time the figures were produced.\n\nPermission required: Administrator role with multi-factor authentication completed, or the application role.\n\nValues for `status`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.", "operationId": "ActionJob_GetActionJobStatistic", "parameters": [ { "name": "days", "in": "path", "description": "How many days back to count, measured from now.", "required": true, "schema": { "type": "integer", "format": "int32" }, "example": 7 } ], "responses": { "200": { "description": "An array with one entry per status that has at least one action in the period.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActionJobStatistic" } } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in account does not have the required role, or an administrator has not completed multi-factor authentication." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionJob/{id}": { "get": { "tags": [ "Action Job" ], "summary": "Get one scheduled job", "description": "Returns a single job, including its type, schedule settings, next start time and the identifiers of the resource, account or domain it applies to.\n\nPermission required: Administrator role with multi-factor authentication completed, or the application role.\n\nValues for `type`: 0 = None, 1 = Protection, 2 = PasswordRotation, 3 = PasswordVerification, 4 = HostScan, 5 = DomainSync, 6 = DomainSyncTest, 7 = ActivitySession, 8 = RemoteServiceRegistration, 9 = ServiceRotation, 10 = PasswordRollback, 11 = DomainOUMapping, 12 = ResourceConnectionTest, 13 = WinRmHttp, 14 = Report, 15 = Debug, 16 = CommandPlanRun.\n\nValues for `recurrenceType`: 0 = None, 1 = Minutes, 2 = Daily, 3 = Weekly, 4 = Monthly.\n\nValues for `dayOfWeek`: 0 = Sunday, 1 = Monday, 2 = Tuesday, 3 = Wednesday, 4 = Thursday, 5 = Friday, 6 = Saturday.\n\nValues for `managedObjectType`: 0 = HostUser, 1 = HostService, 2 = HostScheduledTask.", "operationId": "ActionJob_Get", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier of the scheduled job.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The job.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionJob" } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in account does not have the required role, or an administrator has not completed multi-factor authentication." }, "404": { "description": "No job matches the identifier." }, "503": { "description": "The request was cancelled before it completed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionQueue": { "get": { "tags": [ "Action Queue" ], "summary": "List the status of all action queues", "description": "Returns every action queue with its status and the status of each step in it, newest first. Use it to monitor activity and job runs.\n\nPermission required: Requires the Admin, Auditing and Reporting, or App role.\n\nValues for `status`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.\n\nCaution: The response covers every queue and can be large on busy systems; use Search for paged results.", "operationId": "ActionQueue_GetActionGroup", "responses": { "200": { "description": "An array of action queue status objects, each with its steps.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActionQueueStatus" } } } } }, "400": { "description": "The request failed; the body holds the error text." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionQueue/Action/{actionQueueActionId}/Log": { "get": { "tags": [ "Action Queue" ], "summary": "Get log entries for an action queue step", "description": "Returns a page of log entries written while one step of an action queue ran. Use it to see why a step succeeded or failed.\n\nPermission required: Requires the Admin, Auditing and Reporting, or App role.\n\nValues for `logLevel`: 0 = Debug, 1 = Info, 2 = Warn, 3 = Error.", "operationId": "ActionQueue_GetActionLogs", "parameters": [ { "name": "actionQueueActionId", "in": "path", "description": "ID of the action queue step whose log to read.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "logLevel", "in": "query", "description": "Minimum log level, sent as a number: returns entries at this level or higher. 0 Debug, 1 Info, 2 Warn, 3 Error. When omitted, 0 is used and all entries are returned.", "required": false, "schema": { "$ref": "#/components/schemas/ActionLogType" } }, { "name": "skip", "in": "query", "description": "Number of log entries to skip. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of log entries to return. Default is 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderDescending", "in": "query", "description": "When true (default), returns the newest entries first.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true }, { "name": "filterText", "in": "query", "description": "Returns only entries whose message contains this text, ignoring case.", "required": false, "schema": { "type": "string", "default": "" }, "example": "error" } ], "responses": { "200": { "description": "An object with the log lines, the total count of matching entries, and a version.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionLogCollection" } } } }, "400": { "description": "The ID is empty or the search failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionQueue/ByStatus/{status}": { "get": { "tags": [ "Action Queue" ], "summary": "List action queues with a given status", "description": "Returns action queues that have the given status, oldest change first, with paging. Use it to find queues that are running, failed or waiting.\n\nPermission required: Requires the Admin, Auditing and Reporting, or App role.\n\nValues for `status`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.\n\nValues for `failureReason`: 0 = NoError, 1 = UnknownError, 2 = SystemError, 3 = ActionServiceUnavailable, 4 = ActionTimeout, 5 = AccessDenied, 6 = UserAlreadyMemberofGroup, 7 = UserNotMemberofGroup, 8 = InvalidGroupName, 9 = InvalidUserName, 10 = InvalidHostName, 11 = FailedToConnect.", "operationId": "ActionQueue_GetByStatus", "parameters": [ { "name": "status", "in": "path", "description": "Status to match, sent as a number. See the values below.", "required": true, "schema": { "$ref": "#/components/schemas/ActionStatus" } }, { "name": "allQueues", "in": "query", "description": "When true (default), includes all queues. When false, includes only queues started by a scheduled job.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true }, { "name": "skip", "in": "query", "description": "Number of items to skip before returning results. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of items to return. Default is 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 } ], "responses": { "200": { "description": "An array of action queues.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActionQueue" } } } } }, "400": { "description": "The request failed; the body holds the error text." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionQueue/LastRun/Action/{actionId}/Log": { "get": { "tags": [ "Action Queue" ], "summary": "Get log entries from an action's last run", "description": "Returns a page of log entries for the most recent run of an action. Use it to check the outcome of the last time the action ran. When the action has never run, the list is empty.\n\nPermission required: Requires the Admin, Auditing and Reporting, or App role.\n\nValues for `logLevel`: 0 = Debug, 1 = Info, 2 = Warn, 3 = Error.", "operationId": "ActionQueue_GetLatestActionLog", "parameters": [ { "name": "actionId", "in": "path", "description": "ID of the action whose last run log to read.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "logLevel", "in": "query", "description": "Minimum log level, sent as a number: returns entries at this level or higher. 0 Debug, 1 Info, 2 Warn, 3 Error. When omitted, 0 is used and all entries are returned.", "required": false, "schema": { "$ref": "#/components/schemas/ActionLogType" } }, { "name": "skip", "in": "query", "description": "Number of log entries to skip. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of log entries to return. Default is 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderDescending", "in": "query", "description": "When true (default), returns the newest entries first.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true }, { "name": "filterText", "in": "query", "description": "Returns only entries whose message contains this text, ignoring case.", "required": false, "schema": { "type": "string", "default": "" }, "example": "error" } ], "responses": { "200": { "description": "An object with the log lines, the total count of matching entries, and a version.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionLogCollection" } } } }, "400": { "description": "The ID is empty or the search failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionQueue/Log/{id}": { "get": { "tags": [ "Action Queue" ], "summary": "Get one action log entry", "description": "Returns a single log entry by its ID.\n\nPermission required: Requires the Admin, Auditing and Reporting, or App role.\n\nValues for `type`: 0 = Debug, 1 = Info, 2 = Warn, 3 = Error.", "operationId": "ActionQueue_GetLog", "parameters": [ { "name": "id", "in": "path", "description": "ID of the log entry.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The log entry, with its type, time, message and version.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionLog" } } } }, "400": { "description": "The request failed; the body holds the error text." }, "404": { "description": "No log entry has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionQueue/Search": { "get": { "tags": [ "Action Queue" ], "summary": "Search action queues with paging", "description": "Returns a page of action queue runs with their job, activity, resource and account details. Use it to find and review runs; the console uses it for its action queue list.\n\nPermission required: Requires the Admin, Auditing and Reporting, or App role.\n\nValues for `status`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.\n\nValues for `jobType`: 0 = None, 1 = Protection, 2 = PasswordRotation, 3 = PasswordVerification, 4 = HostScan, 5 = DomainSync, 6 = DomainSyncTest, 7 = ActivitySession, 8 = RemoteServiceRegistration, 9 = ServiceRotation, 10 = PasswordRollback, 11 = DomainOUMapping, 12 = ResourceConnectionTest, 13 = WinRmHttp, 14 = Report, 15 = Debug, 16 = CommandPlanRun.", "operationId": "ActionQueue_SearchActionQueue", "parameters": [ { "name": "filterText", "in": "query", "description": "Returns only runs whose job name contains this text, ignoring case.", "required": false, "schema": { "type": "string" }, "example": "rotation" }, { "name": "orderBy", "in": "query", "description": "Name of the field to sort by. Default is startTimeUtc.", "required": false, "schema": { "type": "string" }, "example": "startTimeUtc" }, { "name": "orderDescending", "in": "query", "description": "When true (default), sorts in descending order.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true }, { "name": "skip", "in": "query", "description": "Number of items to skip. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of items to return. Default is 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 } ], "responses": { "200": { "description": "An object with data, the page of matching runs, and recordsTotal, the total count. Without filterText, recordsTotal counts every action queue.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfActionQueueSearchResult" } } } }, "400": { "description": "The search failed; the body holds the error text." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionQueue/{actionQueueId}": { "delete": { "tags": [ "Action Queue" ], "summary": "Cancel an action queue", "description": "Sets the status of the action queue to Cancelled (4). Use it to cancel an action queue that is queued or running.\n\nPermission required: Requires the Admin, Auditing and Reporting, or App role.\n\nCaution: The status changes to Cancelled immediately, and the call does not check whether the action queue has already finished.", "operationId": "ActionQueue_Delete", "parameters": [ { "name": "actionQueueId", "in": "path", "description": "ID of the action queue to cancel.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "202": { "description": "The action queue status is set to Cancelled." }, "400": { "description": "The cancel failed; the body holds the error text." }, "404": { "description": "No action queue has this ID." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Action Queue" ], "summary": "Get an action queue", "description": "Returns one action queue, including its status and status description. Use it to check progress of a run you started.\n\nPermission required: Requires the Admin, Auditing and Reporting, or App role.\n\nValues for `status`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.\n\nValues for `failureReason`: 0 = NoError, 1 = UnknownError, 2 = SystemError, 3 = ActionServiceUnavailable, 4 = ActionTimeout, 5 = AccessDenied, 6 = UserAlreadyMemberofGroup, 7 = UserNotMemberofGroup, 8 = InvalidGroupName, 9 = InvalidUserName, 10 = InvalidHostName, 11 = FailedToConnect.", "operationId": "ActionQueue_Get", "parameters": [ { "name": "actionQueueId", "in": "path", "description": "ID of the action queue.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "The action queue.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionQueue" } } } }, "400": { "description": "The request failed; the body holds the error text." }, "404": { "description": "No action queue has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionQueue/{actionQueueId}/Job": { "get": { "tags": [ "Action Queue" ], "summary": "Get the job behind an action queue", "description": "Returns the scheduled job that created the action queue, including its schedule and type. Use it to see when and how a run was scheduled.\n\nPermission required: Requires the Admin, Auditing and Reporting, or App role.\n\nValues for `type`: 0 = None, 1 = Protection, 2 = PasswordRotation, 3 = PasswordVerification, 4 = HostScan, 5 = DomainSync, 6 = DomainSyncTest, 7 = ActivitySession, 8 = RemoteServiceRegistration, 9 = ServiceRotation, 10 = PasswordRollback, 11 = DomainOUMapping, 12 = ResourceConnectionTest, 13 = WinRmHttp, 14 = Report, 15 = Debug, 16 = CommandPlanRun.\n\nValues for `recurrenceType`: 0 = None, 1 = Minutes, 2 = Daily, 3 = Weekly, 4 = Monthly.", "operationId": "ActionQueue_GetJob", "parameters": [ { "name": "actionQueueId", "in": "path", "description": "ID of the action queue.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "The job.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionJob" } } } }, "404": { "description": "No job exists for this action queue." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionQueue/{actionQueueId}/Log": { "get": { "tags": [ "Action Queue" ], "summary": "Get log entries for an action queue", "description": "Returns a page of log entries for an action queue. Use it to follow or review a run, filtering by level or text.\n\nPermission required: Requires the Admin, Auditing and Reporting, or App role.\n\nValues for `logLevel`: 0 = Debug, 1 = Info, 2 = Warn, 3 = Error.", "operationId": "ActionQueue_GetLogs", "parameters": [ { "name": "actionQueueId", "in": "path", "description": "ID of the action queue whose log to read.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "lastRunActionQueueId", "in": "query", "description": "ID of another action queue run. When set, entries from that run are returned together with entries from the action queue in the path.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" }, { "name": "logLevel", "in": "query", "description": "Minimum log level, sent as a number: returns entries at this level or higher. 0 Debug, 1 Info, 2 Warn, 3 Error. When omitted, 0 is used and all entries are returned.", "required": false, "schema": { "$ref": "#/components/schemas/ActionLogType" } }, { "name": "skip", "in": "query", "description": "Number of log entries to skip. Default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of log entries to return. Default is 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderDescending", "in": "query", "description": "When true (default), returns the newest entries first.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true }, { "name": "filterText", "in": "query", "description": "Returns only entries whose message contains this text, ignoring case.", "required": false, "schema": { "type": "string", "default": "" }, "example": "error" } ], "responses": { "200": { "description": "An object with the log lines, the total count of matching entries, and a version.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionLogCollection" } } } }, "400": { "description": "The ID is empty or the search failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionTemplate": { "get": { "tags": [ "Action Template" ], "summary": "List action templates you can choose from", "description": "Returns the action templates available for selection when building activities, with their parameters. Templates that are not available for selection are left out. Returns an empty array when there are none.\n\nPermission required: Requires the Admin or App role.\n\nValues for `classification`: 0 = PreSession, 1 = Session, 2 = PostSession, 3 = Internal, 4 = Any.", "operationId": "ActionTemplate_Get", "parameters": [ { "name": "skip", "in": "query", "description": "Accepted for compatibility but not applied; all templates are returned. A negative value returns 400.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "take", "in": "query", "description": "Accepted for compatibility but not applied; all templates are returned. A negative value returns 400.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 20 } ], "responses": { "200": { "description": "An array of action templates, each with its parameters.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActionTemplate" } } } } }, "400": { "description": "Skip or take is negative." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionTemplate/action/{actionId}": { "post": { "tags": [ "Action Template" ], "summary": "Create a template from an action step", "description": "Creates a new user-defined action template from an existing action step and returns it. The template is named after the step (or after the step's own template when the step has no name) and copies the description, definition, icon and parameters from the step's template. A parameter that has a value on the step becomes optional, with that value as its default. The classification is not copied, so the new template has classification 0 (PreSession).\n\nPermission required: Requires the Admin or App role.\n\nValues for `classification`: 0 = PreSession, 1 = Session, 2 = PostSession, 3 = Internal, 4 = Any.", "operationId": "ActionTemplate_PostActionTemplate", "parameters": [ { "name": "actionId", "in": "path", "description": "ID of the action step to turn into a template.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The new action template.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionTemplate" } } } }, "400": { "description": "No action step has this ID, or a user-defined template with the same name already exists; the body holds the error text." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionTemplate/parameter/{templateId}": { "get": { "tags": [ "Action Template" ], "summary": "Get one action template parameter by its ID", "description": "Returns a single action template parameter, such as its name, type, whether it is required and its default value. The ID in the path is matched against the parameter's own ID, not the template's; to list all parameters of a template, get the template and read its actionTemplateParameter array.\n\nPermission required: Requires the Admin or App role.\n\nValues for `type`: 0 = PowerShell, 1 = Integer, 2 = DateTime, 3 = Credential, 4 = SecureString, 5 = String, 6 = KeyValue, 7 = Guid, 8 = HostId, 9 = UserId, 10 = ManagedResourceId, 11 = ManagedAccountId, 12 = UserCredential, 13 = DomainId, 14 = SessionId, 15 = DomainCredential, 16 = DomainConfigurationId, 17 = Boolean, 18 = ReportId.", "operationId": "ActionTemplate_GetParameter", "parameters": [ { "name": "templateId", "in": "path", "description": "ID of the template parameter (not the template).", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The template parameter.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionTemplateParameter" } } } }, "404": { "description": "No template parameter has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionTemplate/userdefined": { "get": { "tags": [ "Action Template" ], "summary": "List user-defined action templates", "description": "Returns the action templates that users created, with optional paging. Returns an empty array when there are none.\n\nPermission required: Requires the Admin or App role.\n\nValues for `classification`: 0 = PreSession, 1 = Session, 2 = PostSession, 3 = Internal, 4 = Any.", "operationId": "ActionTemplate_GetUserDefined", "parameters": [ { "name": "skip", "in": "query", "description": "Number of templates to skip. Must not be negative.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of templates to return. Must not be negative.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 20 } ], "responses": { "200": { "description": "An array of action templates.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActionTemplate" } } } } }, "400": { "description": "Skip or take is negative." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActionTemplate/{templateId}": { "delete": { "tags": [ "Action Template" ], "summary": "Delete an action template", "description": "Deletes the action template with the given ID and its parameters. If the template is one half of a start/end pair, the paired template is deleted too.\n\nPermission required: Requires the Admin or App role.\n\nCaution: The template, and its paired template if it has one, is deleted immediately and cannot be restored through the API.", "operationId": "ActionTemplate_DeleteTemplate", "parameters": [ { "name": "templateId", "in": "path", "description": "ID of the template to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "202": { "description": "The template is deleted. The body is empty." }, "404": { "description": "No template has this ID." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Action Template" ], "summary": "Get an action template", "description": "Returns one action template, including its parameters. Use it to see which values an action built from the template needs.\n\nPermission required: Requires the Admin or App role.\n\nValues for `classification`: 0 = PreSession, 1 = Session, 2 = PostSession, 3 = Internal, 4 = Any.", "operationId": "ActionTemplate_GetTemplate", "parameters": [ { "name": "templateId", "in": "path", "description": "ID of the template.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "A single action template object.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionTemplate" } } } }, "404": { "description": "No template has this ID." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Action Template" ], "summary": "Update an action template", "description": "Updates the action template's own settings, such as its name, description, definition and icon, with the values you send. The template is found by the id in the body, and the display name must be unique among templates. Parameters are not changed by this call.\n\nPermission required: Requires the Admin or App role.\n\nValues for `classification`: 0 = PreSession, 1 = Session, 2 = PostSession, 3 = Internal, 4 = Any.\n\nCaution: The change applies immediately. Settings left out of the body are reset to defaults, including classification (to 0, PreSession) and userDefined (to false).", "operationId": "ActionTemplate_UpdateTemplate", "parameters": [ { "name": "templateId", "in": "path", "description": "ID of the template to update.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "requestBody": { "description": "The action template. Send every setting you want to keep, because any setting you omit, including those not listed here, is reset to its default.\n\n- `id` (string (GUID), required): ID of the template being updated. The template is looked up by this value; use the same ID as in the path.\n- `displayName` (string, required): Name of the template. Must not match another template's name, ignoring case; otherwise 400.\n- `description` (string): Description of the template.\n- `definition` (string): Definition of the template.\n- `icon` (string): Icon for the template.\n- `classification` (integer (enum)): When the step can run, sent as a number. See the values below.\n- `actionTemplateParameter` (array): Parameters of the template. Ignored by this call; parameters are not updated.\n- `userDefined` (boolean): Whether users created the template. Omitting it sets false, which removes the template from the user-defined list.\n- `newActionDisplayName` (string): Default name for a new action built from the template.\n- `pairedActionTemplateId` (string (GUID)): ID of the paired start or end template. Omitting it clears the pairing link on this template.\n- `actionPackId` (string (GUID)): ID of the action pack that contains the template.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionTemplateUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The updated template.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionTemplate" } } } }, "400": { "description": "Another template already uses that name." }, "500": { "description": "No template has the ID in the body, or displayName is missing." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActiveDirectory/Domain/ByName/{domainName}": { "get": { "tags": [ "Active Directory" ], "summary": "Get a domain by name", "description": "Looks up a domain by its fully qualified or NetBIOS name and returns its configuration ID and both names.\n\nPermission required: Requires the Admin or App role.", "operationId": "ActiveDirectory_GetDomainByEitherName", "parameters": [ { "name": "domainName", "in": "path", "description": "Fully qualified or NetBIOS name of the domain.", "required": true, "schema": { "type": "string" }, "example": "example.com" } ], "responses": { "200": { "description": "An object with domainConfigId, fqdn and netbios.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DomainNames" } } } }, "400": { "description": "The lookup failed; the body holds the error text." }, "404": { "description": "No domain has this name." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActiveDirectory/Domain/{domain}/User/{samaccountname}/Properties": { "get": { "tags": [ "Active Directory" ], "summary": "Get Active Directory properties of a user", "description": "Returns the directory attributes of a user as key and value pairs. Use it to inspect an account in a domain.\n\nPermission required: Requires the Admin or App role.", "operationId": "ActiveDirectory_GetProperties", "parameters": [ { "name": "domain", "in": "path", "description": "Name of the domain. Also used as the server to query unless domainController is set.", "required": true, "schema": { "type": "string" }, "example": "example.com" }, { "name": "samaccountname", "in": "path", "description": "The user's sAMAccountName.", "required": true, "schema": { "type": "string" }, "example": "jsmith" }, { "name": "userId", "in": "query", "description": "ID of a stored user. When set, that user's domain name replaces the domain in the path for the lookup. The server queried is still the path domain, or domainController when set.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "domainController", "in": "query", "description": "Domain controller to query instead of the domain.", "required": false, "schema": { "type": "string" }, "example": "dc01.example.com" } ], "responses": { "200": { "description": "An array of objects with key and value.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string" }, "value": { "type": "string" } } } } } } }, "400": { "description": "The lookup failed; the body holds the error text." }, "404": { "description": "The user was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActiveDirectory/Names": { "get": { "tags": [ "Active Directory" ], "summary": "List domain IDs with their domain controller names", "description": "Returns the ID of each Active Directory domain that has a domain controller, with the domain controller name as the name, sorted by that name.\n\nPermission required: Requires the Admin or App role.", "operationId": "ActiveDirectory_ListNames", "responses": { "200": { "description": "An array of objects with id and name, where name is the domain controller name.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Activity": { "get": { "tags": [ "Activity" ], "summary": "List all activities", "description": "Returns every activity that has not been deleted, with its settings and the activity groups it belongs to. Credential release and file release activities are not included.\n\nPermission required: Administrator role. The signed-in session must have completed multifactor authentication.", "operationId": "Activity_GetAll", "responses": { "200": { "description": "An array of activities.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Activity" } } } } } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Activity" ], "summary": "Create an activity", "description": "Creates an activity. If you do not supply the start, during and end step groups, the server creates an empty group for each and returns their ids. The creation is recorded in the event log.\n\nPermission required: Administrator role. The signed-in session must have completed multifactor authentication.\n\nValues for `activityType`: 0 = Interactive, 1 = InteractiveAppLaunch, 2 = TaskAutomation, 3 = CredentialRelease, 4 = FileRelease.\n\nValues for `loginAccount`: 0 = Requester, 1 = Managed, 2 = ActivityIdentity (shown as Activity Token in the console), 3 = Vault, 4 = Resource.\n\nValues for `requesterLoginFormat`: 0 = Samaccountname (Domain\\SamAccountName), 1 = UPN (User Principal Name), 2 = Email, 3 = SamAccountNameOnly (SamAccountName), 4 = Custom.\n\nCaution: The activity is created immediately and can start applying wherever it is later added to an access policy.", "operationId": "Activity_Create", "requestBody": { "description": "The activity to create.\n\n- `id` (string (GUID)): Identifier of the activity. On update it must match the id in the path. On copy it identifies the activity to copy.\n- `name` (string, required): Name of the activity. Must be unique among activities, up to 256 characters.\n- `description` (string): Description of the activity.\n- `platformId` (string (GUID)): Platform the activity applies to. Use the Platform names list to find the id.\n- `activityType` (integer): Kind of activity. See the `Values for activityType` paragraph in the operation description.\n- `loginAccount` (integer): Type of account the activity signs in with. See the `Values for loginAccount` paragraph in the operation description.\n- `loginAccountNameFormat` (string): Template for the sign-in account name, for example one built from %samaccountname%. Required and validated unless loginAccount is Requester or Vault. An invalid template returns 400 with a message.\n- `requesterLoginFormat` (integer): Name format to use when the requester is the sign-in account. See the `Values for requesterLoginFormat` paragraph in the operation description.\n- `applicationToLaunch` (string): Path of the application to launch for application-launch activities.\n- `preferredRDSHostId` (string (GUID)): Resource to use as the preferred Remote Desktop Services host.\n- `connectCredentialId` (string (GUID)): Service account used to connect to the Remote Desktop Services host.\n- `createAccount` (boolean): Whether to create the account when the session starts. Applies when loginAccount is Managed or Resource.\n- `deleteAccount` (boolean): Whether to delete the account when the session ends. When false the account is disabled. Applies when loginAccount is Managed or Resource.\n- `vaultId` (string (GUID)): Vault connector used to look up the sign-in credentials. Used when loginAccount is Vault.\n- `vaultInfo` (string): Vault-specific settings, as a JSON string. Used when loginAccount is Vault.\n- `logonUrl` (string): Sign-in URL for website activities.\n- `activityConfigurationId` (string (GUID)): Connection profile settings attached to the activity.\n- `startActionGroupId` (string (GUID)): Steps that run when a session starts. If omitted, null or the empty GUID on create, an empty step group is created and its id is returned. On update, omitted ids keep their current values.\n- `duringActionGroupId` (string (GUID)): Steps that run during a session. Same behavior as startActionGroupId.\n- `endActionGroupId` (string (GUID)): Steps that run when a session ends. Same behavior as startActionGroupId.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityCreateRequest" }, "example": { "name": "", "description": "", "loginAccount": 2, "loginAccountNameFormat": "", "platformId": "7c9e6679-7425-40de-944b-e07fc1f90ae7", "createAccount": true, "deleteAccount": true } } }, "required": true }, "responses": { "201": { "description": "The activity is created. The response body is the new activity, and the Location header points to it.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Activity" } } } }, "400": { "description": "The sign-in account name template is missing or invalid. The response body is the error message as plain text." }, "500": { "description": "The activity could not be created, for example because another activity already has the same name." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Activity/copy": { "post": { "tags": [ "Activity" ], "summary": "Copy an activity", "description": "Creates a new activity from an existing one. Set the id in the request body to the activity to copy and supply the settings for the new activity, including a new name. Settings you leave out take default values; they are not copied from the original activity. The copy gets its own copies of the original's start, during and end steps, and, when the body includes a connection profile id, its own copy of the original activity's connection profile settings. The creation is recorded in the event log.\n\nPermission required: Administrator role. The signed-in session must have completed multifactor authentication.\n\nValues for `activityType`: 0 = Interactive, 1 = InteractiveAppLaunch, 2 = TaskAutomation, 3 = CredentialRelease, 4 = FileRelease.\n\nValues for `loginAccount`: 0 = Requester, 1 = Managed, 2 = ActivityIdentity (shown as Activity Token in the console), 3 = Vault, 4 = Resource.\n\nValues for `requesterLoginFormat`: 0 = Samaccountname (Domain\\SamAccountName), 1 = UPN (User Principal Name), 2 = Email, 3 = SamAccountNameOnly (SamAccountName), 4 = Custom.", "operationId": "Activity_Copy", "requestBody": { "description": "The settings for the new activity. The id identifies the activity to copy.\n\n- `id` (string (GUID), required): Identifier of the activity. Identifier of the activity to copy. The new activity gets a new id.\n- `name` (string, required): Name of the activity. Must be unique among activities, up to 256 characters.\n- `description` (string): Description of the activity.\n- `platformId` (string (GUID)): Platform the activity applies to. Use the Platform names list to find the id.\n- `activityType` (integer): Kind of activity. See the `Values for activityType` paragraph in the operation description.\n- `loginAccount` (integer): Type of account the activity signs in with. See the `Values for loginAccount` paragraph in the operation description.\n- `loginAccountNameFormat` (string): Template for the sign-in account name, for example one built from %samaccountname%. Not validated on copy.\n- `requesterLoginFormat` (integer): Name format to use when the requester is the sign-in account. See the `Values for requesterLoginFormat` paragraph in the operation description.\n- `applicationToLaunch` (string): Path of the application to launch for application-launch activities.\n- `preferredRDSHostId` (string (GUID)): Resource to use as the preferred Remote Desktop Services host.\n- `connectCredentialId` (string (GUID)): Service account used to connect to the Remote Desktop Services host.\n- `createAccount` (boolean): Whether to create the account when the session starts. Applies when loginAccount is Managed or Resource.\n- `deleteAccount` (boolean): Whether to delete the account when the session ends. When false the account is disabled. Applies when loginAccount is Managed or Resource.\n- `vaultId` (string (GUID)): Vault connector used to look up the sign-in credentials. Used when loginAccount is Vault.\n- `vaultInfo` (string): Vault-specific settings, as a JSON string. Used when loginAccount is Vault.\n- `logonUrl` (string): Sign-in URL for website activities.\n- `activityConfigurationId` (string (GUID)): Connection profile settings attached to the activity. If set, the server ignores the id and creates a copy of the original activity's connection profile settings for the new activity. If the original has none, the request fails with 500.\n- `startActionGroupId` (string (GUID)): Steps that run when a session starts. Ignored on copy. The server creates a new step group and fills it with copies of the original's steps.\n- `duringActionGroupId` (string (GUID)): Steps that run during a session. Ignored on copy. The server creates a new step group and fills it with copies of the original's steps.\n- `endActionGroupId` (string (GUID)): Steps that run when a session ends. Ignored on copy. The server creates a new step group and fills it with copies of the original's steps.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityCopyRequest" } } }, "required": true }, "responses": { "201": { "description": "The copy is created. The response body is the new activity, and the Location header points to it.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Activity" } } } }, "500": { "description": "The copy could not be created, for example because no activity has the id in the body or the name is already in use." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Activity/Names": { "get": { "tags": [ "Activity" ], "summary": "List activity names", "description": "Returns the id and name of every activity that has not been deleted, sorted by name, including credential release and file release activities. Use it to fill pick lists without loading full activity records.\n\nPermission required: Administrator role. The signed-in session must have completed multifactor authentication.", "operationId": "Activity_ListNames", "responses": { "200": { "description": "An array of objects, each with an id and a name.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Activity/{id}": { "delete": { "tags": [ "Activity" ], "summary": "Delete an activity", "description": "Deletes an activity and removes it from every activity group it belongs to. The activity no longer appears in activity lists, and the deletion is recorded in the event log.\n\nPermission required: Administrator role. The signed-in session must have completed multifactor authentication.", "operationId": "Activity_Delete", "parameters": [ { "name": "id", "in": "path", "description": "Identifier of the activity.", "required": true, "schema": { "type": "string" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "202": { "description": "The activity is deleted. The response has no body." }, "400": { "description": "The delete failed. The response body is the error message as plain text." }, "404": { "description": "No activity exists with this id." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Activity" ], "summary": "Get an activity", "description": "Returns one activity and its settings. The lookup is by id only, so it also returns deleted activities and credential release and file release activities. Use the activity list if you need group membership and connection profile settings.\n\nPermission required: Administrator role. The signed-in session must have completed multifactor authentication.", "operationId": "Activity_GetById", "parameters": [ { "name": "id", "in": "path", "description": "Identifier of the activity.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "200": { "description": "The activity.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Activity" } } } }, "404": { "description": "No activity exists with this id. The response body is the requested id." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Activity" ], "summary": "Update an activity", "description": "Replaces the settings of an existing activity with the activity in the request body. Changes to the name, platform, sign-in account and similar settings are recorded in the event log.\n\nPermission required: Administrator role. The signed-in session must have completed multifactor authentication.\n\nValues for `activityType`: 0 = Interactive, 1 = InteractiveAppLaunch, 2 = TaskAutomation, 3 = CredentialRelease, 4 = FileRelease.\n\nValues for `loginAccount`: 0 = Requester, 1 = Managed, 2 = ActivityIdentity (shown as Activity Token in the console), 3 = Vault, 4 = Resource.\n\nValues for `requesterLoginFormat`: 0 = Samaccountname (Domain\\SamAccountName), 1 = UPN (User Principal Name), 2 = Email, 3 = SamAccountNameOnly (SamAccountName), 4 = Custom.\n\nCaution: The change replaces the stored activity and takes effect immediately, so send the full activity rather than only the fields you want to change.", "operationId": "Activity_Update", "parameters": [ { "name": "id", "in": "path", "description": "Identifier of the activity.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "requestBody": { "description": "The complete activity with your changes. The id must match the id in the path.\n\n- `id` (string (GUID), required): Identifier of the activity. Must match the id in the path; otherwise the request fails with 400.\n- `name` (string, required): Name of the activity. Must be unique among activities, up to 256 characters.\n- `description` (string): Description of the activity.\n- `platformId` (string (GUID)): Platform the activity applies to. Use the Platform names list to find the id.\n- `activityType` (integer): Kind of activity. See the `Values for activityType` paragraph in the operation description.\n- `loginAccount` (integer): Type of account the activity signs in with. See the `Values for loginAccount` paragraph in the operation description.\n- `loginAccountNameFormat` (string): Template for the sign-in account name, for example one built from %samaccountname%. Required and validated unless loginAccount is Requester or Vault. An invalid template returns 400 with a message.\n- `requesterLoginFormat` (integer): Name format to use when the requester is the sign-in account. See the `Values for requesterLoginFormat` paragraph in the operation description.\n- `applicationToLaunch` (string): Path of the application to launch for application-launch activities.\n- `preferredRDSHostId` (string (GUID)): Resource to use as the preferred Remote Desktop Services host.\n- `connectCredentialId` (string (GUID)): Service account used to connect to the Remote Desktop Services host.\n- `createAccount` (boolean): Whether to create the account when the session starts. Applies when loginAccount is Managed or Resource.\n- `deleteAccount` (boolean): Whether to delete the account when the session ends. When false the account is disabled. Applies when loginAccount is Managed or Resource.\n- `vaultId` (string (GUID)): Vault connector used to look up the sign-in credentials. Used when loginAccount is Vault.\n- `vaultInfo` (string): Vault-specific settings, as a JSON string. Used when loginAccount is Vault.\n- `logonUrl` (string): Sign-in URL for website activities.\n- `activityConfigurationId` (string (GUID)): Connection profile settings attached to the activity.\n- `startActionGroupId` (string (GUID)): Steps that run when a session starts. If omitted, null or the empty GUID on create, an empty step group is created and its id is returned. On update, omitted ids keep their current values.\n- `duringActionGroupId` (string (GUID)): Steps that run during a session. Same behavior as startActionGroupId.\n- `endActionGroupId` (string (GUID)): Steps that run when a session ends. Same behavior as startActionGroupId.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The activity is updated. The response body is the updated activity.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Activity" } } } }, "400": { "description": "The id in the path does not match the id in the body, or the sign-in account name template is missing or invalid. The response body is a message as plain text." }, "404": { "description": "No activity exists with this id." }, "500": { "description": "The update failed, for example because another activity already has the same name or the name is missing." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Activity/{id}/AccessPolicies": { "get": { "tags": [ "Activity" ], "summary": "Get an activity and its access policies", "description": "Returns an activity together with the access policies that use it. Use it to see where an activity applies before you change or delete it.\n\nPermission required: Administrator role. The signed-in session must have completed multifactor authentication.", "operationId": "Activity_GetByIdWithPolicies", "parameters": [ { "name": "id", "in": "path", "description": "Identifier of the activity.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "200": { "description": "An object with an activity property holding the activity and a policies property holding an array of access policies. If no activity has this id, activity is null and policies is empty.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityWithPolicies" } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivityGroup": { "get": { "tags": [ "Activity Group" ], "summary": "List all activity groups", "description": "Returns every activity group, including the activities in each group. Groups marked as deleted are not filtered out.\n\nPermission required: Administrator role.", "operationId": "ActivityGroup_Get", "responses": { "200": { "description": "An array of activity groups.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityGroup" } } } } } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Activity Group" ], "summary": "Create an activity group", "description": "Creates an activity group. If a deleted group has the same id or name, that group is restored with the new description instead of a new one being created.\n\nPermission required: Administrator role.", "operationId": "ActivityGroup_Create", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityGroupCreateRequest" } } }, "required": true, "description": "The activity group to create.\n\n- `id` (string (GUID)): Identifier of the activity group. Optional. If a group marked as deleted has this id or this name, that group is restored instead of a new one being created.\n- `name` (string, required): Name of the activity group. Must be unique among activity groups, up to 256 characters.\n- `description` (string): Description of the activity group.\n- `activityGroupActivities` (array of objects): Activities to place in the group when it is created. Each object needs the activityId of an existing activity. Optional. Ignored when a deleted group is restored. If an activityId does not match an activity, the request fails with 500 but the group itself is still created. You can also add activities after creation with the add activities route." }, "responses": { "201": { "description": "The group is created or restored. The response body is the activity group, and the Location header points to it.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityGroup" } } } }, "500": { "description": "The group could not be created, for example because another activity group already has the same name or the name is missing." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivityGroup/Names": { "get": { "tags": [ "Activity Group" ], "summary": "List activity group names", "description": "Returns the id and name of every activity group that has not been deleted, sorted by name.\n\nPermission required: Administrator role.", "operationId": "ActivityGroup_ListNames", "responses": { "200": { "description": "An array of objects, each with an id and a name.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivityGroup/{activityGroupId}/SearchActivities": { "get": { "tags": [ "Activity Group" ], "summary": "Search the activities in a group", "description": "Returns a page of the activities that belong to an activity group. You can filter by text and choose the sort order.\n\nPermission required: Administrator role.", "operationId": "ActivityGroup_SearchActivities", "parameters": [ { "name": "activityGroupId", "in": "path", "description": "Identifier of the activity group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "skip", "in": "query", "description": "Number of activities to skip. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of activities to return. Defaults to 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort by. Defaults to Name.", "required": false, "schema": { "type": "string" }, "example": "Name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. Defaults to false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "filterText", "in": "query", "description": "Return only activities whose name or description contains this text. The match ignores case.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Accepted but not used by this route. The text filter always searches a fixed set of columns.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "An object with a data array of activities and a recordsTotal count of all matches.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfActivity" } } } }, "400": { "description": "The search failed. The response body is a message." }, "404": { "description": "No activity group exists with this id. The response body is a message." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivityGroup/{id}": { "delete": { "tags": [ "Activity Group" ], "summary": "Delete an activity group", "description": "Deletes an activity group permanently, together with its activity memberships. The activities in the group are not deleted.\n\nPermission required: Administrator role.\n\nCaution: The group is removed permanently and cannot be restored. Check which access policies use it first with the get activity group and access policies route.", "operationId": "ActivityGroup_Delete", "parameters": [ { "name": "id", "in": "path", "description": "Identifier of the activity group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "202": { "description": "The deletion is accepted. The response has no body. An id that does not match a group also returns 202." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Activity Group" ], "summary": "Get an activity group", "description": "Returns one activity group, including the activities in it. A group marked as deleted is still returned.\n\nPermission required: Administrator role.", "operationId": "ActivityGroup_GetById", "parameters": [ { "name": "id", "in": "path", "description": "Identifier of the activity group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "The activity group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityGroup" } } } }, "404": { "description": "No activity group exists with this id." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Activity Group" ], "summary": "Update an activity group", "description": "Changes the name and description of an activity group. Other properties in the request body are ignored; use the add and remove activities routes to change membership.\n\nPermission required: Administrator role.", "operationId": "ActivityGroup_Update", "parameters": [ { "name": "id", "in": "path", "description": "Identifier of the activity group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityGroupUpdateRequest" } } }, "required": true, "description": "The activity group. Only name and description can be changed on update.\n\n- `id` (string (GUID), required): Identifier of the activity group. Must match the id in the path; otherwise the request fails with 400.\n- `name` (string, required): Name of the activity group. Must be unique among activity groups, up to 256 characters.\n- `description` (string): Description of the activity group." }, "responses": { "200": { "description": "The group is updated. The response body is the updated activity group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityGroup" } } } }, "400": { "description": "The id in the path does not match the id in the body." }, "404": { "description": "No activity group exists with this id." }, "500": { "description": "The update failed, for example because another activity group already has the same name or the name is missing." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivityGroup/{id}/AccessPolicies": { "get": { "tags": [ "Activity Group" ], "summary": "Get an activity group and its access policies", "description": "Returns an activity group together with the access policies that use it. Use it to see where a group applies before you change or delete it.\n\nPermission required: Administrator role.", "operationId": "ActivityGroup_GetByIdWithAccessPolicies", "parameters": [ { "name": "id", "in": "path", "description": "Identifier of the activity group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "An object with an activityGroup property holding the group and a policies property holding an array of access policies. If no group has this id, activityGroup is null and policies is empty.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityGroup" } } } }, "404": { "description": "No activity group has this ID. The body is the ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivityGroup/{id}/AddActivities": { "put": { "tags": [ "Activity Group" ], "summary": "Add activities to a group", "description": "Adds the listed activities to an activity group. Activities that are already members, and ids that do not match an activity, are skipped. The response is the number of activities added.\n\nPermission required: Administrator role.", "operationId": "ActivityGroup_AddActivities", "parameters": [ { "name": "id", "in": "path", "description": "Identifier of the activity group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true, "description": "A JSON array of activity ids to add.\n\n- `(array item)` (string (GUID), required): Id of an activity to add. Ids that do not match an existing activity are ignored. Deleted activities are not filtered out, so their ids are added." }, "responses": { "200": { "description": "The number of activities added, as an integer.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "404": { "description": "No activity group exists with this id." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivityGroup/{id}/RemoveActivities": { "put": { "tags": [ "Activity Group" ], "summary": "Remove activities from a group", "description": "Removes the listed activities from an activity group. Activities that are not members, and ids that do not match an activity, are skipped. The activities themselves are not deleted. The response is the number removed.\n\nPermission required: Administrator role.", "operationId": "ActivityGroup_RemoveActivities", "parameters": [ { "name": "id", "in": "path", "description": "Identifier of the activity group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true, "description": "A JSON array of activity ids to remove.\n\n- `(array item)` (string (GUID), required): Id of an activity to remove. Ids that do not match an existing activity are ignored." }, "responses": { "200": { "description": "The number of activities removed, as an integer.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "404": { "description": "No activity group exists with this id." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession": { "get": { "tags": [ "Activity Session" ], "summary": "List activity sessions by status", "description": "Returns activity sessions as a plain list, optionally limited to one status and to one target. Use the paged summary routes instead when you need paging or sorting.\n\nPermission required: Administrator role or Auditing and Reporting role.", "operationId": "ActivitySession_GetAllActivitySessionsByStatus", "parameters": [ { "name": "status", "in": "query", "description": "Which sessions to return: active, pending, approvalrequired or historical. Leave empty to return sessions in every status. Historical returns sessions that are past the active state, such as completed, failed or cancelled sessions. Active also includes sessions that are starting or ending, meaning pending sessions whose start time has passed and sessions being cancelled. Because sessions being cancelled are not yet complete, they appear under both active and historical.", "required": false, "schema": { "type": "string" }, "example": "active" }, { "name": "targetId", "in": "query", "description": "Return only sessions on the target (host or domain) with this identifier.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "targetUserId", "in": "query", "description": "Return only sessions for the target account with this identifier.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The list of matching activity sessions. The list is empty when nothing matches.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActivitySession" } } } } }, "400": { "description": "The status value is not recognized, or the request failed. The body is the error message; for an unrecognized status it says the status must be pending, active or historical." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The signed-in account does not have the required role." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Activity Session" ], "summary": "Create and start an activity session", "description": "Creates an activity session for the target resource or credential and queues it to start. If the access policy requires approval, the session waits for approval before it is scheduled. The session is created for the signed-in user, and application accounts must name the user in managedAccountId.\n\nPermission required: Any signed-in user with a managed account, or an application account.\n\nValues for `customFields[].customFieldDataType`: 0 = Integer, 1 = String, 2 = Options.", "operationId": "ActivitySession_Create", "requestBody": { "description": "The session to create. Identify the target with a resource or a credential field and the activity with activityName or activityId.\n\n- `managedResourceId` (string (uuid)): Identifier of the resource to connect to. Provide the resource or a credential, unless the activity only assigns group roles, which needs neither. The server checks managedResourceId first, then managedResourceName, then credentialId, then credentialUsername with credentialDomain, then credentialName, and uses the first one present. An identifier that is really a credential is accepted.\n- `managedResourceName` (string): DNS host name of the resource to connect to. Used when managedResourceId is not sent.\n- `credentialId` (string (uuid)): Identifier of the credential to release, for a credential session.\n- `credentialUsername` (string): User name of the credential to release. Send together with credentialDomain.\n- `credentialDomain` (string): Domain or host name of the credential to release. Empty for Entra ID accounts.\n- `credentialName` (string): Name of the credential to release.\n- `activityName` (string): Name of the activity to run, for example Credential Release. When set, it is looked up by exact name and replaces activityId. Send activityName or activityId; one of them is required.\n- `activityId` (string (uuid)): Identifier of the activity to run. Send this or activityName; one of them is required.\n- `accessPolicyId` (string (uuid)): Identifier of the access policy that grants the session.\n- `startDateTimeUtc` (string (date-time)): UTC time the session starts. A future time schedules the session. If left empty or set in the past, the session starts now.\n- `endDateTimeUtc` (string (date-time)): UTC time the session ends. If left out or earlier than the start, the session ends after the maximum session length of its connection profile. A later time is capped to that maximum.\n- `note` (string): A note to store with the session. Required when the access policy requires notes.\n- `ticket` (string): A ticket reference to store with the session. Required when the access policy requires a ticket.\n- `managedAccountId` (string (uuid)): Identifier of the user the session is created for. Application accounts must send it. Used only for application accounts. For every other caller the server replaces it with the caller's own account.\n- `encryptedFileId` (string (uuid)): Identifier of the encrypted file to release, for a file release session.\n- `customFields` (array of objects): Values for custom fields on the access policy. Each item has policyId, name, value and customFieldDataType. Send customFieldDataType as a number, see the enum notes.\n- `runtimeParameterOverrides` (array of objects): Values that replace action parameters for this session. Each item has actionId, parameterName and value.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivitySessionRequest" }, "example": { "credentialUsername": "", "credentialDomain": "", "activityName": "Credential Release", "note": "", "ticket": "", "accessPolicyId": "7c9e6679-7425-40de-944b-e07fc1f90ae7", "startDateTimeUtc": "2026-01-01T00:00:00Z" } } }, "required": true }, "responses": { "201": { "description": "The session was created and queued. The body is the new activity session, and the Location header points to it.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivitySession" } } } }, "400": { "description": "The request is not valid. The body is the message, for example that the account is locked, that the resource, credential or activity could not be found, that no resource or credential was supplied, that no access policy grants the user this activity, or that a note or ticket the policy requires is missing." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "404": { "description": "The account for the session was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/Config/{id}": { "get": { "tags": [ "Activity Session" ], "summary": "Get the connection profile settings of a session", "description": "Returns the activity configuration, the connection profile settings, that apply to one activity session. Use it to see what the session allows, such as password access or session extension.\n\nPermission required: Administrator role, Auditing and Reporting role or application account.", "operationId": "ActivitySession_GetActivityConfiguration", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier of the activity session.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The activity configuration for the session.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityConfiguration" } } } }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The signed-in account does not have the required role." }, "404": { "description": "No activity session exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/Group": { "post": { "tags": [ "Activity Session" ], "summary": "Create a group of activity sessions", "description": "Creates one or more activity sessions together as a group and queues them to start. All sessions are created for the signed-in user. This is the route the console uses when a user requests a session. Sessions are created one at a time, so if a later request in the array fails, the sessions created before it remain.\n\nPermission required: Any signed-in user with a managed account.\n\nValues for `customFields[].customFieldDataType`: 0 = Integer, 1 = String, 2 = Options.", "operationId": "ActivitySession_CreateActivitySessionGroup", "requestBody": { "description": "A JSON array with one session request for each session to create. Each item has the same fields as the request to create a single session, except that managedAccountId is ignored.\n\n- `(array item)` (array of objects, required): One session request per item. At least one item is required. Fields: managedResourceId, managedResourceName, credentialId, credentialUsername, credentialDomain, credentialName, activityName, activityId, accessPolicyId, startDateTimeUtc, endDateTimeUtc, note, ticket, encryptedFileId, customFields, runtimeParameterOverrides. See POST /api/v1/ActivitySession for what each field does. Send customFieldDataType inside customFields as a number, see the enum notes.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActivitySessionRequest" } }, "example": [ { "managedResourceId": "7c9e6679-7425-40de-944b-e07fc1f90ae7", "activityId": "7c9e6679-7425-40de-944b-e07fc1f90ae7", "note": "", "ticket": "", "accessPolicyId": "3fa85f64-5717-4562-b3fc-2c963f66afa6", "startDateTimeUtc": "2024-03-27T01:01:01Z" } ] } }, "required": true }, "responses": { "201": { "description": "The group and its sessions were created and queued. The body is the group, with its sessions in activitySessions.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivitySessionGroup" } } } }, "400": { "description": "The array is empty, the account or resources are locked, a resource, credential or activity could not be found, no access policy grants the user an activity, or a note or ticket the policy requires is missing. The body is the message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The signed-in account is not linked to a managed account." }, "404": { "description": "The account for the sessions was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/lock": { "put": { "tags": [ "Activity Session" ], "summary": "Lock or unlock live activity sessions", "description": "Locks or unlocks one or more activity sessions. A locked session shows a message to the user until it is unlocked. You can also lock the user, or the user on one resource, so that new sessions are blocked too.\n\nPermission required: Administrators and application accounts. An auditor needs a role that includes auditor permissions, and an auditor or an administrator in read-only view also needs the Lock Session permission for each session's user and resource.\n\nCaution: Locking or unlocking takes effect immediately, and locking the user affects all of that user's active and pending sessions until you unlock them. Unlocking is not limited to the sessions you list. Sessions are processed in order, so if one fails, the sessions before it have already been changed.", "operationId": "ActivitySession_Lock", "requestBody": { "description": "The sessions to lock or unlock and how.\n\n- `activitySessionIds` (array of strings (uuid), required): Identifiers of the sessions to lock or unlock. At least one is required.\n- `locked` (boolean, required): True to lock the sessions, false to unlock them. If left out it is treated as false and the sessions are unlocked. Unlocking removes the user's block on the session's resource, unlocks the user's account, and unlocks all of that user's active, pending and approval-required sessions, whatever the other flags say.\n- `lockResource` (boolean): When locking, also block this user from starting new sessions on the session's resource.\n- `lockUser` (boolean): When locking, also lock the user: all of the user's active, pending and approval-required sessions are locked and new sessions are blocked.\n- `lockActivity` (boolean): Not used by this route. The session itself is locked whenever locked is true.\n- `lockMessage` (string): Message shown to the user. Defaults to a message asking them to contact a Netwrix Privilege Secure administrator.\n- `lockTitle` (string): Title of the message dialog. Defaults to Netwrix Privilege Secure.\n- `id` (string (uuid)): Not needed for this request. You can leave it out.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LiveSessionUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The lock or unlock was applied. The body repeats the request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LiveSessionRequest" } } } }, "400": { "description": "No session identifiers were supplied, or an identifier was empty. The body is the error message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not allowed to lock these sessions, for example an auditor without the Lock Session permission." }, "404": { "description": "One of the sessions was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/MySummaryByStatus/Historical": { "get": { "tags": [ "Activity Session" ], "summary": "List your past activity sessions", "description": "Returns a page of the signed-in user's sessions that have ended, newest first by default. Use it to review your own session history.\n\nPermission required: Any signed-in user. The result always contains only the caller's own sessions.\n\nValues for `filterUserType`: 0 = User, 1 = Application, 2 = Local.", "operationId": "ActivitySession_GetHistoricalSessionSummaryForUser", "parameters": [ { "name": "skip", "in": "query", "description": "Number of items to skip. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Number of items to return. Defaults to 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "Name of the session property to sort by.", "required": false, "schema": { "type": "string" }, "example": "startDateTimeUtc" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort newest or highest first. Defaults to true.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true }, { "name": "filterText", "in": "query", "description": "Return only sessions that contain this text.", "required": false, "schema": { "type": "string" }, "example": "maintenance" }, { "name": "filterUserType", "in": "query", "description": "Return only sessions for this type of account. Send the number.", "required": false, "schema": { "$ref": "#/components/schemas/AccountType" } }, { "name": "resourceName", "in": "query", "description": "Return only sessions on resources with this name or DNS host name. Repeat the parameter to match several resources.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "startDate", "in": "query", "description": "Return only sessions that start after this UTC date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-01T00:00:00Z" }, { "name": "endDate", "in": "query", "description": "Return only sessions whose start is before this UTC date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-12-31T23:59:59Z" }, { "name": "metadataFilterText", "in": "query", "description": "Return only sessions whose recorded keystrokes or output contain this text.", "required": false, "schema": { "type": "string" } }, { "name": "userName", "in": "query", "description": "Return only sessions for this user name. Repeat the parameter to match several users (userName=X&userName=Y).", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns the matching session summaries in data and the total number of matches in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfSessionSummary" } } } }, "400": { "description": "The request failed. The body is the error message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "404": { "description": "The signed-in account is not linked to a managed account." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/MySummaryByStatus/{status}": { "get": { "tags": [ "Activity Session" ], "summary": "List your activity sessions with a given status", "description": "Returns a page of the signed-in user's sessions that have the given status, such as pending, active or waiting for approval. It includes sessions the user created and sessions scheduled for the user.\n\nPermission required: Any signed-in user. The result always contains only the caller's own sessions.\n\nValues for `status`: -1 = ApprovalRequired, 0 = Pending, 1 = Active, 2 = Cancelling, 3 = Complete, 4 = Failed, 5 = Cancelled, 6 = ApprovalDenied, 7 = ApprovalFailed.", "operationId": "ActivitySession_GetSessionSummaryByStatusForUser", "parameters": [ { "name": "status", "in": "path", "description": "Session status to return. Send the name or the number.", "required": true, "schema": { "$ref": "#/components/schemas/SessionStatus" } }, { "name": "skip", "in": "query", "description": "Number of items to skip. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Number of items to return. Defaults to 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "Name of the session property to sort by.", "required": false, "schema": { "type": "string" }, "example": "startDateTimeUtc" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort newest or highest first. Defaults to true.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true }, { "name": "filterText", "in": "query", "description": "Return only sessions that contain this text.", "required": false, "schema": { "type": "string" }, "example": "maintenance" }, { "name": "resourceName", "in": "query", "description": "Return only sessions on resources with this name or DNS host name. Repeat the parameter to match several resources.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "startDate", "in": "query", "description": "Return only sessions that start after this UTC date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-01T00:00:00Z" }, { "name": "endDate", "in": "query", "description": "Return only sessions whose start is before this UTC date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-12-31T23:59:59Z" }, { "name": "metadataFilterText", "in": "query", "description": "Return only sessions whose recorded keystrokes or output contain this text.", "required": false, "schema": { "type": "string" } }, { "name": "userName", "in": "query", "description": "Return only sessions for this user name. Repeat the parameter to match several users (userName=X&userName=Y).", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns the matching session summaries in data and the total number of matches in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfSessionSummary" } } } }, "400": { "description": "The status value is not valid, or the request failed. The body is the error message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "404": { "description": "The signed-in account is not linked to a managed account." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/Rdp/{sessionId}": { "get": { "tags": [ "Activity Session" ], "summary": "Get the RDP connection file for a session", "description": "Returns the text of a Remote Desktop (.rdp) file that connects the session's owner through the Netwrix Privilege Secure proxy. It works for sessions on Windows and Active Directory resources, and for interactive application launches that use a remote desktop host. The file uses the screen size and display settings from the system settings and is signed when a signing certificate is configured.\n\nPermission required: Only the user who owns the session.\n\nCaution: The file can hold a one-time connection token that lets whoever has it connect to the session, so handle it as a secret and open it promptly.", "operationId": "ActivitySession_GetRdpFile", "parameters": [ { "name": "sessionId", "in": "path", "description": "The unique identifier of the activity session.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "200": { "description": "The contents of the RDP file as text.", "content": { "application/json": { "schema": { "type": "string" } } } }, "401": { "description": "The session or the account is locked, or the request is not signed in." }, "403": { "description": "The caller does not own the session." }, "404": { "description": "The session's resource is not on a platform that supports RDP. This check runs before the ownership check, so a caller who does not own the session can also receive 404." }, "500": { "description": "No activity session exists with this identifier. The server does not handle this case and fails the request instead of returning 404." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/Search": { "get": { "tags": [ "Activity Session" ], "summary": "Search activity sessions with summary statistics", "description": "Searches activity sessions and returns a page of matching session summaries together with the most active users and overall session counts and durations. Use it to build audit and reporting views.\n\nPermission required: Administrator role or Auditing and Reporting role.\n\nValues for `filterTopUsersType`: 0 = None, 1 = Everyone, 2 = Top5, 3 = Top10.", "operationId": "ActivitySession_Search", "parameters": [ { "name": "skip", "in": "query", "description": "Number of items to skip. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Number of items to return. Defaults to 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "Name of the session property to sort by.", "required": false, "schema": { "type": "string" }, "example": "startDateTimeUtc" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort newest or highest first. Defaults to true.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true }, { "name": "filterText", "in": "query", "description": "Return only sessions that contain this text.", "required": false, "schema": { "type": "string" }, "example": "maintenance" }, { "name": "filterDateTimeMin", "in": "query", "description": "Return only sessions on or after this UTC date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-01T00:00:00Z" }, { "name": "filterDateTimeMax", "in": "query", "description": "Return only sessions on or before this UTC date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-12-31T23:59:59Z" }, { "name": "filterTopUsersType", "in": "query", "description": "Which top users list to include in topUsers. Send the number. Defaults to 0, which includes none.", "required": false, "schema": { "$ref": "#/components/schemas/ActivitySessionTopUsersTypes" } } ], "responses": { "200": { "description": "The matching sessions in data, the total in recordsTotal, the top users in topUsers, and counts and durations in summary.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivitySessionSearchResults" } } } }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The signed-in account does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/Ssh/{sessionId}": { "get": { "tags": [ "Activity Session" ], "summary": "Get the SSH connection URL for a session", "description": "Returns the SSH URL that the session's owner uses to connect through the Netwrix Privilege Secure proxy. When the session's connection profile uses automatic connect, the URL carries a one-time token in place of the user name.\n\nPermission required: Only the user who owns the session.\n\nCaution: When automatic connect is on, the URL holds a one-time connection token that lets whoever has it connect to the session, so handle it as a secret and use it promptly.", "operationId": "ActivitySession_GetSshUrl", "parameters": [ { "name": "sessionId", "in": "path", "description": "The unique identifier of the activity session.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "200": { "description": "The SSH URL as a string, for example ssh://user+activity+host@proxy:4422.", "content": { "application/json": { "schema": { "type": "string" } } } }, "401": { "description": "The activity or the account is locked, or the request is not signed in." }, "403": { "description": "The caller does not own the session." }, "404": { "description": "The session does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/SummaryById/{sessionId}": { "get": { "tags": [ "Activity Session" ], "summary": "Get the summary of one activity session", "description": "Returns the summary row for one activity session, with its status, times, resource, activity and access policy.\n\nPermission required: Administrators and application accounts, or the user who owns the session.", "operationId": "ActivitySession_GetActivitySessionSummaryById", "parameters": [ { "name": "sessionId", "in": "path", "description": "The unique identifier of the activity session.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "200": { "description": "The session summary.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SessionSummary" } } } }, "400": { "description": "The request failed. The body is the error message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator, an application account, or the session owner." }, "404": { "description": "No activity session exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/SummaryByStatus/Historical": { "get": { "tags": [ "Activity Session" ], "summary": "List past activity sessions", "description": "Returns a page of activity sessions that have ended. Administrators can see all users or narrow to one user or group, auditors see the sessions they are allowed to audit, and everyone else sees only their own sessions.\n\nPermission required: Any signed-in user. Administrators see all sessions, auditors see the sessions they are allowed to audit, and other users see only their own. Filtering by another user or a group is limited to administrators.\n\nValues for `filterUserType`: 0 = User, 1 = Application, 2 = Local.\n\nValues for `streamType`: -1 = Unknown, 0 = All, 1 = Windows_Audit, 2 = StdIn, 3 = StdOut.", "operationId": "ActivitySession_GetHistoricalSessionSummary", "parameters": [ { "name": "userId", "in": "query", "description": "Return only sessions for this user. Administrators can use any user, and other users can use only their own identifier.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "userGroupId", "in": "query", "description": "Return only sessions for members of this user group. Administrators only.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "skip", "in": "query", "description": "Number of items to skip. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Number of items to return. Defaults to 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "Name of the session property to sort by.", "required": false, "schema": { "type": "string" }, "example": "startDateTimeUtc" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort newest or highest first. Defaults to true.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true }, { "name": "filterText", "in": "query", "description": "Return only sessions that contain this text.", "required": false, "schema": { "type": "string" }, "example": "maintenance" }, { "name": "filterUserType", "in": "query", "description": "Return only sessions for this type of account. Send the number.", "required": false, "schema": { "$ref": "#/components/schemas/AccountType" } }, { "name": "metadataFilterText", "in": "query", "description": "Return only sessions whose recorded keystrokes or output contain this text. Intended for administrators and auditors. When used, recordsTotal is the number of sessions on the returned page rather than the full match count.", "required": false, "schema": { "type": "string" }, "example": "restart" }, { "name": "streamType", "in": "query", "description": "Which recorded streams metadataFilterText searches. Send the number. Defaults to 0, which searches all.", "required": false, "schema": { "$ref": "#/components/schemas/StreamType" } }, { "name": "startDate", "in": "query", "description": "Return only sessions that start after this UTC date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-01T00:00:00Z" }, { "name": "endDate", "in": "query", "description": "Return only sessions whose start is before this UTC date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-12-31T23:59:59Z" }, { "name": "resourceName", "in": "query", "description": "Return only sessions on resources with this name or DNS host name. Repeat the parameter to match several resources.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "userName", "in": "query", "description": "Return only sessions for this user name. Repeat the parameter to match several users. Used for administrators and auditors listing all users.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns the matching session summaries in data and the total number of matches in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfSessionSummary" } } } }, "400": { "description": "The request failed. The body is the error message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "A non-administrator asked for another user's sessions or for a group." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/SummaryByStatus/{status}": { "get": { "tags": [ "Activity Session" ], "summary": "List activity sessions with a given status", "description": "Returns a page of activity sessions that have the given status, such as pending, active or waiting for approval. Administrators and auditors can see all users or narrow to one user or group, and everyone else sees only their own sessions.\n\nPermission required: Any signed-in user. Administrators see all sessions, auditors see the sessions they are allowed to audit, and other users see only their own. The user, group and keystroke filters apply only to administrators and auditors.\n\nValues for `status`: -1 = ApprovalRequired, 0 = Pending, 1 = Active, 2 = Cancelling, 3 = Complete, 4 = Failed, 5 = Cancelled, 6 = ApprovalDenied, 7 = ApprovalFailed.\n\nValues for `streamType`: -1 = Unknown, 0 = All, 1 = Windows_Audit, 2 = StdIn, 3 = StdOut.", "operationId": "ActivitySession_GetSessionSummaryByStatus", "parameters": [ { "name": "status", "in": "path", "description": "Session status to return. Send the name or the number.", "required": true, "schema": { "$ref": "#/components/schemas/SessionStatus" } }, { "name": "userId", "in": "query", "description": "Return only sessions for this user. Ignored for users who are not administrators or auditors.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "userGroupId", "in": "query", "description": "Return only sessions for members of this user group. Ignored for users who are not administrators or auditors.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "skip", "in": "query", "description": "Number of items to skip. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Number of items to return. Defaults to 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "Name of the session property to sort by.", "required": false, "schema": { "type": "string" }, "example": "startDateTimeUtc" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort newest or highest first. Defaults to true.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true }, { "name": "filterText", "in": "query", "description": "Return only sessions that contain this text.", "required": false, "schema": { "type": "string" }, "example": "maintenance" }, { "name": "metadataFilterText", "in": "query", "description": "Return only sessions whose recorded keystrokes or output contain this text. Used for administrators and auditors and ignored for other users. When used, recordsTotal is the number of sessions on the returned page.", "required": false, "schema": { "type": "string" }, "example": "restart" }, { "name": "streamType", "in": "query", "description": "Which recorded streams metadataFilterText searches. Send the number. Defaults to 0, which searches all.", "required": false, "schema": { "$ref": "#/components/schemas/StreamType" } }, { "name": "startDate", "in": "query", "description": "Return only sessions that start after this UTC date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-01T00:00:00Z" }, { "name": "endDate", "in": "query", "description": "Return only sessions whose start is before this UTC date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-12-31T23:59:59Z" }, { "name": "resourceName", "in": "query", "description": "Return only sessions on resources with this name or DNS host name. Repeat the parameter to match several resources.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "userName", "in": "query", "description": "Return only sessions for this user name. Repeat the parameter to match several users. Ignored for users who are not administrators or auditors.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns the matching session summaries in data and the total number of matches in recordsTotal. With take set to 0 and no group filter, data is empty and recordsTotal still shows the match count. When metadataFilterText is used, recordsTotal is the number of sessions on the returned page rather than the full match count.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfSessionSummary" } } } }, "400": { "description": "The status value is not valid, or the request failed. The body is the error message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/SummaryForResource/{managedResourceId}": { "get": { "tags": [ "Activity Session" ], "summary": "List activity sessions for one resource", "description": "Returns a page of activity sessions on one managed resource. Use it to review who accessed a resource and when.\n\nPermission required: Administrator role or Auditing and Reporting role.", "operationId": "ActivitySession_GetSessionSummaryByHost", "parameters": [ { "name": "managedResourceId", "in": "path", "description": "The unique identifier of the resource.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "skip", "in": "query", "description": "Number of items to skip. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Number of items to return. Defaults to 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "Name of the session property to sort by.", "required": false, "schema": { "type": "string" }, "example": "startDateTimeUtc" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort newest or highest first. Defaults to true.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true }, { "name": "filterText", "in": "query", "description": "Return only sessions that contain this text.", "required": false, "schema": { "type": "string" }, "example": "maintenance" }, { "name": "startDate", "in": "query", "description": "Return only sessions that start after this UTC date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-01T00:00:00Z" }, { "name": "endDate", "in": "query", "description": "Return only sessions whose start is before this UTC date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-12-31T23:59:59Z" } ], "responses": { "200": { "description": "Returns the matching session summaries in data and the total number of matches in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfSessionSummary" } } } }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The signed-in account does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/{sessionId}": { "delete": { "tags": [ "Activity Session" ], "summary": "End an activity session", "description": "Ends an activity session as soon as possible. A session that is still waiting for approval is cancelled through the approval process, and any other session is marked for cancellation and ended in the background. The call returns once the end is queued, so poll the session to see it finish.\n\nPermission required: Administrators and application accounts can end any session. Other users can end only their own sessions. An auditor needs the Terminate Session permission for the session.", "operationId": "ActivitySession_Delete", "parameters": [ { "name": "sessionId", "in": "path", "description": "The unique identifier of the activity session to end.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" }, { "name": "serviceNowEndState", "in": "query", "description": "Optional ServiceNow end state to store on the session before it is ended.", "required": false, "schema": { "type": "string" }, "example": "Closed" } ], "responses": { "202": { "description": "The end was accepted and queued. No body is returned." }, "400": { "description": "The session could not be ended. The body is the error message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller does not own the session and is not an administrator, or the auditor does not hold the Terminate Session permission for it." }, "404": { "description": "No activity session exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Activity Session" ], "summary": "Get an activity session", "description": "Returns the full details of one activity session, including its status, times, resource, activity and connection profile settings. For users other than administrators, allowSessionExtension is false once no extensions remain.\n\nPermission required: Administrators and application accounts, or the user who owns the session.\n\nValues for `status`: -1 = ApprovalRequired, 0 = Pending, 1 = Active, 2 = Cancelling, 3 = Complete, 4 = Failed, 5 = Cancelled, 6 = ApprovalDenied, 7 = ApprovalFailed.", "operationId": "ActivitySession_GetById", "parameters": [ { "name": "sessionId", "in": "path", "description": "The unique identifier of the activity session.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" }, { "name": "commandRestrictionList", "in": "query", "description": "Set to true to include the command restriction settings in the response. Defaults to false.", "required": false, "schema": { "type": "boolean" }, "example": false } ], "responses": { "200": { "description": "The activity session.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivitySession" } } } }, "400": { "description": "The request failed. The body is the error message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator, an application account, or the session owner." }, "404": { "description": "No activity session exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/{sessionId}/Approve": { "post": { "tags": [ "Activity Session" ], "summary": "Approve a session that is waiting for approval", "description": "Records the signed-in user's approval for an activity session that requires approval. When this approval completes the workflow, the session moves to pending and is scheduled to start.\n\nPermission required: Only a user who is a pending approver for the session in its approval workflow.", "operationId": "ActivitySession_Approve", "parameters": [ { "name": "sessionId", "in": "path", "description": "The unique identifier of the activity session.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" }, { "name": "notes", "in": "query", "description": "Optional notes to record with the approval. Send them as a query parameter, not in the request body.", "required": false, "schema": { "type": "string" }, "example": "Approved for the maintenance window" } ], "responses": { "200": { "description": "The approval was recorded. The body is a short confirmation message.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "The caller has no pending approval for this session, or the request failed. The body is the error message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "404": { "description": "No activity session exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/{sessionId}/CanViewPassword": { "get": { "tags": [ "Activity Session" ], "summary": "Check whether you can view the password of a session", "description": "Returns true when the signed-in user can view the password for an active credential session, and false in every other case. The check does not return the password.\n\nPermission required: Any signed-in user. The answer is true only for the session owner.", "operationId": "ActivitySession_ViewPassword", "parameters": [ { "name": "sessionId", "in": "path", "description": "The unique identifier of the activity session.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "200": { "description": "true or false. The answer is true only when the caller owns the session, the session is active, and its connection profile allows password viewing.", "content": { "application/json": { "schema": { "type": "boolean" } } } }, "400": { "description": "The request failed. The body is the error message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/{sessionId}/Deny": { "post": { "tags": [ "Activity Session" ], "summary": "Deny a session that is waiting for approval", "description": "Records the signed-in user's denial for an activity session that requires approval, and cancels the approval process for it. The session does not start.\n\nPermission required: Only a user who is a pending approver for the session in its approval workflow.", "operationId": "ActivitySession_Deny", "parameters": [ { "name": "sessionId", "in": "path", "description": "The unique identifier of the activity session.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "requestBody": { "description": "Optional notes explaining the denial, sent as a single JSON string.\n\n- `(request body)` (string): Notes to record with the denial. Send as a JSON string, for example \"Not approved\".", "content": { "application/json": { "schema": { "type": "string" } } }, "required": true }, "responses": { "200": { "description": "The denial was recorded. The body is a short confirmation message.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "The caller has no pending approval for this session, the session does not exist, or the request failed. The body is the error message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/{sessionId}/Extend": { "post": { "tags": [ "Activity Session" ], "summary": "Extend an activity session by a number of minutes", "description": "Adds time to an activity session and returns the updated session. The session's connection profile must allow extensions, extensions must remain, and the requested time cannot exceed the length allowed for one extension. If the body is left out or the number is zero or negative, the full allowed extension is added.\n\nPermission required: Administrators and application accounts, or the user who owns the session.", "operationId": "ActivitySession_Extend", "parameters": [ { "name": "sessionId", "in": "path", "description": "The unique identifier of the activity session.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "requestBody": { "description": "The number of minutes to add, sent as a single JSON integer.\n\n- `(request body)` (integer): Minutes to add to the session. Zero, a negative number or no body adds the full allowed extension. Send as a bare number, for example 120.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32", "default": -1 }, "example": 120 } }, "required": true }, "responses": { "200": { "description": "The session was extended. The body is the updated activity session.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivitySession" } } } }, "400": { "description": "The session cannot be extended, for example because extensions are not allowed, none remain, or the time is too long. The body is the error message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "404": { "description": "No activity session exists with this identifier." }, "500": { "description": "The caller is not an administrator, an application account or the session owner. The server fails the request instead of returning 403." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/{sessionId}/Log": { "get": { "tags": [ "Activity Session" ], "summary": "Get the log of an activity session", "description": "Returns the log lines recorded for one activity session, limited to the time window of the session. Use it to see what the session did and whether any step failed.\n\nPermission required: Administrators, application accounts, Auditing and Reporting role, the session owner, or an auditor allowed to audit this session.\n\nValues for `logLevel (and status on each line)`: 0 = Debug, 1 = Info, 2 = Warn, 3 = Error.", "operationId": "ActivitySession_GetSessionLogs", "parameters": [ { "name": "sessionId", "in": "path", "description": "The unique identifier of the activity session.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" }, { "name": "logLevel", "in": "query", "description": "Lowest log level to return. Send the number. 0 returns every line.", "required": false, "schema": { "$ref": "#/components/schemas/ActionLogType" } }, { "name": "skip", "in": "query", "description": "Number of log lines to skip. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Number of log lines to return. Defaults to 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 500 }, { "name": "orderDescending", "in": "query", "description": "Set to true to return the newest lines first. Defaults to true.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true }, { "name": "filterText", "in": "query", "description": "Return only lines that contain this text.", "required": false, "schema": { "type": "string", "default": "" }, "example": "" }, { "name": "startDate", "in": "query", "description": "Return lines from this UTC date and time. It can only narrow the session's own time window.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-01T00:00:00Z" }, { "name": "endDate", "in": "query", "description": "Return lines up to this UTC date and time. It can only narrow the session's own time window.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-12-31T23:59:59Z" } ], "responses": { "200": { "description": "The log lines in lines, with totalCount for the full match count.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionLogCollection" } } } }, "400": { "description": "No session identifier was provided, the auditor is not allowed to view this session's logs, or the request failed. The body is the error message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not allowed to view this session's logs." }, "404": { "description": "No activity session exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ActivitySession/{sessionId}/Password": { "get": { "tags": [ "Activity Session" ], "summary": "Get the password for an active credential session", "description": "Returns the password of the credential that belongs to an active session so the owner can copy it. It is returned as plain text, or as a JSON string when the request accepts JSON.\n\nPermission required: Only the user who owns the session, and only when the session's connection profile allows password access.\n\nCaution: The response contains a password in clear text, and each request is recorded in the audit log.", "operationId": "ActivitySession_CopyPassword", "parameters": [ { "name": "sessionId", "in": "path", "description": "The unique identifier of the activity session.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "200": { "description": "The password.", "content": { "text/plain": { "schema": { "type": "string" } }, "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "The request failed. The body is the error message." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "404": { "description": "The caller does not own the session, the session is not active, the connection profile does not allow password access, the session has no credential, or no password is stored." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AdConfiguration/domain/configuration": { "get": { "tags": [ "AD Configuration" ], "summary": "List Active Directory domain configurations", "description": "Returns every configured Active Directory domain, including the service account each domain uses and whether it connects over SSL. Use it to list the domains the product can work with.\n\nPermission required: Administrator or application role.", "operationId": "AdConfiguration_GetAllDomainConfigurations", "responses": { "200": { "description": "The list of domain configurations.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectoryDomainConfiguration" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AdConfiguration/domain/configuration/Names": { "get": { "tags": [ "AD Configuration" ], "summary": "List domain names and IDs", "description": "Returns the name and ID of each configured Active Directory domain, sorted by name. Use it to fill a domain picker without loading full configurations.\n\nPermission required: Administrator or application role.", "operationId": "AdConfiguration_ListNames", "responses": { "200": { "description": "A list of domain names and IDs.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AdConfiguration/domain/configuration/{id}": { "delete": { "tags": [ "AD Configuration" ], "summary": "Delete an Active Directory domain configuration", "description": "Removes the domain configuration and the resource that represents the domain, marks the stored credentials of the domain's accounts and resources as deleted, and removes the domain's managed resources and its scheduled domain sync job. The call is refused if resource groups still depend on the domain, or if you are signed in as an administrator with an account from that same domain.\n\nPermission required: Administrator or application role.", "operationId": "AdConfiguration_DeleteDomainInformation", "parameters": [ { "name": "id", "in": "path", "description": "ID of the domain configuration to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The domain configuration was deleted. The body is the JSON string \"Ok\".", "content": { "application/json": { "schema": { "type": "string" }, "example": "Ok" } } }, "400": { "description": "The domain cannot be deleted, for example because resource groups depend on it, your own account belongs to it, or no domain configuration has that ID." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "AD Configuration" ], "summary": "Get a domain configuration by ID or name", "description": "Returns the configuration of the Active Directory domain with the given ID or domain name. The path value is either the ID of the domain configuration or the name of the domain.\n\nPermission required: Administrator or application role.", "operationId": "AdConfiguration_GetDomainInformation", "parameters": [ { "name": "id", "in": "path", "description": "ID of the domain configuration, or the name of the domain.", "required": true, "schema": { "type": "string" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The domain configuration.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActiveDirectoryDomainConfiguration" } } } }, "404": { "description": "No domain configuration has that ID or domain name." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ApprovalWorkflow": { "get": { "tags": [ "Approval Workflow" ], "summary": "List approval workflows", "description": "Returns all approval workflows, each with its tiers and approvers. Use it to see which approval processes are defined.\n\nPermission required: Administrator or application role.\n\nValues for `progressionType (on each tier)`: 0 = Sequential, 1 = Concurrent.", "operationId": "ApprovalWorkflow_GetAllWorkflows", "responses": { "200": { "description": "The list of approval workflows.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ApprovalWorkflow" } } } } }, "400": { "description": "The request failed." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Approval Workflow" ], "summary": "Create an approval workflow", "description": "Creates an approval workflow with its tiers, approvers and approver groups. Use it to define who must approve access requests and in what order.\n\nPermission required: Administrator or application role.\n\nValues for `progressionType (on each tier)`: 0 = Sequential, 1 = Concurrent.\n\nCaution: The workflow is saved before the response is built, so an error response does not always mean that nothing was created. Check the workflow list before you retry. The console and other clients save workflows with PUT; prefer PUT for a reliable result.", "operationId": "ApprovalWorkflow_CreateWorkflow", "requestBody": { "description": "The workflow to create, with its tiers.\n\n- `id` (string (GUID)): ID of the workflow. Leave empty or omit when creating; the server assigns it.\n- `nodeId` (string (GUID)): Server node the record belongs to. Set by the server.\n- `approvalWorkflowTiers` (array of tier objects): The tiers of the workflow in order. Each tier has tierNumber, progressionType (0 Sequential, 1 Concurrent), requiredApprovalCount, escalationTimeout, an optional escalation approver account or group, and its approvers and approver groups. Defaults to an empty list.\n- `modifiedBy` (string (GUID)): User who last changed the workflow. Set by the server.\n- `modifiedDateTimeUtc` (string (date-time)): Time of the last change. Set by the server.\n- `createdDateTimeUtc` (string (date-time)): Time the workflow was created. Set by the server.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalWorkflow" } } }, "required": true }, "responses": { "201": { "description": "The workflow was created and is returned.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalWorkflow" } } } }, "400": { "description": "The workflow could not be created; the body holds the reason." }, "500": { "description": "The workflow was saved but the server could not build the response. Check the workflow list before you retry." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Approval Workflow" ], "summary": "Update an approval workflow", "description": "Saves an approval workflow with its tiers and approvers. The tiers you send replace the stored ones: tiers left out of the request are deleted, and each tier's approvers and approver groups are replaced by the ones you send. If no workflow with the given ID exists, a new one is created.\n\nPermission required: Administrator or application role.\n\nValues for `progressionType (on each tier)`: 0 = Sequential, 1 = Concurrent.\n\nCaution: The change takes effect immediately, and any tier you leave out of the request is deleted.", "operationId": "ApprovalWorkflow_UpdateWorkflow", "requestBody": { "description": "The full workflow as it should be saved.\n\n- `id` (string (GUID)): ID of the workflow to update. If no workflow has this ID, a new workflow is created.\n- `nodeId` (string (GUID)): Server node the record belongs to. Set by the server.\n- `approvalWorkflowTiers` (array of tier objects): The tiers of the workflow in order. Each tier has tierNumber, progressionType (0 Sequential, 1 Concurrent), requiredApprovalCount, escalationTimeout, an optional escalation approver account or group, and its approvers and approver groups. When the workflow already exists, tiers are renumbered 1, 2, 3 in the order of their tierNumber values. Send every tier you want to keep, with its id; a tier without an id is added as a new tier.\n- `modifiedBy` (string (GUID)): User who last changed the workflow. Set by the server.\n- `modifiedDateTimeUtc` (string (date-time)): Time of the last change. Set by the server.\n- `createdDateTimeUtc` (string (date-time)): Time the workflow was created. Set by the server.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalWorkflow" } } }, "required": true }, "responses": { "200": { "description": "The saved workflow is returned.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalWorkflow" } } } }, "400": { "description": "The workflow could not be saved; the body holds the reason." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ApprovalWorkflow/Approval": { "get": { "tags": [ "Approval Workflow" ], "summary": "List approvals for an activity session", "description": "Returns the approval records for the given activity session across all tiers, showing who must approve and the state of each approval.\n\nPermission required: Administrator or application role.\n\nValues for `approvalState`: 0 = Pending, 1 = Approved, 2 = Denied.\n\nValues for `approverType`: 0 = Normal, 1 = Escalated, 2 = Requester.", "operationId": "ApprovalWorkflow_GetAllWorkflowApprovalsForSession", "parameters": [ { "name": "activitySessionId", "in": "query", "description": "ID of the activity session.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "200": { "description": "The list of approvals, which is empty when there are none.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ApprovalWorkflowApproval" } } } } }, "400": { "description": "The request failed." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Approval Workflow" ], "summary": "Approve or deny an access request", "description": "Records an approver's decision and notes on every approval that approver holds for an activity session. The approval process then advances: a completed tier moves the workflow on, and if the combined result of the workflow becomes Denied, the approval process for the session is cancelled.\n\nPermission required: Administrator or application role.\n\nValues for `approvalState`: 0 = Pending, 1 = Approved, 2 = Denied.\n\nCaution: The decision takes effect immediately; if it makes the combined result Denied, the approval process for the session is cancelled.", "operationId": "ApprovalWorkflow_UpdateWorkflowApprovals", "requestBody": { "description": "The approver's decision for the session.\n\n- `approverAccountId` (string (GUID), required): ID of the approver account.\n- `activitySessionId` (string (GUID), required): ID of the activity session being decided.\n- `approvalState` (integer, required): The decision: 1 to approve, 2 to deny. 0 is Pending.\n- `approverNotes` (string): Notes from the approver.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalWorkflowApprovalUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The decision was recorded. The call also returns 200 and changes nothing when the approver has no approvals for that session." }, "400": { "description": "The decision could not be recorded; the body holds the reason." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ApprovalWorkflow/Approval/{id}": { "delete": { "tags": [ "Approval Workflow" ], "summary": "Delete an approval", "description": "Deletes a single approval record from an approval workflow. The record is removed immediately; the call also returns 202 when no approval has that ID.\n\nPermission required: Administrator or application role.", "operationId": "ApprovalWorkflow_DeleteApproval", "parameters": [ { "name": "id", "in": "path", "description": "ID of the approval to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "202": { "description": "The approval was deleted, or no approval had that ID." }, "400": { "description": "The approval could not be deleted; the body holds the reason." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Approval Workflow" ], "summary": "Get an approval by ID", "description": "Returns one approval record, including its state and any notes from the approver.\n\nPermission required: Administrator or application role.\n\nValues for `approvalState`: 0 = Pending, 1 = Approved, 2 = Denied.\n\nValues for `approverType`: 0 = Normal, 1 = Escalated, 2 = Requester.", "operationId": "ApprovalWorkflow_GetWorkflowApprovalById", "parameters": [ { "name": "id", "in": "path", "description": "ID of the approval.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The approval.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalWorkflowApproval" } } } }, "400": { "description": "The request failed." }, "404": { "description": "No approval has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ApprovalWorkflow/SearchApprovalCandidates": { "get": { "tags": [ "Approval Workflow" ], "summary": "Search accounts and groups that can approve in a tier", "description": "Searches the accounts and groups that can be added as approvers to an approval tier, with paging, sorting and text filtering. Accounts and groups already assigned to the tier are left out, and applications and collections are never returned. Use it to populate an approver picker.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 4 = Local.", "operationId": "ApprovalWorkflow_SearchApprovalCandidates", "parameters": [ { "name": "id", "in": "query", "description": "ID of the approval tier to find candidates for. Required in practice; an empty value returns 400.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "entityType", "in": "query", "description": "Limits results to one type of approver. Send the name or the number: ManagedAccount (0), ManagedAccountGroup (1) or Local (4).", "required": false, "schema": { "$ref": "#/components/schemas/ManagedAccountKind" } }, { "name": "Skip", "in": "query", "description": "Number of items to skip. Default 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "Number of items to return. Default 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "Name of the property to sort by. By default results are sorted by display name.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. Default false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only entries whose name, display name, domain, email, SAM account name or user principal name contains this text (case-insensitive).", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Accepted but has no effect on this route; the text filter always searches the fields listed for FilterText.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "A page of candidate approvers. The body has data (the page of rows) and recordsTotal (the number of matching rows before paging is applied).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedAccountView" } } } }, "400": { "description": "No tier ID was provided, or the search failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ApprovalWorkflow/Tier": { "get": { "tags": [ "Approval Workflow" ], "summary": "Get the approval tier for an approval", "description": "Returns the approval tier that an approval record belongs to. Use it when you have an approval ID and need the tier it is part of.\n\nPermission required: Administrator or application role.\n\nValues for `progressionType`: 0 = Sequential, 1 = Concurrent.", "operationId": "ApprovalWorkflow_GetWorkflowTierByApprovalId", "parameters": [ { "name": "workflowApprovalId", "in": "query", "description": "ID of the approval.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The approval tier.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalWorkflowTier" } } } }, "204": { "description": "No tier was found for that approval." }, "400": { "description": "The request failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ApprovalWorkflow/Tier/{id}": { "get": { "tags": [ "Approval Workflow" ], "summary": "Get an approval tier by ID", "description": "Returns an approval tier, including its approvers, approver groups and escalation settings. Send the tier ID in the id query parameter; the value in the path is not used.\n\nPermission required: Administrator or application role.\n\nValues for `progressionType`: 0 = Sequential, 1 = Concurrent.\n\nCaution: The tier can include approver account details, which may be sensitive.", "operationId": "ApprovalWorkflow_GetWorkflowTierById", "parameters": [ { "name": "id", "in": "path", "description": "Any value. The route needs a path segment here, but the value is not used.", "required": true, "schema": { "type": "string" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "id", "in": "query", "description": "ID of the approval tier. This is the value the server uses.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The approval tier.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalWorkflowTier" } } } }, "204": { "description": "No tier was found for that ID." }, "400": { "description": "The request failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ApprovalWorkflow/Tier/{id}/Approval": { "get": { "tags": [ "Approval Workflow" ], "summary": "List a tier's approvals for an activity session", "description": "Returns the approval records for one approval tier in the given activity session.\n\nPermission required: Administrator or application role.\n\nValues for `approvalState`: 0 = Pending, 1 = Approved, 2 = Denied.\n\nValues for `approverType`: 0 = Normal, 1 = Escalated, 2 = Requester.", "operationId": "ApprovalWorkflow_GetAllWorkflowApprovalsForTier", "parameters": [ { "name": "id", "in": "path", "description": "ID of the approval tier.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "activitySessionId", "in": "query", "description": "ID of the activity session.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "200": { "description": "The list of approvals, which is empty when there are none.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ApprovalWorkflowApproval" } } } } }, "400": { "description": "The request failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ApprovalWorkflow/Workflow": { "get": { "tags": [ "Approval Workflow" ], "summary": "Get the approval workflow for a tier", "description": "Returns the approval workflow that contains the given tier.\n\nPermission required: Administrator or application role.", "operationId": "ApprovalWorkflow_GetWorkflowByTierId", "parameters": [ { "name": "workflowTierId", "in": "query", "description": "ID of the approval tier.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The approval workflow.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalWorkflow" } } } }, "204": { "description": "No workflow was found for that tier." }, "400": { "description": "The request failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ApprovalWorkflow/{id}": { "delete": { "tags": [ "Approval Workflow" ], "summary": "Delete an approval workflow", "description": "Deletes an approval workflow. The workflow is removed immediately; the call also returns 202 when no workflow has that ID.\n\nPermission required: Administrator or application role.", "operationId": "ApprovalWorkflow_DeleteWorkflow", "parameters": [ { "name": "id", "in": "path", "description": "ID of the approval workflow to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "responses": { "202": { "description": "The workflow was deleted, or no workflow had that ID." }, "400": { "description": "The workflow could not be deleted; the body holds the reason." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Approval Workflow" ], "summary": "Get an approval workflow by ID", "description": "Returns one approval workflow with its tiers, approvers and approver groups.\n\nPermission required: Administrator or application role.\n\nValues for `progressionType (on each tier)`: 0 = Sequential, 1 = Concurrent.", "operationId": "ApprovalWorkflow_GetWorkflowById", "parameters": [ { "name": "id", "in": "path", "description": "ID of the approval workflow.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "responses": { "200": { "description": "The approval workflow.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalWorkflow" } } } }, "400": { "description": "The request failed." }, "404": { "description": "No workflow has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ApprovalWorkflow/{id}/State": { "get": { "tags": [ "Approval Workflow" ], "summary": "Get the approval state of a session", "description": "Returns the overall approval result for an activity session under the given workflow: Pending, Approved or Denied.\n\nPermission required: Administrator or application role.\n\nValues for the response: 0 = Pending, 1 = Approved, 2 = Denied.", "operationId": "ApprovalWorkflow_GetWorkflowState", "parameters": [ { "name": "id", "in": "path", "description": "ID of the approval workflow.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "sessionId", "in": "query", "description": "ID of the activity session.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "200": { "description": "The approval state.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApprovalWorkflowApprovalState" } } } }, "400": { "description": "The request failed." }, "404": { "description": "No workflow has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AuditChangeRow/ListModels": { "get": { "tags": [ "Audit Change" ], "summary": "List the record types that appear in the change audit", "description": "Returns the record types (each with a name and a display title) that appear in the change audit log. Use it to fill a filter list before you call the change audit search. The result is wrapped in an object that holds the list in a data array and the number of entries in recordsTotal.\n\nPermission required: Administrator or Auditing and Reporting role.", "operationId": "AuditChangeRow_ListModels", "responses": { "200": { "description": "The list of record types, wrapped in an object with data and recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfAuditChangeRow" } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AzureAdTenant/Create": { "post": { "tags": [ "Azure AD" ], "summary": "Create an Entra ID tenant", "description": "Creates an Entra ID tenant configuration and returns it with its new ID. Creating the tenant also adds a virtual host, a resource and a website that represent it, so you can manage the tenant like other resources. If any of these cannot be created, everything created so far is removed and the call returns 400.\n\nPermission required: Administrator or application role.\n\nCaution: The tenant is created immediately.", "operationId": "AzureAdTenant_Create", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AzureAdCreateRequest" }, "example": { "serviceAccountId": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "name": "", "emailDomain": "", "logonUrl": "https://portal.azure.com", "platformId": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "tenantId": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } } }, "required": true, "description": "The tenant to create.\n\n- `id` (string (GUID)): ID of the tenant configuration. Leave out on create.\n- `name` (string, required): Name of the tenant in the console.\n- `description` (string): Description of the tenant. Not saved on create. Set it with an update.\n- `tenantId` (string, required): The Microsoft Entra directory (tenant) ID.\n- `emailDomain` (string, required): The tenant's email domain, for example the onmicrosoft.com domain. Required: the create fails without it.\n- `logonUrl` (string, required): The sign-in URL for the tenant portal.\n- `platformId` (string (GUID)): ID of the platform the tenant belongs to. Not used on create: a new tenant always uses the Entra ID platform. You can change it later with an update.\n- `serviceAccountId` (string (GUID)): ID of the service account the product uses to manage the tenant. Can be left out; set it so the product has an account to manage the tenant with.\n- `processGroupMembership` (boolean): Whether group membership is processed for the tenant. Not saved on create. Set it with an update.\n- `associatedDomainId` (string (GUID)): ID of an associated Active Directory domain.\n- `managedResourceId` (string (GUID)): ID of the resource that represents the tenant. The product sets it.\n- `virtualHostId` (string (GUID)): ID of the virtual host for the tenant. The product sets it.\n- `virtualWebsiteId` (string (GUID)): ID of the virtual website for the tenant. The product sets it." }, "responses": { "200": { "description": "The tenant was created. The body is the new tenant configuration.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AzureAd" } } } }, "400": { "description": "The tenant could not be created. The body is an error message as a JSON string." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AzureAdTenant/Delete/{tenantId}": { "delete": { "tags": [ "Azure AD" ], "summary": "Delete an Entra ID tenant", "description": "Deletes the Entra ID tenant configuration with the given ID, along with the resource and website that represent it, and returns the ID of the deleted tenant. Use it to stop managing a tenant.\n\nPermission required: Administrator or application role.\n\nCaution: The tenant is deleted immediately.", "operationId": "AzureAdTenant_Delete", "parameters": [ { "name": "tenantId", "in": "path", "description": "ID of the Entra ID tenant configuration.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "200": { "description": "The tenant was deleted. The body is the tenant ID.", "content": { "application/json": { "schema": { "type": "string", "format": "uuid" } } } }, "400": { "description": "The tenant could not be deleted. The body is an error message as a JSON string." }, "404": { "description": "The tenant was not found, or it has no resource record." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AzureAdTenant/Retrieve/{tenantId}": { "get": { "tags": [ "Azure AD" ], "summary": "Get an Entra ID tenant", "description": "Returns the settings of one Entra ID tenant configuration, identified by its ID.\n\nPermission required: Administrator or application role.", "operationId": "AzureAdTenant_Retrieve", "parameters": [ { "name": "tenantId", "in": "path", "description": "ID of the Entra ID tenant configuration.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "200": { "description": "The tenant configuration.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AzureAd" } } } }, "404": { "description": "The tenant was not found, or it has no resource record." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AzureAdTenant/RetrieveAll": { "get": { "tags": [ "Azure AD" ], "summary": "List Entra ID tenants", "description": "Returns all configured Entra ID tenants. The list is empty when none are configured.\n\nPermission required: Administrator or application role.", "operationId": "AzureAdTenant_RetrieveAll", "responses": { "200": { "description": "An array of tenant configurations.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AzureAd" } } } } }, "400": { "description": "The tenant list could not be retrieved. The body is the message \"Unable to retrieve Entra ID Tenant list.\"" } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AzureAdTenant/RetrieveFromVirtualHost/{virtualHostId}": { "get": { "tags": [ "Azure AD" ], "summary": "Get the Entra ID tenant for a virtual host", "description": "Returns the Entra ID tenant configuration that is linked to the given virtual host. Use it when you have the virtual host ID and need the tenant it belongs to.\n\nPermission required: Administrator or application role.", "operationId": "AzureAdTenant_RetrieveFromVirtualHost", "parameters": [ { "name": "virtualHostId", "in": "path", "description": "ID of the virtual host linked to the tenant.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The tenant configuration.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AzureAd" } } } }, "404": { "description": "No tenant is linked to that virtual host." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/AzureAdTenant/Update/{tenantId}": { "put": { "tags": [ "Azure AD" ], "summary": "Update an Entra ID tenant", "description": "Replaces the settings of an existing Entra ID tenant configuration and returns the updated tenant. The id in the request body must match the tenantId in the URL. Changing the name also renames the tenant's virtual host and website.\n\nPermission required: Administrator or application role.\n\nCaution: The change takes effect immediately.", "operationId": "AzureAdTenant_Update", "parameters": [ { "name": "tenantId", "in": "path", "description": "ID of the Entra ID tenant configuration.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AzureAdUpdateRequest" } } }, "required": true, "description": "The full tenant configuration to save.\n\n- `id` (string (GUID), required): ID of the tenant configuration. Must match the tenantId in the URL; otherwise the call returns 400.\n- `name` (string, required): Name of the tenant in the console.\n- `description` (string): Description of the tenant.\n- `tenantId` (string, required): The Microsoft Entra directory (tenant) ID.\n- `emailDomain` (string, required): The tenant's email domain, for example the onmicrosoft.com domain.\n- `logonUrl` (string, required): The sign-in URL for the tenant portal.\n- `platformId` (string (GUID), required): ID of the platform the tenant belongs to. Changing it moves the tenant's resource to that platform.\n- `serviceAccountId` (string (GUID)): ID of the service account the product uses to manage the tenant. Leaving it out clears the service account for the tenant.\n- `processGroupMembership` (boolean): Whether group membership is processed for the tenant.\n- `associatedDomainId` (string (GUID)): ID of an associated Active Directory domain.\n- `managedResourceId` (string (GUID)): ID of the resource that represents the tenant. The product sets it. Ignored on update.\n- `virtualHostId` (string (GUID)): ID of the virtual host for the tenant. The product sets it. Ignored on update.\n- `virtualWebsiteId` (string (GUID)): ID of the virtual website for the tenant. The product sets it. Ignored on update." }, "responses": { "200": { "description": "The tenant was updated. The body is the updated tenant configuration.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AzureAd" } } } }, "400": { "description": "The tenant could not be updated, for example because the IDs do not match." }, "404": { "description": "The tenant was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/CommandRestriction": { "post": { "tags": [ "Command Restriction" ], "summary": "Create a command restriction", "description": "Creates a command restriction and returns it. Use it to define keywords for commands that sessions log, block, lock or terminate, and who is notified.\n\nPermission required: Administrator who has completed multi-factor authentication.\n\nValues for `commandRestrictionSettings[].commandRestrictionMatchType`: 0 = Keyword.\n\nValues for `commandRestrictionSettings[].commandRestrictionActionType`: 0 = LogOnly, 1 = Block, 2 = BlockAndLock, 3 = Terminate.\n\nCaution: The command restriction is created immediately.", "operationId": "CommandRestriction_CreateCommandRestriction", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CommandRestriction" }, "example": { "name": "", "emailRecipient": "user@example.com", "commandRestrictionSettings": [ { "commandRestrictionSettingNumber": 0, "active": true, "email": true, "lockMessage": "", "commandRestrictionMatchType": 0, "commandRestrictionActionType": 1, "match": "" } ] } } }, "description": "The command restriction to create.\n\n- `id` (string (GUID)): ID of the command restriction. Leave out on create.\n- `name` (string, required): Name of the command restriction, up to 256 characters.\n- `emailRecipient` (string (email)): Email address to notify. Leave the field out if you have no address. An empty string is rejected with a 400.\n- `commandRestrictionSettings` (array): The settings that define which commands are matched and what happens. Each item has commandRestrictionSettingNumber, active, email, emailRecipient, lockMessage, match, commandRestrictionMatchType and commandRestrictionActionType. See the enum values." }, "responses": { "200": { "description": "The command restriction was created. The body is the new command restriction.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CommandRestriction" }, "example": { "id": "00000000-0000-0000-0000-000000000000", "name": "", "emailRecipient": "user@example.com" } } } }, "400": { "description": "The command restriction could not be created, for example because the request is not valid." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Command Restriction" ], "summary": "Update a command restriction", "description": "Updates an existing command restriction, identified by the id in the request body, and returns the saved result. The settings in the request replace the existing settings.\n\nPermission required: Administrator who has completed multi-factor authentication.\n\nValues for `commandRestrictionSettings[].commandRestrictionMatchType`: 0 = Keyword.\n\nValues for `commandRestrictionSettings[].commandRestrictionActionType`: 0 = LogOnly, 1 = Block, 2 = BlockAndLock, 3 = Terminate.\n\nCaution: The change takes effect immediately.", "operationId": "CommandRestriction_UpdateCommandRestriction", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CommandRestrictionUpdateRequest" }, "example": { "id": "00000000-0000-0000-0000-000000000000", "name": "", "emailRecipient": "user@example.com", "commandRestrictionSettings": [ { "commandRestrictionSettingNumber": 0, "active": true, "email": false, "lockMessage": "", "commandRestrictionMatchType": 0, "commandRestrictionActionType": 1, "match": "" } ] } } }, "description": "The command restriction to save, including its id.\n\n- `id` (string (GUID), required): ID of the command restriction. Required on update; the call returns 404 if no command restriction has this ID.\n- `name` (string, required): Name of the command restriction, up to 256 characters.\n- `emailRecipient` (string (email)): Email address to notify. Leave the field out if you have no address. An empty string is rejected with a 400.\n- `commandRestrictionSettings` (array): The settings that define which commands are matched and what happens. Send the full list. Settings with an existing id are updated, settings without one are added, and existing settings left out of the list are removed; leaving the field out removes all settings. Each item has commandRestrictionSettingNumber, active, email, emailRecipient, lockMessage, match, commandRestrictionMatchType and commandRestrictionActionType." }, "responses": { "200": { "description": "The command restriction was updated. The body is the saved command restriction.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CommandRestriction" }, "example": { "id": "00000000-0000-0000-0000-000000000000", "name": "", "emailRecipient": "user@example.com" } } } }, "400": { "description": "The command restriction could not be updated." }, "404": { "description": "The command restriction was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/CommandRestriction/NameAndIds": { "get": { "tags": [ "Command Restriction" ], "summary": "List command restriction names and IDs", "description": "Returns the name and ID of every command restriction, sorted by name. Use it to fill a pick list or to find the ID you need for other calls.\n\nPermission required: Administrator who has completed multi-factor authentication.", "operationId": "CommandRestriction_GetNameAndIds", "responses": { "200": { "description": "An array of objects with the id and name of each command restriction.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } }, "example": [ { "id": "00000000-0000-0000-0000-000000000000", "name": "" } ] } } }, "400": { "description": "The list could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/CommandRestriction/{commandRestrictionId}": { "delete": { "tags": [ "Command Restriction" ], "summary": "Delete a command restriction", "description": "Deletes the command restriction with the given ID, together with its settings. Use it when you no longer need the set of blocked or logged commands.\n\nPermission required: Administrator who has completed multi-factor authentication.\n\nCaution: The command restriction and its settings are deleted immediately. Connection profiles that use it no longer reference any command restriction.", "operationId": "CommandRestriction_DeleteCommandRestriction", "parameters": [ { "name": "commandRestrictionId", "in": "path", "description": "ID of the command restriction.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "202": { "description": "The command restriction was deleted. The response has no body." }, "400": { "description": "The command restriction could not be deleted." }, "404": { "description": "The command restriction was not found." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Command Restriction" ], "summary": "Get a command restriction", "description": "Returns one command restriction, including its list of settings that define which commands are matched and what happens when one is used.\n\nPermission required: Administrator who has completed multi-factor authentication.\n\nValues for `commandRestrictionSettings[].commandRestrictionMatchType`: 0 = Keyword.\n\nValues for `commandRestrictionSettings[].commandRestrictionActionType`: 0 = LogOnly, 1 = Block, 2 = BlockAndLock, 3 = Terminate.", "operationId": "CommandRestriction_GetCommandRestriction", "parameters": [ { "name": "commandRestrictionId", "in": "path", "description": "ID of the command restriction.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "The command restriction and its settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CommandRestriction" }, "example": { "id": "00000000-0000-0000-0000-000000000000", "name": "", "emailRecipient": "user@example.com", "commandRestrictionSettings": [ { "id": "00000000-0000-0000-0000-000000000000", "commandRestrictionId": "00000000-0000-0000-0000-000000000000", "commandRestrictionSettingNumber": 0, "active": true, "email": false, "lockMessage": "", "commandRestrictionMatchType": 0, "commandRestrictionActionType": 1, "match": "" } ] } } } }, "400": { "description": "The command restriction could not be retrieved." }, "404": { "description": "The command restriction was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ConnectionProfile": { "get": { "tags": [ "Connection Profile" ], "summary": "List connection profiles", "description": "Returns all connection profiles. Use it to choose a profile when you create or edit an access policy. The list also includes a default connection profile that was deleted, because the default profile is only marked as deleted; check its isDeleted field. Reading a profile that has no approval workflow creates an empty one, and reading a profile that has no approval email template assigns the default template; either way the profile is saved.\n\nPermission required: Administrator, or a user with the User Plus role and the Access Policies permission.\n\nValues for `type`: 0 = Generic, 1 = ConnectionProfile, 2 = EmailSettings, 3 = System.\n\nValues for `approvalTypeRequired`: 0 = Deny, 1 = Allow, 2 = Workflow, 3 = External.\n\nValues for `activityConfigurationSettings[].type`: 0 = String, 1 = Integer, 2 = UnsignedInteger, 3 = Boolean, 4 = Guid.", "operationId": "ConnectionProfile_GetAll", "responses": { "200": { "description": "An array of connection profiles.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityConfiguration" } } } } }, "400": { "description": "The list could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Connection Profile" ], "summary": "Create a connection profile", "description": "Creates a connection profile and returns it. The name must not match another connection profile.\n\nPermission required: Administrator.\n\nValues for `type`: 0 = Generic, 1 = ConnectionProfile, 2 = EmailSettings, 3 = System.\n\nValues for `approvalTypeRequired`: 0 = Deny, 1 = Allow, 2 = Workflow, 3 = External.\n\nValues for `activityConfigurationSettings[].type`: 0 = String, 1 = Integer, 2 = UnsignedInteger, 3 = Boolean, 4 = Guid.\n\nValues for `customFields[].customFieldDataType`: 0 = Integer, 1 = String, 2 = Options.\n\nCaution: The profile is created immediately.", "operationId": "ConnectionProfile_Create", "requestBody": { "description": "The connection profile to create. Only the main fields are listed; a profile returned by the get route shows every setting you can send.\n\n- `id` (string (GUID)): ID of the connection profile. Leave out on create.\n- `name` (string, required): Name of the profile. It must not match another connection profile's name (case-insensitive).\n- `description` (string): Description of the profile.\n- `type` (integer): Kind of configuration. Defaults to 0 (Generic) when left out. Send 1 (ConnectionProfile) so that the profile appears in the connection profile list.\n- `approvalTypeRequired` (integer): How activity is approved: deny, allow, workflow or external.\n- `maxSessionLength` (integer): Maximum session length.\n- `allowSessionExtension` (boolean): Whether users can extend a session.\n- `record` (boolean): Whether sessions are recorded.\n- `notesRequired` (boolean): Whether users must enter notes to start a session.\n- `ticketRequired` (boolean): Whether users must enter a ticket to start a session.\n- `commandRestrictionId` (string (GUID)): ID of a command restriction to apply.\n- `customFields` (array): Custom fields for the profile. Each item has name, label, description, customFieldNumber, customFieldDataType, options and required. See the enum values.\n- `activityConfigurationSettings` (array): Additional settings, each with a key, name, value and type.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityConfigurationCreateRequest" }, "example": { "name": "", "description": "", "type": 1, "activityConfigurationSettings": [], "customFields": [], "maxSessionLength": 120, "expirationTimeoutThreshold": 5, "allowSessionExtension": false, "sessionExtensionMinutes": 30, "sessionExtensionCount": 2, "record": true, "recordAudio": true, "proxyAutoConnect": true, "monitorEntireSession": true, "sessionMonitorInterval": 5, "leaveInGroup": true, "notesRequired": true, "ticketRequired": true, "allowPasswordAccess": true, "allowAutofillPassword": true, "allowViewPassword": false, "viewPasswordInSeconds": 20, "approvalTypeRequired": 1, "clearWebsiteDataBeforeStart": true, "clearWebsiteDataAfterStop": true, "sshScanDc": false, "deleteAccount": false } } }, "required": true }, "responses": { "200": { "description": "The profile was created. The body is the new connection profile.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityConfiguration" } } } }, "400": { "description": "The profile could not be created, for example because the name is already used." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ConnectionProfile/Names": { "get": { "tags": [ "Connection Profile" ], "summary": "List connection profile names and IDs", "description": "Returns the name and ID of every connection profile that has not been deleted, sorted by name.\n\nPermission required: Administrator.", "operationId": "ConnectionProfile_ListNames", "responses": { "200": { "description": "An array of objects with the id and name of each connection profile.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ConnectionProfile/{id}": { "delete": { "tags": [ "Connection Profile" ], "summary": "Delete a connection profile", "description": "Deletes a connection profile and returns the deleted profile. The default connection profile is marked as deleted rather than removed, and a profile that access policies use cannot be deleted.\n\nPermission required: Administrator.\n\nCaution: The profile is deleted immediately.", "operationId": "ConnectionProfile_DeleteConnectionProfile", "parameters": [ { "name": "id", "in": "path", "description": "ID of the connection profile.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The connection profile was deleted. The body is the deleted profile.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityConfiguration" } } } }, "400": { "description": "The profile cannot be deleted, for example because access policies use it." }, "404": { "description": "The connection profile was not found." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Connection Profile" ], "summary": "Get a connection profile", "description": "Returns the full settings of one connection profile, including its custom fields. Reading a profile that has no approval workflow creates an empty one, and reading a profile that has no approval email template assigns the default template; either way the profile is saved.\n\nPermission required: Administrator.\n\nValues for `type`: 0 = Generic, 1 = ConnectionProfile, 2 = EmailSettings, 3 = System.\n\nValues for `approvalTypeRequired`: 0 = Deny, 1 = Allow, 2 = Workflow, 3 = External.\n\nValues for `activityConfigurationSettings[].type`: 0 = String, 1 = Integer, 2 = UnsignedInteger, 3 = Boolean, 4 = Guid.\n\nValues for `customFields[].customFieldDataType`: 0 = Integer, 1 = String, 2 = Options.", "operationId": "ConnectionProfile_Get", "parameters": [ { "name": "id", "in": "path", "description": "ID of the connection profile.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The connection profile.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityConfiguration" } } } }, "400": { "description": "The profile could not be retrieved." }, "404": { "description": "The connection profile was not found." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Connection Profile" ], "summary": "Update a connection profile", "description": "Replaces the settings of a connection profile and returns the saved profile. Get the profile first, change the fields you need and send the whole object back. The name must not match another profile.\n\nPermission required: Administrator.\n\nValues for `type`: 0 = Generic, 1 = ConnectionProfile, 2 = EmailSettings, 3 = System.\n\nValues for `approvalTypeRequired`: 0 = Deny, 1 = Allow, 2 = Workflow, 3 = External.\n\nValues for `activityConfigurationSettings[].type`: 0 = String, 1 = Integer, 2 = UnsignedInteger, 3 = Boolean, 4 = Guid.\n\nValues for `customFields[].customFieldDataType`: 0 = Integer, 1 = String, 2 = Options.\n\nCaution: The change takes effect immediately and applies to access policies that use the profile.", "operationId": "ConnectionProfile_Update", "parameters": [ { "name": "id", "in": "path", "description": "ID of the connection profile.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "requestBody": { "description": "The full connection profile to save. Only the main fields are listed; a profile returned by the get route shows every setting you can send.\n\n- `id` (string (GUID), required): ID of the connection profile. Use the same ID as in the URL; the route does not check that the two match. The profile and its custom fields are saved under this id, but custom fields missing from the list are removed from the profile the URL names.\n- `name` (string, required): Name of the profile. It must not match another connection profile's name (case-insensitive).\n- `description` (string): Description of the profile.\n- `type` (integer, required): Kind of configuration. Send 1 (ConnectionProfile). Other values create a configuration that does not appear in the connection profile list.\n- `approvalTypeRequired` (integer): How activity is approved: deny, allow, workflow or external.\n- `maxSessionLength` (integer): Maximum session length.\n- `allowSessionExtension` (boolean): Whether users can extend a session.\n- `record` (boolean): Whether sessions are recorded.\n- `notesRequired` (boolean): Whether users must enter notes to start a session.\n- `ticketRequired` (boolean): Whether users must enter a ticket to start a session.\n- `commandRestrictionId` (string (GUID)): ID of a command restriction to apply.\n- `customFields` (array): Custom fields for the profile. Send the full list. Custom fields left out of the list (matched by name) are removed; leaving the field out removes all custom fields. Each item has name, label, description, customFieldNumber, customFieldDataType, options and required. See the enum values.\n- `activityConfigurationSettings` (array): Additional settings, each with a key, name, value and type.\n\nGET the profile, change one field such as maxSessionLength, send the whole object back.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityConfigurationUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The profile was updated. The body is the saved connection profile.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActivityConfiguration" } } } }, "400": { "description": "The profile could not be updated, for example because the name is already used." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ConsoleAccess/Groups": { "get": { "tags": [ "Console Access" ], "summary": "List groups with console administrator access", "description": "Returns the Active Directory groups whose members have administrator access to the console.\n\nPermission required: Administrator role or an application (API) token.", "operationId": "ConsoleAccess_GetGroups", "responses": { "200": { "description": "An array of Active Directory groups.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectoryGroup" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ConsoleAccess/Groups/{adGroupId}": { "delete": { "tags": [ "Console Access" ], "summary": "Remove console administrator access from a group", "description": "Removes the specified Active Directory group from the list of groups whose members have administrator access to the console. Use it to revoke access previously granted to a whole group.\n\nPermission required: Administrator role or an application (API) token.\n\nCaution: The change takes effect immediately and removes console administrator access for every member of the group who does not have access another way.", "operationId": "ConsoleAccess_RemoveGroup", "parameters": [ { "name": "adGroupId", "in": "path", "description": "ID of the Active Directory group to remove.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "Access was removed, or the group had no access. The response has no body." }, "404": { "description": "No Active Directory group exists with the supplied ID." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Console Access" ], "summary": "Give a group console administrator access", "description": "Grants administrator access to the console to all members of the specified Active Directory group. The call takes no request body.\n\nPermission required: Administrator role or an application (API) token.\n\nCaution: The change takes effect immediately and grants console administrator access to every member of the group.", "operationId": "ConsoleAccess_AddGroup", "parameters": [ { "name": "adGroupId", "in": "path", "description": "ID of the Active Directory group to grant access to.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "Access was granted, or the entry already had it. The response has no body." }, "404": { "description": "No Active Directory group exists with the supplied ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ConsoleAccess/RemoveMultiple": { "post": { "tags": [ "Console Access" ], "summary": "Remove console administrator access from several entries", "description": "Removes console administrator access for each listed entry in one call and returns a pass and fail report. Each entry is processed independently. You cannot remove your own entry or a group or collection you belong to, and an ID that matches no administrator entry is also rejected; these are reported as failures.\n\nPermission required: Administrator role.\n\nCaution: The change takes effect immediately and revokes console administrator access for every listed entry.", "operationId": "ConsoleAccess_RemoveMultiple", "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true, "description": "A JSON array of administrator entry IDs, as returned in the id field of the administrator search results.\n\n- `(array item)` (string (GUID), required): ID of an administrator entry to remove. This is the entry ID from the administrator search, not the user's account ID. Send the body as a bare JSON array of IDs." }, "responses": { "200": { "description": "A report with passed and failed counts and a report array with one message per entry. The status is 200 even when some or all entries failed, so check the failed count.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "404": { "description": "The signed-in account could not be identified." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ConsoleAccess/Search": { "get": { "tags": [ "Console Access" ], "summary": "Search users and groups with console administrator access", "description": "Returns a page of the users, groups, applications and collections that currently have administrator access to the console, with optional filtering by type and text. Use it to list administrators or to find entry IDs for the remove-multiple call.\n\nPermission required: Administrator role.\n\nValues for `filterEntityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "ConsoleAccess_Search", "parameters": [ { "name": "filterEntityType", "in": "query", "description": "Limits results to one entry type. Send the number from the entry type list. Omit to include every type.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedAccountKind" } }, { "name": "filterText", "in": "query", "description": "Text to match, ignoring case, against the entry name, user name or email address. Omit to skip text filtering.", "required": false, "schema": { "type": "string" }, "example": "admin" }, { "name": "orderBy", "in": "query", "description": "Name of an entry field to sort by, such as name. The match ignores case. Results are also sorted by name after this field. An unrecognized field name falls back to sorting by name only, and none turns sorting off. The default is name.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "Number of entries to skip, used for paging. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of entries to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 } ], "responses": { "200": { "description": "An object with a data array of administrator entries and recordsTotal, the total number of matching entries. The id of each entry identifies the administrator entry, not the underlying account, and is the value to pass to the remove-multiple call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfConsoleAccessMemberView" } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ConsoleAccess/Search/Candidate": { "get": { "tags": [ "Console Access" ], "summary": "Search users and groups eligible for console administrator access", "description": "Returns a page of the users, applications, groups and collections that can be given administrator access to the console, with optional filtering by type and text. Entries that already have access are not listed. Use it to find entries to pass to the add-multiple call.\n\nPermission required: Administrator role.\n\nValues for `filterEntityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "ConsoleAccess_SearchCandidate", "parameters": [ { "name": "filterEntityType", "in": "query", "description": "Limits results to one entry type. Send the number from the entry type list. Omit to include every type.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedAccountKind" } }, { "name": "filterText", "in": "query", "description": "Text to match, ignoring case, against the entry display name, user name or email address. Omit to skip text filtering.", "required": false, "schema": { "type": "string" }, "example": "admin" }, { "name": "orderBy", "in": "query", "description": "Name of an entry field to sort by, such as name. The match ignores case. Results are also sorted by name after this field. An unrecognized field name falls back to sorting by name only, and none turns sorting off. The default is name.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "Number of entries to skip, used for paging. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of entries to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 } ], "responses": { "200": { "description": "An object with a data array of candidate entries and recordsTotal, the total number of matching entries.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfConsoleAccessMemberCandidateView" } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ConsoleAccess/Users": { "get": { "tags": [ "Console Access" ], "summary": "List users with explicit console administrator access", "description": "Returns the users who have been given administrator access to the console directly, rather than through a group.\n\nPermission required: Administrator role or an application (API) token.", "operationId": "ConsoleAccess_GetUsers", "responses": { "200": { "description": "An array of user records.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountInfo" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ConsoleAccess/Users/{managedAccountId}": { "delete": { "tags": [ "Console Access" ], "summary": "Remove console administrator access from a user", "description": "Removes explicit console administrator access from the specified user. Use it to revoke access that was granted to the user directly.\n\nPermission required: Administrator role or an application (API) token.\n\nCaution: The change takes effect immediately; the user loses console administrator access unless a group or collection they belong to still grants it.", "operationId": "ConsoleAccess_RemoveUser", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "ID of the user's managed account.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "Access was removed, or the user had no explicit access. The response has no body." }, "404": { "description": "No user exists with the supplied ID." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Console Access" ], "summary": "Give a user console administrator access", "description": "Grants administrator access to the console to the specified user. The call takes no request body.\n\nPermission required: Administrator role or an application (API) token.\n\nCaution: The change takes effect immediately and grants the user console administrator access.", "operationId": "ConsoleAccess_AddUser", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "ID of the user's managed account.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "Access was granted, or the entry already had it. The response has no body." }, "404": { "description": "No user exists with the supplied ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Credential": { "get": { "tags": [ "Credential" ], "summary": "List credentials of one type", "description": "Returns the credentials of one type. Without a type it returns the Configuration credentials, which are the service accounts used by resources. The Search route is the better choice for most uses.\n\nPermission required: Admin or App role, or the UserPlus role with the Credentials permission.\n\nValues for `CredentialType`: -1 = Any, 0 = Configuration, 1 = User, 2 = Service, 3 = ActivityToken, 4 = Application, 5 = VaultUser, 6 = SshKeyCert.\n\nCaution: The response lists credential details and can include deleted credentials unless includeDeleted is false.", "operationId": "Credential_GetByCredentialType", "parameters": [ { "name": "type", "in": "query", "description": "The credential type to return, as a number. The default is 0 (Configuration). Use -1 to return every type.", "required": false, "schema": { "$ref": "#/components/schemas/CredentialType" } }, { "name": "userName", "in": "query", "description": "Returns only credentials whose user name matches this value exactly, ignoring case. Accepts DOMAIN\\user or user@domain; without a domain, only credentials with no domain match. When you set userName, includeDeleted is ignored and the list is not sorted.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "includeDeleted", "in": "query", "description": "Set to false to leave out deleted credentials. The default is true. Without userName, results are sorted by name, domain and user name.", "required": false, "schema": { "type": "boolean", "default": true }, "example": true } ], "responses": { "200": { "description": "A list of credentials. Password, enable password, key and passphrase fields are left out.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Credential" } } } } }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Credential" ], "summary": "Create a credential", "description": "Creates a credential (service account) that NPS uses to sign in to resources. If the request carries the ID of an existing credential and a domain, that credential is updated instead and set to the Configuration type. If the domain and user name already belong to a different credential, the call returns 409.\n\nPermission required: Admin role.\n\nValues for `AuthenticationMethodType`: 0 = Password, 1 = SshCertificate, 2 = SshCertificateAndPassword.\n\nValues for `CredentialType`: -1 = Any, 0 = Configuration, 1 = User, 2 = Service, 3 = ActivityToken, 4 = Application, 5 = VaultUser, 6 = SshKeyCert.\n\nCaution: The request body contains the account password or private key, so send it only over a secure connection and do not log it.", "operationId": "Credential_Create", "requestBody": { "description": "The credential to create.\n\n- `id` (string (GUID)): The credential ID. Leave empty for a new credential.\n- `name` (string): The display name of the service account.\n- `description` (string): A description of the credential.\n- `platformId` (string (GUID)): The ID of the platform the account belongs to.\n- `username` (string, required): The user name. The request fails if it is empty. A DOMAIN\\user or user@domain value is split into domain and user name.\n- `password` (string): The password. Required unless you give a private key or a password vault connector. Stored encrypted.\n- `enablePassword` (string): The enable password, used by some network devices. Stored encrypted.\n- `domain` (string): The domain, for a domain account.\n- `type` (integer): The credential type. A number; see the `Values for` paragraphs in the operation description.\n- `authenticationMethod` (integer): How the credential authenticates. A number; see the `Values for AuthenticationMethodType` paragraph in the operation description. Use privateKey with the SSH certificate methods.\n- `privateKey` (string): The SSH private key. Stored encrypted.\n- `passphrase` (string): The passphrase for the private key. Stored encrypted.\n- `publicKey` (string): The SSH public key. Stored encrypted.\n- `passwordVaultConnectorId` (string (GUID)): The ID of a password vault connector that holds the password.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialCreateRequest" }, "example": { "name": "", "description": "", "platformId": "7c9e6679-7425-40de-944b-e07fc1f90ae7", "username": "", "password": "", "domain": "" } } }, "required": true }, "responses": { "200": { "description": "The credential. Password, enable password, key and passphrase fields are left out.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Credential" } } } }, "400": { "description": "The user name is missing, no password, private key or password vault connector was given, the user name and domain match an existing NPS user, or saving failed. When the request updates an existing credential, an SSH key that is not valid also returns 400. The body describes the problem." }, "403": { "description": "The signed-in user does not have the required role." }, "409": { "description": "The domain and user name already belong to a different service account." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Credential/Count": { "get": { "tags": [ "Credential" ], "summary": "Count credentials", "description": "Returns a single number: how many credentials and discovered users match, using the same set as the Search route (Application-type credentials are not counted). For users with the UserPlus role the count covers only the items that user can see.\n\nPermission required: Admin role, or the UserPlus role with the Credentials permission.", "operationId": "Credential_Count", "parameters": [ { "name": "includeDeleted", "in": "query", "description": "Set to true to include deleted credentials in the count. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "The number of credentials.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The count could not be read. The body describes the problem." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Credential/DeleteMultiple": { "post": { "tags": [ "Credential" ], "summary": "Delete several credentials", "description": "Marks the credentials whose IDs you list as deleted and reports how many were deleted and how many failed. An ID that does not match a credential counts as a failure. Unlike the single delete route, it does not check whether a domain or resource still uses the credential. Use it to remove many credentials in one call.\n\nPermission required: Admin role.\n\nCaution: The listed credentials are marked deleted immediately.", "operationId": "Credential_DeleteMultiple", "requestBody": { "description": "A JSON array of credential IDs to delete.\n\n- `(array item)` (string (GUID), required): The ID of one credential to delete. The body is a bare array of IDs.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "Two counts: the number of credentials deleted and the number that failed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntPair" } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Credential/GetAuthenticationMethodTypes": { "get": { "tags": [ "Credential" ], "summary": "List credential authentication methods", "description": "Returns the authentication methods a credential can use, as names with their numbers. Use it to look up the values for the authenticationMethod field.\n\nPermission required: Admin or App role.\n\nValues for `AuthenticationMethodType`: 0 = Password, 1 = SshCertificate, 2 = SshCertificateAndPassword.", "operationId": "Credential_GetAuthenticationMethodTypes", "responses": { "200": { "description": "An object that maps each method name to its number.", "content": { "application/json": { "schema": { "type": "object", "description": "Each authentication method name with its number.", "properties": { "password": { "type": "integer", "format": "int32" }, "sshCertificate": { "type": "integer", "format": "int32" }, "sshCertificateAndPassword": { "type": "integer", "format": "int32" } } } } } }, "400": { "description": "The list could not be read." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Credential/GetCredentialSSHCertificate/{credentialId}": { "get": { "tags": [ "Credential" ], "summary": "Get the SSH key for a credential", "description": "Returns the SSH key settings for one SSH key credential, including the private key, public key and passphrase in plain text. Use it when you need to retrieve the key material.\n\nPermission required: Admin or App role.\n\nValues for `AuthenticationMethodType`: 0 = Password, 1 = SshCertificate, 2 = SshCertificateAndPassword.\n\nValues for `CredentialType`: -1 = Any, 0 = Configuration, 1 = User, 2 = Service, 3 = ActivityToken, 4 = Application, 5 = VaultUser, 6 = SshKeyCert.\n\nCaution: The response contains the private key and passphrase in plain text, so protect it and do not log it.", "operationId": "Credential_GetCredentialSshCertificate", "parameters": [ { "name": "credentialId", "in": "path", "description": "The ID of the credential.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The body wraps the key settings: value holds the credential ID, type, authentication method, key settings, private key, passphrase, public key and sudo command, and statusCode is 200. The other wrapper properties are empty.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SshCertificateInfoResponse" } } } }, "400": { "description": "The key could not be read. The body describes the problem." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No credential of the SSH key type exists with that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Credential/GetCredentialTypes": { "get": { "tags": [ "Credential" ], "summary": "List credential types", "description": "Returns the credential types as names with their numbers. Use it to look up the values for the type field and the type and credentialType query parameters.\n\nPermission required: Admin or App role.\n\nValues for `CredentialType`: -1 = Any, 0 = Configuration, 1 = User, 2 = Service, 3 = ActivityToken, 4 = Application, 5 = VaultUser, 6 = SshKeyCert.", "operationId": "Credential_GetCredentialTypes", "responses": { "200": { "description": "An object that maps each credential type name to its number.", "content": { "application/json": { "schema": { "type": "object", "description": "Each credential type name with its number.", "properties": { "any": { "type": "integer", "format": "int32" }, "configuration": { "type": "integer", "format": "int32" }, "user": { "type": "integer", "format": "int32" }, "service": { "type": "integer", "format": "int32" }, "activityToken": { "type": "integer", "format": "int32" }, "application": { "type": "integer", "format": "int32" }, "vaultUser": { "type": "integer", "format": "int32" }, "sshKeyCert": { "type": "integer", "format": "int32" } } } } } }, "400": { "description": "The list could not be read." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Credential/OnChangeReset": { "put": { "tags": [ "Credential" ], "summary": "Set when credential passwords rotate", "description": "Sets whether the passwords of the listed credentials change at the start of a session, at the end of a session, or both, and what happens to the account afterward. It applies only to credentials whose managed user rotates automatically. The credentials are updated in list order, so if one fails, the ones before it are already changed.\n\nPermission required: Admin or App role.\n\nValues for `PostSessionAction`: 0 = Disable, 1 = Enable, 2 = KeepPrevious.", "operationId": "Credential_SetOnChangeReset", "parameters": [ { "name": "changeOnCheckout", "in": "query", "description": "Set to true to change the password when a session starts. Defaults to false when omitted.", "required": false, "schema": { "type": "boolean" }, "example": true }, { "name": "changeOnRelease", "in": "query", "description": "Set to true to change the password when a session ends. Defaults to false when omitted.", "required": false, "schema": { "type": "boolean" }, "example": true }, { "name": "postSessionAction", "in": "query", "description": "What happens to the account after the session ends, as a number. Defaults to 0 (Disable) when omitted.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 2 } ], "requestBody": { "description": "A JSON array of credential IDs to update.\n\n- `(array item)` (string (GUID), required): The ID of one credential. The list cannot be empty. Every credential must have an automatically rotated managed user.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "202": { "description": "The settings were accepted and applied." }, "400": { "description": "The list was empty, an ID was empty, a managed user is not automatic, or the update failed." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "A credential or its managed user was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Credential/Search": { "get": { "tags": [ "Credential" ], "summary": "Search credentials and discovered users", "description": "Returns one page of credentials and discovered users, including users found by directory sync and host scans. You can filter by text, type, management state and privilege. Application-type credentials are never returned, and credentials held in a password vault are left out unless the deployment is set to release them. For users with only the UserPlus role, the results cover only what that user can see.\n\nPermission required: Admin or App role, or the UserPlus role with the Credentials permission.\n\nValues for `ManagedType (managedType)`: -1 = All, 0 = Internal, 1 = Standard, 2 = Service.\n\nValues for `CredentialType`: -1 = Any, 0 = Configuration, 1 = User, 2 = Service, 3 = ActivityToken, 4 = Application, 5 = VaultUser, 6 = SshKeyCert.\n\nValues for `CredentialSearchManagedFilter (managedFilter)`: -1 = All, 0 = NotManaged, 1 = Managed, 2 = Automatic, 3 = Manual.\n\nValues for `UserPrivilege (privilegeFilter)`: 0 = NotSet, 1 = Administrator, 2 = PowerUser, 3 = Guest, 4 = User, 5 = SuperUser, 6 = LinuxUser, 7 = CiscoPrivilege_0, 8 = CiscoPrivilege_1, 9 = CiscoPrivilege_2, 10 = CiscoPrivilege_3, 11 = CiscoPrivilege_4, 12 = CiscoPrivilege_5, 13 = CiscoPrivilege_6, 14 = CiscoPrivilege_7, 15 = CiscoPrivilege_8, 16 = CiscoPrivilege_9, 17 = CiscoPrivilege_10, 18 = CiscoPrivilege_11, 19 = CiscoPrivilege_12, 20 = CiscoPrivilege_13, 21 = CiscoPrivilege_14, 22 = CiscoPrivilege_15, 23 = DomainAdmin, 24 = EnterpriseAdmin.", "operationId": "Credential_Search", "parameters": [ { "name": "filterText", "in": "query", "description": "Returns only items where this text appears, ignoring case, in the user name, platform, domain or privilege name.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "managedType", "in": "query", "description": "Limits results by account kind. A number; the default is -1 (All).", "required": false, "schema": { "$ref": "#/components/schemas/ManagedType" } }, { "name": "credentialType", "in": "query", "description": "Limits results to one credential type. A number; the default is -1 (Any). Application (4) credentials are never returned, so that value returns nothing.", "required": false, "schema": { "$ref": "#/components/schemas/CredentialType" } }, { "name": "skip", "in": "query", "description": "The number of items to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of items to return. The default is 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "includeDeleted", "in": "query", "description": "Set to true to include deleted items. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "orderBy", "in": "query", "description": "The name of the property to sort by.", "required": false, "schema": { "type": "string", "default": "" }, "example": "userName" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "managedFilter", "in": "query", "description": "Limits results by management state. A number; the default is -1 (All).", "required": false, "schema": { "$ref": "#/components/schemas/CredentialSearchManagedFilter" } }, { "name": "privilegeFilter", "in": "query", "description": "Limits results to one privilege level, as a number. When omitted, privilege is not filtered.", "required": false, "schema": { "$ref": "#/components/schemas/UserPrivilege" } } ], "responses": { "200": { "description": "An object with the page of results in data and the total number of matches in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfCredentialResult" } } } }, "400": { "description": "The search failed. The body describes the problem." }, "403": { "description": "The signed-in user does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Credential/SSHKeyGenAlgorithms": { "get": { "tags": [ "Credential" ], "summary": "List supported SSH key algorithms", "description": "Returns the SSH key algorithms the product supports (RSA and ECDSA). Each algorithm lists the key lengths it allows: 1024, 2048 and 4096 for RSA, and 256, 384 and 521 for ECDSA. Use it to choose values for keyGenAlgorithm and keyLength.\n\nPermission required: Admin or App role.", "operationId": "Credential_GetSshKeyGenAlgorithms", "responses": { "200": { "description": "An object that maps each algorithm name to a list of supported key lengths.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "integer", "format": "int32" } } } } } }, "400": { "description": "The list could not be read." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Credential/{credentialId}": { "delete": { "tags": [ "Credential" ], "summary": "Delete a credential", "description": "Deletes one credential (service account) by ID. The credential is marked deleted and removed from any access policies it belongs to. Use it to remove a credential that is no longer needed.\n\nPermission required: Admin or App role.\n\nCaution: The change takes effect immediately and removes the credential from any access policies it belongs to.", "operationId": "Credential_Delete", "parameters": [ { "name": "credentialId", "in": "path", "description": "The ID of the credential.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The credential was deleted." }, "400": { "description": "The credential was not found (the body is empty), or it cannot be deleted because a domain or a resource with no other credential to fall back on still uses it (the body describes the problem)." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Credential" ], "summary": "Get a credential by ID", "description": "Returns one credential, including whether it is managed. Password, key and passphrase values are blank unless you set showPassword to true. For Admin users, showPassword has no effect on Configuration (service account) credentials, and each password view by an Admin is recorded as an event.\n\nPermission required: Admin or App role, or the UserPlus role with the Credentials permission.\n\nValues for `CredentialType`: -1 = Any, 0 = Configuration, 1 = User, 2 = Service, 3 = ActivityToken, 4 = Application, 5 = VaultUser, 6 = SshKeyCert.\n\nValues for `AuthenticationMethodType`: 0 = Password, 1 = SshCertificate, 2 = SshCertificateAndPassword.\n\nCaution: With showPassword set to true the response contains secrets in plain text, and a password view by an Admin is recorded as an event and forwarded to any configured SIEM.", "operationId": "Credential_GetById", "parameters": [ { "name": "credentialId", "in": "path", "description": "The ID of the credential.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" }, { "name": "showPassword", "in": "query", "description": "Set to true to include the password, keys and passphrase in plain text. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "The credential, with an isManaged flag and its comment.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialSummary" } } } }, "400": { "description": "The credential ID was empty." }, "401": { "description": "The built-in Administrator account asked to view the current password, which it cannot do." }, "403": { "description": "The signed-in user does not have the required role or permission." }, "404": { "description": "No credential exists with that ID." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Credential" ], "summary": "Update a credential", "description": "Replaces the settings of one credential with the body you send. A blank password or enable password keeps the stored value, so you can update other fields without re-sending secrets.\n\nPermission required: Admin, App or UserPlus role. A UserPlus user also needs the Credential Manage permission for this credential.\n\nValues for `AuthenticationMethodType`: 0 = Password, 1 = SshCertificate, 2 = SshCertificateAndPassword.\n\nValues for `CredentialType`: -1 = Any, 0 = Configuration, 1 = User, 2 = Service, 3 = ActivityToken, 4 = Application, 5 = VaultUser, 6 = SshKeyCert.\n\nCaution: The change takes effect immediately, and the request body can contain secrets, so send it only over a secure connection.", "operationId": "Credential_Update", "parameters": [ { "name": "credentialId", "in": "path", "description": "The ID of the credential. It must match the id in the body.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "requestBody": { "description": "The full credential with your changes.\n\n- `id` (string (GUID), required): The credential ID. Must match the id in the URL.\n- `name` (string): The display name.\n- `description` (string): A description of the credential.\n- `username` (string): The user name. A DOMAIN\\user or user@domain value is split into domain and user name.\n- `domain` (string): The domain, for a domain account.\n- `password` (string): The new password. Leave blank to keep the stored password. Stored encrypted.\n- `enablePassword` (string): The new enable password. Leave blank to keep the stored value. Stored encrypted.\n- `type` (integer): The credential type. A number; see the `Values for` paragraphs in the operation description.\n- `authenticationMethod` (integer): How the credential authenticates. A number; see the `Values for AuthenticationMethodType` paragraph in the operation description.\n- `privateKey` (string): The SSH private key. Used with the SSH certificate methods. Leave privateKey and passphrase blank to keep the stored key. If you send either, the key is validated.\n- `passphrase` (string): The passphrase for the private key. Used with the SSH certificate methods. Leave blank to keep the stored passphrase.\n- `publicKey` (string): The SSH public key.\n- `passwordVaultConnectorId` (string (GUID)): The ID of a password vault connector that holds the password.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The updated credential. Password, enable password, key and passphrase fields are left out.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Credential" } } } }, "400": { "description": "The id in the body does not match the URL, the user name matches an existing NPS user, or the update failed. The body describes the problem." }, "401": { "description": "A UserPlus user does not have permission to manage this credential." }, "403": { "description": "The signed-in user does not have the required role." }, "409": { "description": "The domain and user name already belong to another service account." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/CredentialGroup": { "post": { "tags": [ "Credential Group" ], "summary": "Create a credential group", "description": "Creates a credential group from the name and description in the request body and returns the new group. Use it to collect credentials so that access policies can refer to them together.\n\nPermission required: Admin role.", "operationId": "CredentialGroup_AddCredentialGroup", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialGroupCreateRequest" } } }, "required": true, "description": "The credential group to create.\n\n- `name` (string, required): The name of the credential group. Up to 256 characters.\n- `description` (string): A description of the group." }, "responses": { "200": { "description": "The credential group was created. The body is the new group, including its ID.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialGroup" } } } }, "400": { "description": "The group could not be created, for example because the body is missing. The body contains the error message." }, "403": { "description": "The signed-in user does not have the Admin role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/CredentialGroup/AddCredentials/{credentialGroupId}": { "post": { "tags": [ "Credential Group" ], "summary": "Add credentials to a credential group", "description": "Adds the credentials whose IDs are in the request body to the credential group. The response is the number of credentials added.\n\nPermission required: Admin role.", "operationId": "CredentialGroup_AddCredentials", "parameters": [ { "name": "credentialGroupId", "in": "path", "description": "The ID of the credential group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true, "description": "An array of credential IDs to add to the group.\n\n- `(array item)` (string (GUID), required): The ID of a credential to add. The body is a JSON array of IDs, not an object." }, "responses": { "200": { "description": "The credentials were added. The body is the number added; credentials already in the group are skipped and not counted.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The group ID is empty or the credentials could not be added. The body contains the error message." }, "403": { "description": "The signed-in user does not have the Admin role." }, "404": { "description": "No credential group with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/CredentialGroup/Names": { "get": { "tags": [ "Credential Group" ], "summary": "List credential group names and IDs", "description": "Returns the name and ID of each credential group. Use it to fill a list or to find a group ID. You can narrow the list with filter text.\n\nPermission required: Admin or App role.", "operationId": "CredentialGroup_ListNames", "parameters": [ { "name": "filterText", "in": "query", "description": "Text to filter the group names by. The default is an empty string, which returns all groups.", "required": false, "schema": { "type": "string", "default": "" }, "example": "admin" } ], "responses": { "200": { "description": "An array of objects, each with the ID and name of a credential group.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } }, "400": { "description": "The list could not be retrieved. The body contains the error message." }, "403": { "description": "The signed-in user does not have the Admin or App role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/CredentialGroup/Search": { "get": { "tags": [ "Credential Group" ], "summary": "Search the credentials in a credential group", "description": "Returns a page of the credentials that belong to one credential group. Application credentials are not included. Use it to see the group's members, with optional filtering, sorting and paging.\n\nPermission required: Admin role.\n\nValues for `managedType`: -1 = All, 0 = Internal, 1 = Standard, 2 = Service.", "operationId": "CredentialGroup_Search", "parameters": [ { "name": "id", "in": "query", "description": "The ID of the credential group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "filterText", "in": "query", "description": "Text to match in the credential display name. The default is an empty string, which applies no filter.", "required": false, "schema": { "type": "string", "default": "" }, "example": "admin" }, { "name": "skip", "in": "query", "description": "The number of results to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of results to return. The default is 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "The name of the field to sort the results by. If you leave it out, results are sorted by display name.", "required": false, "schema": { "type": "string", "default": "" }, "example": "displayName" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "managedType", "in": "query", "description": "Limits the results by how the credential is managed. The default is All (-1).", "required": false, "schema": { "$ref": "#/components/schemas/ManagedType" } } ], "responses": { "200": { "description": "A page of credentials. The body has a data array and a recordsTotal count of all matches.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfCredentialResult" } } } }, "400": { "description": "The group ID is empty or the search failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the Admin role." }, "404": { "description": "No credential group with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/CredentialGroup/SearchCandidates": { "get": { "tags": [ "Credential Group" ], "summary": "Search credentials that can join a credential group", "description": "Returns a page of credentials that are not yet in the given credential group and can be added to it. Application credentials are not included. Use it to choose credentials before you call the add credentials route.\n\nPermission required: Admin role.\n\nValues for `managedType`: -1 = All, 0 = Internal, 1 = Standard, 2 = Service.", "operationId": "CredentialGroup_SearchCandidates", "parameters": [ { "name": "id", "in": "query", "description": "The ID of the credential group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "filterText", "in": "query", "description": "Text to match in the credential display name. The default is an empty string, which applies no filter.", "required": false, "schema": { "type": "string", "default": "" }, "example": "admin" }, { "name": "skip", "in": "query", "description": "The number of results to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of results to return. The default is 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "The name of the field to sort the results by. If you leave it out, results are sorted by display name.", "required": false, "schema": { "type": "string", "default": "" }, "example": "displayName" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "managedType", "in": "query", "description": "Limits the results by how the credential is managed. The default is All (-1).", "required": false, "schema": { "$ref": "#/components/schemas/ManagedType" } } ], "responses": { "200": { "description": "A page of candidate credentials. The body has a data array and a recordsTotal count of all matches.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfCredentialResult" } } } }, "400": { "description": "The group ID is empty or the search failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the Admin role." }, "404": { "description": "No credential group with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/CredentialGroup/{credentialGroupId}": { "delete": { "tags": [ "Credential Group" ], "summary": "Delete a credential group", "description": "Deletes the credential group with the given ID. Use it when you no longer need the group.\n\nPermission required: Admin role.\n\nCaution: The group is deleted immediately and the call cannot be undone.", "operationId": "CredentialGroup_RemoveCredentialGroup", "parameters": [ { "name": "credentialGroupId", "in": "path", "description": "The ID of the credential group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The credential group was deleted. The body is empty." }, "400": { "description": "The group could not be deleted. The body contains the error message." }, "403": { "description": "The signed-in user does not have the Admin role." }, "404": { "description": "No credential group with that ID exists." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Credential Group" ], "summary": "Get a credential group", "description": "Returns the credential group with the given ID, including its name and description.\n\nPermission required: Admin role.", "operationId": "CredentialGroup_GetCredentialGroup", "parameters": [ { "name": "credentialGroupId", "in": "path", "description": "The ID of the credential group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The credential group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialGroup" } } } }, "400": { "description": "The ID is empty or the group could not be retrieved. The body contains the error message." }, "403": { "description": "The signed-in user does not have the Admin role." }, "404": { "description": "No credential group with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/CredentialPasswordHistory": { "delete": { "tags": [ "Credential Password History" ], "summary": "Delete expired password history entries", "description": "Deletes the stored password history entries that are older than the retention period set in the password history options. Use it to clear old entries on demand.\n\nPermission required: Admin role. The session must also satisfy the multi-factor authentication requirement.\n\nCaution: The expired entries are deleted immediately and cannot be recovered.", "operationId": "CredentialPasswordHistory_RemoveExpiredCredentials", "responses": { "200": { "description": "The expired entries were deleted. The body is empty." }, "403": { "description": "The signed-in user does not have the Admin role or has not satisfied the MFA requirement." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/CredentialPasswordHistory/CanRollback/{credentialId}": { "get": { "tags": [ "Credential Password History" ], "summary": "Check whether a credential can be rolled back", "description": "Returns true when the credential has at least one stored password history entry, which means its password can be rolled back. Use it before you offer a rollback.\n\nPermission required: Admin or App role, or the UserPlus role with the Rotate Services credential permission. The session must also satisfy the multi-factor authentication requirement.", "operationId": "CredentialPasswordHistory_GetCanRollbackCredential", "parameters": [ { "name": "credentialId", "in": "path", "description": "The ID of the credential.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "A JSON boolean, true when a rollback is possible.", "content": { "application/json": { "schema": { "type": "boolean" } } } }, "400": { "description": "The credential ID is empty or the check failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role, or is a UserPlus user without the Rotate Services permission, or has not satisfied the MFA requirement." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/DomainSync/Cancel/{domainConfigId}": { "post": { "tags": [ "Domain Sync" ], "summary": "Cancel the running Active Directory sync for a domain", "description": "Marks the sync runs for the domain that are still in progress as cancelled. Use it to stop a sync that is queued or running.\n\nPermission required: Admin or App role. The session must also satisfy the multi-factor authentication requirement.", "operationId": "DomainSync_Cancel", "parameters": [ { "name": "domainConfigId", "in": "path", "description": "The ID of the domain configuration.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The cancellation was recorded. The body is empty. The call also succeeds when the domain configuration ID matches no sync runs." }, "403": { "description": "The signed-in user does not have the required role or has not satisfied the MFA requirement." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/DomainSync/errors/sync/{syncId}": { "get": { "tags": [ "Domain Sync" ], "summary": "List the errors from one Active Directory sync", "description": "Returns the errors recorded during one Active Directory sync run, newest first, each with a time and a message. Use it to find out why a sync reported errors.\n\nPermission required: Admin role. The session must also satisfy the multi-factor authentication requirement.", "operationId": "DomainSync_GetActiveDirectorySyncErrors", "parameters": [ { "name": "syncId", "in": "path", "description": "The ID of the sync run (the ID of a sync statistics entry).", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "skip", "in": "query", "description": "The number of items to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of items to return. The default is 1000.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 1000 } ], "responses": { "200": { "description": "An array of sync errors. Each has an ID, an error time and an error message.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectorySyncStatsError" } } } } }, "403": { "description": "The signed-in user does not have the Admin role or has not satisfied the MFA requirement." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/DomainSync/scan/domain": { "post": { "tags": [ "Domain Sync" ], "summary": "Start an Active Directory sync now for a domain", "description": "Starts a sync for the named domain immediately. Set fullSync to true to read all objects rather than only changes since the last sync. The response is the ID of the sync job.\n\nPermission required: Admin role. The session must also satisfy the multi-factor authentication requirement.\n\nCaution: The sync starts immediately, and any pending, queued or running sync for this domain is cancelled first.", "operationId": "DomainSync_SyncActiveDirectoryDomainInformation", "parameters": [ { "name": "domainName", "in": "query", "description": "The name of the domain to sync.", "required": true, "schema": { "type": "string" }, "example": "example.com" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdSyncSchedule" } } }, "required": true, "description": "Sync options. Send a body, even if it is only an empty object.\n\n- `schedule` (string): Not needed to start the sync, which runs now whatever the value. The sync schedule as a comma-separated string. Daily is e,0,d,a,hour,minute, for example e,0,d,a,6,0 for 06:00. Weekly is e,0,w,o,day,a,hour,minute with the day as su, m, tu, w, th, f or sa. Hourly is e,n,h to repeat every n hours. The hour is 0 to 23 in UTC.\n- `useGlobalCatalog` (boolean): Set to true to read from the global catalog.\n- `fullSync` (boolean): Set to true to run a full sync instead of an incremental one. Applies to the scan route; resets the saved change position first." }, "responses": { "200": { "description": "The sync was scheduled. The body is the job ID.", "content": { "application/json": { "schema": { "type": "string", "format": "uuid" } } } }, "400": { "description": "The sync could not be scheduled for this domain." }, "403": { "description": "The signed-in user does not have the Admin role or has not satisfied the MFA requirement." }, "404": { "description": "The domain is unknown or has no sync queue. The body is the domain name." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/DomainSync/scan/resourceGroup/{domainId}": { "post": { "tags": [ "Domain Sync" ], "summary": "Start a sync for a domain configuration", "description": "Starts an Active Directory sync now for the domain configuration with the given ID. Set onlyMap to true to run only the resource group mapping instead of the sync.\n\nPermission required: Admin role. The session must also satisfy the multi-factor authentication requirement.\n\nCaution: When onlyMap is false the sync starts immediately, and a sync for this domain that is pending, queued or running is cancelled first.", "operationId": "DomainSync_ScheduleResourceGroupOuMappingJob", "parameters": [ { "name": "domainId", "in": "path", "description": "The ID of the domain configuration.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "onlyMap", "in": "query", "description": "Set to true to run only the resource group to OU mapping. The default is false, which runs an Active Directory sync.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "The job was scheduled. The body is empty." }, "400": { "description": "The job could not be scheduled." }, "403": { "description": "The signed-in user does not have the Admin role or has not satisfied the MFA requirement." }, "404": { "description": "The domain configuration was not found, or, when onlyMap is false, it has no sync queue." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/DomainSync/schedule/domain/{domainName}": { "post": { "tags": [ "Domain Sync" ], "summary": "Set the Active Directory sync schedule for a domain", "description": "Saves the sync schedule for the named domain and returns the resulting sync job. Use it to set up recurring syncs.\n\nPermission required: Admin role. The session must also satisfy the multi-factor authentication requirement.", "operationId": "DomainSync_ScheduleActiveDirectorySync", "parameters": [ { "name": "domainName", "in": "path", "description": "The name of the domain.", "required": true, "schema": { "type": "string" }, "example": "example.com" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdSyncSchedule" } } }, "required": true, "description": "The schedule options. Send a body, even if it is only an empty object.\n\n- `activeDirectoryDomainConfigurationId` (string (GUID)): The ID of the domain configuration. The console omits it, and then the returned job ID is the empty GUID.\n- `schedule` (string): The sync schedule as a comma-separated string. Daily is e,0,d,a,hour,minute, for example e,0,d,a,6,0 for 06:00. Weekly is e,0,w,o,day,a,hour,minute with the day as su, m, tu, w, th, f or sa. Hourly is e,n,h to repeat every n hours. The hour is 0 to 23 in UTC. Send -1 for no recurring schedule. For the domain added during initial setup, -1 is replaced with a daily schedule at 06:00 UTC.\n- `useGlobalCatalog` (boolean): Set to true to read from the global catalog.\n- `fullSync` (boolean): Not used by this route. This route ignores the value. To run a full sync now, use the start sync route." }, "responses": { "200": { "description": "The schedule was saved. The body describes the sync job, with its schedule and domain configuration ID.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActiveDirectoryJob" } } } }, "403": { "description": "The signed-in user does not have the Admin role or has not satisfied the MFA requirement." }, "404": { "description": "The domain does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/DomainSync/stats": { "get": { "tags": [ "Domain Sync" ], "summary": "List Active Directory sync statistics", "description": "Returns the statistics for Active Directory sync runs across all domains. Use it to review sync history and results. Entries are newest first. Each has the domain controller, counts of users, groups, members, computers and service accounts processed, start and end times, error and warning counts, and a status, and the job settings used (domain, domain controller and global catalog option).\n\nPermission required: Admin role. The session must also satisfy the multi-factor authentication requirement.\n\nValues for `status`: -1 = None, 0 = Created, 1 = Queued, 2 = Failed, 3 = Complete, 4 = Unauthorized, 5 = ProcessingGroups, 6 = ProcessingUsers, 7 = ProcessingGroupMembers, 8 = ProcessingComputers, 9 = ProcessingServiceAccounts, 10 = Cancelled.", "operationId": "DomainSync_GetActiveDirectorySyncStats", "parameters": [ { "name": "skip", "in": "query", "description": "The number of items to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of items to return. The default is 1000.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 1000 } ], "responses": { "200": { "description": "An array of sync statistics.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectorySyncStats" } } } } }, "403": { "description": "The signed-in user does not have the Admin role or has not satisfied the MFA requirement." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/DomainSync/stats/domain/{domainId}": { "get": { "tags": [ "Domain Sync" ], "summary": "List sync statistics for one domain", "description": "Returns the sync statistics for one Active Directory domain configuration, newest first. Use it to review that domain's sync history. Each entry has the domain controller, counts of users, groups, members, computers and service accounts processed, start and end times, error and warning counts, and a status, and the job settings used (domain, domain controller and global catalog option).\n\nPermission required: Admin role. The session must also satisfy the multi-factor authentication requirement.\n\nValues for `status`: -1 = None, 0 = Created, 1 = Queued, 2 = Failed, 3 = Complete, 4 = Unauthorized, 5 = ProcessingGroups, 6 = ProcessingUsers, 7 = ProcessingGroupMembers, 8 = ProcessingComputers, 9 = ProcessingServiceAccounts, 10 = Cancelled.", "operationId": "DomainSync_GetActiveDirectorySyncDomainStats", "parameters": [ { "name": "domainId", "in": "path", "description": "The ID of the domain configuration, as used by the other domain sync routes. This is not the ID of an individual Active Directory domain record.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "skip", "in": "query", "description": "The number of items to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of items to return. The default is 1000.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 1000 } ], "responses": { "200": { "description": "An array of sync statistics.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectorySyncStats" } } } } }, "403": { "description": "The signed-in user does not have the Admin role or has not satisfied the MFA requirement." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/DomainSync/stats/domainController/{domainController}": { "get": { "tags": [ "Domain Sync" ], "summary": "List sync statistics for one domain controller", "description": "Returns the sync statistics for runs that used the named domain controller. The name match ignores case. Entries are newest first. Each has the domain controller, counts of users, groups, members, computers and service accounts processed, start and end times, error and warning counts, and a status, and the job settings used (domain, domain controller and global catalog option).\n\nPermission required: Admin role. The session must also satisfy the multi-factor authentication requirement.\n\nValues for `status`: -1 = None, 0 = Created, 1 = Queued, 2 = Failed, 3 = Complete, 4 = Unauthorized, 5 = ProcessingGroups, 6 = ProcessingUsers, 7 = ProcessingGroupMembers, 8 = ProcessingComputers, 9 = ProcessingServiceAccounts, 10 = Cancelled.", "operationId": "DomainSync_GetActiveDirectorySyncJobsByDomainController", "parameters": [ { "name": "domainController", "in": "path", "description": "The name of the domain controller.", "required": true, "schema": { "type": "string" }, "example": "dc01.example.com" }, { "name": "skip", "in": "query", "description": "The number of items to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of items to return. The default is 1000.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 1000 } ], "responses": { "200": { "description": "An array of sync statistics.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectorySyncStats" } } } } }, "403": { "description": "The signed-in user does not have the Admin role or has not satisfied the MFA requirement." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/DomainSync/stats/id/{id}": { "get": { "tags": [ "Domain Sync" ], "summary": "Get one sync statistics entry", "description": "Returns the statistics for a single Active Directory sync run, with the domain controller, counts of objects processed, start and end times, error and warning counts, and a status. The job settings are not expanded in this response; it carries only their ID.\n\nPermission required: Admin role. The session must also satisfy the multi-factor authentication requirement.\n\nValues for `status`: -1 = None, 0 = Created, 1 = Queued, 2 = Failed, 3 = Complete, 4 = Unauthorized, 5 = ProcessingGroups, 6 = ProcessingUsers, 7 = ProcessingGroupMembers, 8 = ProcessingComputers, 9 = ProcessingServiceAccounts, 10 = Cancelled.", "operationId": "DomainSync_GetActiveDirectorySyncJobs", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the sync statistics entry.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The sync statistics entry.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActiveDirectorySyncStats" } } } }, "204": { "description": "No sync statistics entry has that ID. The body is empty." }, "403": { "description": "The signed-in user does not have the Admin role or has not satisfied the MFA requirement." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/DomainSync/SyncGroupMembers": { "post": { "tags": [ "Domain Sync" ], "summary": "Sync the members of one Active Directory group", "description": "Runs a synchronization for a single Active Directory group, identified by the distinguished name in the request body, so its membership is refreshed. The call returns when the sync finishes. The group's domain must already be known to the product.\n\nPermission required: Admin role. The session must also satisfy the multi-factor authentication requirement.", "operationId": "DomainSync_SyncGroupMembers", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActiveDirectoryGroupCreateRequest" } } }, "required": true, "description": "The Active Directory group to sync.\n\n- `activeDirectoryDomainId` (string (GUID), required): The ID of the domain the group belongs to. Must match a known domain.\n- `distinguishedName` (string, required): The distinguished name of the group.\n- `name` (string): The group name, used in the error message if the sync cannot run." }, "responses": { "200": { "description": "The group sync ran. The body is empty." }, "400": { "description": "The body is missing or the domain ID does not match a known domain, so the sync did not run." }, "403": { "description": "The signed-in user does not have the Admin role or has not satisfied the MFA requirement." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Email": { "post": { "tags": [ "Email" ], "summary": "Send a test email", "description": "Queues an email for delivery using the mail server details in the request, and returns the request. The console uses it to test mail server settings. The call fails if no email service is registered.\n\nPermission required: Admin role (or the App role).\n\nValues for `importance`: 0 = Low, 1 = Normal, 2 = High.\n\nValues for `priority`: 0 = NonUrgent, 1 = Normal, 2 = Urgent.\n\nCaution: The call queues a real email to the recipient address and also creates a settings record from the values in the request.", "operationId": "Email_Create", "requestBody": { "description": "The message and the mail server details to send it with.\n\n- `subject` (string, required): Subject of the email. Not checked by the server.\n- `htmlBody` (string, required): HTML body of the email. Not checked by the server.\n- `toAddress` (string, required): Recipient address. Not checked by the server.\n- `fromAddress` (string, required): Address the email is sent from. Not checked by the server.\n- `useTls` (boolean): Whether the connection to the mail server uses TLS.\n- `useAuth` (boolean): Whether the mail server requires authentication.\n- `smtpHost` (string, required): Host name of the mail server. Not checked by the server.\n- `smtpPort` (integer, required): Port of the mail server. Not checked by the server.\n- `credentialId` (string (GUID)): ID of the credential used to sign in to the mail server. Used when useAuth is true. Can be null.\n- `importance` (integer): Importance of the email. See the `Values for importance` paragraph in the operation description. The number or the member name is accepted. If omitted, the value is 0 (Low).\n- `priority` (integer): Priority of the email. See the `Values for priority` paragraph in the operation description. The number or the member name is accepted. If omitted, the value is 0 (NonUrgent).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailCreateRequest" } } }, "required": true }, "responses": { "200": { "description": "The email was queued. The body repeats the request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailRequest" } } } }, "400": { "description": "No email service is registered, or the email could not be queued. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only access." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Email" ], "summary": "Send an email from a template", "description": "Builds an email from an email template for one user and queues it for delivery. Each key in the request body is a text placeholder in the template that is replaced with its value. The call fails if the user has no email address or the template is empty.\n\nPermission required: Admin role (or the App role).\n\nValues for `importance`: 0 = Low, 1 = Normal, 2 = High.\n\nValues for `priority`: 0 = NonUrgent, 1 = Normal, 2 = Urgent.\n\nCaution: The call queues a real email to the user right away.", "operationId": "Email_UpdateUsingEmailTemplate", "parameters": [ { "name": "toUserId", "in": "query", "description": "The ID of the user who receives the email.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "subject", "in": "query", "description": "The subject of the email.", "required": true, "schema": { "type": "string" }, "example": "Subject text" }, { "name": "emailTemplateId", "in": "query", "description": "The ID of the email template to use.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "expiresDateTimeUtc", "in": "query", "description": "When the email expires. After this time it is not sent.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-01T00:00:00Z" }, { "name": "importance", "in": "query", "description": "The importance of the email. The default is Normal (1).", "required": false, "schema": { "$ref": "#/components/schemas/EmailImportance" } }, { "name": "priority", "in": "query", "description": "The priority of the email. The default is Normal (1).", "required": false, "schema": { "$ref": "#/components/schemas/EmailPriority" } } ], "requestBody": { "description": "An object of placeholder text and replacement values.\n\n- `(any key)` (string): A placeholder in the template mapped to the text that replaces it. Send an empty object when the template has no placeholders.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "string" } } } }, "required": true }, "responses": { "200": { "description": "The email was queued. The body is the queued email.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Email" } } } }, "400": { "description": "The template was not found or is empty (the body is an error message), or the user has no email address (the body is empty)." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only access." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Email/settings": { "get": { "tags": [ "Email" ], "summary": "Get the email settings", "description": "Returns the email settings record, which holds the mail server configuration the product uses to send email. The response is a single object, not an array.\n\nPermission required: Admin role (or the App role).", "operationId": "Email_GetAllEmailSettings", "responses": { "200": { "description": "The body is the email settings record.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailSettings" } } } }, "400": { "description": "The request failed. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No email settings exist yet. The body is a message." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Email" ], "summary": "Create the email settings", "description": "Creates the email settings record if it does not exist yet. The record is created with default values and the values in the request body are not applied, so call the update route afterward to set the mail server details.\n\nPermission required: Admin role (or the App role).\n\nCaution: The call fails once the email settings exist. If a create call reports an error, the record may still have been created, so check with the get route before you retry.", "operationId": "Email_CreateEmailSettings", "requestBody": { "description": "An email settings object. The server creates the record with default values and does not use the values sent.\n\n- `name` (string): Name of the settings record.\n- `description` (string): Description of the settings record.\n- `sendNotification` (boolean): Whether notification emails are sent.\n- `useTls` (boolean): Whether the connection to the mail server uses TLS.\n- `useAuth` (boolean): Whether the mail server requires authentication.\n- `smtpHost` (string): Host name of the mail server.\n- `smtpPort` (integer): Port of the mail server. Can be null.\n- `fromAddress` (string): Address the emails are sent from.\n- `credentialId` (string (GUID)): ID of the credential used to sign in to the mail server. Can be null.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailSettings" } } }, "required": true }, "responses": { "201": { "description": "The settings record was created. The body is the new record.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailSettings" } } } }, "400": { "description": "The email settings already exist (\"Only one email service allowed.\") or the record could not be created. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only access." }, "500": { "description": "The server failed while building the response. The settings record may still have been created, so check with the get route before you retry." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Email/settings/{id}": { "delete": { "tags": [ "Email" ], "summary": "Delete the email settings", "description": "Deletes the email settings record with the given ID and returns the record that was deleted.\n\nPermission required: Admin role (or the App role).\n\nCaution: The settings are deleted immediately and the call cannot be undone.", "operationId": "Email_DeleteEmailSettings", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the email settings record.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The settings were deleted. The body is the deleted record.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailSettings" } } } }, "400": { "description": "The request failed. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only access." }, "404": { "description": "No settings record has this ID." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Email" ], "summary": "Get email settings by ID", "description": "Returns the email settings record with the given ID.\n\nPermission required: Admin role (or the App role).", "operationId": "Email_GetEmailSettings", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the email settings record.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The body is the email settings record.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailSettings" }, "example": { "id": "00000000-0000-0000-0000-000000000000", "name": "", "description": "", "sendNotification": true, "useTls": true, "useAuth": true, "smtpHost": "smtp.example.com", "smtpPort": 587, "fromAddress": "", "credentialId": "00000000-0000-0000-0000-000000000000", "nodeId": "00000000-0000-0000-0000-000000000000", "createdDateTimeUtc": "2026-01-01T00:00:00Z", "modifiedDateTimeUtc": "2026-01-01T00:00:00Z" } } } }, "400": { "description": "The request failed. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No settings record has this ID." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Email" ], "summary": "Update the email settings", "description": "Replaces the email settings with the values in the request body and returns them. Use it to set the mail server, sender address and credential. The path ID must belong to an existing record; the record that is saved is the one named by the id in the body.\n\nPermission required: Admin role (or the App role).\n\nCaution: The new values take effect immediately for email that uses these settings.", "operationId": "Email_UpdateEmailSettings", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the email settings record.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "description": "The full email settings object.\n\n- `id` (string (GUID), required): ID of the settings record. Keep it the same as the ID in the path.\n- `name` (string): Name of the settings record.\n- `description` (string): Description of the settings record.\n- `sendNotification` (boolean): Whether notification emails are sent.\n- `useTls` (boolean): Whether the connection to the mail server uses TLS.\n- `useAuth` (boolean): Whether the mail server requires authentication.\n- `smtpHost` (string): Host name of the mail server.\n- `smtpPort` (integer): Port of the mail server. Can be null.\n- `fromAddress` (string): Address the emails are sent from.\n- `credentialId` (string (GUID)): ID of the credential used to sign in to the mail server. Can be null.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailSettingsUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The settings were updated. The body is the settings as sent, with the modified time set.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailSettings" } } } }, "400": { "description": "The request failed. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only access." }, "404": { "description": "No settings record has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Email/templates": { "get": { "tags": [ "Email" ], "summary": "List email templates", "description": "Returns all email templates. Use it to find the ID of a template to use when sending email or when setting up notifications.\n\nPermission required: Admin role (or the App role).\n\nValues for `emailSettings.type`: 0 = Generic, 1 = ConnectionProfile, 2 = EmailSettings, 3 = System.", "operationId": "Email_GetAllEmailTemplates", "responses": { "200": { "description": "The body is an array of email templates.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/EmailTemplate" } } } } }, "400": { "description": "The request failed. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Email" ], "summary": "Create an email template", "description": "Creates an email template and returns the new template.\n\nPermission required: Admin role (or the App role).\n\nValues for `emailSettings.type`: 0 = Generic, 1 = ConnectionProfile, 2 = EmailSettings, 3 = System.", "operationId": "Email_CreateEmailTemplate", "requestBody": { "description": "The template to create.\n\n- `name` (string): Name of the template. Not checked by the server.\n- `description` (string): Description of the template.\n- `htmlTemplate` (string): HTML used to format the email message. Not checked when saved, but sending from the template fails while it is empty.\n- `emailSettingsId` (string (GUID)): ID of the email settings used when emails are sent from this template. Can be null.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailTemplate" } } }, "required": true }, "responses": { "200": { "description": "The template was created. The body is the new template.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailTemplate" } } } }, "400": { "description": "The request failed. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only access." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Email/templates/{id}": { "delete": { "tags": [ "Email" ], "summary": "Delete an email template", "description": "Deletes the email template with the given ID and returns the template that was deleted.\n\nPermission required: Admin role (or the App role).", "operationId": "Email_DeleteEmailTemplate", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the email template.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The template was deleted. The body is the deleted template.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailTemplate" } } } }, "400": { "description": "The request failed. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only access." }, "404": { "description": "No template has this ID." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Email" ], "summary": "Get an email template", "description": "Returns the email template with the given ID.\n\nPermission required: Admin role (or the App role).\n\nValues for `emailSettings.type`: 0 = Generic, 1 = ConnectionProfile, 2 = EmailSettings, 3 = System.", "operationId": "Email_GetEmailTemplate", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the email template.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The body is the email template.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailTemplate" } } } }, "400": { "description": "The request failed. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No template has this ID." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Email" ], "summary": "Update an email template", "description": "Updates the email template and returns the saved template. The template to update is identified by the id in the request body, so keep it the same as the ID in the path.\n\nPermission required: Admin role (or the App role).\n\nValues for `emailSettings.type`: 0 = Generic, 1 = ConnectionProfile, 2 = EmailSettings, 3 = System.\n\nCaution: The change applies immediately to every message later built from this template.", "operationId": "Email_UpdateEmailTemplate", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the email template.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "description": "The full email template object.\n\n- `id` (string (GUID), required): ID of the template. Should match the ID in the path.\n- `name` (string): Name of the template. Not checked by the server.\n- `description` (string): Description of the template.\n- `htmlTemplate` (string): HTML used to format the email message. Not checked when saved, but sending from the template fails while it is empty.\n- `emailSettingsId` (string (GUID)): ID of the email settings used when emails are sent from this template. Can be null.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailTemplateUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The template was updated. The body is the saved template.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailTemplate" } } } }, "400": { "description": "The request failed. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only access." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Email/{id}": { "delete": { "tags": [ "Email" ], "summary": "Delete a queued email", "description": "Deletes the email with the given ID from the email queue and returns the email that was deleted.\n\nPermission required: Admin role (or the App role).", "operationId": "Email_Delete", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the email.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The email was deleted. The body is the deleted email.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Email" } } } }, "400": { "description": "The request failed. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only access." }, "404": { "description": "No email has this ID." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Email" ], "summary": "Get an email", "description": "Returns the email with the given ID, including its recipients, subject and body.\n\nPermission required: Admin role (or the App role).", "operationId": "Email_Get", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the email.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The body is the email.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Email" } } } }, "400": { "description": "The request failed. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No email has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/EncryptedFile/BySecretVaultIdAndName": { "get": { "tags": [ "Encrypted File" ], "summary": "Get a file record by name", "description": "Returns the details of the file with the given name in a vault secret. The response describes the file but does not include its content.\n\nPermission required: Admin role (or the App role).\n\nCaution: The response identifies stored files for a vault secret.", "operationId": "EncryptedFile_GetBySecretVaultIdAndName", "parameters": [ { "name": "secretVaultId", "in": "query", "description": "The ID of the vault secret that holds the file.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" }, { "name": "name", "in": "query", "description": "The file name. The match ignores case.", "required": true, "schema": { "type": "string" }, "example": "file.txt" } ], "responses": { "200": { "description": "The body is the file record without its content.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncryptedFile" }, "example": { "id": "00000000-0000-0000-0000-000000000000", "secretVaultId": "00000000-0000-0000-0000-000000000000", "secretVaultName": "Example vault", "name": "example.pem", "size": 1234, "contentType": "application/x-pem-file", "content": "", "checksum": "", "description": "Example description", "createdBy": "00000000-0000-0000-0000-000000000000", "modifiedBy": "00000000-0000-0000-0000-000000000000", "nodeId": "00000000-0000-0000-0000-000000000000", "createdDateTimeUtc": "2026-01-01T00:00:00Z", "modifiedDateTimeUtc": "2026-01-01T00:00:00Z" } } } }, "400": { "description": "The name is missing or the lookup failed. The body is an error message." }, "401": { "description": "The caller is not signed in." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No file with this name exists in the secret." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/EncryptedFile/Delete": { "delete": { "tags": [ "Encrypted File" ], "summary": "Delete encrypted files", "description": "Deletes the encrypted files whose IDs are listed in the request body and removes them from any access policy that uses them. Every ID is checked first, so if any ID is not found, nothing is deleted. Each deletion is recorded as an event. The server reads the list from the request body of this DELETE request, so the body is required. Some HTTP clients and API tools drop the body of a DELETE request; check that yours sends it.\n\nPermission required: Admin role (or the App role).\n\nCaution: The files are deleted immediately and cannot be recovered.", "operationId": "EncryptedFile_Delete", "requestBody": { "description": "An array of file IDs.\n\n- `(array item)` (string (GUID), required): The ID of a file to delete.", "required": true, "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "example": [ "00000000-0000-0000-0000-000000000000" ] } } }, "responses": { "200": { "description": "The files were deleted." }, "400": { "description": "An ID was not found or the files could not be deleted. The body is an error message." }, "401": { "description": "The caller is not signed in." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only access." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/EncryptedFile/Download": { "get": { "tags": [ "Encrypted File" ], "summary": "Download an encrypted file", "description": "Returns the decrypted content of the file with the given ID as a file download. The download is recorded as an event that names the user and the file.\n\nPermission required: Admin role (or the App role).\n\nCaution: The response is the file in clear text, which can contain sensitive values.", "operationId": "EncryptedFile_Download", "parameters": [ { "name": "id", "in": "query", "description": "The ID of the file to download.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The body is the file content, sent with the file's name and content type.", "content": { "application/octet-stream": { "schema": { "type": "string", "format": "binary" } } } }, "400": { "description": "The download failed. The body is an error message." }, "401": { "description": "The caller is not signed in." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No file has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/EncryptedFile/SearchBySecretVaultId": { "get": { "tags": [ "Encrypted File" ], "summary": "Search the files of a vault secret", "description": "Returns a page of the files stored in a vault secret, optionally filtered by text. The file content is not included. The search is recorded as an event.\n\nPermission required: Admin role (or the App role).\n\nCaution: The search is written to the event log under the signed-in user.", "operationId": "EncryptedFile_SearchBySecretVaultId", "parameters": [ { "name": "secretVaultId", "in": "query", "description": "The ID of the vault secret that holds the file.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" }, { "name": "filterText", "in": "query", "description": "Text to match in the file name, description or content type. The match ignores case.", "required": false, "schema": { "type": "string", "nullable": true }, "example": "report" }, { "name": "orderBy", "in": "query", "description": "The property to sort by. The default is the creation time.", "required": false, "schema": { "type": "string", "nullable": true }, "example": "Name" }, { "name": "orderDescending", "in": "query", "description": "When true, sorts in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "The number of rows to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of rows to return. The default is 25.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 25 }, "example": 25 } ], "responses": { "200": { "description": "The body is a table object with the matching rows in data and the total in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfEncryptedFile" }, "example": { "data": [ { "id": "00000000-0000-0000-0000-000000000000", "secretVaultId": "00000000-0000-0000-0000-000000000000", "name": "example.pem", "size": 1234, "contentType": "application/x-pem-file", "description": "Example description" } ], "recordsTotal": 1 } } } }, "400": { "description": "The search failed. The body is an error message." }, "401": { "description": "The caller is not signed in." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/EncryptedFile/Upload/{secretVaultId}": { "post": { "tags": [ "Encrypted File" ], "summary": "Upload files to a vault secret", "description": "Uploads one or more files in a multipart form and stores them encrypted in the vault secret. A file with the same name and content type as a file already in the secret replaces that file. When malware scanning is turned on in the encrypted file settings, each file is scanned before it is stored.\n\nPermission required: Admin role (or the App role).\n\nCaution: Uploading a file with the same name and content type as an existing file in the secret replaces that file's content immediately. Files are stored one at a time, so if a later file in the same request fails (for example the malware scan), earlier files in that request are already stored.", "operationId": "EncryptedFile_Upload", "parameters": [ { "name": "secretVaultId", "in": "path", "description": "The ID of the vault secret to store the files in.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" }, { "name": "description", "in": "query", "description": "A description saved with the files. When omitted, new files get an empty description and replaced files keep their existing description.", "required": false, "schema": { "type": "string", "default": "" }, "example": "Contract" } ], "requestBody": { "description": "A multipart/form-data body with one file part per file.\n\n- `(file part)` (file, required): A file to store. The part's file name and content type are saved with it. Each file must be within the maximum size set in the encrypted file settings (in MB).\n\nExample request:\n\n```\ncurl -X POST \"https://HOST:6500/api/v1/EncryptedFile/Upload/SECRET_VAULT_ID?description=Example%20description\" -H \"Authorization: Bearer TOKEN\" -F \"example.pem=@example.pem;type=application/x-pem-file\"\n```", "required": true, "content": { "multipart/form-data": { "schema": { "type": "object", "additionalProperties": { "type": "string", "format": "binary" } } } } }, "responses": { "200": { "description": "The files were stored. The body is a summary with secretVaultId, description, fileCount, totalSize, uploadTime and details, a list with the id, name, contentType, size, checksum and timestamps of each file.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FileUploadSummary" }, "example": { "secretVaultId": "00000000-0000-0000-0000-000000000000", "description": "Example description", "fileCount": 1, "totalSize": 1234, "uploadTime": "12.5ms", "details": [ { "id": "00000000-0000-0000-0000-000000000000", "name": "example.pem", "contentType": "application/x-pem-file", "size": 1234, "checksum": "", "createdDateTimeUtc": "2026-01-01T00:00:00Z", "modifiedDateTimeUtc": "2026-01-01T00:00:00Z" } ] } } } }, "204": { "description": "The request had no content type, so nothing was stored." }, "400": { "description": "The vault secret was not found, a file is too large or invalid, the malware scan failed, or the upload failed. The body is an error message." }, "401": { "description": "The caller is not signed in." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only access." }, "415": { "description": "The content type is not multipart/form-data." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/EncryptedFile/{id}": { "put": { "tags": [ "Encrypted File" ], "summary": "Update a file description", "description": "Updates the description of an encrypted file and returns the file record without its content. Only the description changes.\n\nPermission required: Admin role (or the App role).", "operationId": "EncryptedFile_Update", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the file.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncryptedFile" }, "example": { "description": "Example description" } } }, "required": true, "description": "The file object. Only the description is used.\n\n- `description` (string): The new description of the file. If omitted, the description is cleared." }, "responses": { "200": { "description": "The file was updated. The body is the file record without its content.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncryptedFile" }, "example": { "id": "00000000-0000-0000-0000-000000000000", "secretVaultId": "00000000-0000-0000-0000-000000000000", "name": "example.pem", "size": 1234, "contentType": "application/x-pem-file", "content": "", "checksum": "", "description": "Example description" } } } }, "400": { "description": "The update failed. The body is an error message." }, "401": { "description": "The caller is not signed in." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only access." }, "404": { "description": "No file has this ID. The body is a message." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/EventMessage": { "get": { "tags": [ "Event Message" ], "summary": "List recent events", "description": "Returns events from the event log, newest first. Use skip and take to page through them.\n\nPermission required: Admin, App, or Auditing and Reporting role.\n\nValues for `eventType`: 0 = Unspecified, 1 = Status, 2 = ServiceStart, 3 = PasswordRotation, 4 = HostScan, 5 = ADSync, 6 = ActivitySession, 7 = Manage, 8 = Unmanage, 9 = Verify, 10 = RotateServices, 11 = CommandRestrictionAction.\n\nValues for `status`: 0 = Information, 1 = Warning, 2 = Error.\n\nValues for `serviceType`: 0 = Unspecified, 1 = WebUi, 2 = ActionService, 3 = ProxyService, 4 = SchedulerService, 5 = EmailService, 6 = ADSyncService, 7 = RagGateway, 8 = RagPortal.", "operationId": "EventMessage_GetAll", "parameters": [ { "name": "skip", "in": "query", "description": "The number of events to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of events to return. The default is 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 } ], "responses": { "200": { "description": "The body is an array of events.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/EventMessage" } } } } }, "400": { "description": "The request failed. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/EventMessage/Search": { "get": { "tags": [ "Event Message" ], "summary": "Search events", "description": "Returns a page of events matching the filters. Filter by text, event type, service, status, resource, account, account group, domain or activity session. Use it to build audit views.\n\nPermission required: Admin, App, or Auditing and Reporting role.\n\nValues for `eventType`: 0 = Unspecified, 1 = Status, 2 = ServiceStart, 3 = PasswordRotation, 4 = HostScan, 5 = ADSync, 6 = ActivitySession, 7 = Manage, 8 = Unmanage, 9 = Verify, 10 = RotateServices, 11 = CommandRestrictionAction.\n\nValues for `status`: 0 = Information, 1 = Warning, 2 = Error.\n\nValues for `serviceType`: 0 = Unspecified, 1 = WebUi, 2 = ActionService, 3 = ProxyService, 4 = SchedulerService, 5 = EmailService, 6 = ADSyncService, 7 = RagGateway, 8 = RagPortal.", "operationId": "EventMessage_Search", "parameters": [ { "name": "filterText", "in": "query", "description": "Text to search for in the event message. The match ignores case.", "required": false, "schema": { "type": "string" }, "example": "rotation" }, { "name": "orderBy", "in": "query", "description": "The property to sort by. When omitted, events are sorted newest first.", "required": false, "schema": { "type": "string" }, "example": "EventTimeUtc" }, { "name": "orderDescending", "in": "query", "description": "When true, sorts in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": true }, { "name": "skip", "in": "query", "description": "The number of rows to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of rows to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 }, { "name": "filterEventType", "in": "query", "description": "Only events of this type. See the `Values for` paragraphs in the operation description.", "required": false, "schema": { "$ref": "#/components/schemas/EventType" } }, { "name": "filterServiceType", "in": "query", "description": "Only events logged by this service. See the `Values for` paragraphs in the operation description.", "required": false, "schema": { "$ref": "#/components/schemas/EventServiceType" } }, { "name": "filterStatus", "in": "query", "description": "Only events with this status. See the `Values for` paragraphs in the operation description.", "required": false, "schema": { "$ref": "#/components/schemas/EventStatus" } }, { "name": "domainConfigId", "in": "query", "description": "Only events for the resource that represents this domain. When set, it replaces managedResourceId. If no domain resource matches this ID, the call fails with a server error.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "managedResourceId", "in": "query", "description": "Only events for this resource.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "managedAccountId", "in": "query", "description": "Only events for this managed account.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "managedAccountGroupId", "in": "query", "description": "Only events for the accounts in this group. An ID that matches no group applies no filter.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" }, { "name": "sessionId", "in": "query", "description": "Only events for this activity session.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "200": { "description": "The body is a table object with the matching events in data and the total in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfEventMessage" } } } }, "400": { "description": "A parameter value could not be read, for example an ID that is not a GUID or a filter value that is not a valid number or name." }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The domainConfigId matches no domain resource, or the search failed unexpectedly." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/EventMessage/{id}": { "get": { "tags": [ "Event Message" ], "summary": "Get an event", "description": "Returns the event with the given ID.\n\nPermission required: Admin, App, or Auditing and Reporting role.\n\nValues for `eventType`: 0 = Unspecified, 1 = Status, 2 = ServiceStart, 3 = PasswordRotation, 4 = HostScan, 5 = ADSync, 6 = ActivitySession, 7 = Manage, 8 = Unmanage, 9 = Verify, 10 = RotateServices, 11 = CommandRestrictionAction.\n\nValues for `status`: 0 = Information, 1 = Warning, 2 = Error.\n\nValues for `serviceType`: 0 = Unspecified, 1 = WebUi, 2 = ActionService, 3 = ProxyService, 4 = SchedulerService, 5 = EmailService, 6 = ADSyncService, 7 = RagGateway, 8 = RagPortal.", "operationId": "EventMessage_Get", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the event.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The body is the event.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EventMessage" } } } }, "400": { "description": "The request failed. The body is an error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No event has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/GennixCommandPlan": { "post": { "tags": [ "Command Plan" ], "summary": "Create a command plan", "description": "Creates a command plan, with its command sets, commands and result actions, on a platform. The platform must be a custom platform created from a base platform.\n\nPermission required: Administrator role or application role. The session must have completed multifactor authentication.\n\nCaution: The new plan and the commands in it are saved immediately, and the commands can later run against the systems that use the platform.", "operationId": "CommandPlan_Post", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CommandPlanCreateRequest" } } }, "required": true, "description": "The command plan to create, including its nested command sets, commands and result actions.\n\n- `id` (string (GUID)): ID of the command plan. Optional. If you leave it out, the system assigns one.\n- `platformId` (string (GUID), required): ID of the platform the plan belongs to. Must be a custom platform created from a base platform. Otherwise nothing is created and the response is 204.\n- `name` (string): Name of the command plan. The server does not check it, but the name is how other routes find the plan by name.\n- `description` (string): Description of the command plan.\n- `connectionType` (string): Connection type the plan uses.\n- `permanent` (boolean): Marks the plan as permanent.\n- `commandSets` (array): Ordered command sets in the plan. Each command set has an id, name, description, executionOrder and a commands array. Each command has an id, commandToSend, commandScript, executionOrder and a resultActions array. Each result action has an id, expectedResult, executionOrder and flags that control how the output is matched and what happens next. Do not send nodeId, createdDateTimeUtc or modifiedDateTimeUtc; the system sets them." }, "responses": { "200": { "description": "The plan was created. The response body is the created command plan.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CommandPlan" } } } }, "204": { "description": "The platform is missing or is not a custom platform created from a base platform. Nothing is created and the response has no body." }, "400": { "description": "The body is missing, a plan with the same ID already exists, a command script was rejected by the malware scan, or the plan could not be created. The response text explains why." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/GennixCommandPlan/ByNameAndPlatformId/{name}/{platformId}": { "get": { "tags": [ "Command Plan" ], "summary": "Get a command plan by name and platform", "description": "Returns the command plan with the given name on the given platform, including its command sets, commands and result actions. The name match ignores letter case.\n\nPermission required: Administrator role or application role. The session must have completed multifactor authentication.\n\nCaution: The response contains the full text of every command and script in the plan, which can include sensitive content.", "operationId": "CommandPlan_RequestCommandPlanByNameAndPlatformId", "parameters": [ { "name": "name", "in": "path", "description": "Name of the command plan.", "required": true, "schema": { "type": "string" }, "example": "example-plan" }, { "name": "platformId", "in": "path", "description": "ID of the platform the plan belongs to.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The command plan, with its command sets, commands and result actions in execution order.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CommandPlan" }, "example": { "id": "00000000-0000-0000-0000-000000000000", "platformId": "00000000-0000-0000-0000-000000000000", "name": "", "description": "", "connectionType": "", "permanent": false, "commandSets": [] } } } }, "400": { "description": "The request failed. The response text explains why." }, "404": { "description": "No plan with that name exists on that platform." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/GennixCommandPlan/ByPlatformId": { "get": { "tags": [ "Command Plan" ], "summary": "List all command plans for a platform", "description": "Returns every command plan on the platform, each with its command sets, commands and result actions. Use NamesAndIds instead when you only need plan names and IDs.\n\nPermission required: Administrator role or application role. The session must have completed multifactor authentication.\n\nCaution: The response contains the full text of every command and script in every plan on the platform, which can include sensitive content.", "operationId": "CommandPlan_GetByPlatformId", "parameters": [ { "name": "platformId", "in": "query", "description": "ID of the platform whose command plans to return.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "A list of command plans. The list is empty when the platform has none.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/CommandPlan" } }, "example": [ { "id": "00000000-0000-0000-0000-000000000000", "platformId": "00000000-0000-0000-0000-000000000000", "name": "", "commandSets": [] } ] } } }, "400": { "description": "The request failed. The response text explains why." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/GennixCommandPlan/NamesAndIds": { "get": { "tags": [ "Command Plan" ], "summary": "List command plan names and IDs for a platform", "description": "Returns the name and ID of each command plan on the platform. Use it to populate a picker or to find a plan ID before calling Get.\n\nPermission required: Administrator role or application role. The session must have completed multifactor authentication.", "operationId": "CommandPlan_GetNames", "parameters": [ { "name": "platformId", "in": "query", "description": "ID of the platform whose command plans to list.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "A list of objects, each with an id and a name. The list is empty when the platform has none.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } }, "example": [ { "id": "00000000-0000-0000-0000-000000000000", "name": "" } ] } } }, "400": { "description": "The request failed. The response text explains why." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/GennixCommandPlan/{commandPlanId}": { "delete": { "tags": [ "Command Plan" ], "summary": "Delete a command plan and its contents", "description": "Deletes the command plan together with its command sets, commands and result actions. Use it to remove a plan you no longer need.\n\nPermission required: Administrator role or application role. The session must have completed multifactor authentication.\n\nCaution: The deletion takes effect immediately, cannot be undone, and also removes every command set, command and result action in the plan.", "operationId": "CommandPlan_Delete", "parameters": [ { "name": "commandPlanId", "in": "path", "description": "ID of the command plan to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The command plan and its contents were deleted. The response has no body." }, "400": { "description": "The plan could not be deleted. The response text explains why." }, "404": { "description": "No command plan exists with that ID." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Command Plan" ], "summary": "Get a command plan by ID", "description": "Returns the command plan with its command sets, commands and result actions in execution order.\n\nPermission required: Administrator role or application role. The session must have completed multifactor authentication.", "operationId": "CommandPlan_RequestCommandPlanById", "parameters": [ { "name": "commandPlanId", "in": "path", "description": "ID of the command plan.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The command plan.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CommandPlan" } } } }, "400": { "description": "The request failed. The response text explains why." }, "404": { "description": "No command plan exists with that ID." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Command Plan" ], "summary": "Update a command plan", "description": "Updates the command plan and its command sets, commands and result actions to match the body. The plan's platform must be a custom platform created from a base platform.\n\nPermission required: Administrator role or application role. The session must have completed multifactor authentication.\n\nCaution: Command sets, commands and result actions that are in the saved plan but missing from the body are deleted.", "operationId": "CommandPlan_Update", "parameters": [ { "name": "commandPlanId", "in": "path", "description": "ID of the command plan to update.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CommandPlanUpdateRequest" } } }, "required": true, "description": "The full command plan as it should be after the update. Start from the plan returned by a get and change it, because every value in the body replaces the saved value.\n\n- `id` (string (GUID), required): ID of the command plan. Set it to the same value as commandPlanId in the path. The update is applied to the plan with this ID; if it is missing or unknown, the call returns 400.\n- `platformId` (string (GUID), required): ID of the platform the plan belongs to. The saved plan must belong to a custom platform created from a base platform.\n- `name` (string): Name of the command plan. The update replaces the saved name with this value, so send the current name unless you are renaming the plan.\n- `description` (string): Description of the command plan.\n- `connectionType` (string): Connection type the plan uses.\n- `permanent` (boolean): Marks the plan as permanent.\n- `commandSets` (array): Ordered command sets in the plan. Each command set has an id, name, description, executionOrder and a commands array. Each command has an id, commandToSend, commandScript, executionOrder and a resultActions array. Each result action has an id, expectedResult, executionOrder and flags that control how the output is matched and what happens next. Include every command set, command and result action you want to keep, with their IDs. Items without a matching ID are added." }, "responses": { "200": { "description": "The plan was updated. The response body is the updated command plan.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CommandPlan" } } } }, "400": { "description": "The body is missing, the body ID does not match a saved plan, the platform is not a custom platform, or the update failed. The response text explains why." }, "404": { "description": "No command plan exists with that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Group/AsTable": { "get": { "tags": [ "Group" ], "summary": "Search Active Directory groups with paging", "description": "Returns a page of Active Directory groups known to Privilege Secure, with the total group count. Use it to browse or search groups.\n\nPermission required: Administrator role or application role.", "operationId": "Group_GetAllHostGroups", "parameters": [ { "name": "skip", "in": "query", "description": "Number of groups to skip. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of groups to return. Defaults to 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "sortColumn", "in": "query", "description": "Name of the group property to sort by, for example name. If it is omitted or not a property, the results are unsorted.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "sortDirection", "in": "query", "description": "Sort direction, asc or desc (lowercase). Defaults to desc. Applies only when sortColumn names a group property; any other value leaves the results unsorted.", "required": false, "schema": { "type": "string", "default": "desc" }, "example": "asc" }, { "name": "q", "in": "query", "description": "Search text. Matches groups whose name, account name or email address contains it, ignoring letter case.", "required": false, "schema": { "type": "string" }, "example": "example" }, { "name": "FilterManaged", "in": "query", "description": "Set to true to return only groups that are not deleted and are not yet used as managed account groups. Defaults to false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "managed", "in": "query", "description": "Accepted but has no effect.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "An object with a data array of groups and a recordsTotal count. recordsTotal is the total number of groups, not the number that match the search text or the FilterManaged filter.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfActiveDirectoryGroup" } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Group/ForUser/{userId}": { "get": { "tags": [ "Group" ], "summary": "List local groups an account belongs to", "description": "Returns the groups that the specified host account belongs to, on hosts that are managed resources. Use it to show an account's local group memberships.\n\nPermission required: Administrator role or application role.", "operationId": "Group_GetGroupsForUser", "parameters": [ { "name": "userId", "in": "path", "description": "ID of the host account (local user) whose groups to return.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "A list of groups, each with id, name, hostId, hostName, managedResourceId, managedResourceName and managedResourceDisplayName. A group on a host with several managed resources appears once per managed resource. The list is empty when the account has no matching groups.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/HostGroupInfo" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Group/{id}": { "get": { "tags": [ "Group" ], "summary": "Get an Active Directory group by ID", "description": "Returns the Active Directory group with the specified ID.\n\nPermission required: Administrator role or application role.", "operationId": "Group_Get", "parameters": [ { "name": "id", "in": "path", "description": "ID of the Active Directory group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActiveDirectoryGroup" } } } }, "204": { "description": "No group matches the ID, so the response has no body." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/GroupRole/candidates": { "get": { "tags": [ "Group Role" ], "summary": "List groups and roles you can select across platforms", "description": "Returns a combined, paged list of Active Directory groups, Entra ID groups and directory roles, and SQL Server and Oracle database roles. Use it to choose a group or role for an access policy or similar setting. Entra ID directory roles appear only for tenants that have a service account configured, and an Entra tenant whose roles cannot be read is skipped without an error. Deleted Active Directory groups and groups in domains linked to an Entra ID tenant are left out.\n\nPermission required: Administrator role or application role.", "operationId": "GroupRole_GetCandidates", "parameters": [ { "name": "platformType", "in": "query", "description": "Limits results to one platform: AD, Entra, SQL or Oracle (not case-sensitive). Omit it to include all. Any other value returns an empty page.", "required": false, "schema": { "type": "string" }, "example": "AD" }, { "name": "skip", "in": "query", "description": "Number of items to skip. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of items to return. Defaults to 100; values above 1000 are reduced to 1000.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 }, { "name": "q", "in": "query", "description": "Search text. Matches names (and account names for Active Directory groups, descriptions for Entra roles), ignoring letter case.", "required": false, "schema": { "type": "string" }, "example": "example" }, { "name": "orderBy", "in": "query", "description": "Sort column: name, type, platformName or context. Without it, results sort by type and then name.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. Defaults to false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "An object with a data array of candidates and a recordsTotal count of all matches before paging. Each item has id, name, type, platformId, platformName, context and additionalInfo, plus hostId, hostDatabaseId, domainId or tenantId where they apply.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfGroupRoleCandidate" }, "example": { "data": [ { "id": "00000000-0000-0000-0000-000000000000", "name": "", "type": "AD", "platformId": "00000000-0000-0000-0000-000000000000", "platformName": "", "context": "", "additionalInfo": "", "hostId": null, "hostDatabaseId": null, "domainId": null, "tenantId": null } ], "recordsTotal": 1 } } } }, "500": { "description": "The list could not be built. The response includes an error and message." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/GroupRole/{id}": { "get": { "tags": [ "Group Role" ], "summary": "Get a group or role by ID", "description": "Returns one group or role from any supported platform. The ID can belong to a SQL Server or Oracle database role, an Entra ID group, or an on-premises Active Directory group. Entra ID directory roles listed by the candidates route cannot be fetched by ID.\n\nPermission required: Administrator role or application role.", "operationId": "GroupRole_Get", "parameters": [ { "name": "id", "in": "path", "description": "ID of the group or role, as returned by the candidates list. IDs of Entra ID directory roles are not accepted and return 404.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The group or role. Each item has id, name, type, platformId, platformName, context and additionalInfo, plus hostId, hostDatabaseId, domainId or tenantId where they apply.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GroupRoleCandidate" }, "example": { "id": "00000000-0000-0000-0000-000000000000", "name": "", "type": "SQL", "platformId": "00000000-0000-0000-0000-000000000000", "platformName": "", "context": "Server-level Role", "additionalInfo": " - Server Role", "hostId": "00000000-0000-0000-0000-000000000000", "hostDatabaseId": "00000000-0000-0000-0000-000000000000", "domainId": null, "tenantId": null } } } }, "404": { "description": "No group or role has that ID. The response includes an error and the ID." }, "500": { "description": "The lookup failed. The response includes an error and message." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Host": { "post": { "tags": [ "Host" ], "summary": "Create a host record", "description": "Creates a host record. A host record must be paired with a managed resource before Privilege Secure can use it; managed resources are normally created by a host scan or the managed resource endpoints.\n\nPermission required: Administrator role or application role. The session must have completed multifactor authentication.\n\nCaution: The host record is created immediately; a host with no managed resource is not usable until one is added.", "operationId": "Host_Create", "requestBody": { "description": "The host to create. Send only the host's own fields and leave related lists such as users and groups out of the body. Other host properties that a get returns, such as samaccountname, isGlobalCatalog and objectSid, are also accepted in the body.\n\n- `id` (string (GUID)): ID of the host. Optional. If you leave it out, the system assigns one.\n- `name` (string): Name of the host.\n- `dnsHostName` (string): DNS host name.\n- `netBiosName` (string): NetBIOS name.\n- `distinguishedName` (string): Active Directory distinguished name.\n- `ipAddress` (string): IP address of the host.\n- `os` (string): Operating system name.\n- `version` (string): Operating system version.\n- `hasSSH` (boolean): True if the host supports SSH.\n- `credentialId` (string (GUID)): ID of the service account credential for the host.\n- `activeDirectoryDomainId` (string (GUID)): ID of the domain the host belongs to.\n- `activeDirectoryObjectId` (string (GUID)): ID from Active Directory sync, usually the same as the host ID.\n- `isVirtual` (boolean): True for virtual hosts such as Entra ID tenants.\n- `platformId` (string (GUID)): ID of the platform assigned to the host.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Host" }, "example": { "id": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "activeDirectoryObjectId": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a", "name": "example\\host", "distinguishedName": "CN=Host,OU=42,DC=example,DC=local", "ipAddress": "192.0.2.10", "os": "Windows Server 2022", "version": "10.0.20348", "lsaLookupCache": null, "lastUpdatedDateTimeUtc": "2024-03-17T21:16:00Z", "credentialId": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f", "hasSSH": false, "activeDirectoryDomainId": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e", "dnsHostName": "host.example.com", "netBiosName": "Host", "users": [], "groups": [], "features": [], "services": [], "scheduledTasks": [], "databases": [], "databaseDbs": [], "databaseRoles": [], "samaccountname": "EXAMPLE\\Host", "isDomainController": false, "isGlobalCatalog": false, "usnChanged": 12345, "objectSid": "S-1-5-21-1234567890-1234567890-123456789-123456", "added": "2019-08-24T19:15:22Z", "deleted": false, "isVirtual": false, "nodeId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "createdDateTimeUtc": "0001-01-01T00:00:00Z", "modifiedDateTimeUtc": "0001-01-01T00:00:00Z" } } }, "required": true }, "responses": { "200": { "description": "The host was created. The response body is the host record.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Host" }, "example": { "id": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "activeDirectoryObjectId": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a", "name": "example\\host", "distinguishedName": "CN=Host,OU=42,DC=example,DC=local", "ipAddress": "192.0.2.10", "os": "Windows Server 2022", "version": "10.0.20348", "lsaLookupCache": null, "lastUpdatedDateTimeUtc": "2024-03-17T21:16:00Z", "credentialId": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f", "hasSSH": false, "activeDirectoryDomainId": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e", "dnsHostName": "host.example.com", "netBiosName": "Host", "users": [], "groups": [], "features": [], "services": [], "scheduledTasks": [], "databases": [], "databaseDbs": [], "databaseRoles": [], "samaccountname": "EXAMPLE\\Host", "isDomainController": false, "isGlobalCatalog": false, "usnChanged": 12345, "objectSid": "S-1-5-21-1234567890-1234567890-123456789-123456", "added": "2019-08-24T19:15:22Z", "deleted": false, "isVirtual": false, "nodeId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "createdDateTimeUtc": "0001-01-01T00:00:00Z", "modifiedDateTimeUtc": "0001-01-01T00:00:00Z" } } } }, "400": { "description": "The host could not be created. The response text explains why." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Host/{id}": { "get": { "tags": [ "Host" ], "summary": "Get a host by ID", "description": "Returns the host record with its name, addresses, operating system and IDs. Related lists such as users, groups, features, services and scheduled tasks are always returned empty; use the host list routes to read them.\n\nPermission required: Administrator role or application role. The session must have completed multifactor authentication.\n\nCaution: The response includes network details for the host, such as its IP address, and the ID of the service account credential assigned to it.", "operationId": "Host_GetHostById", "parameters": [ { "name": "id", "in": "path", "description": "ID of the host.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "includeReferencedLists", "in": "query", "description": "Set to true to also return the host's domain record and to skip hosts marked as deleted. Defaults to false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "The host record.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Host" }, "example": { "id": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "activeDirectoryObjectId": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a", "name": "example\\host", "distinguishedName": "CN=Host,OU=42,DC=example,DC=local", "ipAddress": "192.0.2.10", "os": "Windows Server 2022", "version": "10.0.20348", "lsaLookupCache": null, "lastUpdatedDateTimeUtc": "2024-03-17T21:16:00Z", "credentialId": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f", "hasSSH": false, "activeDirectoryDomainId": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e", "dnsHostName": "host.example.com", "netBiosName": "Host", "users": [], "groups": [], "features": [], "services": [], "scheduledTasks": [], "databases": [], "databaseDbs": [], "databaseRoles": [], "samaccountname": "EXAMPLE\\Host", "isDomainController": false, "isGlobalCatalog": false, "usnChanged": 12345, "objectSid": "S-1-5-21-1234567890-1234567890-123456789-123456", "added": "2019-08-24T19:15:22Z", "deleted": false, "isVirtual": false, "nodeId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "createdDateTimeUtc": "0001-01-01T00:00:00Z", "modifiedDateTimeUtc": "0001-01-01T00:00:00Z" } } } }, "400": { "description": "The host could not be retrieved." }, "404": { "description": "No host exists with that ID." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Host" ], "summary": "Update a host record", "description": "Updates the host record with the values in the body. The ID in the body must match the ID in the URL.\n\nPermission required: Administrator role or application role. The session must have completed multifactor authentication.\n\nCaution: The change takes effect immediately and replaces every saved value, so fields you leave out are cleared; start from the record returned by a get.", "operationId": "Host_Put", "parameters": [ { "name": "id", "in": "path", "description": "ID of the host to update.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "description": "The full host record with its updated values and the same ID as in the URL. Related lists in the body are ignored. Other host properties that a get returns, such as samaccountname, isGlobalCatalog and objectSid, are also accepted in the body.\n\n- `id` (string (GUID), required): ID of the host. Must equal the ID in the URL; otherwise the call returns 400.\n- `name` (string): Name of the host.\n- `dnsHostName` (string): DNS host name.\n- `netBiosName` (string): NetBIOS name.\n- `distinguishedName` (string): Active Directory distinguished name.\n- `ipAddress` (string): IP address of the host.\n- `os` (string): Operating system name.\n- `version` (string): Operating system version.\n- `hasSSH` (boolean): True if the host supports SSH.\n- `credentialId` (string (GUID)): ID of the service account credential for the host.\n- `activeDirectoryDomainId` (string (GUID)): ID of the domain the host belongs to.\n- `activeDirectoryObjectId` (string (GUID)): ID from Active Directory sync, usually the same as the host ID.\n- `isVirtual` (boolean): True for virtual hosts such as Entra ID tenants.\n- `platformId` (string (GUID)): ID of the platform assigned to the host.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostUpdateRequest" }, "example": { "id": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "activeDirectoryObjectId": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a", "name": "example\\host", "distinguishedName": "CN=Host,OU=42,DC=example,DC=local", "ipAddress": "192.0.2.10", "os": "Windows Server 2022", "version": "10.0.20348", "lsaLookupCache": null, "lastUpdatedDateTimeUtc": "2024-03-17T21:16:00Z", "credentialId": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f", "hasSSH": false, "activeDirectoryDomainId": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e", "dnsHostName": "host.example.com", "netBiosName": "Host", "users": [], "groups": [], "features": [], "services": [], "scheduledTasks": [], "databases": [], "databaseDbs": [], "databaseRoles": [], "samaccountname": "EXAMPLE\\Host", "isDomainController": false, "isGlobalCatalog": false, "usnChanged": 12345, "objectSid": "S-1-5-21-1234567890-1234567890-123456789-123456", "added": "2019-08-24T19:15:22Z", "deleted": false, "isVirtual": false, "nodeId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "createdDateTimeUtc": "0001-01-01T00:00:00Z", "modifiedDateTimeUtc": "0001-01-01T00:00:00Z" } } }, "required": true }, "responses": { "200": { "description": "The host was updated. The response body is the updated host record.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Host" }, "example": { "id": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b", "activeDirectoryObjectId": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a", "name": "example\\host", "distinguishedName": "CN=Host,OU=42,DC=example,DC=local", "ipAddress": "192.0.2.10", "os": "Windows Server 2022", "version": "10.0.20348", "lsaLookupCache": null, "lastUpdatedDateTimeUtc": "2024-03-17T21:16:00Z", "credentialId": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f", "hasSSH": false, "activeDirectoryDomainId": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e", "dnsHostName": "host.example.com", "netBiosName": "Host", "users": [], "groups": [], "features": [], "services": [], "scheduledTasks": [], "databases": [], "databaseDbs": [], "databaseRoles": [], "samaccountname": "EXAMPLE\\Host", "isDomainController": false, "isGlobalCatalog": false, "usnChanged": 12345, "objectSid": "S-1-5-21-1234567890-1234567890-123456789-123456", "added": "2019-08-24T19:15:22Z", "deleted": false, "isVirtual": false, "nodeId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "createdDateTimeUtc": "0001-01-01T00:00:00Z", "modifiedDateTimeUtc": "0001-01-01T00:00:00Z" } } } }, "400": { "description": "The IDs do not match, no host exists with that ID, or the host could not be updated. The response text explains why." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Host/{id}/Domain": { "get": { "tags": [ "Host" ], "summary": "Get the domain a host belongs to", "description": "Returns the Active Directory domain record for the host.\n\nPermission required: Administrator role or application role. The session must have completed multifactor authentication.\n\nCaution: The response can include domain connection details, such as the domain controller name and the ID of the service account used to connect.", "operationId": "Host_GetDomainForHost", "parameters": [ { "name": "id", "in": "path", "description": "ID of the host.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The domain record, including its domain configuration.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActiveDirectoryDomain" }, "example": { "id": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e", "name": null, "domainName": null, "netBiosName": null, "domainController": null, "usnChanged": null, "activeDirectoryDomainConfigurationId": "00000000-0000-0000-0000-000000000000", "functionalLevel": null, "activeDirectoryGroup": null, "objectSid": null, "maxRenewAge": null, "maxTicketAge": null, "nodeId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "createdDateTimeUtc": "0001-01-01T00:00:00Z", "modifiedDateTimeUtc": "0001-01-01T00:00:00Z" } } } }, "204": { "description": "The host refers to a domain record that no longer exists, so the response has no body." }, "400": { "description": "The domain could not be retrieved. Some errors return 500 instead." }, "404": { "description": "No host exists with that ID or the host is marked as deleted, or the host is not a member of a domain." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Host/{id}/ScheduledTasks": { "get": { "tags": [ "Host" ], "summary": "List discovered scheduled tasks on a host", "description": "Returns a page of the scheduled tasks discovered on the host, with the total count. Use it to see what runs on a host and under which account.\n\nPermission required: Administrator role or application role. The session must have completed multifactor authentication.", "operationId": "Host_GetScheduledTasks", "parameters": [ { "name": "id", "in": "path", "description": "ID of the host.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "skip", "in": "query", "description": "Number of items to skip before returning results. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of items to return. Defaults to 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort by, for example name. If it is omitted or does not name a property, the results are not sorted in a defined order.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. Defaults to false. Applies only when orderBy names a property.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "filterText", "in": "query", "description": "Search text. Matches name, user name or description, ignoring letter case.", "required": false, "schema": { "type": "string" }, "example": "example" } ], "responses": { "200": { "description": "An object with a data array of scheduled tasks and a recordsTotal count of all matches.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfHostScheduledTask" }, "example": { "data": [ { "hostId": "00000000-0000-0000-0000-000000000000", "credentialId": null, "hostUserId": null, "id": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e", "userName": null, "name": "Example Scheduled Task", "taskPath": null, "description": null, "discoveredDateTimeUtc": "0001-01-01T00:00:00Z", "source": null, "nextRunTimeUtc": "0001-01-01T00:00:00Z", "lastRunTimeUtc": "0001-01-01T00:00:00Z", "lastRunResult": 0, "scheduledTaskTriggers": null, "scheduledTaskActions": null, "nodeId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "createdDateTimeUtc": "0001-01-01T00:00:00Z", "modifiedDateTimeUtc": "0001-01-01T00:00:00Z" } ], "recordsTotal": 1 } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Host/{id}/Services": { "get": { "tags": [ "Host" ], "summary": "List discovered services on a host", "description": "Returns a page of the services discovered on the host, with the total count. Use it to see what runs on a host and under which account.\n\nPermission required: Administrator role or application role. The session must have completed multifactor authentication.\n\nValues for `startType`: 0 = Boot, 1 = System, 2 = Automatic, 3 = Manual, 4 = Disabled.\n\nValues for `serviceType (flags, values add together)`: 1 = KernelDriver, 2 = FileSystemDriver, 4 = Adapter, 8 = RecognizerDriver, 16 = Win32OwnProcess, 32 = Win32ShareProcess, 256 = InteractiveProcess.", "operationId": "Host_GetServices", "parameters": [ { "name": "id", "in": "path", "description": "ID of the host.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "skip", "in": "query", "description": "Number of items to skip before returning results. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of items to return. Defaults to 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort by, for example name. If it is omitted or does not name a property, services sort by display name ascending.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. Defaults to false. Applies only when orderBy names a property.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "filterText", "in": "query", "description": "Search text. Matches name, display name, user name or description, ignoring letter case.", "required": false, "schema": { "type": "string" }, "example": "example" } ], "responses": { "200": { "description": "An object with a data array of services and a recordsTotal count of all matches. startType and serviceType are numbers; see the value lists.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfHostService" }, "example": { "data": [ { "hostId": "00000000-0000-0000-0000-000000000000", "credentialId": null, "hostUserId": null, "id": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e", "name": "Example Service", "displayName": null, "description": null, "startType": 0, "userName": null, "binaryPathName": null, "dependentServices": null, "canPauseAndContinue": false, "canShutdown": false, "canStop": false, "serviceType": 16, "delayedStart": false, "nodeId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "createdDateTimeUtc": "0001-01-01T00:00:00Z", "modifiedDateTimeUtc": "0001-01-01T00:00:00Z", "discoveredDateTimeUtc": "0001-01-01T00:00:00Z" } ], "recordsTotal": 1 } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostDatabase/Search": { "get": { "tags": [ "Host Database" ], "summary": "Search discovered database servers on hosts", "description": "Returns a page of database servers discovered on hosts, with the total count. Use it to find database instances by host, type or name.\n\nPermission required: Administrator role or application role.\n\nValues for `filterType and type`: -1 = Unknown, 0 = PostgreSQL, 1 = SqlServer, 2 = Sqlite, 3 = Oracle, 4 = MySql.", "operationId": "HostDatabase_Search", "parameters": [ { "name": "filterText", "in": "query", "description": "Search text. Matches database name, full name or cluster name, ignoring letter case.", "required": false, "schema": { "type": "string" }, "example": "example" }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort by, for example name. Defaults to fullName.", "required": false, "schema": { "type": "string" }, "example": "fullName" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. Defaults to false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "hostId", "in": "query", "description": "Return only databases on this host.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" }, { "name": "filterType", "in": "query", "description": "Return only databases of this type, as a number. Omit it or use -1 for all types. See the value list.", "required": false, "schema": { "$ref": "#/components/schemas/DatabaseType" } }, { "name": "skip", "in": "query", "description": "Number of items to skip. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of items to return. Defaults to 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 } ], "responses": { "200": { "description": "An object with a data array of database servers and a recordsTotal count.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfHostDatabase" } } } }, "400": { "description": "The search failed. The response text explains why." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostFeature/Search": { "get": { "tags": [ "Host Feature" ], "summary": "Search discovered features on hosts", "description": "Returns a page of the features discovered on hosts, with the total count. Use it to find features by host or by name, description or version.\n\nPermission required: Administrator role or application role.", "operationId": "HostFeature_Search", "parameters": [ { "name": "filterText", "in": "query", "description": "Search text. Matches feature name, description or version, ignoring letter case.", "required": false, "schema": { "type": "string" }, "example": "example" }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort by. Defaults to name.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. Defaults to false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "hostId", "in": "query", "description": "Return only features on this host.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" }, { "name": "skip", "in": "query", "description": "Number of items to skip. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of items to return. Defaults to 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 } ], "responses": { "200": { "description": "An object with a data array of features and a recordsTotal count.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfHostFeature" } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostFeature/{id}": { "get": { "tags": [ "Host Feature" ], "summary": "Get a discovered host feature by ID", "description": "Returns one feature discovered on a host, with its name, version, description and host ID, and the record of the host it was found on.\n\nPermission required: Administrator role or application role.", "operationId": "HostFeature_Get", "parameters": [ { "name": "id", "in": "path", "description": "ID of the host feature.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The host feature, including its host record.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostFeature" } } } }, "400": { "description": "The feature could not be retrieved. The response text explains why." }, "404": { "description": "No host feature exists with that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostGroup/{hostId}": { "get": { "tags": [ "Host Group" ], "summary": "List local groups on a host", "description": "Returns a page of the local groups discovered on the host, with the total count. Use it to see which groups exist on a managed host.\n\nPermission required: Administrator role or application role.\n\nCaution: The response includes details of each group's member accounts, which can include sensitive values.", "operationId": "HostGroup_GetLocalGroups", "parameters": [ { "name": "hostId", "in": "path", "description": "ID of the host.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" }, { "name": "skip", "in": "query", "description": "Number of groups to skip. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of groups to return. Defaults to 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort by. Defaults to name.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. Defaults to false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "filterText", "in": "query", "description": "Return only groups whose name contains this text, ignoring letter case.", "required": false, "schema": { "type": "string" }, "example": "example" } ], "responses": { "200": { "description": "An object with a data array of groups and a recordsTotal count of all matching groups. Each group includes its host record and its member accounts.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfHostGroup" } } } }, "404": { "description": "No host exists with that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostScanJob": { "get": { "tags": [ "Host Scan Job" ], "summary": "List the status of all host scan jobs", "description": "Returns the status of every host scan job, including the status of each host in the job. Use it to see all scans that are queued, running or finished.\n\nPermission required: Admin or App role.\n\nValues for `status`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.\n\nValues for `failureReason`: 0 = NoError, 1 = UnknownError, 2 = SystemError, 3 = ActionServiceUnavailable, 4 = ActionTimeout, 5 = AccessDenied, 6 = UserAlreadyMemberofGroup, 7 = UserNotMemberofGroup, 8 = InvalidGroupName, 9 = InvalidUserName, 10 = InvalidHostName, 11 = FailedToConnect.", "operationId": "HostScanJob_Get", "responses": { "200": { "description": "A list of scan job statuses. Each entry has the job ID, an overall status and description, and a status entry for each host.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/HostScanJobStatus" } } } } }, "400": { "description": "The statuses could not be read. The body explains why." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Host Scan Job" ], "summary": "Create host scan jobs for a list of hosts", "description": "Creates a scan job for the hosts in the request and returns its status. Use it to onboard new hosts or to scan hosts by name with a service account.\n\nPermission required: Admin or App role.\n\nValues for `sshTrustActionType`: 0 = AlwaysTrustIgnoreThumbprint, 1 = WarnOnThumbprintMismatch, 2 = ErrorOnThumbprintMismatch.\n\nValues for `certificateType`: 0 = WinRM, 1 = RDP, 2 = SSH.", "operationId": "HostScanJob_PostListOfIds", "requestBody": { "description": "A list with one entry for each host to scan. The list must contain at least one entry.\n\n- `dnsHostName` (string, required): DNS name of the host to scan. Leading and trailing spaces are removed.\n- `credentialId` (string (GUID)): ID of the service account used to connect to the host. Provide either credentialId or credentialName. One of them is required.\n- `credentialName` (string): Name of the service account used to connect to the host. If given, it is looked up and replaces credentialId. An unknown name returns an error.\n- `hostId` (string (GUID)): ID of a host that is already known to the system. Use it to scan that exact host instead of matching by name or address.\n- `ipAddress` (string): IP address to use if the DNS name does not resolve.\n- `os` (string): Operating system value to record if the scan cannot detect one.\n- `platformName` (string): Name of the platform for the host.\n- `acceptThumbprintOnFirstDiscovery` (boolean): When true, the scan can complete and the thumbprint it finds is stored as trusted.\n- `sshTrustActionType` (integer): What to do when the connection thumbprint does not match the trusted one. 0 AlwaysTrustIgnoreThumbprint, 1 WarnOnThumbprintMismatch, 2 ErrorOnThumbprintMismatch.\n- `certificateType` (integer): Type of connection the trusted thumbprint applies to. 0 WinRM, 1 RDP, 2 SSH.\n- `trustedThumbprint` (string): Thumbprint to trust for the connection.\n- `sshPort` (integer): SSH port to use when connecting to the host.\n- `source` (string): Optional source value for the request.\n- `platformDetectionOnly` (boolean): When true, the scan only detects the host platform and operating system and skips the full enumeration of users, groups, features, services, tasks and databases.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/HostScanJobRequest" } }, "example": [ { "credentialId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "dnsHostName": "", "ipAddress": "" } ] } }, "required": true }, "responses": { "201": { "description": "The body is the scan job status: the job ID, an overall status and description, and a status entry for each host. The Location header points to the new job.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostScanJobStatus" } } } }, "400": { "description": "The request was not valid, for example the list is empty, a host name is missing, no service account was given, or the service account does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostScanJob/ByHostId/{hostId}": { "get": { "tags": [ "Host Scan Job" ], "summary": "Get the latest scan job status for a host", "description": "Returns the status of the most recent host scan job for the given host. Use it to check whether a scan of that host is queued, running or finished.\n\nPermission required: Admin or App role.\n\nValues for `status`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.\n\nValues for `failureReason`: 0 = NoError, 1 = UnknownError, 2 = SystemError, 3 = ActionServiceUnavailable, 4 = ActionTimeout, 5 = AccessDenied, 6 = UserAlreadyMemberofGroup, 7 = UserNotMemberofGroup, 8 = InvalidGroupName, 9 = InvalidUserName, 10 = InvalidHostName, 11 = FailedToConnect.", "operationId": "HostScanJob_GetJobStatusForHost", "parameters": [ { "name": "hostId", "in": "path", "description": "The ID of the host.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The body is the scan job status: the job ID, an overall status and description, and a status entry for each host.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostScanJobStatus" } } } }, "400": { "description": "The status could not be read. The body explains why." }, "404": { "description": "The host has no scan job." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Host Scan Job" ], "summary": "Scan a known host", "description": "Schedules a scan of one host that already exists in the system. The scan uses the resource service account, or the credential saved on the host if the resource has none.\n\nPermission required: Admin or App role.\n\nValues for `status`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.", "operationId": "HostScanJob_ByHostId", "parameters": [ { "name": "hostId", "in": "path", "description": "The ID of the host to scan.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The body is the scan job status: the job ID, an overall status and description, and a status entry for each host.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostScanJobStatus" } } } }, "400": { "description": "The host does not exist, no service account is available for it, or the scan could not be scheduled." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostScanJob/ByHostIdMultiple": { "post": { "tags": [ "Host Scan Job" ], "summary": "Scan several known hosts", "description": "Schedules a scan for each host ID in the list and returns the status of the scan jobs that were created. Hosts that cannot be scheduled, such as unknown hosts or hosts without a service account, are left out of the response without an error.\n\nPermission required: Admin or App role.\n\nValues for `status`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.", "operationId": "HostScanJob_ByHostIdMultiple", "requestBody": { "description": "A list of host IDs to scan.\n\n- `(array item)` (string (GUID), required): The ID of a host to scan. Send the request body as a JSON array of IDs.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "A list of scan job statuses, one for each host that was scheduled.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/HostScanJobStatus" } } } } }, "400": { "description": "The request could not be processed. The body explains why." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostScanJob/{hostScanJobId}": { "delete": { "tags": [ "Host Scan Job" ], "summary": "Cancel a host scan job", "description": "Cancels a host scan job. The call returns as soon as the cancellation is accepted, so check the job status afterward to confirm.\n\nPermission required: Admin or App role.", "operationId": "HostScanJob_CancelJob", "parameters": [ { "name": "hostScanJobId", "in": "path", "description": "The ID of the host scan job to cancel.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "202": { "description": "The cancellation was accepted." }, "400": { "description": "The job could not be cancelled. The body explains why." }, "404": { "description": "No host scan job has this ID." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Host Scan Job" ], "summary": "Get the status of a host scan job", "description": "Returns the status of one host scan job, including the status of each host in the job. Poll this route after you start a scan until the status shows the job has finished.\n\nPermission required: Admin or App role.\n\nValues for `status`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.\n\nValues for `failureReason`: 0 = NoError, 1 = UnknownError, 2 = SystemError, 3 = ActionServiceUnavailable, 4 = ActionTimeout, 5 = AccessDenied, 6 = UserAlreadyMemberofGroup, 7 = UserNotMemberofGroup, 8 = InvalidGroupName, 9 = InvalidUserName, 10 = InvalidHostName, 11 = FailedToConnect.", "operationId": "HostScanJob_GetJobStatus", "parameters": [ { "name": "hostScanJobId", "in": "path", "description": "The ID of the host scan job, as returned when the scan was started.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "The body is the scan job status: the job ID, an overall status and description, and a status entry for each host.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostScanJobStatus" } } } }, "400": { "description": "The status could not be read. The body explains why." }, "404": { "description": "No host scan job has this ID." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Host Scan Job" ], "summary": "Scan a resource now", "description": "Starts a scan of the host behind a resource, using the resource service account, and returns the scan job status. Use it to refresh what the system knows about a resource right away. In this operation the `hostScanJobId` path segment holds the ID of a managed resource, not the ID of a scan job; the response carries the ID of the new scan job.\n\nPermission required: Admin or App role.\n\nValues for `status`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.", "operationId": "HostScanJob_PostId", "parameters": [ { "name": "hostScanJobId", "in": "path", "description": "The ID of the resource to scan.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "201": { "description": "The body is the scan job status: the job ID, an overall status and description, and a status entry for each host. Use the job ID in the body to check progress.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostScanJobStatus" } } } }, "400": { "description": "The resource was not found, it has no service account, or the scan could not be scheduled." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostScanService/scanQueue": { "get": { "tags": [ "Host Scan Service" ], "summary": "List the scan queue of a host scan service", "description": "Returns a page of the scan actions for one host scan service. By default it lists the actions assigned to that service, and the queuedFilter parameter lists the actions still waiting in the queue instead. Use it to see what the service is running or has run.\n\nPermission required: Admin or App role, and the sign-in must satisfy the multi-factor authentication requirement.\n\nValues for `queuedFilter`: 0 = All, 1 = QueuedItems, 2 = ExcludeQueuedItems.\n\nValues for `status`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.", "operationId": "HostScanService_GetScanQueue", "parameters": [ { "name": "hostScanServiceId", "in": "query", "description": "The ID of the host scan service.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "skip", "in": "query", "description": "Number of items to skip before returning results.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of items to return. The default is 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "filterText", "in": "query", "description": "Returns only entries whose action name, host name or host user name contains this text. The match ignores case.", "required": false, "schema": { "type": "string" }, "example": "web" }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "startTimeUtc" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "queuedFilter", "in": "query", "description": "0 returns the actions assigned to the service and 1 returns only the actions still queued. 2 returns the actions assigned to the service and leaves out queued ones. The default is 0.", "required": false, "schema": { "$ref": "#/components/schemas/ActionQueueStatusFilter" } } ], "responses": { "200": { "description": "A page of scan queue entries with the total number of matches. Each entry has the action name, start and end time, status, host and related IDs.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfActionQueueActionInfoView" }, "example": { "data": [ { "id": "00000000-0000-0000-0000-000000000000", "actionName": "", "actionQueueId": "00000000-0000-0000-0000-000000000000", "actionServiceId": "00000000-0000-0000-0000-000000000000", "status": 2, "jobType": 4 } ], "recordsTotal": 1 } } } }, "400": { "description": "The queue could not be read." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostScheduledTask/Search": { "get": { "tags": [ "Host Scheduled Task" ], "summary": "Search scheduled tasks found on hosts", "description": "Returns a page of the scheduled tasks that host scans discovered. Filter by host or by whether the task is managed, and use the paging parameters to move through the results.\n\nPermission required: Admin or App role.\n\nValues for `filterManagedType`: 0 = Unmanaged, 1 = Managed.", "operationId": "HostScheduledTask_Search", "parameters": [ { "name": "filterText", "in": "query", "description": "Returns only entries that contain this text.", "required": false, "schema": { "type": "string" }, "example": "backup" }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "hostId", "in": "query", "description": "Returns only tasks on this host.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" }, { "name": "filterManagedType", "in": "query", "description": "Returns only managed or only unmanaged tasks. Omit it to return both.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedStatus" } }, { "name": "skip", "in": "query", "description": "Number of items to skip before returning results.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of items to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 } ], "responses": { "200": { "description": "A page of scheduled tasks with the total number of matches. Each entry has the task name and path, the account it runs as, its last and next run times and its managed state.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfHostScheduledTaskView" } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostScheduledTask/{id}": { "get": { "tags": [ "Host Scheduled Task" ], "summary": "Get a scheduled task", "description": "Returns the details of one scheduled task that a host scan discovered, including its name and path, the account it runs as, and its last and next run times.\n\nPermission required: Admin or App role.", "operationId": "HostScheduledTask_Get", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the scheduled task.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The scheduled task.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostScheduledTask" }, "example": { "hostId": "00000000-0000-0000-0000-000000000000", "credentialId": null, "hostUserId": null, "id": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e", "userName": null, "name": "Example Scheduled Task", "taskPath": null, "description": null, "discoveredDateTimeUtc": "0001-01-01T00:00:00Z", "source": null, "nextRunTimeUtc": "0001-01-01T00:00:00Z", "lastRunTimeUtc": "0001-01-01T00:00:00Z", "lastRunResult": 0, "scheduledTaskTriggers": null, "scheduledTaskActions": null, "nodeId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "createdDateTimeUtc": "0001-01-01T00:00:00Z", "modifiedDateTimeUtc": "0001-01-01T00:00:00Z" } } } }, "400": { "description": "The task could not be read. The body explains why." }, "404": { "description": "No scheduled task has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostService/Search": { "get": { "tags": [ "Host Service" ], "summary": "Search services found on hosts", "description": "Returns a page of the services that host scans discovered. Filter by host, managed state or start type, and use the paging parameters to move through the results.\n\nPermission required: Admin or App role, and the sign-in must satisfy the multi-factor authentication requirement.\n\nValues for `filterManagedType`: 0 = Unmanaged, 1 = Managed.\n\nValues for `filterStartType`: 0 = Boot, 1 = System, 2 = Automatic, 3 = Manual, 4 = Disabled.", "operationId": "HostService_Search", "parameters": [ { "name": "filterText", "in": "query", "description": "Returns only entries that contain this text.", "required": false, "schema": { "type": "string" }, "example": "print" }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort the results by.", "required": false, "schema": { "type": "string" }, "example": "displayName" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "hostId", "in": "query", "description": "Returns only services on this host.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" }, { "name": "filterManagedType", "in": "query", "description": "Returns only managed or only unmanaged services. Omit it to return both.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedStatus" } }, { "name": "filterStartType", "in": "query", "description": "Returns only services with this start type.", "required": false, "schema": { "$ref": "#/components/schemas/ServiceStartType" } }, { "name": "skip", "in": "query", "description": "Number of items to skip before returning results.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of items to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 } ], "responses": { "200": { "description": "A page of services with the total number of matches. Each entry has the service and display name, start type, the account it runs as, its managed state and its dependency count.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfHostServiceView" } } } }, "400": { "description": "The search failed. The body explains why." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostService/{id}": { "get": { "tags": [ "Host Service" ], "summary": "Get a service found on a host", "description": "Returns the details of one service that a host scan discovered, including its start type, the account it runs as and its capabilities.\n\nPermission required: Admin or App role, and the sign-in must satisfy the multi-factor authentication requirement.\n\nValues for `startType`: 0 = Boot, 1 = System, 2 = Automatic, 3 = Manual, 4 = Disabled.", "operationId": "HostService_Get", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the host service.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The host service.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostService" }, "example": { "hostId": "00000000-0000-0000-0000-000000000000", "credentialId": null, "hostUserId": null, "id": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e", "name": "Example Service", "displayName": null, "description": null, "startType": 0, "userName": null, "binaryPathName": null, "dependentServices": null, "canPauseAndContinue": false, "canShutdown": false, "canStop": false, "serviceType": 16, "delayedStart": false, "nodeId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "createdDateTimeUtc": "0001-01-01T00:00:00Z", "modifiedDateTimeUtc": "0001-01-01T00:00:00Z", "discoveredDateTimeUtc": "0001-01-01T00:00:00Z" } } } }, "400": { "description": "The service could not be read. The body explains why." }, "404": { "description": "No host service has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostUser/ByHost/{hostId}": { "get": { "tags": [ "Host User" ], "summary": "List the local users of a host", "description": "Returns a page of the users that host scans found on one host. Use the filter to match on user name.\n\nPermission required: Admin or App role, and the sign-in must satisfy the multi-factor authentication requirement.", "operationId": "HostUser_GetLocalUsers", "parameters": [ { "name": "hostId", "in": "path", "description": "The ID of the host.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" }, { "name": "skip", "in": "query", "description": "Number of items to skip before returning results.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of items to return. The default is 10.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 10 }, "example": 10 }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort the results by. The default is the user name.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "filterText", "in": "query", "description": "Returns only users whose name contains this text. The match ignores case.", "required": false, "schema": { "type": "string" }, "example": "admin" } ], "responses": { "200": { "description": "A page of host users with the total number of matches.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfHostUser" }, "example": { "data": [ { "id": "00000000-0000-0000-0000-000000000000", "name": "", "hostId": "00000000-0000-0000-0000-000000000000", "enabled": true } ], "recordsTotal": 1 } } } }, "404": { "description": "No host has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/HostUser/{hostUserId}": { "get": { "tags": [ "Host User" ], "summary": "Get a host user", "description": "Returns the record of one user that a host scan found, such as its names, security identifier, enabled state and password dates. Use it to inspect a host user before you manage it.\n\nPermission required: Admin or App role, or the User Plus role with the credentials Manage permission in its custom role. The sign-in must satisfy the multi-factor authentication requirement.\n\nCaution: The response is a full host user record and can include sensitive account details, so limit who can call it and where the response is stored.", "operationId": "HostUser_GetHostUsers", "parameters": [ { "name": "hostUserId", "in": "path", "description": "The ID of the host user.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The host user record.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostUser" } } } }, "204": { "description": "No host user has this ID. The response has no body." }, "400": { "description": "The user could not be read." }, "403": { "description": "A User Plus caller does not have the required permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/IntegrationConnector": { "get": { "tags": [ "Integration Connector" ], "summary": "List integration connectors", "description": "Returns every integration connector configured in the system, with each connector's name, description, template and configuration identifiers. The setting values are not filled in here; get a single connector by its identifier to see its settings.\n\nPermission required: Requires the Admin role, or an application account with the App role.", "operationId": "IntegrationConnector_GetAll", "responses": { "200": { "description": "A list of integration connectors. The list is empty when none are configured.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/IntegrationConnector" } } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The caller does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/IntegrationConnector/Names": { "get": { "tags": [ "Integration Connector" ], "summary": "List integration connector names", "description": "Returns the identifier and name of every integration connector, sorted by name. Use it to populate a picker or to look up a connector's identifier by name.\n\nPermission required: Requires the Admin role.\n\nCaution: The names returned can identify the third-party systems your organization connects to.", "operationId": "IntegrationConnector_ListNames", "responses": { "200": { "description": "A list of objects, each with the connector id and name.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The caller does not have the Admin role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/IntegrationConnector/{id}": { "delete": { "tags": [ "Integration Connector" ], "summary": "Delete an integration connector", "description": "Deletes the integration connector with the given identifier. Use it to remove a connector you no longer need. Access activities that use the connector as their vault are left without a vault connector. If no connector has that identifier, the call still succeeds and nothing changes.\n\nPermission required: Requires the Admin role, or an application account with the App role.\n\nCaution: The connector is deleted immediately and the call cannot be undone. Any access activity that used it as a vault loses that setting.", "operationId": "IntegrationConnector_Delete", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier of the integration connector.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The connector was deleted, or no connector had that identifier. The response has no body." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The caller does not have the required role, or the account has read-only access." }, "500": { "description": "The connector could not be deleted, for example because recorded sessions still refer to it as their vault." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/IntegrationConnectorTemplate": { "get": { "tags": [ "Integration Connector Template" ], "summary": "List integration connector templates", "description": "Returns the available integration connector templates. A template defines the type of connector, with its name, description and configuration identifier. The configurationValues field may be empty, so do not rely on it for default settings. Which templates appear can depend on the features enabled on your system.\n\nPermission required: Requires the Admin role, and the sign-in must have completed multi-factor authentication.\n\nValues for `type`: 0 = GenericConnector, 1 = StealthAUDITConnector, 2 = PasswordVaultConnector, 3 = ServiceNowConnector.\n\nValues for `configurationValues[].type`: 0 = Uri, 1 = HostName, 2 = Token, 3 = Credential, 4 = User, 5 = Resource, 6 = String, 7 = Int32, 8 = Int64, 9 = Boolean, 10 = Options, 11 = Password, 12 = PowerShell.", "operationId": "IntegrationConnectorTemplate_GetAll", "responses": { "200": { "description": "A list of connector templates.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/IntegrationConnectorTemplate" } } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The caller does not have the Admin role, or the sign-in has not completed multi-factor authentication." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/IntegrationConnectorTemplate/{id}": { "get": { "tags": [ "Integration Connector Template" ], "summary": "Get an integration connector template", "description": "Returns the integration connector template with the given identifier: its type, name, description and configuration identifier. The configurationValues field may be empty, so do not rely on it for default settings. Use it to look up a template before you create a connector of that type.\n\nPermission required: Requires the Admin role, and the sign-in must have completed multi-factor authentication.\n\nValues for `type`: 0 = GenericConnector, 1 = StealthAUDITConnector, 2 = PasswordVaultConnector, 3 = ServiceNowConnector.\n\nValues for `configurationValues[].type`: 0 = Uri, 1 = HostName, 2 = Token, 3 = Credential, 4 = User, 5 = Resource, 6 = String, 7 = Int32, 8 = Int64, 9 = Boolean, 10 = Options, 11 = Password, 12 = PowerShell.", "operationId": "IntegrationConnectorTemplate_Get", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier of the connector template.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The connector template.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntegrationConnectorTemplate" } } } }, "204": { "description": "No template has that identifier. The response has no body." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The caller does not have the Admin role, or the sign-in has not completed multi-factor authentication." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/IPAddressRule": { "post": { "tags": [ "IP Address Rule" ], "summary": "Create an IP address rule", "description": "Creates an IP address rule for a managed account or an activity configuration and returns the saved rule. The call is rejected if the same address, allow setting and type already exist for that owner.\n\nPermission required: Admin or App role.\n\nValues for `ipAddressRuleType`: 0 = Standard, 1 = Range, 2 = CIDR.", "operationId": "IPAddressRule_Create", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IPAddressRuleCreateRequest" } } }, "required": true, "description": "The IP address rule to create.\n\n- `address` (string, required): The IP address, address range or CIDR block, matching the rule type. Send a value that matches the rule type.\n- `allowed` (boolean): True for an allow rule, false for a deny rule. Defaults to false (deny) if omitted.\n- `ipAddressRuleType` (integer): How the address value is interpreted. 0 Standard, 1 Range, 2 CIDR. Defaults to 0 Standard if omitted.\n- `managedAccountId` (string (GUID)): ID of the managed account the rule belongs to. Provide either managedAccountId or activityConfigurationId. One of them is required.\n- `activityConfigurationId` (string (GUID)): ID of the activity configuration the rule belongs to." }, "responses": { "200": { "description": "The rule that was created.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IPAddressRule" } } } }, "400": { "description": "The body is missing, no owner was given, or the same rule already exists. The body explains why." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "IP Address Rule" ], "summary": "Update an IP address rule", "description": "Updates an existing IP address rule and returns the saved rule. Send the full rule, including its ID. The update is rejected as a duplicate if any rule for that owner, including the one being updated, already has the same address, allow setting and type.\n\nPermission required: Admin or App role.\n\nValues for `ipAddressRuleType`: 0 = Standard, 1 = Range, 2 = CIDR.\n\nCaution: The update takes effect immediately, and an update that keeps the same address, allow setting and type as the stored rule is rejected as a duplicate.", "operationId": "IPAddressRule_Update", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IPAddressRuleUpdateRequest" } } }, "required": true, "description": "The IP address rule with its changes. Include the ID of the rule to update.\n\n- `id` (string (GUID), required): The ID of the rule to update.\n- `address` (string, required): The IP address, address range or CIDR block, matching the rule type. Send a value that matches the rule type.\n- `allowed` (boolean): True for an allow rule, false for a deny rule. Defaults to false (deny) if omitted.\n- `ipAddressRuleType` (integer): How the address value is interpreted. 0 Standard, 1 Range, 2 CIDR. Defaults to 0 Standard if omitted.\n- `managedAccountId` (string (GUID)): ID of the managed account the rule belongs to. Provide either managedAccountId or activityConfigurationId. One of them is required.\n- `activityConfigurationId` (string (GUID)): ID of the activity configuration the rule belongs to." }, "responses": { "200": { "description": "The rule after the update.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IPAddressRule" } } } }, "400": { "description": "The body is missing, no owner was given, or the same rule already exists. The body explains why." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/IPAddressRule/ByActivityConfigurationId/{activityConfigurationId}": { "get": { "tags": [ "IP Address Rule" ], "summary": "List IP address rules for an activity configuration", "description": "Returns the IP address rules of one activity configuration that are either allow rules or deny rules. Make one call for each kind to see them all.\n\nPermission required: Admin or App role.\n\nValues for `ipAddressRuleType`: 0 = Standard, 1 = Range, 2 = CIDR.", "operationId": "IPAddressRule_GetByActivityConfigurationId", "parameters": [ { "name": "activityConfigurationId", "in": "path", "description": "The ID of the activity configuration.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "allowed", "in": "query", "description": "Set to true to return allow rules or false to return deny rules. If you omit it, deny rules are returned.", "required": false, "schema": { "type": "boolean" }, "example": true } ], "responses": { "200": { "description": "A list of IP address rules. The list is empty when none match.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/IPAddressRule" } } } } }, "400": { "description": "The ID is empty or the rules could not be read. The body explains why." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/IPAddressRule/ByManagedAccountId/{managedAccountId}": { "get": { "tags": [ "IP Address Rule" ], "summary": "List IP address rules for a managed account", "description": "Returns the IP address rules of one managed account that are either allow rules or deny rules. Make one call for each kind to see them all.\n\nPermission required: Admin or App role.\n\nValues for `ipAddressRuleType`: 0 = Standard, 1 = Range, 2 = CIDR.", "operationId": "IPAddressRule_GetByManagedAccountId", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the managed account.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "allowed", "in": "query", "description": "Set to true to return allow rules or false to return deny rules. If you omit it, deny rules are returned.", "required": false, "schema": { "type": "boolean" }, "example": true } ], "responses": { "200": { "description": "A list of IP address rules. The list is empty when none match.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/IPAddressRule" } } } } }, "400": { "description": "The ID is empty or the rules could not be read. The body explains why." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/IPAddressRule/{ipAddressRuleId}": { "delete": { "tags": [ "IP Address Rule" ], "summary": "Delete an IP address rule", "description": "Deletes one IP address rule from a managed account or an activity configuration.\n\nPermission required: Admin or App role.", "operationId": "IPAddressRule_Delete", "parameters": [ { "name": "ipAddressRuleId", "in": "path", "description": "The ID of the IP address rule to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "202": { "description": "The deletion was accepted." }, "400": { "description": "The ID is empty or the rule could not be deleted. The body explains why." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "IP Address Rule" ], "summary": "Get an IP address rule", "description": "Returns one IP address rule, with its address, whether it allows or denies, its type and the managed account or activity configuration it belongs to.\n\nPermission required: Admin or App role.\n\nValues for `ipAddressRuleType`: 0 = Standard, 1 = Range, 2 = CIDR.", "operationId": "IPAddressRule_GetIPAddressRule", "parameters": [ { "name": "ipAddressRuleId", "in": "path", "description": "The ID of the IP address rule.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "The IP address rule.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IPAddressRule" } } } }, "204": { "description": "No IP address rule has this ID. The response has no body." }, "400": { "description": "The ID is empty or the rule could not be read. The body explains why." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/LicenseInfo/GetLicensedUserCount": { "get": { "tags": [ "License" ], "summary": "Get licensed and used user counts", "description": "Returns the number of user licenses your license allows and the number of users currently counted against it. Use it to check how many licenses remain.\n\nPermission required: Requires the Admin role.", "operationId": "LicenseInfo_GetLicensedUserCount", "responses": { "200": { "description": "An object with two numbers: item1 is the number of licenses allowed and item2 is the number in use.", "content": { "application/json": { "schema": { "type": "object", "properties": { "item1": { "type": "integer", "format": "int32", "description": "Licenses allowed (the license credits)." }, "item2": { "type": "integer", "format": "int32", "description": "Licenses consumed (current application users)." } }, "additionalProperties": false }, "example": { "item1": 100, "item2": 42 } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The caller does not have the Admin role." }, "404": { "description": "No license information is available. The body is an error message." }, "500": { "description": "The counts could not be read. The body is an error message." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Log/downloadzip": { "get": { "tags": [ "Log" ], "summary": "Download log files as a zip", "description": "Packages the server's log files whose activity overlaps a date range into a zip archive and returns it for download. A file is left out only when both its creation time and its last write time fall before the start date, or both fall after the end date. Pass both dates; if you omit the end date, the archive contains no files.\n\nPermission required: Requires the Admin role or the Auditing and Reporting role.\n\nCaution: The archive can contain sensitive operational details, and each call builds a new archive on the server.", "operationId": "Log_DownloadZipGet", "parameters": [ { "name": "startDate", "in": "query", "description": "Start of the date range, as a date and time. If omitted, the range has no lower limit.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-01T00:00:00Z" }, { "name": "endDate", "in": "query", "description": "End of the date range, as a date and time. Pass it on every call: if omitted, no files match.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-31T23:59:59Z" } ], "responses": { "200": { "description": "A zip archive of the matching log files, sent as a file download rather than JSON.", "content": { "application/zip": { "schema": { "type": "string", "format": "binary" } } } }, "400": { "description": "A date value could not be read." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The caller does not have the required role." }, "500": { "description": "The archive could not be built." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount": { "post": { "tags": [ "Managed Account" ], "summary": "Add one NPS user", "description": "Adds a host user as an NPS user. Identify the user by userId or by sid. If you supply a sid and omit name, the name defaults to the user's display name.\n\nPermission required: Admin or App role.\n\nValues for `type`: 0 = HostUser, 1 = HostService, 2 = HostScheduledTask.\n\nCaution: The user is added immediately and the call is recorded in the audit log.", "operationId": "ManagedAccount_Post", "requestBody": { "description": "The NPS user to add. Supply userId or sid, and a name unless you supply a sid.\n\n- `userId` (string (GUID)): The ID of the host user to add. Required unless sid is supplied.\n- `sid` (string): The Windows security identifier of the user to add. When set, the call looks up the user by SID and replaces any userId you send. The call fails with 400 if no user has that SID.\n- `name` (string): The name to show for the NPS user. Required unless you supply a sid and the matching user has a display name.\n- `type` (integer): The kind of account. See the account type values. The default is 0 (HostUser).\n- `isReviewer` (boolean): Whether the user is a reviewer.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccount" } } }, "required": true }, "responses": { "200": { "description": "Returns the new NPS user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountInfo" } } } }, "400": { "description": "The user could not be added. The body is a text message that includes the reason." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/AddMultiple": { "post": { "tags": [ "Managed Account" ], "summary": "Add several users and groups to NPS", "description": "Adds a list of domain users and domain groups as NPS users and groups in one call, then synchronizes the members of any domain groups you added. A domain user whose NPS account was deleted earlier is reactivated. Use it to onboard many accounts at once.\n\nPermission required: Admin or App role.\n\nValues for `entityType`: 0 = HostUser, 1 = DomainGroup, 2 = ApplicationUser, 3 = DomainGroupMember.", "operationId": "ManagedAccount_AddMultiple", "requestBody": { "description": "An array of the users and groups to add.\n\n- `id` (string (GUID), required): The ID of the host user or domain group to add. Take it from the Host User Search call.\n- `entityType` (integer, required): The kind of entry. Use 0 for a domain user and 1 for a domain group. Entries with other values are skipped and not counted.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/HostUserOrGroupId" } }, "example": [ { "id": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e", "entityType": 0 } ] } }, "required": true }, "responses": { "200": { "description": "Returns the number of entries that passed and failed, with a report array of messages. Entries that are already NPS users or groups, users that are not domain users, and users that already have a credential with the same domain and user name count as failed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "400": { "description": "The license has expired or the credit limit is reached, or the add failed. The body is a text message." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/ByAppUserId/{userId}": { "get": { "tags": [ "Managed Account" ], "summary": "Get an NPS user by sign-in account ID", "description": "Returns the NPS user linked to a Netwrix Privilege Secure sign-in account, including the user's name, account names, email address, last sign-in time, lock state and reviewer flag. Use it when you have the ID of the sign-in account rather than the NPS user ID. The policies, resources and activeSessions arrays in the response are always empty and scheduledSessionCount is 0; use the Policies call for the user's policies.\n\nPermission required: Admin or App role.", "operationId": "ManagedAccount_GetManagedAccountByAppUserId", "parameters": [ { "name": "userId", "in": "path", "description": "The ID of the sign-in account.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "Returns the NPS user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountInfo" } } } }, "400": { "description": "The lookup failed, for example because no sign-in account has that ID. The body is a text message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The sign-in account is not linked to an NPS user." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/ByManagedId/{managedAccountId}": { "get": { "tags": [ "Managed Account" ], "summary": "Get an NPS user by ID", "description": "Returns one NPS user, including the user's name, account names, email address, last sign-in time, lock state and reviewer flag. Administrators and users with the Auditing and Reporting role can read any NPS user. Other callers can read only their own record. The policies, resources and activeSessions arrays in the response are always empty and scheduledSessionCount is 0; use the Policies call for the user's policies.\n\nPermission required: Admin, App, Reviewer or Auditing and Reporting role. Only Admin and Auditing and Reporting can read other users' records.\n\nCaution: The response includes the user's email address and last sign-in time.", "operationId": "ManagedAccount_GetManagedAccountById", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the NPS user to return.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "Returns the NPS user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountInfo" } } } }, "400": { "description": "The lookup failed. The body is a text message." }, "403": { "description": "The caller is not an administrator or auditor and asked for a record other than their own. The body is empty." }, "404": { "description": "No NPS user exists with that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/BySbPamUserId/{id}": { "get": { "tags": [ "Managed Account" ], "summary": "Get an NPS user by sign-in identity ID", "description": "Returns the NPS user record linked to a Netwrix Privilege Secure sign-in account. Use it when you have the ID of a user's sign-in account and need the matching NPS user.\n\nPermission required: Admin or App role.\n\nValues for `type`: 0 = HostUser, 1 = HostService, 2 = HostScheduledTask.", "operationId": "ManagedAccount_GetByIdentityId", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the sign-in account.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "Returns the NPS user record.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccount" } } } }, "400": { "description": "The ID is empty." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No sign-in account has that ID, or it is not linked to an NPS user." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/BySid/{sid}": { "get": { "tags": [ "Managed Account" ], "summary": "Get an NPS user by SID", "description": "Returns the NPS user whose Windows security identifier (SID) matches the value you supply. Use it to find an NPS user from an Active Directory SID.\n\nPermission required: Admin or App role.", "operationId": "ManagedAccount_GetManagedAccountBySid", "parameters": [ { "name": "sid", "in": "path", "description": "The security identifier (SID) of the user.", "required": true, "schema": { "type": "string" }, "example": "S-1-5-21-0-0-0-0000" } ], "responses": { "200": { "description": "Returns the NPS user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountInfo" } } } }, "400": { "description": "The lookup failed. The body is a text message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No NPS user has that SID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/ByUserId/{userId}": { "get": { "tags": [ "Managed Account" ], "summary": "Get an NPS user by host user ID", "description": "Returns the NPS user that is linked to a host user, including the user's name, account names, email address, last sign-in time, lock state and reviewer flag. Use it when you have a host user ID, for example from a resource scan, and need the NPS user. The policies, resources and activeSessions arrays in the response are always empty and scheduledSessionCount is 0; use the Policies call for the user's policies.\n\nPermission required: Admin or App role.", "operationId": "ManagedAccount_GetManagedAccountByUserId", "parameters": [ { "name": "userId", "in": "path", "description": "The ID of the host user.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "Returns the NPS user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountInfo" } } } }, "400": { "description": "The lookup failed. The body is a text message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No NPS user is linked to that host user." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/CreateApplicationUser": { "post": { "tags": [ "Managed Account" ], "summary": "Create an application user", "description": "Creates an application user, which is an NPS user that signs in with an API key, and generates its API key. Retrieve the key afterward with the Reveal API Key call.\n\nPermission required: Admin role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "ManagedAccount_CreateApplicationUser", "requestBody": { "description": "The application user to create. Supply name and certificateSerialNumber.\n\n- `name` (string, required): The name of the application user. Also used as the account name when samAccountName is omitted.\n- `samAccountName` (string): The account name. Defaults to name.\n- `certificateSerialNumber` (string, required): The certificate serial number to store for the application user. Send an empty string when there is none. If the field is missing, the call fails with 400. Spaces are removed and the value is stored in lower case.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountViewCreateRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the new application user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountView" } } } }, "400": { "description": "The user could not be created, for example because the license check failed. The body is a text message." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/CreateLocalUser": { "post": { "tags": [ "Managed Account" ], "summary": "Create a local user", "description": "Creates a local user, which is an NPS user that signs in with a password stored in Netwrix Privilege Secure, and sets its first password.\n\nPermission required: Admin or App role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "ManagedAccount_CreateLocalUser", "requestBody": { "description": "The local user to create and its first password.\n\n- `managedAccountView.name` (string, required): The user name of the new local user.\n- `localUserPasswordChangeRequest.passwordNew` (string, required): The first password for the user. Must meet the password requirements.\n- `changePasswordNextLogin` (boolean): Set to true to make the user change the password at the next sign-in. The default is false.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateLocalUserRequest" }, "example": { "changePasswordNextLogin": false, "localUserPasswordChangeRequest": { "passwordNew": "", "passwordOld": "" }, "managedAccountView": { "name": "" } } } }, "required": true }, "responses": { "200": { "description": "Returns the new local user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountView" } } } }, "400": { "description": "The user could not be created. The body is a text message, such as a missing user, a license failure or 'Unable to create new Local User'." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/DeleteMultiple": { "post": { "tags": [ "Managed Account" ], "summary": "Delete several NPS users and groups", "description": "Deletes a list of NPS users and groups in one call. Users are marked as deleted and lose their sign-in account and console access; groups are removed. Only entries with entityType 0 (user) or 1 (group) are processed, so use the application user and local user delete calls for those kinds.\n\nPermission required: Admin or App role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.\n\nCaution: The users and groups are deleted immediately, and deleted users can no longer sign in.", "operationId": "ManagedAccount_DeleteMultiple", "requestBody": { "description": "An array of the users and groups to delete.\n\n- `id` (string (GUID), required): The ID of the NPS user or group.\n- `entityType` (integer, required): The kind of entry. Use 0 for a user or 1 for a group. Entries with other values are skipped and not counted.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountOrGroupId" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of entries that passed and failed, with a report array of messages. IDs that do not exist count as failed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "400": { "description": "The delete failed. The body is a text message." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/DeleteMultipleApplicationUsers": { "post": { "tags": [ "Managed Account" ], "summary": "Delete several application users", "description": "Deletes a list of application users and their API credentials in one call. The response reports how many were deleted and how many failed.\n\nPermission required: Admin role.\n\nCaution: The users and their API keys are deleted immediately and applications that use those keys stop working.", "operationId": "ManagedAccount_DeleteMultipleApplicationUsers", "requestBody": { "description": "An array of application user IDs.\n\n- `(array item)` (string (GUID), required): The ID of an application user to delete.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "Returns an object with item1, the number deleted, and item2, the number that failed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntPair" } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/DeleteMultipleLocalUsers": { "post": { "tags": [ "Managed Account" ], "summary": "Delete several local users", "description": "Deletes a list of local users and their sign-in accounts in one call. The response reports how many were deleted and how many failed.\n\nPermission required: Admin or App role.", "operationId": "ManagedAccount_DeleteMultipleLocalUsers", "requestBody": { "description": "An array of local user IDs.\n\n- `(array item)` (string (GUID), required): The ID of a local user to delete.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "Returns passed and failed counts. The report array is empty for this call. IDs that do not exist count as failed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/GenerateApiKey/{managedAccountId}": { "put": { "tags": [ "Managed Account" ], "summary": "Generate a new API key for an application user", "description": "Creates a new API key for an application user and replaces the existing one. Use it to rotate the key. Retrieve the new key with the Reveal API Key call.\n\nPermission required: Admin or App role.\n\nCaution: The change takes effect immediately and applications that use the previous key must be updated.", "operationId": "ManagedAccount_GenerateApiKey", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the application user.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "The new key was generated. The body is empty." }, "400": { "description": "The key could not be generated, or the ID is empty." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The user or its credential was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/HostUser/Search": { "get": { "tags": [ "Managed Account" ], "summary": "Search users and groups available to add to NPS", "description": "Searches the host users, domain groups, application users and domain group members that can be added as NPS users. Use it to find candidates before you add them with the Add Multiple call.\n\nPermission required: Admin, Reviewer or App role.\n\nValues for `filterEntityType and entityType`: 0 = HostUser, 1 = DomainGroup, 2 = ApplicationUser, 3 = DomainGroupMember.", "operationId": "ManagedAccount_HostUserSearch", "parameters": [ { "name": "filterEntityType", "in": "query", "description": "Limits the results to one kind of entry. Omit it to return all kinds. See the values of `entityType`.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedAccountCandidateKind" } }, { "name": "filterText", "in": "query", "description": "Returns only entries that match this text.", "required": false, "schema": { "type": "string" }, "example": "jsmith" }, { "name": "excludeAccounts", "in": "query", "description": "Set to true to leave out entries that are already NPS users. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": true }, { "name": "orderBy", "in": "query", "description": "The name of the field to sort by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "The number of items to skip before the first returned item. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The maximum number of items to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 } ], "responses": { "200": { "description": "Returns a paged result with a data array and a recordsTotal count. Each item describes one candidate user or group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedAccountCandidateView" } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/ListApplicationUsersNameAndIds": { "get": { "tags": [ "Managed Account" ], "summary": "List application user names and IDs", "description": "Returns the name and NPS user ID of every application user. Use it to fill a picker or to find an application user's ID.\n\nPermission required: Admin or App role.", "operationId": "ManagedAccount_ListApplicationUsersNameAndIds", "responses": { "200": { "description": "Returns an array of objects with id and name. The array is empty when there are no application users.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/ListLocalUsersNameAndIds": { "get": { "tags": [ "Managed Account" ], "summary": "List local user names and IDs", "description": "Returns the name and NPS user ID of every local user, which are the users that sign in with a Netwrix Privilege Secure password. Use it to fill a picker or to find a local user's ID.\n\nPermission required: Admin or App role.", "operationId": "ManagedAccount_ListLocalUsersNameAndIds", "responses": { "200": { "description": "Returns an array of objects with id and name. The array is empty when there are no local users.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/ManagedAccountView/{managedAccountId}": { "get": { "tags": [ "Managed Account" ], "summary": "Get the list view of an NPS user", "description": "Returns one NPS user in the form used by the Users and Groups list, with counts of active sessions, scheduled sessions and access policies, last sign-in time, lock state and license count.\n\nPermission required: Admin or App role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "ManagedAccount_GetManagedAccountViewByManagedAccountId", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the NPS user.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "Returns the user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountView" } } } }, "400": { "description": "The ID is empty." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No NPS user exists with that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/ResetLocalUserPassword/{managedAccountId}": { "put": { "tags": [ "Managed Account" ], "summary": "Reset a local user's password", "description": "Sets a new password for a local user without needing the current password. Use it when a local user is locked out or has forgotten the password.\n\nPermission required: Admin role.\n\nCaution: The password changes immediately and the previous password stops working.", "operationId": "ManagedAccount_ResetLocalUserPassword", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the local user.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "description": "The new password. The managedAccountId in the body must match the one in the path.\n\n- `managedAccountId` (string (GUID), required): The ID of the local user. Must equal the ID in the path.\n- `passwordNew` (string, required): The new password. Must meet the password requirements.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LocalUserPasswordChangeUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The password was reset. The body is a text message.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "The IDs do not match, or the password could not be reset. The body is a generic text message." }, "401": { "description": "No user exists with that ID." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/ResetMFA/{id}": { "put": { "tags": [ "Managed Account" ], "summary": "Reset multifactor authentication for an NPS user", "description": "Turns off the user's multifactor authentication settings and clears the stored authentication tokens. Use it when a user loses the device they use for multifactor authentication.\n\nPermission required: Admin role.\n\nCaution: The reset takes effect immediately and is recorded in the audit log.", "operationId": "ManagedAccount_ResetMfa", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the NPS user.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The reset succeeded. The body is empty." }, "400": { "description": "The ID is empty, the user has no sign-in account, or the reset failed. The body is a text message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No NPS user exists with that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/RevealApiKey/{managedAccountId}": { "get": { "tags": [ "Managed Account" ], "summary": "Reveal an application user's API key", "description": "Returns the current API key of an application user as plain text. Use it when you need to configure an application with the key.\n\nPermission required: Admin or App role.\n\nCaution: The response contains the API key in clear text, so protect it, and each reveal is recorded in the audit log.", "operationId": "ManagedAccount_RevealApiKey", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the application user.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "Returns the API key as text.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "The ID is empty." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The user or its API key was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/Reviewer": { "get": { "tags": [ "Managed Account" ], "summary": "List reviewers", "description": "Returns every NPS user who is a reviewer, including users who are reviewers through a reviewer group, nested group or collection. Deleted users and users with no linked host user are left out. The list is sorted by account name.\n\nPermission required: Admin role.", "operationId": "ManagedAccount_RetrieveAllReviewers", "responses": { "200": { "description": "Returns an array of objects with id (the NPS user ID) and name (the account name, such as the sAMAccountName).", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/Reviewer/AddMultiple": { "post": { "tags": [ "Managed Account" ], "summary": "Make several users and groups reviewers", "description": "Gives the reviewer role to a list of NPS users, groups and collections. The response is a text message with the number added.\n\nPermission required: Admin or App role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.\n\nCaution: Reviewer rights take effect immediately for every entry that succeeds, even when the call returns 400.", "operationId": "ManagedAccount_AddMultipleReviewer", "requestBody": { "description": "An array of the users and groups to make reviewers.\n\n- `id` (string (GUID), required): The ID of the NPS user or group.\n- `entityType` (integer, required): The kind of entry. See the values of `entityType`.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountOrGroupId" } } } }, "required": true }, "responses": { "200": { "description": "Returns a text message with the number of users added.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "No entries were added, or at least one entry failed. Entries that succeeded are still made reviewers. The body is a text message with the count." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/Reviewer/DeleteMultiple": { "post": { "tags": [ "Managed Account" ], "summary": "Remove several users and groups from reviewers", "description": "Removes the reviewer role from a list of NPS users, groups and collections. The response is a text message with the number removed.\n\nPermission required: Admin or App role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "ManagedAccount_DeleteMultipleReviewer", "requestBody": { "description": "An array of the users and groups to remove from the reviewer role.\n\n- `id` (string (GUID), required): The ID of the NPS user or group.\n- `entityType` (integer, required): The kind of entry. See the values of `entityType`.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountOrGroupId" } } } }, "required": true }, "responses": { "200": { "description": "Returns a text message with the number of users removed.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "No entries were removed, or at least one entry failed. Entries that succeeded still lose the reviewer role. The body is a text message with the count." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/Reviewer/Search": { "get": { "tags": [ "Managed Account" ], "summary": "Search reviewers or reviewer candidates", "description": "Searches NPS users, groups and collections that are reviewers, or that could be made reviewers. Set candidates to true to list who can be added and to false to list who is a reviewer now.\n\nPermission required: Admin, Reviewer or App role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "ManagedAccount_ReviewerSearch", "parameters": [ { "name": "filterEntityType", "in": "query", "description": "Limits the results to one kind of entry. Omit it to return all kinds. See the values of `entityType`.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedAccountKind" } }, { "name": "filterText", "in": "query", "description": "Returns only entries that match this text.", "required": false, "schema": { "type": "string" }, "example": "jsmith" }, { "name": "orderBy", "in": "query", "description": "The name of the field to sort by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "The number of items to skip before the first returned item. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The maximum number of items to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 }, { "name": "candidates", "in": "query", "description": "Set to true to list candidate reviewers, or false to list current reviewers. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "Returns a paged result with a data array and a recordsTotal count. Each item describes one user, group or collection.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedAccountAndCollectionsView" } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/Reviewer/{managedAccountId}": { "put": { "tags": [ "Managed Account" ], "summary": "Set or clear the reviewer role for an NPS user", "description": "Turns the reviewer role on or off for one NPS user and returns the updated user. If you omit isReviewer, the role is turned off.\n\nPermission required: Admin role.", "operationId": "ManagedAccount_SetAsReviewer", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the NPS user.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "isReviewer", "in": "query", "description": "Set to true to make the user a reviewer, or false to remove the role. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": true } ], "responses": { "200": { "description": "Returns the updated NPS user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountInfo" } } } }, "400": { "description": "The change failed. The body is a text message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No NPS user exists with that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/Search": { "get": { "tags": [ "Managed Account" ], "summary": "Search NPS users and groups", "description": "Searches the NPS users and groups that appear in the Users and Groups list. You can filter by kind, text, domain and license state, and by the last sign-in time. The results are paged.\n\nPermission required: Admin, Reviewer or App role.\n\nValues for `filterEntityType and entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.\n\nValues for `licensedFilter`: 0 = Licensed, 1 = Unlicensed.\n\nCaution: The response includes users' email addresses and last sign-in times.", "operationId": "ManagedAccount_Search", "parameters": [ { "name": "filterEntityType", "in": "query", "description": "Limits the results to one kind of entry. Omit it to return all kinds. See the values of `entityType`.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedAccountKind" } }, { "name": "filterText", "in": "query", "description": "Returns only entries whose name, display name, account name, user principal name or email contains this text. The match ignores case.", "required": false, "schema": { "type": "string" }, "example": "jsmith" }, { "name": "domainConfigId", "in": "query", "description": "Returns only entries from this domain.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "resourceId", "in": "query", "description": "Reserved. Omit this parameter.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "orderBy", "in": "query", "description": "The name of the field to sort by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "The number of items to skip before the first returned item. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The maximum number of items to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 }, { "name": "licensedFilter", "in": "query", "description": "Limits the results to licensed or unlicensed users. See the license filter values.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "startDate", "in": "query", "description": "Returns only entries whose last sign-in is at or after this date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-01T00:00:00Z" }, { "name": "endDate", "in": "query", "description": "Returns only entries whose last sign-in is at or before this date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-12-31T23:59:59Z" } ], "responses": { "200": { "description": "Returns a paged result with a data array and a recordsTotal count. Each item describes one NPS user, group, application user, collection or local user. Deleted users are left out.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedAccountView" } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/UpdateApplicationUser": { "put": { "tags": [ "Managed Account" ], "summary": "Update an application user", "description": "Updates the name and profile details of an application user and returns the updated user.\n\nPermission required: Admin role.\n\nCaution: Changing the name also changes the user name stored with the application user's API credential and the name the application signs in with. If the call fails with 400 partway, for example because certificateSerialNumber is missing, earlier changes to the profile, credential and NPS user name may already be saved.", "operationId": "ManagedAccount_UpdateApplicationUser", "requestBody": { "description": "The application user with all of its values. The id and hostUserId identify the user. Send every profile field, because omitted fields are cleared.\n\n- `id` (string (GUID), required): The ID of the NPS user.\n- `hostUserId` (string (GUID), required): The ID of the host user linked to the application user. The call fails without it.\n- `name` (string, required): The name of the application user.\n- `displayName` (string): The display name. Replaced with the value you send. If you omit it, the stored value is cleared.\n- `samAccountName` (string): The account name. Replaced with the value you send. If you omit it, the stored value is cleared.\n- `department` (string): The department. Replaced with the value you send. If you omit it, the stored value is cleared.\n- `email` (string): The email address. Replaced with the value you send. If you omit it, the stored value is cleared.\n- `userPrincipalName` (string): The user principal name. Replaced with the value you send. If you omit it, the stored value is cleared.\n- `certificateSerialNumber` (string, required): The certificate serial number to store for the application user. Send an empty string when there is none. If the field is missing, the call fails with 400. Spaces are removed and the value is stored in lower case.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountViewUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the updated application user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountView" } } } }, "400": { "description": "The update failed, or the user has no linked host user. The body is a text message." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/UpdateLocalUser": { "put": { "tags": [ "Managed Account" ], "summary": "Update a local user", "description": "Updates a local user's name and profile details and returns the updated user. The name is also the user name the local user signs in with, so changing it changes the sign-in name.\n\nPermission required: Admin or App role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "ManagedAccount_UpdateLocalUser", "requestBody": { "description": "The local user with all of its values. The id and hostUserId identify the user. Send every profile field, because omitted fields are cleared.\n\n- `id` (string (GUID), required): The ID of the NPS user.\n- `hostUserId` (string (GUID), required): The ID of the host user linked to the local user.\n- `name` (string, required): The user name of the local user. Also becomes the name the user signs in with.\n- `displayName` (string): The display name. If you omit it, the stored value is cleared.\n- `samAccountName` (string): The account name. If you omit it, the stored value is cleared.\n- `department` (string): The department. If you omit it, the stored value is cleared.\n- `email` (string): The email address. If you omit it, the stored value is cleared.\n- `userPrincipalName` (string): The user principal name. If you omit it, the stored value is cleared.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountViewUpdateLocalUserRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the updated local user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountView" } } } }, "400": { "description": "A required ID is missing or the update failed. The body is a text message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No NPS user exists with that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/{managedAccountId}": { "delete": { "tags": [ "Managed Account" ], "summary": "Delete an NPS user", "description": "Removes an NPS user. The call deletes the user's stored credentials, marks the account as deleted, and removes the user's sign-in identity and console access if they have them. Use it when a person or account no longer needs to use Netwrix Privilege Secure.\n\nPermission required: Admin or App role.", "operationId": "ManagedAccount_Delete", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the NPS user to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "202": { "description": "The delete was accepted. The response has no body; the Location header holds a text message that includes the user ID.", "headers": { "Location": { "description": "A text message that includes the user ID.", "schema": { "type": "string" } } } }, "400": { "description": "The user could not be deleted. The body is a text message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No NPS user exists with that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/{managedAccountId}/Groups": { "get": { "tags": [ "Managed Account" ], "summary": "List the groups an NPS user belongs to", "description": "Returns the NPS groups that the NPS user is a member of. Use it to see how a user inherits access through groups.\n\nPermission required: Admin or App role.\n\nValues for `type`: 0 = Local, 1 = ActiveDirectory.", "operationId": "ManagedAccount_GetGroups", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the NPS user.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "Returns an array of groups. The array is empty when the user is in no group.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountGroup" } } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/{managedAccountId}/Lock": { "post": { "tags": [ "Managed Account" ], "summary": "Lock an NPS user", "description": "Locks an NPS user and returns the updated user. The call also locks the user's active, pending and approval-required sessions, including live connections. Use it to stop a user from working until you unlock the account.\n\nPermission required: Admin or App role.", "operationId": "ManagedAccount_LockManagedAccount", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the NPS user to lock.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "Returns the updated NPS user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountInfo" } } } }, "400": { "description": "The user could not be locked. The body is a text message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No NPS user exists with that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/{managedAccountId}/Policies": { "get": { "tags": [ "Managed Account" ], "summary": "List the access policies of an NPS user", "description": "Returns the access policies that the NPS user is a member of, including the activities and resources each policy covers.\n\nPermission required: Admin or App role.\n\nValues for `approvalTypeRequired`: 0 = Deny, 1 = Allow, 2 = Workflow, 3 = External.\n\nValues for `policyType`: 0 = Resource, 1 = Credential.", "operationId": "ManagedAccount_GetUserPolicies", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the NPS user.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "Returns an array of access policies. The array is empty when the user is in no policy.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/SimpleAccessControlPolicy" } } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccount/{managedAccountId}/Unlock": { "post": { "tags": [ "Managed Account" ], "summary": "Unlock an NPS user", "description": "Unlocks an NPS user and returns the updated user. The call also unlocks the user's active, pending and approval-required sessions, and for host users it clears a sign-in lockout.\n\nPermission required: Admin or App role.", "operationId": "ManagedAccount_UnlockManagedAccount", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the NPS user to unlock.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "Returns the updated NPS user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountInfo" } } } }, "400": { "description": "The user could not be unlocked. The body is a text message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No NPS user exists with that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccountGroup": { "get": { "tags": [ "Managed Account Group" ], "summary": "List managed account groups", "description": "Returns the managed account groups that are backed by a directory group, with each group's name, type, directory details and reviewer setting, sorted by name. Use this to see which directory groups the product manages.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `type`: 0 = Local, 1 = ActiveDirectory.", "operationId": "ManagedAccountGroup_GetGroups", "responses": { "200": { "description": "The list of managed account groups.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountGroupInfo" } } } } } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Managed Account Group" ], "summary": "Create a managed account group", "description": "Creates a managed account group from the details in the request body and returns the saved group. For a directory group, membership is synchronized from the directory after the group is created.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `type`: 0 = Local, 1 = ActiveDirectory.", "operationId": "ManagedAccountGroup_PostGroup", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountGroupCreateRequest" } } }, "required": true, "description": "The managed account group to create.\n\n- `name` (string, required): The display name of the group.\n- `type` (integer): The kind of group. 0 = Local, 1 = ActiveDirectory. Defaults to 0 when omitted.\n- `groupId` (string (GUID)): The ID of the directory group that this group is based on. Set this for a directory group; the group's members are then synchronized from the directory.\n- `mfaConnectorId` (string (GUID)): The multifactor connector assigned to the group.\n- `isReviewer` (boolean): Whether members of the group can act as reviewers." }, "responses": { "200": { "description": "The group was created and is returned.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountGroup" } } } }, "400": { "description": "The group could not be created; the response text explains why." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccountGroup/ByName/{groupName}": { "get": { "tags": [ "Managed Account Group" ], "summary": "Get a managed account group by name", "description": "Returns the managed account group that has the given name, including its member and access policy links. The name match is not case-sensitive, and the route returns an empty response when no group has that name.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `type`: 0 = Local, 1 = ActiveDirectory.", "operationId": "ManagedAccountGroup_GetGroupByName", "parameters": [ { "name": "groupName", "in": "path", "description": "The name of the managed account group.", "required": true, "schema": { "type": "string" }, "example": "" } ], "responses": { "200": { "description": "The managed account group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountGroup" } } } }, "204": { "description": "No group with that name exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccountGroup/Candidate/RemoveMultiple": { "post": { "tags": [ "Managed Account Group" ], "summary": "Remove domain groups from management", "description": "Removes the listed directory groups from management and returns how many were removed. IDs that are not currently managed are skipped.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nCaution: Each matching managed account group is deleted immediately.", "operationId": "ManagedAccountGroup_CandidateRemoveMultiple", "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true, "description": "A JSON array of directory group IDs, as returned by the candidate search." }, "responses": { "200": { "description": "The number of groups that were removed.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccountGroup/Candidate/Search": { "get": { "tags": [ "Managed Account Group" ], "summary": "Search domain groups available to manage", "description": "Searches the groups in an Active Directory domain that can be enrolled as managed account groups, and shows whether each one is already enrolled. Use it to find groups to pass to the add-multiple route.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `filterAppGroupType / appGroupType`: 0 = NotEnrolled, 1 = CanLogIn, 2 = Admin.", "operationId": "ManagedAccountGroup_CandidateSearch", "parameters": [ { "name": "domainConfigId", "in": "query", "description": "The ID of the domain configuration to search. If it is omitted, the search matches no groups.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "filterAppGroupType", "in": "query", "description": "Returns only groups of this type, as a number.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedAccountGroupAppGroupType" } }, { "name": "filterText", "in": "query", "description": "Returns only groups whose display name, account name, description or distinguished name contains this text. Not case-sensitive.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort by. The default is DisplayName.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "Number of rows to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of rows to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 } ], "responses": { "200": { "description": "A page of candidate groups with the total record count.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedAccountGroupCandidateView" } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccountGroup/{groupId}": { "get": { "tags": [ "Managed Account Group" ], "summary": "Get a managed account group", "description": "Returns the managed account group with the given ID, with its directory details. The route finds only groups that are backed by a directory group; it returns an empty response when the ID does not match such a group.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `type`: 0 = Local, 1 = ActiveDirectory.", "operationId": "ManagedAccountGroup_GetGroup", "parameters": [ { "name": "groupId", "in": "path", "description": "The ID of the managed account group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "The managed account group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountGroupInfo" } } } }, "204": { "description": "No directory-backed group with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccountGroup/{groupId}/Members": { "get": { "tags": [ "Managed Account Group" ], "summary": "List members of a managed account group", "description": "Returns all managed accounts that belong to the given group. Use the Members/Search route instead for large groups that need paging.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedAccountGroup_GetGroupMembers", "parameters": [ { "name": "groupId", "in": "path", "description": "The ID of the managed account group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "The list of member accounts.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountInfo" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccountGroup/{groupId}/Members/Search": { "get": { "tags": [ "Managed Account Group" ], "summary": "Search members of a managed account group", "description": "Returns a page of the managed accounts in the given group, with optional text filtering and sorting. Use it to browse large groups.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedAccountGroup_SearchGroupMembers", "parameters": [ { "name": "groupId", "in": "path", "description": "The ID of the managed account group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "skip", "in": "query", "description": "Number of rows to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of rows to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort by. The default is DisplayName.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "filterText", "in": "query", "description": "Returns only members whose display name, user principal name or email contains this text. Not case-sensitive.", "required": false, "schema": { "type": "string" }, "example": "" } ], "responses": { "200": { "description": "A page of member accounts with the total record count.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedAccountInfo" } } } }, "400": { "description": "The search failed; the response text explains why." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedAccountGroup/{groupId}/Policies": { "get": { "tags": [ "Managed Account Group" ], "summary": "List access policies for a managed account group", "description": "Returns the access policies that apply to the given managed account group. Use it to see what the group members can do.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedAccountGroup_GetGroupAccessControlPolicies", "parameters": [ { "name": "groupId", "in": "path", "description": "The ID of the managed account group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "The list of access policies for the group.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/SimpleAccessControlPolicy" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedDatabase/ByResourceId/{resourceId}": { "get": { "tags": [ "Managed Database" ], "summary": "Get database settings by resource", "description": "Returns the database settings for the database resource with the given ID. Use it when you have the resource ID rather than the database ID.\n\nPermission required: Administrator or application account.\n\nValues for `type`: -1 = Unknown, 0 = PostgreSQL, 1 = SqlServer, 2 = Sqlite, 3 = Oracle, 4 = MySql.", "operationId": "ManagedDatabase_GetSettingsByResourceId", "parameters": [ { "name": "resourceId", "in": "path", "description": "The ID of the database resource.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The database settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedDatabaseWithResource" } } } }, "400": { "description": "The resource has no database settings, or the lookup failed." }, "404": { "description": "No resource with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedDatabase/Delete/{databaseId}": { "delete": { "tags": [ "Managed Database" ], "summary": "Delete a managed database", "description": "Deletes the managed database with the given ID together with its resource, its managed users and its host entry. Returns the ID of the deleted database.\n\nPermission required: Administrator or application account.\n\nCaution: The database, its resource, its managed users and its host entry are removed from the product immediately.", "operationId": "ManagedDatabase_Delete", "parameters": [ { "name": "databaseId", "in": "path", "description": "The ID of the managed database.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The database was deleted; the response is its ID.", "content": { "application/json": { "schema": { "type": "string", "format": "uuid" } } } }, "400": { "description": "The delete failed; the response text explains why." }, "404": { "description": "No database with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedDatabase/NamesAndIds": { "get": { "tags": [ "Managed Database" ], "summary": "List managed database names and IDs", "description": "Returns the name and ID of every managed database. Use it to fill pick lists or to look up an ID by name.\n\nPermission required: Administrator or application account.", "operationId": "ManagedDatabase_GetNamesAndIds", "responses": { "200": { "description": "The list of names and IDs.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } }, "400": { "description": "The list could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedDatabase/Retrieve/{id}": { "get": { "tags": [ "Managed Database" ], "summary": "Get database settings", "description": "Returns the settings of the managed database with the given ID, combined with the settings of its resource, such as the service account and platform.\n\nPermission required: Administrator or application account.\n\nValues for `type`: -1 = Unknown, 0 = PostgreSQL, 1 = SqlServer, 2 = Sqlite, 3 = Oracle, 4 = MySql.", "operationId": "ManagedDatabase_Retrieve", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the managed database.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The database settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedDatabaseWithResource" } } } }, "400": { "description": "The lookup failed." }, "404": { "description": "No database with that ID exists, or the database has no resource." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedDatabase/SearchExternal": { "get": { "tags": [ "Managed Database" ], "summary": "Search external users of a resource host", "description": "Returns a page of the external (domain) users and groups that are known on the host of the given database resource. Use it when you choose domain users to manage for a database.\n\nPermission required: Administrator or application account.\n\nValues for `memberType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "ManagedDatabase_SearchExternalUsers", "parameters": [ { "name": "id", "in": "query", "description": "The ID of the database resource whose host is searched.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "skip", "in": "query", "description": "Number of rows to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of rows to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort by.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "filterText", "in": "query", "description": "Returns only users whose member name contains this text. Not case-sensitive.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Accepted but not used by this route. The text filter always searches a fixed set of columns.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "A page of external users with the total record count.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfDatabaseDomainUserView" } } } }, "400": { "description": "The resource has no host, or the search failed." }, "404": { "description": "No resource with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedDatabase/SearchRoles": { "get": { "tags": [ "Managed Database" ], "summary": "Search database roles on a resource host", "description": "Returns a page of the database roles found on the host of the given database resource, with their members. Use it to see which roles exist on the server.\n\nPermission required: Administrator or application account.", "operationId": "ManagedDatabase_SearchRoles", "parameters": [ { "name": "id", "in": "query", "description": "The ID of the database resource whose host is searched.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "skip", "in": "query", "description": "Number of rows to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "take", "in": "query", "description": "Maximum number of rows to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "orderBy", "in": "query", "description": "Name of the property to sort by.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "filterText", "in": "query", "description": "Returns only roles whose role name or database name contains this text. Not case-sensitive.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Accepted but not used by this route. The text filter always searches a fixed set of columns.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "A page of roles with the total record count.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfDatabaseRole" } } } }, "400": { "description": "The resource has no host, or the search failed." }, "404": { "description": "No resource with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedDatabase/Update/{databaseId}": { "put": { "tags": [ "Managed Database" ], "summary": "Update a managed database", "description": "Updates the settings of an existing managed database and its resource, and returns the saved settings. The host entry's name and IP address are updated to match. The database ID in the path must match the one in the body.\n\nPermission required: Administrator or application account.\n\nValues for `type`: -1 = Unknown, 0 = PostgreSQL, 1 = SqlServer, 2 = Sqlite, 3 = Oracle, 4 = MySql.", "operationId": "ManagedDatabase_Update", "parameters": [ { "name": "databaseId", "in": "path", "description": "The ID of the managed database.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedDatabaseUpdateRequest" } } }, "required": true, "description": "The full database settings, including databaseId and resourceId.\n\n- `databaseId` (string (GUID), required): The ID of the database. It must match the ID in the path.\n- `resourceId` (string (GUID), required): The ID of the database resource to update.\n- `name` (string, required): The name of the database as it appears in the console.\n- `server` (string, required): The server name or address that hosts the database.\n- `port` (integer, required): The port the database listens on.\n- `platformId` (string (GUID), required): The ID of the database platform. Must be a SQL Server or Oracle platform, or a custom platform based on one of them; any other platform returns 400. The database type is set from it.\n- `serviceAccountId` (string (GUID)): The ID of the managed account used to connect to the database.\n- `ipAddress` (string): The IP address of the database server.\n- `domainId` (string (GUID)): The ID of the domain used for integrated security.\n- `hostDatabaseId` (string (GUID)): The ID of the database on the host to connect to. Not changed by this route.\n- `integratedSecurity` (boolean): Whether the connection uses integrated security.\n- `trustServerCertificate` (boolean): Whether the server certificate is trusted without validation.\n- `encrypted` (boolean): Whether the connection is encrypted." }, "responses": { "200": { "description": "The database was updated; the response holds its settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedDatabaseWithResource" } } } }, "400": { "description": "The IDs do not match, the resource or platform is not valid, or the update failed." }, "404": { "description": "No database with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedDatabase/{id}": { "get": { "tags": [ "Managed Database" ], "summary": "Get a managed database", "description": "Returns the managed database with the given ID, including its server, port and connection options. Use the Retrieve route to also get the resource settings.\n\nPermission required: Administrator or application account.\n\nValues for `type`: -1 = Unknown, 0 = PostgreSQL, 1 = SqlServer, 2 = Sqlite, 3 = Oracle, 4 = MySql.", "operationId": "ManagedDatabase_Get", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the managed database.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The managed database.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedDatabase" } } } }, "400": { "description": "The lookup failed." }, "404": { "description": "No database with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource": { "post": { "tags": [ "Managed Resource" ], "summary": "Create a resource", "description": "Creates a resource record and returns it. Use it to create the record for a host or an Active Directory domain when you already have its details. Only one resource of a given type can exist for a host or a domain configuration.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `type`: 0 = Host, 1 = Domain, 2 = Website, 3 = AzureAdTenant, 4 = SecretVault, 5 = Database.\n\nValues for `manageAccount`: 0 = Unmanaged, 1 = Managed.\n\nCaution: The resource is created immediately and the call does not validate that the host or service account is reachable.", "operationId": "ManagedResource_Post", "requestBody": { "description": "The resource to create.\n\n- `name` (string): Name of the resource.\n- `type` (integer): The kind of resource. See the type values below.\n- `displayName` (string): Name shown in the console.\n- `hostId` (string (GUID)): ID of the host the resource is built on.\n- `domainConfigId` (string (GUID)): ID of the Active Directory domain configuration, for a domain resource. Required when type is 1 (Domain). It is cleared for other types.\n- `platformId` (string (GUID)): ID of the platform of the resource. If you leave it out, Privilege Secure picks a platform from the host's operating system.\n- `serviceAccountId` (string (GUID)): ID of the service account used to manage the resource.\n- `manageAccount` (integer): Whether the built-in administrator account is managed. See the manageAccount values below.\n- `ipAddress` (string): IP address of the resource.\n- `portSsh` (integer): SSH port.\n- `portRdp` (integer): RDP port.\n- `portWinRm` (integer): WinRM HTTP port.\n- `portWinRmHttps` (integer): WinRM HTTPS port.\n- `disableWinRm` (boolean): Set to true to turn off WinRM for the resource.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResource" } } }, "required": true }, "responses": { "200": { "description": "Returns the created resource.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResource" } } } }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The resource could not be created, for example because a domain resource has no domainConfigId or a resource of the same type already exists for the host." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/ByDomainConfigId/{domainConfigId}": { "get": { "tags": [ "Managed Resource" ], "summary": "Get the resource for an Active Directory domain", "description": "Returns the resource that represents one Active Directory domain configuration. Use it to look up a domain resource when you know the domain configuration ID.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nCaution: The response can include the resource's service account details and trusted certificate thumbprints, so treat it as sensitive.", "operationId": "ManagedResource_GetManagedResourceByDomainConfigId", "parameters": [ { "name": "domainConfigId", "in": "path", "description": "The ID of the Active Directory domain configuration. The ID of the domain record is also accepted.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "Returns the resource.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResource" } } } }, "204": { "description": "No resource exists for this domain configuration. The response has no body." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/ByHostId/{hostId}": { "get": { "tags": [ "Managed Resource" ], "summary": "Get the resource for a host", "description": "Returns the resource that is built on one host. Use it to find out whether a discovered host is already managed.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nCaution: The response can include the resource's service account details and trusted certificate thumbprints, so treat it as sensitive.", "operationId": "ManagedResource_GetManagedResourceByHostId", "parameters": [ { "name": "hostId", "in": "path", "description": "The ID of the host.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "Returns the resource.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResourceView" } } } }, "400": { "description": "The lookup failed." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No resource exists for this host." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/Candidate/AddMultiple": { "post": { "tags": [ "Managed Resource" ], "summary": "Bring hosts under management", "description": "Turns discovered domain hosts into managed resources that use the service account you name, and starts a host scan for each of them. A host that is already a resource is switched to the service account instead. Use the IDs from the candidate search for the host list.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nCaution: Each listed host is created as a resource, or switched to the service account you name if it is already one, and scanned right away. Hosts are processed in order, so if one host fails validation the hosts before it have already been added, but no scan is started for any of them.", "operationId": "ManagedResource_CandidateAddMultiple", "requestBody": { "description": "The hosts to add and the service account to use.\n\n- `hostIds` (array of string (GUID), required): IDs of the hosts to add. Use the id values from the candidate search. At least one ID is required. Each host must belong to an Active Directory domain and have a DNS host name.\n- `serviceAccountId` (string (GUID), required): ID of an existing service account that the new resources use. Must not be the empty GUID.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CandidateAddMultipleCreateRequest" }, "example": { "hostIds": [ "7c9e6679-7425-40de-944b-e07fc1f90ae7" ], "serviceAccountId": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } } }, "required": true }, "responses": { "200": { "description": "Returns the number of hosts that were added or switched to the service account.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "No hosts were sent, the service account is missing or not found, a host is not found or is not a domain host with a DNS host name, or the add failed. The body is a message." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/Candidate/Search": { "get": { "tags": [ "Managed Resource" ], "summary": "Search hosts that are not yet managed", "description": "Returns a page of discovered hosts and resources that you can bring under management. Use it to find the host IDs to pass to the add-multiple call.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `filterAppResourceType and appResourceType`: 0 = NotEnrolled, 1 = Resource.", "operationId": "ManagedResource_CandidateSearch", "parameters": [ { "name": "filterAppResourceType", "in": "query", "description": "Limit the results to one enrollment state. 0 returns hosts that are not enrolled and 1 returns hosts that are already resources.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedResourceAppResourceType" } }, { "name": "filterText", "in": "query", "description": "Return only items that contain this text, ignoring case. The search covers display name, domain name, operating system, DNS host name, distinguished name and service account name.", "required": false, "schema": { "type": "string" }, "example": "server01" }, { "name": "domainConfigId", "in": "query", "description": "Return only hosts that belong to this Active Directory domain configuration.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "orderBy", "in": "query", "description": "The name of the property to sort by. The default is displayName.", "required": false, "schema": { "type": "string" }, "example": "displayName" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "The number of items to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of items to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 }, { "name": "filterServers", "in": "query", "description": "Set to true to return only Windows or Hyper-V servers, judged by the operating system text. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "Returns an object with the page of hosts in data and the total count in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedResourceCandidateView" } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/Delete": { "post": { "tags": [ "Managed Resource" ], "summary": "Remove several resources", "description": "Removes the resources whose IDs you send, along with the managed accounts, local accounts and their stored credentials, protected group members, scheduled jobs and group links that belong to them. Set removeFromDb to also delete the host records.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nCaution: An empty array removes every resource. Removals, including stored credentials for local accounts, take effect immediately and cannot be undone.", "operationId": "ManagedResource_DeleteIds", "parameters": [ { "name": "removeFromDb", "in": "query", "description": "Set to true to also delete the host records of the removed resources, including hosts that came from an Active Directory domain. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "requestBody": { "description": "A JSON array of the resource IDs to remove.\n\n- `(array item)` (string (GUID), required): ID of a resource to remove. Send the IDs as a bare JSON array. An empty array removes every resource.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "The resources were removed. The body is a confirmation message.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "The resources could not be removed." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/GetDomainNames": { "get": { "tags": [ "Managed Resource" ], "summary": "List Active Directory domain resources", "description": "Returns the name and ID of each resource that is an Active Directory domain. Use the ID to read the full resource with the get-resource call.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_GetDomainNames", "responses": { "200": { "description": "Returns an array of objects with id and name.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/InGroup/{managedResourceGroupId}": { "get": { "tags": [ "Managed Resource" ], "summary": "List the resources in a resource group", "description": "Returns a page of the resources that belong to one resource group, with their operating system, platform, service account and last scan time. Set showAll to also list hosts from a mapped organizational unit that are not yet onboarded.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `onboardState`: 0 = NotOnboard, 1 = Onboard, 2 = OnboardInGroup.\n\nValues for `manageAccount`: 0 = Unmanaged, 1 = Managed.", "operationId": "ManagedResource_ResourcesInGroup", "parameters": [ { "name": "managedResourceGroupId", "in": "path", "description": "The ID of the resource group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "filterText", "in": "query", "description": "Return only resources whose name or IP address contains this text, ignoring case.", "required": false, "schema": { "type": "string" }, "example": "server01" }, { "name": "orderBy", "in": "query", "description": "The name of the property to sort by. The default is name.", "required": false, "schema": { "type": "string", "default": "name" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "The number of items to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of items to return. The default is -1, which returns all items.", "required": false, "schema": { "type": "integer", "format": "int32", "default": -1 }, "example": 100 }, { "name": "showAll", "in": "query", "description": "Set to true to include hosts from the group's mapped organizational unit that are not yet resources. This applies only when the group has organizational unit mapping turned on. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "Returns an object with the page of resources in data and the total count in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedResourceSkeleton" } } } }, "400": { "description": "The resources could not be read." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The resource group does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/ManageAccount/{managedResourceGroupId}/All/{manageAccount}": { "put": { "tags": [ "Managed Resource" ], "summary": "Set account management for every resource in a group", "description": "Turns management of the built-in administrator account on or off for every resource in one resource group.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `manageAccount`: 0 = Unmanaged, 1 = Managed.\n\nCaution: The change applies immediately to every resource in the group.", "operationId": "ManagedResource_SetManagedAccountAll", "parameters": [ { "name": "managedResourceGroupId", "in": "path", "description": "The ID of the resource group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "manageAccount", "in": "path", "description": "1 to manage the built-in administrator accounts or 0 to stop managing them.", "required": true, "schema": { "$ref": "#/components/schemas/ManagedResourceManageAccount" } } ], "responses": { "200": { "description": "The request was processed. The response has no body. Problems with individual resources, such as an unknown resource or a platform with no built-in administrator account, are not reported and do not change the status." }, "400": { "description": "The setting could not be applied. The body is a message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The resource group does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/ManageAccount/{managedResourceGroupId}/{manageAccount}": { "put": { "tags": [ "Managed Resource" ], "summary": "Set account management for chosen resources in a group", "description": "Turns management of the built-in administrator account on or off for the resources you list in one resource group.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `manageAccount`: 0 = Unmanaged, 1 = Managed.\n\nCaution: The change applies immediately to the resources you list.", "operationId": "ManagedResource_SetManageAccount", "parameters": [ { "name": "managedResourceGroupId", "in": "path", "description": "The ID of the resource group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "manageAccount", "in": "path", "description": "1 to manage the built-in administrator accounts or 0 to stop managing them.", "required": true, "schema": { "$ref": "#/components/schemas/ManagedResourceManageAccount" } } ], "requestBody": { "description": "A JSON array of the resource IDs to change.\n\n- `(array item)` (string (GUID), required): ID of a resource in the group. Send the IDs as a bare JSON array.", "required": true, "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "example": [ "00000000-0000-0000-0000-000000000000" ] } } }, "responses": { "200": { "description": "The request was processed. The response has no body. Problems with individual resources, such as an unknown resource or a platform with no built-in administrator account, are not reported and do not change the status." }, "400": { "description": "The setting could not be applied. The body is a message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The resource group does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/OperatingSystems": { "get": { "tags": [ "Managed Resource" ], "summary": "List operating systems across resources", "description": "Returns each distinct operating system value found on your resources, sorted. Resources with no operating system add the labels Website, Secret Vault or Unknown. Use the values to fill an operating system filter.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_GetOperatingSystems", "responses": { "200": { "description": "Returns an array of strings.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string" } }, "example": [ "Windows Server 2022", "Ubuntu 24.04" ] } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/Platform/Bulk": { "put": { "tags": [ "Managed Resource" ], "summary": "Set the platform of several resources", "description": "Sets the platform of each resource you list. The new platform is also applied to the resource's scheduled jobs and to the credentials it uses.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nCaution: The change applies immediately and also updates the scheduled jobs and credentials that belong to each resource.", "operationId": "ManagedResource_SetPlatformBatch", "requestBody": { "description": "The resources to change and the new value.\n\n- `resourceIds` (array of string (GUID), required): IDs of the resources to change.\n- `property` (string (GUID), required): ID of the platform to set.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResourceBatchOfGuidUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns one result for each resource, with its id, a status of 200, 400 or 404, and a message. The call returns 200 even when some resources fail, so check each status.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/BatchResponse" } } } } }, "400": { "description": "The batch could not be processed." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/PlatformDetectionScan": { "post": { "tags": [ "Managed Resource" ], "summary": "Scan resources to detect their platform", "description": "Schedules one host scan that detects and saves the platform and operating system of the resources you send, without a full account and group scan. Resources that already have a platform, or that have no host or credential, are skipped.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `status`: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun.", "operationId": "ManagedResource_SchedulePlatformDetectionScans", "requestBody": { "description": "A JSON array of the resource IDs to scan.\n\n- `(array item)` (string (GUID), required): ID of a resource to scan. Send the IDs as a bare JSON array. Use the IDs from the unspecified platform list.", "required": true, "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "example": [ "00000000-0000-0000-0000-000000000000" ] } } }, "responses": { "200": { "description": "Returns the status of the scan job.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostScanJobStatus" }, "example": { "id": "00000000-0000-0000-0000-000000000000", "status": 0, "statusDescription": "", "hostScanHostStatus": [ { "hostId": "00000000-0000-0000-0000-000000000000", "name": "example-host", "dnsHostName": "host.example.local", "os": "", "ipAddress": "192.0.2.10", "version": "", "status": 0, "statusDescription": "", "failureReason": 0, "errorMessage": null } ] } } } }, "400": { "description": "No IDs were sent, none of the resources can be scanned, or the scan could not be scheduled." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/ProtectedGroup": { "post": { "tags": [ "Managed Resource" ], "summary": "Create a protected group", "description": "Creates a protected group for a resource and returns it. Once protection policy schedules run for the resource, users who are not listed as members are removed from the group.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_PostProtectedGroup", "requestBody": { "description": "The protected group to create.\n\n- `name` (string): Name of the protected group.\n- `managedResourceId` (string (GUID), required): ID of the resource the group belongs to.\n- `isSystem` (boolean): Whether the group is a system group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtectedGroupCreateRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the created protected group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtectedGroup" } } } }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The group could not be created." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/ProtectedGroup/Member": { "post": { "tags": [ "Managed Resource" ], "summary": "Add a member to a protected group", "description": "Adds a member to a protected group and returns it. A member belongs to the allowed list, the current list, or both.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_PostGroupMember", "requestBody": { "description": "The member to add.\n\n- `userName` (string): Name of the member.\n- `userId` (string (GUID)): ID of the user, when the member is a known user.\n- `allowedProtectedGroupId` (string (GUID)): ID of the protected group whose allowed list the member joins.\n- `currentProtectedGroupId` (string (GUID)): ID of the protected group whose current list the member joins.\n- `isTransient` (boolean): Whether the membership is temporary.\n- `isSystem` (boolean): Whether the membership was added by a policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtectedGroupMember" } } }, "required": true }, "responses": { "200": { "description": "Returns the created member.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtectedGroupMember" } } } }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The member could not be added." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Managed Resource" ], "summary": "Add or update a protected group member", "description": "Saves a protected group member. If a member with the same ID exists it is updated, otherwise a new member is created.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_PutGroupMember", "requestBody": { "description": "The member to save.\n\n- `id` (string (GUID)): ID of the member. An existing ID updates that member.\n- `userName` (string): Name of the member.\n- `userId` (string (GUID)): ID of the user, when the member is a known user.\n- `allowedProtectedGroupId` (string (GUID)): ID of the protected group whose allowed list the member belongs to.\n- `currentProtectedGroupId` (string (GUID)): ID of the protected group whose current list the member belongs to.\n- `isTransient` (boolean): Whether the membership is temporary.\n- `isSystem` (boolean): Whether the membership was added by a policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtectedGroupMember" } } }, "required": true }, "responses": { "200": { "description": "Returns the saved member.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtectedGroupMember" } } } }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The member could not be saved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/ProtectedGroup/Member/{memberId}": { "delete": { "tags": [ "Managed Resource" ], "summary": "Remove a member from a protected group", "description": "Removes one member record from a protected group. Use it to take a user off the allowed or current member list of a protected group.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_DeleteGroupMember", "parameters": [ { "name": "memberId", "in": "path", "description": "The ID of the protected group member to remove.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" } ], "responses": { "202": { "description": "The removal was accepted. The response has no body." }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The member could not be removed." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Managed Resource" ], "summary": "Get a protected group member", "description": "Returns one member record of a protected group. The response is empty when no member has this ID.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_GetGroupMember", "parameters": [ { "name": "memberId", "in": "path", "description": "The ID of the protected group member.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" } ], "responses": { "200": { "description": "Returns the member.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtectedGroupMember" } } } }, "204": { "description": "No member has this ID. The response has no body." }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The member could not be read." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/ProtectedGroup/{groupId}": { "delete": { "tags": [ "Managed Resource" ], "summary": "Remove a protected group", "description": "Removes one protected group from a resource. Use it when the group no longer needs to be tracked.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_DeleteProtectedGroup", "parameters": [ { "name": "groupId", "in": "path", "description": "The ID of the protected group to remove.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "202": { "description": "The removal was accepted. The response has no body." }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The protected group could not be removed." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Managed Resource" ], "summary": "Get a protected group", "description": "Returns one protected group of a resource, including its allowed and current members. The response is empty when no group has this ID.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_GetProtectedGroup", "parameters": [ { "name": "groupId", "in": "path", "description": "The ID of the protected group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "Returns the protected group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtectedGroup" } } } }, "204": { "description": "No group has this ID. The response has no body." }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The group could not be read." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/ProtectedGroup/{groupId}/AllowedMembers": { "get": { "tags": [ "Managed Resource" ], "summary": "List the allowed members of a protected group", "description": "Returns the members that are allowed to belong to one protected group.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_GetallowedMembers", "parameters": [ { "name": "groupId", "in": "path", "description": "The ID of the protected group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "Returns an array of members. The array is empty when the group has none.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectedGroupMember" } } } } }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The members could not be read." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/ProtectedGroup/{groupId}/CurrentMembers": { "get": { "tags": [ "Managed Resource" ], "summary": "List the current members of a protected group", "description": "Returns the members that currently belong to one protected group.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_GetCurrentMembers", "parameters": [ { "name": "groupId", "in": "path", "description": "The ID of the protected group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "Returns an array of members. The array is empty when the group has none.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectedGroupMember" } } } } }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The members could not be read." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/RetrieveByIds": { "post": { "tags": [ "Managed Resource" ], "summary": "Get several resources by ID", "description": "Returns the resources whose IDs you send, with no filtering or paging.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_RetrieveByIds", "requestBody": { "description": "A JSON array of the resource IDs to read.\n\n- `(array item)` (string (GUID), required): ID of a resource. Send the IDs as a bare JSON array.", "required": true, "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "example": [ "00000000-0000-0000-0000-000000000000" ] } } }, "responses": { "200": { "description": "Returns an array of resources.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResource" } }, "example": [ { "id": "00000000-0000-0000-0000-000000000000", "name": "example-host", "type": 0, "displayName": "Example host", "ipAddress": "192.0.2.10", "manageAccount": 1 } ] } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/Search": { "get": { "tags": [ "Managed Resource" ], "summary": "Search resources", "description": "Returns a page of resources that you can filter by type, domain, operating system, resource group and last scan date. This is the recommended way to list resources.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `filterType and type`: 0 = Host, 1 = Domain, 2 = Website, 3 = AzureAdTenant, 4 = SecretVault, 5 = Database.\n\nValues for `manageAccount`: 0 = Unmanaged, 1 = Managed.\n\nValues for `sshTrustActionType`: 0 = AlwaysTrustIgnoreThumbprint, 1 = WarnOnThumbprintMismatch, 2 = ErrorOnThumbprintMismatch.\n\nValues for `certificateType`: 0 = WinRM, 1 = RDP, 2 = SSH.", "operationId": "ManagedResource_Search", "parameters": [ { "name": "skip", "in": "query", "description": "The number of items to skip.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of items to return.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "orderBy", "in": "query", "description": "The name of the property to sort by.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "filterText", "in": "query", "description": "Return only resources that contain this text, ignoring case. The search covers name, DNS host name, operating system, IP address, service account name and platform name.", "required": false, "schema": { "type": "string" }, "example": "server01" }, { "name": "filterColumns", "in": "query", "description": "Accepted but not used by this call. filterText is always matched against a fixed set of columns.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "filterType", "in": "query", "description": "Return only resources of one type. 0 Host, 1 Domain, 2 Website, 3 AzureAdTenant, 4 SecretVault, 5 Database.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedResourceType" } }, { "name": "filterTextExcludeDomainName", "in": "query", "description": "Controls whether filterText also matches the domain name. In this release the domain name is matched only when this is true. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "domainConfigId", "in": "query", "description": "Return only resources that belong to this Active Directory domain configuration.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "managedResourceId", "in": "query", "description": "Return only the resource with this ID.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "filterOs", "in": "query", "description": "Return only resources with this operating system. Repeat the key to send more than one. Use the values from the operating systems list, which also includes Website, Secret Vault and Unknown for resources that have no operating system.", "required": false, "schema": { "type": "string" }, "example": "Windows Server 2022" }, { "name": "filterResourceGroupId", "in": "query", "description": "Return only resources in this resource group. Repeat the key to send more than one.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "scanStartDate", "in": "query", "description": "Return only resources scanned on or after this date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-01T00:00:00Z" }, { "name": "scanEndDate", "in": "query", "description": "Return only resources scanned on or before this date and time.", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-12-31T23:59:59Z" } ], "responses": { "200": { "description": "Returns an object with the page of resources in data and the total count in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedResourceView" } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/ServiceAccount/Bulk": { "put": { "tags": [ "Managed Resource" ], "summary": "Set the service account of several resources", "description": "Sets the service account that each listed resource uses to connect.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nCaution: The change applies immediately to each listed resource.", "operationId": "ManagedResource_SetServiceAccountBatch", "requestBody": { "description": "The resources to change and the new value.\n\n- `resourceIds` (array of string (GUID), required): IDs of the resources to change.\n- `property` (string (GUID), required): ID of the service account to set.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResourceBatchOfGuidRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns one result for each resource, with its id, a status of 200, 400 or 404, and a message. The call returns 200 even when some resources fail, so check each status.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/BatchResponse" } } } } }, "400": { "description": "The batch could not be processed." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/TestConnection/{resourceId}": { "post": { "tags": [ "Managed Resource" ], "summary": "Start a connection test for a resource", "description": "Starts a test of the connection to a resource using its service account and returns the ID of the test. Read the result with the connection test status call.\n\nPermission required: Administrator signed in with multifactor authentication.", "operationId": "ManagedResource_TestConnection", "parameters": [ { "name": "resourceId", "in": "path", "description": "The ID of the resource to test.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "Returns the test ID as a string.", "content": { "application/json": { "schema": { "type": "string", "format": "uuid" } } } }, "400": { "description": "The resource has no service account or the test could not be scheduled." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The resource does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/TestConnection/{resourceId}/{testId}": { "get": { "tags": [ "Managed Resource" ], "summary": "Get the result of a connection test", "description": "Returns the status of a connection test that you started for a resource, with the result of each step. Poll it after you start a test until the status is Passed or Failed.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `status`: 0 = Pending, 1 = Running, 2 = Passed, 3 = Failed, 4 = NotRun.", "operationId": "ManagedResource_GetTestResourceStatus", "parameters": [ { "name": "resourceId", "in": "path", "description": "The ID of the resource that was tested.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "testId", "in": "path", "description": "The ID of the test, which the start-test call returned.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "Returns the test status, including its steps.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TestResourceStatus" } } } }, "400": { "description": "The status could not be read." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No test with this ID exists for the resource." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/UnspecifiedPlatformIds": { "get": { "tags": [ "Managed Resource" ], "summary": "List resources whose platform is not detected", "description": "Returns the IDs of scannable resources whose platform has not been determined yet, on either the resource or its host and that have a usable credential. Resources that cannot be host-scanned, such as Microsoft Entra ID, SQL or Oracle resources, are left out. Pass the IDs to the platform detection scan call.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_GetUnspecifiedPlatformIds", "responses": { "200": { "description": "Returns an array of resource IDs.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "example": [ "00000000-0000-0000-0000-000000000000" ] } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/User/Search": { "get": { "tags": [ "Managed Resource" ], "summary": "Search the accounts on resources", "description": "Returns a page of the local and domain accounts found on resources, with their management state, password schedule and last password check. Use hostId or domainConfigId to limit the accounts to one host or one domain.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `filterAppUserType and appUserType`: 0 = NonUser, 1 = User, 2 = Admin.\n\nValues for `filterManagedType and rotationType`: 0 = NotManaged, 1 = Manual, 2 = Automatic.\n\nValues for `managedType`: 0 = Internal, 1 = Standard, 2 = Service.\n\nValues for `postSessionAction`: 0 = Disable, 1 = Enable, 2 = KeepPrevious.\n\nValues for `privilege`: 0 = NotSet, 1 = Administrator, 2 = PowerUser, 3 = Guest, 4 = User, 5 = SuperUser, 6 = LinuxUser, 7 = CiscoPrivilege_0, 8 = CiscoPrivilege_1, 9 = CiscoPrivilege_2, 10 = CiscoPrivilege_3, 11 = CiscoPrivilege_4, 12 = CiscoPrivilege_5, 13 = CiscoPrivilege_6, 14 = CiscoPrivilege_7, 15 = CiscoPrivilege_8, 16 = CiscoPrivilege_9, 17 = CiscoPrivilege_10, 18 = CiscoPrivilege_11, 19 = CiscoPrivilege_12, 20 = CiscoPrivilege_13, 21 = CiscoPrivilege_14, 22 = CiscoPrivilege_15, 23 = DomainAdmin, 24 = EnterpriseAdmin.\n\nValues for `passwordStatus`: 0 = Unspecified, 1 = Verified, 2 = Pending, 3 = Changed, 4 = Failed, 5 = Mismatch.", "operationId": "ManagedResource_UserSearch", "parameters": [ { "name": "skip", "in": "query", "description": "The number of items to skip.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of items to return.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "orderBy", "in": "query", "description": "The name of the property to sort by.", "required": false, "schema": { "type": "string" }, "example": "displayName" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "filterText", "in": "query", "description": "Return only accounts whose display name, SAM account name, schedule name or password complexity name contains this text, ignoring case.", "required": false, "schema": { "type": "string" }, "example": "admin" }, { "name": "filterColumns", "in": "query", "description": "Accepted but not used by this call. filterText is always matched against display name, SAM account name, schedule name and password complexity name.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "filterAppUserType", "in": "query", "description": "Return only one kind of account. 0 NonUser, 1 User, 2 Admin.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedResourceLocalUserAppUserType" } }, { "name": "filterManagedType", "in": "query", "description": "Return only accounts with one management state. 0 NotManaged, 1 Manual, 2 Automatic.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedUserType" } }, { "name": "domainConfigId", "in": "query", "description": "Return only accounts that belong to this Active Directory domain configuration.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "hostId", "in": "query", "description": "Return only accounts on this host.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "Returns an object with the page of accounts in data and the total count in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedResourceLocalUserView" } } } }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/WinRmHttps/{managedResourceId}": { "get": { "tags": [ "Managed Resource" ], "summary": "Configure WinRM over HTTPS on a Windows host", "description": "Starts a job that sets up WinRM over HTTPS on a Windows host resource and switches the resource to use HTTPS for WinRM. The call returns the ID of the queued job. Use the job ID to follow its progress.\n\nPermission required: Administrator signed in with multifactor authentication.\n\nCaution: Although this is a GET call, it queues a job that changes the target host, and setting deleteHttp to true removes WinRM over HTTP until you re-enable it on the host.", "operationId": "ManagedResource_ConfigureWinRmHttps", "parameters": [ { "name": "managedResourceId", "in": "path", "description": "The ID of the host resource to configure.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "thumbPrint", "in": "query", "description": "The thumbprint of the certificate to use. Include the word global to use the WinRM certificate thumbprint set in system settings.", "required": false, "schema": { "type": "string", "default": "" }, "example": "global" }, { "name": "exportCert", "in": "query", "description": "Set to true to export the certificate that the thumbprint identifies. A thumbprint is then required. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "deleteHttp", "in": "query", "description": "Set to true to turn off the WinRM HTTP listeners on the host. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "Returns the ID of the queued configuration job as a string.", "content": { "application/json": { "schema": { "type": "string", "format": "uuid" } } } }, "400": { "description": "The resource is not a Windows host, a required thumbprint is missing, or the job could not be queued." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The resource does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/WinRmHttps/{resourceId}/Test": { "get": { "tags": [ "Managed Resource" ], "summary": "Test WinRM over HTTPS on a host", "description": "Connects to the host on its configured WinRM over HTTPS port without sending credentials and returns the thumbprint of the certificate the host presents, as a JSON string. Use it to check the connection before you trust or configure a certificate.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_TestWinRm", "parameters": [ { "name": "resourceId", "in": "path", "description": "The ID of the resource to test.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "Returns the certificate thumbprint as a JSON string.", "content": { "application/json": { "schema": { "type": "string" }, "example": "A1B2C3D4E5F60718293A4B5C6D7E8F9012345678" } } }, "400": { "description": "The resource has no host or service account, the host could not be reached within 15 seconds, or it did not answer as expected. The body is a message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The resource does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/{managedResourceId}": { "delete": { "tags": [ "Managed Resource" ], "summary": "Remove a resource", "description": "Removes one resource from management, along with the managed accounts, local accounts and their stored credentials, protected group members, scheduled jobs and group links that belong to it. The record of a host that came from an Active Directory domain is kept.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nCaution: The resource and everything that belongs to it, including stored credentials for its local accounts, are removed immediately and this cannot be undone.", "operationId": "ManagedResource_Delete", "parameters": [ { "name": "managedResourceId", "in": "path", "description": "The ID of the resource to remove.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "responses": { "202": { "description": "The removal was accepted. The response has no body." }, "400": { "description": "The resource could not be removed. The response body is an error message." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Managed Resource" ], "summary": "Get a resource", "description": "Returns one resource. Administrators and application accounts can read any resource. Other users can read only the resources assigned to access policies they are assigned to.\n\nPermission required: Any signed-in user who has completed multifactor authentication; application accounts are exempt from the multifactor check. Administrators and application accounts can read any resource; other users can read only resources assigned to access policies they are assigned to.\n\nValues for `type`: 0 = Host, 1 = Domain, 2 = Website, 3 = AzureAdTenant, 4 = SecretVault, 5 = Database.\n\nValues for `manageAccount`: 0 = Unmanaged, 1 = Managed.\n\nValues for `sshTrustActionType`: 0 = AlwaysTrustIgnoreThumbprint, 1 = WarnOnThumbprintMismatch, 2 = ErrorOnThumbprintMismatch.\n\nValues for `certificateType`: 0 = WinRM, 1 = RDP, 2 = SSH.\n\nCaution: The response can include the resource's service account details and trusted certificate thumbprints, so treat it as sensitive.", "operationId": "ManagedResource_GetManagedResourceById", "parameters": [ { "name": "managedResourceId", "in": "path", "description": "The ID of the resource.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "responses": { "200": { "description": "Returns the resource.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResourceView" } } } }, "204": { "description": "No resource has this ID, or you do not have rights to it. The response has no body." }, "400": { "description": "The resource could not be read." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Managed Resource" ], "summary": "Update a resource", "description": "Replaces the settings of one resource, such as its platform, service account, ports and certificate trust options. The host record is updated to match the service account and platform.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.\n\nValues for `type`: 0 = Host, 1 = Domain, 2 = Website, 3 = AzureAdTenant, 4 = SecretVault, 5 = Database.\n\nValues for `manageAccount`: 0 = Unmanaged, 1 = Managed.\n\nValues for `sshTrustActionType`: 0 = AlwaysTrustIgnoreThumbprint, 1 = WarnOnThumbprintMismatch, 2 = ErrorOnThumbprintMismatch.\n\nValues for `certificateType`: 0 = WinRM, 1 = RDP, 2 = SSH.\n\nCaution: The change applies immediately. Fields you leave out are saved as their defaults, so send the full resource. A new platform is also applied to the resource's scheduled jobs and credentials.", "operationId": "ManagedResource_Put", "parameters": [ { "name": "managedResourceId", "in": "path", "description": "The ID of the resource to update. It must match the id in the body.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "The full resource, as returned by the get-resource call, with your changes.\n\n- `id` (string (GUID), required): ID of the resource. It must match the ID in the path.\n- `name` (string): Name of the resource.\n- `type` (integer): The kind of resource. Send the value from the get-resource call. A resource saved without it becomes a host (0). See the type values below.\n- `displayName` (string): Name shown in the console.\n- `platformId` (string (GUID)): ID of the platform of the resource.\n- `serviceAccountId` (string (GUID)): ID of the service account used to manage the resource.\n- `manageAccount` (integer): Whether the built-in administrator account is managed. See the manageAccount values below.\n- `hostId` (string (GUID)): ID of the host the resource is built on.\n- `domainConfigId` (string (GUID)): ID of the Active Directory domain configuration, for a domain resource. Required when type is 1 (Domain). It is cleared for other types.\n- `portSsh` (integer): SSH port.\n- `portRdp` (integer): RDP port.\n- `portWinRm` (integer): WinRM HTTP port.\n- `portWinRmHttps` (integer): WinRM HTTPS port.\n- `disableWinRm` (boolean): Set to true to turn off WinRM for the resource.\n- `acceptThumbprintOnFirstDiscovery` (boolean): Whether to trust the first certificate thumbprint the resource presents.\n- `trustedThumbprint` (string): The certificate thumbprint that is trusted.\n- `sshTrustActionType` (integer): What happens when a discovered thumbprint differs from the trusted one. See the sshTrustActionType values below.\n- `certificateType` (integer): The kind of certificate the thumbprint belongs to. See the certificateType values below.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResourceViewUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the updated resource.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResource" } } } }, "400": { "description": "The id in the body does not match the ID in the path." }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The resource could not be updated, for example because a domain resource has no domainConfigId." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/{managedResourceId}/BuiltInAdmin": { "get": { "tags": [ "Managed Resource" ], "summary": "Get the built-in administrator account of a resource", "description": "Returns the built-in administrator account of a resource, as an account record, when the resource's platform defines one. The response is empty when the platform has no built-in administrator account.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_GetBuiltInAdmin", "parameters": [ { "name": "managedResourceId", "in": "path", "description": "The ID of the resource.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "responses": { "200": { "description": "Returns the built-in administrator account.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResourceLocalUserView" } } } }, "204": { "description": "The resource's platform has no built-in administrator account. The response has no body." }, "400": { "description": "The resource has no host or platform, or the account could not be read. The body is a message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The resource does not exist, or the platform's built-in administrator account was not found on the host." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/{managedResourceId}/Group": { "get": { "tags": [ "Managed Resource" ], "summary": "List the resource groups of a resource", "description": "Returns the resource groups that one resource belongs to.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_GetGroups", "parameters": [ { "name": "managedResourceId", "in": "path", "description": "The ID of the resource.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "responses": { "200": { "description": "Returns an array of resource groups.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceGroup" } } } } }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The groups could not be read." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/{managedResourceId}/ProtectedGroup": { "get": { "tags": [ "Managed Resource" ], "summary": "List the protected groups of a resource", "description": "Returns the protected groups that belong to one resource. System groups are left out unless you ask for them.\n\nPermission required: Administrator signed in with multifactor authentication, or an application account.", "operationId": "ManagedResource_GetProtectedGroups", "parameters": [ { "name": "managedResourceId", "in": "path", "description": "The ID of the resource.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "system", "in": "query", "description": "Set to true to include system groups. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "Returns an array of protected groups.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectedGroup" } } } } }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The groups could not be read." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResource/{resourceId}/Trust": { "put": { "tags": [ "Managed Resource" ], "summary": "Trust the discovered certificate of a resource", "description": "Saves the certificate thumbprint that Privilege Secure last discovered on a resource as the trusted thumbprint for the certificate type you name.\n\nPermission required: Administrator signed in with multifactor authentication.\n\nValues for `type`: 0 = WinRM, 1 = RDP, 2 = SSH.\n\nCaution: Later connections accept the discovered certificate as genuine, so confirm it belongs to the resource before you call this.", "operationId": "ManagedResource_Trust", "parameters": [ { "name": "resourceId", "in": "path", "description": "The ID of the resource.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "type", "in": "query", "description": "The kind of certificate to trust. 0 WinRM, 1 RDP, 2 SSH.", "required": false, "schema": { "$ref": "#/components/schemas/CertificateType" } } ], "responses": { "200": { "description": "The thumbprint is now trusted. The response has no body." }, "400": { "description": "No resource has this ID." }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The thumbprint could not be trusted." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResourceGroup": { "post": { "tags": [ "Managed Resource Group" ], "summary": "Create a resource group", "description": "Creates a resource group and returns it. Use it to group resources so access policies and protection settings can target them together.\n\nPermission required: Requires the Admin role, or an application account with the App role.\n\nValues for `type`: 0 = Local.\n\nValues for `manageAccounts`: 0 = PerResource, 1 = Unmanaged, 2 = Managed.", "operationId": "ManagedResourceGroup_CreateSingle", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResourceGroupCreateRequest" } } }, "required": true, "description": "The resource group to create. When OU mapping is enabled the server finds the domain from the OU distinguished name.\n\n- `id` (string (GUID)): The ID of the resource group. Send a new GUID, as the console does. If you leave it out, the server generates one.\n- `name` (string, required): The name of the resource group. Maximum 256 characters. Names are not checked for uniqueness.\n- `type` (integer): The type of resource group. 0 = Local.\n- `platformId` (string (GUID)): The platform the group is tied to, when it is a built-in platform group. Can be null.\n- `manageAccounts` (integer): How the built-in accounts of the group's resources are managed. 0 = PerResource, 1 = Unmanaged, 2 = Managed.\n- `notificationEmailList` (string): Comma-separated email addresses that receive notifications for the group. Can be null.\n- `ouMappingEnabled` (boolean): Whether the group is mapped to an Active Directory organizational unit (OU). When false, the OU settings are cleared.\n- `ouFqdn` (string): The distinguished name of the mapped OU or container. Required when ouMappingEnabled is true. Must start with OU= or CN= and include DC= parts, for example OU=Computers,DC=example,DC=com.\n- `ouAutoOnboard` (boolean): Whether resources found in the mapped OU are onboarded automatically.\n- `ouIncludeChildren` (boolean): Whether child OUs of the mapped OU are included.\n- `ouDomainConfigId` (string (GUID)): The domain that contains the mapped OU. Set by the server from ouFqdn when OU mapping is enabled; cleared when it is disabled.\n- `defaultPlatformId` (string (GUID)): The platform given to resources that OU mapping onboards automatically. Can be null; when null the platform is detected as usual.\n- `defaultServiceAccountId` (string (GUID)): The service account given to resources that OU mapping onboards automatically. Can be null; when null no service account is assigned." }, "responses": { "200": { "description": "The created resource group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResourceGroup" } } } }, "400": { "description": "The OU settings are not valid, for example OU mapping is enabled without an OU distinguished name, the name cannot be parsed, or the domain is not found. The body is the error text." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the required role." }, "500": { "description": "The group could not be saved, for example the name is missing or longer than 256 characters." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResourceGroup/Names": { "get": { "tags": [ "Managed Resource Group" ], "summary": "List resource group names and IDs", "description": "Returns the ID and name of each resource group, sorted by name, with the platform IDs for platform groups. Use it to fill a picker or find a group's ID without loading full group details.\n\nPermission required: Requires the Admin role, or an application account with the App role.", "operationId": "ManagedResourceGroup_ListNames", "parameters": [ { "name": "filterText", "in": "query", "description": "Returns only groups whose name contains this text. Group names are compared in lowercase, so send lowercase text.", "required": false, "schema": { "type": "string" }, "example": "servers" } ], "responses": { "200": { "description": "A data table. recordsTotal is the number of groups and data lists them, each with id, name, platformId and basePlatformId.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedResourceGroupNameAndId" } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResourceGroup/OuMapping/ByDomainConfigId/{domainConfigId}": { "get": { "tags": [ "Managed Resource Group" ], "summary": "List OU-mapped resource groups for a domain", "description": "Returns a summary of the resource groups whose OU mapping points at the given domain. Use it to see which groups map to a domain, optionally only those that onboard resources automatically.\n\nPermission required: Requires the Admin role, or an application account with the App role.", "operationId": "ManagedResourceGroup_RetrieveByDomainConfigId", "parameters": [ { "name": "domainConfigId", "in": "path", "description": "The ID of the domain configuration.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "autoOnboardOnly", "in": "query", "description": "When true, returns only groups that onboard resources automatically. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "A list of group summaries (id, name, ouMappingEnabled, ouFqdn, ouAutoOnboard, ouIncludeChildren and resources). resources lists only member resources that have a host, and ouDomainConfig is not filled in. Each resource has id, name, displayName, hostId, dnsHostName, hostDistinguishedName and hostObjectSid filled in; its other fields hold default values and should be ignored. The list is empty when no group maps to the domain.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceGroupSkeleton" } } } } }, "400": { "description": "The groups could not be retrieved. The body is the error text." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResourceGroup/OuMapping/{id}": { "get": { "tags": [ "Managed Resource Group" ], "summary": "Get OU mapping summary for a resource group", "description": "Returns a summary of one resource group with its OU mapping settings and its resources. Use it to review how a group is mapped to an Active Directory OU.\n\nPermission required: Requires the Admin role, or an application account with the App role.", "operationId": "ManagedResourceGroup_GetForOuMapping", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the resource group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The group summary: id, name, ouMappingEnabled, ouFqdn, ouAutoOnboard, ouIncludeChildren, ouDomainConfig and resources. resources lists only member resources that have a host; ouDomainConfig is not filled in by this call. Each resource has id, name, displayName, hostId, dnsHostName, hostDistinguishedName and hostObjectSid filled in; its other fields hold default values and should be ignored.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResourceGroupSkeleton" } } } }, "400": { "description": "The group could not be retrieved. The body is the error text." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No resource group has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResourceGroup/OuMapping/{id}/Schedule": { "put": { "tags": [ "Managed Resource Group" ], "summary": "Run OU mapping for a resource group", "description": "Schedules a job that maps the group's OU to its resources. Use it after you enable or change OU mapping to apply it without waiting.\n\nPermission required: Requires the Admin role, or an application account with the App role.", "operationId": "ManagedResourceGroup_ScheduleOuMapping", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the resource group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The job was scheduled. The body is empty." }, "400": { "description": "The job could not be scheduled, for example OU mapping is not enabled for the group or its OU settings are incomplete. The body is the error text." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No resource group has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResourceGroup/{id}": { "delete": { "tags": [ "Managed Resource Group" ], "summary": "Delete a resource group", "description": "Deletes one resource group by its ID. If the group manages its resources' built-in accounts, those accounts are released from management before the group is removed. The resources themselves are not deleted.\n\nPermission required: Requires the Admin role, or an application account with the App role.", "operationId": "ManagedResourceGroup_DeleteSingle", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the resource group to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The resource group was deleted. The body is empty." }, "400": { "description": "The delete failed. The body is the error text." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No resource group has that ID." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Managed Resource Group" ], "summary": "Get a resource group", "description": "Returns one resource group by its ID, including its platform, account management setting and OU mapping settings. Use it to read a group's current configuration.\n\nPermission required: Requires the Admin role, or an application account with the App role.\n\nValues for `type`: 0 = Local.\n\nValues for `manageAccounts`: 0 = PerResource, 1 = Unmanaged, 2 = Managed.", "operationId": "ManagedResourceGroup_GetSingle", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the resource group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The resource group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResourceGroup" } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No resource group has that ID." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Managed Resource Group" ], "summary": "Update a resource group", "description": "Replaces the settings of the resource group and returns the updated group. Send the full group: fields you leave out are reset to their defaults. When manageAccounts is Managed or Unmanaged, that setting is applied to the built-in accounts of every resource in the group, or of every resource on the platform for a platform group.\n\nPermission required: Requires the Admin role, or an application account with the App role.\n\nValues for `type`: 0 = Local.\n\nValues for `manageAccounts`: 0 = PerResource, 1 = Unmanaged, 2 = Managed.\n\nCaution: Setting manageAccounts to Managed or Unmanaged takes effect immediately for every resource in the group (or on the platform), and the request does not return until it finishes.", "operationId": "ManagedResourceGroup_UpdateSingle", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the resource group to update.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResourceGroupUpdateRequest" } } }, "required": true, "description": "The full resource group. The id must match the route.\n\n- `id` (string (GUID), required): The ID of the resource group. Must match the ID in the route.\n- `name` (string, required): The name of the resource group. Maximum 256 characters.\n- `type` (integer): The type of resource group. 0 = Local.\n- `platformId` (string (GUID)): The platform the group is tied to, when it is a built-in platform group. Can be null.\n- `manageAccounts` (integer): How the built-in accounts of the group's resources are managed. 0 = PerResource, 1 = Unmanaged, 2 = Managed.\n- `notificationEmailList` (string): Comma-separated email addresses that receive notifications for the group. Can be null.\n- `ouMappingEnabled` (boolean): Whether the group is mapped to an Active Directory organizational unit (OU). When false, the OU settings are cleared.\n- `ouFqdn` (string): The distinguished name of the mapped OU or container. Required when ouMappingEnabled is true. Must start with OU= or CN= and include DC= parts, for example OU=Computers,DC=example,DC=com.\n- `ouAutoOnboard` (boolean): Whether resources found in the mapped OU are onboarded automatically.\n- `ouIncludeChildren` (boolean): Whether child OUs of the mapped OU are included.\n- `ouDomainConfigId` (string (GUID)): The domain that contains the mapped OU. Set by the server from ouFqdn when OU mapping is enabled; cleared when it is disabled.\n- `defaultPlatformId` (string (GUID)): The platform given to resources that OU mapping onboards automatically. Can be null; when null the platform is detected as usual.\n- `defaultServiceAccountId` (string (GUID)): The service account given to resources that OU mapping onboards automatically. Can be null; when null no service account is assigned." }, "responses": { "200": { "description": "The updated resource group.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResourceGroup" } } } }, "400": { "description": "The ID in the body does not match the route (empty body), or the OU settings are not valid, for example OU mapping is enabled without an OU distinguished name, the name cannot be parsed, or the domain is not found (the body is the error text)." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No resource group has that ID." }, "500": { "description": "The group could not be saved, for example the name is missing or longer than 256 characters." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResourceGroup/{id}/AccessPolicies": { "get": { "tags": [ "Managed Resource Group" ], "summary": "List access policies that use a resource group", "description": "Returns the access policies that reference the resource group. Use it to see what depends on a group before you change or delete it.\n\nPermission required: Requires the Admin role, or an application account with the App role.\n\nValues for `policyType`: 0 = Resource, 1 = Credential.", "operationId": "ManagedResourceGroup_GetAccessPolicies", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the resource group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "A list of access policies, each with id, name, description, policyType, policyTypeName and connectionProfileName. The list is empty when no policy uses the group.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AccessControlPolicyDetails" } }, "example": [ { "id": "00000000-0000-0000-0000-000000000000", "name": "", "description": "", "connectionProfileName": "", "policyType": 0, "policyTypeName": "" } ] } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No resource group has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResourceGroup/{id}/ConnectionProfiles": { "get": { "tags": [ "Managed Resource Group" ], "summary": "List connection profiles used through a resource group", "description": "Returns the distinct connection profiles set in the access policies that reference the resource group. Use it to see how users connect to the group's resources.\n\nPermission required: Requires the Admin role, or an application account with the App role.", "operationId": "ManagedResourceGroup_GetConnectionProfiles", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the resource group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "A list of connection profiles, each with id, name and description. The list is empty when no policy that uses the group sets one.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ConnectionProfileInfo" } }, "example": [ { "id": "00000000-0000-0000-0000-000000000000", "name": "", "description": "" } ] } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No resource group has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedResourceGroup/{managedResourceGroupId}/RotateAccounts": { "post": { "tags": [ "Managed Resource Group" ], "summary": "Rotate built-in admin accounts in a resource group", "description": "Schedules a password rotation for the built-in administrator accounts of managed resources and returns how many rotations were scheduled. Send all set to true to rotate every managed resource in the group (for a platform group, every managed resource on that platform), or list resource IDs in ids. Resources whose account cannot be rotated are skipped.\n\nPermission required: Requires the Admin role, or an application account with the App role.\n\nCaution: Rotation changes real account passwords on the selected resources, so confirm the selection before you call it.", "operationId": "ManagedResourceGroup_RotateAccounts", "parameters": [ { "name": "managedResourceGroupId", "in": "path", "description": "The ID of the resource group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedResourceGroupMultiItemSelector" } } }, "required": true, "description": "Which resources to rotate.\n\n- `ids` (array of string (GUID)): The IDs of the resources to rotate when all is false. Only managed resources are rotated. The IDs are not checked against the group's members.\n- `all` (boolean): When true, rotates all managed resources in the group, or on the platform for a platform group. ids is ignored when all is true.\n- `filterText` (string): Accepted but not used by this call." }, "responses": { "200": { "description": "The number of rotations scheduled, as a plain integer. Resources that could not be scheduled are skipped and are not listed in this response.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "No rotations were scheduled. The body is a list of messages that say why, for example a resource has no host, its platform has no built-in account, the account was not found by a host scan, or the account has dependencies. The list is empty when the request selects no managed resources." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No resource group has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedUser/AddMultiple": { "post": { "tags": [ "Managed User" ], "summary": "Start managing several accounts", "description": "Makes each listed host user or credential a managed account. Each entry needs a userId or a credentialId. Entries the caller is not permitted to manage, accounts that are already managed, and accounts that sign in to Privilege Secure are not managed, and the response gives the number that succeeded and the number that did not.\n\nPermission required: Administrator, application, or a delegated user with the Manage permission on the credentials.\n\nValues for `managedType`: 0 = NotManaged, 1 = Manual, 2 = Automatic.", "operationId": "ManagedUser_AddMultiple", "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedUserAddRequest" } }, "example": [ { "userId": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a", "managedType": 2 } ] } }, "required": true, "description": "A JSON array with one entry for each account to manage.\n\n- `userId` (string (uuid)): The id of the host user to manage.\n- `credentialId` (string (uuid)): The id of the credential to manage.\n- `managedType` (integer): How the password is managed: Manual or Automatic. 1 = Manual, 2 = Automatic. Defaults to Automatic when omitted. Quoted numbers are also accepted." }, "responses": { "200": { "description": "Returns two counts: item1 is the number managed and item2 is the number not managed, including entries the caller was not permitted to manage.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntPair" } } } }, "401": { "description": "The caller is not authorized to manage any of the listed credentials." }, "403": { "description": "The caller does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedUser/ByHostUserId/{hostUserId}": { "get": { "tags": [ "Managed User" ], "summary": "Get the managed user for a host user", "description": "Returns the managed user record that belongs to the given host user. Use it to find out whether a host user account is managed and how.\n\nPermission required: Administrator, application, or a delegated user with the Rotate Services permission.\n\nValues for `managedType`: 0 = NotManaged, 1 = Manual, 2 = Automatic.", "operationId": "ManagedUser_GetByHostUserId", "parameters": [ { "name": "hostUserId", "in": "path", "description": "The id of the host user.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The managed user for the host user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedUser" } } } }, "400": { "description": "The lookup failed. The body is a text message." }, "401": { "description": "The caller is not signed in." }, "403": { "description": "The caller does not have the required role or permission." }, "404": { "description": "No managed user exists for the host user. The body is a text message." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedUser/DeleteMultiple": { "post": { "tags": [ "Managed User" ], "summary": "Stop managing several accounts", "description": "Removes the listed managed users so the accounts are no longer managed, and removes their scheduled jobs. Entries the caller is not permitted to unmanage and entries that no longer exist are skipped. For accounts managed through a resource group, the managed user record is still removed, but the scheduled jobs, the credential and the host user are left as they are. The response gives two counts, but the first count reflects the records the call changed rather than strictly the number of accounts, so check the accounts afterward if you need an exact result.\n\nPermission required: Administrator, or a delegated user with the Unmanage permission on the credentials. The caller must have signed in with multi-factor authentication.\n\nCaution: This call takes effect immediately. For accounts that have no dependencies, it also removes their credentials from credential access policies and renames the stored credential by appending its id.", "operationId": "ManagedUser_DeleteMultiple", "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true, "description": "A JSON array of managed user ids.\n\n- `(array item)` (string (uuid), required): The id of a managed user to stop managing." }, "responses": { "200": { "description": "Returns two counts, item1 and item2. item1 is the number of records changed, which can differ from the number of accounts unmanaged; item2 is the number of listed ids minus item1.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntPair" } } } }, "401": { "description": "The caller is not authorized to unmanage any of the listed credentials." }, "403": { "description": "The caller does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedUser/VerifyAccounts": { "post": { "tags": [ "Managed User" ], "summary": "Verify passwords for managed accounts", "description": "Schedules a verification job for each listed account to check that the stored password still works. The response gives the number scheduled and the number not scheduled.\n\nPermission required: Administrator, application, or a delegated user with the Verify permission on the credentials.\n\nValues for `managedType`: 0 = NotManaged, 1 = Manual, 2 = Automatic.", "operationId": "ManagedUser_VerifyAccounts", "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedUserAddRequest" } } } }, "required": true, "description": "A JSON array with one entry for each account to verify.\n\n- `userId` (string (uuid), required): The id of the host user. Entries without it are counted as failed.\n- `credentialId` (string (uuid), required): The id of the credential to verify. Entries without it are counted as failed, although a verification job may already have been scheduled for the user.\n- `managedType` (integer): Not used by this route. 1 = Manual, 2 = Automatic." }, "responses": { "200": { "description": "Returns two counts: item1 is the number that succeeded and item2 is the number that failed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntPair" } } } }, "401": { "description": "The caller is not authorized to verify these credentials." }, "403": { "description": "The caller does not have the required role or permission." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ManagedUser/{id}": { "delete": { "tags": [ "Managed User" ], "summary": "Stop managing an account, optionally removing its host user", "description": "Removes the managed user record so the account is no longer managed. It also removes the account's scheduled jobs, marks the host user as not managed, and, for accounts without dependencies, renames the stored credential and removes it from credential access policies. If the account is managed through a resource group, those other steps are skipped, but the managed user record is still removed and the call returns 200. When deleteHostUser is true, the host user record linked to it is also marked as deleted. Returns the id that was passed in.\n\nPermission required: Administrator or application role.\n\nCaution: This call takes effect immediately, and with deleteHostUser set to true it also deletes the host user record. For an account managed through a resource group, the record is removed but its scheduled jobs and resource group membership are left in place.", "operationId": "ManagedUser_Delete", "parameters": [ { "name": "id", "in": "path", "description": "The id of the managed user to remove.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "deleteHostUser", "in": "query", "description": "When true, also deletes the host user record linked to the managed user. Defaults to false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "ignoreNotFound", "in": "query", "description": "When true, returns 200 instead of 404 if the managed user does not exist. Defaults to false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "The managed user was removed, or was not found and ignoreNotFound is true. The body is the id.", "content": { "application/json": { "schema": { "type": "string", "format": "uuid" } } } }, "403": { "description": "The caller does not have the required role." }, "404": { "description": "The managed user was not found and ignoreNotFound is false." }, "500": { "description": "The managed user could not be removed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/MfaConnector": { "get": { "tags": [ "MFA Connector" ], "summary": "List multi-factor authentication connectors", "description": "Returns all configured connectors, sorted by name. Use it to see which RADIUS, OpenID Connect and SAML connectors exist and which one is the default or exclusive.\n\nPermission required: Administrator role.\n\nValues for `connectorType`: -1 = MFANotRequired, 0 = MFAConnector (RADIUS), 1 = OpenIdConnect, 2 = Saml.", "operationId": "MfaConnector_GetAll", "responses": { "200": { "description": "The list of connectors.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/MfaConnector" } } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "MFA Connector" ], "summary": "Create a RADIUS connector", "description": "Creates a RADIUS multi-factor authentication connector together with its RADIUS settings. Use it to add a RADIUS server as a sign-in method.\n\nPermission required: Administrator role.\n\nValues for `authType`: 0 = MSCHAPv2, 1 = PAP.\n\nValues for `connectorType`: -1 = MFANotRequired, 0 = MFAConnector (RADIUS), 1 = OpenIdConnect, 2 = Saml.", "operationId": "MfaConnector_Post", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MfaConnectorRequest" } } }, "required": true, "description": "The connector name and the RADIUS server settings. A user name format sent here is ignored; set it afterward by updating the RADIUS settings.\n\n- `name` (string): The display name of the connector. The API does not check this field on create, but updating a connector with an empty name fails.\n- `description` (string): A description of the connector.\n- `remoteHost` (string): The host name or address of the RADIUS server. The API does not check this field.\n- `remotePort` (integer): The port the RADIUS server listens on. The API does not check this field.\n- `sharedSecret` (string): The shared secret used to talk to the RADIUS server. The API does not check this field.\n- `timeout` (integer): How long to wait for a reply from the RADIUS server.\n- `maxRetries` (integer): How many times to retry a failed request.\n- `sendNasIdentifier` (boolean): Whether to send the NAS identifier to the RADIUS server.\n- `authType` (integer): The RADIUS authentication method. Send 0 for MSCHAPv2 or 1 for PAP. See enum notes.\n- `dialogTitle` (string): The title of the sign-in prompt shown to users.\n- `loginText` (string): The text of the sign-in prompt shown to users.\n- `autoResponse` (boolean): Whether to answer the RADIUS challenge automatically with autoResponseText.\n- `autoResponseText` (string): The automatic answer to send.\n- `responsePrefix` (string): Text added in front of the user's response." }, "responses": { "200": { "description": "The new connector.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MfaConnector" } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/MfaConnector/Default/{connectorId}": { "put": { "tags": [ "MFA Connector" ], "summary": "Set the default connector", "description": "Turns the default setting on or off for a connector. Turning it on makes this the default sign-in method, removes the default setting from the previous default connector and removes the exclusive setting from whichever connector has it, including this one. If the connector is already the default, nothing changes. Turning it off changes only this connector.\n\nPermission required: Administrator role.", "operationId": "MfaConnector_SetDefaultConnector", "parameters": [ { "name": "connectorId", "in": "path", "description": "The ID of the connector.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "boolean" } } }, "required": true, "description": "A single JSON value: true to make the connector the default, false to remove the default setting.\n\n- `(body)` (boolean, required): true or false." }, "responses": { "200": { "description": "The updated connector.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MfaConnector" } } } }, "400": { "description": "No connector matches the ID, the ID is not a valid GUID, or the change failed." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/MfaConnector/Group/{groupId}": { "put": { "tags": [ "MFA Connector" ], "summary": "Assign a connector to a group", "description": "Sets the multi-factor authentication connector for a managed account group. Members who have no connector of their own use the group's connector. If a member belongs to several groups that have connectors, the group that comes first by name is used.\n\nPermission required: Administrator role.", "operationId": "MfaConnector_SetMfaConnectorForGroup", "parameters": [ { "name": "groupId", "in": "path", "description": "The ID of the group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorInfoUpdateRequest" } } }, "required": true, "description": "The connector to assign.\n\n- `connectorId` (string (GUID), required): The ID of the connector. Take it from the connector names list. Send the empty GUID (all zeros) to remove the group's connector." }, "responses": { "200": { "description": "The updated group. The response is empty (204) when no group has the ID.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountGroup" } } } }, "204": { "description": "No group has this ID. The response has no body." }, "400": { "description": "The ID is not a valid GUID." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/MfaConnector/Names": { "get": { "tags": [ "MFA Connector" ], "summary": "List connector names and IDs", "description": "Returns the ID, name and type of every connector, sorted by name. Use it to find a connector ID, for example before assigning a connector to a user.\n\nPermission required: Administrator role.\n\nValues for `type`: -1 = MFANotRequired, 0 = MFAConnector (RADIUS), 1 = OpenIdConnect, 2 = Saml.", "operationId": "MfaConnector_ListNames", "responses": { "200": { "description": "The list of connector IDs, names and types.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameIdAndType" } } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/MfaConnector/Oidc": { "get": { "tags": [ "MFA Connector" ], "summary": "List OpenID Connect connectors", "description": "Returns the ID, name and type of each OpenID Connect connector, sorted by name. Use it to find the OpenID Connect connector you want to view or change.\n\nPermission required: Administrator role.\n\nValues for `type`: -1 = MFANotRequired, 0 = MFAConnector (RADIUS), 1 = OpenIdConnect, 2 = Saml.", "operationId": "MfaConnector_GetOidcConnectors", "responses": { "200": { "description": "The list of OpenID Connect connectors. The list is empty if none exist.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameIdAndType" } } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/MfaConnector/Oidc/{id}": { "delete": { "tags": [ "MFA Connector" ], "summary": "Delete an OpenID Connect connector", "description": "Deletes the multi-factor authentication connector with the given connector ID. Use it to remove a OpenID Connect connector you no longer need; it behaves the same as the general connector delete.\n\nPermission required: Administrator role.", "operationId": "MfaConnector_RemoveOpenIdConnector", "parameters": [ { "name": "id", "in": "path", "description": "The unique ID of the OpenID Connect connector (the connector ID, not the ID of its OpenID Connect settings).", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "202": { "description": "The delete request is accepted. The same status is returned when no connector has the ID." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "MFA Connector" ], "summary": "Update OpenID Connect settings", "description": "Updates the OpenID Connect settings with the given ID. Use it to change the provider address, client ID or user matching of an OpenID Connect connector.\n\nPermission required: Administrator role.\n\nValues for `login`: 0 = SamAccountName, 1 = UserPrincipalName, 2 = EmailAddress, 3 = Sid.\n\nValues for `userIdSource`: 0 = Introspection, 1 = UserInfo, 2 = TokenParse.", "operationId": "MfaConnector_PutOidcOptions", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the OpenID Connect settings.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpenIdOptionsUpdateRequest" } } }, "required": true, "description": "The full settings. The ID must match the path. Fields you leave out are cleared, so send every current value you want to keep.\n\n- `id` (string (GUID), required): The settings ID. Must match the ID in the path.\n- `authority` (string): The address of the OpenID Connect provider. The API does not check this field.\n- `clientId` (string): The client ID registered with the provider. The API does not check this field.\n- `login` (integer): The user attribute used to match the provider's user. The API does not check this field. See enum notes.\n- `userIdSource` (integer): Where the user identifier is read from. The API does not check this field. See enum notes.\n- `userIdSourceField` (string): The name of the field that holds the user identifier." }, "responses": { "200": { "description": "The updated settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpenIdOptions" } } } }, "400": { "description": "The ID in the path does not match the ID in the request body." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/MfaConnector/Saml": { "post": { "tags": [ "MFA Connector" ], "summary": "Create a SAML connector", "description": "Creates a SAML multi-factor authentication connector together with its SAML settings. Use it to add a SAML identity provider as a sign-in method.\n\nPermission required: Administrator role.\n\nValues for `loginType`: 0 = SamAccountName, 1 = UserPrincipalName, 2 = EmailAddress, 3 = Sid.\n\nValues for `connectorType`: -1 = MFANotRequired, 0 = MFAConnector (RADIUS), 1 = OpenIdConnect, 2 = Saml.", "operationId": "MfaConnector_PostSamlConnector", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SamlRequest" } } }, "required": true, "description": "The connector name and the SAML settings.\n\n- `name` (string): The display name of the connector. The API does not check this field on create, but updating a connector with an empty name fails.\n- `description` (string): A description of the connector.\n- `issuer` (string): The sign-in address of the SAML identity provider. The API does not check this field.\n- `logoutUri` (string): The address used to sign users out of the identity provider.\n- `loginType` (integer): The Active Directory attribute that the provider's user identifier is matched to. The API does not check this field. See enum notes for the values.\n- `claim` (string): The name of the claim that holds the user identifier.\n- `checkCertificate` (boolean): Whether to validate the identity provider's certificate.\n- `certificate` (string): The identity provider's signing certificate. Leave out the BEGIN CERTIFICATE and END CERTIFICATE lines and any spaces or line breaks.\n- `nameIdPolicy` (string): The name ID policy requested from the identity provider. Use a value from the SAML name policies list. When it is empty, sign-in uses the transient identifier policy." }, "responses": { "200": { "description": "The new connector.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MfaConnector" } } } }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/MfaConnector/Saml/{id}": { "delete": { "tags": [ "MFA Connector" ], "summary": "Delete a SAML connector", "description": "Deletes the multi-factor authentication connector with the given connector ID. Use it to remove a SAML connector you no longer need; it behaves the same as the general connector delete.\n\nPermission required: Administrator role.", "operationId": "MfaConnector_RemoveSamlConnector", "parameters": [ { "name": "id", "in": "path", "description": "The unique ID of the SAML connector (the connector ID, not the ID of its SAML settings).", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "202": { "description": "The delete request is accepted. The same status is returned when no connector has the ID." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "MFA Connector" ], "summary": "Get SAML settings", "description": "Returns the SAML settings with the given ID, such as the issuer, logout address, claim and name ID policy. Use it to review or edit a SAML connector.\n\nPermission required: Administrator role.\n\nValues for `loginType`: 0 = SamAccountName, 1 = UserPrincipalName, 2 = EmailAddress, 3 = Sid.", "operationId": "MfaConnector_GetSamlOptions", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the SAML settings, as shown in the samlOptionsId field of the connector.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" } ], "responses": { "200": { "description": "The SAML settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SamlOptions" } } } }, "204": { "description": "No settings exist for this ID." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "MFA Connector" ], "summary": "Update SAML settings", "description": "Updates the SAML settings with the given ID. Use it to change the issuer, claim, certificate or name ID policy of a SAML connector.\n\nPermission required: Administrator role.\n\nValues for `loginType`: 0 = SamAccountName, 1 = UserPrincipalName, 2 = EmailAddress, 3 = Sid.", "operationId": "MfaConnector_PutSamlOptions", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the SAML settings.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SamlOptionsUpdateRequest" } } }, "required": true, "description": "The full settings. The ID must match the path. Fields you leave out are cleared, so send every current value you want to keep.\n\n- `id` (string (GUID), required): The settings ID. Must match the ID in the path.\n- `issuer` (string): The sign-in address of the SAML identity provider. The API does not check this field.\n- `logoutUri` (string): The address used to sign users out.\n- `loginType` (integer): The user attribute used to match the provider's user. The API does not check this field. See enum notes.\n- `claim` (string): The name of the claim that holds the user identifier.\n- `checkCertificate` (boolean): Whether to validate the identity provider's certificate.\n- `certificate` (string): The identity provider's signing certificate. Leave out the BEGIN CERTIFICATE and END CERTIFICATE lines and any spaces or line breaks.\n- `nameIdPolicy` (string): The name ID policy requested from the identity provider. Use a value from the SAML name policies list. When it is empty, sign-in uses the transient identifier policy." }, "responses": { "200": { "description": "The updated settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SamlOptions" } } } }, "400": { "description": "The ID in the path does not match the ID in the request body." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/MfaConnector/User/{userId}": { "put": { "tags": [ "MFA Connector" ], "summary": "Assign a connector to a user", "description": "Sets the multi-factor authentication connector used by a user and returns the user's account information. If the user is not yet a product user, the call first checks that the license allows another user, then creates the product user.\n\nPermission required: Administrator role.", "operationId": "MfaConnector_SetMfaConnector", "parameters": [ { "name": "userId", "in": "path", "description": "The ID of the user. For a managed account, this is its host user ID, not the managed account ID.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectorInfoUpdateRequest" }, "example": { "connectorId": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" } } }, "required": true, "description": "The connector to assign.\n\n- `connectorId` (string (GUID), required): The ID of the connector. Take it from the connector names list. Send the empty GUID (all zeros) to remove the user's own connector, as the console does for Internal MFA; the user then follows the group or default connector. For a user who is created by this call, the empty GUID leaves the connector the new user inherited." }, "responses": { "200": { "description": "The user's account information.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedAccountInfo" } } } }, "400": { "description": "The license does not allow another user, or the update failed. The response contains the message." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/MfaConnector/{id}": { "get": { "tags": [ "MFA Connector" ], "summary": "Get a multi-factor authentication connector", "description": "Returns the connector with the given ID. Use it to see a connector's name, type, enabled state and the IDs of its settings.\n\nPermission required: Administrator role.\n\nValues for `connectorType`: -1 = MFANotRequired, 0 = MFAConnector (RADIUS), 1 = OpenIdConnect, 2 = Saml.", "operationId": "MfaConnector_Get", "parameters": [ { "name": "id", "in": "path", "description": "The unique ID of the connector.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The connector.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MfaConnector" } } } }, "204": { "description": "No connector has this ID." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/NodeStatus/Nodes/{id}/stats": { "get": { "tags": [ "Node Status" ], "summary": "Get node resource statistics", "description": "Returns resource usage figures for the node with the given ID. Each entry covers one feature process with its memory and processor use and its process IDs.\n\nPermission required: Administrator role.", "operationId": "NodeStatus_GetNodeStats", "parameters": [ { "name": "id", "in": "path", "description": "The unique ID of the node (a GUID), as returned by the node list.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "A list of usage entries for the node.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NodeStats" } } } } }, "400": { "description": "The ID is not a valid GUID." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/NodeStatus/{id}": { "get": { "tags": [ "Node Status" ], "summary": "Get a service node", "description": "Returns the details of the service node with the given ID, including its host name, tags and properties. Use it to check a single node.\n\nPermission required: Administrator role.", "operationId": "NodeStatus_GetNode", "parameters": [ { "name": "id", "in": "path", "description": "The unique ID of the node (a GUID), as returned by the node list.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The node details.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NodeDetail" } } } }, "400": { "description": "The ID is not a valid GUID." }, "401": { "description": "The request is not signed in." }, "403": { "description": "The signed-in user does not have the Administrator role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/OverridePolicy": { "post": { "tags": [ "Override Policy" ], "summary": "Create an override policy", "description": "Creates an override policy and returns it with its new ID. The name must not match the name of an existing override policy.\n\nPermission required: Admin role.\n\nValues for `type`: 0 = Credential, 1 = Resource.", "operationId": "OverridePolicy_CreateOverridePolicy", "requestBody": { "description": "The override policy to create.\n\n- `id` (string (GUID)): The ID of the override policy. Leave empty when creating; the response carries the new ID.\n- `name` (string, required): The name of the override policy. Must be unique among override policies.\n- `description` (string): A description of the override policy.\n- `type` (integer): The type of the override policy. 0 for Credential, 1 for Resource. See the `Values for type` paragraph in the operation description.\n- `platformId` (string (GUID)): The ID of the platform the policy applies to. Send it for a credential policy: only credentials on this platform can be added to the policy and listed as candidates.\n- `scanScheduleId` (string (GUID) or null): The ID of the schedule that controls scanning.\n- `protectScheduleId` (string (GUID) or null): The ID of the schedule that controls protecting.\n- `rotateScheduleId` (string (GUID) or null): The ID of the schedule that controls rotating passwords.\n- `verifyScheduleId` (string (GUID) or null): The ID of the schedule that controls verifying passwords.\n- `scanSchedule, protectSchedule, rotateSchedule, verifySchedule` (object or null): The full schedule objects that go with the matching schedule IDs. Returned on reads.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OverridePolicy" } } }, "required": true }, "responses": { "200": { "description": "The created override policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OverridePolicy" } } } }, "400": { "description": "The name is missing, or an override policy with the same name already exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/OverridePolicy/Credential/{id}/AddMultiple": { "put": { "tags": [ "Override Policy" ], "summary": "Add credentials to an override policy", "description": "Adds the listed credentials to a credential override policy, then applies the policy's rotation and verification schedules to them. A credential counts as failed when it is not on the policy's platform, already belongs to any override policy, or could not be added.\n\nPermission required: Admin role.", "operationId": "OverridePolicy_CredentialAddMultiple", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the credential override policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "description": "An array of credential IDs to add.\n\n- `(array item)` (string (GUID), required): The ID of a credential to add. The body is a JSON array of IDs, with at least one.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "A report with passed and failed counts. The report array is returned but is not filled in by this route.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "400": { "description": "The policy is not a credential override policy, the list is empty, or the add failed." }, "404": { "description": "No override policy has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/OverridePolicy/Credential/{id}/Candidates": { "get": { "tags": [ "Override Policy" ], "summary": "List credentials that can be added to a policy", "description": "Returns a page of credentials that you can add to a credential override policy: managed credentials on the policy's platform that are set to rotate automatically and do not already belong to any override policy. Use it to build a picker before you add credentials to the policy.\n\nPermission required: Admin role.", "operationId": "OverridePolicy_SearchCredentialCandidates", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the credential override policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "skip", "in": "query", "description": "The number of rows to skip before returning results. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "take", "in": "query", "description": "The maximum number of rows to return. Defaults to 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "orderBy", "in": "query", "description": "The name of the field to sort by. Defaults to the display name.", "required": false, "schema": { "type": "string" }, "example": "displayName" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "filterText", "in": "query", "description": "Text to match against the credential display name. The match ignores case.", "required": false, "schema": { "type": "string" }, "example": "svc" }, { "name": "filterColumns", "in": "query", "description": "Accepted but not used by this route; the filter text always applies to the display name.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "A page of candidate credentials. The body has a data array and a recordsTotal count.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfCredentialResult" } } } }, "400": { "description": "The policy is not a credential override policy, or the search failed." }, "404": { "description": "No override policy has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/OverridePolicy/Credential/{id}/RemoveMultiple": { "put": { "tags": [ "Override Policy" ], "summary": "Remove credentials from an override policy", "description": "Removes the listed credentials from a credential override policy and reverts the policy's rotation and verification jobs for them. IDs that are not members of this policy count as failed. The list must contain at least one ID.\n\nPermission required: Admin role.", "operationId": "OverridePolicy_CredentialRemoveMultiple", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the credential override policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "description": "An array of credential IDs to remove.\n\n- `(array item)` (string (GUID), required): The ID of a credential to remove. The body is a JSON array of IDs, with at least one.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "A report with passed and failed counts. The report array is returned but is not filled in by this route.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "400": { "description": "The policy is not a credential override policy, the list is empty, or the removal failed." }, "404": { "description": "No override policy has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/OverridePolicy/Credential/{id}/Search": { "get": { "tags": [ "Override Policy" ], "summary": "Search credentials in a policy", "description": "Returns a page of the credentials in a credential override policy, sorted by the search parameters. Only managed credentials that are set to rotate automatically are listed. The policy must be a credential override policy.\n\nPermission required: Admin role.", "operationId": "OverridePolicy_SearchCredentials", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the credential override policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "skip", "in": "query", "description": "The number of rows to skip before returning results. Defaults to 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "take", "in": "query", "description": "The maximum number of rows to return. Defaults to 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "orderBy", "in": "query", "description": "The name of the field to sort by. Defaults to the display name.", "required": false, "schema": { "type": "string" }, "example": "displayName" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "filterText", "in": "query", "description": "Text to match against the credential display name. The match ignores case.", "required": false, "schema": { "type": "string" }, "example": "svc" }, { "name": "filterColumns", "in": "query", "description": "Accepted but not used by this route; the filter text always applies to the display name.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "A page of credentials. The body has a data array and a recordsTotal count.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfCredentialResult" } } } }, "400": { "description": "The policy is not a credential override policy, or the search failed." }, "404": { "description": "No override policy has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/OverridePolicy/NameAndIds": { "get": { "tags": [ "Override Policy" ], "summary": "List override policy names and IDs", "description": "Returns the name and ID of each override policy of the given type, sorted by name. Use it to fill a selection list. The type defaults to credential policies.\n\nPermission required: Admin role.\n\nValues for `type`: 0 = Credential, 1 = Resource.", "operationId": "OverridePolicy_GetNameAndIds", "parameters": [ { "name": "type", "in": "query", "description": "The type of override policy to list, as a number: 0 for Credential or 1 for Resource. Defaults to 0.", "required": false, "schema": { "$ref": "#/components/schemas/OverridePolicyType" } } ], "responses": { "200": { "description": "An array of objects with id and name. The array is empty when no policies exist.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/OverridePolicy/{id}": { "delete": { "tags": [ "Override Policy" ], "summary": "Delete an override policy", "description": "Deletes one credential override policy. Credentials in the policy are removed from it first, and the policy's password rotation and verification jobs for those credentials are reverted.\n\nPermission required: Admin role.", "operationId": "OverridePolicy_DeleteOverridePolicy", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the override policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The policy was deleted. The body is a confirmation message.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "The policy could not be deleted, for example because it is not a credential override policy." }, "404": { "description": "No override policy has this ID." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Override Policy" ], "summary": "Get an override policy", "description": "Returns one override policy, including its scan, protect, rotate and verify schedules.\n\nPermission required: Admin role.\n\nValues for `type`: 0 = Credential, 1 = Resource.", "operationId": "OverridePolicy_GetOverridePolicy", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the override policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The override policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OverridePolicy" } } } }, "404": { "description": "No override policy has this ID." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Override Policy" ], "summary": "Update an override policy", "description": "Replaces the settings of an override policy and returns the updated policy. Send the full policy: the ID in the body must match the ID in the path, and the name must not match another policy. When a schedule ID changes, the policy's existing jobs of that kind move to the new schedule.\n\nPermission required: Admin role.\n\nValues for `type`: 0 = Credential, 1 = Resource.", "operationId": "OverridePolicy_UpdateOverridePolicy", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the override policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "description": "The full override policy with your changes.\n\n- `id` (string (GUID), required): The ID of the override policy. Must match the ID in the path.\n- `name` (string, required): The name of the override policy. Must be unique among override policies.\n- `description` (string): A description of the override policy.\n- `type` (integer): The type of the override policy. 0 for Credential, 1 for Resource. See the `Values for type` paragraph in the operation description.\n- `platformId` (string (GUID)): The ID of the platform the policy applies to.\n- `scanScheduleId` (string (GUID) or null): The ID of the schedule that controls scanning.\n- `protectScheduleId` (string (GUID) or null): The ID of the schedule that controls protecting.\n- `rotateScheduleId` (string (GUID) or null): The ID of the schedule that controls rotating passwords.\n- `verifyScheduleId` (string (GUID) or null): The ID of the schedule that controls verifying passwords.\n- `scanSchedule, protectSchedule, rotateSchedule, verifySchedule` (object or null): The full schedule objects that go with the matching schedule IDs. Returned on reads.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OverridePolicyUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The updated override policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OverridePolicy" } } } }, "400": { "description": "The ID in the body does not match the path, the name is already used, or the update failed." }, "404": { "description": "No override policy has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/PasswordComplexity": { "post": { "tags": [ "Password Complexity" ], "summary": "Create a password complexity policy", "description": "Creates a password complexity policy and returns it with its new ID. The name must not match the name of an existing policy, ignoring case.\n\nPermission required: Admin or App role.\n\nValues for `type`: 0 = Password, 1 = Samaccountname.\n\nValues for `mustStartWith, mustEndWith`: 0 = None, 1 = Lowercase, 2 = Uppercase, 4 = Numeric, 8 = Symbol, 16 = Space.", "operationId": "PasswordComplexity_PostPasswordComplexity", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordComplexityCreateRequest" } } }, "required": true, "description": "The password complexity policy to create.\n\n- `name` (string, required): The name of the policy. Must be unique among password complexity policies; the check ignores case.\n- `description` (string): A description of the policy.\n- `type` (integer): Whether the policy applies to passwords or to SAM account names. 0 for Password, 1 for Samaccountname. See the `Values for type` paragraph in the operation description.\n- `length` (integer, required): The length of generated values. Must be at least 2. A missing value is read as 0 and is rejected with a 400.\n- `lowerCase` (boolean): Whether lowercase letters are used.\n- `upperCase` (boolean): Whether uppercase letters are used.\n- `numeric` (boolean): Whether digits are used.\n- `specialCharacter` (boolean): Whether special characters are used.\n- `space` (boolean): Whether spaces are used.\n- `mustStartWith` (integer): The character types the value must start with, as a combined flag value. Add the numbers together to combine types. See the `Values for mustStartWith, mustEndWith` paragraph in the operation description.\n- `mustEndWith` (integer): The character types the value must end with, as a combined flag value. Add the numbers together to combine types. See the `Values for mustStartWith, mustEndWith` paragraph in the operation description.\n- `maxConsecutive` (integer, required): The maximum number of times the same character can repeat in a row. Must be from 1 to 128. A missing value is read as 0 and is rejected with a 400.\n- `charsToExclude` (string): Characters that must never appear in a generated value." }, "responses": { "200": { "description": "The created policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordComplexity" } } } }, "400": { "description": "A policy with the same name already exists, the name is missing, a value is out of range, or the policy could not be created." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Password Complexity" ], "summary": "Update a password complexity policy", "description": "Replaces the settings of an existing password complexity policy, found by the ID in the body, and returns the updated policy. The name must not match another policy.\n\nPermission required: Admin or App role.\n\nValues for `type`: 0 = Password, 1 = Samaccountname.\n\nValues for `mustStartWith, mustEndWith`: 0 = None, 1 = Lowercase, 2 = Uppercase, 4 = Numeric, 8 = Symbol, 16 = Space.", "operationId": "PasswordComplexity_PutPasswordComplexity", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordComplexityUpdateRequest" } } }, "required": true, "description": "The full password complexity policy with your changes.\n\n- `id` (string (GUID), required): The ID of the password complexity policy to update.\n- `name` (string, required): The name of the policy. Must be unique among password complexity policies; the check ignores case.\n- `description` (string): A description of the policy.\n- `type` (integer): Whether the policy applies to passwords or to SAM account names. 0 for Password, 1 for Samaccountname. See the `Values for type` paragraph in the operation description.\n- `length` (integer, required): The length of generated values. Must be at least 2. A missing value is read as 0 and is rejected with a 400.\n- `lowerCase` (boolean): Whether lowercase letters are used.\n- `upperCase` (boolean): Whether uppercase letters are used.\n- `numeric` (boolean): Whether digits are used.\n- `specialCharacter` (boolean): Whether special characters are used.\n- `space` (boolean): Whether spaces are used.\n- `mustStartWith` (integer): The character types the value must start with, as a combined flag value. Add the numbers together to combine types. See the `Values for mustStartWith, mustEndWith` paragraph in the operation description.\n- `mustEndWith` (integer): The character types the value must end with, as a combined flag value. Add the numbers together to combine types. See the `Values for mustStartWith, mustEndWith` paragraph in the operation description.\n- `maxConsecutive` (integer, required): The maximum number of times the same character can repeat in a row. Must be from 1 to 128. A missing value is read as 0 and is rejected with a 400.\n- `charsToExclude` (string): Characters that must never appear in a generated value." }, "responses": { "200": { "description": "The updated policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordComplexity" } } } }, "400": { "description": "The name is already used by another policy, the name is missing, a value is out of range, or the update failed." }, "404": { "description": "No policy has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/PasswordComplexity/Copy/{id}": { "post": { "tags": [ "Password Complexity" ], "summary": "Copy a password complexity policy", "description": "Creates a copy of a password complexity policy and returns it. The copy is named after the original with \"Copy\" added, and a number when that name is taken.\n\nPermission required: Admin or App role.\n\nValues for `type`: 0 = Password, 1 = Samaccountname.\n\nValues for `mustStartWith, mustEndWith`: 0 = None, 1 = Lowercase, 2 = Uppercase, 4 = Numeric, 8 = Symbol, 16 = Space.", "operationId": "PasswordComplexity_CopyPasswordComplexity", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the policy to copy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The new copy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordComplexity" } } } }, "400": { "description": "The policy could not be copied." }, "404": { "description": "The ID is the empty GUID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/PasswordComplexity/Generate": { "put": { "tags": [ "Password Complexity" ], "summary": "Generate a password from rules", "description": "Generates one random password that follows the rules in the request body and returns it as a JSON string. It does not save anything. The length must be between 2 and 128, and needs must name at least one character type.\n\nPermission required: Admin or App role.\n\nValues for `needs, mustStartWith, mustEndWith`: 0 = None, 1 = Lowercase, 2 = Uppercase, 4 = Numeric, 8 = Symbol, 16 = Space.\n\nCaution: The response contains a generated password in plain text, so handle and store it as a secret.", "operationId": "PasswordComplexity_GeneratePassword", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordRulesUpdateRequest" } } }, "required": true, "description": "The rules the password must follow.\n\n- `length` (integer, required): The length of the password, from 2 to 128.\n- `needs` (integer): The character types the password must include, as a combined flag value. Add the numbers together to combine types. See the `Values for needs, mustStartWith, mustEndWith` paragraph in the operation description.\n- `mustStartWith` (integer): The character types the first character must come from. Same flag values as needs.\n- `mustEndWith` (integer): The character types the last character must come from. Same flag values as needs.\n- `maxConsecutive` (integer): The maximum number of times the same character can repeat in a row. Defaults to 2 when omitted. Use 1 or more. A value of 0 means no password can be generated.\n- `charsToExclude` (string): Characters that must not appear in the password." }, "responses": { "200": { "description": "The generated password as a JSON string.", "content": { "application/json": { "schema": { "type": "string" } } } }, "500": { "description": "The length is out of range or no password could be generated from the rules." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/PasswordComplexity/List": { "get": { "tags": [ "Password Complexity" ], "summary": "List password complexity policies", "description": "Returns every password complexity policy with its full settings.\n\nPermission required: Admin or App role.\n\nValues for `type`: 0 = Password, 1 = Samaccountname.\n\nValues for `mustStartWith, mustEndWith`: 0 = None, 1 = Lowercase, 2 = Uppercase, 4 = Numeric, 8 = Symbol, 16 = Space.", "operationId": "PasswordComplexity_GetListPasswordComplexity", "responses": { "200": { "description": "An array of password complexity policies.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/PasswordComplexity" } } } } }, "400": { "description": "The policies could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/PasswordComplexity/Names": { "get": { "tags": [ "Password Complexity" ], "summary": "List password complexity policy names", "description": "Returns the name and ID of each password complexity policy of the given type, sorted by name. Use it to fill a selection list. The type defaults to password policies.\n\nPermission required: Admin or App role.\n\nValues for `type`: 0 = Password, 1 = Samaccountname.", "operationId": "PasswordComplexity_GetNamesPasswordComplexity", "parameters": [ { "name": "type", "in": "query", "description": "The type of policy to list, as a number: 0 for Password or 1 for Samaccountname. Defaults to 0.", "required": false, "schema": { "$ref": "#/components/schemas/PasswordComplexityType" } } ], "responses": { "200": { "description": "An array of objects with id and name.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } }, "400": { "description": "The names could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/PasswordComplexity/{id}": { "delete": { "tags": [ "Password Complexity" ], "summary": "Delete a password complexity policy", "description": "Deletes one password complexity policy. Use it when you no longer need the policy. An ID that matches no policy is also accepted with 202 and nothing is deleted.\n\nPermission required: Admin or App role.", "operationId": "PasswordComplexity_DeletePasswordComplexity", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the password complexity policy to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "202": { "description": "The delete was accepted. The body is empty." }, "400": { "description": "The policy could not be deleted." }, "404": { "description": "The ID is the empty GUID." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Password Complexity" ], "summary": "Get a password complexity policy", "description": "Returns one password complexity policy with its full settings.\n\nPermission required: Admin or App role.\n\nValues for `type`: 0 = Password, 1 = Samaccountname.\n\nValues for `mustStartWith, mustEndWith`: 0 = None, 1 = Lowercase, 2 = Uppercase, 4 = Numeric, 8 = Symbol, 16 = Space.", "operationId": "PasswordComplexity_GetPasswordComplexity", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the password complexity policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The password complexity policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordComplexity" } } } }, "204": { "description": "No policy has this ID. The body is empty." }, "400": { "description": "The policy could not be retrieved." }, "404": { "description": "The ID is the empty GUID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/PasswordOptions": { "get": { "tags": [ "Password Options" ], "summary": "Get password requirements for local users", "description": "Returns the password requirements that apply to local sign-in accounts: minimum length, unique characters, required character types and how many days before a password expires.\n\nPermission required: No sign-in required.", "operationId": "PasswordOptions_GetPasswordOptions", "responses": { "200": { "description": "The current password options.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordOptions" } } } } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Password Options" ], "summary": "Update password requirements for local users", "description": "Replaces the password requirements for local sign-in accounts and returns the new values. Send every field: a field you leave out is saved as 0 or false. The change takes effect immediately.\n\nPermission required: Admin role.", "operationId": "PasswordOptions_SetPasswordOptions", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordOptions" } } }, "required": true, "description": "The new password options.\n\n- `requiredLength` (integer): The minimum password length.\n- `requiredUniqueChars` (integer): The minimum number of different characters in a password.\n- `requireNonAlphanumeric` (boolean): Whether a password needs a character that is not a letter or digit.\n- `requireLowercase` (boolean): Whether a password needs a lowercase letter.\n- `requireUppercase` (boolean): Whether a password needs an uppercase letter.\n- `requireDigit` (boolean): Whether a password needs a digit.\n- `passwordExpirationInDays` (integer): The number of days before a password expires." }, "responses": { "200": { "description": "The updated password options.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordOptions" } } } }, "400": { "description": "The options could not be updated." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Platform": { "get": { "tags": [ "Platform" ], "summary": "List all platforms", "description": "Returns every platform, including built-in and custom platforms. Each platform carries the identifiers of its password complexity policy and schedules; the linked policy and schedule objects themselves are not included. Use the details route to get them for one platform.\n\nPermission required: Any signed-in user.\n\nValues for `type`: 0 = Unspecified, 1 = Cloud, 2 = Database.", "operationId": "Platform_GetAll", "responses": { "200": { "description": "A list of platform objects, each including its type as a number. See the `Values for type` paragraph in the operation description.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Platform" } } } } } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Platform" ], "summary": "Create a custom platform", "description": "Creates a custom platform, its command plan templates and a resource group for the platform. The new platform is always based on the custom platform and shows command plans, whatever values are sent for those settings.\n\nPermission required: Requires the Admin role.\n\nValues for `type`: 0 = Unspecified, 1 = Cloud, 2 = Database.\n\nCaution: The platform is created immediately, and any base platform or command plan display values you send are replaced by the server.", "operationId": "Platform_Create", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformCreateRequest" } } }, "required": true, "description": "The platform to create. Leave out the identifier so the server assigns one. The server marks the new platform as based on the custom platform and with command plans shown.\n\n- `name` (string, required): Name of the platform. Must be unique among platforms (not case-sensitive).\n- `description` (string): Description of the platform.\n- `builtInAccount` (string): Name of the built-in account whose password is managed when a resource is set to manage its built-in account.\n- `passwordComplexityPolicyId` (string (uuid)): Identifier of the password complexity policy for the platform. When omitted, the default password complexity policy is used.\n- `scheduledChangePolicyId` (string (uuid)): Identifier of the schedule for password changes. May be null.\n- `protectionPolicyScheduleId` (string (uuid)): Identifier of the protection policy schedule. May be null.\n- `scanScheduleId` (string (uuid)): Identifier of the scan schedule. May be null.\n- `verificationScheduleId` (string (uuid)): Identifier of the password verification schedule. May be null.\n- `resetOnMismatch` (boolean): When true, the password is reset if verification fails.\n- `os` (string): Operating system names, as reported by the resource, that map to this custom platform.\n- `type` (integer): Type of platform. See the `Values for type` paragraph in the operation description. Enum value sent as a number." }, "responses": { "200": { "description": "The platform was created; the response is the platform object.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Platform" } } } }, "400": { "description": "The platform could not be created." }, "403": { "description": "The caller is not an administrator." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Platform/Copy/{id}": { "post": { "tags": [ "Platform" ], "summary": "Copy a platform", "description": "Creates a copy of the platform with the given identifier, including its command plans, and returns the new platform. The copy is named after the original with 'Copy' appended (numbered if copies already exist), is not permanent, and uses the same password complexity policy and schedules as the original.\n\nPermission required: Requires the Admin role.\n\nValues for `type`: 0 = Unspecified, 1 = Cloud, 2 = Database.", "operationId": "Platform_CopyPlatform", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier of the platform to copy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The copy was created; the response is the new platform object.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Platform" } } } }, "400": { "description": "The platform could not be copied, for example because too many copies already exist." }, "403": { "description": "The caller is not an administrator." }, "404": { "description": "No platform matches the identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Platform/Names": { "get": { "tags": [ "Platform" ], "summary": "List platform names and identifiers", "description": "Returns the name, identifier, base platform identifier and permanent flag of each platform, sorted by name. Use it to populate platform pickers. The base platform that custom platforms build on is never listed; the includeBaseId flag controls whether the Unspecified platform is listed.\n\nPermission required: Any signed-in user.", "operationId": "Platform_RetrieveNameAndIds", "parameters": [ { "name": "includeBaseId", "in": "query", "description": "When true, leaves the Unspecified platform out of the list. When false (the default), the Unspecified platform is listed first. The base platform identifier is returned either way.", "required": false, "schema": { "type": "boolean", "default": false }, "example": true } ], "responses": { "200": { "description": "A list of objects with id, name, basePlatformId and permanent.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/PlatformNameIdBase" } } } } }, "403": { "description": "The caller is not permitted to list platforms." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Platform/Names/{platformType}": { "get": { "tags": [ "Platform" ], "summary": "List platform names by platform type", "description": "Returns the name, identifier, base platform identifier and permanent flag of every platform of one type, such as cloud or database, sorted by name.\n\nPermission required: Requires the Admin role.\n\nValues for `platformType`: 0 = Unspecified, 1 = Cloud, 2 = Database.", "operationId": "Platform_RetrieveNameAndIdsByType", "parameters": [ { "name": "platformType", "in": "path", "description": "The platform type, sent as a number. See the `Values for platformType` paragraph in the operation description.", "required": true, "schema": { "$ref": "#/components/schemas/PlatformType" } } ], "responses": { "200": { "description": "A list of objects with id, name, basePlatformId and permanent.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/PlatformNameIdBase" } } } } }, "400": { "description": "The platform names could not be retrieved." }, "403": { "description": "The caller is not an administrator." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Platform/{id}": { "delete": { "tags": [ "Platform" ], "summary": "Delete a custom platform", "description": "Deletes the platform with the given identifier, along with its command plans and the resource group that mirrors the platform. Built-in (permanent) platforms cannot be deleted.\n\nPermission required: Requires the Admin role.", "operationId": "Platform_Delete", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier of the platform.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The platform was deleted." }, "400": { "description": "The platform is permanent or could not be deleted." }, "403": { "description": "The caller is not an administrator." }, "404": { "description": "No platform matches the identifier." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Platform" ], "summary": "Get a platform", "description": "Returns the platform with the given identifier.\n\nPermission required: Any signed-in user.\n\nValues for `type`: 0 = Unspecified, 1 = Cloud, 2 = Database.", "operationId": "Platform_GetById", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier of the platform.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The platform object, including its identifier, name, description, policy and schedule identifiers, base platform, and whether it is permanent. The linked policy and schedule objects are not included.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Platform" } } } }, "403": { "description": "The caller is not permitted to view platforms." }, "404": { "description": "No platform matches the identifier." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Platform" ], "summary": "Update a platform", "description": "Replaces the settings of the platform with the given identifier and applies any schedule changes to the platform's scheduled jobs. The identifier in the body must match the path, and the name must not be used by another platform (not case-sensitive). A built-in platform keeps its existing name whatever name is sent.\n\nPermission required: Requires the Admin role.\n\nValues for `type`: 0 = Unspecified, 1 = Cloud, 2 = Database.", "operationId": "Platform_Put", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier of the platform.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformUpdateRequest" } } }, "required": true, "description": "The full platform object, as returned by a get. Every setting is replaced, so send the current values of fields you do not intend to change; an omitted field is cleared.\n\n- `id` (string (uuid), required): Identifier of the platform. Must match the id in the path.\n- `name` (string, required): Name of the platform. Required, and must be unique among platforms (not case-sensitive). Ignored for a built-in platform, which keeps its name.\n- `description` (string): Description of the platform.\n- `builtInAccount` (string): Name of the built-in account whose password is managed when a resource is set to manage its built-in account.\n- `passwordComplexityPolicyId` (string (uuid)): Identifier of the password complexity policy for the platform.\n- `scheduledChangePolicyId` (string (uuid)): Identifier of the schedule for password changes. May be null.\n- `protectionPolicyScheduleId` (string (uuid)): Identifier of the protection policy schedule. May be null.\n- `scanScheduleId` (string (uuid)): Identifier of the scan schedule. May be null.\n- `verificationScheduleId` (string (uuid)): Identifier of the password verification schedule. May be null.\n- `resetOnMismatch` (boolean): When true, the password is reset if verification fails.\n- `os` (string): Operating system names, as reported by the resource, that map to this custom platform.\n- `type` (integer): Type of platform. See the `Values for type` paragraph in the operation description. Enum value sent as a number.\n- `showCommandPlans` (boolean): Whether command plans are shown for the platform.\n- `basePlatformId` (string (uuid)): Identifier of the platform this platform is based on. Send the current value. Built-in platforms have no base platform.\n- `permanent` (boolean): Whether the platform is a built-in platform that cannot be deleted. Send the current value.\n- `icon` (string (base64)): Icon image of the platform, as base64-encoded bytes. Send the current value or it is cleared." }, "responses": { "200": { "description": "The platform was updated; the response is the updated platform object.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Platform" } } } }, "400": { "description": "The identifiers differ, the name is already used, or the update failed." }, "403": { "description": "The caller is not an administrator." }, "404": { "description": "No platform matches the identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Platform/{id}/details": { "get": { "tags": [ "Platform" ], "summary": "Get a platform with its policies and schedules", "description": "Returns the platform with the given identifier, with its password complexity policy and its password change, protection policy and scan schedules filled in. The verification schedule is returned by identifier only.\n\nPermission required: Any signed-in user.\n\nValues for `type`: 0 = Unspecified, 1 = Cloud, 2 = Database.", "operationId": "Platform_GetWithDetails", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier of the platform.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The platform object with its password complexity policy and password change, protection policy and scan schedule objects included.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Platform" } } } }, "403": { "description": "The caller is not permitted to view platforms." }, "404": { "description": "No platform matches the identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Platform/{id}/osmap": { "post": { "tags": [ "Platform" ], "summary": "Map an operating system to a platform", "description": "Associates an operating system name with the platform so resources whose reported operating system contains that name are matched to the platform. Fails if that operating system name is already mapped to any platform; the comparison is not case-sensitive.\n\nPermission required: Requires the Admin or App role.", "operationId": "Platform_AddPlatformMap", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier of the platform.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "string" } } }, "required": true, "description": "The operating system name as a JSON string.\n\n- `(body)` (string, required): The operating system name to map to the platform. Sent as a bare JSON string, not an object." }, "responses": { "200": { "description": "The mapping was created; the response contains the operating system and platform identifier.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OsPlatformMap" } } } }, "400": { "description": "The operating system is already mapped (not case-sensitive) or the mapping could not be created." }, "403": { "description": "The caller does not have the required role." }, "404": { "description": "No platform matches the identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Postgres/ServerStatus": { "get": { "tags": [ "PostgreSQL" ], "summary": "Get the database service status", "description": "Returns the current state of the PostgreSQL database service on the server that handles the request, as a number.\n\nPermission required: Requires the Admin role.\n\nValues for `(response)`: 1 = Stopped, 2 = StartPending, 3 = StopPending, 4 = Running, 5 = ContinuePending, 6 = PausePending, 7 = Paused.\n\nCaution: The value reflects only the server that answers the call and can change at any time.", "operationId": "Postgres_GetDatabaseServiceState", "responses": { "200": { "description": "The service state as a number.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServiceStatus" } } } }, "400": { "description": "The service state could not be read." }, "403": { "description": "The caller is not an administrator." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ProtectionPolicy": { "get": { "tags": [ "Protection Policy" ], "summary": "List protection policies", "description": "Returns the protection policies. Without options it returns every policy, whatever its deleted or disabled status; set isDeleted or isDisabled to true to return only deleted or only disabled policies.\n\nPermission required: Administrators and application accounts.", "operationId": "ProtectionPolicy_GetAll", "parameters": [ { "name": "isDeleted", "in": "query", "description": "When true, returns only deleted policies.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "isDisabled", "in": "query", "description": "When true, returns only disabled policies.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "ignoreStatus", "in": "query", "description": "When true, returns all policies regardless of deleted or disabled status. This matches the result with no options.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "An array of protection policies.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/SimpleProtectionPolicy" } } } } }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Protection Policy" ], "summary": "Create a protection policy", "description": "Creates a protection policy with its resources, resource groups and protected groups, and schedules protection for its resources. Resource and resource group identifiers that do not exist are skipped. Returns the new policy.\n\nPermission required: Administrators and application accounts.", "operationId": "ProtectionPolicy_Post", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleProtectionPolicyCreateRequest" } } }, "required": true, "description": "The protection policy to create.\n\n- `id` (string (GUID)): The policy identifier. Leave empty or omit it to have one assigned.\n- `name` (string, required): The policy name. Up to 256 characters. Policy names must be unique.\n- `description` (string): A description of the policy.\n- `groupMonitorInterval` (integer): A group monitoring interval, in minutes, stored with the policy. In this release it does not change how often protected groups are checked; protection runs on the platform's protection schedule. If omitted or 0, the server stores the default of 60.\n- `managedResourceIds` (array of string (GUID)): Identifiers of the resources in the policy.\n- `managedResourceGroupIds` (array of string (GUID)): Identifiers of the resource groups in the policy.\n- `groupMembers` (array of object): The protected groups and their members, each with groupName and groupMember. Each entry needs groupName; entries with the same groupName form one protected group. Leading and trailing spaces are trimmed." }, "responses": { "200": { "description": "The created protection policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleProtectionPolicy" } } } }, "400": { "description": "The policy could not be created, for example because another policy has the same name." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." }, "409": { "description": "A policy with the identifier in the request body already exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ProtectionPolicy/Copy/{id}": { "post": { "tags": [ "Protection Policy" ], "summary": "Copy a protection policy", "description": "Creates a new protection policy as a copy of an existing one and schedules protection for it. The copy is named after the original with ' Copy' added (then ' Copy (2)' and so on if that name is taken). Returns the new policy.\n\nPermission required: Administrators and application accounts.\n\nCaution: A group monitoring interval of 0 on the original is not carried over; the copy is stored with the default of 60.", "operationId": "ProtectionPolicy_PostCopy", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier of the policy to copy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The new protection policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleProtectionPolicy" } } } }, "400": { "description": "The policy could not be copied, for example because no policy has this identifier." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." }, "404": { "description": "The identifier is empty." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ProtectionPolicy/Groups/{protectionPolicyId}": { "put": { "tags": [ "Protection Policy" ], "summary": "Update the protected groups of a policy", "description": "Replaces the protected groups and their members in a policy with those in the request, adding and removing groups and members as needed. Returns the updated policy.\n\nPermission required: Administrators and application accounts.", "operationId": "ProtectionPolicy_UpdateGroups", "parameters": [ { "name": "protectionPolicyId", "in": "path", "description": "The unique identifier of the protection policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "requestBody": { "description": "The protection policy. Only id and groupMembers are used; the other fields are ignored.\n\n- `id` (string (GUID), required): The policy identifier. Must match the identifier in the path.\n- `name` (string): The policy name. Not used by this route.\n- `description` (string): A description of the policy. Not used by this route.\n- `groupMonitorInterval` (integer): A group monitoring interval, in minutes, stored with the policy. In this release it does not change how often protected groups are checked; protection runs on the platform's protection schedule. Not used by this route.\n- `managedResourceIds` (array of string (GUID)): Identifiers of the resources in the policy. Not used by this route.\n- `managedResourceGroupIds` (array of string (GUID)): Identifiers of the resource groups in the policy. Not used by this route.\n- `groupMembers` (array of object): The protected groups and their members, each with groupName and groupMember. Each entry needs groupName; entries with the same groupName form one protected group. Leading and trailing spaces are trimmed. Groups and members not listed are removed from the policy, so omitting this field removes them all.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleProtectionPolicyUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The updated protection policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleProtectionPolicy" } } } }, "400": { "description": "The identifier in the body does not match the path." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." }, "404": { "description": "No protection policy exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ProtectionPolicy/List": { "get": { "tags": [ "Protection Policy" ], "summary": "List protection policy names and identifiers", "description": "Returns the name and identifier of every protection policy, sorted by name, for use in pickers and lookups. Deleted and disabled policies are included.\n\nPermission required: Administrators and application accounts.\n\nCaution: The list includes deleted and disabled policies, and the query options do not filter it.", "operationId": "ProtectionPolicy_RetrieveNameAndIds", "parameters": [ { "name": "isDeleted", "in": "query", "description": "Accepted but not used; the list is not filtered by it.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "isDisabled", "in": "query", "description": "Accepted but not used; the list is not filtered by it.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "ignoreStatus", "in": "query", "description": "Accepted but not used; the list is not filtered by it.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "An array of objects, each with id and name.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ProtectionPolicy/ManagedResource/{managedResourceId}": { "get": { "tags": [ "Protection Policy" ], "summary": "List policies that cover a resource", "description": "Returns the protection policies that apply to a resource. Policies that contain the resource directly are returned only when they are not deleted or disabled. By default the result also includes policies that reach the resource through a resource group, whatever their status; set directOnly to true to leave those out.\n\nPermission required: Administrators and application accounts.", "operationId": "ProtectionPolicy_FindResourcePolicies", "parameters": [ { "name": "managedResourceId", "in": "path", "description": "The unique identifier of the resource.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "directOnly", "in": "query", "description": "When true, returns only policies that contain the resource directly.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "An array of protection policies.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/SimpleProtectionPolicy" } } } } }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ProtectionPolicy/ResourcesAndGroups/{protectionPolicyId}": { "put": { "tags": [ "Protection Policy" ], "summary": "Update the contents of a protection policy", "description": "Replaces a policy's settings, protected groups, resources and resource groups with those in the request, then reschedules protection. New resources that do not exist, have no host, or are Entra ID tenants are skipped. Returns an object holding the updated policy and the number of resources added.\n\nPermission required: Administrators and application accounts.\n\nCaution: The call also saves the name, description and groupMonitorInterval from the body and clears any disabled or deleted flag, so send the full current policy with your changes. A resource group identifier that does not exist makes the call fail with a server error.", "operationId": "ProtectionPolicy_UpdateResources", "parameters": [ { "name": "protectionPolicyId", "in": "path", "description": "The unique identifier of the protection policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "requestBody": { "description": "The protection policy.\n\n- `id` (string (GUID), required): The policy identifier. Must match the identifier in the path.\n- `name` (string, required): The policy name. Up to 256 characters. Policy names must be unique.\n- `description` (string): A description of the policy.\n- `groupMonitorInterval` (integer): A group monitoring interval, in minutes, stored with the policy. In this release it does not change how often protected groups are checked; protection runs on the platform's protection schedule. If omitted it is saved as 0.\n- `managedResourceIds` (array of string (GUID)): Identifiers of the resources in the policy.\n- `managedResourceGroupIds` (array of string (GUID)): Identifiers of the resource groups in the policy.\n- `groupMembers` (array of object): The protected groups and their members, each with groupName and groupMember. Each entry needs groupName; entries with the same groupName form one protected group. Leading and trailing spaces are trimmed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleProtectionPolicyResourcesAndGroupsRequest" } } }, "required": true }, "responses": { "200": { "description": "An object with data (the updated policy) and recordsTotal (the number of resources added).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfSimpleProtectionPolicy" } } } }, "400": { "description": "The identifier in the body does not match the path." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." }, "404": { "description": "No protection policy exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ProtectionPolicy/Search": { "get": { "tags": [ "Protection Policy" ], "summary": "Search protection policies", "description": "Returns a page of protection policies, optionally limited to those that contain a given resource directly and filtered by text. Deleted and disabled policies are included. Use skip and take to page and orderBy to sort.\n\nPermission required: Administrators and application accounts.", "operationId": "ProtectionPolicy_Search", "parameters": [ { "name": "resourceId", "in": "query", "description": "Return only policies that contain this resource directly.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "filterText", "in": "query", "description": "Text to match against the policy name or description.", "required": false, "schema": { "type": "string" }, "example": "example" }, { "name": "orderBy", "in": "query", "description": "The field to sort by: name or description.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "When true, sorts in descending order.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "The number of rows to skip.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of rows to return. The default of -1 returns all rows.", "required": false, "schema": { "type": "integer", "format": "int32", "default": -1 }, "example": 30 } ], "responses": { "200": { "description": "An object with data (the policies on this page) and recordsTotal (the total number of matches).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfSimpleProtectionPolicy" } } } }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ProtectionPolicy/SearchResourceCandidates": { "get": { "tags": [ "Protection Policy" ], "summary": "Search resources and groups to add to a policy", "description": "Returns a page of resources, resource groups or secret vaults on Windows or Linux platforms that can be added to a protection policy. Use entityType to choose what to search for; when a policy is given, resources already directly in that policy are left out, but resource groups already in it are still listed.\n\nPermission required: Administrators and application accounts.\n\nValues for `entityType`: 0 = Resource, 1 = ResourceGroup, 2 = SecretVault.", "operationId": "ProtectionPolicy_SearchPolicyResourceCandidates", "parameters": [ { "name": "protectionPolicyId", "in": "query", "description": "A policy whose directly assigned resources are left out of the results.", "required": false, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "entityType", "in": "query", "description": "What to search for, as a number: 0 Resource, 1 ResourceGroup, 2 SecretVault. The default is 0.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedResourceOrGroupKind" } }, { "name": "filterText", "in": "query", "description": "Text to match against the name, DNS host name or operating system.", "required": false, "schema": { "type": "string" }, "example": "example" }, { "name": "orderBy", "in": "query", "description": "The field to sort by. The default is name.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "When true, sorts in descending order.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "The number of rows to skip.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of rows to return. The default is 30.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 30 }, "example": 30 } ], "responses": { "200": { "description": "An object with data (the matching rows, each with id, name, platformId, dnsHostName, os, activeSessionCount, entityType and related identifiers) and recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedResourceAndGroupView" } } } }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ProtectionPolicy/{protectionPolicyId}": { "delete": { "tags": [ "Protection Policy" ], "summary": "Delete a protection policy", "description": "Permanently deletes a protection policy and stops scheduled protection for its resources that no other policy covers. The call does not return a body. To mark a policy deleted without removing it, use the status route instead.\n\nPermission required: Administrators and application accounts.\n\nCaution: The deletion is permanent and takes effect immediately; it cannot be undone through the API.", "operationId": "ProtectionPolicy_Delete", "parameters": [ { "name": "protectionPolicyId", "in": "path", "description": "The unique identifier of the protection policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "202": { "description": "The policy was deleted. No body is returned." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." }, "500": { "description": "No protection policy exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Protection Policy" ], "summary": "Get a protection policy", "description": "Returns one protection policy, including its resource, resource group and protected group assignments. The policy is returned whatever its deleted or disabled status.\n\nPermission required: Administrators and application accounts.", "operationId": "ProtectionPolicy_Get", "parameters": [ { "name": "protectionPolicyId", "in": "path", "description": "The unique identifier of the protection policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "ignoreStatus", "in": "query", "description": "Accepted for compatibility. The policy is returned whatever its status with or without this option.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "responses": { "200": { "description": "The protection policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleProtectionPolicy" } } } }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." }, "500": { "description": "No protection policy exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Protection Policy" ], "summary": "Update a protection policy name and description", "description": "Changes the name and description of a protection policy. Other fields in the body are ignored. Returns the updated policy.\n\nPermission required: Administrators and application accounts.", "operationId": "ProtectionPolicy_UpdateProtectionPolicy", "parameters": [ { "name": "protectionPolicyId", "in": "path", "description": "The unique identifier of the protection policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "requestBody": { "description": "The protection policy. Only id, name and description are used.\n\n- `id` (string (GUID), required): The policy identifier. Must match the identifier in the path.\n- `name` (string, required): The policy name. Up to 256 characters. Policy names must be unique.\n- `description` (string): A description of the policy. If omitted, the description is cleared.\n- `groupMonitorInterval` (integer): A group monitoring interval, in minutes, stored with the policy. In this release it does not change how often protected groups are checked; protection runs on the platform's protection schedule. Not used by this route.\n- `managedResourceIds` (array of string (GUID)): Identifiers of the resources in the policy. Not used by this route.\n- `managedResourceGroupIds` (array of string (GUID)): Identifiers of the resource groups in the policy. Not used by this route.\n- `groupMembers` (array of object): The protected groups and their members, each with groupName and groupMember. Not used by this route.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleProtectionPolicyResourcesAndGroupsRequest" } } }, "required": true }, "responses": { "200": { "description": "The updated protection policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleProtectionPolicy" } } } }, "400": { "description": "The identifier in the body does not match the path." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." }, "404": { "description": "No protection policy exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ProtectionPolicy/{protectionPolicyId}/ManagedResource": { "get": { "tags": [ "Protection Policy" ], "summary": "List resources in a protection policy", "description": "Returns the resources that are directly in a protection policy.\n\nPermission required: Administrators and application accounts.\n\nCaution: The response returns full resource records, which can include sensitive settings, so handle and store it with care.", "operationId": "ProtectionPolicy_GetManagedResources", "parameters": [ { "name": "protectionPolicyId", "in": "path", "description": "The unique identifier of the protection policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "An array of resources.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResource" } } } } }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Protection Policy" ], "summary": "Add resources to a protection policy", "description": "Adds resources to a protection policy and reschedules protection. Resources that do not exist or have no host are skipped, and Entra ID tenants are not added. Returns the policy.\n\nPermission required: Administrators and application accounts.\n\nCaution: Skipped resources are not reported in the response, so read the policy afterward to confirm what was added.", "operationId": "ProtectionPolicy_AddManagedResourceToPolicy", "parameters": [ { "name": "protectionPolicyId", "in": "path", "description": "The unique identifier of the protection policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true, "description": "An array of resource identifiers to add.\n\n- `(array item)` (string (GUID), required): The identifier of a resource to add. The body is a JSON array of identifiers." }, "responses": { "202": { "description": "The request was accepted. The body is the policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleProtectionPolicy" } } } }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." }, "404": { "description": "No protection policy exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ProtectionPolicy/{protectionPolicyId}/ManagedResource/{managedResourceId}": { "delete": { "tags": [ "Protection Policy" ], "summary": "Remove a resource from a protection policy", "description": "Removes one resource from a protection policy and reschedules protection for the affected resources. Returns the updated policy.\n\nPermission required: Administrators and application accounts.", "operationId": "ProtectionPolicy_RemoveManagedResourceFromPolicy", "parameters": [ { "name": "protectionPolicyId", "in": "path", "description": "The unique identifier of the protection policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "managedResourceId", "in": "path", "description": "The unique identifier of the resource to remove.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "responses": { "202": { "description": "The removal was accepted. The body is the updated protection policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleProtectionPolicy" } } } }, "400": { "description": "No resource exists with this identifier." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." }, "404": { "description": "No protection policy exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ProtectionPolicy/{protectionPolicyId}/ManagedResourceGroup": { "get": { "tags": [ "Protection Policy" ], "summary": "List resource groups in a protection policy", "description": "Returns the resource groups that are in a protection policy.\n\nPermission required: Administrators and application accounts.", "operationId": "ProtectionPolicy_GetManagedResourceGroups", "parameters": [ { "name": "protectionPolicyId", "in": "path", "description": "The unique identifier of the protection policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "An array of resource groups.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceGroup" } } } } }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Protection Policy" ], "summary": "Add a resource group to a protection policy", "description": "Adds a resource group to a protection policy and reschedules protection. To see the result, read the policy again afterward.\n\nPermission required: Administrators and application accounts.\n\nCaution: The response is the full policy record and can include details of the resources in the policy, so handle it with care.", "operationId": "ProtectionPolicy_AddManagedResourceGroupToPolicy", "parameters": [ { "name": "protectionPolicyId", "in": "path", "description": "The unique identifier of the protection policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "requestBody": { "description": "The identifier of the resource group to add.\n\n- `(body)` (string (GUID), required): The identifier of the resource group. The body is a single JSON identifier.", "content": { "application/json": { "schema": { "type": "string", "format": "uuid" } } }, "required": true }, "responses": { "202": { "description": "The resource group was added. The body is the full policy record as it was read before the change, so it does not yet list the added group, and it has a different shape from the policy returned by the other policy routes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtectionPolicy" } } } }, "400": { "description": "No resource group exists with this identifier." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." }, "404": { "description": "No protection policy exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ProtectionPolicy/{protectionPolicyId}/ManagedResourceGroup/{managedResourceGroupId}": { "delete": { "tags": [ "Protection Policy" ], "summary": "Remove a resource group from a protection policy", "description": "Removes one resource group from a protection policy and reschedules protection for the affected resources. The call does not return a body.\n\nPermission required: Administrators and application accounts.", "operationId": "ProtectionPolicy_RemoveManagedResourceGroupFromPolicy", "parameters": [ { "name": "protectionPolicyId", "in": "path", "description": "The unique identifier of the protection policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "managedResourceGroupId", "in": "path", "description": "The unique identifier of the resource group to remove.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "202": { "description": "The removal was accepted. No body is returned." }, "400": { "description": "No resource group exists with this identifier." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." }, "404": { "description": "No protection policy exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ProtectionPolicy/{protectionPolicyId}/Status": { "put": { "tags": [ "Protection Policy" ], "summary": "Disable, enable, delete or restore a policy", "description": "Sets whether a protection policy is deleted or disabled and reschedules protection. Send only the options to change. Returns the updated policy.\n\nPermission required: Administrators and application accounts.\n\nCaution: Protection is rescheduled before the new status is saved, so deleting, disabling or enabling a policy through this route does not change scheduled protection during the call. The schedule catches up the next time protection is rescheduled for the affected resources, for example when the policy's resources change.", "operationId": "ProtectionPolicy_PutStatus", "parameters": [ { "name": "protectionPolicyId", "in": "path", "description": "The unique identifier of the protection policy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "isDeleted", "in": "query", "description": "Set true to mark the policy deleted, or false to restore it. The policy is kept and can be restored.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "isDisabled", "in": "query", "description": "Set true to disable the policy, or false to enable it.", "required": false, "schema": { "type": "boolean" }, "example": false } ], "responses": { "200": { "description": "The updated protection policy.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleProtectionPolicy" } } } }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator or application account." }, "404": { "description": "No protection policy exists with this identifier." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RegisteredService": { "get": { "tags": [ "Registered Service" ], "summary": "List service nodes", "description": "Returns the service nodes known to the proxy service, as it reports them at the time of the call.\n\nPermission required: Administrators only.\n\nCaution: The response can include node properties and network details, so treat it as sensitive.", "operationId": "RegisteredService_GetAllNodes", "responses": { "200": { "description": "An array of nodes, each with id, nid, subject, hostname, advertise, tags and properties.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NodeDetail" } } } } }, "400": { "description": "The node list could not be retrieved from the proxy." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RegisteredService/Nodes": { "get": { "tags": [ "Registered Service" ], "summary": "List service node names and status", "description": "Returns each distinct service or service node name with a status number. For a named group of services the status is all offline, all online or mixed; for a service node it is the node's own status. The call first tries to refresh node status from the proxy service; if the refresh fails it still returns the last stored status.\n\nPermission required: Administrators only.\n\nValues for `value`: 0 = Offline, 1 = Online (Running), 2 = Mixed (service groups only).", "operationId": "RegisteredService_GetDistinctNodes", "responses": { "200": { "description": "An array of objects, each with key (the lower-case name) and value (the status number).", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string" }, "value": { "type": "integer", "format": "int32" } } } } } } }, "400": { "description": "The nodes could not be listed." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RegisteredService/Nodes/{id}/stats": { "get": { "tags": [ "Registered Service" ], "summary": "Get statistics for a service node", "description": "Returns current resource statistics for one service node, as reported live by the proxy service.\n\nPermission required: Administrators only.", "operationId": "RegisteredService_GetNodeStats", "parameters": [ { "name": "id", "in": "path", "description": "The identifier of the service node: the id field (not nid) returned by the list service nodes route. It is passed to the proxy service unchanged and is not the stored service record identifier used by the node properties route.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "An array of objects, each with mem, cpu, feature, pid and ppid.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NodeStats" } } } } }, "400": { "description": "The statistics could not be retrieved from the proxy." }, "401": { "description": "The request is not signed in, or the sign-in has expired." }, "403": { "description": "The caller is not an administrator." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ReplaySession/Active/Search": { "get": { "tags": [ "Replay Session" ], "summary": "Search recordings of active sessions", "description": "Searches the recorded activity of sessions that are still in progress and returns metadata for the sessions with matching records. Use it to find live sessions by what was typed or shown.\n\nPermission required: Admin or Auditing and Reporting role, with multi-factor authentication complete.\n\nValues for `key`: 0 = All, 1 = Windows_Audit, 2 = StdIn, 3 = StdOut, -1 = Unknown.", "operationId": "ReplaySession_SearchActive", "parameters": [ { "name": "searchFilter", "in": "query", "description": "Text to look for in the recorded session activity. Needed to get any results; without it the response is empty.", "required": false, "schema": { "type": "string" }, "example": "example-text" }, { "name": "startDate", "in": "query", "description": "Start of the date range to search (UTC).", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-01T00:00:00Z" }, { "name": "endDate", "in": "query", "description": "End of the date range to search (UTC).", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-31T23:59:59Z" }, { "name": "key", "in": "query", "description": "Type of recorded activity to search, as an integer. Defaults to 0 (All).", "required": false, "schema": { "$ref": "#/components/schemas/StreamType" } } ], "responses": { "200": { "description": "The matching session metadata, with the records that matched.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ReplayMetadata" } } } } }, "204": { "description": "No search text was given, no sessions matched, or the search could not be completed." }, "400": { "description": "The search failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ReplaySession/Historical/Search": { "get": { "tags": [ "Replay Session" ], "summary": "Search recordings of completed sessions", "description": "Searches the recorded activity of sessions that have ended and returns metadata for the sessions with matching records. Use it to find past sessions by what was typed or shown.\n\nPermission required: Admin or Auditing and Reporting role, with multi-factor authentication complete.\n\nValues for `key`: 0 = All, 1 = Windows_Audit, 2 = StdIn, 3 = StdOut, -1 = Unknown.", "operationId": "ReplaySession_SearchHistorical", "parameters": [ { "name": "searchFilter", "in": "query", "description": "Text to look for in the recorded session activity. Needed to get any results; without it the response is empty.", "required": false, "schema": { "type": "string" }, "example": "example-text" }, { "name": "startDate", "in": "query", "description": "Start of the date range to search (UTC).", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-01T00:00:00Z" }, { "name": "endDate", "in": "query", "description": "End of the date range to search (UTC).", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-31T23:59:59Z" }, { "name": "key", "in": "query", "description": "Type of recorded activity to search, as an integer. Defaults to 0 (All).", "required": false, "schema": { "$ref": "#/components/schemas/StreamType" } } ], "responses": { "200": { "description": "The matching session metadata, with the records that matched.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ReplayMetadata" } } } } }, "204": { "description": "No search text was given, no sessions matched, or the search could not be completed." }, "400": { "description": "The search failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ReplaySession/live": { "get": { "tags": [ "Replay Session" ], "summary": "List live sessions", "description": "Returns the sessions that are in progress. Admins see every live session. Other users see their own sessions, plus, when filter is all, the sessions they hold the Live Session Viewer permission for.\n\nPermission required: Admin role, or a role with an auditor permission. Admins receive every live session; other users, including read-only administrators, receive only their own sessions or the sessions they hold the Live Session Viewer permission for. Multi-factor authentication must be complete.", "operationId": "ReplaySession_GetFilteredLiveSessions", "parameters": [ { "name": "filter", "in": "query", "description": "\"mine\" returns only the caller's own sessions; any other value, such as \"all\", also returns every session the caller can view. Defaults to \"mine\". Admins always receive all live sessions.", "required": false, "schema": { "type": "string", "default": "mine" }, "example": "mine" } ], "responses": { "200": { "description": "The list of live sessions.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ProxySession" } }, "example": [ { "id": "00000000-0000-0000-0000-000000000000", "activitySessionId": "00000000-0000-0000-0000-000000000000", "record": true, "type": "", "active": true, "locked": false } ] } } }, "400": { "description": "The list could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ReplaySession/live/{proxySessionId}/lock": { "put": { "tags": [ "Replay Session" ], "summary": "Lock or unlock a live session", "description": "Locks a live session so the user cannot keep working in it, or removes the locks when locked is false. The lock can cover the activity, the resource, the user, or just this session, and the action is recorded in the audit log.\n\nPermission required: Admin role, or a custom role that includes the Lock Session permission for the session's user and resource. Users whose role has an auditor permission can also lock their own sessions. Read-only administrators need the same permission. Multi-factor authentication must be complete.\n\nCaution: Takes effect immediately and can lock the user or resource out of other sessions, depending on the lock options selected.", "operationId": "ReplaySession_LockLiveSession", "parameters": [ { "name": "proxySessionId", "in": "path", "description": "ID of the live session (the proxy session ID).", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "requestBody": { "description": "The lock request. Set locked to true to lock, or false (the default) to remove all locks.\n\n- `id` (string (guid)): Optional. The session is identified by the path.\n- `activitySessionIds` (array of string (guid)): Optional. The session to lock is identified by the path.\n- `lockMessage` (string): Message shown to the user in the locked session. Defaults to a standard message that asks the user to contact an administrator.\n- `lockTitle` (string): Title of the lock message. Defaults to \"Netwrix Privilege Secure\".\n- `locked` (boolean): True locks the session; false removes all locks. Defaults to false, so a body without it removes all locks.\n- `lockActivity` (boolean): Lock the whole activity this session belongs to. Applies when locked is true.\n- `lockResource` (boolean): Lock the user and resource combination. Applies when locked is true.\n- `lockUser` (boolean): Lock the user's account and all of the user's active and pending sessions, rather than only this session. Applies when locked is true.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LiveSessionRequest" } } }, "required": true }, "responses": { "200": { "description": "The lock request that was applied.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LiveSessionRequest" } } } }, "400": { "description": "The request body was missing or the lock could not be applied." }, "403": { "description": "The caller does not have permission to lock this session." }, "404": { "description": "The session or its activity was not found, or the session is no longer live." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ReplaySession/live/{sessionId}": { "get": { "tags": [ "Replay Session" ], "summary": "Get a live session", "description": "Returns one session that is in progress. Each call adds a \"viewed\" entry to the audit log unless refresh is true.\n\nPermission required: Admin role, or a custom role that includes the Live Session Viewer permission for the session's user and resource. Users whose role has an auditor permission can also view their own sessions. Read-only administrators need the same permission. Multi-factor authentication must be complete.", "operationId": "ReplaySession_GetLiveSession", "parameters": [ { "name": "sessionId", "in": "path", "description": "ID of the live session (the proxy session ID).", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" }, { "name": "refresh", "in": "query", "description": "Set to true when reloading a session that is already open, so no new \"viewed\" audit entry is written. Defaults to false.", "required": false, "schema": { "type": "boolean" }, "example": false } ], "responses": { "200": { "description": "The live session.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProxySession" } } } }, "400": { "description": "The session could not be retrieved, or its recording is not available." }, "403": { "description": "The caller does not have permission to view this session." }, "404": { "description": "The session was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ReplaySession/live/{sessionId}/terminate": { "delete": { "tags": [ "Replay Session" ], "summary": "End a live session immediately", "description": "Ends a session that is currently in progress and records the action in the audit log. Use it when an auditor needs to cut off a live session.\n\nPermission required: Admin role, or a custom role that includes the Terminate Session permission for the session's user and resource. Users whose role has an auditor permission can also end their own sessions. Read-only administrators need the same permission. Multi-factor authentication must be complete.\n\nCaution: Ends the session immediately and cannot be undone; the user loses their connection.", "operationId": "ReplaySession_TerminateSession", "parameters": [ { "name": "sessionId", "in": "path", "description": "ID of the live session (the proxy session ID) to end.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } ], "responses": { "200": { "description": "The session was ended." }, "400": { "description": "The session could not be ended, or the recording service rejected the request." }, "403": { "description": "The caller does not have permission to end this session." }, "404": { "description": "The session was not found or is no longer live." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ReplaySession/Metadata/{proxySessionId}": { "get": { "tags": [ "Replay Session" ], "summary": "Get recording metadata for a session", "description": "Returns the recording metadata for one session. The search text, date range and activity type can be supplied to narrow the result; the recording service applies them. Use it to load the details of a session found by a search.\n\nPermission required: Admin role, or a role that grants access to the session's user and resource: Live Session Viewer or View Recordings for an active session, or View Recordings for an ended session. Users can also view their own sessions. Read-only administrators need the same permissions. Multi-factor authentication must be complete.\n\nValues for `key`: 0 = All, 1 = Windows_Audit, 2 = StdIn, 3 = StdOut, -1 = Unknown.", "operationId": "ReplaySession_GetMetadata", "parameters": [ { "name": "proxySessionId", "in": "path", "description": "ID of the session (the proxy session ID).", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, { "name": "searchFilter", "in": "query", "description": "Text to look for in the recorded session activity.", "required": false, "schema": { "type": "string" }, "example": "example-text" }, { "name": "startDate", "in": "query", "description": "Start of the date range to search (UTC).", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-01T00:00:00Z" }, { "name": "endDate", "in": "query", "description": "End of the date range to search (UTC).", "required": false, "schema": { "type": "string", "format": "date-time" }, "example": "2026-01-31T23:59:59Z" }, { "name": "key", "in": "query", "description": "Type of recorded activity to search, as an integer. Defaults to 0 (All).", "required": false, "schema": { "$ref": "#/components/schemas/StreamType" } } ], "responses": { "200": { "description": "The session metadata.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReplayMetadata" } } } }, "204": { "description": "No metadata could be retrieved for the session." }, "400": { "description": "The metadata could not be retrieved." }, "401": { "description": "The caller does not have permission to view this session." }, "404": { "description": "The session was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Report/DownloadCsv/{reportId}": { "get": { "tags": [ "Report" ], "summary": "Download a report as CSV", "description": "Runs a saved report and returns its results as a CSV file named Report.csv.\n\nPermission required: Admin, App or Auditing and Reporting role, with multi-factor authentication complete.", "operationId": "Report_DownloadCsv", "parameters": [ { "name": "reportId", "in": "path", "description": "ID of the report.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The CSV file (text/csv).", "content": { "text/csv": { "schema": { "type": "string" } } } }, "400": { "description": "The file could not be created." }, "404": { "description": "The report was not found." }, "500": { "description": "The report file could not be generated." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Report/DownloadPdf/{reportId}": { "get": { "tags": [ "Report" ], "summary": "Download a report as PDF", "description": "Runs a saved report and returns its results as a PDF file named Report.pdf.\n\nPermission required: Admin, App or Auditing and Reporting role, with multi-factor authentication complete.", "operationId": "Report_DownloadPdf", "parameters": [ { "name": "reportId", "in": "path", "description": "ID of the report.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The PDF file (application/pdf).", "content": { "application/pdf": { "schema": { "type": "string", "format": "binary" } } } }, "400": { "description": "The file could not be created." }, "404": { "description": "The report was not found." }, "503": { "description": "The PDF service is busy. Retry later." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Report/GetSubscription/{reportId}": { "get": { "tags": [ "Report" ], "summary": "Get your subscription to a report", "description": "Returns the calling user's subscription to a report, including the ID of the delivery schedule and whether the CSV and PDF files are sent. Use it to show or edit the user's current subscription.\n\nPermission required: Admin, App or Auditing and Reporting role, with multi-factor authentication complete.", "operationId": "Report_GetReportSubscription", "parameters": [ { "name": "reportId", "in": "path", "description": "ID of the report.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The subscription.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReportSubscription" } } } }, "204": { "description": "The caller is not subscribed to this report." }, "400": { "description": "The subscription could not be retrieved." }, "404": { "description": "The report or the caller's account was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Report/Run/{id}": { "post": { "tags": [ "Report" ], "summary": "Run a report", "description": "Runs a saved report and returns its results as a table. The body sets paging, sorting and text filtering for the returned rows.\n\nPermission required: Any signed-in user, with multi-factor authentication complete.\n\nCaution: The results can include sensitive details about accounts, resources and sessions.", "operationId": "Report_RunReport", "parameters": [ { "name": "id", "in": "path", "description": "ID of the report.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SearchParams" } } }, "required": true, "description": "Paging, sorting and filter settings for the results. The body is required.\n\n- `skip` (integer): Number of rows to skip. Defaults to 0.\n- `take` (integer): Number of rows to return. Defaults to 100.\n- `orderBy` (string): Name of the column to sort by.\n- `orderDescending` (boolean): Sort in descending order. Defaults to false.\n- `filterText` (string): Return only rows that contain this text.\n- `filterColumns` (array of string): Accepted but not used. The filter text is matched against all text columns of the report." }, "responses": { "200": { "description": "The report results: a data list of rows and a recordsTotal count of rows that matched.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfObject" } } } }, "400": { "description": "The body is missing, the report does not exist, or the report could not be run." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Report/Tree": { "get": { "tags": [ "Report" ], "summary": "List reports and report folders", "description": "Returns the folders and reports available to the calling user, including which reports the user has marked as favorites. Use it to build a report browser.\n\nPermission required: Admin, App or Auditing and Reporting role, with multi-factor authentication complete.", "operationId": "Report_RetrieveTree", "responses": { "200": { "description": "An object with a folders list and a reports list.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReportTree" } } } }, "400": { "description": "The tree could not be retrieved." }, "404": { "description": "The user or the tree was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Report/UpdateSubscription": { "put": { "tags": [ "Report" ], "summary": "Update a report subscription", "description": "Replaces the stored settings of an existing report subscription, such as whether the CSV and PDF files are sent. Send the full subscription as returned by the get subscription route, because omitted fields are reset.\n\nPermission required: Admin, App or Auditing and Reporting role, with multi-factor authentication complete.", "operationId": "Report_UpdateSubscription", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReportSubscriptionUpdateRequest" } } }, "required": true, "description": "The full subscription. The report and account IDs identify which subscription to change.\n\n- `reportId` (string (guid), required): ID of the report.\n- `managedAccountId` (string (guid), required): ID of the subscribed account.\n- `scheduledChangePolicyId` (string (guid), required): ID of the schedule that controls when the report is sent. Stored value only: changing it here does not reschedule the existing scheduled job. To change the schedule, subscribe again with the current job ID.\n- `subscribedToCsv` (boolean): Send the report as a CSV file. Defaults to true if omitted.\n- `subscribedToPdf` (boolean): Send the report as a PDF file. Defaults to true if omitted.\n- `actionJobId` (string (guid)): ID of the scheduled job for the subscription. Send the current value; if omitted it is cleared." }, "responses": { "200": { "description": "The updated subscription.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReportSubscription" } } } }, "400": { "description": "The subscription could not be updated." }, "404": { "description": "No subscription exists for this report and account." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Report/{id}": { "get": { "tags": [ "Report" ], "summary": "Get a report", "description": "Returns the saved definition of one report: its name, data source, time range and filter conditions.\n\nPermission required: Admin, App or Auditing and Reporting role, with multi-factor authentication complete.\n\nValues for `durationType`: 0 = LastHour, 1 = Last4Hours, 2 = Last8Hours, 3 = Last24Hours, 4 = Last5Days, 5 = Last7Days, 6 = Last14Days, 7 = Last30Days, 8 = Custom.\n\nValues for `reportAttributes[].operator`: 0 = Equals, 1 = NotEquals, 2 = Contains, 3 = NotContains, 4 = StartsWith, 5 = EndsWith, 6 = LessThan, 7 = GreaterThan.", "operationId": "Report_GetReport", "parameters": [ { "name": "id", "in": "path", "description": "ID of the report.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The report definition.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Report" } } } }, "400": { "description": "The report could not be retrieved." }, "404": { "description": "The report was not found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ReportSource": { "get": { "tags": [ "Report Source" ], "summary": "List report sources", "description": "Returns the data sources that reports can be built on, such as session activity, along with the columns each one provides. Use a source's ID when saving a report.\n\nPermission required: Admin, App or Auditing and Reporting role, with multi-factor authentication complete.", "operationId": "ReportSource_GetReportSource", "responses": { "200": { "description": "The list of report sources.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ReportSource" } } } } }, "400": { "description": "The sources could not be retrieved." }, "404": { "description": "No report sources exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesPermission/NameAndIds": { "get": { "tags": [ "Permissions" ], "summary": "List role permissions", "description": "Returns every permission that can be assigned to a role, with its name, ID and the group it belongs to. Use it to look up permission IDs.\n\nPermission required: Admin role.", "operationId": "RolesPermission_GetNameAndIds", "responses": { "200": { "description": "The list of permissions.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/PermissionNamesAndId" } } } } }, "400": { "description": "The permissions could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole": { "post": { "tags": [ "Roles" ], "summary": "Create a custom role", "description": "Creates a custom role with the name, description and target that you send. The role starts with no permissions, scope or members; add them with the other role routes. Use it to delegate part of administration to people who are not administrators.\n\nPermission required: Administrator role.\n\nValues for `roleTarget`: 0 = AccessPolicies, 1 = Credentials, 2 = Auditors.", "operationId": "RolesRole_CreateRole", "requestBody": { "description": "The role.\n\n- `name` (string, required): The role name. It must be unique among roles. The comparison ignores case.\n- `description` (string): A description of the role.\n- `roleTarget` (integer): What the role delegates: access policies, credentials, or auditing. Sent as a number; see the `Values for roleTarget` paragraph in the operation description. When omitted it is 0 (AccessPolicies).\n- `allActivities` (boolean): When true, the role covers all activities.\n- `allCredentials` (boolean): When true, the role covers all credentials.\n- `allPolicies` (boolean): When true, the role covers all access policies.\n- `allResources` (boolean): When true, the role covers all resources.\n- `allUsers` (boolean): When true, the role covers all users.\n- `builtInRole` (boolean): Marks a built-in role. Send false for a custom role.\n- `isDeleted` (boolean): Send false.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RolesRoleCreateRequest" }, "example": { "name": "", "description": "", "roleTarget": 2, "allActivities": false, "allPolicies": false, "allResources": false, "allCredentials": false, "allUsers": false, "builtInRole": false, "isDeleted": false } } }, "required": true }, "responses": { "200": { "description": "Returns the new role, including its ID.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RolesRole" } } } }, "400": { "description": "A role with that name already exists, or the role could not be created." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/AddRolesToManagedAccount/{managedAccountId}": { "post": { "tags": [ "Roles" ], "summary": "Give roles to a user", "description": "Gives a user one or more roles in a single call. It handles the built-in Administrator and Reviewer roles and custom roles together. Custom roles the user already holds are skipped and not counted.\n\nPermission required: Administrator role.\n\nCaution: Adding the Administrator role gives the user or group full administrative access to the console.", "operationId": "RolesRole_AddRolesToManagedAccount", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the user (managed account) on the Users & Groups page.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "description": "A JSON array of the roles to add. Send each role with its id and name.\n\n- `id` (string (GUID)): The ID of the role. Required for a custom role, which is matched by ID. Not used for the built-in Administrator and Reviewer roles.\n- `name` (string): The name of the role. Required for the built-in roles, which are matched by this exact name: Administrator or Reviewer. The console sends it for every role.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/RolesRole" } } } }, "required": true }, "responses": { "200": { "description": "Returns an object with item1, the number of roles added, and item2, the number that failed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoleAssignmentCounts" } } } }, "400": { "description": "The roles could not be added." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The user does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/AddRolesToManagedAccountGroup/{managedAccountGroupId}": { "post": { "tags": [ "Roles" ], "summary": "Give roles to a group", "description": "Gives a group one or more roles in a single call. It handles the built-in Administrator and Reviewer roles and custom roles together. Members of the group receive the roles through the group, and custom roles the group already holds are skipped and not counted. The Administrator role can be given only to a group that is backed by a directory group; otherwise that item counts as failed.\n\nPermission required: Administrator role.\n\nCaution: Adding the Administrator role gives the user or group full administrative access to the console.", "operationId": "RolesRole_AddRolesToManagedAccountGroup", "parameters": [ { "name": "managedAccountGroupId", "in": "path", "description": "The ID of the group (managed account group) on the Users & Groups page.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" } ], "requestBody": { "description": "A JSON array of the roles to add. Send each role with its id and name.\n\n- `id` (string (GUID)): The ID of the role. Required for a custom role, which is matched by ID. Not used for the built-in Administrator and Reviewer roles.\n- `name` (string): The name of the role. Required for the built-in roles, which are matched by this exact name: Administrator or Reviewer. The console sends it for every role.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/RolesRole" } } } }, "required": true }, "responses": { "200": { "description": "Returns an object with item1, the number of roles added, and item2, the number that failed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoleAssignmentCounts" } } } }, "400": { "description": "The roles could not be added." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The group does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/NameAndIds": { "get": { "tags": [ "Roles" ], "summary": "List the names and IDs of all roles", "description": "Returns the name and ID of every role, sorted by name, including the built-in Auditors role. Use it to fill a role picker or to look up a role ID. Deleted roles are not included, and the Administrator and Reviewer roles are not listed.\n\nPermission required: Administrator role.", "operationId": "RolesRole_GetNameAndIds", "responses": { "200": { "description": "Returns an array of objects with an id and a name.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } }, "400": { "description": "The roles could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/RemoveRolesFromManagedAccount/{managedAccountId}": { "delete": { "tags": [ "Roles" ], "summary": "Remove roles from a user", "description": "Removes one or more roles from a user in a single call. A signed-in administrator cannot remove their own account from the Administrator role; that item counts as failed. The server reads the list from the request body of this DELETE request, so the body is required. Some HTTP clients and API tools drop the body of a DELETE request; check that yours sends it.\n\nPermission required: Administrator role.", "operationId": "RolesRole_RemoveRolesFromManagedAccount", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the user (managed account) on the Users & Groups page.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "description": "A JSON array of the roles to remove. Send each role with its id and name.\n\n- `id` (string (GUID)): The ID of the role. Required for a custom role, which is matched by ID. Not used for the built-in Administrator and Reviewer roles.\n- `name` (string): The name of the role. Required for the built-in roles, which are matched by this exact name: Administrator or Reviewer. The console sends it for every role.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/RolesRole" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of roles removed (passed), the number that failed, and a message for each item.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "400": { "description": "The roles could not be removed." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The user does not exist, or the signed-in user's account could not be found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/RemoveRolesFromManagedAccountGroup/{managedAccountGroupId}": { "delete": { "tags": [ "Roles" ], "summary": "Remove roles from a group", "description": "Removes one or more roles from a group in a single call. The Administrator role cannot be removed from a group that the signed-in administrator belongs to; that item counts as failed. The Administrator role can be removed only from a group that is backed by a directory group; otherwise that item counts as failed. The server reads the list from the request body of this DELETE request, so the body is required. Some HTTP clients and API tools drop the body of a DELETE request; check that yours sends it.\n\nPermission required: Administrator role.", "operationId": "RolesRole_RemoveRolesFromManagedAccountGroup", "parameters": [ { "name": "managedAccountGroupId", "in": "path", "description": "The ID of the group (managed account group) on the Users & Groups page.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" } ], "requestBody": { "description": "A JSON array of the roles to remove. Send each role with its id and name.\n\n- `id` (string (GUID)): The ID of the role. Required for a custom role, which is matched by ID. Not used for the built-in Administrator and Reviewer roles.\n- `name` (string): The name of the role. Required for the built-in roles, which are matched by this exact name: Administrator or Reviewer. The console sends it for every role.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/RolesRole" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of roles removed (passed), the number that failed, and a message for each item.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassFailReport" } } } }, "400": { "description": "The roles could not be removed." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The group does not exist, or the signed-in user's account could not be found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/SearchRolesForManagedAccount/{managedAccountId}": { "get": { "tags": [ "Roles" ], "summary": "List the roles of a user", "description": "Returns the roles that a user holds, as a page of results that you can filter by name or description. The built-in Administrator and Reviewer roles appear when the user has them.\n\nPermission required: Administrator role.\n\nValues for `roleTarget`: 0 = AccessPolicies, 1 = Credentials, 2 = Auditors.", "operationId": "RolesRole_SearchRolesForManagedAccount", "parameters": [ { "name": "managedAccountId", "in": "path", "description": "The ID of the user (managed account) on the Users & Groups page.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "Skip", "in": "query", "description": "The number of rows to skip, for paging. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "The maximum number of rows to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "A property name of the returned rows, ignoring case. The default is Name. An unrecognized name returns the rows ordered by ID.", "required": false, "schema": { "type": "string" }, "example": "Name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only roles whose name or description contains this value, ignoring case.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns a page of results in data, with the total number of matching rows in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfRolesRole" } } } }, "400": { "description": "The roles could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The user does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/SearchRolesForManagedAccountGroup/{managedAccountGroupId}": { "get": { "tags": [ "Roles" ], "summary": "List the roles of a group", "description": "Returns the roles that a group holds, as a page of results that you can filter by name or description. The built-in Administrator and Reviewer roles appear when the group has them.\n\nPermission required: Administrator role.\n\nValues for `roleTarget`: 0 = AccessPolicies, 1 = Credentials, 2 = Auditors.", "operationId": "RolesRole_SearchRolesForManagedAccountGroup", "parameters": [ { "name": "managedAccountGroupId", "in": "path", "description": "The ID of the group (managed account group) on the Users & Groups page.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" }, { "name": "Skip", "in": "query", "description": "The number of rows to skip, for paging. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "The maximum number of rows to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "A property name of the returned rows, ignoring case. The default is Name. An unrecognized name returns the rows ordered by ID.", "required": false, "schema": { "type": "string" }, "example": "Name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only roles whose name or description contains this value, ignoring case.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns a page of results in data, with the total number of matching rows in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfRolesRole" } } } }, "400": { "description": "The roles could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The group does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}": { "delete": { "tags": [ "Roles" ], "summary": "Delete a role", "description": "Deletes a role. The role no longer appears in role lists, and its members no longer receive the permissions it granted. Use it when a delegated responsibility is no longer needed.\n\nPermission required: Administrator role.\n\nCaution: The role is deleted immediately and its members lose the access it granted.", "operationId": "RolesRole_DeleteRole", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "responses": { "200": { "description": "The role was deleted. There is no response body." }, "400": { "description": "The role could not be deleted." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Roles" ], "summary": "Get a role", "description": "Returns one role with its name, description, target and the flags that say whether it covers all activities, credentials, policies, resources or users. It does not return the permissions or the members of the role. Use the other role routes for those.\n\nPermission required: Administrator role.\n\nValues for `roleTarget`: 0 = AccessPolicies, 1 = Credentials, 2 = Auditors.", "operationId": "RolesRole_GetRole", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "responses": { "200": { "description": "Returns the role.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RolesRole" } } } }, "400": { "description": "The role could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Roles" ], "summary": "Update a role", "description": "Replaces the stored values of a role with the values you send, such as its name, description and the flags that cover all activities, credentials, policies, resources or users. Fields you leave out are reset to their defaults (false, or 0 for the target), so send the full role. The ID in the body must match the ID in the path. Use it to rename a role or change its description.\n\nPermission required: Administrator role.\n\nValues for `roleTarget`: 0 = AccessPolicies, 1 = Credentials, 2 = Auditors.", "operationId": "RolesRole_UpdateRole", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "The full role, with the same ID as in the path.\n\n- `id` (string (GUID), required): The ID of the role. It must equal the ID in the path.\n- `name` (string, required): The role name. It must be unique among roles. The comparison ignores case.\n- `description` (string): A description of the role.\n- `roleTarget` (integer): What the role delegates: access policies, credentials, or auditing. Sent as a number; see the `Values for roleTarget` paragraph in the operation description. When omitted it is 0 (AccessPolicies).\n- `allActivities` (boolean): When true, the role covers all activities.\n- `allCredentials` (boolean): When true, the role covers all credentials.\n- `allPolicies` (boolean): When true, the role covers all access policies.\n- `allResources` (boolean): When true, the role covers all resources.\n- `allUsers` (boolean): When true, the role covers all users.\n- `builtInRole` (boolean): Marks a built-in role. Send false for a custom role.\n- `isDeleted` (boolean): Send false.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RolesRoleUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the updated role.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RolesRole" } } } }, "400": { "description": "The IDs in the path and body differ, another role already has that name, or the role could not be updated." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}/AccessPolicy": { "post": { "tags": [ "Roles" ], "summary": "Add access policies to a role", "description": "Adds access policies to the scope of a role. Role members can then change those policies as far as the permissions of the role allow. Policies already in the scope are skipped.\n\nPermission required: Administrator role.", "operationId": "RolesRole_AddAccessPolicyToRoleMultiple", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "A JSON array of the IDs of the access policies to add.\n\n- `(array item)` (string (GUID), required): The ID of one item. The body is a JSON array of IDs.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of access policies added.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The access policies could not be added." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Roles" ], "summary": "Remove access policies from a role", "description": "Removes access policies from the scope of a role. Role members can no longer change those policies through the role.\n\nPermission required: Administrator role.", "operationId": "RolesRole_RemoveAccessPolicyFromRoleMultiple", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "A JSON array of the IDs of the access policies to remove.\n\n- `(array item)` (string (GUID), required): The ID of one item. The body is a JSON array of IDs.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of access policies removed.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The access policies could not be removed." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}/ActivityOrGroup": { "post": { "tags": [ "Roles" ], "summary": "Add activities and activity groups to a role", "description": "Adds activities or activity groups to the scope of a role. Use it to limit the activities that role members can work with. Entries already in the scope are skipped.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = Activity, 1 = ActivityGroup.", "operationId": "RolesRole_AddActivityOrGroupsToRoleMultiple", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "A JSON array of the activities or activity groups to add.\n\n- `id` (string (GUID), required): The ID of the entry to add or remove. Entries that do not exist are skipped.\n- `entityType` (integer): The kind of entry that the ID identifies. Sent as a number; see the `Values for entityType` paragraph in the operation description. When omitted it is 0 (Activity), so always send it.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityOrGroupReference" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of entries added.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The entries could not be added." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Roles" ], "summary": "Remove activities and groups from a role", "description": "Removes activities or activity groups from the scope of a role. Use it to narrow the activities that role members can work with.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = Activity, 1 = ActivityGroup.", "operationId": "RolesRole_RemoveActivityOrGroupsFromRoleMultiple", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "A JSON array of the activities or activity groups to remove.\n\n- `id` (string (GUID), required): The ID of the entry to add or remove. Entries that do not exist are skipped.\n- `entityType` (integer): The kind of entry that the ID identifies. Sent as a number; see the `Values for entityType` paragraph in the operation description. When omitted it is 0 (Activity), so always send it.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityOrGroupReference" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of entries removed.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The entries could not be removed." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}/Copy": { "post": { "tags": [ "Roles" ], "summary": "Copy a custom role", "description": "Creates a new role from an existing custom role. The copy keeps the permissions, scope and members of the original, but takes its name, description, target and all-items flags from the body, so send the role as it is returned by the get role route with a new name. Built-in roles cannot be copied.\n\nPermission required: Administrator role.\n\nValues for `roleTarget`: 0 = AccessPolicies, 1 = Credentials, 2 = Auditors.", "operationId": "RolesRole_CopyRole", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role. This is the role to copy.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "The role to copy, with a new name. The new role's description, target and all-items flags come from this body.\n\n- `id` (string (GUID), required): The ID of the role to copy. It must equal the ID in the path.\n- `name` (string, required): The name of the new role. It must differ from the original name and from every other role name.\n- `description` (string): The description of the new role.\n- `roleTarget` (integer): The target of the new role. Sent as a number; see the `Values for roleTarget` paragraph in the operation description. When omitted it is 0 (AccessPolicies).\n- `allActivities` (boolean): When true, the new role covers all activities. Set in the request body, not copied from the original role. When omitted it is false.\n- `allCredentials` (boolean): When true, the new role covers all credentials. Set in the request body, not copied from the original role. When omitted it is false.\n- `allPolicies` (boolean): When true, the new role covers all access policies. Set in the request body, not copied from the original role. When omitted it is false.\n- `allResources` (boolean): When true, the new role covers all resources. Set in the request body, not copied from the original role. When omitted it is false.\n- `allUsers` (boolean): When true, the new role covers all users. Set in the request body, not copied from the original role. When omitted it is false.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RolesRoleCopyRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the new role.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RolesRole" } } } }, "400": { "description": "The IDs differ, the role is a built-in role, the new name is the same as the original or already in use, or the copy failed." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}/CredentialOrGroup": { "post": { "tags": [ "Roles" ], "summary": "Add credentials and credential groups to a role", "description": "Adds credentials, credential groups or host users to the scope of a role. Role members can then use the permissions of the role on those credentials. Entries already in the scope are skipped.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = Credential, 1 = CredentialGroup, 2 = HostUser.\n\nCaution: Role members can use the role's permissions, which can include viewing passwords, on the added credentials immediately.", "operationId": "RolesRole_AddCredentialsOrGroupToRoleMultiple", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "A JSON array of the credentials, credential groups or host users to add.\n\n- `id` (string (GUID), required): The ID of the entry to add or remove. Entries that do not exist are skipped.\n- `entityType` (integer): The kind of entry that the ID identifies. Sent as a number; see the `Values for entityType` paragraph in the operation description. When omitted it is 0 (Credential), so always send it.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialOrHostUserId" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of entries added.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The entries could not be added." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Roles" ], "summary": "Remove credentials and groups from a role", "description": "Removes credentials, credential groups or host users from the scope of a role. Role members can no longer use the permissions of the role on them.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = Credential, 1 = CredentialGroup, 2 = HostUser.", "operationId": "RolesRole_RemoveCredentialsOrGroupsFromRoleMultiple", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "A JSON array of the credentials, credential groups or host users to remove.\n\n- `id` (string (GUID), required): The ID of the entry to add or remove. Entries that do not exist are skipped.\n- `entityType` (integer): The kind of entry that the ID identifies. Sent as a number; see the `Values for entityType` paragraph in the operation description. When omitted it is 0 (Credential), so always send it.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialOrHostUserId" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of entries removed.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The entries could not be removed." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}/ManagedAccountOrGroup": { "post": { "tags": [ "Roles" ], "summary": "Add users and groups to a role", "description": "Gives a role to users, groups, applications or collections that are on the Users & Groups page. Accounts that already hold the role, and IDs that do not exist, are skipped.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "RolesRole_AddManagedAccountOrGroupsToRoleMultiple", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "A JSON array of the users, groups, applications or collections to give the role to.\n\n- `id` (string (GUID), required): The ID of the entry to add or remove. Entries that do not exist are skipped.\n- `entityType` (integer): The kind of entry that the ID identifies. Sent as a number; see the `Values for entityType` paragraph in the operation description. When omitted it is 0 (ManagedAccount), so always send it.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountOrGroupReference" } }, "example": [ { "id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "entityType": 0 } ] } }, "required": true }, "responses": { "200": { "description": "Returns the number of entries added.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The entries could not be added." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Roles" ], "summary": "Remove users and groups from a role", "description": "Takes a role away from the users, groups, applications or collections you send. Use it to stop members from receiving the permissions of the role.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "RolesRole_RemoveManagedAccountOrGroupsFromRoleMultiple", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "A JSON array of the users, groups, applications or collections to remove from the role.\n\n- `id` (string (GUID), required): The ID of the entry to add or remove. Entries that do not exist are skipped.\n- `entityType` (integer): The kind of entry that the ID identifies. Sent as a number; see the `Values for entityType` paragraph in the operation description. When omitted it is 0 (ManagedAccount), so always send it.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountOrGroupReference" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of entries removed.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The entries could not be removed." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}/ManagedAccountOrGroupEntity": { "post": { "tags": [ "Roles" ], "summary": "Add users and groups to the scope of a role", "description": "Adds users, groups or collections to the scope of a role, which is the set of users the role members can act on. For an Auditors role, it sets whose sessions the members can see. This is separate from the members who hold the role.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.\n\nCaution: Adding users to the scope widens what role members can act on, such as whose sessions an auditor can see, and takes effect immediately.", "operationId": "RolesRole_AddManagedAccountOrGroupEntitiesToRoleMultiple", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "A JSON array of the users, groups or collections to add to the role scope.\n\n- `id` (string (GUID), required): The ID of the entry to add or remove. Entries that do not exist are skipped.\n- `entityType` (integer): The kind of entry that the ID identifies. Sent as a number; see the `Values for entityType` paragraph in the operation description. When omitted it is 0 (ManagedAccount), so always send it.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountOrGroupReference" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of entries added.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The entries could not be added." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Roles" ], "summary": "Remove users and groups from the scope of a role", "description": "Removes users, groups or collections from the scope of a role, which is the set of users the role members can act on. Use it to narrow what members can see or change.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "RolesRole_RemoveManagedAccountOrGroupEntitiesFromRoleMultiple", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "A JSON array of the users, groups or collections to remove from the role scope.\n\n- `id` (string (GUID), required): The ID of the entry to add or remove. Entries that do not exist are skipped.\n- `entityType` (integer): The kind of entry that the ID identifies. Sent as a number; see the `Values for entityType` paragraph in the operation description. When omitted it is 0 (ManagedAccount), so always send it.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountOrGroupReference" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of entries removed.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The entries could not be removed." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}/Permission": { "get": { "tags": [ "Roles" ], "summary": "List the permissions of a role", "description": "Returns the permissions currently assigned to a role. Each row repeats the role's id, name and description, and gives the permission in permissionId, permissionName and permissionDescription and its permission group in groupId, groupName and groupDescription.\n\nPermission required: Administrator role.", "operationId": "RolesRole_GetRolePermissions", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "responses": { "200": { "description": "Returns an array with one row per permission. The array is empty when the role has none.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/RolesRolePermissionView" } } } } }, "400": { "description": "The permissions could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Roles" ], "summary": "Add permissions to a role", "description": "Assigns permissions to a role by their IDs; permissions that the role already has, or that do not exist, are skipped. Terminate Session and Lock Session need Live Session Viewer, which can be sent in the same call. Adding Admin View Read Only also adds the Reporting permission.\n\nPermission required: Administrator role.", "operationId": "RolesRole_AddPermissionsToRoleMultiple", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "A JSON array of the IDs of the permissions to add.\n\n- `(array item)` (string (GUID), required): The ID of one item. The body is a JSON array of IDs.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "example": [ "7c9e6679-7425-40de-944b-e07fc1f90ae7", "7c9e6679-7425-40de-944b-e07fc1f90ae7" ] } }, "required": true }, "responses": { "200": { "description": "Returns the number of permissions added, including Reporting when it is added automatically.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The permissions could not be added, for example Terminate Session or Lock Session without Live Session Viewer." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Roles" ], "summary": "Remove permissions from a role", "description": "Removes permissions from a role. Send the IDs of the permissions to remove. Removing Live Session Viewer also removes Terminate Session and Lock Session, and removing Reporting also removes Admin View Read Only.\n\nPermission required: Administrator role.", "operationId": "RolesRole_RemovePermissionsFromRoleMultiple", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "A JSON array of the IDs of the permissions to remove.\n\n- `(array item)` (string (GUID), required): The ID of one item. The body is a JSON array of IDs.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of permissions removed, including permissions removed because they depend on another one.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The permissions could not be removed." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}/ResourceOrGroup": { "post": { "tags": [ "Roles" ], "summary": "Add resources and resource groups to a role", "description": "Adds resources, resource groups or secret vaults to the scope of a role. Use it to limit the resources that role members can work with. For an Auditors role, it sets which resources' sessions the members can see.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = Resource, 1 = ResourceGroup, 2 = SecretVault.", "operationId": "RolesRole_AddResourceOrGroupsToRoleMultiple", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "A JSON array of the resources, resource groups or secret vaults to add.\n\n- `id` (string (GUID), required): The ID of the entry to add or remove. Entries that do not exist are skipped.\n- `entityType` (integer): The kind of entry that the ID identifies. Sent as a number; see the `Values for entityType` paragraph in the operation description. When omitted it is 0 (Resource), so always send it.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceOrGroupReference" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of entries added.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The entries could not be added." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Roles" ], "summary": "Remove resources and groups from a role", "description": "Removes resources, resource groups or secret vaults from the scope of a role. Use it to narrow the resources that role members can work with.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = Resource, 1 = ResourceGroup, 2 = SecretVault.", "operationId": "RolesRole_RemoveResourceOrGroupsFromRoleMultiple", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "A JSON array of the resources, resource groups or secret vaults to remove.\n\n- `id` (string (GUID), required): The ID of the entry to add or remove. Entries that do not exist are skipped.\n- `entityType` (integer): The kind of entry that the ID identifies. Sent as a number; see the `Values for entityType` paragraph in the operation description. When omitted it is 0 (Resource), so always send it.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceOrGroupReference" } } } }, "required": true }, "responses": { "200": { "description": "Returns the number of entries removed.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The entries could not be removed." }, "403": { "description": "The signed-in user does not have the required role, or the account has read-only administrator access." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}/SearchAccountEntities": { "get": { "tags": [ "Roles" ], "summary": "List the users in the scope of a role", "description": "Returns the users, groups and collections that make up the scope of a role, as a page of results that you can filter and sort. This is not the list of role members.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "RolesRole_SearchManagedAccountEntities", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "entityType", "in": "query", "description": "Returns only this kind of entry. Omit it to return all kinds. Sent as a number; see the values below.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedAccountKind" } }, { "name": "Skip", "in": "query", "description": "The number of rows to skip, for paging. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "The maximum number of rows to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "A property name of the returned rows, ignoring case. The default is Name. An unrecognized name returns the rows ordered by ID.", "required": false, "schema": { "type": "string" }, "example": "Name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only rows whose name, domain, account name (samAccountName) or email contains this value, ignoring case.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns a page of results in data, with the total number of matching rows in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedAccountAndCollectionsView" } } } }, "400": { "description": "The scope could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}/SearchAccounts": { "get": { "tags": [ "Roles" ], "summary": "List the members of a role", "description": "Returns the users, groups, applications and collections that hold a role, as a page of results that you can filter and sort. Use it to show who has the role.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "RolesRole_SearchManagedAccounts", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "entityType", "in": "query", "description": "Returns only this kind of entry. Omit it to return all kinds. Sent as a number; see the values below.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedAccountKind" } }, { "name": "Skip", "in": "query", "description": "The number of rows to skip, for paging. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "The maximum number of rows to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "A property name of the returned rows, ignoring case. The default is Name. An unrecognized name returns the rows ordered by ID.", "required": false, "schema": { "type": "string" }, "example": "Name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only rows whose name, domain, account name (samAccountName) or email contains this value, ignoring case.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns a page of results in data, with the total number of matching rows in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedAccountAndCollectionsView" } } } }, "400": { "description": "The members could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}/SearchActivities": { "get": { "tags": [ "Roles" ], "summary": "List the activities in the scope of a role", "description": "Returns the activities and activity groups that are in the scope of a role, as a page of results that you can filter and sort.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = Activity, 1 = ActivityGroup.", "operationId": "RolesRole_SearchActivities", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "entityType", "in": "query", "description": "Returns only activities (0) or only activity groups (1). Omit it to return both.", "required": false, "schema": { "$ref": "#/components/schemas/ActivityOrGroupKind" } }, { "name": "Skip", "in": "query", "description": "The number of rows to skip, for paging. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "The maximum number of rows to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "A property name of the returned rows, ignoring case. The default is Name. An unrecognized name returns the rows ordered by ID.", "required": false, "schema": { "type": "string" }, "example": "Name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only rows whose name or description contains this value, ignoring case.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns a page of results in data, with the total number of matching rows in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfActivityAndGroupView" } } } }, "400": { "description": "The activities could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}/SearchCredentials": { "get": { "tags": [ "Roles" ], "summary": "List the credentials in the scope of a role", "description": "Returns the credentials and credential groups that are in the scope of a role, as a page of results that you can filter and sort. Host users in the scope appear as credential rows.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = Credential, 1 = CredentialGroup, 2 = HostUser.\n\nValues for `credentialType`: 0 = Configuration, 1 = User, 2 = Service, 3 = ActivityToken, 4 = Application, 5 = VaultUser, 6 = SshKeyCert.\n\nValues for `managedType`: 0 = Internal, 1 = Standard, 2 = Service.\n\nValues for `rotationType`: 0 = NotManaged, 1 = Manual, 2 = Automatic.\n\nValues for `passwordStatus`: 0 = Unspecified, 1 = Verified, 2 = Pending, 3 = Changed, 4 = Failed, 5 = Mismatch.", "operationId": "RolesRole_SearchCredentials", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "entityType", "in": "query", "description": "Returns only credentials (0) or only credential groups (1). Omit it to return both. Sent as a number. Host-user entries are returned as credentials, so 2 (HostUser) returns no rows.", "required": false, "schema": { "$ref": "#/components/schemas/CredentialOrHostUser" } }, { "name": "Skip", "in": "query", "description": "The number of rows to skip, for paging. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "The maximum number of rows to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "A property name of the returned rows, ignoring case, such as DisplayName. The default is Name, which these rows do not have, so rows come back ordered by ID unless you send another property.", "required": false, "schema": { "type": "string" }, "example": "Name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only rows whose display name or domain contains this value, ignoring case.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns a page of results in data, with the total number of matching rows in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfCredentialHostUserAndCredentialGroupView" } } } }, "400": { "description": "The credentials could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}/SearchPolicies": { "get": { "tags": [ "Roles" ], "summary": "List the access policies in the scope of a role", "description": "Returns the access policies that are in the scope of a role, as a page of results that you can filter and sort by name or description.\n\nPermission required: Administrator role.\n\nValues for `approvalTypeRequired`: 0 = Deny, 1 = Allow, 2 = Workflow, 3 = External.\n\nValues for `policyType`: 0 = Resource, 1 = Credential.", "operationId": "RolesRole_SearchAccessPolicies", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "Skip", "in": "query", "description": "The number of rows to skip, for paging. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "The maximum number of rows to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "A property name of the returned rows, ignoring case. The default is Name. An unrecognized name returns the rows ordered by ID.", "required": false, "schema": { "type": "string" }, "example": "Name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only rows whose name or description contains this value, ignoring case.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns a page of results in data, with the total number of matching rows in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfSimpleAccessControlPolicy" } } } }, "400": { "description": "The access policies could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/RolesRole/{roleId}/SearchResources": { "get": { "tags": [ "Roles" ], "summary": "List the resources in the scope of a role", "description": "Returns the resources, resource groups and secret vaults that are in the scope of a role, as a page of results that you can filter and sort.\n\nPermission required: Administrator role.\n\nValues for `entityType`: 0 = Resource, 1 = ResourceGroup, 2 = SecretVault.", "operationId": "RolesRole_SearchManagedResources", "parameters": [ { "name": "roleId", "in": "path", "description": "The ID of the role.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, { "name": "entityType", "in": "query", "description": "Returns only this kind of entry. Omit it to return all kinds. Sent as a number; see the values below.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedResourceOrGroupKind" } }, { "name": "Skip", "in": "query", "description": "The number of rows to skip, for paging. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "The maximum number of rows to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "A property name of the returned rows, ignoring case. The default is Name. An unrecognized name returns the rows ordered by ID.", "required": false, "schema": { "type": "string" }, "example": "Name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true to sort in descending order. The default is false.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Returns only rows whose name or operating system contains this value, ignoring case.", "required": false, "schema": { "type": "string" }, "example": "" }, { "name": "FilterColumns", "in": "query", "description": "Not used by this route.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Returns a page of results in data, with the total number of matching rows in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedResourceAndGroupView" } } } }, "400": { "description": "The resources could not be retrieved." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "The role does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ScheduledChangePolicy": { "get": { "tags": [ "Scheduled Change Policy" ], "summary": "List schedules", "description": "Returns every schedule, including its frequency, interval, run time and a readable description. Schedules set when recurring jobs run, such as password changes, verification, scans, protection policies and report subscriptions.\n\nPermission required: Admin or Auditing and Reporting role.\n\nValues for `frequency`: 0 = Hours, 1 = DaysAtTime, 2 = WeeklyOnDaysOfWeek, 3 = MonthlyOnDay, 4 = Minutes.", "operationId": "ScheduledChangePolicy_GetAll", "responses": { "200": { "description": "A list of schedules.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ScheduledChangePolicy" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ScheduledChangePolicy/Names": { "get": { "tags": [ "Scheduled Change Policy" ], "summary": "List schedule names", "description": "Returns the ID and name of every schedule, sorted by name. Use it to fill a picker or to look up a schedule ID.\n\nPermission required: Admin or Auditing and Reporting role.", "operationId": "ScheduledChangePolicy_GetNames", "responses": { "200": { "description": "A list of objects with an id and a name.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/ScheduledChangePolicy/{id}": { "delete": { "tags": [ "Scheduled Change Policy" ], "summary": "Delete a schedule", "description": "Deletes one schedule. Schedules set when recurring jobs run, such as password changes, verification, scans, protection policies and report subscriptions. Use it to remove a schedule you no longer need.\n\nPermission required: Admin or Auditing and Reporting role.\n\nCaution: The schedule is deleted immediately and the call cannot be undone.", "operationId": "ScheduledChangePolicy_Delete", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the schedule to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "202": { "description": "The schedule is deleted." }, "404": { "description": "No schedule with that ID exists." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Scheduled Change Policy" ], "summary": "Get a schedule", "description": "Returns one schedule, including its frequency, interval and run time.\n\nPermission required: Admin or Auditing and Reporting role.\n\nValues for `frequency`: 0 = Hours, 1 = DaysAtTime, 2 = WeeklyOnDaysOfWeek, 3 = MonthlyOnDay, 4 = Minutes.", "operationId": "ScheduledChangePolicy_Get", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the schedule.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The schedule.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScheduledChangePolicy" } } } }, "404": { "description": "No schedule with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SecretVault": { "get": { "tags": [ "Secret Vault" ], "summary": "List secret vaults", "description": "Returns every secret vault with its name, description and the resource that represents it.\n\nPermission required: Admin or App role, and the signed-in user must have completed multi-factor authentication.\n\nCaution: The call requires multi-factor authentication.", "operationId": "SecretVault_GetSecretVaults", "responses": { "200": { "description": "A list of vaults.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/SecretVaultSummary" } } } } }, "400": { "description": "The vaults could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "Secret Vault" ], "summary": "Create a secret vault", "description": "Creates a secret vault and the resource that represents it. The vault name must be unique; only the name and description are read from the body.\n\nPermission required: Admin role, and the signed-in user must have completed multi-factor authentication.\n\nCaution: The vault is created immediately and the call requires multi-factor authentication.", "operationId": "SecretVault_CreateSecretVault", "requestBody": { "description": "The vault to save.\n\n- `id` (string (GUID)): The ID of the vault. Ignored on create. Set by the server and returned in the response.\n- `name` (string, required): The name of the vault. Must be unique among vaults.\n- `description` (string): A description of the vault.\n- `managedResourceId` (string (GUID)): The ID of the resource that represents the vault. Ignored on create. Set by the server and returned in the response.\n- `platformId` (string (GUID)): The platform of the vault resource. Ignored on create. Set by the server and returned in the response.\n- `policyIds` (array of string (GUID)): The access policies that include the vault. Ignored on create.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretVaultCreateRequest" } } }, "required": true }, "responses": { "200": { "description": "The vault was created. The body is the saved vault.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretVaultSummary" } } } }, "400": { "description": "A vault with that name already exists or the vault could not be created." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SecretVault/User/Search": { "get": { "tags": [ "Secret Vault" ], "summary": "Search the accounts in a secret vault", "description": "Returns a page of the accounts stored in one secret vault, with the total number of matches. Passwords are not included. Use the paging, sort and filter options to narrow the results.\n\nPermission required: Admin role, and the signed-in user must have completed multi-factor authentication.\n\nValues for `managedType`: 0 = NotManaged, 1 = Manual, 2 = Automatic.\n\nCaution: The response lists vault account details, so treat it as sensitive; the call requires multi-factor authentication.", "operationId": "SecretVault_SearchManagedUsers", "parameters": [ { "name": "secretVaultId", "in": "query", "description": "The ID of the vault to search.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" }, { "name": "skip", "in": "query", "description": "The number of accounts to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "take", "in": "query", "description": "The number of accounts to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "orderBy", "in": "query", "description": "The property to sort by. The default is name.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort in descending order.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "filterText", "in": "query", "description": "Return only accounts whose name or user name contains this text. Matching ignores case.", "required": false, "schema": { "type": "string" }, "example": "example" }, { "name": "filterColumns", "in": "query", "description": "Accepted but not used by this route. The filter text is always matched against the name and user name.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "A page of accounts in data, with the total number of matches in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedUserCredential" } } } }, "400": { "description": "The search failed." }, "404": { "description": "No vault with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SecretVault/{id}": { "delete": { "tags": [ "Secret Vault" ], "summary": "Delete a secret vault", "description": "Deletes a secret vault, the accounts stored in it and the files stored in it. The deleted accounts are also removed from any access policies and credential groups that included them.\n\nPermission required: Admin role, and the signed-in user must have completed multi-factor authentication.\n\nCaution: The vault, its accounts and its stored files are deleted immediately and the call cannot be undone.", "operationId": "SecretVault_DeleteSecreteVault", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the vault to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The vault is deleted. The body is a confirmation message.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "The vault could not be deleted." }, "404": { "description": "No vault with that ID exists." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Secret Vault" ], "summary": "Get a secret vault", "description": "Returns one secret vault, including the IDs of the access policies that include it.\n\nPermission required: Admin or App role, and the signed-in user must have completed multi-factor authentication.\n\nCaution: The call requires multi-factor authentication.", "operationId": "SecretVault_GetSecretVault", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the vault.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The vault.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretVaultSummary" } } } }, "400": { "description": "The vault could not be retrieved." }, "404": { "description": "No vault with that ID exists." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Secret Vault" ], "summary": "Update a secret vault", "description": "Changes the name or description of a secret vault. Send the vault as returned by a get, with the new values; the ID in the body must match the ID in the path.\n\nPermission required: Admin role, and the signed-in user must have completed multi-factor authentication.\n\nCaution: The change is saved immediately and the call requires multi-factor authentication.", "operationId": "SecretVault_UpdateSecretVault", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the vault to update.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "description": "The vault to save.\n\n- `id` (string (GUID), required): The ID of the vault. Must match the ID in the path.\n- `name` (string, required): The name of the vault. Must be unique among vaults.\n- `description` (string): A description of the vault.\n- `managedResourceId` (string (GUID), required): The ID of the resource that represents the vault. Send the value returned when you get the vault. A value that matches no resource makes the call fail; a value that belongs to a different resource would rename that resource, so do not send another resource's ID.\n- `platformId` (string (GUID)): The platform of the vault resource. Ignored on update.\n- `policyIds` (array of string (GUID)): The access policies that include the vault. Ignored on update.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretVaultUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The vault was updated. The body is the saved vault.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretVaultSummary" } } } }, "400": { "description": "The IDs do not match, the name is already used by another vault, the resource ID does not match an existing resource, or the update failed." }, "404": { "description": "No vault with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SecretVault/{vaultId}/User": { "post": { "tags": [ "Secret Vault" ], "summary": "Add an account to a secret vault", "description": "Adds an account with a stored password to a secret vault. The account's managedResourceId must be the resource of the vault named in the path.\n\nPermission required: Admin role, and the signed-in user must have completed multi-factor authentication.\n\nValues for `managedType`: 0 = NotManaged, 1 = Manual, 2 = Automatic.\n\nCaution: The request body contains a password, so send it only over a secure connection; the account is stored immediately.", "operationId": "SecretVault_AddManagedUser", "parameters": [ { "name": "vaultId", "in": "path", "description": "The ID of the vault to add the account to.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" } ], "requestBody": { "description": "The account to add. The password is encrypted before it is stored.\n\n- `name` (string, required): The display name of the account.\n- `username` (string, required): The user name of the account.\n- `password` (string, required): The password to store. The server encrypts it. Responses never include the password.\n- `managedResourceId` (string (GUID), required): The resource ID of the vault. Must equal the managedResourceId of the vault.\n- `managedType` (integer): How the account is managed. See the managed type values below. If omitted, the value is 0 (NotManaged).\n- `comment` (string): A comment about the account.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedUserCredentialCreateRequest" } } }, "required": true }, "responses": { "200": { "description": "The account was added. The body is the saved account, without the password.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedUserCredential" } } } }, "400": { "description": "The resource ID does not match the vault, or the account could not be added." }, "404": { "description": "No vault with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SecretVault/{vaultId}/User/DeleteMultiple": { "post": { "tags": [ "Secret Vault" ], "summary": "Delete several accounts from a secret vault", "description": "Deletes the listed accounts from a secret vault and returns how many were deleted.\n\nPermission required: Admin role, and the signed-in user must have completed multi-factor authentication.\n\nCaution: The accounts are deleted immediately and the call cannot be undone, even when it returns an error for some of them. The call does not check that each ID belongs to the vault in the path, so send only IDs of accounts in this vault.", "operationId": "SecretVault_DeleteManagedUserMultiple", "parameters": [ { "name": "vaultId", "in": "path", "description": "The ID of the vault that holds the accounts.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" } ], "requestBody": { "description": "A JSON array of the IDs of the accounts to delete.\n\n- `(array item)` (string (GUID), required): The ID of an account to delete.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true }, "responses": { "200": { "description": "All accounts were deleted. The body is the number deleted.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "Not all of the accounts could be deleted. Accounts that were deleted stay deleted." }, "404": { "description": "No vault with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SecretVault/{vaultId}/User/{managedUserId}": { "put": { "tags": [ "Secret Vault" ], "summary": "Update an account in a secret vault", "description": "Changes an account stored in a secret vault. Send the whole account; leave the password empty to keep the stored password.\n\nPermission required: Admin role, and the signed-in user must have completed multi-factor authentication.\n\nValues for `managedType`: 0 = NotManaged, 1 = Manual, 2 = Automatic.\n\nCaution: The request body can contain a password, so send it only over a secure connection; the change is saved immediately.", "operationId": "SecretVault_UpdateManagedUser", "parameters": [ { "name": "vaultId", "in": "path", "description": "The ID of the vault that holds the account.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" }, { "name": "managedUserId", "in": "path", "description": "The ID of the account to update.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "description": "The full account. Values you send replace the stored ones, so include every field you want to keep. Its id must match managedUserId in the path.\n\n- `id` (string (GUID), required): The ID of the account. Must match managedUserId in the path.\n- `credentialId` (string (GUID), required): The ID of the credential behind the account. Send the value returned when you get or search the account. A different value makes the call fail.\n- `name` (string, required): The display name of the account. The value you send replaces the stored value.\n- `username` (string, required): The user name of the account. The value you send replaces the stored value.\n- `password` (string): A new password to store. If empty, the stored password is not changed.\n- `managedResourceId` (string (GUID), required): The resource ID of the vault. Must equal the managedResourceId of the vault.\n- `managedType` (integer): How the account is managed. The value you send replaces the stored value. See the managed type values below.\n- `comment` (string): A comment about the account. The value you send replaces the stored value.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedUserCredentialUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "The account was updated. The body is the saved account, without the password.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedUserCredential" } } } }, "400": { "description": "The IDs do not match, no account with that ID exists, the resource or credential ID does not match the account, or the update failed." }, "404": { "description": "No vault with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SiemServer": { "post": { "tags": [ "SIEM Server" ], "summary": "Create a SIEM server", "description": "Adds a SIEM server that receives events. The server assigns the name, so any name you send is ignored.\n\nPermission required: Admin or App role.\n\nCaution: The server is saved immediately and starts receiving events if it is enabled.", "operationId": "SiemServer_Create", "parameters": [ { "name": "test", "in": "query", "description": "Set to true to leave the Location header out of the response. The SIEM server is still saved.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemServer" } } }, "required": true, "description": "The SIEM server settings.\n\n- `id` (string (GUID)): The ID of the SIEM server. Ignored on create.\n- `host` (string): The host name or address of the SIEM server. Not checked by the server, but needed for events to be delivered.\n- `port` (integer): The port the SIEM server listens on. Not checked by the server, but needed for events to be delivered.\n- `serverType` (string): The transport used to send events: Udp or Tcp. Case-insensitive text, not a number. Any other value is saved but no events are sent to the server.\n- `protocol` (string): The TLS version to use for a TCP connection when useSsl is true. Text: Tls, Tls11, Tls12 or Tls13 (case-insensitive). Empty or any other value means no TLS. Ignored for Udp.\n- `useSsl` (boolean): Whether to encrypt the connection. Applies to Tcp servers only, and only takes effect when protocol names a TLS version.\n- `enabled` (boolean): Whether events are sent to this server.\n- `siemTemplateId` (string (GUID)): The ID of the SIEM template that formats the events.\n- `name` (string): The name of the server. Ignored. The server assigns a generated name." }, "responses": { "201": { "description": "The SIEM server was created. The body is the saved server, and the Location header points to it unless test is true.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemServer" } } } }, "400": { "description": "The SIEM server could not be created." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "SIEM Server" ], "summary": "Update a SIEM server", "description": "Changes the settings of an existing SIEM server, identified by the id in the body. The server keeps the existing name.\n\nPermission required: Admin or App role.\n\nCaution: The change is saved immediately and affects where events are sent.", "operationId": "SiemServer_Update", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemServerUpdateRequest" } } }, "required": true, "description": "The full SIEM server settings. Values you send replace the stored ones, so include every field you want to keep.\n\n- `id` (string (GUID), required): The ID of the SIEM server. Identifies the SIEM server to update.\n- `host` (string): The host name or address of the SIEM server. Not checked by the server, but needed for events to be delivered.\n- `port` (integer): The port the SIEM server listens on. Not checked by the server, but needed for events to be delivered.\n- `serverType` (string): The transport used to send events: Udp or Tcp. Case-insensitive text, not a number. Any other value is saved but no events are sent to the server.\n- `protocol` (string): The TLS version to use for a TCP connection when useSsl is true. Text: Tls, Tls11, Tls12 or Tls13 (case-insensitive). Empty or any other value means no TLS. Ignored for Udp.\n- `useSsl` (boolean): Whether to encrypt the connection. Applies to Tcp servers only, and only takes effect when protocol names a TLS version.\n- `enabled` (boolean): Whether events are sent to this server.\n- `siemTemplateId` (string (GUID)): The ID of the SIEM template that formats the events.\n- `name` (string): The name of the server. Ignored. The existing name is kept." }, "responses": { "200": { "description": "The SIEM server was updated. The body is empty." }, "400": { "description": "The update failed." }, "404": { "description": "No SIEM server with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SiemServer/Names": { "get": { "tags": [ "SIEM Server" ], "summary": "List SIEM server names", "description": "Returns the ID and host of every SIEM server, sorted by host. The host is returned in the name field.\n\nPermission required: Admin role.", "operationId": "SiemServer_ListNames", "responses": { "200": { "description": "A list of objects with an id and a name, where name is the server's host.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SiemServer/status/{enabled}": { "get": { "tags": [ "SIEM Server" ], "summary": "List SIEM servers by enabled state", "description": "Returns the SIEM servers that are enabled or disabled, depending on the value in the path.\n\nPermission required: Admin or App role.", "operationId": "SiemServer_GetSiemServerByEnabledFlag", "parameters": [ { "name": "enabled", "in": "path", "description": "Use true for enabled servers or false for disabled servers.", "required": true, "schema": { "type": "boolean", "default": true }, "example": true } ], "responses": { "200": { "description": "A list of SIEM servers.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/SiemServer" } } } } }, "400": { "description": "The servers could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SiemServer/{siemServerId}": { "delete": { "tags": [ "SIEM Server" ], "summary": "Delete a SIEM server", "description": "Deletes a SIEM server so events are no longer sent to it.\n\nPermission required: Admin or App role.\n\nCaution: The SIEM server is deleted immediately and the call cannot be undone.", "operationId": "SiemServer_Delete", "parameters": [ { "name": "siemServerId", "in": "path", "description": "The ID of the SIEM server to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "The SIEM server is deleted." }, "400": { "description": "The SIEM server could not be deleted." }, "404": { "description": "No SIEM server with that ID exists." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "SIEM Server" ], "summary": "Get a SIEM server", "description": "Returns the settings of one SIEM server.\n\nPermission required: Admin or App role.", "operationId": "SiemServer_GetSiemServerById", "parameters": [ { "name": "siemServerId", "in": "path", "description": "The ID of the SIEM server.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "responses": { "200": { "description": "The SIEM server.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemServer" } } } }, "400": { "description": "The server could not be retrieved." }, "404": { "description": "No SIEM server with that ID exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SiemSettings/{siemSettingsId}": { "get": { "tags": [ "SIEM Settings" ], "summary": "Get SIEM settings", "description": "Returns the SIEM settings record with the given ID, including its host, port, transport, enabled state and SIEM template.\n\nPermission required: Admin or App role.\n\nValues for `serverType`: 0 = UDP, 1 = TCP.", "operationId": "SiemSettings_GetSiemSettingsById", "parameters": [ { "name": "siemSettingsId", "in": "path", "description": "The ID of the SIEM settings record.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" } ], "responses": { "200": { "description": "The SIEM settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemSettings" } } } }, "204": { "description": "No SIEM settings record with that ID exists, so the body is empty." }, "400": { "description": "The settings could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SiemTemplate": { "post": { "tags": [ "SIEM Template" ], "summary": "Create a SIEM template", "description": "Creates a SIEM template and returns the saved template. Use it to define the message format that is sent to a SIEM server.\n\nPermission required: Administrator role (or an application account with the App role).", "operationId": "SiemTemplate_Create", "parameters": [ { "name": "test", "in": "query", "description": "Used for testing. When true, the response does not include the URL of the new template. Default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemTemplate" } } }, "required": true, "description": "The SIEM template to create.\n\n- `id` (string (uuid)): Omit it; the server generates an ID for the new template. The saved template in the response includes the ID.\n- `name` (string): The display name of the template. Must be unique across SIEM templates. Up to 256 characters.\n- `description` (string): A description of the template.\n- `templateFormat` (string): The layout of the message sent to the SIEM server. Write each attribute in upper case between percent signs, for example %EVENTTIMEUTC%. Get the attribute names from the attributes route. The format also accepts %SYSLOG_DATE%, %HOST%, %TEMPLATENAME%, %TEMPLATEVERSION%, %COMPANY%, %PRODUCT%, %PRODUCT_VERSION%, %LOGLEVEL% and %LOGLEVELSTATUS%, and \\t for a tab.\n- `version` (string): A version label for the template. Used for %TEMPLATEVERSION%; when empty, 1.0 is used.\n- `charactersToEscape` (string): Each character in this string is escaped in the formatted message.\n- `escapeCharacter` (string): The text placed before each escaped character.\n- `nodeId` (string (uuid)): Internal value set by the server. Do not send it. On update the stored value is always kept.\n- `createdDateTimeUtc` (string (date-time)): Set by the server; any value you send is replaced.\n- `modifiedDateTimeUtc` (string (date-time)): Set by the server; any value you send is replaced." }, "responses": { "201": { "description": "The template was created. The body contains the saved template.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemTemplate" } } } }, "400": { "description": "The template could not be created, for example because another template has the same name. The response body contains the error message." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "SIEM Template" ], "summary": "Update a SIEM template", "description": "Replaces the settings of an existing SIEM template. The id in the request body identifies the template; send every field, because fields you leave out are cleared.\n\nPermission required: Administrator role (or an application account with the App role).", "operationId": "SiemTemplate_Update", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemTemplateUpdateRequest" } } }, "required": true, "description": "The full SIEM template. Fields you leave out are cleared.\n\n- `id` (string (uuid), required): The ID of the template to update.\n- `name` (string): The display name of the template. Must be unique across SIEM templates. Up to 256 characters.\n- `description` (string): A description of the template.\n- `templateFormat` (string): The layout of the message sent to the SIEM server. Write each attribute in upper case between percent signs, for example %EVENTTIMEUTC%. Get the attribute names from the attributes route. The format also accepts %SYSLOG_DATE%, %HOST%, %TEMPLATENAME%, %TEMPLATEVERSION%, %COMPANY%, %PRODUCT%, %PRODUCT_VERSION%, %LOGLEVEL% and %LOGLEVELSTATUS%, and \\t for a tab.\n- `version` (string): A version label for the template. Used for %TEMPLATEVERSION%; when empty, 1.0 is used.\n- `charactersToEscape` (string): Each character in this string is escaped in the formatted message.\n- `escapeCharacter` (string): The text placed before each escaped character.\n- `nodeId` (string (uuid)): Internal value set by the server. Do not send it. On update the stored value is always kept.\n- `createdDateTimeUtc` (string (date-time)): Omit it to keep the stored creation time.\n- `modifiedDateTimeUtc` (string (date-time)): Set by the server; any value you send is replaced." }, "responses": { "200": { "description": "The template was updated. The response body is empty." }, "400": { "description": "The template could not be updated. The response body contains the error message." }, "404": { "description": "No template with the ID in the request body exists." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SiemTemplate/attributes": { "get": { "tags": [ "SIEM Template" ], "summary": "List available SIEM template attributes", "description": "Returns the names of the event attributes that a SIEM template can include. In a template format, write an attribute name in upper case between percent signs, for example %EVENTTIMEUTC%.\n\nPermission required: Administrator role (or an application account with the App role).", "operationId": "SiemTemplate_GetSiemTemplateAttrbutes", "responses": { "200": { "description": "An array of attribute names as strings.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string" } } } } }, "400": { "description": "The list could not be produced. The response body contains the error message." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SiemTemplate/Names": { "get": { "tags": [ "SIEM Template" ], "summary": "List SIEM template names and IDs", "description": "Returns the ID and name of every SIEM template. Use it to populate a template picker.\n\nPermission required: Administrator role.", "operationId": "SiemTemplate_ListNames", "responses": { "200": { "description": "An array of objects, each with an id and a name.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SiemTemplate/{siemTemplateId}": { "delete": { "tags": [ "SIEM Template" ], "summary": "Delete a SIEM template", "description": "Deletes the SIEM template with the given ID. Use it to remove a template that is no longer needed.\n\nPermission required: Administrator role (or an application account with the App role).", "operationId": "SiemTemplate_Delete", "parameters": [ { "name": "siemTemplateId", "in": "path", "description": "The ID of the SIEM template.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "The template was deleted." }, "400": { "description": "The template could not be deleted. The response body contains the error message." }, "404": { "description": "No template with that ID exists." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "SIEM Template" ], "summary": "Get a SIEM template by ID", "description": "Returns the full SIEM template with the given ID, including its format and escape settings.\n\nPermission required: Administrator role (or an application account with the App role).", "operationId": "SiemTemplate_GetSiemTemplateById", "parameters": [ { "name": "siemTemplateId", "in": "path", "description": "The ID of the SIEM template.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "The SIEM template.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemTemplate" } } } }, "204": { "description": "No template with that ID exists. The response body is empty." }, "400": { "description": "The template could not be retrieved. The response body contains the error message." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/ActionPack": { "get": { "tags": [ "System Settings" ], "summary": "List action packs", "description": "Returns the action packs available in the console, with their action templates and any timeout override. The built-in packs that are not shown in the console are left out.\n\nPermission required: Admin or App role.", "operationId": "SystemSettings_GetActionPacks", "responses": { "200": { "description": "Returns a list of action packs.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ActionPack" } } } } }, "400": { "description": "The list could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/ActionPack/{actionPackId}": { "get": { "tags": [ "System Settings" ], "summary": "Get an action pack", "description": "Returns one action pack by its ID, including its action templates and timeout override.\n\nPermission required: Admin or App role.", "operationId": "SystemSettings_GetActionPackById", "parameters": [ { "name": "actionPackId", "in": "path", "description": "The ID of the action pack.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "Returns the action pack.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionPack" } } } }, "400": { "description": "The action pack could not be retrieved." }, "404": { "description": "No action pack has this ID." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "System Settings" ], "summary": "Update an action pack timeout", "description": "Changes the timeout override of an action pack. Only the timeout override is saved; other fields in the body are ignored. Returns the updated action pack.\n\nPermission required: Admin or App role.\n\nCaution: The new timeout applies to the pack's actions that run after the change, so a value that is too low can make actions fail.", "operationId": "SystemSettings_UpdateActionPack", "parameters": [ { "name": "actionPackId", "in": "path", "description": "The ID of the action pack to update. It must match the id in the body.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "description": "The action pack. Send back the object returned by the GET route with the new timeout override.\n\n- `id` (string (GUID), required): ID of the action pack. It must equal the ID in the URL.\n- `timeoutOverride` (integer): New timeout override, in seconds, for the pack's actions. 0 means no override, so each action uses its own timeout. If left out, 0 is saved.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionPackUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the updated action pack.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionPack" } } } }, "400": { "description": "The ID in the URL and body differ, the pack cannot be updated through this route, or the update failed." }, "404": { "description": "No action pack has this ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/AdUserFormat": { "get": { "tags": [ "System Settings" ], "summary": "Get the AD user name format", "description": "Returns the format Privilege Secure uses for user names when people sign in with Active Directory accounts: the SAM account name or the user principal name.\n\nPermission required: Admin role.\n\nValues for `response body`: 0 = Samaccountname, 1 = Upn.", "operationId": "SystemSettings_GetAdUserFormat", "responses": { "200": { "description": "Returns the format as a number.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdUserFormat" } } } }, "400": { "description": "The setting could not be read." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/AdUserFormat/{adUf}": { "put": { "tags": [ "System Settings" ], "summary": "Set the AD user name format", "description": "Sets the format Privilege Secure uses for user names when people sign in with Active Directory accounts. Returns the value that was saved.\n\nPermission required: Admin role.\n\nValues for `adUf`: 0 = Samaccountname, 1 = Upn.", "operationId": "SystemSettings_UpdateAdUserFormat", "parameters": [ { "name": "adUf", "in": "path", "description": "The format to use. Send the number or the name: 0 or Samaccountname, 1 or Upn.", "required": true, "schema": { "$ref": "#/components/schemas/AdUserFormat" } } ], "responses": { "200": { "description": "Returns the saved format.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdUserFormat" } } } }, "400": { "description": "The value is not valid or the setting could not be saved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/Certificates": { "get": { "tags": [ "System Settings" ], "summary": "List server certificates", "description": "Returns the unexpired certificates in the Personal store of the local computer certificate store of the server, with friendly name, subject and thumbprint. Use it to pick a certificate for a setting that needs a thumbprint, such as the WinRM or RDP file signing certificate.\n\nPermission required: Admin role.", "operationId": "SystemSettings_GetCertificateList", "parameters": [ { "name": "serverAuthOnly", "in": "query", "description": "When true, returns only certificates that allow server authentication. Defaults to false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": true } ], "responses": { "200": { "description": "Returns a list of certificates.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Certificate" } } } } }, "400": { "description": "The certificate store could not be read." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/CredentialPasswordHistoryOptions": { "get": { "tags": [ "System Settings" ], "summary": "Get password history options", "description": "Returns how many previous passwords Privilege Secure keeps for each managed credential and how many days it keeps them.\n\nPermission required: Admin or App role.", "operationId": "SystemSettings_GetCredentialPasswordHistoryOptions", "responses": { "200": { "description": "Returns the password history options.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialPasswordHistoryOptions" } } } }, "400": { "description": "The options could not be retrieved." }, "404": { "description": "No password history options exist." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "System Settings" ], "summary": "Update password history options", "description": "Sets how many previous passwords Privilege Secure keeps for each managed credential and how many days it keeps them. Returns the saved options.\n\nPermission required: Admin or App role.", "operationId": "SystemSettings_UpdateCredentialPasswordHistoryOptions", "requestBody": { "description": "The password history options to save. Send back the object returned by the GET route with your changes.\n\n- `id` (string (GUID), required): ID of the options record. Required. Use the value returned by the GET route; an unknown or missing ID returns 400.\n- `historicalPasswordLimit` (integer): Number of previous passwords to keep for each credential. If left out, 0 is saved.\n- `daysOfPasswordRetention` (integer): Number of days to keep previous passwords. If left out, 0 is saved.\n- `nodeId` (string (GUID)): Internal identifier. Leave as returned. Ignored; not saved. Leave as returned.\n- `createdDateTimeUtc` (string (date-time)): Set by the server. Leave as returned. Ignored; not saved. Leave as returned.\n- `modifiedDateTimeUtc` (string (date-time)): Set by the server. Leave as returned. Ignored; not saved. Leave as returned.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialPasswordHistoryOptionsUpdateRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the saved options.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialPasswordHistoryOptions" } } } }, "400": { "description": "The options could not be saved, for example because the ID is missing or unknown." }, "404": { "description": "The options could not be saved because no record was returned." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/DataRetentionSettings": { "get": { "tags": [ "System Settings" ], "summary": "Get data retention settings", "description": "Returns whether each retention rule is on and the number of days set for SIEM records, email records and I/O logs.\n\nPermission required: Admin or App role.", "operationId": "SystemSettings_GetDataRetentionSettings", "responses": { "200": { "description": "Returns the data retention settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataRetentionSettings" }, "example": { "enableSiemRetention": true, "siemRetentionDays": 365, "enableEmailRetention": true, "emailRetentionDays": 90, "enableIoLogRetention": false, "ioLogRetentionDays": 365 } } } }, "400": { "description": "The settings could not be read." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "System Settings" ], "summary": "Update data retention settings", "description": "Sets whether each retention rule is on and how many days each rule keeps SIEM records, email records and I/O logs. Returns the saved settings.\n\nPermission required: Admin role.\n\nCaution: When the SIEM or email rule is on, records older than the period are deleted and cannot be recovered.", "operationId": "SystemSettings_UpdateDataRetentionSettings", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataRetentionSettingsUpdateRequest" }, "example": { "enableSiemRetention": true, "siemRetentionDays": 365, "enableEmailRetention": true, "emailRetentionDays": 90, "enableIoLogRetention": false, "ioLogRetentionDays": 365 } } }, "required": true, "description": "The data retention settings to save. Each number of days must be between 1 and 3650, even for a rule that is off.\n\n- `enableSiemRetention` (boolean): Whether SIEM records are deleted after the retention period. If left out, it is set to false, which turns the rule off.\n- `siemRetentionDays` (integer, required): Days to keep SIEM records. 1 to 3650.\n- `enableEmailRetention` (boolean): Whether email records are deleted after the retention period. If left out, it is set to false, which turns the rule off.\n- `emailRetentionDays` (integer, required): Days to keep email records. 1 to 3650.\n- `enableIoLogRetention` (boolean): Whether the I/O log retention rule is on. If left out, it is set to false. The cleanup in this release acts on SIEM and email records.\n- `ioLogRetentionDays` (integer, required): Days for the I/O log retention rule. 1 to 3650." }, "responses": { "200": { "description": "Returns the saved settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataRetentionSettings" }, "example": { "enableSiemRetention": true, "siemRetentionDays": 365, "enableEmailRetention": true, "emailRetentionDays": 90, "enableIoLogRetention": false, "ioLogRetentionDays": 365 } } } }, "400": { "description": "A value is outside the allowed range or the settings could not be saved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/EmailConfiguration": { "get": { "tags": [ "System Settings" ], "summary": "Get the email configuration", "description": "Returns the web site URL that Privilege Secure puts in the links it sends in email notifications.\n\nPermission required: Admin or App role.", "operationId": "SystemSettings_GetEmailConfiguration", "responses": { "200": { "description": "Returns the email configuration.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailConfiguration" } } } }, "400": { "description": "The configuration could not be retrieved." }, "404": { "description": "No email configuration exists." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "System Settings" ], "summary": "Update the email configuration", "description": "Sets the web site URL that Privilege Secure puts in the links it sends in email notifications. Returns the saved configuration.\n\nPermission required: Admin or App role.", "operationId": "SystemSettings_UpdateEmailConfiguration", "requestBody": { "description": "The email configuration to save.\n\n- `websiteUrl` (string, required): The base URL used for links in email notifications. Required. Must be a well-formed absolute or relative URI; otherwise 400.\n- `id` (string (GUID), required): ID of the configuration record. Required. Use the value returned by the GET route; an unknown or missing ID returns 400.\n- `nodeId` (string (GUID)): Internal identifier. Leave as returned. Ignored; not saved. Leave as returned.\n- `createdDateTimeUtc` (string (date-time)): Set by the server. Leave as returned. Ignored; not saved. Leave as returned.\n- `modifiedDateTimeUtc` (string (date-time)): Set by the server. Leave as returned. Ignored; not saved. Leave as returned.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailConfigurationCreateRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the saved configuration.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailConfiguration" } } } }, "400": { "description": "The URL is missing or not a valid URI, the ID is unknown, or the configuration could not be saved." }, "404": { "description": "The configuration could not be saved because no record was returned." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/EncryptedFileSettings": { "get": { "tags": [ "System Settings" ], "summary": "Get encrypted file settings", "description": "Returns the maximum size, in megabytes, of files stored as encrypted files in the secret vault and whether those files are scanned for malware.\n\nThis route does not require a sign-in.", "operationId": "SystemSettings_GetEncryptedFileSettings", "responses": { "200": { "description": "Returns the encrypted file settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncryptedFileSettings" }, "example": { "encryptedFileMaxSizeMb": 10, "enableFileMalwareScan": true } } } }, "400": { "description": "The settings could not be read." } }, "security": [] }, "put": { "tags": [ "System Settings" ], "summary": "Update encrypted file settings", "description": "Sets the maximum size, in megabytes, of files stored as encrypted files in the secret vault and whether those files are scanned for malware. Returns the saved settings.\n\nPermission required: Admin role.", "operationId": "SystemSettings_UpdateEncryptedFileSettings", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncryptedFileSettingsUpdateRequest" }, "example": { "encryptedFileMaxSizeMb": 10, "enableFileMalwareScan": true } } }, "required": true, "description": "The encrypted file settings to save.\n\n- `encryptedFileMaxSizeMb` (integer, required): Maximum file size in megabytes. 1 to 20.\n- `enableFileMalwareScan` (boolean): Whether uploaded files are scanned for malware. If left out, it is set to false, which turns scanning off." }, "responses": { "200": { "description": "Returns the saved settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EncryptedFileSettings" }, "example": { "encryptedFileMaxSizeMb": 10, "enableFileMalwareScan": true } } } }, "400": { "description": "The size is outside the allowed range or the settings could not be saved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/InsecureSkipVerify": { "get": { "tags": [ "System Settings" ], "summary": "Get the skip certificate verification setting", "description": "Returns true when every Privilege Secure service is set to skip verification of server certificates on its connections, and false when at least one service verifies them.\n\nPermission required: Admin or App role.", "operationId": "SystemSettings_GetInsecureSkipVerify", "responses": { "200": { "description": "Returns true or false.", "content": { "application/json": { "schema": { "type": "boolean" } } } }, "400": { "description": "The setting could not be read." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "System Settings" ], "summary": "Turn certificate verification skipping on or off", "description": "Sets whether every Privilege Secure service skips verification of server certificates on its connections. The setting is saved to each service's configuration and the new value is returned.\n\nPermission required: Admin or App role.\n\nCaution: Setting this to true turns off certificate verification for all services, so use it only for troubleshooting and set it back to false afterward.", "operationId": "SystemSettings_UpdateInsecureSkipVerify", "parameters": [ { "name": "setting", "in": "query", "description": "True to skip certificate verification, false to verify certificates. If left out, false is used.", "required": false, "schema": { "type": "boolean" }, "example": false } ], "responses": { "200": { "description": "Returns the setting now in effect as true or false.", "content": { "application/json": { "schema": { "type": "boolean" } } } }, "400": { "description": "The setting could not be saved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/LogFileOptions": { "post": { "tags": [ "System Settings" ], "summary": "Update log file options for a service", "description": "Sets the minimum log level, the number of log files kept and the maximum log file size for one Privilege Secure service. For Action Service and Host Scan Service the same values are also applied to their worker processes. Returns the options that were sent.\n\nPermission required: Admin or App role.", "operationId": "SystemSettings_UpdateLogFileOptions", "requestBody": { "description": "The log file options to save. The name selects the service.\n\n- `name` (string, required): Name of the service, with or without spaces, such as Action Service, Host Scan Service or Proxy Service. Required. The server removes spaces and must recognize the service name (same capitalization as the GET route); an unknown name returns 400.\n- `minimumLogLevel` (string): Minimum level written to the log, such as Information. Send it with the other two values; if left out, null is written to the log settings.\n- `retainedFileCountLimit` (integer): Number of log files to keep. Send it with the other values; if left out, 0 is saved.\n- `fileSizeLimitBytes` (integer): Maximum size of one log file, in bytes. Send it with the other values; if left out, 0 is saved.\n- `outputTemplate` (string): Log line format. Returned by the GET route. Ignored; not saved. Leave as returned.\n- `shared` (boolean): Whether the log file is shared between processes. Returned by the GET route. Ignored; not saved. Leave as returned.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LogFileOptionsCreateRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the log file options that were sent.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LogFileOptions" } } } }, "400": { "description": "The service name is missing or not recognized, or the settings could not be written." }, "404": { "description": "The options could not be saved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/LogFileOptions/{serviceName}": { "get": { "tags": [ "System Settings" ], "summary": "Get log file options for a service", "description": "Returns the minimum log level, the number of log files kept and the maximum log file size for one Privilege Secure service.\n\nPermission required: Admin or App role.", "operationId": "SystemSettings_GetLogFileOptions", "parameters": [ { "name": "serviceName", "in": "path", "description": "The name of the service, written without spaces and with the same capitalization, such as ActionService, HostScanService or ProxyService.", "required": true, "schema": { "type": "string" }, "example": "" } ], "responses": { "200": { "description": "Returns the log file options.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LogFileOptions" } } } }, "400": { "description": "The service name is not recognized or the options could not be read." }, "404": { "description": "The log settings file for this service does not exist." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/MaxIdleTimeoutSettings": { "get": { "tags": [ "System Settings" ], "summary": "Get the idle user period", "description": "Returns the number of days without sign-in after which Privilege Secure removes a user's account. A value of 0 means the check is off. Application users and console access members are not removed.\n\nThis route does not require a sign-in.", "operationId": "SystemSettings_GetMaxIdleTimeoutSettings", "responses": { "200": { "description": "Returns the idle user setting.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MaxIdleTimeout" }, "example": { "maxIdleUserDays": 120 } } } }, "400": { "description": "The setting could not be read." } }, "security": [] }, "put": { "tags": [ "System Settings" ], "summary": "Update the idle user period", "description": "Sets the number of days without sign-in after which Privilege Secure removes a user's account. Send 0 to turn the check off. Returns the saved value.\n\nPermission required: Admin role.\n\nCaution: Accounts of users who exceed the idle period are removed (application users and console access members are excluded), so shortening the period can remove many accounts at once.", "operationId": "SystemSettings_UpdateMaxIdleTimeoutSettings", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MaxIdleTimeout" }, "example": { "maxIdleUserDays": 120 } } }, "required": true, "description": "The idle user setting to save.\n\n- `maxIdleUserDays` (integer): Days without sign-in before a user is idle. 0 turns the check off. Otherwise 90 to 365. If left out, 0 is saved and the check is turned off." }, "responses": { "200": { "description": "Returns the saved value.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MaxIdleTimeout" }, "example": { "maxIdleUserDays": 120 } } } }, "400": { "description": "The value is not 0 or between 90 and 365, or the setting could not be saved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/RdpFileOptions": { "get": { "tags": [ "System Settings" ], "summary": "Get RDP file options", "description": "Returns the settings Privilege Secure uses when it builds RDP files: the default and allowed resolutions, multi-monitor, smart sizing and the certificate used to sign the file.\n\nPermission required: Admin or App role.", "operationId": "SystemSettings_GetRdpFileOptions", "responses": { "200": { "description": "Returns the RDP file options.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleRdpFileOptions" } } } }, "400": { "description": "The options could not be retrieved." }, "404": { "description": "No RDP file options exist." } }, "security": [ { "bearerAuth": [] } ] }, "post": { "tags": [ "System Settings" ], "summary": "Update RDP file options", "description": "Sets the default and allowed resolutions, multi-monitor, smart sizing and signing certificate that Privilege Secure uses when it builds RDP files. Returns the saved options.\n\nPermission required: Admin or App role.", "operationId": "SystemSettings_UpdateRdpFileOptions", "requestBody": { "description": "The RDP file options to save. Send back the object returned by the GET route with your changes.\n\n- `defaultResolution` (string): Resolution used by default for RDP sessions. If left out, the stored value is replaced with null.\n- `allowedResolutions` (array of string, required): Resolutions a user can choose. Required; null returns 400. Saved as a comma-separated list.\n- `multiMonitor` (boolean): Whether RDP sessions can use multiple monitors. If left out, false is saved.\n- `smartSizing` (boolean): Whether RDP sessions scale to fit the window. If left out, false is saved.\n- `certificateThumbprint` (string): Thumbprint of the certificate used to sign RDP files. Use the Certificates route to find one. May be null for no certificate.\n- `id` (string (GUID), required): ID of the options record. Required. Use the value returned by the GET route; an unknown or missing ID returns 400.\n- `nodeId` (string (GUID)): Internal identifier. Leave as returned. Ignored; not saved. Leave as returned.\n- `createdDateTimeUtc` (string (date-time)): Set by the server. Leave as returned. Ignored; not saved. Leave as returned.\n- `modifiedDateTimeUtc` (string (date-time)): Set by the server. Leave as returned. Ignored; not saved. Leave as returned.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleRdpFileOptionsCreateRequest" } } }, "required": true }, "responses": { "200": { "description": "Returns the saved options.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimpleRdpFileOptions" } } } }, "400": { "description": "The ID is unknown, allowedResolutions is missing, or the options could not be saved." }, "404": { "description": "The options could not be saved because no record was returned." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/TimeoutSettings": { "get": { "tags": [ "System Settings" ], "summary": "Get the console idle timeout", "description": "Returns the console idle timeout: the minutes of inactivity before the console warns a user that their session is about to time out. If the setting cannot be read, the response returns the default of 10.\n\nThis route does not require a sign-in.", "operationId": "SystemSettings_GetTimeoutSettings", "responses": { "200": { "description": "Returns the idle timeout in minutes.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TimeoutSettings" } } } } }, "security": [] }, "put": { "tags": [ "System Settings" ], "summary": "Update the console idle timeout", "description": "Sets the console idle timeout: the minutes of inactivity before the console warns a user that their session is about to time out. Returns the value that was sent.\n\nPermission required: Admin role.\n\nCaution: The new value applies to every console user, so a very low value can sign people out after a short pause.", "operationId": "SystemSettings_UpdateTimeoutSettings", "requestBody": { "description": "The timeout to save.\n\n- `timeoutMinutes` (integer): Minutes of inactivity before the console shows the timeout warning. 0 to 1000; a value outside this range returns 400. If left out, 0 is saved.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TimeoutSettings" }, "example": { "timeoutMinutes": 15 } } }, "required": true }, "responses": { "200": { "description": "Returns the saved timeout.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TimeoutSettings" } } } }, "400": { "description": "The value is out of range, the body is missing, or the setting could not be saved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/SystemSettings/WinRm": { "get": { "tags": [ "System Settings" ], "summary": "Get WinRM connection settings", "description": "Returns whether Privilege Secure connects to Windows computers over WinRM using HTTP or HTTPS, and the thumbprint of the certificate it uses.\n\nPermission required: Admin or App role.\n\nValues for `httpSettings`: -1 = Default, 0 = UseHttp, 1 = UseHttpsIfAvailable, 2 = UseHttpsOnly.", "operationId": "SystemSettings_GetWinRmHttpSettings", "responses": { "200": { "description": "Returns the WinRM settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WinRmSettings" } } } }, "400": { "description": "The settings could not be read." }, "404": { "description": "The system settings could not be found." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "System Settings" ], "summary": "Update WinRM connection settings", "description": "Sets whether Privilege Secure connects to Windows computers over WinRM using HTTP or HTTPS, and the thumbprint of the certificate it uses. Returns the saved settings.\n\nPermission required: Admin or App role.\n\nValues for `httpSettings`: -1 = Default, 0 = UseHttp, 1 = UseHttpsIfAvailable, 2 = UseHttpsOnly.\n\nCaution: The change applies to all later WinRM connections, so a wrong choice can stop Privilege Secure reaching Windows computers.", "operationId": "SystemSettings_UpdateWinRmHttpSettings", "requestBody": { "description": "The WinRM settings to save.\n\n- `httpSettings` (integer): How WinRM connections use HTTP and HTTPS. See the enumeration values. If left out, 0 (UseHttp) is saved.\n- `thumbprint` (string): Thumbprint of the certificate to use. Use the Certificates route to find one. May be null. If left out, an empty value is saved.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WinRmSettings" } } }, "required": true }, "responses": { "200": { "description": "Returns the saved settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WinRmSettings" } } } }, "400": { "description": "The settings could not be saved." }, "404": { "description": "The system settings could not be found." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/User": { "put": { "tags": [ "User" ], "summary": "Update a user", "description": "Replaces the stored details of an existing user with the object you send. Properties you leave out are reset to their defaults rather than kept. The user is identified by the ID in the body.\n\nPermission required: Admin or App role, and a sign-in that has passed multi-factor authentication.", "operationId": "User_Update", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostUserUpdateRequest" } } }, "required": true, "description": "The full user object, including its ID. The fields listed are the commonly used ones; other user properties are accepted too.\n\n- `id` (string (GUID), required): The ID of the user to update. The call returns 404 when no user has this ID.\n- `name` (string): The account name.\n- `displayName` (string): The display name.\n- `samaccountname` (string): The sAMAccountName of the account.\n- `userPrincipalName` (string): The user principal name.\n- `email` (string): The email address.\n- `activeDirectoryDomainId` (string (GUID)): The ID of the Active Directory domain the account belongs to.\n- `hostId` (string (GUID)): The ID of the resource the account belongs to, for local accounts.\n- `managed` (boolean): Whether Privilege Secure manages the account.\n- `deleted` (boolean): Whether the account is marked as deleted.\n- `forcePasswordReset` (boolean): Whether the password is flagged to be reset." }, "responses": { "200": { "description": "The user was updated. The body contains the updated user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostUser" } } } }, "400": { "description": "The update failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No user has the ID in the body." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/User/GetByUserNameHostId/{username}/{hostId}": { "get": { "tags": [ "User" ], "summary": "Get a local user by name and resource", "description": "Finds a user account by its name property on a specific resource. The match is not case-sensitive and the result can include a user that is marked as deleted. Group memberships are not included.\n\nPermission required: Admin or App role, and a sign-in that has passed multi-factor authentication.", "operationId": "User_GetHostUserByUserNameHostId", "parameters": [ { "name": "username", "in": "path", "description": "The user's name on the resource, such as localadmin. The match is not case-sensitive.", "required": true, "schema": { "type": "string" }, "example": "localadmin" }, { "name": "hostId", "in": "path", "description": "The ID of the resource.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" } ], "responses": { "200": { "description": "The matching user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostUser" } } } }, "400": { "description": "The lookup failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No user with that name exists on the resource." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/User/{hostUserId}/DependencyCount": { "get": { "tags": [ "User" ], "summary": "Get the dependency count for a managed user", "description": "Returns the number of dependencies on the managed account that belongs to the user. Use it to check whether other items rely on the account before you change it.\n\nPermission required: Admin or App role, and a sign-in that has passed multi-factor authentication.", "operationId": "User_GetDependencyCount", "parameters": [ { "name": "hostUserId", "in": "path", "description": "The ID of the user.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" } ], "responses": { "200": { "description": "The number of dependencies, as an integer.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The user is not managed, or the count could not be retrieved. The body contains a message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No active user has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserAndGroupCollection": { "post": { "tags": [ "User and Group Collection" ], "summary": "Create a user and group collection", "description": "Creates a user and group collection from the object you send and returns it. Collection names are not required to be unique.\n\nPermission required: Admin role, and a sign-in that has passed multi-factor authentication.", "operationId": "UserAndGroupCollection_AddUserAndGroupCollection", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserAndGroupCollectionCreateRequest" } } }, "required": true, "description": "The collection to create.\n\n- `id` (string (GUID)): The collection ID.\n- `name` (string, required): The collection name. Up to 256 characters.\n- `description` (string): A description of the collection.\n- `isReviewer` (boolean): Whether the collection is a reviewer collection." }, "responses": { "200": { "description": "The created collection, with its ID and timestamps.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserAndGroupCollection" } } } }, "400": { "description": "The collection was not provided or could not be created. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserAndGroupCollection/AddUserAndGroup/{userAndGroupCollectionId}": { "post": { "tags": [ "User and Group Collection" ], "summary": "Add users and groups to a collection", "description": "Adds the listed users and groups to a collection and returns the number added. Entries that are already members are skipped and not counted.\n\nPermission required: Admin role, and a sign-in that has passed multi-factor authentication.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "UserAndGroupCollection_AddUserAndGroup", "parameters": [ { "name": "userAndGroupCollectionId", "in": "path", "description": "The ID of the user and group collection.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserAndGroupIdAndType" } } } }, "required": true, "description": "A list of the users and groups to add.\n\n- `id` (string (GUID), required): The ID of the user or group.\n- `entityType` (integer): The type of entry. See the enum notes. 1 adds a group; any other value adds a user. Defaults to 0." }, "responses": { "200": { "description": "The number of new members added, as an integer.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The ID is empty, or the add failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No collection has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserAndGroupCollection/Copy": { "post": { "tags": [ "User and Group Collection" ], "summary": "Copy a user and group collection", "description": "Creates a new collection under a new name with the same users and groups as an existing collection, and returns the new collection. The description and reviewer flag come from your request, not from the original. The new name must differ from the original and must not already be in use; the name check ignores case.\n\nPermission required: Admin role, and a sign-in that has passed multi-factor authentication.", "operationId": "UserAndGroupCollection_CopyUserAndGroupCollection", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserAndGroupCollectionCopyRequest" } } }, "required": true, "description": "The collection to copy, with the new name.\n\n- `id` (string (GUID), required): The ID of the collection to copy.\n- `name` (string, required): The name for the copy. Must be different from the original name and unique.\n- `description` (string): A description for the new collection.\n- `isReviewer` (boolean): Whether the new collection is a reviewer collection." }, "responses": { "200": { "description": "The new collection.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserAndGroupCollection" } } } }, "400": { "description": "The name is the same as the original, is already in use, or the copy failed. The body contains the message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No collection has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserAndGroupCollection/Names": { "get": { "tags": [ "User and Group Collection" ], "summary": "List user and group collection names", "description": "Returns the ID and name of each user and group collection. Use filterText to narrow the list to names that contain the text, ignoring case.\n\nPermission required: Admin or App role, and a sign-in that has passed multi-factor authentication.", "operationId": "UserAndGroupCollection_ListNames", "parameters": [ { "name": "filterText", "in": "query", "description": "Text to filter collection names by. The default is empty, which returns all collections.", "required": false, "schema": { "type": "string", "default": "" }, "example": "admins" } ], "responses": { "200": { "description": "A list of objects with an id and a name.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/NameAndId" } } } } }, "400": { "description": "The list could not be retrieved. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserAndGroupCollection/RemoveUserAndGroup/{userAndGroupCollectionId}": { "put": { "tags": [ "User and Group Collection" ], "summary": "Remove users and groups from a collection", "description": "Removes members from a collection. List the members to remove, or set all to true to remove every member, optionally narrowed by filterText and entityType.\n\nPermission required: Admin role, and a sign-in that has passed multi-factor authentication.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "UserAndGroupCollection_RemoveUserAndGroups", "parameters": [ { "name": "userAndGroupCollectionId", "in": "path", "description": "The ID of the user and group collection.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserAndGroupCollectionMultiItemSelector" } } }, "required": true, "description": "Which members to remove.\n\n- `userAndGroupIdAndTypes` (array): The members to remove when all is false. Each has an id and an entityType. See the enum notes. An entityType of 1 removes a group; any other value removes a user.\n- `all` (boolean): Set to true to remove every member, or every member that matches filterText and entityType.\n- `filterText` (string): Text to filter the members by when all is true.\n- `entityType` (integer): When all is true, limits the removal to one type of entry. See the enum notes. Applies only when all is true." }, "responses": { "200": { "description": "A number. When all is true with no filterText or entityType, the value is -1. When all is true with a filter, it is the number of matching members. When you list members, it is the number of entries you sent, whether or not each one was a member.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "400": { "description": "The ID is empty, or the removal failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No collection has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserAndGroupCollection/Search": { "get": { "tags": [ "User and Group Collection" ], "summary": "Search the members of a collection", "description": "Returns a page of the users and groups that belong to one user and group collection. Use it to list or filter the collection's members.\n\nPermission required: Admin role, and a sign-in that has passed multi-factor authentication.\n\nValues for `entityType`: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local.", "operationId": "UserAndGroupCollection_Search", "parameters": [ { "name": "id", "in": "query", "description": "The ID of the user and group collection.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "Skip", "in": "query", "description": "The number of records to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "The number of records to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "The property to sort by. Without it, the results are sorted by display name.", "required": false, "schema": { "type": "string" }, "example": "name" }, { "name": "OrderDescending", "in": "query", "description": "Set to true for descending order.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Text to match in the name, display name, domain, email, sAMAccountName or user principal name.", "required": false, "schema": { "type": "string" }, "example": "smith" }, { "name": "entityType", "in": "query", "description": "Limits the results to one type of entry. See the enum notes.", "required": false, "schema": { "$ref": "#/components/schemas/ManagedAccountKind" } }, { "name": "FilterColumns", "in": "query", "description": "Accepted but not used by this route. The text filter always searches a fixed set of columns.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "A table with the page of members in data and the total in recordsTotal.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfManagedAccountView" } } } }, "400": { "description": "The ID is missing or empty, or the search failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No collection has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserAndGroupCollection/{userAndGroupCollectionId}": { "delete": { "tags": [ "User and Group Collection" ], "summary": "Delete a user and group collection", "description": "Deletes the collection and removes any console access that was granted through it.\n\nPermission required: Admin role, and a sign-in that has passed multi-factor authentication.\n\nCaution: The collection is deleted immediately, and console access granted through it is removed.", "operationId": "UserAndGroupCollection_RemoveUserAndGroupCollection", "parameters": [ { "name": "userAndGroupCollectionId", "in": "path", "description": "The ID of the user and group collection.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "The collection was deleted. The body is empty." }, "400": { "description": "The delete failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No collection has that ID." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "User and Group Collection" ], "summary": "Get a user and group collection", "description": "Returns one user and group collection: its ID, name, description, reviewer flag and timestamps. The member and access policy lists in the response are returned empty; use the Search route to list the members.\n\nPermission required: Admin role, and a sign-in that has passed multi-factor authentication.", "operationId": "UserAndGroupCollection_GetUserAndGroupCollection", "parameters": [ { "name": "userAndGroupCollectionId", "in": "path", "description": "The ID of the user and group collection.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "responses": { "200": { "description": "The collection.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserAndGroupCollection" } } } }, "400": { "description": "The ID is empty, or the lookup failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No collection has that ID." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "User and Group Collection" ], "summary": "Update a user and group collection", "description": "Updates the name and details of a collection. The ID in the route must match the ID in the body. The collection is replaced with the object you send, so a description or reviewer flag you leave out is cleared.\n\nPermission required: Admin role, and a sign-in that has passed multi-factor authentication.", "operationId": "UserAndGroupCollection_UpdateUserAndGroupCollection", "parameters": [ { "name": "userAndGroupCollectionId", "in": "path", "description": "The ID of the user and group collection.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserAndGroupCollectionUpdateRequest" } } }, "required": true, "description": "The updated collection.\n\n- `id` (string (GUID), required): The collection ID. It must match the ID in the route.\n- `name` (string, required): The collection name. Up to 256 characters.\n- `description` (string): A description of the collection.\n- `isReviewer` (boolean): Whether the collection is a reviewer collection." }, "responses": { "200": { "description": "The collection was updated. The body echoes the collection you sent.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserAndGroupCollection" } } } }, "400": { "description": "The body is missing, the IDs do not match, or the update failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No collection has the ID in the route." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserRole/Group/{groupId}": { "get": { "tags": [ "User Role" ], "summary": "List the roles for a group", "description": "Returns the Administrator and Reviewer roles, each with a flag showing whether this group has it. The None role is never listed. Use it to see which roles are assigned.\n\nPermission required: Admin role.\n\nValues for `roles`: 0 = None, 50 = Administrator, 150 = Reviewer.\n\nCaution: The response shows whether this group holds the Administrator role.", "operationId": "UserRole_GetRolesForGroup", "parameters": [ { "name": "groupId", "in": "path", "description": "The ID of the group in Privilege Secure, as a managed group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }, { "name": "Skip", "in": "query", "description": "The number of roles to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "The number of roles to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "The property to sort by. The default is RoleName.", "required": false, "schema": { "type": "string" }, "example": "RoleName" }, { "name": "OrderDescending", "in": "query", "description": "Set to true for descending order.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Text to filter role names by, ignoring case. The filter is applied after Skip and Take, so a page can come back with fewer entries than expected.", "required": false, "schema": { "type": "string" }, "example": "admin" }, { "name": "FilterColumns", "in": "query", "description": "Accepted but not used by this route. The text filter always searches a fixed set of columns.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "A table of roles. Each entry has an id and a roleName (both the role name, such as Administrator) and isAssigned. recordsTotal is the number of entries returned.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfUserRoleAssignment" } } } }, "400": { "description": "The lookup failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No group has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserRole/Group/{groupId}/Add": { "put": { "tags": [ "User Role" ], "summary": "Add roles to a group", "description": "Adds the roles in the body to the group and returns the roles that result.\n\nPermission required: Admin role.\n\nValues for `roles`: 0 = None, 50 = Administrator, 150 = Reviewer.\n\nCaution: The change takes effect immediately and can grant administrator access to every member of the group.", "operationId": "UserRole_AddRolesForGroup", "parameters": [ { "name": "groupId", "in": "path", "description": "The ID of the group in Privilege Secure, as a managed group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "requestBody": { "description": "A list of role numbers.\n\n- `(array item)` (integer, required): A role number. See the enum notes. Only 50 (Administrator) and 150 (Reviewer) have an effect; 0 (None) is accepted and ignored.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserRoleLevel" } } } }, "required": true }, "responses": { "200": { "description": "The list of role numbers the group now holds.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserRoleLevel" } } } } }, "400": { "description": "The change failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No group has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserRole/Group/{groupId}/Remove": { "put": { "tags": [ "User Role" ], "summary": "Remove roles from a group", "description": "Removes the roles in the body from the group and returns the roles that result.\n\nPermission required: Admin role.\n\nValues for `roles`: 0 = None, 50 = Administrator, 150 = Reviewer.\n\nCaution: The change takes effect immediately and can remove administrator access from every member of the group.", "operationId": "UserRole_RemoveRolesForGroup", "parameters": [ { "name": "groupId", "in": "path", "description": "The ID of the group in Privilege Secure, as a managed group.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "7c9e6679-7425-40de-944b-e07fc1f90ae7" } ], "requestBody": { "description": "A list of role numbers.\n\n- `(array item)` (integer, required): A role number. See the enum notes. Only 50 (Administrator) and 150 (Reviewer) have an effect; 0 (None) is accepted and ignored.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserRoleLevel" } } } }, "required": true }, "responses": { "200": { "description": "The list of role numbers the group still holds.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserRoleLevel" } } } } }, "400": { "description": "The change failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No group has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserRole/User/{userId}": { "get": { "tags": [ "User Role" ], "summary": "List the roles for a user", "description": "Returns the Administrator and Reviewer roles, each with a flag showing whether this user has it. The None role is never listed. Use it to see which roles are assigned.\n\nPermission required: Admin role.\n\nValues for `roles`: 0 = None, 50 = Administrator, 150 = Reviewer.\n\nCaution: The response shows whether this user holds the Administrator role.", "operationId": "UserRole_GetRolesForUser", "parameters": [ { "name": "userId", "in": "path", "description": "The ID of the user in Privilege Secure, as a managed user. This is not the account record ID that the User routes return.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, { "name": "Skip", "in": "query", "description": "The number of roles to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 0 }, { "name": "Take", "in": "query", "description": "The number of roles to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32" }, "example": 100 }, { "name": "OrderBy", "in": "query", "description": "The property to sort by. The default is RoleName.", "required": false, "schema": { "type": "string" }, "example": "RoleName" }, { "name": "OrderDescending", "in": "query", "description": "Set to true for descending order.", "required": false, "schema": { "type": "boolean" }, "example": false }, { "name": "FilterText", "in": "query", "description": "Text to filter role names by, ignoring case. The filter is applied after Skip and Take, so a page can come back with fewer entries than expected.", "required": false, "schema": { "type": "string" }, "example": "admin" }, { "name": "FilterColumns", "in": "query", "description": "Accepted but not used by this route. The text filter always searches a fixed set of columns.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "A table of roles. Each entry has an id and a roleName (both the role name, such as Administrator) and isAssigned. recordsTotal is the number of entries returned.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfUserRoleAssignment" } } } }, "400": { "description": "The lookup failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No user has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserRole/User/{userId}/Add": { "put": { "tags": [ "User Role" ], "summary": "Add roles to a user", "description": "Adds the roles in the body to the user and returns the role numbers the user now holds. Adding the Administrator role, or the Reviewer role to a user who is not yet a reviewer, also records an event.\n\nPermission required: Admin role.\n\nValues for `roles`: 0 = None, 50 = Administrator, 150 = Reviewer.", "operationId": "UserRole_AddRolesForUser", "parameters": [ { "name": "userId", "in": "path", "description": "The ID of the user in Privilege Secure, as a managed user. This is not the account record ID that the User routes return.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "description": "A list of role numbers.\n\n- `(array item)` (integer, required): A role number. See the enum notes. Only 50 (Administrator) and 150 (Reviewer) have an effect; 0 (None) is accepted and ignored.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserRoleLevel" } } } }, "required": true }, "responses": { "200": { "description": "The list of role numbers the user now holds.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserRoleLevel" } } } } }, "400": { "description": "The change failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No user has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserRole/User/{userId}/Remove": { "put": { "tags": [ "User Role" ], "summary": "Remove roles from a user", "description": "Removes the roles in the body from the user and returns the role numbers the user still holds. Removing the Administrator role, or the Reviewer role from a user who is a reviewer, also records an event.\n\nPermission required: Admin role.\n\nValues for `roles`: 0 = None, 50 = Administrator, 150 = Reviewer.\n\nCaution: The change takes effect immediately and can remove administrator access from the user.", "operationId": "UserRole_RemoveRolesForUser", "parameters": [ { "name": "userId", "in": "path", "description": "The ID of the user in Privilege Secure, as a managed user. This is not the account record ID that the User routes return.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "requestBody": { "description": "A list of role numbers.\n\n- `(array item)` (integer, required): A role number. See the enum notes. Only 50 (Administrator) and 150 (Reviewer) have an effect; 0 (None) is accepted and ignored.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserRoleLevel" } } } }, "required": true }, "responses": { "200": { "description": "The list of role numbers the user still holds.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserRoleLevel" } } } } }, "400": { "description": "The change failed. The body contains the error message." }, "403": { "description": "The signed-in user does not have the required role." }, "404": { "description": "No user has that ID." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserToken": { "get": { "tags": [ "User Token" ], "summary": "Renew the current sign-in token", "description": "Returns a new session token to replace the one in the Authorization header, so a client can keep a session going without signing in again. Send the current token as a Bearer token.\n\nPermission required: Any signed-in user.\n\nCaution: The response contains a session token that grants access as the signed-in user; store it securely.", "operationId": "UserToken_Get", "responses": { "200": { "description": "The body is the new token as a string.", "content": { "text/plain": { "schema": { "type": "string" } }, "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "The token could not be renewed. The body is an error message." }, "401": { "description": "The token is missing or not valid, or no new token could be issued." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/UserToken/IsLoggedIn": { "get": { "tags": [ "User Token" ], "summary": "Check that the session token is valid", "description": "Returns success when the token sent with the request is valid and its multi-factor sign-in is complete. Use it to test a token before making other calls.\n\nPermission required: Any signed-in user.", "operationId": "UserToken_IsLoggedIn", "responses": { "200": { "description": "The token is valid. The body is empty." }, "401": { "description": "The token is missing, expired or not valid." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Version": { "get": { "tags": [ "Version" ], "summary": "Get the server version", "description": "Returns the version of the running server as a string in the form YY.MM.build, for example 26.07.00123. Use it to check which release you are connected to.\n\nPermission required: No sign-in required.", "operationId": "Version_Get", "responses": { "200": { "description": "The body is the version string. It is returned as plain text, or as a JSON string when the client asks for JSON.", "content": { "application/json": { "schema": { "type": "string" }, "example": "26.07.00123" }, "text/plain": { "schema": { "type": "string" }, "example": "26.07.00123" } } } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Website": { "get": { "tags": [ "Website" ], "summary": "List all websites", "description": "Returns every website resource with its name, sign-in address, icon and linked resource ID. Websites that are not real websites (virtual entries) and websites with no linked resource are left out. The URL rules are not filled in; use the URL rule search to get them.\n\nPermission required: Admin role.", "operationId": "Website_GetAllWebsites", "responses": { "200": { "description": "The body is an array of website objects.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/WebsiteResource" } } } } }, "204": { "description": "The list could not be read. The body is empty." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Website/byResourceId/{id}": { "get": { "tags": [ "Website" ], "summary": "Get a website by its resource ID", "description": "Returns the website that is linked to a given resource. Use it when you have the resource ID rather than the website ID. The body is the website record itself (ID, name, icon, sign-in address, URL rules, virtual flag and timestamps), not the website-and-resource object that the other website routes return.\n\nPermission required: Admin or App role.", "operationId": "Website_GetWebsiteByManagedResourceId", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the resource that represents the website.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The body is the website record.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Website" } } } }, "400": { "description": "The ID is empty. The body is a message." }, "404": { "description": "No website is linked to that resource, or it could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Website/{id}": { "delete": { "tags": [ "Website" ], "summary": "Delete a website resource", "description": "Deletes a website resource. The website must have no accounts left; delete its accounts first.\n\nPermission required: Admin role.\n\nCaution: The delete is permanent. It also removes the resource that represents the website and the website's URL rules.", "operationId": "Website_DeleteWebsite", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the website to delete.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The website was deleted. The body is a confirmation message.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "The ID is empty, the website still has accounts, or the delete failed. The body is a message." }, "404": { "description": "No website has that ID." } }, "security": [ { "bearerAuth": [] } ] }, "get": { "tags": [ "Website" ], "summary": "Get a website", "description": "Returns one website resource by its ID, with its name, sign-in address, icon, platform and linked resource ID. The URL rules are not filled in; use the URL rule search to get them.\n\nPermission required: Admin or App role.", "operationId": "Website_GetWebsite", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the website.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The body is the website object.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebsiteResource" } } } }, "400": { "description": "The ID is empty. The body is a message." }, "404": { "description": "No website has that ID, or it could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Website/{websiteId}/User/DeleteMultiple": { "post": { "tags": [ "Website" ], "summary": "Delete accounts from a website", "description": "Deletes several accounts in one call. The response is the number of IDs processed without an error; an ID whose delete fails is skipped and not counted.\n\nPermission required: Admin role.\n\nCaution: The website in the path is only checked to exist. The IDs are not checked against it, so any account ID you send is deleted. Send only IDs of this website's accounts.", "operationId": "Website_DeleteManagedUsers", "parameters": [ { "name": "websiteId", "in": "path", "description": "The ID of the website the accounts belong to.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true, "description": "A JSON array of account IDs to delete.\n\n- `(body)` (array of string (GUID), required): The IDs of the accounts to delete." }, "responses": { "200": { "description": "The body is the number of IDs processed without an error. IDs whose delete failed are skipped and not counted.", "content": { "application/json": { "schema": { "type": "integer", "format": "int32" } } } }, "404": { "description": "No website has that ID. The body is a message." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/Website/{websiteId}/User/{managedUserId}": { "put": { "tags": [ "Website" ], "summary": "Update an account of a website", "description": "Updates a stored account (user name, password, note) of a website. The account to change is identified by the ID in the body; the website ID in the path is only checked to exist. Send the full account: omitted name, user name, comment and managedType values replace the stored ones.\n\nPermission required: Admin or App role.\n\nValues for `managedType`: 0 = NotManaged, 1 = Manual, 2 = Automatic.\n\nCaution: The request can contain a new password; use HTTPS. The change applies immediately.", "operationId": "Website_UpdateManagedUser", "parameters": [ { "name": "websiteId", "in": "path", "description": "The ID of the website the account belongs to.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "managedUserId", "in": "path", "description": "The ID of the account to update. Send the same ID in the body; the server uses the body value.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedUserCredentialUserRequest" } } }, "required": true, "description": "The account with its changes.\n\n- `id` (string (GUID), required): The ID of the account record. Required. Identifies the account to update.\n- `credentialId` (string (GUID), required): The ID of the underlying credential. Required. Must be the credentialId returned for this account; a mismatch makes the call fail.\n- `managedResourceId` (string (GUID), required): The resource ID of the website the account belongs to. Required. Use the website's managedResourceId.\n- `name` (string): The display name of the account.\n- `username` (string): The user name used to sign in to the website.\n- `password` (string): The password for the account. Sensitive value. Send a new password to change it; leave empty to keep the existing password.\n- `managedType` (integer): How the password is managed. 0 = NotManaged, 1 = Manual, 2 = Automatic. If omitted, it is set to 0 (NotManaged). Send the current value.\n- `createdDateTimeUtc` (string (date-time)): When the account was created, in UTC. Set by the server.\n- `comment` (string): A free-text note about the account." }, "responses": { "200": { "description": "The body is the updated account.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedUserCredential" } } } }, "404": { "description": "No website has that ID. The body is a message." }, "500": { "description": "The resource ID in the body does not belong to a website, no account has the ID in the body, or credentialId does not match the account." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/WebsiteUri": { "post": { "tags": [ "Website URL" ], "summary": "Add a URL rule to a website", "description": "Adds a URL rule that tells the system which pages belong to a website.\n\nPermission required: Admin role.\n\nValues for `matchType`: -1 = All, 0 = Domain, 1 = Exact, 2 = Never, 3 = StartsWith, 4 = Regex, 5 = Host.\n\nValues for `match`: -1 = All, 0 = Domain, 1 = Exact, 2 = Never, 3 = StartsWith, 4 = Regex, 5 = Host.", "operationId": "WebsiteUri_AddUrl", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebsiteUriCreateRequest" } } }, "required": true, "description": "The URL rule to add.\n\n- `id` (string (GUID)): The ID of the URL rule. Leave empty when creating.\n- `websiteId` (string (GUID), required): The ID of the website the rule belongs to. Required.\n- `uri` (string, required): The address or pattern to match. Required.\n- `match` (integer): An older field for how the address is matched. Set it to the same value as matchType.\n- `matchType` (integer): How the address is matched. The URL rule search filters on this field. 0 = Domain, 1 = Exact, 2 = Never, 3 = StartsWith, 4 = Regex, 5 = Host. Do not use -1 (All), which is only a search filter value.\n- `nodeId` (string (GUID)): Internal server ID. Do not send. Set by the server." }, "responses": { "200": { "description": "The body is the created URL rule.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebsiteUri" } } } }, "400": { "description": "The rule could not be created." } }, "security": [ { "bearerAuth": [] } ] }, "put": { "tags": [ "Website URL" ], "summary": "Update a website URL rule", "description": "Updates an existing URL rule of a website. Send the full rule, including its ID.\n\nPermission required: Admin role.\n\nValues for `matchType`: -1 = All, 0 = Domain, 1 = Exact, 2 = Never, 3 = StartsWith, 4 = Regex, 5 = Host.\n\nValues for `match`: -1 = All, 0 = Domain, 1 = Exact, 2 = Never, 3 = StartsWith, 4 = Regex, 5 = Host.", "operationId": "WebsiteUri_UpdateUrl", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebsiteUriUpdateRequest" } } }, "required": true, "description": "The URL rule with its changes.\n\n- `id` (string (GUID), required): The ID of the URL rule. Required. Identifies the rule to update.\n- `websiteId` (string (GUID), required): The ID of the website the rule belongs to. Required.\n- `uri` (string, required): The address or pattern to match. Required.\n- `match` (integer): An older field for how the address is matched. Set it to the same value as matchType.\n- `matchType` (integer): How the address is matched. The URL rule search filters on this field. 0 = Domain, 1 = Exact, 2 = Never, 3 = StartsWith, 4 = Regex, 5 = Host. Do not use -1 (All), which is only a search filter value.\n- `nodeId` (string (GUID)): Internal server ID. Do not send. Set by the server." }, "responses": { "200": { "description": "The body is the updated URL rule.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebsiteUri" } } } }, "400": { "description": "The rule could not be updated." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/WebsiteUri/deleteMultiple": { "post": { "tags": [ "Website URL" ], "summary": "Delete website URL rules", "description": "Deletes several URL rules in one call. The IDs are processed in order.\n\nPermission required: Admin role.\n\nCaution: If one ID cannot be deleted, the call stops and returns 400; the IDs before it stay deleted.", "operationId": "WebsiteUri_DeleteMultipleUrl", "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "required": true, "description": "A JSON array of URL rule IDs to delete.\n\n- `(body)` (array of string (GUID), required): The IDs of the rules to delete." }, "responses": { "200": { "description": "The rules were deleted. The body is a confirmation message.", "content": { "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "One of the rules could not be deleted. Rules earlier in the list were already deleted." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/WebsiteUri/search": { "get": { "tags": [ "Website URL" ], "summary": "Search the URL rules of a website", "description": "Returns a page of the URL rules that identify pages of one website, optionally filtered by match type and by text contained in the rule's address.\n\nPermission required: Admin role.\n\nValues for `matchType`: -1 = All, 0 = Domain, 1 = Exact, 2 = Never, 3 = StartsWith, 4 = Regex, 5 = Host.", "operationId": "WebsiteUri_GetWebsiteUris", "parameters": [ { "name": "websiteId", "in": "query", "description": "The ID of the website.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, { "name": "filterType", "in": "query", "description": "Only return rules with this match type (the matchType field). The default is -1 (all).", "required": false, "schema": { "$ref": "#/components/schemas/WebsiteUriMatchType" } }, { "name": "filterText", "in": "query", "description": "Only return rules whose address contains this text (not case-sensitive).", "required": false, "schema": { "type": "string" }, "example": "example" }, { "name": "orderBy", "in": "query", "description": "The name of the field to sort by.", "required": false, "schema": { "type": "string" }, "example": "uri" }, { "name": "orderDescending", "in": "query", "description": "Set to true to sort from highest to lowest. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false }, { "name": "skip", "in": "query", "description": "The number of results to skip. The default is 0.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "example": 0 }, { "name": "take", "in": "query", "description": "The maximum number of results to return. The default is 100.", "required": false, "schema": { "type": "integer", "format": "int32", "default": 100 }, "example": 100 } ], "responses": { "200": { "description": "The body is a page of URL rules with the total count.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTableOfWebsiteUri" } } } }, "400": { "description": "The website ID is empty or the search failed." } }, "security": [ { "bearerAuth": [] } ] } }, "/api/v1/WebsiteUri/{id}": { "get": { "tags": [ "Website URL" ], "summary": "Get a website URL rule", "description": "Returns one URL rule of a website by its ID, including its address, match type and timestamps.\n\nPermission required: Any signed-in user.\n\nValues for `matchType`: -1 = All, 0 = Domain, 1 = Exact, 2 = Never, 3 = StartsWith, 4 = Regex, 5 = Host.\n\nValues for `match`: -1 = All, 0 = Domain, 1 = Exact, 2 = Never, 3 = StartsWith, 4 = Regex, 5 = Host.", "operationId": "WebsiteUri_GetUrl", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the URL rule.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" } ], "responses": { "200": { "description": "The body is the URL rule.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebsiteUri" } } } }, "204": { "description": "No rule has that ID. The body is empty." }, "400": { "description": "The rule could not be retrieved." } }, "security": [ { "bearerAuth": [] } ] } }, "/signin": { "post": { "tags": [ "User Token" ], "summary": "Sign in with a form post and get a token", "description": "Checks a user name and password sent as form fields and returns a token. If the user must give a multi-factor code, send the returned token to the sign-in verification route to finish. This route is outside the /api/v1 path.\n\nPermission required: No sign-in required.\n\nCaution: The request carries a password and the response carries a token that grants access as the user; use HTTPS and store the token securely.", "operationId": "UserToken_SigninForm", "requestBody": { "content": { "application/x-www-form-urlencoded": { "schema": { "type": "object", "required": [ "login", "password" ], "properties": { "login": { "type": "string", "description": "The user name to sign in with. Local user name or DOMAIN\\user." }, "password": { "type": "string", "format": "password", "description": "The password for the user." } } } }, "multipart/form-data": { "schema": { "type": "object", "required": [ "login", "password" ], "properties": { "login": { "type": "string", "description": "The user name to sign in with. Local user name or DOMAIN\\user." }, "password": { "type": "string", "format": "password", "description": "The password for the user." } } } } }, "required": true, "description": "The credentials, sent as form fields (application/x-www-form-urlencoded or multipart/form-data).\n\n- `login` (string, required): The user name to sign in with. Local user name or DOMAIN\\user.\n- `password` (string, required): The password for the user. Sensitive value." }, "responses": { "200": { "description": "The body is the token as a string.", "content": { "text/plain": { "schema": { "type": "string" } }, "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "The user is not allowed to sign in with a password, or licensing blocks sign-in. The body is a message." }, "401": { "description": "Credentials are wrong or empty, the database could not be reached, or an unexpected error occurred. The body is a message." } }, "security": [] } }, "/signin2fa": { "post": { "tags": [ "User Token" ], "summary": "Complete sign-in with a multi-factor code", "description": "Finishes a sign-in that requires multi-factor authentication. Send the token from the first sign-in step as a Bearer token and the code as a JSON string; the response is the session token. This route is outside the /api/v1 path.\n\nPermission required: A first-step sign-in token (password accepted, multi-factor code pending).\n\nCaution: The response contains a session token that grants access as the user; store it securely.", "operationId": "UserToken_SigninForm2fa", "parameters": [ { "name": "extension", "in": "query", "description": "Set to true when the sign-in is for a browser extension. The default is false.", "required": false, "schema": { "type": "boolean", "default": false }, "example": false } ], "requestBody": { "content": { "application/json": { "schema": { "type": "string" }, "example": "" } }, "required": true, "description": "The multi-factor code as a raw JSON string, for example \"123456\".\n\n- `(body)` (string, required): The code from the user's authenticator or multi-factor provider. If the account uses the built-in Multi-factor Not Required connector, any value is accepted." }, "responses": { "200": { "description": "The body is the session token as a JSON string. If the sign-in session cannot be found (for example, browser cookies are blocked), the status is still 200 but the body is a JSON object with an error message instead of a token.", "content": { "text/plain": { "schema": { "type": "string" } }, "application/json": { "schema": { "type": "string" } } } }, "401": { "description": "The code is not valid or was used recently, two-factor is not enabled for the user, or the multi-factor provider rejected it. The body is a message." } }, "security": [ { "bearerAuth": [] } ] } }, "/signinBody": { "post": { "tags": [ "User Token" ], "summary": "Sign in with a JSON body and get a token", "description": "Checks a user name and password sent as JSON and returns a token. If the user must give a multi-factor code, send the returned token to the sign-in verification route to finish. This route is outside the /api/v1 path.\n\nPermission required: No sign-in required.\n\nCaution: The request carries a password and the response carries a token that grants access as the user; use HTTPS and store the token securely.", "operationId": "UserToken_SigninBody", "requestBody": { "description": "The credentials as a JSON object.\n\n- `login` (string, required): The user name to sign in with. Local user name or DOMAIN\\user.\n- `password` (string, required): The password for the user. Sensitive value.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LoginFormInfoCreateRequest" }, "example": { "login": "", "password": "" } } }, "required": true }, "responses": { "200": { "description": "The body is the token as a JSON string.", "content": { "text/plain": { "schema": { "type": "string" } }, "application/json": { "schema": { "type": "string" } } } }, "400": { "description": "The user is not allowed to sign in with a password, or licensing blocks sign-in. The body is a message." }, "401": { "description": "Credentials are wrong or empty, the database could not be reached, or an unexpected error occurred. The body is a message." } }, "security": [] } } }, "components": { "securitySchemes": { "bearerAuth": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT", "description": "JSON Web Token returned by the sign-in call." } }, "schemas": { "AccessCertRowTable": { "type": "object", "additionalProperties": false, "description": "One row of the access certification review table.", "properties": { "id": { "type": "string", "format": "uuid" }, "taskId": { "type": "string", "format": "uuid" }, "permissions": { "type": "array", "items": { "type": "string" }, "nullable": true }, "status": { "$ref": "#/components/schemas/AccessCertificationTaskRowStatus" }, "userName": { "type": "string", "nullable": true }, "userId": { "type": "string", "format": "uuid" }, "activityName": { "type": "string", "nullable": true }, "activityId": { "type": "string", "format": "uuid" }, "resourceName": { "type": "string", "nullable": true }, "resourceId": { "type": "string", "format": "uuid", "nullable": true }, "accessPolicyId": { "type": "string", "format": "uuid" }, "accessPolicyName": { "type": "string", "nullable": true }, "credentialId": { "type": "string", "format": "uuid", "nullable": true }, "credentialName": { "type": "string", "nullable": true }, "connectionProfile": { "type": "string", "nullable": true }, "lastAccessedDateTimeUtc": { "type": "string", "format": "date-time" } } }, "AccessCertUserTable": { "type": "object", "additionalProperties": false, "description": "One user row of an access certification task.", "properties": { "id": { "type": "string", "format": "uuid" }, "taskId": { "type": "string", "format": "uuid" }, "userId": { "type": "string", "format": "uuid" }, "userName": { "type": "string", "nullable": true }, "userEmail": { "type": "string", "nullable": true }, "groupName": { "type": "string", "nullable": true }, "samAccountName": { "type": "string", "nullable": true }, "type": { "$ref": "#/components/schemas/AccountType" } } }, "AccessCertificationDenial": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "accessPolicyId": { "type": "string", "format": "uuid" }, "managedUserId": { "type": "string", "description": "Managed account ID representing the user who is denied access", "format": "uuid" }, "resourceId": { "type": "string", "format": "uuid", "nullable": true }, "activityId": { "type": "string", "format": "uuid" }, "credentialId": { "type": "string", "format": "uuid", "nullable": true }, "denyingTaskId": { "type": "string", "format": "uuid" }, "status": { "$ref": "#/components/schemas/AccessCertificationTaskRowStatus" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "denyingTaskName": { "type": "string", "nullable": true }, "resourceName": { "type": "string", "nullable": true }, "credentialName": { "type": "string", "nullable": true }, "activityName": { "type": "string", "nullable": true } }, "additionalProperties": false }, "AccessCertificationTaskCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "reviewerId": { "type": "string", "format": "uuid" }, "status": { "$ref": "#/components/schemas/AccessCertificationTaskStatus" }, "startDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "scheduledStartDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "userIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "groupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "Request data structure for Access Certification Task. Not stored.", "required": [ "name", "reviewerId" ] }, "AccessCertificationTaskRequestResponse": { "type": "object", "additionalProperties": false, "description": "An access certification task: its summary and the detail of each activity row.", "properties": { "summary": { "$ref": "#/components/schemas/AccessCertificationTaskSummary" }, "activitiesDetail": { "type": "array", "nullable": true, "items": { "$ref": "#/components/schemas/AccessCertificationTaskRowDetail" } } } }, "AccessCertificationTaskRowDetail": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "userName": { "type": "string", "nullable": true }, "status": { "$ref": "#/components/schemas/AccessCertificationTaskRowStatus" }, "accessControlPolicy": { "type": "string", "nullable": true }, "resource": { "type": "string", "nullable": true }, "credential": { "type": "string", "nullable": true }, "activity": { "type": "string", "nullable": true }, "groupName": { "type": "string", "nullable": true }, "permissions": { "type": "array", "items": { "type": "string" }, "nullable": true }, "lastAccessedDateTimeUtc": { "type": "string", "format": "date-time" }, "connectionProfile": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "userId": { "type": "string", "format": "uuid" }, "accessPolicyId": { "type": "string", "format": "uuid" }, "resourceId": { "type": "string", "format": "uuid", "nullable": true }, "credentialId": { "type": "string", "format": "uuid", "nullable": true }, "activityId": { "type": "string", "format": "uuid" } }, "additionalProperties": false, "description": "Access Certification task row details. Not stored." }, "AccessCertificationTaskRowReview": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "status": { "$ref": "#/components/schemas/AccessCertificationTaskRowStatus" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "Access Certification task row review status. Not stored." }, "AccessCertificationTaskRowStatus": { "enum": [ 0, 1, 2, 3 ], "type": "integer", "description": "Integer values: 0 = NotSet, 1 = Requested, 2 = Approved, 3 = Denied.", "format": "int32", "x-enum-varnames": [ "NotSet", "Requested", "Approved", "Denied" ] }, "AccessCertificationTaskRowSummary": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "userName": { "type": "string", "nullable": true }, "status": { "$ref": "#/components/schemas/AccessCertificationTaskRowStatus" }, "accessControlPolicy": { "type": "string", "nullable": true }, "resource": { "type": "string", "nullable": true }, "credential": { "type": "string", "nullable": true }, "activity": { "type": "string", "nullable": true }, "groupName": { "type": "string", "nullable": true }, "permissions": { "type": "array", "items": { "type": "string" }, "nullable": true }, "lastAccessedDateTimeUtc": { "type": "string", "format": "date-time" }, "connectionProfile": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "Summary data structure for Access Certification Task rows. Not stored." }, "AccessCertificationTaskRowUpdateRequest": { "type": "object", "properties": { "taskId": { "type": "string", "format": "uuid" }, "rows": { "type": "array", "items": { "$ref": "#/components/schemas/AccessCertificationTaskRowDetail" } } }, "additionalProperties": false, "description": "Access Certification Task row request structure. Not stored.", "required": [ "taskId", "rows" ] }, "AccessCertificationTaskStatus": { "enum": [ 0, 1, 2, 3 ], "type": "integer", "description": "Integer values: 0 = Setup, 1 = ReadyToStart, 2 = Incomplete, 3 = Complete.", "format": "int32", "x-enum-varnames": [ "Setup", "ReadyToStart", "Incomplete", "Complete" ] }, "AccessCertificationTaskSummary": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "reviewer": { "type": "string", "nullable": true }, "reviewerId": { "type": "string", "format": "uuid" }, "status": { "$ref": "#/components/schemas/AccessCertificationTaskStatus" }, "startDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "scheduledStartDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "completedDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "activitiesSummary": { "type": "array", "items": { "$ref": "#/components/schemas/AccessCertificationTaskRowSummary" }, "nullable": true }, "selectedUserIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "selectedUserGroupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "Summary data structure for Access Certification tasks. Not stored." }, "AccessCertificationTaskUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "reviewerId": { "type": "string", "format": "uuid" }, "status": { "$ref": "#/components/schemas/AccessCertificationTaskStatus" }, "startDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "scheduledStartDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "userIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "groupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "Request data structure for Access Certification Task. Not stored.", "required": [ "id", "name", "reviewerId" ] }, "AccessControlPolicy": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this item.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this policy.", "nullable": true }, "description": { "type": "string", "description": "Human readable description of this policy.", "nullable": true }, "activityConfigurationId": { "type": "string", "description": "Id of configuration collection for this policy.", "format": "uuid", "nullable": true }, "activityConfiguration": { "$ref": "#/components/schemas/ActivityConfiguration" }, "priority": { "type": "integer", "description": "Priority of this policy relative to other matching policies. Note: 0 is the lowest priority.", "format": "int32" }, "isDisabled": { "type": "boolean", "description": "True if this policy has been disabled." }, "isDeleted": { "type": "boolean", "description": "True if this policy has been deleted." }, "isDefault": { "type": "boolean" }, "isUserModified": { "type": "boolean" }, "managedAccountPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountPolicyJoin" }, "description": "Managed account(s) referenced by this policy.", "nullable": true }, "managedAccountGroupPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountGroupPolicyJoin" }, "description": "Managed account group(s) referenced by this policy.", "nullable": true }, "managedResourcePolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourcePolicyJoin" }, "description": "Managed resource(s) referenced by this policy.", "nullable": true }, "managedResourceGroupPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceGroupPolicyJoin" }, "description": "Managed resource group(s) referenced by this policy.", "nullable": true }, "activityJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityJoin" }, "description": "Activities referenced by this policy.", "nullable": true }, "activityGroupJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityGroupJoin" }, "description": "Activity groups referenced by this policy.", "nullable": true }, "credentialPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialPolicyJoin" }, "description": "Credentials referenced by this policy.", "nullable": true }, "credentialGroupPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialGroupPolicyJoin" }, "description": "Credential Groups referenced by this policy.", "nullable": true }, "userAndGroupCollectionPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/UserAndGroupCollectionPolicyJoin" }, "description": "User and Group Collections referenced by this policy.", "nullable": true }, "policyType": { "$ref": "#/components/schemas/PolicyType" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A policy that can be applied to an elevation session. Policies are matched to a group, user and host and sorted by priority to determine which policy applies." }, "AccessControlPolicyDetails": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "connectionProfileName": { "type": "string", "nullable": true }, "policyType": { "$ref": "#/components/schemas/PolicyType" }, "policyTypeName": { "type": "string", "nullable": true } }, "additionalProperties": false }, "AccessPolicyObject": { "type": "object", "properties": { "id": { "type": "string", "description": "Managed Resource or Credential Id", "format": "uuid" }, "policyType": { "$ref": "#/components/schemas/PolicyType" }, "activityPolicies": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityPolicy" }, "nullable": true }, "name": { "type": "string", "description": "Name to display - flattened from resource/credential", "nullable": true }, "os": { "type": "string", "description": "Resource OS or the Credential resource", "nullable": true }, "platform": { "type": "string", "description": "Platform - flattened from resource/credential", "nullable": true } }, "additionalProperties": false, "description": "Populates the activity session wizard's resource list for users to choose from" }, "AccountReference": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "entityType": { "$ref": "#/components/schemas/ManagedAccountKind" } }, "additionalProperties": false }, "AccountType": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "User", "Application", "Local" ], "description": "Integer values: 0 = User, 1 = Application, 2 = Local." }, "Action": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this action.", "format": "uuid" }, "actionTemplateId": { "type": "string", "description": "Id of template for this action.", "format": "uuid" }, "actionTemplate": { "$ref": "#/components/schemas/ActionTemplate" }, "actionGroupId": { "type": "string", "description": "Id for action group that this action belongs to.", "format": "uuid" }, "actionGroup": { "$ref": "#/components/schemas/ActionGroup" }, "actionParameter": { "type": "array", "items": { "$ref": "#/components/schemas/ActionParameter" }, "description": "Parameters associated with this action.", "nullable": true }, "continueOnFail": { "type": "boolean", "description": "If true then next action in action group will be executed even if this action fails." }, "executionOrder": { "type": "integer", "description": "This determines the order of execution of the actions in this action group. Lowest value first.", "format": "int32" }, "executionPath": { "type": "string", "nullable": true }, "timeout": { "type": "integer", "description": "This defines a timeout for the action, in seconds, after which it will be failed if it hasn't completed.", "format": "int32", "nullable": true }, "displayName": { "type": "string", "description": "Human readable description of this action.", "nullable": true }, "actionQueueAction": { "type": "array", "items": { "$ref": "#/components/schemas/ActionQueueAction" }, "description": "Current action queues which refer to this action, if any.", "nullable": true }, "createdBy": { "type": "string", "description": "Logged in user id.", "format": "uuid", "nullable": true }, "createdDateTimeUtc": { "type": "string", "description": "When this action was created.", "format": "date-time" }, "lastModifiedBy": { "type": "string", "description": "Logged in user id.", "format": "uuid", "nullable": true }, "modifiedDateTimeUtc": { "type": "string", "description": "When this action was last modified.", "format": "date-time" }, "nodeId": { "type": "string", "format": "uuid" }, "classification": { "$ref": "#/components/schemas/ActionClassification" }, "pairedActionId": { "type": "string", "description": "Reference to another action representing the end to this start or start to this end action", "format": "uuid", "nullable": true }, "pairedAction": { "$ref": "#/components/schemas/Action" }, "isDeleted": { "type": "boolean" }, "isDefault": { "type": "boolean" }, "isUserModified": { "type": "boolean" } }, "additionalProperties": false, "description": "An action in an action group." }, "ActionClassification": { "enum": [ 0, 1, 2, 3, 4 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "PreSession", "Session", "PostSession", "Internal", "Any" ], "description": "Integer values: 0 = PreSession, 1 = Session, 2 = PostSession, 3 = Internal, 4 = Any." }, "ActionCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this action.", "format": "uuid" }, "actionTemplateId": { "type": "string", "description": "Id of template for this action.", "format": "uuid" }, "actionTemplate": { "$ref": "#/components/schemas/ActionTemplate" }, "actionGroupId": { "type": "string", "description": "Id for action group that this action belongs to.", "format": "uuid" }, "actionGroup": { "$ref": "#/components/schemas/ActionGroup" }, "actionParameter": { "type": "array", "items": { "$ref": "#/components/schemas/ActionParameter" }, "description": "Parameters associated with this action.", "nullable": true }, "continueOnFail": { "type": "boolean", "description": "If true then next action in action group will be executed even if this action fails." }, "executionOrder": { "type": "integer", "description": "This determines the order of execution of the actions in this action group. Lowest value first.", "format": "int32" }, "executionPath": { "type": "string", "nullable": true }, "timeout": { "type": "integer", "description": "This defines a timeout for the action, in seconds, after which it will be failed if it hasn't completed.", "format": "int32", "nullable": true }, "displayName": { "type": "string", "description": "Human readable description of this action.", "nullable": true }, "actionQueueAction": { "type": "array", "items": { "$ref": "#/components/schemas/ActionQueueAction" }, "description": "Current action queues which refer to this action, if any.", "nullable": true }, "createdBy": { "type": "string", "description": "Logged in user id.", "format": "uuid", "nullable": true, "readOnly": true }, "createdDateTimeUtc": { "type": "string", "description": "When this action was created.", "format": "date-time", "readOnly": true }, "lastModifiedBy": { "type": "string", "description": "Logged in user id.", "format": "uuid", "nullable": true, "readOnly": true }, "modifiedDateTimeUtc": { "type": "string", "description": "When this action was last modified.", "format": "date-time", "readOnly": true }, "nodeId": { "type": "string", "format": "uuid" }, "classification": { "$ref": "#/components/schemas/ActionClassification" }, "pairedActionId": { "type": "string", "description": "Reference to another action representing the end to this start or start to this end action", "format": "uuid", "nullable": true }, "pairedAction": { "$ref": "#/components/schemas/Action" }, "isDeleted": { "type": "boolean" }, "isDefault": { "type": "boolean" }, "isUserModified": { "type": "boolean" } }, "additionalProperties": false, "description": "An action in an action group.", "required": [ "actionGroupId", "actionTemplateId" ] }, "ActionFailureReason": { "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "NoError", "UnknownError", "SystemError", "ActionServiceUnavailable", "ActionTimeout", "AccessDenied", "UserAlreadyMemberofGroup", "UserNotMemberofGroup", "InvalidGroupName", "InvalidUserName", "InvalidHostName", "FailedToConnect" ], "description": "Integer values: 0 = NoError, 1 = UnknownError, 2 = SystemError, 3 = ActionServiceUnavailable, 4 = ActionTimeout, 5 = AccessDenied, 6 = UserAlreadyMemberofGroup, 7 = UserNotMemberofGroup, 8 = InvalidGroupName, 9 = InvalidUserName, 10 = InvalidHostName, 11 = FailedToConnect." }, "ActionGroup": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this action group.", "format": "uuid" }, "name": { "type": "string", "description": "Human readable name for this action group.", "nullable": true }, "description": { "type": "string", "description": "Human readable description for this action group.", "nullable": true }, "trigger": { "type": "boolean", "description": "Reserved. This property is not used in this release." }, "createdBy": { "type": "string", "format": "uuid", "nullable": true }, "createdDateTimeUtc": { "type": "string", "description": "When this action group was created.", "format": "date-time" }, "lastModifiedBy": { "type": "string", "description": "Logged in user id.", "format": "uuid", "nullable": true }, "modifiedDateTimeUtc": { "type": "string", "description": "When this action group was last modified.", "format": "date-time" }, "nodeId": { "type": "string", "format": "uuid" }, "action": { "type": "array", "items": { "$ref": "#/components/schemas/Action" }, "description": "List of actions associated with this action group.", "nullable": true }, "actionGroupJob": { "type": "array", "items": { "$ref": "#/components/schemas/ActionGroupJob" }, "description": "Current action group jobs that refer to this action group, if any.", "nullable": true }, "actionQueue": { "type": "array", "items": { "$ref": "#/components/schemas/ActionQueue" }, "description": "Current action queues which refer to this action group, if any.", "nullable": true } }, "additionalProperties": false, "description": "A group of actions that an action service performs in order, lowest execution order first." }, "ActionGroupJob": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "actionGroupId": { "type": "string", "format": "uuid" }, "jobId": { "type": "string", "format": "uuid" }, "job": { "$ref": "#/components/schemas/Job" }, "actionGroup": { "$ref": "#/components/schemas/ActionGroup" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ActionGroupUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this action group.", "format": "uuid" }, "name": { "type": "string", "description": "Human readable name for this action group.", "nullable": true }, "description": { "type": "string", "description": "Human readable description for this action group.", "nullable": true }, "trigger": { "type": "boolean", "description": "Reserved. This property is not used in this release." }, "createdBy": { "type": "string", "format": "uuid", "nullable": true }, "createdDateTimeUtc": { "type": "string", "description": "When this action group was created.", "format": "date-time" }, "lastModifiedBy": { "type": "string", "description": "Logged in user id.", "format": "uuid", "nullable": true }, "modifiedDateTimeUtc": { "type": "string", "description": "When this action group was last modified.", "format": "date-time" }, "nodeId": { "type": "string", "format": "uuid" }, "action": { "type": "array", "items": { "$ref": "#/components/schemas/Action" }, "description": "List of actions associated with this action group.", "nullable": true }, "actionGroupJob": { "type": "array", "items": { "$ref": "#/components/schemas/ActionGroupJob" }, "description": "Current action group jobs that refer to this action group, if any.", "nullable": true }, "actionQueue": { "type": "array", "items": { "$ref": "#/components/schemas/ActionQueue" }, "description": "Current action queues which refer to this action group, if any.", "nullable": true } }, "additionalProperties": false, "description": "A group of actions that an action service performs in order, lowest execution order first.", "required": [ "id" ] }, "ActionJob": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this action job.", "format": "uuid" }, "startDateTimeUtc": { "type": "string", "description": "Scheduled time for this action. Note: If in the past, it will be excecuted ASAP.", "format": "date-time" }, "recurrenceInterval": { "type": "integer", "description": "Recurrence interval in minutes. Recurrence type of Minutes", "format": "int32" }, "recurrenceType": { "$ref": "#/components/schemas/RecurrenceType" }, "hour": { "type": "integer", "description": "For recurrence type of daily and weekly, this is the hour of the recurrence. 0-23", "format": "int32" }, "minute": { "type": "integer", "description": "For recurrence type of daily and weekly, this is the minute", "format": "int32" }, "dayOfWeek": { "$ref": "#/components/schemas/DayOfWeek" }, "dayOfMonth": { "type": "integer", "description": "For recurrence type of monthly, 0-31", "format": "int32" }, "recurrenceCount": { "type": "integer", "format": "int32" }, "nextStartTimeUtc": { "type": "string", "description": "Next scheduled start time in UTC", "format": "date-time" }, "actionGroupId": { "type": "string", "description": "Id of action group to execute for this job.", "format": "uuid" }, "actionQueueId": { "type": "string", "description": "Id of action queue to execute for this job.", "format": "uuid", "nullable": true }, "actionQueue": { "$ref": "#/components/schemas/ActionQueue" }, "hostId": { "type": "string", "description": "Id of host related to this job.", "format": "uuid", "nullable": true }, "userId": { "type": "string", "description": "Id of host user related to this job.", "format": "uuid", "nullable": true }, "managedResourceId": { "type": "string", "description": "Id of resource related to this job.", "format": "uuid", "nullable": true }, "domainId": { "type": "string", "description": "Id of domain related to this job.", "format": "uuid", "nullable": true }, "managedObjectId": { "type": "string", "description": "ID of the managed item. The type of the item is in managedObjectType.", "format": "uuid", "nullable": true }, "managedObjectType": { "$ref": "#/components/schemas/ManagedAccountType" }, "type": { "$ref": "#/components/schemas/ActionJobType" }, "name": { "type": "string", "description": "Display name for the action job - shows up in the Schedule page", "nullable": true }, "disabled": { "type": "boolean", "description": "Disable a job from running" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "scheduleChangePolicyId": { "type": "string", "format": "uuid", "nullable": true }, "platformId": { "type": "string", "format": "uuid", "nullable": true }, "isRecurring": { "type": "boolean" }, "isCancelledProtection": { "type": "boolean" } }, "additionalProperties": false, "description": "A job that is scheduled on an action queue." }, "ActionJobSchedule": { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the scheduled action job.", "format": "uuid" }, "name": { "type": "string", "description": "Name of the action group that is associated with the action job.", "nullable": true }, "actionQueueId": { "type": "string", "description": "ID of the action queue that is associated with the action job.", "format": "uuid", "nullable": true }, "recurrenceType": { "$ref": "#/components/schemas/RecurrenceType" }, "hour": { "type": "integer", "format": "int32" }, "minute": { "type": "integer", "format": "int32" }, "dayOfWeek": { "$ref": "#/components/schemas/DayOfWeek" }, "recurrenceCount": { "type": "integer", "format": "int32" }, "disabled": { "type": "boolean" }, "lastRunId": { "type": "string", "format": "uuid", "nullable": true }, "lastRunTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "lastRunStatus": { "$ref": "#/components/schemas/ActionStatus" }, "nextStartTimeUtc": { "type": "string", "format": "date-time" }, "recurrenceInterval": { "type": "integer", "format": "int32" }, "dayOfMonth": { "type": "integer", "format": "int32" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "status": { "$ref": "#/components/schemas/ActionStatus" }, "isRecurring": { "type": "boolean" }, "recurrence": { "type": "string", "nullable": true } }, "additionalProperties": false, "description": "A scheduled action job. It combines the details of the action queue entry and the action job." }, "ActionJobStatistic": { "type": "object", "properties": { "status": { "$ref": "#/components/schemas/ActionStatus" }, "count": { "type": "integer", "format": "int32" }, "reportedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ActionJobType": { "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "None", "Protection", "PasswordRotation", "PasswordVerification", "HostScan", "DomainSync", "DomainSyncTest", "ActivitySession", "RemoteServiceRegistration", "ServiceRotation", "PasswordRollback", "DomainOUMapping", "ResourceConnectionTest", "WinRmHttp", "Report", "Debug", "CommandPlanRun" ], "description": "Integer values: 0 = None, 1 = Protection, 2 = PasswordRotation, 3 = PasswordVerification, 4 = HostScan, 5 = DomainSync, 6 = DomainSyncTest, 7 = ActivitySession, 8 = RemoteServiceRegistration, 9 = ServiceRotation, 10 = PasswordRollback, 11 = DomainOUMapping, 12 = ResourceConnectionTest, 13 = WinRmHttp, 14 = Report, 15 = Debug, 16 = CommandPlanRun." }, "ActionLog": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this action log entry.", "format": "uuid" }, "type": { "$ref": "#/components/schemas/ActionLogType" }, "hResult": { "type": "integer", "description": "Reason the action failed, if available.", "format": "int32" }, "timestamp": { "type": "string", "description": "When this log entry was created.", "format": "date-time" }, "message": { "type": "string", "description": "Human readable message associate with this log entry.", "nullable": true }, "version": { "type": "string", "description": "Current version captured in the log.", "nullable": true }, "actionQueueActionId": { "type": "string", "description": "Id of action queue action associated with this log entry.", "format": "uuid" }, "actionQueueAction": { "$ref": "#/components/schemas/ActionQueueAction" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A log entry for the execution of an action queue action." }, "ActionLogCollection": { "type": "object", "properties": { "lines": { "type": "array", "items": { "$ref": "#/components/schemas/ActionLogLine" }, "nullable": true }, "totalCount": { "type": "integer", "format": "int32" }, "version": { "type": "string", "nullable": true } }, "additionalProperties": false }, "ActionLogLine": { "type": "object", "properties": { "statusString": { "type": "string", "nullable": true }, "status": { "$ref": "#/components/schemas/ActionLogType" }, "logMessage": { "type": "string", "nullable": true }, "lineNumber": { "type": "integer", "format": "int32" }, "timestamp": { "type": "string", "format": "date-time" }, "version": { "type": "string", "nullable": true } }, "additionalProperties": false }, "ActionLogType": { "enum": [ 0, 1, 2, 3 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Debug", "Info", "Warn", "Error" ], "description": "Integer values: 0 = Debug, 1 = Info, 2 = Warn, 3 = Error." }, "ActionPack": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "icon": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "version": { "type": "string", "nullable": true }, "timeoutOverride": { "type": "integer", "format": "int32" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "actionTemplate": { "type": "array", "items": { "$ref": "#/components/schemas/ActionTemplate" }, "nullable": true }, "actionTemplateParameter": { "type": "array", "items": { "$ref": "#/components/schemas/ActionTemplateParameter" }, "nullable": true }, "actionTemplateDemand": { "type": "array", "items": { "$ref": "#/components/schemas/ActionTemplateDemand" }, "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ActionPackUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "icon": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "version": { "type": "string", "nullable": true }, "timeoutOverride": { "type": "integer", "format": "int32" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "actionTemplate": { "type": "array", "items": { "$ref": "#/components/schemas/ActionTemplate" }, "nullable": true }, "actionTemplateParameter": { "type": "array", "items": { "$ref": "#/components/schemas/ActionTemplateParameter" }, "nullable": true }, "actionTemplateDemand": { "type": "array", "items": { "$ref": "#/components/schemas/ActionTemplateDemand" }, "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "id" ] }, "ActionParameter": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this parameter.", "format": "uuid" }, "value": { "type": "string", "description": "Value for this parameter.", "nullable": true }, "actionTemplateParameterId": { "type": "string", "description": "Id of action template associated with this parameter.", "format": "uuid" }, "actionTemplateParameter": { "$ref": "#/components/schemas/ActionTemplateParameter" }, "actionId": { "type": "string", "description": "Id of action associated with this parameter.", "format": "uuid" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A parameter with a fixed value for an action." }, "ActionParameterType": { "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "PowerShell", "Integer", "DateTime", "Credential", "SecureString", "String", "KeyValue", "Guid", "HostId", "UserId", "ManagedResourceId", "ManagedAccountId", "UserCredential", "DomainId", "SessionId", "DomainCredential", "DomainConfigurationId", "Boolean", "ReportId" ], "description": "Integer values: 0 = PowerShell, 1 = Integer, 2 = DateTime, 3 = Credential, 4 = SecureString, 5 = String, 6 = KeyValue, 7 = Guid, 8 = HostId, 9 = UserId, 10 = ManagedResourceId, 11 = ManagedAccountId, 12 = UserCredential, 13 = DomainId, 14 = SessionId, 15 = DomainCredential, 16 = DomainConfigurationId, 17 = Boolean, 18 = ReportId." }, "ActionQueue": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this action queue.", "format": "uuid" }, "actionJobId": { "type": "string", "description": "Action Job that created this ActionQueue", "format": "uuid", "nullable": true }, "runUserId": { "type": "string", "description": "Id associated with the logged in user which created this action queue.", "format": "uuid", "nullable": true }, "timeCreated": { "type": "string", "description": "When this action queue was created.", "format": "date-time" }, "timeStarted": { "type": "string", "description": "When this action queue started execution.", "format": "date-time" }, "timeFinished": { "type": "string", "description": "When this action queue finished execution.", "format": "date-time" }, "heartBeatDateTimeUtc": { "type": "string", "description": "Date and time in UTC of the last update to the queue. It changes when an action in the queue is updated.", "format": "date-time" }, "status": { "$ref": "#/components/schemas/ActionStatus" }, "statusDescription": { "type": "string", "description": "Human readable description of the action queue status.", "nullable": true }, "failureReason": { "$ref": "#/components/schemas/ActionFailureReason" }, "actionGroupId": { "type": "string", "description": "Id of action group associated with this action queue.", "format": "uuid" }, "actionGroup": { "$ref": "#/components/schemas/ActionGroup" }, "actionQueueAction": { "type": "array", "items": { "$ref": "#/components/schemas/ActionQueueAction" }, "description": "List of action queue action associate with this action queue.", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "managedResourceId": { "type": "string", "description": "Id associated with the target resource for this action queue.", "format": "uuid", "nullable": true } }, "additionalProperties": false, "description": "A queue of the actions in an action group, which can be scheduled for execution. The queue is ordered by the execution order of each action, lowest first." }, "ActionQueueAction": { "required": [ "jobType" ], "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this action.", "format": "uuid" }, "actionQueueId": { "type": "string", "description": "Id of action queue which contains this action.", "format": "uuid" }, "actionQueue": { "$ref": "#/components/schemas/ActionQueue" }, "actionId": { "type": "string", "description": "Id of action group action which was used to create this action queue action.", "format": "uuid" }, "action": { "$ref": "#/components/schemas/Action" }, "status": { "$ref": "#/components/schemas/ActionStatus" }, "jobType": { "$ref": "#/components/schemas/ActionJobType" }, "statusDescription": { "type": "string", "description": "Human readable description of the action status.", "nullable": true }, "result": { "type": "string", "description": "Json result.", "nullable": true }, "results": { "type": "string", "description": "Json results from previous steps.", "nullable": true }, "actionQueueActionParameter": { "type": "array", "items": { "$ref": "#/components/schemas/ActionQueueActionParameter" }, "description": "Dynamic parameters associated with this action. Note: These may override the static parameters saved with the action group action.", "nullable": true }, "actionLog": { "type": "array", "items": { "$ref": "#/components/schemas/ActionLog" }, "description": "Log entries associated with the execution of this action queue action.", "nullable": true }, "actionServiceId": { "type": "string", "description": "Id of action service which was selected to execute this action.", "format": "uuid", "nullable": true }, "registeredService": { "$ref": "#/components/schemas/RegisteredService" }, "startTime": { "type": "string", "description": "When the job started", "format": "date-time" }, "endTime": { "type": "string", "description": "When the job finished", "format": "date-time" }, "nodeId": { "type": "string", "description": "The action service node id", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "description": "When the job was created", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "description": "When the job was modified", "format": "date-time" }, "heartbeatUtc": { "type": "string", "description": "Date and time in UTC of the last update from the running action. Privilege Secure uses it to detect an action job that has stalled.", "format": "date-time" }, "complete": { "type": "boolean", "description": "Complete is set true when the action step has completed successfully or continue on failure" }, "managedResourceGroup": { "$ref": "#/components/schemas/ManagedResourceGroup" }, "managedResourceGroupId": { "type": "string", "description": "Managed Resource Group ID for affinity", "format": "uuid", "nullable": true }, "winRmHttpSetting": { "$ref": "#/components/schemas/WinRmHttpSettings" } }, "additionalProperties": false, "description": "An action in an action queue that an action service can run." }, "ActionQueueActionInfoView": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "actionName": { "type": "string", "nullable": true }, "actionId": { "type": "string", "format": "uuid", "nullable": true }, "actionQueueId": { "type": "string", "format": "uuid", "nullable": true }, "actionJobId": { "type": "string", "format": "uuid", "nullable": true }, "actionServiceId": { "type": "string", "format": "uuid", "nullable": true }, "startTimeUtc": { "type": "string", "format": "date-time" }, "endTimeUtc": { "type": "string", "format": "date-time" }, "status": { "$ref": "#/components/schemas/ActionStatus" }, "statusDescription": { "type": "string", "nullable": true }, "platformId": { "type": "string", "format": "uuid", "nullable": true }, "hostId": { "type": "string", "format": "uuid", "nullable": true }, "hostName": { "type": "string", "nullable": true }, "hostUserId": { "type": "string", "format": "uuid", "nullable": true }, "hostUserName": { "type": "string", "nullable": true }, "managedObjectId": { "type": "string", "format": "uuid", "nullable": true }, "managedObjectType": { "$ref": "#/components/schemas/ManagedAccountType" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "jobType": { "$ref": "#/components/schemas/ActionJobType" } }, "additionalProperties": false }, "ActionQueueActionParameter": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this parameter.", "format": "uuid" }, "value": { "type": "string", "description": "Value for this parameter.", "nullable": true }, "actionTemplateParameterId": { "type": "string", "description": "Id of action template associated with this parameter.", "format": "uuid" }, "actionTemplateParameter": { "$ref": "#/components/schemas/ActionTemplateParameter" }, "actionId": { "type": "string", "description": "Id of action associated with this parameter.", "format": "uuid" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "actionQueueActionId": { "type": "string", "description": "Id of action queue action to which this parameter belongs.", "format": "uuid" }, "actionQueueAction": { "$ref": "#/components/schemas/ActionQueueAction" } }, "additionalProperties": false, "description": "A parameter that is added to an action queue action at run time and then applied to the action in the action service." }, "ActionQueueActionStatus": { "type": "object", "additionalProperties": false, "description": "The status of one step of an action queue.", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "status": { "$ref": "#/components/schemas/ActionStatus" }, "statusDescription": { "type": "string", "nullable": true }, "startTime": { "type": "string", "format": "date-time" } } }, "ActionQueueSearchResult": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "actionGroupId": { "type": "string", "format": "uuid" }, "heartBeatDateTimeUtc": { "type": "string", "format": "date-time" }, "startTimeUtc": { "type": "string", "format": "date-time" }, "endTimeUtc": { "type": "string", "format": "date-time" }, "status": { "$ref": "#/components/schemas/ActionStatus" }, "statusDescription": { "type": "string", "nullable": true }, "actionJobId": { "type": "string", "format": "uuid", "nullable": true }, "jobName": { "type": "string", "nullable": true }, "nextStartDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "recurrenceType": { "$ref": "#/components/schemas/RecurrenceType" }, "recurrenceTypeString": { "type": "string", "nullable": true }, "jobType": { "$ref": "#/components/schemas/ActionJobType" }, "jobTypeString": { "type": "string", "nullable": true }, "activitySessionId": { "type": "string", "format": "uuid", "nullable": true }, "activityName": { "type": "string", "nullable": true }, "activitySessionStatus": { "$ref": "#/components/schemas/SessionStatus" }, "hostId": { "type": "string", "format": "uuid", "nullable": true }, "dnsHostName": { "type": "string", "nullable": true }, "userId": { "type": "string", "format": "uuid", "nullable": true }, "samAccountname": { "type": "string", "nullable": true }, "managedResourceId": { "type": "string", "format": "uuid", "nullable": true }, "managedResourceName": { "type": "string", "nullable": true }, "manageAccountId": { "type": "string", "format": "uuid", "nullable": true }, "managedAccountName": { "type": "string", "nullable": true }, "actionGroupName": { "type": "string", "nullable": true } }, "additionalProperties": false }, "ActionQueueStatus": { "type": "object", "additionalProperties": false, "description": "The status of one action queue and of each of its steps.", "properties": { "id": { "type": "string", "format": "uuid" }, "statusDescription": { "type": "string", "nullable": true }, "status": { "$ref": "#/components/schemas/ActionStatus" }, "startTime": { "type": "string", "format": "date-time" }, "actionQueueActionStatus": { "type": "array", "nullable": true, "items": { "$ref": "#/components/schemas/ActionQueueActionStatus" } } } }, "ActionQueueStatusFilter": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "All", "QueuedItems", "ExcludeQueuedItems" ], "description": "Integer values: 0 = All, 1 = QueuedItems, 2 = ExcludeQueuedItems." }, "ActionServiceDemandType": { "enum": [ 0, 1 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Equals", "Contains" ], "description": "Integer values: 0 = Equals, 1 = Contains." }, "ActionServiceProperty": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this property.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this property.", "nullable": true }, "value": { "type": "string", "description": "Value of this property.", "nullable": true }, "actionServiceId": { "type": "string", "description": "Id of action service which owns this property.", "format": "uuid" }, "registeredService": { "$ref": "#/components/schemas/RegisteredService" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A property of an action service." }, "ActionStatus": { "enum": [ -4, -3, -2, -1, 0, 1, 2, 3, 4, 5, 6 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Paused", "Scheduled", "Unknown", "Pending", "Queued", "Running", "Complete", "Failed", "Cancelled", "CompletedWithErrors", "CompletedNotRun" ], "description": "Integer values: -4 = Paused, -3 = Scheduled, -2 = Unknown, -1 = Pending, 0 = Queued, 1 = Running, 2 = Complete, 3 = Failed, 4 = Cancelled, 5 = CompletedWithErrors, 6 = CompletedNotRun." }, "ActionTemplate": { "type": "object", "properties": { "createdBy": { "type": "string", "format": "uuid", "nullable": true }, "lastModifiedBy": { "type": "string", "format": "uuid", "nullable": true }, "id": { "type": "string", "description": "Unique ID of this template.", "format": "uuid" }, "displayName": { "type": "string", "description": "Name for this template.", "nullable": true }, "description": { "type": "string", "description": "Human readable description of this template.", "nullable": true }, "newActionDisplayName": { "type": "string", "description": "Optional alternative to the display name, used to fill in the display names of new actions. This is also a template. It can include bracketed parameter names to insert parameter values (e.g., \"Add User to '{GroupToUpdate}' Group\").", "nullable": true }, "icon": { "type": "string", "description": "Icon for this template.", "nullable": true }, "definition": { "type": "string", "description": "Human readable definition of this template.", "nullable": true }, "userDefined": { "type": "boolean", "description": "True if a user created the template." }, "actionTemplateParameter": { "type": "array", "items": { "$ref": "#/components/schemas/ActionTemplateParameter" }, "description": "List of parameters defined for this template.", "nullable": true }, "action": { "type": "array", "items": { "$ref": "#/components/schemas/Action" }, "description": "List of actions derived from this template.", "nullable": true }, "actionTemplateDemand": { "type": "array", "items": { "$ref": "#/components/schemas/ActionTemplateDemand" }, "description": "List of action template demands derived from this template.", "nullable": true }, "actionPackId": { "type": "string", "description": "Id of action pack which contains this template", "format": "uuid", "nullable": true }, "actionPack": { "$ref": "#/components/schemas/ActionPack" }, "classification": { "$ref": "#/components/schemas/ActionClassification" }, "pairedActionTemplateId": { "type": "string", "description": "Reference to another template representing the end to this start or start to this end action", "format": "uuid", "nullable": true }, "pairedActionTemplate": { "$ref": "#/components/schemas/ActionTemplate" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "An action template that is associated with an action group action." }, "ActionTemplateDemand": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this demand template.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this demand template.", "nullable": true }, "value": { "type": "string", "description": "Value of this demand template.", "nullable": true }, "type": { "$ref": "#/components/schemas/ActionServiceDemandType" }, "actionTemplateId": { "type": "string", "description": "Id of action template used to associate an action with this demand template.", "format": "uuid" }, "actionTemplate": { "$ref": "#/components/schemas/ActionTemplate" }, "actionPackId": { "type": "string", "format": "uuid", "nullable": true }, "actionPack": { "$ref": "#/components/schemas/ActionPack" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A demand template that is used to find an action service that can process a type of action. Privilege Secure looks up the demand template by the template ID of the action and then matches the name and value of the demand template against the properties of the registered action services." }, "ActionTemplateParameter": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this parameter.", "format": "uuid" }, "name": { "type": "string", "description": "Name for this parameter.", "nullable": true }, "displayName": { "type": "string", "description": "Long name for this parameter.", "nullable": true }, "description": { "type": "string", "description": "Human readable description for this parameter.", "nullable": true }, "sortOrder": { "type": "integer", "description": "The order these will appear in lists and reports", "format": "int32" }, "required": { "type": "boolean", "description": "True if parameter is required." }, "type": { "$ref": "#/components/schemas/ActionParameterType" }, "multiline": { "type": "boolean", "description": "True if the console shows the field on several lines." }, "defaultValue": { "type": "string", "description": "Default value.", "nullable": true }, "shouldSerialize_ValueSet": { "type": "boolean", "description": "Not used.", "readOnly": true }, "_ValueSet": { "type": "string", "nullable": true }, "valueSet": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Allowed values (if restricted)." }, "limitToValueSet": { "type": "boolean", "description": "If true (the default) and a value set is given, the user can only choose a value from that list." }, "helperText": { "type": "string", "nullable": true }, "actionTemplateId": { "type": "string", "description": "Id of action template which contains this parameter.", "format": "uuid", "nullable": true }, "actionPackId": { "type": "string", "format": "uuid", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A template for a parameter of an action in an action group." }, "ActionTemplateUpdateRequest": { "type": "object", "properties": { "createdBy": { "type": "string", "format": "uuid", "nullable": true }, "lastModifiedBy": { "type": "string", "format": "uuid", "nullable": true }, "id": { "type": "string", "description": "Unique ID of this template.", "format": "uuid" }, "displayName": { "type": "string", "description": "Name for this template." }, "description": { "type": "string", "description": "Human readable description of this template.", "nullable": true }, "newActionDisplayName": { "type": "string", "description": "Optional alternative to the display name, used to fill in the display names of new actions. This is also a template. It can include bracketed parameter names to insert parameter values (e.g., \"Add User to '{GroupToUpdate}' Group\").", "nullable": true }, "icon": { "type": "string", "description": "Icon for this template.", "nullable": true }, "definition": { "type": "string", "description": "Human readable definition of this template.", "nullable": true }, "userDefined": { "type": "boolean", "description": "True if a user created the template." }, "actionTemplateParameter": { "type": "array", "items": { "$ref": "#/components/schemas/ActionTemplateParameter" }, "description": "List of parameters defined for this template.", "nullable": true }, "action": { "type": "array", "items": { "$ref": "#/components/schemas/Action" }, "description": "List of actions derived from this template.", "nullable": true }, "actionTemplateDemand": { "type": "array", "items": { "$ref": "#/components/schemas/ActionTemplateDemand" }, "description": "List of action template demands derived from this template.", "nullable": true }, "actionPackId": { "type": "string", "description": "Id of action pack which contains this template", "format": "uuid", "nullable": true }, "actionPack": { "$ref": "#/components/schemas/ActionPack" }, "classification": { "$ref": "#/components/schemas/ActionClassification" }, "pairedActionTemplateId": { "type": "string", "description": "Reference to another template representing the end to this start or start to this end action", "format": "uuid", "nullable": true }, "pairedActionTemplate": { "$ref": "#/components/schemas/ActionTemplate" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "An action template that is associated with an action group action.", "required": [ "id", "displayName" ] }, "ActionUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this action.", "format": "uuid" }, "actionTemplateId": { "type": "string", "description": "Id of template for this action.", "format": "uuid" }, "actionTemplate": { "$ref": "#/components/schemas/ActionTemplate" }, "actionGroupId": { "type": "string", "description": "Id for action group that this action belongs to.", "format": "uuid" }, "actionGroup": { "$ref": "#/components/schemas/ActionGroup" }, "actionParameter": { "type": "array", "items": { "$ref": "#/components/schemas/ActionParameter" }, "description": "Parameters associated with this action.", "nullable": true }, "continueOnFail": { "type": "boolean", "description": "If true then next action in action group will be executed even if this action fails." }, "executionOrder": { "type": "integer", "description": "This determines the order of execution of the actions in this action group. Lowest value first.", "format": "int32" }, "executionPath": { "type": "string", "nullable": true }, "timeout": { "type": "integer", "description": "This defines a timeout for the action, in seconds, after which it will be failed if it hasn't completed.", "format": "int32", "nullable": true }, "displayName": { "type": "string", "description": "Human readable description of this action.", "nullable": true }, "actionQueueAction": { "type": "array", "items": { "$ref": "#/components/schemas/ActionQueueAction" }, "description": "Current action queues which refer to this action, if any.", "nullable": true }, "createdBy": { "type": "string", "description": "Logged in user id.", "format": "uuid", "nullable": true }, "createdDateTimeUtc": { "type": "string", "description": "When this action was created.", "format": "date-time" }, "lastModifiedBy": { "type": "string", "description": "Logged in user id.", "format": "uuid", "nullable": true }, "modifiedDateTimeUtc": { "type": "string", "description": "When this action was last modified.", "format": "date-time" }, "nodeId": { "type": "string", "format": "uuid" }, "classification": { "$ref": "#/components/schemas/ActionClassification" }, "pairedActionId": { "type": "string", "description": "Reference to another action representing the end to this start or start to this end action", "format": "uuid", "nullable": true }, "pairedAction": { "$ref": "#/components/schemas/Action" }, "isDeleted": { "type": "boolean" }, "isDefault": { "type": "boolean" }, "isUserModified": { "type": "boolean" } }, "additionalProperties": false, "description": "An action in an action group.", "required": [ "id", "actionGroupId", "actionTemplateId" ] }, "ActiveDirectoryDC": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "activeDirectoryDomain": { "$ref": "#/components/schemas/ActiveDirectoryDomain" }, "activeDirectoryDomainConfigurationId": { "type": "string", "format": "uuid" }, "activeDirectoryDomainConfiguration": { "$ref": "#/components/schemas/ActiveDirectoryDomainConfiguration" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ActiveDirectoryDomain": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this domain.", "format": "uuid", "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, "name": { "type": "string", "description": "Name of this domain, for example corp.", "nullable": true, "example": "example" }, "domainName": { "type": "string", "description": "Fully qualified name of this domain", "nullable": true, "example": "example.local" }, "netBiosName": { "type": "string", "nullable": true }, "domainController": { "type": "string", "description": "Name of the domain controller for this domain.", "nullable": true, "example": "example-dc001.example.local" }, "usnChanged": { "type": "integer", "description": "Update sequence number (USN) assigned by the directory for the latest change.", "format": "int64", "nullable": true, "example": 12345 }, "activeDirectoryDomainConfigurationId": { "type": "string", "description": "NPS Id of the active directory domain configuration.", "format": "uuid", "example": "c6d7e8f9-0a1b-4c2d-8e3f-4a5b6c7d8e9f" }, "activeDirectoryDomainConfiguration": { "$ref": "#/components/schemas/ActiveDirectoryDomainConfiguration" }, "functionalLevel": { "type": "string", "description": "Name of this domain controller's functional level", "nullable": true, "example": "Windows Server 2016" }, "activeDirectoryGroup": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectoryGroup" }, "description": "Active Directory Groups within this domain.", "nullable": true }, "objectSid": { "type": "string", "description": "Object SID for the domain controller this record represents", "nullable": true, "example": "S-1-5-21-1111111111-2222222222-3333333333" }, "maxRenewAge": { "type": "integer", "description": "Max renew age. See [Microsoft documentation](https://learn.microsoft.com/en-us/windows/win32/adschema/a-maxrenewage).", "format": "int32", "nullable": true, "example": 7 }, "maxTicketAge": { "type": "integer", "description": "Max ticket age. See [Microsoft documentation](https://learn.microsoft.com/en-us/windows/win32/adschema/a-maxticketage).", "format": "int32", "nullable": true, "example": 10 }, "nodeId": { "type": "string", "description": "Identifier of the server node that stores this record. Do not send it when you create the record.", "format": "uuid", "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" }, "createdDateTimeUtc": { "type": "string", "description": "Date and time in UTC when the record was created.", "format": "date-time", "example": "2024-01-01T05:07:08.555Z" }, "modifiedDateTimeUtc": { "type": "string", "description": "Date and time in UTC when the record was last modified.", "format": "date-time", "example": "2024-01-02T05:07:08.555Z" } }, "additionalProperties": false, "description": "An Active Directory domain." }, "ActiveDirectoryDomainConfiguration": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "activeDirectoryDomain": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectoryDomain" }, "nullable": true, "readOnly": true }, "name": { "type": "string", "nullable": true }, "controllers": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectoryDC" }, "nullable": true, "readOnly": true }, "enabled": { "type": "boolean" }, "credentialId": { "type": "string", "format": "uuid", "nullable": true }, "useSsl": { "type": "boolean" }, "functionalLevel": { "type": "string", "description": "Name of the domain's functional level", "nullable": true }, "syncActionQueueId": { "type": "string", "format": "uuid", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ActiveDirectoryGroup": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "samaccountname": { "type": "string", "nullable": true }, "usnchanged": { "type": "integer", "format": "int64" }, "description": { "type": "string", "nullable": true }, "distinguishedName": { "type": "string", "nullable": true }, "displayName": { "type": "string", "nullable": true }, "email": { "type": "string", "nullable": true }, "added": { "type": "string", "format": "date-time" }, "groupToken": { "type": "string", "format": "byte", "nullable": true }, "activeDirectoryGroupHostUser": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectoryGroupHostUser" }, "nullable": true }, "activeDirectoryGroupGroupGroup": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectoryGroupGroup" }, "nullable": true }, "activeDirectoryGroupGroupMember": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectoryGroupGroup" }, "nullable": true }, "activeDirectoryDomainId": { "type": "string", "format": "uuid" }, "activeDirectoryDomain": { "$ref": "#/components/schemas/ActiveDirectoryDomain" }, "groupTokenId": { "type": "integer", "format": "int32", "nullable": true }, "name": { "type": "string", "nullable": true }, "sid": { "type": "string", "nullable": true }, "hostGroupGroupJoins": { "type": "array", "items": { "$ref": "#/components/schemas/HostGroupGroupJoin" }, "nullable": true }, "deleted": { "type": "boolean", "description": "True if this group has been deleted." }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ActiveDirectoryGroupCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "samaccountname": { "type": "string", "nullable": true }, "usnchanged": { "type": "integer", "format": "int64" }, "description": { "type": "string", "nullable": true }, "distinguishedName": { "type": "string" }, "displayName": { "type": "string", "nullable": true }, "email": { "type": "string", "nullable": true }, "added": { "type": "string", "format": "date-time" }, "groupToken": { "type": "string", "format": "byte", "nullable": true }, "activeDirectoryGroupHostUser": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectoryGroupHostUser" }, "nullable": true }, "activeDirectoryGroupGroupGroup": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectoryGroupGroup" }, "nullable": true }, "activeDirectoryGroupGroupMember": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectoryGroupGroup" }, "nullable": true }, "activeDirectoryDomainId": { "type": "string", "format": "uuid" }, "activeDirectoryDomain": { "$ref": "#/components/schemas/ActiveDirectoryDomain" }, "groupTokenId": { "type": "integer", "format": "int32", "nullable": true }, "name": { "type": "string", "nullable": true }, "sid": { "type": "string", "nullable": true }, "hostGroupGroupJoins": { "type": "array", "items": { "$ref": "#/components/schemas/HostGroupGroupJoin" }, "nullable": true }, "deleted": { "type": "boolean", "description": "True if this group has been deleted." }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "activeDirectoryDomainId", "distinguishedName" ] }, "ActiveDirectoryGroupGroup": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "memberId": { "type": "string", "format": "uuid" }, "group": { "$ref": "#/components/schemas/ActiveDirectoryGroup" }, "member": { "$ref": "#/components/schemas/ActiveDirectoryGroup" }, "groupId": { "type": "string", "format": "uuid" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ActiveDirectoryGroupHostUser": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "groupId": { "type": "string", "format": "uuid" }, "memberId": { "type": "string", "format": "uuid" }, "group": { "$ref": "#/components/schemas/ActiveDirectoryGroup" }, "member": { "$ref": "#/components/schemas/HostUser" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ActiveDirectoryJob": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "jobType": { "type": "string", "nullable": true }, "jobObject": { "type": "string", "nullable": true }, "jobSchedule": { "type": "string", "nullable": true }, "activeDirectoryDomainConfigurationId": { "type": "string", "format": "uuid" }, "activeDirectoryDomainConfiguration": { "$ref": "#/components/schemas/ActiveDirectoryDomainConfiguration" }, "actionGroupId": { "type": "string", "format": "uuid" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ActiveDirectoryNameFormat": { "enum": [ 1, 2, 3, 4, 5, 6, 7 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "DistinguishedName", "NtAccountName", "DisplayName", "ObjectGuid", "CanonicalName", "UserPrincipalName", "ObjectSid" ], "description": "Integer values: 1 = DistinguishedName, 2 = NtAccountName, 3 = DisplayName, 4 = ObjectGuid, 5 = CanonicalName, 6 = UserPrincipalName, 7 = ObjectSid." }, "ActiveDirectorySyncStats": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "domainController": { "type": "string", "nullable": true }, "usersProcessed": { "type": "integer", "format": "int32" }, "groupsProcessed": { "type": "integer", "format": "int32" }, "membersProcessed": { "type": "integer", "format": "int32" }, "computersProcessed": { "type": "integer", "format": "int32" }, "serviceAccountsProcessed": { "type": "integer", "format": "int32" }, "startTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "endTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "errorCount": { "type": "integer", "format": "int32" }, "warningCount": { "type": "integer", "format": "int32" }, "jobSettingsId": { "type": "string", "format": "uuid", "nullable": true }, "jobSettings": { "$ref": "#/components/schemas/AdSyncInput" }, "activeDirectoryDomainId": { "type": "string", "format": "uuid", "nullable": true }, "activeDirectoryDomain": { "$ref": "#/components/schemas/ActiveDirectoryDomain" }, "status": { "$ref": "#/components/schemas/ActiveDirectorySyncStatusType" }, "activeDirectorySyncStatsError": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectorySyncStatsError" }, "nullable": true, "readOnly": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ActiveDirectorySyncStatsError": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "errorTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "errorMessage": { "type": "string", "nullable": true }, "activeDirectorySyncStatsId": { "type": "string", "format": "uuid" }, "activeDirectorySyncStats": { "$ref": "#/components/schemas/ActiveDirectorySyncStats" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ActiveDirectorySyncStatusType": { "enum": [ -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "None", "Created", "Queued", "Failed", "Complete", "Unauthorized", "ProcessingGroups", "ProcessingUsers", "ProcessingGroupMembers", "ProcessingComputers", "ProcessingServiceAccounts", "Cancelled" ], "description": "Integer values: -1 = None, 0 = Created, 1 = Queued, 2 = Failed, 3 = Complete, 4 = Unauthorized, 5 = ProcessingGroups, 6 = ProcessingUsers, 7 = ProcessingGroupMembers, 8 = ProcessingComputers, 9 = ProcessingServiceAccounts, 10 = Cancelled." }, "Activity": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this activity.", "format": "uuid" }, "createdBy": { "type": "string", "description": "Id of user that created this activity.", "format": "uuid", "nullable": true }, "modifiedBy": { "type": "string", "description": "Id of user that modified this activity.", "format": "uuid", "nullable": true }, "name": { "type": "string", "description": "Activity name - i.e. Add to Local Group", "nullable": true }, "description": { "type": "string", "description": "Description of the activity", "nullable": true }, "activityConfigurationId": { "type": "string", "description": "Id of configuration collection for this activity.", "format": "uuid", "nullable": true }, "activityConfiguration": { "$ref": "#/components/schemas/ActivityConfiguration" }, "platformId": { "type": "string", "description": "Id of platform that this activity can be performed on.", "format": "uuid", "nullable": true }, "platform": { "$ref": "#/components/schemas/Platform" }, "startActionGroupId": { "type": "string", "description": "Action Group to run at the start of the activity.", "format": "uuid", "nullable": true }, "duringActionGroupId": { "type": "string", "description": "Optional - Action group to run during the activity", "format": "uuid", "nullable": true }, "endActionGroupId": { "type": "string", "description": "Action group to run at the end of the activity.", "format": "uuid", "nullable": true }, "activityType": { "$ref": "#/components/schemas/ActivityType" }, "loginAccount": { "$ref": "#/components/schemas/ActivityLoginType" }, "loginAccountNameFormat": { "type": "string", "description": "Login account format.", "nullable": true }, "requesterLoginFormat": { "$ref": "#/components/schemas/RequesterLoginFormat" }, "applicationToLaunch": { "type": "string", "description": "Launch proxy from path", "nullable": true }, "preferredRDSHostId": { "type": "string", "description": "Managed resource for Remote Desktop Server(RDS)", "format": "uuid", "nullable": true }, "connectCredentialId": { "type": "string", "description": "Connect Account for RDS impersonation", "format": "uuid", "nullable": true }, "createAccount": { "type": "boolean", "description": "Create local account option for activity" }, "activityGroupActivities": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityGroupActivity" }, "description": "The links between activities and activity groups.", "nullable": true }, "deleteAccount": { "type": "boolean", "description": "For a managed account, delete account when finished when false account will be disabled" }, "vaultId": { "type": "string", "format": "uuid", "nullable": true }, "vaultInfo": { "type": "string", "description": "Vault properties, JSON string and specific to the Vault", "nullable": true }, "logonUrl": { "type": "string", "description": "Url for site login", "nullable": true }, "isDefault": { "type": "boolean" }, "isDeleted": { "type": "boolean" }, "isUserModified": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "latestSessionActualStartUtc": { "type": "string", "description": "The date and time of the most recent activity session for this activity, filtered by various contexts. Optional lookup value, not stored.", "format": "date-time", "nullable": true } }, "additionalProperties": false, "description": "An activity that a user can perform, such as requesting elevated access to a resource." }, "ActivityAndGroupView": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "entityType": { "$ref": "#/components/schemas/ActivityOrGroupKind" } }, "additionalProperties": false }, "ActivityCard": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "activityType": { "$ref": "#/components/schemas/ActivityType" }, "resourceText": { "type": "string", "nullable": true }, "platformId": { "type": "string", "format": "uuid" }, "platformName": { "type": "string", "nullable": true }, "os": { "type": "string", "nullable": true }, "managedAccountId": { "type": "string", "format": "uuid" }, "totalResources": { "type": "integer", "format": "int32" }, "latestSessionActualStartUtc": { "type": "string", "format": "date-time", "nullable": true }, "customField1Name": { "type": "string", "nullable": true }, "customField1Label": { "type": "string", "nullable": true }, "customField1Description": { "type": "string", "nullable": true }, "customField1Length": { "type": "integer", "format": "int32", "nullable": true }, "customField1Options": { "type": "string", "nullable": true }, "customField1CustomFieldDataType": { "$ref": "#/components/schemas/CustomFieldDataType" }, "customField1Required": { "type": "boolean", "nullable": true }, "customField2Name": { "type": "string", "nullable": true }, "customField2Label": { "type": "string", "nullable": true }, "customField2Description": { "type": "string", "nullable": true }, "customField2Length": { "type": "integer", "format": "int32", "nullable": true }, "customField2Options": { "type": "string", "nullable": true }, "customField2CustomFieldDataType": { "$ref": "#/components/schemas/CustomFieldDataType" }, "customField2Required": { "type": "boolean", "nullable": true }, "customField3Name": { "type": "string", "nullable": true }, "customField3Label": { "type": "string", "nullable": true }, "customField3Description": { "type": "string", "nullable": true }, "customField3Length": { "type": "integer", "format": "int32", "nullable": true }, "customField3Options": { "type": "string", "nullable": true }, "customField3CustomFieldDataType": { "$ref": "#/components/schemas/CustomFieldDataType" }, "customField3Required": { "type": "boolean", "nullable": true }, "policyId": { "type": "string", "format": "uuid" }, "policyName": { "type": "string", "nullable": true }, "policyType": { "$ref": "#/components/schemas/PolicyType" }, "notesRequired": { "type": "boolean" }, "ticketRequired": { "type": "boolean" }, "maxSessionLength": { "type": "integer", "format": "int32" }, "hasGroupAssignmentActions": { "type": "boolean", "description": "Indicates if activity has group/role assignment actions" }, "preConfiguredGroupRoleContexts": { "type": "string", "description": "Pre-configured group/role contexts for display, as a comma-separated list. Not stored.", "nullable": true }, "preConfiguredGroupRoleIds": { "type": "string", "description": "Pre-configured group/role IDs for group assignment actions (comma-separated)", "nullable": true }, "preConfiguredGroupRoleNames": { "type": "string", "description": "Pre-configured group/role names for group assignment actions (comma-separated)", "nullable": true }, "preConfiguredGroupRolePlatformNames": { "type": "string", "description": "Pre-configured group/role platform names for display, as a comma-separated list. Not stored.", "nullable": true }, "preConfiguredGroupRoleTypes": { "type": "string", "description": "Pre-configured group/role types for group assignment actions (comma-separated)", "nullable": true } }, "additionalProperties": false }, "ActivityCardType": { "type": "integer", "format": "int32", "enum": [ 0, 1, 2 ], "x-enum-varnames": [ "Resource", "Credential", "FileRelease" ], "description": "Integer values: 0 = Resource, 1 = Credential, 2 = FileRelease." }, "ActivityCardWithPolicies": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "activityType": { "$ref": "#/components/schemas/ActivityType" }, "resourceText": { "type": "string", "nullable": true }, "platformId": { "type": "string", "format": "uuid" }, "platformName": { "type": "string", "nullable": true }, "os": { "type": "string", "nullable": true }, "managedAccountId": { "type": "string", "format": "uuid" }, "totalResources": { "type": "integer", "format": "int32" }, "latestSessionActualStartUtc": { "type": "string", "format": "date-time", "nullable": true }, "customField1Name": { "type": "string", "nullable": true }, "customField1Label": { "type": "string", "nullable": true }, "customField1Description": { "type": "string", "nullable": true }, "customField1Length": { "type": "integer", "format": "int32", "nullable": true }, "customField1Options": { "type": "string", "nullable": true }, "customField1CustomFieldDataType": { "$ref": "#/components/schemas/CustomFieldDataType" }, "customField1Required": { "type": "boolean", "nullable": true }, "customField2Name": { "type": "string", "nullable": true }, "customField2Label": { "type": "string", "nullable": true }, "customField2Description": { "type": "string", "nullable": true }, "customField2Length": { "type": "integer", "format": "int32", "nullable": true }, "customField2Options": { "type": "string", "nullable": true }, "customField2CustomFieldDataType": { "$ref": "#/components/schemas/CustomFieldDataType" }, "customField2Required": { "type": "boolean", "nullable": true }, "customField3Name": { "type": "string", "nullable": true }, "customField3Label": { "type": "string", "nullable": true }, "customField3Description": { "type": "string", "nullable": true }, "customField3Length": { "type": "integer", "format": "int32", "nullable": true }, "customField3Options": { "type": "string", "nullable": true }, "customField3CustomFieldDataType": { "$ref": "#/components/schemas/CustomFieldDataType" }, "customField3Required": { "type": "boolean", "nullable": true }, "policies": { "type": "array", "items": { "$ref": "#/components/schemas/PolicyInfo" }, "nullable": true }, "policyId": { "type": "string", "format": "uuid" }, "policyName": { "type": "string", "nullable": true }, "policyType": { "$ref": "#/components/schemas/PolicyType" }, "hasGroupAssignmentActions": { "type": "boolean", "description": "Indicates if activity has group/role assignment actions" }, "preConfiguredGroupRoleContexts": { "type": "string", "description": "Pre-configured group/role contexts for display, as a comma-separated list. Not stored.", "nullable": true }, "preConfiguredGroupRoleIds": { "type": "string", "description": "Pre-configured group/role IDs for group assignment actions (comma-separated)", "nullable": true }, "preConfiguredGroupRoleNames": { "type": "string", "description": "Pre-configured group/role names for group assignment actions (comma-separated)", "nullable": true }, "preConfiguredGroupRolePlatformNames": { "type": "string", "description": "Pre-configured group/role platform names for display, as a comma-separated list. Not stored.", "nullable": true }, "preConfiguredGroupRoleTypes": { "type": "string", "description": "Pre-configured group/role types for group assignment actions (comma-separated)", "nullable": true }, "activityCardType": { "$ref": "#/components/schemas/ActivityCardType" }, "resourceIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true } }, "additionalProperties": false }, "ActivityConfiguration": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique id for this collection.", "format": "uuid" }, "name": { "type": "string", "description": "Name for this collection of configuration settings.", "nullable": true }, "description": { "type": "string", "description": "Description of the collection.", "nullable": true }, "type": { "$ref": "#/components/schemas/ActivityConfigurationType" }, "createdBy": { "type": "string", "description": "Id of user that created this collection.", "format": "uuid", "nullable": true }, "modifiedBy": { "type": "string", "description": "Id of user that modified this collection.", "format": "uuid", "nullable": true }, "createdDateTimeUtc": { "type": "string", "description": "Creation date time in UTC", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "description": "Modified date time in UTC", "format": "date-time" }, "isDefault": { "type": "boolean" }, "isDeleted": { "type": "boolean" }, "isUserModified": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "activityConfigurationSettings": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityConfigurationSetting" }, "description": "Settings which are part of this collection.", "nullable": true }, "customFields": { "type": "array", "items": { "$ref": "#/components/schemas/CustomField" }, "nullable": true }, "deleteAccount": { "type": "boolean" }, "sessionRetryInterval": { "type": "integer", "format": "int32", "nullable": true }, "approvedWorkflowEmailTemplateId": { "type": "string", "format": "uuid", "nullable": true }, "notifyApproversWorkflowEmailTemplateId": { "type": "string", "format": "uuid", "nullable": true }, "maxSessionLength": { "type": "integer", "format": "int32", "nullable": true }, "allowSessionExtension": { "type": "boolean" }, "sessionExtensionMinutes": { "type": "integer", "format": "int32", "nullable": true }, "sessionExtensionCount": { "type": "integer", "format": "int32", "nullable": true }, "sessionMonitorInterval": { "type": "integer", "format": "int32", "nullable": true }, "expirationTimeoutThreshold": { "type": "integer", "format": "int32", "nullable": true }, "rdpProxyHost": { "type": "string", "nullable": true }, "sshProxyHost": { "type": "string", "nullable": true }, "sshScanDc": { "type": "boolean" }, "recordAudio": { "type": "boolean" }, "proxyAutoConnect": { "type": "boolean" }, "record": { "type": "boolean" }, "approvalTypeRequired": { "$ref": "#/components/schemas/ApprovalType" }, "approvalWorkflowId": { "type": "string", "format": "uuid", "nullable": true }, "approvalWorkflowEmailTemplateId": { "type": "string", "format": "uuid", "nullable": true }, "monitorEntireSession": { "type": "boolean" }, "allowViewPassword": { "type": "boolean" }, "allowPasswordAccess": { "type": "boolean" }, "allowAutofillPassword": { "type": "boolean" }, "leaveInGroup": { "type": "boolean" }, "activityTokenComplexity": { "type": "string", "format": "uuid", "nullable": true }, "clearWebsiteDataAfterStop": { "type": "boolean" }, "clearWebsiteDataBeforeStart": { "type": "boolean" }, "notesRequired": { "type": "boolean" }, "ticketRequired": { "type": "boolean" }, "viewPasswordInSeconds": { "type": "integer", "format": "int32", "nullable": true }, "commandRestriction": { "$ref": "#/components/schemas/CommandRestriction" }, "commandRestrictionId": { "type": "string", "format": "uuid", "nullable": true }, "recordKeystrokes": { "type": "boolean" }, "serviceNowConnector": { "$ref": "#/components/schemas/IntegrationConnector" }, "serviceNowConnectorId": { "type": "string", "format": "uuid", "nullable": true } }, "additionalProperties": false, "description": "The settings for running an activity." }, "ActivityConfigurationCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique id for this collection.", "format": "uuid" }, "name": { "type": "string", "description": "Name for this collection of configuration settings." }, "description": { "type": "string", "description": "Description of the collection.", "nullable": true }, "type": { "$ref": "#/components/schemas/ActivityConfigurationType" }, "createdBy": { "type": "string", "description": "Id of user that created this collection.", "format": "uuid", "nullable": true }, "modifiedBy": { "type": "string", "description": "Id of user that modified this collection.", "format": "uuid", "nullable": true }, "createdDateTimeUtc": { "type": "string", "description": "Creation date time in UTC", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "description": "Modified date time in UTC", "format": "date-time" }, "isDefault": { "type": "boolean" }, "isDeleted": { "type": "boolean" }, "isUserModified": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "activityConfigurationSettings": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityConfigurationSetting" }, "description": "Settings which are part of this collection.", "nullable": true }, "customFields": { "type": "array", "items": { "$ref": "#/components/schemas/CustomField" }, "nullable": true }, "deleteAccount": { "type": "boolean" }, "sessionRetryInterval": { "type": "integer", "format": "int32", "nullable": true }, "approvedWorkflowEmailTemplateId": { "type": "string", "format": "uuid", "nullable": true }, "notifyApproversWorkflowEmailTemplateId": { "type": "string", "format": "uuid", "nullable": true }, "maxSessionLength": { "type": "integer", "format": "int32", "nullable": true }, "allowSessionExtension": { "type": "boolean" }, "sessionExtensionMinutes": { "type": "integer", "format": "int32", "nullable": true }, "sessionExtensionCount": { "type": "integer", "format": "int32", "nullable": true }, "sessionMonitorInterval": { "type": "integer", "format": "int32", "nullable": true }, "expirationTimeoutThreshold": { "type": "integer", "format": "int32", "nullable": true }, "rdpProxyHost": { "type": "string", "nullable": true }, "sshProxyHost": { "type": "string", "nullable": true }, "sshScanDc": { "type": "boolean" }, "recordAudio": { "type": "boolean" }, "proxyAutoConnect": { "type": "boolean" }, "record": { "type": "boolean" }, "approvalTypeRequired": { "$ref": "#/components/schemas/ApprovalType" }, "approvalWorkflowId": { "type": "string", "format": "uuid", "nullable": true }, "approvalWorkflowEmailTemplateId": { "type": "string", "format": "uuid", "nullable": true }, "monitorEntireSession": { "type": "boolean" }, "allowViewPassword": { "type": "boolean" }, "allowPasswordAccess": { "type": "boolean" }, "allowAutofillPassword": { "type": "boolean" }, "leaveInGroup": { "type": "boolean" }, "activityTokenComplexity": { "type": "string", "format": "uuid", "nullable": true }, "clearWebsiteDataAfterStop": { "type": "boolean" }, "clearWebsiteDataBeforeStart": { "type": "boolean" }, "notesRequired": { "type": "boolean" }, "ticketRequired": { "type": "boolean" }, "viewPasswordInSeconds": { "type": "integer", "format": "int32", "nullable": true }, "commandRestriction": { "$ref": "#/components/schemas/CommandRestriction" }, "commandRestrictionId": { "type": "string", "format": "uuid", "nullable": true }, "recordKeystrokes": { "type": "boolean" }, "serviceNowConnector": { "$ref": "#/components/schemas/IntegrationConnector" }, "serviceNowConnectorId": { "type": "string", "format": "uuid", "nullable": true } }, "additionalProperties": false, "description": "The settings for running an activity.", "required": [ "name" ] }, "ActivityConfigurationSetting": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique id for this setting.", "format": "uuid" }, "name": { "type": "string", "description": "Display Name for this configuration setting.", "nullable": true }, "key": { "type": "string", "description": "Key for this setting.", "nullable": true }, "value": { "type": "string", "description": "Value for this setting.", "nullable": true }, "type": { "$ref": "#/components/schemas/ActivityConfigurationSettingType" }, "activityConfigurationId": { "type": "string", "description": "Id of configuration collection to which this setting belongs.", "format": "uuid" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "The settings (name and value pairs) for running an activity." }, "ActivityConfigurationSettingType": { "enum": [ 0, 1, 2, 3, 4 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "String", "Integer", "UnsignedInteger", "Boolean", "Guid" ], "description": "Integer values: 0 = String, 1 = Integer, 2 = UnsignedInteger, 3 = Boolean, 4 = Guid." }, "ActivityConfigurationType": { "enum": [ 0, 1, 2, 3 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Generic", "ConnectionProfile", "EmailSettings", "System" ], "description": "Integer values: 0 = Generic, 1 = ConnectionProfile, 2 = EmailSettings, 3 = System." }, "ActivityConfigurationUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique id for this collection.", "format": "uuid" }, "name": { "type": "string", "description": "Name for this collection of configuration settings." }, "description": { "type": "string", "description": "Description of the collection.", "nullable": true }, "type": { "$ref": "#/components/schemas/ActivityConfigurationType" }, "createdBy": { "type": "string", "description": "Id of user that created this collection.", "format": "uuid", "nullable": true }, "modifiedBy": { "type": "string", "description": "Id of user that modified this collection.", "format": "uuid", "nullable": true }, "createdDateTimeUtc": { "type": "string", "description": "Creation date time in UTC", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "description": "Modified date time in UTC", "format": "date-time" }, "isDefault": { "type": "boolean" }, "isDeleted": { "type": "boolean" }, "isUserModified": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "activityConfigurationSettings": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityConfigurationSetting" }, "description": "Settings which are part of this collection.", "nullable": true }, "customFields": { "type": "array", "items": { "$ref": "#/components/schemas/CustomField" }, "nullable": true }, "deleteAccount": { "type": "boolean" }, "sessionRetryInterval": { "type": "integer", "format": "int32", "nullable": true }, "approvedWorkflowEmailTemplateId": { "type": "string", "format": "uuid", "nullable": true }, "notifyApproversWorkflowEmailTemplateId": { "type": "string", "format": "uuid", "nullable": true }, "maxSessionLength": { "type": "integer", "format": "int32", "nullable": true }, "allowSessionExtension": { "type": "boolean" }, "sessionExtensionMinutes": { "type": "integer", "format": "int32", "nullable": true }, "sessionExtensionCount": { "type": "integer", "format": "int32", "nullable": true }, "sessionMonitorInterval": { "type": "integer", "format": "int32", "nullable": true }, "expirationTimeoutThreshold": { "type": "integer", "format": "int32", "nullable": true }, "rdpProxyHost": { "type": "string", "nullable": true }, "sshProxyHost": { "type": "string", "nullable": true }, "sshScanDc": { "type": "boolean" }, "recordAudio": { "type": "boolean" }, "proxyAutoConnect": { "type": "boolean" }, "record": { "type": "boolean" }, "approvalTypeRequired": { "$ref": "#/components/schemas/ApprovalType" }, "approvalWorkflowId": { "type": "string", "format": "uuid", "nullable": true }, "approvalWorkflowEmailTemplateId": { "type": "string", "format": "uuid", "nullable": true }, "monitorEntireSession": { "type": "boolean" }, "allowViewPassword": { "type": "boolean" }, "allowPasswordAccess": { "type": "boolean" }, "allowAutofillPassword": { "type": "boolean" }, "leaveInGroup": { "type": "boolean" }, "activityTokenComplexity": { "type": "string", "format": "uuid", "nullable": true }, "clearWebsiteDataAfterStop": { "type": "boolean" }, "clearWebsiteDataBeforeStart": { "type": "boolean" }, "notesRequired": { "type": "boolean" }, "ticketRequired": { "type": "boolean" }, "viewPasswordInSeconds": { "type": "integer", "format": "int32", "nullable": true }, "commandRestriction": { "$ref": "#/components/schemas/CommandRestriction" }, "commandRestrictionId": { "type": "string", "format": "uuid", "nullable": true }, "recordKeystrokes": { "type": "boolean" }, "serviceNowConnector": { "$ref": "#/components/schemas/IntegrationConnector" }, "serviceNowConnectorId": { "type": "string", "format": "uuid", "nullable": true } }, "additionalProperties": false, "description": "The settings for running an activity.", "required": [ "id", "name", "type" ] }, "ActivityCopyRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this activity.", "format": "uuid" }, "createdBy": { "type": "string", "description": "Id of user that created this activity.", "format": "uuid", "nullable": true }, "modifiedBy": { "type": "string", "description": "Id of user that modified this activity.", "format": "uuid", "nullable": true }, "name": { "type": "string", "description": "Activity name - i.e. Add to Local Group", "nullable": true }, "description": { "type": "string", "description": "Description of the activity", "nullable": true }, "activityConfigurationId": { "type": "string", "description": "Id of configuration collection for this activity.", "format": "uuid", "nullable": true }, "activityConfiguration": { "$ref": "#/components/schemas/ActivityConfiguration" }, "platformId": { "type": "string", "description": "Id of platform that this activity can be performed on.", "format": "uuid", "nullable": true }, "platform": { "$ref": "#/components/schemas/Platform" }, "startActionGroupId": { "type": "string", "description": "Action Group to run at the start of the activity.", "format": "uuid", "nullable": true }, "duringActionGroupId": { "type": "string", "description": "Optional - Action group to run during the activity", "format": "uuid", "nullable": true }, "endActionGroupId": { "type": "string", "description": "Action group to run at the end of the activity.", "format": "uuid", "nullable": true }, "activityType": { "$ref": "#/components/schemas/ActivityType" }, "loginAccount": { "$ref": "#/components/schemas/ActivityLoginType" }, "loginAccountNameFormat": { "type": "string", "description": "Login account format.", "nullable": true }, "requesterLoginFormat": { "$ref": "#/components/schemas/RequesterLoginFormat" }, "applicationToLaunch": { "type": "string", "description": "Launch proxy from path", "nullable": true }, "preferredRDSHostId": { "type": "string", "description": "Managed resource for Remote Desktop Server(RDS)", "format": "uuid", "nullable": true }, "connectCredentialId": { "type": "string", "description": "Connect Account for RDS impersonation", "format": "uuid", "nullable": true }, "createAccount": { "type": "boolean", "description": "Create local account option for activity" }, "activityGroupActivities": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityGroupActivity" }, "description": "The links between activities and activity groups.", "nullable": true }, "deleteAccount": { "type": "boolean", "description": "For a managed account, delete account when finished when false account will be disabled" }, "vaultId": { "type": "string", "format": "uuid", "nullable": true }, "vaultInfo": { "type": "string", "description": "Vault properties, JSON string and specific to the Vault", "nullable": true }, "logonUrl": { "type": "string", "description": "Url for site login", "nullable": true }, "isDefault": { "type": "boolean" }, "isDeleted": { "type": "boolean" }, "isUserModified": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "latestSessionActualStartUtc": { "type": "string", "description": "The date and time of the most recent activity session for this activity, filtered by various contexts. Optional lookup value, not stored.", "format": "date-time", "nullable": true } }, "additionalProperties": false, "description": "An activity that a user can perform, such as requesting elevated access to a resource.", "required": [ "id", "name" ] }, "ActivityCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this activity.", "format": "uuid" }, "createdBy": { "type": "string", "description": "Id of user that created this activity.", "format": "uuid", "nullable": true }, "modifiedBy": { "type": "string", "description": "Id of user that modified this activity.", "format": "uuid", "nullable": true }, "name": { "type": "string", "description": "Activity name - i.e. Add to Local Group" }, "description": { "type": "string", "description": "Description of the activity", "nullable": true }, "activityConfigurationId": { "type": "string", "description": "Id of configuration collection for this activity.", "format": "uuid", "nullable": true }, "activityConfiguration": { "$ref": "#/components/schemas/ActivityConfiguration" }, "platformId": { "type": "string", "description": "Id of platform that this activity can be performed on.", "format": "uuid", "nullable": true }, "platform": { "$ref": "#/components/schemas/Platform" }, "startActionGroupId": { "type": "string", "description": "Action Group to run at the start of the activity.", "format": "uuid", "nullable": true }, "duringActionGroupId": { "type": "string", "description": "Optional - Action group to run during the activity", "format": "uuid", "nullable": true }, "endActionGroupId": { "type": "string", "description": "Action group to run at the end of the activity.", "format": "uuid", "nullable": true }, "activityType": { "$ref": "#/components/schemas/ActivityType" }, "loginAccount": { "$ref": "#/components/schemas/ActivityLoginType" }, "loginAccountNameFormat": { "type": "string", "description": "Login account format.", "nullable": true }, "requesterLoginFormat": { "$ref": "#/components/schemas/RequesterLoginFormat" }, "applicationToLaunch": { "type": "string", "description": "Launch proxy from path", "nullable": true }, "preferredRDSHostId": { "type": "string", "description": "Managed resource for Remote Desktop Server(RDS)", "format": "uuid", "nullable": true }, "connectCredentialId": { "type": "string", "description": "Connect Account for RDS impersonation", "format": "uuid", "nullable": true }, "createAccount": { "type": "boolean", "description": "Create local account option for activity" }, "activityGroupActivities": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityGroupActivity" }, "description": "The links between activities and activity groups.", "nullable": true }, "deleteAccount": { "type": "boolean", "description": "For a managed account, delete account when finished when false account will be disabled" }, "vaultId": { "type": "string", "format": "uuid", "nullable": true }, "vaultInfo": { "type": "string", "description": "Vault properties, JSON string and specific to the Vault", "nullable": true }, "logonUrl": { "type": "string", "description": "Url for site login", "nullable": true }, "isDefault": { "type": "boolean" }, "isDeleted": { "type": "boolean" }, "isUserModified": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "latestSessionActualStartUtc": { "type": "string", "description": "The date and time of the most recent activity session for this activity, filtered by various contexts. Optional lookup value, not stored.", "format": "date-time", "nullable": true } }, "additionalProperties": false, "description": "An activity that a user can perform, such as requesting elevated access to a resource.", "required": [ "name" ] }, "ActivityGroup": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this group.", "format": "uuid" }, "createdBy": { "type": "string", "description": "Id of user that created this activity.", "format": "uuid", "nullable": true }, "modifiedBy": { "type": "string", "description": "Id of user that modified this activity.", "format": "uuid", "nullable": true }, "modifiedDateTimeUtc": { "type": "string", "description": "Modified date time in UTC", "format": "date-time" }, "name": { "type": "string", "description": "Name for this group.", "nullable": true }, "description": { "type": "string", "description": "Description for this group.", "nullable": true }, "activityConfigurationId": { "type": "string", "description": "Id of configuration collection for this group.", "format": "uuid", "nullable": true }, "activityConfiguration": { "$ref": "#/components/schemas/ActivityConfiguration" }, "activityGroupActivities": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityGroupActivity" }, "description": "The links between activities and activity groups.", "nullable": true }, "isDefault": { "type": "boolean" }, "isDeleted": { "type": "boolean" }, "isUserModified": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "latestSessionActualStartUtc": { "type": "string", "description": "The date and time of the most recent activity session for this activity, filtered by various contexts. Optional lookup value, not stored.", "format": "date-time", "nullable": true } }, "additionalProperties": false, "description": "A group of activities." }, "ActivityGroupActivity": { "type": "object", "properties": { "activityId": { "type": "string", "format": "uuid" }, "activity": { "$ref": "#/components/schemas/Activity" }, "activityGroupId": { "type": "string", "format": "uuid" }, "activityGroup": { "$ref": "#/components/schemas/ActivityGroup" }, "isDeleted": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ActivityGroupCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this group.", "format": "uuid" }, "createdBy": { "type": "string", "description": "Id of user that created this activity.", "format": "uuid", "nullable": true }, "modifiedBy": { "type": "string", "description": "Id of user that modified this activity.", "format": "uuid", "nullable": true }, "modifiedDateTimeUtc": { "type": "string", "description": "Modified date time in UTC", "format": "date-time" }, "name": { "type": "string", "description": "Name for this group." }, "description": { "type": "string", "description": "Description for this group.", "nullable": true }, "activityConfigurationId": { "type": "string", "description": "Id of configuration collection for this group.", "format": "uuid", "nullable": true }, "activityConfiguration": { "$ref": "#/components/schemas/ActivityConfiguration" }, "activityGroupActivities": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityGroupActivity" }, "description": "The links between activities and activity groups.", "nullable": true }, "isDefault": { "type": "boolean" }, "isDeleted": { "type": "boolean" }, "isUserModified": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "latestSessionActualStartUtc": { "type": "string", "description": "The date and time of the most recent activity session for this activity, filtered by various contexts. Optional lookup value, not stored.", "format": "date-time", "nullable": true } }, "additionalProperties": false, "description": "A group of activities.", "required": [ "name" ] }, "ActivityGroupJoin": { "type": "object", "properties": { "accessControlPolicyId": { "type": "string", "format": "uuid" }, "activityGroupId": { "type": "string", "format": "uuid" }, "activityGroup": { "$ref": "#/components/schemas/ActivityGroup" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ActivityGroupUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this group.", "format": "uuid" }, "createdBy": { "type": "string", "description": "Id of user that created this activity.", "format": "uuid", "nullable": true }, "modifiedBy": { "type": "string", "description": "Id of user that modified this activity.", "format": "uuid", "nullable": true }, "modifiedDateTimeUtc": { "type": "string", "description": "Modified date time in UTC", "format": "date-time" }, "name": { "type": "string", "description": "Name for this group." }, "description": { "type": "string", "description": "Description for this group.", "nullable": true }, "activityConfigurationId": { "type": "string", "description": "Id of configuration collection for this group.", "format": "uuid", "nullable": true }, "activityConfiguration": { "$ref": "#/components/schemas/ActivityConfiguration" }, "activityGroupActivities": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityGroupActivity" }, "description": "The links between activities and activity groups.", "nullable": true }, "isDefault": { "type": "boolean" }, "isDeleted": { "type": "boolean" }, "isUserModified": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "latestSessionActualStartUtc": { "type": "string", "description": "The date and time of the most recent activity session for this activity, filtered by various contexts. Optional lookup value, not stored.", "format": "date-time", "nullable": true } }, "additionalProperties": false, "description": "A group of activities.", "required": [ "id", "name" ] }, "ActivityJoin": { "type": "object", "properties": { "accessControlPolicyId": { "type": "string", "format": "uuid" }, "activityId": { "type": "string", "format": "uuid" }, "activity": { "$ref": "#/components/schemas/Activity" }, "isDefault": { "type": "boolean" }, "isDeleted": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ActivityLoginType": { "enum": [ 0, 1, 2, 3, 4 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Requester", "Managed", "ActivityIdentity", "Vault", "Resource" ], "description": "Integer values: 0 = Requester, 1 = Managed, 2 = ActivityIdentity, 3 = Vault, 4 = Resource." }, "ActivityOrGroupKind": { "enum": [ 0, 1 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Activity", "ActivityGroup" ], "description": "Integer values: 0 = Activity, 1 = ActivityGroup." }, "ActivityOrGroupReference": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "entityType": { "$ref": "#/components/schemas/ActivityOrGroupKind" } }, "additionalProperties": false }, "ActivityPolicy": { "type": "object", "properties": { "activityId": { "type": "string", "format": "uuid" }, "activityName": { "type": "string", "nullable": true }, "policyId": { "type": "string", "format": "uuid" }, "policyName": { "type": "string", "nullable": true }, "platformId": { "type": "string", "format": "uuid", "nullable": true }, "isDeleted": { "type": "boolean" }, "notesRequired": { "type": "boolean" }, "ticketRequired": { "type": "boolean" }, "maxSessionLength": { "type": "integer", "format": "int32" } }, "additionalProperties": false, "description": "Each activity session wizard resource has a list of matching activity + policy entries" }, "ActivityReference": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "entityType": { "$ref": "#/components/schemas/ActivityOrGroupKind" } }, "additionalProperties": false }, "ActivitySession": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this session.", "format": "uuid" }, "createdBy": { "type": "string", "description": "Id of user that created this session.", "format": "uuid", "nullable": true }, "createdByUserName": { "type": "string", "description": "Name of user that created this session.", "nullable": true }, "createdFromAddress": { "type": "string", "description": "IP address of user that created this session.", "nullable": true }, "createdDateTimeUtc": { "type": "string", "description": "Creation date time in UTC", "format": "date-time" }, "credentialId": { "type": "string", "description": "ID of the credential for this session. If you do not specify one, the credential of the host of the managed resource is used, if there is one.", "format": "uuid", "nullable": true }, "userCredentialId": { "type": "string", "format": "uuid", "nullable": true }, "connectCredentialId": { "type": "string", "description": "Connect Account for RDS impersonation", "format": "uuid", "nullable": true }, "locked": { "type": "boolean" }, "loginAccountName": { "type": "string", "description": "Account name generated from the login account name format.", "nullable": true }, "vaultId": { "type": "string", "description": "ID of the vault to use to look up the credential for this session. Leave it empty to use a credential that is not in a vault.", "format": "uuid", "nullable": true }, "vaultInfo": { "type": "string", "description": "Vault properties, JSON string and specific to the Vault", "nullable": true }, "activityId": { "type": "string", "description": "Id of activity run by this session.", "format": "uuid" }, "activity": { "$ref": "#/components/schemas/Activity" }, "activityConfigurationId": { "type": "string", "description": "Id of configuration collection for this activity.", "format": "uuid", "nullable": true }, "activityConfiguration": { "$ref": "#/components/schemas/ActivityConfiguration" }, "activitySessionGroupId": { "type": "string", "description": "Id of activity session group to which this session belongs.", "format": "uuid", "nullable": true }, "activitySessionGroup": { "$ref": "#/components/schemas/ActivitySessionGroup" }, "accessControlPolicyId": { "type": "string", "description": "Id of policy associated this session.", "format": "uuid", "nullable": true }, "accessControlPolicy": { "$ref": "#/components/schemas/AccessControlPolicy" }, "managedAccountId": { "type": "string", "description": "Id of account associated with this session.", "format": "uuid", "nullable": true }, "managedAccount": { "$ref": "#/components/schemas/ManagedAccount" }, "managedResourceId": { "type": "string", "description": "Id of resource associated with this session.", "format": "uuid", "nullable": true }, "managedResource": { "$ref": "#/components/schemas/ManagedResource" }, "sessionInitActionQueueId": { "type": "string", "description": "Id of action queue to execute enable RDP before session", "format": "uuid", "nullable": true }, "sessionInitActionQueue": { "$ref": "#/components/schemas/ActionQueue" }, "createUserActionQueueId": { "type": "string", "description": "Id of action queue to execute to create/enable the user before the session.", "format": "uuid", "nullable": true }, "createUserActionQueue": { "$ref": "#/components/schemas/ActionQueue" }, "disableUserActionQueueId": { "type": "string", "description": "Id of action queue to execute to create/enable the user before the session.", "format": "uuid", "nullable": true }, "disableUserActionQueue": { "$ref": "#/components/schemas/ActionQueue" }, "startActionQueueId": { "type": "string", "description": "Id of action queue to execute to start this session.", "format": "uuid", "nullable": true }, "startActionQueue": { "$ref": "#/components/schemas/ActionQueue" }, "duringActionQueueId": { "type": "string", "description": "Id of action queue to execute during this session.", "format": "uuid", "nullable": true }, "duringActionQueue": { "$ref": "#/components/schemas/ActionQueue" }, "monitorActionQueueId": { "type": "string", "description": "Id of action queue to execute to monitor the job.", "format": "uuid", "nullable": true }, "monitorActionQueue": { "$ref": "#/components/schemas/ActionQueue" }, "endActionQueueId": { "type": "string", "description": "Id of action queue to execute to end this session.", "format": "uuid", "nullable": true }, "endActionQueue": { "$ref": "#/components/schemas/ActionQueue" }, "messageActionQueueId": { "type": "string", "description": "Id of action queue to execute to message the user during this session.", "format": "uuid", "nullable": true }, "messageActionQueue": { "$ref": "#/components/schemas/ActionQueue" }, "status": { "$ref": "#/components/schemas/SessionStatus" }, "statusDescription": { "type": "string", "description": "Human readable description of the current status of this session.", "nullable": true }, "scheduledStartDateTimeUtc": { "type": "string", "description": "Scheduled start date time in UTC", "format": "date-time" }, "actualStartDateTimeUtc": { "type": "string", "description": "Actual start date time in UTC", "format": "date-time", "nullable": true }, "scheduledEndDateTimeUtc": { "type": "string", "description": "Scheduled end date time in UTC", "format": "date-time", "nullable": true }, "actualEndDateTimeUtc": { "type": "string", "description": "Actual end date time in UTC", "format": "date-time", "nullable": true }, "cancelledBy": { "type": "string", "description": "Id of user that cancelled this session.", "format": "uuid", "nullable": true }, "targetUserId": { "type": "string", "description": "The ID of the host user that the activity targets.", "format": "uuid", "nullable": true }, "targetId": { "type": "string", "description": "The ID of the target of the activity. It is the ID of a host or of a domain; the type of the managed resource tells you which.", "format": "uuid", "nullable": true }, "proxySessions": { "type": "array", "items": { "$ref": "#/components/schemas/ProxySession" }, "description": "List of proxy sessions associated with this activity session.", "nullable": true }, "approvalWorkflowId": { "type": "string", "description": "Id of approval workflow associated with this session.", "format": "uuid", "nullable": true }, "approvalWorkflow": { "$ref": "#/components/schemas/ApprovalWorkflow" }, "approvalWorkflowApprovals": { "type": "array", "items": { "$ref": "#/components/schemas/ApprovalWorkflowApproval" }, "description": "List of approvals associated with this activity session.", "nullable": true }, "note": { "type": "string", "description": "User can add \"Notes for this session\" in the session setup wizard", "nullable": true }, "ticket": { "type": "string", "description": "User can add \"Ticket for this session\" in the session setup wizard", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "allowSessionExtension": { "type": "boolean", "description": "Whether the user of the session is allowed to extend this session's time" }, "sessionExtensionCount": { "type": "integer", "description": "How many session extensions remain for the user to request", "format": "int32" }, "sessionExtensionMinutes": { "type": "integer", "description": "The maximum number of minutes the session's user may request for a single extension", "format": "int32" }, "customFields": { "type": "string", "nullable": true }, "commandRestrictionActionTaken": { "type": "boolean" }, "commandRestrictionSettings": { "type": "array", "items": { "$ref": "#/components/schemas/CommandRestrictionSetting" }, "nullable": true }, "commandRestrictionSettingsSerialized": { "type": "string", "nullable": true }, "encryptedFileId": { "type": "string", "description": "Id of encrypted file associated with this session.", "format": "uuid", "nullable": true }, "encryptedFileName": { "type": "string", "description": "Encrypted file name associated with this session.", "nullable": true }, "loginAccount": { "$ref": "#/components/schemas/ActivityLoginType" }, "serviceNowEndState": { "type": "string", "description": "ServiceNow ticket state to set when the session ends (for example Resolved or On Hold). Null means no state change is made on session end.", "nullable": true } }, "additionalProperties": false, "description": "A session that runs an activity, such as giving a user elevated access to a resource." }, "ActivitySessionGroup": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this group.", "format": "uuid" }, "createdBy": { "type": "string", "description": "Id of user that created this group.", "format": "uuid", "nullable": true }, "activitySessions": { "type": "array", "items": { "$ref": "#/components/schemas/ActivitySession" }, "description": "List of active sessions which belong to this group.", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A group of activity sessions." }, "ActivitySessionRequest": { "type": "object", "properties": { "createdBy": { "type": "string", "format": "uuid", "nullable": true }, "createdByUserName": { "type": "string", "nullable": true }, "createdFromAddress": { "type": "string", "nullable": true }, "activitySessionGroupId": { "type": "string", "format": "uuid", "nullable": true }, "managedAccountId": { "type": "string", "format": "uuid" }, "managedResourceId": { "type": "string", "format": "uuid", "nullable": true }, "managedResourceName": { "type": "string", "nullable": true }, "activityId": { "type": "string", "format": "uuid" }, "accessPolicyId": { "type": "string", "format": "uuid", "nullable": true }, "credentialId": { "type": "string", "format": "uuid", "nullable": true }, "credentialDomain": { "type": "string", "nullable": true }, "credentialUsername": { "type": "string", "nullable": true }, "credentialName": { "type": "string", "nullable": true }, "startDateTimeUtc": { "type": "string", "format": "date-time" }, "endDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "activityName": { "type": "string", "nullable": true }, "note": { "type": "string", "nullable": true }, "ticket": { "type": "string", "nullable": true }, "customFields": { "type": "array", "items": { "$ref": "#/components/schemas/CustomFieldValue" }, "nullable": true }, "encryptedFileId": { "type": "string", "format": "uuid", "nullable": true }, "encryptedFileName": { "type": "string", "nullable": true }, "runtimeParameterOverrides": { "type": "array", "items": { "$ref": "#/components/schemas/RuntimeParameterOverride" }, "nullable": true } }, "additionalProperties": false }, "ActivitySessionSearchResults": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/SessionSummary" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" }, "topUsers": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountSessionCount" }, "description": "Short list of top active users", "nullable": true }, "summary": { "$ref": "#/components/schemas/ActivitySessionSummaryCount" } }, "additionalProperties": false }, "ActivitySessionSummaryCount": { "type": "object", "properties": { "countSessions": { "type": "integer", "description": "Total number of sessions for all users in results", "format": "int32" }, "sumDuration": { "type": "integer", "description": "Total duration of all sessions in results", "format": "int32" }, "avgDuration": { "type": "integer", "description": "Average duration of all sessions in results", "format": "int32" }, "minDuration": { "type": "integer", "description": "Shortest duration of all sessions in results", "format": "int32" }, "maxDuration": { "type": "integer", "description": "Longest durations of all sessions in results", "format": "int32" } }, "additionalProperties": false }, "ActivitySessionTopUsersTypes": { "enum": [ 0, 1, 2, 3 ], "type": "integer", "description": "Integer values: 0 = None, 1 = Everyone, 2 = Top5, 3 = Top10.", "format": "int32", "x-enum-varnames": [ "None", "Everyone", "Top5", "Top10" ] }, "ActivityType": { "enum": [ 0, 1, 2, 3, 4 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Interactive", "InteractiveAppLaunch", "TaskAutomation", "CredentialRelease", "FileRelease" ], "description": "Integer values: 0 = Interactive, 1 = InteractiveAppLaunch, 2 = TaskAutomation, 3 = CredentialRelease, 4 = FileRelease." }, "ActivityUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this activity.", "format": "uuid" }, "createdBy": { "type": "string", "description": "Id of user that created this activity.", "format": "uuid", "nullable": true }, "modifiedBy": { "type": "string", "description": "Id of user that modified this activity.", "format": "uuid", "nullable": true }, "name": { "type": "string", "description": "Activity name - i.e. Add to Local Group" }, "description": { "type": "string", "description": "Description of the activity", "nullable": true }, "activityConfigurationId": { "type": "string", "description": "Id of configuration collection for this activity.", "format": "uuid", "nullable": true }, "activityConfiguration": { "$ref": "#/components/schemas/ActivityConfiguration" }, "platformId": { "type": "string", "description": "Id of platform that this activity can be performed on.", "format": "uuid", "nullable": true }, "platform": { "$ref": "#/components/schemas/Platform" }, "startActionGroupId": { "type": "string", "description": "Action Group to run at the start of the activity.", "format": "uuid", "nullable": true }, "duringActionGroupId": { "type": "string", "description": "Optional - Action group to run during the activity", "format": "uuid", "nullable": true }, "endActionGroupId": { "type": "string", "description": "Action group to run at the end of the activity.", "format": "uuid", "nullable": true }, "activityType": { "$ref": "#/components/schemas/ActivityType" }, "loginAccount": { "$ref": "#/components/schemas/ActivityLoginType" }, "loginAccountNameFormat": { "type": "string", "description": "Login account format.", "nullable": true }, "requesterLoginFormat": { "$ref": "#/components/schemas/RequesterLoginFormat" }, "applicationToLaunch": { "type": "string", "description": "Launch proxy from path", "nullable": true }, "preferredRDSHostId": { "type": "string", "description": "Managed resource for Remote Desktop Server(RDS)", "format": "uuid", "nullable": true }, "connectCredentialId": { "type": "string", "description": "Connect Account for RDS impersonation", "format": "uuid", "nullable": true }, "createAccount": { "type": "boolean", "description": "Create local account option for activity" }, "activityGroupActivities": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityGroupActivity" }, "description": "The links between activities and activity groups.", "nullable": true }, "deleteAccount": { "type": "boolean", "description": "For a managed account, delete account when finished when false account will be disabled" }, "vaultId": { "type": "string", "format": "uuid", "nullable": true }, "vaultInfo": { "type": "string", "description": "Vault properties, JSON string and specific to the Vault", "nullable": true }, "logonUrl": { "type": "string", "description": "Url for site login", "nullable": true }, "isDefault": { "type": "boolean" }, "isDeleted": { "type": "boolean" }, "isUserModified": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "latestSessionActualStartUtc": { "type": "string", "description": "The date and time of the most recent activity session for this activity, filtered by various contexts. Optional lookup value, not stored.", "format": "date-time", "nullable": true } }, "additionalProperties": false, "description": "An activity that a user can perform, such as requesting elevated access to a resource.", "required": [ "id", "name" ] }, "ActivityWithPolicies": { "type": "object", "properties": { "activity": { "$ref": "#/components/schemas/Activity" }, "policies": { "type": "array", "items": { "$ref": "#/components/schemas/AccessControlPolicy" }, "nullable": true } }, "additionalProperties": false }, "AdSyncInput": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "specificGroups": { "type": "string", "description": "The specific groups that this job scans.", "default": null, "nullable": true }, "nameFormat": { "$ref": "#/components/schemas/ActiveDirectoryNameFormat" }, "fullScan": { "type": "boolean", "description": "True to scan all objects again. False to continue from the position of the last scan.", "default": false }, "useGlobalCatalog": { "type": "boolean", "description": "True if a global catalog server performs the name translations.", "default": false }, "domain": { "type": "string", "nullable": true }, "domainController": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "AdSyncSchedule": { "type": "object", "properties": { "activeDirectoryDomainConfigurationId": { "type": "string", "format": "uuid" }, "schedule": { "type": "string", "nullable": true }, "useGlobalCatalog": { "type": "boolean" }, "fullSync": { "type": "boolean" } }, "additionalProperties": false }, "AdUserFormat": { "enum": [ 0, 1 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Samaccountname", "Upn" ], "description": "Integer values: 0 = Samaccountname, 1 = Upn." }, "AppToken": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this token.", "format": "uuid" }, "name": { "type": "string", "description": "Name for this token.", "nullable": true }, "description": { "type": "string", "description": "Human readable description of this token.", "nullable": true }, "token": { "type": "string", "description": "Encrypted JWT Authorization BEARER token.", "nullable": true }, "tokenSalt": { "type": "string", "description": "Salt for token encryption.", "nullable": true }, "createdDateTimeUtc": { "type": "string", "description": "When this token was created.", "format": "date-time" }, "expirationDate": { "type": "string", "description": "Expiration date/time for this token.", "format": "date-time" }, "revoked": { "type": "boolean", "description": "True if this token has been revoked." }, "createdBy": { "type": "string", "description": "Id of logged in user who created this token.", "format": "uuid", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A token that a service can use for authorization." }, "ApprovalType": { "enum": [ 0, 1, 2, 3 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Deny", "Allow", "Workflow", "External" ], "description": "Integer values: 0 = Deny, 1 = Allow, 2 = Workflow, 3 = External." }, "ApprovalWorkflow": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this workflow.", "format": "uuid" }, "modifiedBy": { "type": "string", "description": "Id of user that created/modified this workflow.", "format": "uuid", "nullable": true }, "modifiedDateTimeUtc": { "type": "string", "description": "Modified date time in UTC", "format": "date-time" }, "approvalWorkflowTiers": { "type": "array", "items": { "$ref": "#/components/schemas/ApprovalWorkflowTier" }, "description": "List of approval tier(s).", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "An approval workflow that can be assigned to a connection profile." }, "ApprovalWorkflowApproval": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this workflow approval.", "format": "uuid" }, "modifiedByUserName": { "type": "string", "description": "Name of user that created this approval.", "nullable": true }, "modifiedFromAddress": { "type": "string", "description": "IP address of user that created this session.", "nullable": true }, "modifiedBy": { "type": "string", "description": "Id of user that created this workflow approval.", "format": "uuid", "nullable": true }, "approvalState": { "$ref": "#/components/schemas/ApprovalWorkflowApprovalState" }, "activitySessionId": { "type": "string", "description": "Id of activity session to which this approval applies.", "format": "uuid" }, "activitySession": { "$ref": "#/components/schemas/ActivitySession" }, "approvalWorkflowTierId": { "type": "string", "description": "Id of approval workflow tier to which this approval applies.", "format": "uuid" }, "approvalWorkflowTier": { "$ref": "#/components/schemas/ApprovalWorkflowTier" }, "approverAccountId": { "type": "string", "description": "Id of managed account which provided this approval.", "format": "uuid" }, "approverAccount": { "$ref": "#/components/schemas/ManagedAccount" }, "approverType": { "$ref": "#/components/schemas/ApprovalWorkflowApproverType" }, "approverNotes": { "type": "string", "description": "Notes from approver.", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "An approval in an approval workflow." }, "ApprovalWorkflowApprovalState": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Pending", "Approved", "Denied" ], "description": "Integer values: 0 = Pending, 1 = Approved, 2 = Denied." }, "ApprovalWorkflowApprovalUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this workflow approval.", "format": "uuid" }, "modifiedByUserName": { "type": "string", "description": "Name of user that created this approval.", "nullable": true }, "modifiedFromAddress": { "type": "string", "description": "IP address of user that created this session.", "nullable": true }, "modifiedBy": { "type": "string", "description": "Id of user that created this workflow approval.", "format": "uuid", "nullable": true }, "approvalState": { "$ref": "#/components/schemas/ApprovalWorkflowApprovalState" }, "activitySessionId": { "type": "string", "description": "Id of activity session to which this approval applies.", "format": "uuid" }, "activitySession": { "$ref": "#/components/schemas/ActivitySession" }, "approvalWorkflowTierId": { "type": "string", "description": "Id of approval workflow tier to which this approval applies.", "format": "uuid" }, "approvalWorkflowTier": { "$ref": "#/components/schemas/ApprovalWorkflowTier" }, "approverAccountId": { "type": "string", "description": "Id of managed account which provided this approval.", "format": "uuid" }, "approverAccount": { "$ref": "#/components/schemas/ManagedAccount" }, "approverType": { "$ref": "#/components/schemas/ApprovalWorkflowApproverType" }, "approverNotes": { "type": "string", "description": "Notes from approver.", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "An approval in an approval workflow.", "required": [ "approverAccountId", "activitySessionId", "approvalState" ] }, "ApprovalWorkflowApproverType": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Normal", "Escalated", "Requester" ], "description": "Integer values: 0 = Normal, 1 = Escalated, 2 = Requester." }, "ApprovalWorkflowTier": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this workflow tier.", "format": "uuid" }, "approvalWorkflowId": { "type": "string", "description": "Id of workflow to which this tier belongs.", "format": "uuid", "nullable": true }, "tierNumber": { "type": "integer", "description": "Tier number (1, ...).", "format": "int32" }, "progressionType": { "$ref": "#/components/schemas/ApprovalWorkflowTierProgressionType" }, "requiredApprovalCount": { "type": "integer", "description": "Number of approvals needed to accomplish this tier.", "format": "int32" }, "approvalWorkflowTierApprovers": { "type": "array", "items": { "$ref": "#/components/schemas/ApprovalWorkflowTierApprover" }, "description": "List of possible approvers for this tier", "nullable": true }, "approvalWorkflowTierApproverGroups": { "type": "array", "items": { "$ref": "#/components/schemas/ApprovalWorkflowTierApproverGroup" }, "description": "List of possible approver groups for this tier", "nullable": true }, "escalationTimeout": { "type": "integer", "description": "Escalation timeout for normal approval in minutes.", "format": "int32" }, "escalationApproverAccountId": { "type": "string", "description": "Id of account to which to escalate this approval.", "format": "uuid", "nullable": true }, "escalationApproverAccount": { "$ref": "#/components/schemas/ManagedAccount" }, "escalationApproverGroupId": { "type": "string", "description": "Id of account group to which to escalate this approval.", "format": "uuid", "nullable": true }, "escalationApproverGroup": { "$ref": "#/components/schemas/ManagedAccountGroup" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "expirationDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true } }, "additionalProperties": false, "description": "A tier of an approval workflow." }, "ApprovalWorkflowTierApprover": { "type": "object", "properties": { "approvalWorkflowTierId": { "type": "string", "format": "uuid" }, "approvalWorkflowTier": { "$ref": "#/components/schemas/ApprovalWorkflowTier" }, "approvalWorkflowApproverAccountId": { "type": "string", "format": "uuid" }, "approvalWorkflowApproverAccount": { "$ref": "#/components/schemas/ManagedAccount" } }, "additionalProperties": false }, "ApprovalWorkflowTierApproverGroup": { "type": "object", "properties": { "approvalWorkflowTierId": { "type": "string", "format": "uuid" }, "approvalWorkflowTier": { "$ref": "#/components/schemas/ApprovalWorkflowTier" }, "approvalWorkflowApproverGroupId": { "type": "string", "format": "uuid" }, "approvalWorkflowApproverGroup": { "$ref": "#/components/schemas/ManagedAccountGroup" } }, "additionalProperties": false }, "ApprovalWorkflowTierProgressionType": { "enum": [ 0, 1 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Sequential", "Concurrent" ], "description": "Integer values: 0 = Sequential, 1 = Concurrent." }, "AuditChangeRow": { "type": "object", "properties": { "name": { "type": "string", "nullable": true }, "title": { "type": "string", "nullable": true } }, "additionalProperties": false }, "AuthenticationMethodType": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Password", "SshCertificate", "SshCertificateAndPassword" ], "description": "Integer values: 0 = Password, 1 = SshCertificate, 2 = SshCertificateAndPassword." }, "AzureAd": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "tenantId": { "type": "string", "nullable": true }, "logonUrl": { "type": "string", "nullable": true }, "emailDomain": { "type": "string", "nullable": true }, "associatedDomainId": { "type": "string", "format": "uuid", "nullable": true }, "processGroupMembership": { "type": "boolean" }, "managedResourceId": { "type": "string", "format": "uuid", "nullable": true }, "platformId": { "type": "string", "format": "uuid" }, "serviceAccountId": { "type": "string", "format": "uuid", "nullable": true }, "virtualHostId": { "type": "string", "format": "uuid", "nullable": true }, "virtualWebsiteId": { "type": "string", "format": "uuid", "nullable": true } }, "additionalProperties": false }, "AzureAdCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "tenantId": { "type": "string" }, "logonUrl": { "type": "string" }, "emailDomain": { "type": "string" }, "associatedDomainId": { "type": "string", "format": "uuid", "nullable": true }, "processGroupMembership": { "type": "boolean" }, "managedResourceId": { "type": "string", "format": "uuid", "nullable": true }, "platformId": { "type": "string", "format": "uuid" }, "serviceAccountId": { "type": "string", "format": "uuid", "nullable": true }, "virtualHostId": { "type": "string", "format": "uuid", "nullable": true }, "virtualWebsiteId": { "type": "string", "format": "uuid", "nullable": true } }, "additionalProperties": false, "required": [ "name", "tenantId", "emailDomain", "logonUrl" ] }, "AzureAdTenant": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique Id", "format": "uuid" }, "name": { "type": "string", "description": "Name of the Microsoft Entra tenant. Required.", "nullable": true }, "description": { "type": "string", "description": "Description of the AzureAD tenant", "nullable": true }, "tenantId": { "type": "string", "description": "The Microsoft Entra directory (tenant) ID. Required.", "nullable": true }, "logonUrl": { "type": "string", "description": "The sign-in URL for the tenant portal, where the browser is sent so that the user can sign in. Required.", "nullable": true }, "emailDomain": { "type": "string", "description": "The email domain of the tenant, for example example.com. The random characters of an activity token form the part of the email address before the domain.", "nullable": true }, "associatedDomainId": { "type": "string", "description": "Optional link to ActiveDirectory domain", "format": "uuid", "nullable": true }, "processGroupMembership": { "type": "boolean", "description": "Enable/disable group membership processing" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "AzureAdUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "tenantId": { "type": "string" }, "logonUrl": { "type": "string" }, "emailDomain": { "type": "string" }, "associatedDomainId": { "type": "string", "format": "uuid", "nullable": true }, "processGroupMembership": { "type": "boolean" }, "managedResourceId": { "type": "string", "format": "uuid", "nullable": true }, "platformId": { "type": "string", "format": "uuid" }, "serviceAccountId": { "type": "string", "format": "uuid", "nullable": true }, "virtualHostId": { "type": "string", "format": "uuid", "nullable": true }, "virtualWebsiteId": { "type": "string", "format": "uuid", "nullable": true } }, "additionalProperties": false, "required": [ "id", "name", "tenantId", "emailDomain", "logonUrl", "platformId" ] }, "BatchResponse": { "type": "object", "properties": { "id": { "type": "string", "description": "Id of record that this response corresponds to", "format": "uuid" }, "status": { "type": "integer", "description": "HTTP status code of this response.", "format": "int32" }, "message": { "type": "string", "description": "Human readable message", "nullable": true } }, "additionalProperties": false, "description": "Batched response" }, "CandidateAddMultipleCreateRequest": { "type": "object", "properties": { "hostIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "description": "List of host ids to add as managed resources" }, "serviceAccountId": { "type": "string", "description": "Service account id to use as resource service id", "format": "uuid" } }, "additionalProperties": false, "required": [ "hostIds", "serviceAccountId" ] }, "Certificate": { "type": "object", "properties": { "friendlyName": { "type": "string", "nullable": true }, "subject": { "type": "string", "nullable": true }, "thumbprint": { "type": "string", "nullable": true } }, "additionalProperties": false }, "CertificateType": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "WinRM", "RDP", "SSH" ], "description": "Integer values: 0 = WinRM, 1 = RDP, 2 = SSH." }, "CharacterTypeFlags": { "enum": [ 0, 1, 2, 4, 8, 16 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "None", "Lowercase", "Uppercase", "Numeric", "Symbol", "Space" ], "description": "Integer values: 0 = None, 1 = Lowercase, 2 = Uppercase, 4 = Numeric, 8 = Symbol, 16 = Space." }, "Command": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "commandSetId": { "type": "string", "format": "uuid" }, "commandToSend": { "type": "string", "nullable": true }, "executionOrder": { "type": "integer", "format": "int32" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "resultActions": { "type": "array", "items": { "$ref": "#/components/schemas/CommandResultAction" }, "nullable": true }, "commandScript": { "type": "string", "nullable": true } }, "additionalProperties": false }, "CommandPlan": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "platformId": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "permanent": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "commandSets": { "type": "array", "items": { "$ref": "#/components/schemas/CommandSet" }, "nullable": true }, "connectionType": { "type": "string", "nullable": true } }, "additionalProperties": false }, "CommandPlanCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "platformId": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "permanent": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "commandSets": { "type": "array", "items": { "$ref": "#/components/schemas/CommandSet" }, "nullable": true }, "connectionType": { "type": "string", "nullable": true } }, "additionalProperties": false, "required": [ "platformId" ] }, "CommandPlanUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "platformId": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "permanent": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "commandSets": { "type": "array", "items": { "$ref": "#/components/schemas/CommandSet" }, "nullable": true }, "connectionType": { "type": "string", "nullable": true } }, "additionalProperties": false, "required": [ "id", "platformId" ] }, "CommandRestriction": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "description": "Unique identifier." }, "name": { "maxLength": 256, "minLength": 1, "type": "string", "description": "Unique name." }, "emailRecipient": { "type": "string", "format": "email", "nullable": true, "description": "Email address to send notifications to. Omit the property when not used; an empty string fails validation." }, "commandRestrictionSettings": { "type": "array", "items": { "$ref": "#/components/schemas/CommandRestrictionSetting" }, "description": "The rules.", "nullable": true }, "nodeId": { "type": "string", "format": "uuid", "description": "Identifier of the server node that stores this record. Do not send it when you create the record." }, "createdDateTimeUtc": { "type": "string", "format": "date-time", "description": "Date and time in UTC when the record was created." }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time", "description": "Date and time in UTC when the record was last modified." } }, "additionalProperties": false, "required": [ "name" ], "description": "A named set of rules that restrict the commands typed in a session." }, "CommandRestrictionActionType": { "enum": [ 0, 1, 2, 3 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "LogOnly", "Block", "BlockAndLock", "Terminate" ], "description": "Integer values: 0 = LogOnly, 1 = Block, 2 = BlockAndLock, 3 = Terminate." }, "CommandRestrictionMatchType": { "enum": [ 0 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Keyword" ], "description": "Integer values: 0 = Keyword." }, "CommandRestrictionSetting": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "commandRestrictionId": { "type": "string", "format": "uuid", "description": "Id of the command restriction this setting belongs to. The server sets it on update." }, "commandRestrictionSettingNumber": { "type": "integer", "format": "int32", "description": "Number of the setting within the restriction." }, "active": { "type": "boolean", "description": "Whether the setting is active." }, "email": { "type": "boolean", "description": "Whether to send an email when the setting matches." }, "emailRecipient": { "type": "string", "description": "Email recipient copied from the parent command restriction. Not stored on the setting.", "nullable": true }, "lockMessage": { "type": "string", "description": "Custom message shown when the session is locked.", "nullable": true }, "commandRestrictionMatchType": { "$ref": "#/components/schemas/CommandRestrictionMatchType" }, "commandRestrictionActionType": { "$ref": "#/components/schemas/CommandRestrictionActionType" }, "match": { "type": "string", "description": "Text to match.", "nullable": true }, "nodeId": { "type": "string", "format": "uuid", "description": "Identifier of the server node that stores this record. Do not send it." }, "createdDateTimeUtc": { "type": "string", "format": "date-time", "description": "Date and time in UTC when the record was created." }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time", "description": "Date and time in UTC when the record was last modified." } }, "additionalProperties": false, "description": "One rule of a command restriction." }, "CommandRestrictionUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "description": "Unique identifier." }, "name": { "maxLength": 256, "minLength": 1, "type": "string", "description": "Unique name." }, "emailRecipient": { "type": "string", "format": "email", "nullable": true, "description": "Email address to send notifications to. Omit the property when not used; an empty string fails validation." }, "commandRestrictionSettings": { "type": "array", "items": { "$ref": "#/components/schemas/CommandRestrictionSetting" }, "description": "The rules.", "nullable": true }, "nodeId": { "type": "string", "format": "uuid", "description": "Identifier of the server node that stores this record. Do not send it when you create the record." }, "createdDateTimeUtc": { "type": "string", "format": "date-time", "description": "Date and time in UTC when the record was created." }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time", "description": "Date and time in UTC when the record was last modified." } }, "additionalProperties": false, "required": [ "name", "id" ], "description": "A named set of rules that restrict the commands typed in a session." }, "CommandResultAction": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "commandId": { "type": "string", "format": "uuid" }, "expectedResult": { "type": "string", "nullable": true }, "expectedResultIsSuffix": { "type": "boolean" }, "expectedResultIsPrefix": { "type": "boolean" }, "isRegex": { "type": "boolean" }, "isTermBreak": { "type": "boolean" }, "isForceTermBreak": { "type": "boolean" }, "isError": { "type": "boolean" }, "continueOnError": { "type": "boolean" }, "executionOrder": { "type": "integer", "format": "int32" }, "jumpToCommandId": { "type": "string", "format": "uuid", "nullable": true }, "jumpToCommandSetId": { "type": "string", "format": "uuid", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "CommandSet": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "commandPlanId": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "executionOrder": { "type": "integer", "format": "int32" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "commands": { "type": "array", "items": { "$ref": "#/components/schemas/Command" }, "nullable": true } }, "additionalProperties": false }, "ConnectionProfileInfo": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true } }, "additionalProperties": false, "description": "Summary information about a connection profile." }, "ConnectorConfiguration": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for available connector.", "format": "uuid" }, "name": { "type": "string", "description": "Name for configuration type of connector.", "nullable": true }, "integrationConnector": { "$ref": "#/components/schemas/IntegrationConnector" }, "integrationConnectorTemplate": { "$ref": "#/components/schemas/IntegrationConnectorTemplate" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "An integration connector for Netwrix products and available third-party apps." }, "ConnectorConfigurationValue": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for connector configuration values.", "format": "uuid" }, "configurationId": { "type": "string", "description": "Unique identifier of connector configuration set.", "format": "uuid" }, "name": { "type": "string", "description": "Name of configuration value.", "nullable": true }, "value": { "type": "string", "description": "Set value for configuration.", "nullable": true }, "defaultValue": { "type": "string", "description": "Default value for configuration.", "nullable": true }, "description": { "type": "string", "description": "Description for configuration set.", "nullable": true }, "displayOrder": { "type": "integer", "description": "Position of this setting in the list shown in the console.", "format": "int32" }, "required": { "type": "boolean", "description": "Determines whether a configuration value is required or optional." }, "connectorId": { "type": "string", "description": "Unique identifier of integration connector", "format": "uuid", "nullable": true }, "integrationConnectorTemplateId": { "type": "string", "description": "Unique identifier of integration connector", "format": "uuid", "nullable": true }, "connectorConfiguration": { "$ref": "#/components/schemas/ConnectorConfiguration" }, "type": { "$ref": "#/components/schemas/ConnectorConfigurationValueType" }, "advanced": { "type": "boolean", "description": "Advanced setting" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "helperText": { "type": "string", "description": "Helper text displayed beneath the field in the UI.", "nullable": true } }, "additionalProperties": false, "description": "An integration connector for Netwrix products and available third-party apps." }, "ConnectorConfigurationValueType": { "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Uri", "HostName", "Token", "Credential", "User", "Resource", "String", "Int32", "Int64", "Boolean", "Options", "Password", "PowerShell" ], "description": "Integer values: 0 = Uri, 1 = HostName, 2 = Token, 3 = Credential, 4 = User, 5 = Resource, 6 = String, 7 = Int32, 8 = Int64, 9 = Boolean, 10 = Options, 11 = Password, 12 = PowerShell." }, "ConnectorInfoUpdateRequest": { "type": "object", "properties": { "connectorId": { "type": "string", "format": "uuid" } }, "additionalProperties": false, "required": [ "connectorId" ] }, "ConsoleAccessMemberCandidateView": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "username": { "type": "string", "nullable": true }, "lastLogonTimestamp": { "type": "string", "format": "date-time", "nullable": true }, "email": { "type": "string", "nullable": true }, "entityType": { "$ref": "#/components/schemas/ManagedAccountKind" }, "displayName": { "type": "string", "nullable": true } }, "additionalProperties": false }, "ConsoleAccessMemberView": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "managedAccountId": { "type": "string", "format": "uuid", "nullable": true }, "managedAccountGroupId": { "type": "string", "format": "uuid", "nullable": true }, "userAndGroupCollectionId": { "type": "string", "format": "uuid", "nullable": true }, "activeDirectoryGroupId": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "nullable": true }, "username": { "type": "string", "nullable": true }, "lastLogonTimestamp": { "type": "string", "format": "date-time", "nullable": true }, "email": { "type": "string", "nullable": true }, "entityType": { "$ref": "#/components/schemas/ManagedAccountKind" } }, "additionalProperties": false }, "CreateLocalUserRequest": { "type": "object", "properties": { "managedAccountView": { "$ref": "#/components/schemas/ManagedAccountView" }, "localUserPasswordChangeRequest": { "$ref": "#/components/schemas/LocalUserPasswordChangeRequest" }, "changePasswordNextLogin": { "type": "boolean" } }, "additionalProperties": false }, "Credential": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this credential.", "format": "uuid" }, "domain": { "type": "string", "description": "Domain", "nullable": true }, "username": { "type": "string", "description": "Username", "nullable": true }, "password": { "type": "string", "description": "Password (encrypted while persisted). Returned only when the server includes secrets.", "nullable": true }, "salt": { "type": "string", "nullable": true, "description": "Some salt for the password encryption. Never returned in responses.", "writeOnly": true }, "enablePassword": { "type": "string", "description": "Enable Password (encrypted while persisted). Returned only when the server includes secrets and the value is not empty.", "nullable": true }, "enableSalt": { "type": "string", "nullable": true, "description": "Some salt for the enable password encryption. Never returned in responses.", "writeOnly": true }, "name": { "type": "string", "description": "Name for this username password pair", "nullable": true }, "description": { "type": "string", "description": "Description for username password pair", "nullable": true }, "type": { "$ref": "#/components/schemas/CredentialType" }, "userId": { "type": "string", "description": "Host User Id, if there is one", "format": "uuid", "nullable": true }, "managedAccountId": { "type": "string", "description": "Host User Id, if there is one", "format": "uuid", "nullable": true }, "platformId": { "type": "string", "description": "Platform identifier for these credentials Use this to group credentials for a platform", "format": "uuid", "nullable": true }, "platform": { "$ref": "#/components/schemas/Platform" }, "sudoCommand": { "type": "string", "description": "Command to use for elevated commands on Linux, default \"sudo\".", "nullable": true }, "passwordVaultConnectorId": { "type": "string", "description": "Id for password vault integration connector for these credentials Use this to manage credentials for this user.", "format": "uuid", "nullable": true }, "passwordVaultConnector": { "$ref": "#/components/schemas/IntegrationConnector" }, "passwordVaultInfo": { "type": "string", "description": "Extra info needed for password vault integration.", "nullable": true }, "changeOnCheckout": { "type": "boolean", "description": "Settings for managed users on checkout change", "nullable": true }, "changeOnRelease": { "type": "boolean", "description": "Settings for managed users on release change", "nullable": true }, "showPassword": { "type": "boolean", "description": "Server-side flag that controls whether secrets are returned. Never returned in responses.", "writeOnly": true }, "credentialJoin": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialJoin" }, "nullable": true, "readOnly": true }, "isDeleted": { "type": "boolean", "description": "Credentials are marked as deleted when the owning user is removed" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "authenticationMethod": { "$ref": "#/components/schemas/AuthenticationMethodType" }, "keyGenAlgorithm": { "type": "string", "nullable": true }, "keyLength": { "type": "integer", "format": "int32", "nullable": true }, "autoGenPassphrase": { "type": "boolean", "nullable": true }, "passphrase": { "type": "string", "description": "Passphrase for the private key. Returned only when the server includes secrets.", "nullable": true }, "privateKey": { "type": "string", "description": "Private key. Returned only when the server includes secrets.", "nullable": true }, "publicKey": { "type": "string", "description": "Public key. Returned only when the server includes secrets.", "nullable": true }, "comment": { "type": "string", "maxLength": 1000, "nullable": true }, "postSessionAction": { "$ref": "#/components/schemas/PostSessionAction" } }, "additionalProperties": false, "description": "The stored credentials of a user." }, "CredentialCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this credential.", "format": "uuid" }, "domain": { "type": "string", "description": "Domain", "nullable": true }, "username": { "type": "string", "description": "Username" }, "password": { "type": "string", "description": "Password (encrypted while persisted). Returned only when the server includes secrets.", "nullable": true }, "salt": { "type": "string", "nullable": true, "description": "Some salt for the password encryption. Never returned in responses.", "writeOnly": true }, "enablePassword": { "type": "string", "description": "Enable Password (encrypted while persisted). Returned only when the server includes secrets and the value is not empty.", "nullable": true }, "enableSalt": { "type": "string", "nullable": true, "description": "Some salt for the enable password encryption. Never returned in responses.", "writeOnly": true }, "name": { "type": "string", "description": "Name for this username password pair", "nullable": true }, "description": { "type": "string", "description": "Description for username password pair", "nullable": true }, "type": { "$ref": "#/components/schemas/CredentialType" }, "userId": { "type": "string", "description": "Host User Id, if there is one", "format": "uuid", "nullable": true }, "managedAccountId": { "type": "string", "description": "Host User Id, if there is one", "format": "uuid", "nullable": true }, "platformId": { "type": "string", "description": "Platform identifier for these credentials Use this to group credentials for a platform", "format": "uuid", "nullable": true }, "platform": { "$ref": "#/components/schemas/Platform" }, "sudoCommand": { "type": "string", "description": "Command to use for elevated commands on Linux, default \"sudo\".", "nullable": true }, "passwordVaultConnectorId": { "type": "string", "description": "Id for password vault integration connector for these credentials Use this to manage credentials for this user.", "format": "uuid", "nullable": true }, "passwordVaultConnector": { "$ref": "#/components/schemas/IntegrationConnector" }, "passwordVaultInfo": { "type": "string", "description": "Extra info needed for password vault integration.", "nullable": true }, "changeOnCheckout": { "type": "boolean", "description": "Settings for managed users on checkout change", "nullable": true }, "changeOnRelease": { "type": "boolean", "description": "Settings for managed users on release change", "nullable": true }, "showPassword": { "type": "boolean", "description": "Server-side flag that controls whether secrets are returned. Never returned in responses.", "writeOnly": true }, "credentialJoin": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialJoin" }, "nullable": true, "readOnly": true }, "isDeleted": { "type": "boolean", "description": "Credentials are marked as deleted when the owning user is removed" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "authenticationMethod": { "$ref": "#/components/schemas/AuthenticationMethodType" }, "keyGenAlgorithm": { "type": "string", "nullable": true }, "keyLength": { "type": "integer", "format": "int32", "nullable": true }, "autoGenPassphrase": { "type": "boolean", "nullable": true }, "passphrase": { "type": "string", "description": "Passphrase for the private key. Returned only when the server includes secrets.", "nullable": true }, "privateKey": { "type": "string", "description": "Private key. Returned only when the server includes secrets.", "nullable": true }, "publicKey": { "type": "string", "description": "Public key. Returned only when the server includes secrets.", "nullable": true }, "comment": { "type": "string", "maxLength": 1000, "nullable": true }, "postSessionAction": { "$ref": "#/components/schemas/PostSessionAction" } }, "additionalProperties": false, "description": "The stored credentials of a user.", "required": [ "username" ] }, "CredentialGroup": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "credentialJoin": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialJoin" }, "nullable": true, "readOnly": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "CredentialGroupCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "credentialJoin": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialJoin" }, "nullable": true, "readOnly": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "name" ] }, "CredentialGroupPolicyJoin": { "type": "object", "properties": { "accessControlPolicyId": { "type": "string", "format": "uuid" }, "credentialGroupId": { "type": "string", "format": "uuid" }, "credentialGroup": { "$ref": "#/components/schemas/CredentialGroup" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "CredentialHostUserAndCredentialGroupView": { "type": "object", "properties": { "id": { "type": "string", "description": "User Id or Credential Id or Credential Group Id", "format": "uuid" }, "credentialId": { "type": "string", "description": "Credential Id", "format": "uuid", "nullable": true }, "displayName": { "type": "string", "description": "Credential dislay name", "nullable": true }, "domain": { "type": "string", "description": "Credential domain/resource", "nullable": true }, "passwordStatus": { "$ref": "#/components/schemas/VerificationScanStatus" }, "managedType": { "$ref": "#/components/schemas/ManagedType" }, "rotationType": { "$ref": "#/components/schemas/ManagedUserType" }, "credentialType": { "$ref": "#/components/schemas/CredentialType" }, "privilege": { "$ref": "#/components/schemas/UserPrivilege" }, "entityType": { "$ref": "#/components/schemas/CredentialOrHostUser" } }, "additionalProperties": false }, "CredentialJoin": { "type": "object", "properties": { "credentialId": { "type": "string", "description": "Id of credential.", "format": "uuid" }, "credential": { "$ref": "#/components/schemas/Credential" }, "credentialGroupId": { "type": "string", "description": "Id of credential group.", "format": "uuid" }, "credentialGroup": { "$ref": "#/components/schemas/CredentialGroup" } }, "additionalProperties": false, "description": "Links credentials to credential groups." }, "CredentialOrHostUser": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Credential", "CredentialGroup", "HostUser" ], "description": "Integer values: 0 = Credential, 1 = CredentialGroup, 2 = HostUser." }, "CredentialOrHostUserId": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "entityType": { "$ref": "#/components/schemas/CredentialOrHostUser" } }, "additionalProperties": false }, "CredentialPasswordHistoryOptions": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "historicalPasswordLimit": { "type": "integer", "format": "int32" }, "daysOfPasswordRetention": { "type": "integer", "format": "int32" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "CredentialPasswordHistoryOptionsUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "historicalPasswordLimit": { "type": "integer", "format": "int32" }, "daysOfPasswordRetention": { "type": "integer", "format": "int32" }, "nodeId": { "type": "string", "format": "uuid", "readOnly": true }, "createdDateTimeUtc": { "type": "string", "format": "date-time", "readOnly": true }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time", "readOnly": true } }, "additionalProperties": false, "required": [ "id" ] }, "CredentialPolicyCandidateView": { "type": "object", "properties": { "id": { "type": "string", "description": "Credential Id", "format": "uuid" }, "username": { "type": "string", "description": "Credential username", "nullable": true }, "name": { "type": "string", "description": "Credential name", "nullable": true }, "description": { "type": "string", "description": "Credential group description", "nullable": true }, "domain": { "type": "string", "description": "Credential domain/resource", "nullable": true }, "userId": { "type": "string", "description": "Credential user id", "format": "uuid", "nullable": true }, "os": { "type": "string", "description": "Credential resource operating system or domain functional level", "nullable": true }, "activeSessionCount": { "type": "integer", "description": "Number of active sessions for credential", "format": "int32" }, "entityType": { "$ref": "#/components/schemas/CredentialOrHostUser" }, "vaultConnectorId": { "type": "string", "format": "uuid", "nullable": true }, "platformId": { "type": "string", "description": "Credential Platform id", "format": "uuid", "nullable": true } }, "additionalProperties": false, "description": "Credential Policy Credentials by Policy Id" }, "CredentialPolicyCredentialView": { "type": "object", "properties": { "id": { "type": "string", "description": "Credential Id", "format": "uuid" }, "username": { "type": "string", "description": "Credential username", "nullable": true }, "name": { "type": "string", "description": "Credential name", "nullable": true }, "userId": { "type": "string", "description": "Credential user id", "format": "uuid", "nullable": true }, "policyId": { "type": "string", "description": "Policy Id to which the credential is assigned", "format": "uuid" }, "os": { "type": "string", "description": "Credential resource operating system or domain functional level", "nullable": true }, "activeSessionCount": { "type": "integer", "description": "Number of active sessions for credential", "format": "int32" }, "entityType": { "$ref": "#/components/schemas/CredentialOrHostUser" }, "azureAdTenantId": { "type": "string", "format": "uuid", "nullable": true, "description": "Credential azure ad tenant id" }, "domainId": { "type": "string", "format": "uuid", "nullable": true, "description": "Credential domain id" }, "managedDatabaseId": { "type": "string", "format": "uuid", "nullable": true, "description": "Credential database id" }, "platformId": { "type": "string", "format": "uuid", "nullable": true }, "resourceId": { "type": "string", "format": "uuid", "nullable": true, "description": "Credential resource id" }, "resourceName": { "type": "string", "nullable": true, "description": "Credential resource name" }, "secretVaultId": { "type": "string", "format": "uuid", "nullable": true, "description": "Credential secret vault id" }, "websiteId": { "type": "string", "format": "uuid", "nullable": true, "description": "Credential website id" } }, "additionalProperties": false, "description": "Credential Policy Credentials by Policy Id" }, "CredentialPolicyJoin": { "type": "object", "properties": { "accessControlPolicyId": { "type": "string", "format": "uuid" }, "credentialId": { "type": "string", "format": "uuid" }, "credential": { "$ref": "#/components/schemas/Credential" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "CredentialResult": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "credentialId": { "type": "string", "format": "uuid", "nullable": true }, "userName": { "type": "string", "nullable": true }, "displayName": { "type": "string", "nullable": true }, "lastVerifiedDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "status": { "type": "string", "nullable": true }, "lastPasswordChangeDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "nextPasswordChangeDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "age": { "type": "integer", "format": "int32" }, "userId": { "type": "string", "format": "uuid", "nullable": true }, "managedUserId": { "type": "string", "format": "uuid", "nullable": true }, "samAccountName": { "type": "string", "nullable": true }, "userPrincipalName": { "type": "string", "nullable": true }, "dependencyCount": { "type": "integer", "format": "int32" }, "managedType": { "$ref": "#/components/schemas/ManagedType" }, "rotationType": { "$ref": "#/components/schemas/ManagedUserType" }, "credentialType": { "$ref": "#/components/schemas/CredentialType" }, "domain": { "type": "string", "nullable": true }, "resource": { "type": "string", "nullable": true }, "platform": { "type": "string", "nullable": true }, "platformId": { "type": "string", "format": "uuid", "nullable": true }, "managedResourceId": { "type": "string", "format": "uuid", "nullable": true }, "secretVaultId": { "type": "string", "format": "uuid", "nullable": true }, "websiteId": { "type": "string", "format": "uuid", "nullable": true }, "azureAdTenantId": { "type": "string", "format": "uuid", "nullable": true }, "managedDatabaseId": { "type": "string", "format": "uuid", "nullable": true }, "domainConfigId": { "type": "string", "format": "uuid", "nullable": true }, "passwordStatus": { "$ref": "#/components/schemas/VerificationScanStatus" }, "privilege": { "$ref": "#/components/schemas/UserPrivilege" }, "privilegeName": { "type": "string", "nullable": true }, "lastLogonTimestamp": { "type": "string", "format": "date-time", "nullable": true }, "comment": { "type": "string", "nullable": true } }, "additionalProperties": false }, "CredentialSearchManagedFilter": { "enum": [ -1, 0, 1, 2, 3 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "All", "NotManaged", "Managed", "Automatic", "Manual" ], "description": "Integer values: -1 = All, 0 = NotManaged, 1 = Managed, 2 = Automatic, 3 = Manual." }, "CredentialSummary": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "domain": { "type": "string", "nullable": true }, "username": { "type": "string", "nullable": true }, "password": { "type": "string", "nullable": true }, "salt": { "type": "string", "nullable": true }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "type": { "$ref": "#/components/schemas/CredentialType" }, "userId": { "type": "string", "format": "uuid", "nullable": true }, "platformId": { "type": "string", "format": "uuid", "nullable": true }, "platform": { "$ref": "#/components/schemas/Platform" }, "sudoCommand": { "type": "string", "nullable": true }, "changeOnCheckout": { "type": "boolean", "nullable": true }, "changeOnRelease": { "type": "boolean", "nullable": true }, "passwordVaultConnectorId": { "type": "string", "format": "uuid", "nullable": true }, "passwordVaultConnector": { "$ref": "#/components/schemas/IntegrationConnector" }, "passwordVaultInfo": { "type": "string", "nullable": true }, "isDeleted": { "type": "boolean" }, "isManaged": { "type": "boolean" }, "authenticationMethod": { "$ref": "#/components/schemas/AuthenticationMethodType" }, "autoGenPassphrase": { "type": "boolean", "nullable": true }, "passphrase": { "type": "string", "nullable": true }, "privateKey": { "type": "string", "nullable": true }, "publicKey": { "type": "string", "nullable": true }, "keyGenAlgorithm": { "type": "string", "nullable": true }, "keyLength": { "type": "integer", "format": "int32", "nullable": true }, "comment": { "type": "string", "nullable": true } }, "additionalProperties": false }, "CredentialType": { "enum": [ -1, 0, 1, 2, 3, 4, 5, 6 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Any", "Configuration", "User", "Service", "ActivityToken", "Application", "VaultUser", "SshKeyCert" ], "description": "Integer values: -1 = Any, 0 = Configuration, 1 = User, 2 = Service, 3 = ActivityToken, 4 = Application, 5 = VaultUser, 6 = SshKeyCert." }, "CredentialUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this credential.", "format": "uuid" }, "domain": { "type": "string", "description": "Domain", "nullable": true }, "username": { "type": "string", "description": "Username", "nullable": true }, "password": { "type": "string", "description": "Password (encrypted while persisted). Returned only when the server includes secrets.", "nullable": true }, "salt": { "type": "string", "nullable": true, "description": "Some salt for the password encryption. Never returned in responses.", "writeOnly": true }, "enablePassword": { "type": "string", "description": "Enable Password (encrypted while persisted). Returned only when the server includes secrets and the value is not empty.", "nullable": true }, "enableSalt": { "type": "string", "nullable": true, "description": "Some salt for the enable password encryption. Never returned in responses.", "writeOnly": true }, "name": { "type": "string", "description": "Name for this username password pair", "nullable": true }, "description": { "type": "string", "description": "Description for username password pair", "nullable": true }, "type": { "$ref": "#/components/schemas/CredentialType" }, "userId": { "type": "string", "description": "Host User Id, if there is one", "format": "uuid", "nullable": true }, "managedAccountId": { "type": "string", "description": "Host User Id, if there is one", "format": "uuid", "nullable": true }, "platformId": { "type": "string", "description": "Platform identifier for these credentials Use this to group credentials for a platform", "format": "uuid", "nullable": true }, "platform": { "$ref": "#/components/schemas/Platform" }, "sudoCommand": { "type": "string", "description": "Command to use for elevated commands on Linux, default \"sudo\".", "nullable": true }, "passwordVaultConnectorId": { "type": "string", "description": "Id for password vault integration connector for these credentials Use this to manage credentials for this user.", "format": "uuid", "nullable": true }, "passwordVaultConnector": { "$ref": "#/components/schemas/IntegrationConnector" }, "passwordVaultInfo": { "type": "string", "description": "Extra info needed for password vault integration.", "nullable": true }, "changeOnCheckout": { "type": "boolean", "description": "Settings for managed users on checkout change", "nullable": true }, "changeOnRelease": { "type": "boolean", "description": "Settings for managed users on release change", "nullable": true }, "showPassword": { "type": "boolean", "description": "Server-side flag that controls whether secrets are returned. Never returned in responses.", "writeOnly": true }, "credentialJoin": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialJoin" }, "nullable": true, "readOnly": true }, "isDeleted": { "type": "boolean", "description": "Credentials are marked as deleted when the owning user is removed" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "authenticationMethod": { "$ref": "#/components/schemas/AuthenticationMethodType" }, "keyGenAlgorithm": { "type": "string", "nullable": true }, "keyLength": { "type": "integer", "format": "int32", "nullable": true }, "autoGenPassphrase": { "type": "boolean", "nullable": true }, "passphrase": { "type": "string", "description": "Passphrase for the private key. Returned only when the server includes secrets.", "nullable": true }, "privateKey": { "type": "string", "description": "Private key. Returned only when the server includes secrets.", "nullable": true }, "publicKey": { "type": "string", "description": "Public key. Returned only when the server includes secrets.", "nullable": true }, "comment": { "type": "string", "maxLength": 1000, "nullable": true }, "postSessionAction": { "$ref": "#/components/schemas/PostSessionAction" } }, "additionalProperties": false, "description": "The stored credentials of a user.", "required": [ "id" ] }, "CustomField": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "activityConfigurationId": { "type": "string", "format": "uuid" }, "customFieldNumber": { "type": "integer", "format": "int32" }, "name": { "type": "string", "nullable": true }, "label": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "options": { "type": "string", "nullable": true }, "length": { "type": "integer", "format": "int32", "nullable": true }, "customFieldDataType": { "$ref": "#/components/schemas/CustomFieldDataType" }, "required": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "CustomFieldDataType": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Integer", "String", "Options" ], "description": "Integer values: 0 = Integer, 1 = String, 2 = Options." }, "CustomFieldValue": { "type": "object", "properties": { "policyId": { "type": "string", "format": "uuid" }, "customFieldDataType": { "$ref": "#/components/schemas/CustomFieldDataType" }, "name": { "type": "string", "nullable": true }, "value": { "type": "string", "nullable": true } }, "additionalProperties": false }, "DataRetentionSettings": { "type": "object", "properties": { "enableSiemRetention": { "type": "boolean" }, "siemRetentionDays": { "type": "integer", "format": "int32", "description": "Range 1 to 3650.", "minimum": 1, "maximum": 3650 }, "enableEmailRetention": { "type": "boolean" }, "emailRetentionDays": { "type": "integer", "format": "int32", "description": "Range 1 to 3650.", "minimum": 1, "maximum": 3650 }, "enableIoLogRetention": { "type": "boolean" }, "ioLogRetentionDays": { "type": "integer", "format": "int32", "description": "Range 1 to 3650.", "minimum": 1, "maximum": 3650 } }, "additionalProperties": false }, "DataRetentionSettingsUpdateRequest": { "type": "object", "properties": { "enableSiemRetention": { "type": "boolean" }, "siemRetentionDays": { "type": "integer", "format": "int32", "description": "Range 1 to 3650.", "minimum": 1, "maximum": 3650 }, "enableEmailRetention": { "type": "boolean" }, "emailRetentionDays": { "type": "integer", "format": "int32", "description": "Range 1 to 3650.", "minimum": 1, "maximum": 3650 }, "enableIoLogRetention": { "type": "boolean" }, "ioLogRetentionDays": { "type": "integer", "format": "int32", "description": "Range 1 to 3650.", "minimum": 1, "maximum": 3650 } }, "additionalProperties": false, "required": [ "siemRetentionDays", "emailRetentionDays", "ioLogRetentionDays" ] }, "DataTableOfAccessCertRowTable": { "type": "object", "additionalProperties": false, "description": "A page of search results.", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/AccessCertRowTable" }, "nullable": true, "description": "The rows on this page." }, "recordsTotal": { "type": "integer", "format": "int32", "description": "Total number of matching records; data may hold only one page of them." } } }, "DataTableOfAccessCertUserTable": { "type": "object", "additionalProperties": false, "description": "A page of search results.", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/AccessCertUserTable" }, "nullable": true, "description": "The rows on this page." }, "recordsTotal": { "type": "integer", "format": "int32", "description": "Total number of matching records; data may hold only one page of them." } } }, "DataTableOfAccessPolicyObject": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/AccessPolicyObject" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfActionJobSchedule": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ActionJobSchedule" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfActionQueueActionInfoView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ActionQueueActionInfoView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfActionQueueSearchResult": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ActionQueueSearchResult" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfActiveDirectoryGroup": { "type": "object", "additionalProperties": false, "description": "A page of search results.", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectoryGroup" }, "nullable": true, "description": "The records on this page." }, "recordsTotal": { "type": "integer", "format": "int32", "description": "Total number of matching records; data may hold only one page of them." } } }, "DataTableOfActivity": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Activity" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfActivityAndGroupView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityAndGroupView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfActivityCard": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityCard" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfActivityCardWithPolicies": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityCardWithPolicies" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfAuditChangeRow": { "type": "object", "additionalProperties": false, "description": "The record types in the change audit log and how many there are.", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/AuditChangeRow" }, "description": "The records on this page." }, "recordsTotal": { "type": "integer", "format": "int32", "description": "Total number of matching records; data may hold only one page of them." } } }, "DataTableOfConsoleAccessMemberCandidateView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ConsoleAccessMemberCandidateView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfConsoleAccessMemberView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ConsoleAccessMemberView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfCredentialHostUserAndCredentialGroupView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialHostUserAndCredentialGroupView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfCredentialPolicyCandidateView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialPolicyCandidateView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfCredentialPolicyCredentialView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialPolicyCredentialView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfCredentialResult": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/CredentialResult" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfDatabaseDomainUserView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/DatabaseDomainUserView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfDatabaseRole": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/DatabaseRole" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfEncryptedFile": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/EncryptedFile" }, "nullable": true, "description": "The records on this page." }, "recordsTotal": { "type": "integer", "format": "int32", "description": "Total number of matching records; data may hold only one page of them." } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfEventMessage": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/EventMessage" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfGroupActivityCard": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/GroupActivityCard" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfGroupRoleCandidate": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/GroupRoleCandidate" }, "nullable": true, "description": "The records on this page." }, "recordsTotal": { "type": "integer", "format": "int32", "description": "Total number of matching records; data may hold only one page of them." } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfHostDatabase": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/HostDatabase" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfHostFeature": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/HostFeature" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfHostGroup": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/HostGroup" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfHostScheduledTask": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/HostScheduledTask" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfHostScheduledTaskView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/HostScheduledTaskView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfHostService": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/HostService" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfHostServiceView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/HostServiceView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfHostUser": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/HostUser" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfManagedAccountAndCollectionsView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountAndCollectionsView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfManagedAccountCandidateView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountCandidateView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfManagedAccountGroupCandidateView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountGroupCandidateView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfManagedAccountInfo": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountInfo" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfManagedAccountView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfManagedResourceAndGroupView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceAndGroupView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfManagedResourceCandidateView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceCandidateView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfManagedResourceGroupNameAndId": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceGroupNameAndId" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfManagedResourceLocalUserView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceLocalUserView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfManagedResourceSkeleton": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceSkeleton" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfManagedResourceView": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceView" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfManagedUserCredential": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedUserCredential" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfObject": { "type": "object", "properties": { "data": { "type": "array", "items": {}, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfRolesRole": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/RolesRole" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfSessionSummary": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/SessionSummary" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfSimpleAccessControlPolicy": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/SimpleAccessControlPolicy" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfSimpleProtectionPolicy": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/SimpleProtectionPolicy" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfUserRoleAssignment": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/UserRoleAssignment" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DataTableOfWebsiteUri": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/WebsiteUri" }, "description": "The records on this page.", "nullable": true }, "recordsTotal": { "type": "integer", "description": "Total number of matching records; data may hold only one page of them.", "format": "int32" } }, "additionalProperties": false, "description": "A page of search results." }, "DatabaseDomainUserView": { "type": "object", "properties": { "hostId": { "type": "string", "format": "uuid" }, "groupId": { "type": "string", "format": "uuid", "nullable": true }, "id": { "type": "string", "format": "uuid" }, "memberName": { "type": "string", "nullable": true }, "memberType": { "$ref": "#/components/schemas/ManagedAccountKind" } }, "additionalProperties": false }, "DatabaseRole": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "databaseId": { "type": "string", "format": "uuid", "nullable": true }, "roleName": { "type": "string", "nullable": true }, "databaseName": { "type": "string", "nullable": true }, "memberList": { "type": "array", "items": { "$ref": "#/components/schemas/RoleMember" }, "nullable": true } }, "additionalProperties": false }, "DatabaseType": { "enum": [ -1, 0, 1, 2, 3, 4 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Unknown", "PostgreSQL", "SqlServer", "Sqlite", "Oracle", "MySql" ], "description": "Integer values: -1 = Unknown, 0 = PostgreSQL, 1 = SqlServer, 2 = Sqlite, 3 = Oracle, 4 = MySql." }, "DayOfWeek": { "enum": [ 0, 1, 2, 3, 4, 5, 6 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday" ], "description": "Integer values: 0 = Sunday, 1 = Monday, 2 = Tuesday, 3 = Wednesday, 4 = Thursday, 5 = Friday, 6 = Saturday." }, "DomainNames": { "type": "object", "properties": { "domainConfigId": { "type": "string", "format": "uuid" }, "fqdn": { "type": "string", "nullable": true }, "netbios": { "type": "string", "nullable": true } }, "additionalProperties": false }, "Email": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this email.", "format": "uuid" }, "expiresDateTimeUtc": { "type": "string", "description": "When this email expires, after which it won't be sent.", "format": "date-time", "nullable": true }, "emailSettingsId": { "type": "string", "description": "Id of email settings used for sending this email.", "format": "uuid", "nullable": true }, "emailSettings": { "$ref": "#/components/schemas/EmailSettings" }, "subject": { "type": "string", "description": "Subject for this email.", "nullable": true }, "toAddress": { "type": "string", "description": "Destination email addresses, for example user@example.com.", "nullable": true }, "htmlBody": { "type": "string", "description": "HTML body of this email.", "nullable": true }, "importance": { "$ref": "#/components/schemas/EmailImportance" }, "priority": { "$ref": "#/components/schemas/EmailPriority" }, "wasSent": { "type": "boolean", "description": "True if this email was sent." }, "sentDateTimeUtc": { "type": "string", "description": "When this email was sent.", "format": "date-time", "nullable": true }, "attachmentPath": { "type": "string", "description": "api endpoint to fetch attachment", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "retryCount": { "type": "integer", "format": "int32", "description": "Number of times sending this email has been attempted and failed." }, "serviceId": { "type": "string", "format": "uuid", "nullable": true, "description": "ID of the service which claimed this email for sending." } }, "additionalProperties": false, "description": "The model represents an email message." }, "EmailConfiguration": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "websiteUrl": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "EmailConfigurationCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "websiteUrl": { "type": "string" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "websiteUrl", "id" ] }, "EmailCreateRequest": { "type": "object", "properties": { "subject": { "type": "string" }, "htmlBody": { "type": "string" }, "toAddress": { "type": "string" }, "fromAddress": { "type": "string" }, "useTls": { "type": "boolean" }, "useAuth": { "type": "boolean" }, "smtpHost": { "type": "string" }, "smtpPort": { "type": "integer", "format": "int32" }, "credentialId": { "type": "string", "format": "uuid", "nullable": true }, "importance": { "$ref": "#/components/schemas/EmailImportance" }, "priority": { "$ref": "#/components/schemas/EmailPriority" } }, "additionalProperties": false, "required": [ "subject", "htmlBody", "toAddress", "fromAddress", "smtpHost", "smtpPort" ] }, "EmailImportance": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Low", "Normal", "High" ], "description": "Integer values: 0 = Low, 1 = Normal, 2 = High." }, "EmailPriority": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "NonUrgent", "Normal", "Urgent" ], "description": "Integer values: 0 = NonUrgent, 1 = Normal, 2 = Urgent." }, "EmailRequest": { "type": "object", "properties": { "subject": { "type": "string", "nullable": true }, "htmlBody": { "type": "string", "nullable": true }, "toAddress": { "type": "string", "nullable": true }, "fromAddress": { "type": "string", "nullable": true }, "useTls": { "type": "boolean" }, "useAuth": { "type": "boolean" }, "smtpHost": { "type": "string", "nullable": true }, "smtpPort": { "type": "integer", "format": "int32" }, "credentialId": { "type": "string", "format": "uuid", "nullable": true }, "importance": { "$ref": "#/components/schemas/EmailImportance" }, "priority": { "$ref": "#/components/schemas/EmailPriority" } }, "additionalProperties": false }, "EmailSettings": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "sendNotification": { "type": "boolean" }, "useTls": { "type": "boolean" }, "useAuth": { "type": "boolean" }, "smtpHost": { "type": "string", "nullable": true }, "smtpPort": { "type": "integer", "format": "int32", "nullable": true }, "fromAddress": { "type": "string", "nullable": true }, "credentialId": { "type": "string", "format": "uuid", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "EmailSettingsUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "sendNotification": { "type": "boolean" }, "useTls": { "type": "boolean" }, "useAuth": { "type": "boolean" }, "smtpHost": { "type": "string", "nullable": true }, "smtpPort": { "type": "integer", "format": "int32", "nullable": true }, "fromAddress": { "type": "string", "nullable": true }, "credentialId": { "type": "string", "format": "uuid", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "id" ] }, "EmailTemplate": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this template.", "format": "uuid" }, "name": { "type": "string", "description": "Name for this template.", "nullable": true }, "description": { "type": "string", "description": "Description of this template.", "nullable": true }, "emailSettingsId": { "type": "string", "description": "Id of email settings used for sending email(s).", "format": "uuid", "nullable": true }, "emailSettings": { "$ref": "#/components/schemas/ActivityConfiguration" }, "htmlTemplate": { "type": "string", "description": "HTML template used for formatting email message.", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "This model is a template used to send an email to a user or group of users." }, "EmailTemplateUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this template.", "format": "uuid" }, "name": { "type": "string", "description": "Name for this template.", "nullable": true }, "description": { "type": "string", "description": "Description of this template.", "nullable": true }, "emailSettingsId": { "type": "string", "description": "Id of email settings used for sending email(s).", "format": "uuid", "nullable": true }, "emailSettings": { "$ref": "#/components/schemas/ActivityConfiguration" }, "htmlTemplate": { "type": "string", "description": "HTML template used for formatting email message.", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "This model is a template used to send an email to a user or group of users.", "required": [ "id" ] }, "EncryptedFile": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "description": "Unique identifier of the file." }, "secretVaultId": { "type": "string", "format": "uuid", "description": "Id of the secret vault that holds the file." }, "secretVaultName": { "type": "string", "nullable": true, "description": "Name of the secret vault." }, "name": { "type": "string", "nullable": true, "description": "File name." }, "size": { "type": "integer", "format": "int64", "description": "File size in bytes." }, "contentType": { "type": "string", "nullable": true, "description": "Media type recorded at upload." }, "content": { "type": "string", "format": "byte", "nullable": true, "description": "Encrypted file content, base64 encoded in JSON. The get-by-name and update operations return it empty; use the Download operation to get the file." }, "checksum": { "type": "string", "nullable": true, "description": "SHA-512 hash of the original file content, in hexadecimal." }, "description": { "type": "string", "nullable": true, "description": "Free-text description of the file." }, "createdBy": { "type": "string", "format": "uuid", "description": "Id of the user who uploaded the file." }, "modifiedBy": { "type": "string", "format": "uuid", "description": "Id of the user who last uploaded a replacement for the file." }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A file stored encrypted in a secret vault." }, "EncryptedFileSettings": { "type": "object", "properties": { "encryptedFileMaxSizeMb": { "type": "integer", "format": "int32", "description": "Maximum size of an uploaded encrypted file, in MB. Validated against the range 1 to 20.", "minimum": 1, "maximum": 20 }, "enableFileMalwareScan": { "type": "boolean", "description": "Scan uploaded encrypted files for malware." } }, "additionalProperties": false }, "EncryptedFileSettingsUpdateRequest": { "type": "object", "properties": { "encryptedFileMaxSizeMb": { "type": "integer", "format": "int32", "description": "Maximum size of an uploaded encrypted file, in MB. Validated against the range 1 to 20.", "minimum": 1, "maximum": 20 }, "enableFileMalwareScan": { "type": "boolean", "description": "Scan uploaded encrypted files for malware." } }, "additionalProperties": false, "required": [ "encryptedFileMaxSizeMb" ] }, "EventMessage": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of the message.", "format": "uuid" }, "eventTimeUtc": { "type": "string", "description": "DateTime in UTC that the event happened", "format": "date-time" }, "managedAccountId": { "type": "string", "description": "Optional Id of account that this event happened to", "format": "uuid", "nullable": true }, "managedAccount": { "$ref": "#/components/schemas/ManagedAccount" }, "managedResourceId": { "type": "string", "description": "Optional ID of the host that the event happened to.", "format": "uuid", "nullable": true }, "message": { "type": "string", "description": "Event message text.", "nullable": true }, "sourceHost": { "type": "string", "description": "Name of the host that generated the event, for example the host of the action service. That host may not be in the list of hosts, so the value is a name and not an ID.", "nullable": true }, "sessionId": { "type": "string", "description": "Optional ID of the activity session for this event.", "format": "uuid", "nullable": true }, "session": { "$ref": "#/components/schemas/ActivitySession" }, "serviceType": { "$ref": "#/components/schemas/EventServiceType" }, "eventType": { "$ref": "#/components/schemas/EventType" }, "status": { "$ref": "#/components/schemas/EventStatus" }, "loggedInUserId": { "type": "string", "description": "Id of user that caused this event to be generated.", "format": "uuid", "nullable": true }, "loggedInUserName": { "type": "string", "description": "Name of user that caused this event to be generated.", "nullable": true }, "loggedInFromIpAddress": { "type": "string", "description": "IP address of user that caused this event to be generated.", "nullable": true }, "accessPolicyName": { "type": "string", "description": "Name of access ploicy used to create session.", "nullable": true }, "actionQueueId": { "type": "string", "description": "Action Queue Id of action queue if this was generated by an action event", "format": "uuid", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "isRead": { "type": "boolean" } }, "additionalProperties": false }, "EventServiceType": { "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8 ], "type": "integer", "description": "Integer values: 0 = Unspecified, 1 = WebUi, 2 = ActionService, 3 = ProxyService, 4 = SchedulerService, 5 = EmailService, 6 = ADSyncService, 7 = RagGateway, 8 = RagPortal.", "format": "int32", "x-enum-varnames": [ "Unspecified", "WebUi", "ActionService", "ProxyService", "SchedulerService", "EmailService", "ADSyncService", "RagGateway", "RagPortal" ] }, "EventStatus": { "enum": [ 0, 1, 2 ], "type": "integer", "description": "Integer values: 0 = Information, 1 = Warning, 2 = Error.", "format": "int32", "x-enum-varnames": [ "Information", "Warning", "Error" ] }, "EventType": { "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 ], "type": "integer", "description": "Integer values: 0 = Unspecified, 1 = Status, 2 = ServiceStart, 3 = PasswordRotation, 4 = HostScan, 5 = ADSync, 6 = ActivitySession, 7 = Manage, 8 = Unmanage, 9 = Verify, 10 = RotateServices, 11 = CommandRestrictionAction.", "format": "int32", "x-enum-varnames": [ "Unspecified", "Status", "ServiceStart", "PasswordRotation", "HostScan", "ADSync", "ActivitySession", "Manage", "Unmanage", "Verify", "RotateServices", "CommandRestrictionAction" ] }, "FileDetail": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "size": { "type": "integer", "format": "int64" }, "contentType": { "type": "string", "nullable": true }, "checksum": { "type": "string", "nullable": true }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "Summary of one file stored by an upload." }, "FileUploadSummary": { "type": "object", "properties": { "secretVaultId": { "type": "string", "format": "uuid" }, "description": { "type": "string", "nullable": true }, "fileCount": { "type": "integer", "format": "int32" }, "totalSize": { "type": "integer", "format": "int64", "description": "Total size of the uploaded files in bytes." }, "uploadTime": { "type": "string", "nullable": true, "description": "Elapsed processing time, for example 12.5ms." }, "details": { "type": "array", "items": { "$ref": "#/components/schemas/FileDetail" }, "nullable": true } }, "additionalProperties": false, "description": "Result of a file upload to a secret vault." }, "GroupActivityCard": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "policyId": { "type": "string", "format": "uuid" }, "policyName": { "type": "string", "nullable": true }, "managedAccountGroupId": { "type": "string", "format": "uuid" }, "latestSessionActualStartUtc": { "type": "string", "format": "date-time", "nullable": true } }, "additionalProperties": false }, "GroupCollectionJoin": { "type": "object", "properties": { "managedAccountGroupId": { "type": "string", "description": "Id of Managed Account Group.", "format": "uuid" }, "managedAccountGroup": { "$ref": "#/components/schemas/ManagedAccountGroup" }, "userAndGroupCollectionId": { "type": "string", "description": "Id of User Collection.", "format": "uuid" }, "userAndGroupCollection": { "$ref": "#/components/schemas/UserAndGroupCollection" } }, "additionalProperties": false, "description": "Links managed account groups to user collections." }, "GroupRoleCandidate": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "description": "ID of the group or role." }, "name": { "type": "string", "nullable": true, "description": "Display name of the group or role." }, "type": { "type": "string", "nullable": true, "description": "Platform type: AD, Entra, SQL or Oracle." }, "platformId": { "type": "string", "format": "uuid", "description": "ID of the platform record in Privilege Secure: the Active Directory domain, the Entra tenant record or the managed database." }, "platformName": { "type": "string", "nullable": true, "description": "Name of the platform." }, "context": { "type": "string", "nullable": true, "description": "Extra context such as the domain name, tenant email domain or database name." }, "additionalInfo": { "type": "string", "nullable": true, "description": "Extra detail such as the sAMAccountName or the role description." }, "hostId": { "type": "string", "format": "uuid", "nullable": true, "description": "Host ID, for Entra groups and database roles." }, "hostDatabaseId": { "type": "string", "format": "uuid", "nullable": true, "description": "Database ID for database roles (SQL/Oracle)." }, "domainId": { "type": "string", "format": "uuid", "nullable": true, "description": "Domain ID for AD groups. Set by the by-ID route; the candidates list leaves it null." }, "tenantId": { "type": "string", "format": "uuid", "nullable": true, "description": "ID of the Entra tenant record in Privilege Secure (the same value as platformId), for Entra groups. This is not the Microsoft Entra directory (tenant) ID." } }, "additionalProperties": false }, "Host": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this host.", "format": "uuid", "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" }, "activeDirectoryObjectId": { "type": "string", "description": "Unique id from AD sync (usually same as Id).", "format": "uuid", "nullable": true }, "name": { "type": "string", "nullable": true }, "distinguishedName": { "type": "string", "description": "Distingished name from active directory", "nullable": true, "example": "CN=Host, CN=Computers, DC=example, DC=local" }, "ipAddress": { "type": "string", "description": "IP address of host.", "nullable": true, "example": "192.0.2.10" }, "os": { "type": "string", "description": "Name of OS on host.", "nullable": true, "example": "Windows Server 2022" }, "version": { "type": "string", "description": "Verion of OS on host.", "nullable": true, "example": "192.0.2.10" }, "lsaLookupCache": { "type": "string", "description": "Most recent value of the LSA lookup cache size setting on the host.", "nullable": true, "example": "10" }, "lastUpdatedDateTimeUtc": { "type": "string", "description": "Date/time of last system update.", "format": "date-time", "nullable": true, "example": "2024-03-27T18:25:43.511Z" }, "credentialId": { "type": "string", "description": "Id of service account for this host", "format": "uuid", "nullable": true, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, "hasSSH": { "type": "boolean", "description": "True if the host supports SSH.", "example": false }, "activeDirectoryDomainId": { "type": "string", "description": "Id of active directory domain if host is a member of a domain.", "format": "uuid", "nullable": true, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, "activeDirectoryDomain": { "$ref": "#/components/schemas/ActiveDirectoryDomain" }, "dnsHostName": { "type": "string", "description": "DNS hostname.", "nullable": true, "example": "host.example.local" }, "netBiosName": { "type": "string", "description": "NetBios hostname.", "nullable": true, "example": "HOST" }, "users": { "type": "array", "items": { "$ref": "#/components/schemas/HostUser" }, "description": "List of users associated with this host.", "nullable": true, "readOnly": true }, "groups": { "type": "array", "items": { "$ref": "#/components/schemas/HostGroup" }, "description": "List of groups associated with this host.", "nullable": true, "readOnly": true }, "features": { "type": "array", "items": { "$ref": "#/components/schemas/HostFeature" }, "description": "List of features installed on this host.", "nullable": true, "readOnly": true }, "services": { "type": "array", "items": { "$ref": "#/components/schemas/HostService" }, "description": "List of services that have accounts that can be managed.", "nullable": true, "readOnly": true }, "scheduledTasks": { "type": "array", "items": { "$ref": "#/components/schemas/HostScheduledTask" }, "description": "List of scheduled tasks that have accounts that can be managed.", "nullable": true, "readOnly": true }, "databases": { "type": "array", "items": { "$ref": "#/components/schemas/HostDatabase" }, "description": "List of SQL Server database server instances found on Windows host", "nullable": true, "readOnly": true }, "databaseDbs": { "type": "array", "items": { "$ref": "#/components/schemas/HostDatabaseDb" }, "description": "List of SQL Server databases found on Windows host", "nullable": true, "readOnly": true }, "databaseRoles": { "type": "array", "items": { "$ref": "#/components/schemas/HostDatabaseRole" }, "description": "List of SQL Server database roles found on Windows host", "nullable": true, "readOnly": true }, "samaccountname": { "type": "string", "description": "sAMAccountname for host (from ActiveDirectory) NOTE: this includes the NETBIOS name to make it unique", "nullable": true }, "isDomainController": { "type": "boolean", "description": "Boolean indicating if this host is a Domain Controller", "example": false }, "isGlobalCatalog": { "type": "boolean", "description": "Boolean indicating if this host is a Global Catalog server", "nullable": true, "example": false }, "usnChanged": { "type": "integer", "description": "USN from Active Directory", "format": "int64", "example": 12345 }, "objectSid": { "type": "string", "description": "SID from Active Directory", "nullable": true, "example": "S-1-5-21-1234567890-1234567890-123456789-123456" }, "added": { "type": "string", "description": "UTC Time of when host was Added to NPS", "format": "date-time", "example": "2024-03-27T01:01:01.555Z" }, "deleted": { "type": "boolean", "description": "True if this host has been deleted.", "example": false }, "isVirtual": { "type": "boolean", "description": "True if not a real host Used for AzureAD tenants", "example": false }, "nodeId": { "type": "string", "description": "Identifier of the server node that stores this record. Do not send it when you create the record.", "format": "uuid", "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" }, "createdDateTimeUtc": { "type": "string", "description": "Date and time in UTC when the record was created.", "format": "date-time", "example": "2024-01-01T05:07:08.555Z" }, "modifiedDateTimeUtc": { "type": "string", "description": "Date and time in UTC when the record was last modified.", "format": "date-time", "example": "2024-01-02T05:07:08.555Z" }, "lastScannedUtc": { "type": "string", "format": "date-time" }, "platformId": { "type": "string", "nullable": true }, "scanStartedUtc": { "type": "string", "format": "date-time", "nullable": true } }, "additionalProperties": false, "description": "A host machine." }, "HostDatabase": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "fullName": { "type": "string", "nullable": true }, "product": { "type": "string", "nullable": true }, "version": { "type": "string", "nullable": true }, "isClustered": { "type": "boolean" }, "clusterName": { "type": "string", "nullable": true }, "type": { "$ref": "#/components/schemas/DatabaseType" }, "discoveredDateTimeUtc": { "type": "string", "format": "date-time" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "hostId": { "type": "string", "description": "ID of the host that has this database.", "format": "uuid" }, "host": { "$ref": "#/components/schemas/Host" }, "deleted": { "type": "boolean" }, "lastSeenUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "HostDatabaseDb": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "databaseId": { "type": "string", "nullable": true }, "ownerSid": { "type": "string", "nullable": true }, "createDate": { "type": "string", "format": "date-time" }, "isOnline": { "type": "boolean" }, "statusDesc": { "type": "string", "nullable": true }, "discoveredDateTimeUtc": { "type": "string", "format": "date-time" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "hostId": { "type": "string", "description": "ID of the host that has this database.", "format": "uuid" }, "host": { "$ref": "#/components/schemas/Host" }, "hostUsers": { "type": "array", "items": { "$ref": "#/components/schemas/HostUser" }, "description": "Users which are in this database", "nullable": true, "readOnly": true }, "hostGroups": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectoryGroup" }, "description": "Domain groups which are in this database", "nullable": true }, "hostDbRoles": { "type": "array", "items": { "$ref": "#/components/schemas/HostDatabaseRole" }, "nullable": true } }, "additionalProperties": false }, "HostDatabaseRole": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "sid": { "type": "string", "nullable": true }, "principalId": { "type": "string", "nullable": true }, "createDate": { "type": "string", "format": "date-time" }, "modifyDate": { "type": "string", "format": "date-time" }, "isDisabled": { "type": "boolean" }, "discoveredDateTimeUtc": { "type": "string", "format": "date-time" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "hostId": { "type": "string", "description": "ID of the host that has this database.", "format": "uuid" }, "host": { "$ref": "#/components/schemas/Host" }, "databaseDbId": { "type": "string", "description": "Null if a server role", "format": "uuid", "nullable": true }, "databaseDb": { "$ref": "#/components/schemas/HostDatabaseDb" }, "hostUsers": { "type": "array", "items": { "$ref": "#/components/schemas/HostUser" }, "description": "Users which are assigned the role", "nullable": true, "readOnly": true }, "hostGroups": { "type": "array", "items": { "$ref": "#/components/schemas/ActiveDirectoryGroup" }, "description": "Domain groups which are assigned this role", "nullable": true } }, "additionalProperties": false }, "HostFeature": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "version": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "discoveredDateTimeUtc": { "type": "string", "format": "date-time" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "hostId": { "type": "string", "description": "Id of host with this installed feature.", "format": "uuid" }, "host": { "$ref": "#/components/schemas/Host" }, "deleted": { "type": "boolean" }, "lastSeenUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "HostGroup": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this group.", "format": "uuid" }, "name": { "type": "string", "description": "Name for this group.", "nullable": true }, "sid": { "type": "string", "description": "Windows Security ID for group", "nullable": true }, "unixId": { "type": "integer", "description": "Unix id if this is a group on a Unix host.", "format": "int32", "nullable": true }, "hostId": { "type": "string", "description": "Id of host to which this group belongs.", "format": "uuid", "nullable": true }, "host": { "$ref": "#/components/schemas/Host" }, "hostUserGroupJoin": { "type": "array", "items": { "$ref": "#/components/schemas/HostUserGroupJoin" }, "description": "Users which are in this group.", "nullable": true, "readOnly": true }, "hostGroupGroupJoins": { "type": "array", "items": { "$ref": "#/components/schemas/HostGroupGroupJoin" }, "description": "Domain groups which are in this group", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "deleted": { "type": "boolean" }, "lastSeenUtc": { "type": "string", "format": "date-time" }, "resourceObjectId": { "type": "string", "nullable": true } }, "additionalProperties": false, "description": "A group that can be associated with a target host." }, "HostGroupGroupJoin": { "type": "object", "properties": { "hostGroupId": { "type": "string", "description": "Id of the parent group", "format": "uuid" }, "hostGroup": { "$ref": "#/components/schemas/HostGroup" }, "domainGroupMemberId": { "type": "string", "description": "ID of the member Active Directory group.", "format": "uuid" }, "domainGroupMember": { "$ref": "#/components/schemas/ActiveDirectoryGroup" } }, "additionalProperties": false }, "HostGroupInfo": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "hostId": { "type": "string", "format": "uuid" }, "hostName": { "type": "string", "nullable": true }, "managedResourceId": { "type": "string", "format": "uuid", "nullable": true }, "managedResourceName": { "type": "string", "nullable": true }, "managedResourceDisplayName": { "type": "string", "nullable": true }, "groupMembers": { "type": "array", "items": { "type": "string" }, "nullable": true, "readOnly": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "HostScanHostStatus": { "type": "object", "properties": { "hostId": { "type": "string", "description": "Unique identifier for host", "format": "uuid", "nullable": true, "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, "name": { "type": "string", "description": "Name of host", "nullable": true }, "dnsHostName": { "type": "string", "description": "DNS hostname.", "nullable": true, "example": "host.example.local" }, "os": { "type": "string", "description": "Name of OS on host.", "nullable": true, "example": "Windows Server 2022" }, "ipAddress": { "type": "string", "description": "IP Address of host", "nullable": true, "example": "192.0.2.10" }, "version": { "type": "string", "description": "Version of OS on host.", "nullable": true, "example": "192.0.2.10" }, "status": { "$ref": "#/components/schemas/ActionStatus" }, "statusDescription": { "type": "string", "description": "Human readable description of the action queue status.", "nullable": true, "example": "Running" }, "failureReason": { "$ref": "#/components/schemas/ActionFailureReason" }, "errorMessage": { "type": "string", "nullable": true, "description": "The most recent Error-level log message recorded for this scan attempt, if any. This is the diagnostic detail behind failureReason, which is only a coarse classification." } }, "additionalProperties": false, "description": "Status of host scan job" }, "HostScanJobRequest": { "type": "object", "properties": { "dnsHostName": { "type": "string", "description": "DNS hostname.", "nullable": true }, "ipAddress": { "type": "string", "description": "IP Address to use if DNS resolution fails", "nullable": true }, "os": { "type": "string", "description": "Default OS value if scan fails", "nullable": true }, "credentialId": { "type": "string", "description": "Id of credentials for host.", "format": "uuid" }, "credentialName": { "type": "string", "description": "Name of credentials for host.", "nullable": true }, "platformName": { "type": "string", "nullable": true }, "acceptThumbprintOnFirstDiscovery": { "type": "boolean", "description": "Accept thumbprint on first discovery will allow the scan to complete and store the found thumbprint as trusted" }, "sshTrustActionType": { "$ref": "#/components/schemas/SshTrustActionType" }, "certificateType": { "$ref": "#/components/schemas/CertificateType" }, "trustedThumbprint": { "type": "string", "description": "Trusted thumbprint", "nullable": true }, "sshPort": { "type": "integer", "description": "SSH Port", "format": "int32", "nullable": true }, "source": { "type": "string", "nullable": true }, "hostId": { "type": "string", "format": "uuid", "nullable": true }, "platformDetectionOnly": { "type": "boolean", "description": "When true, the scan only detects and persists the host platform/OS and skips the full user, group, feature, service, task and database enumeration." } }, "additionalProperties": false }, "HostScanJobStatus": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this job.", "format": "uuid", "example": "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" }, "status": { "$ref": "#/components/schemas/ActionStatus" }, "statusDescription": { "type": "string", "description": "Human readable description of the action queue status.", "nullable": true, "example": "Running." }, "hostScanHostStatus": { "type": "array", "items": { "$ref": "#/components/schemas/HostScanHostStatus" }, "description": "Status for host(s) scanned by this job.", "nullable": true } }, "additionalProperties": false }, "HostScheduledTask": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "userName": { "type": "string", "nullable": true }, "name": { "type": "string", "nullable": true }, "taskPath": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "discoveredDateTimeUtc": { "type": "string", "format": "date-time" }, "source": { "type": "string", "nullable": true }, "nextRunTimeUtc": { "type": "string", "format": "date-time" }, "lastRunTimeUtc": { "type": "string", "format": "date-time" }, "lastRunResult": { "type": "integer", "format": "int32" }, "scheduledTaskTriggers": { "type": "array", "items": { "$ref": "#/components/schemas/ScheduledTaskTrigger" }, "nullable": true }, "scheduledTaskActions": { "type": "array", "items": { "$ref": "#/components/schemas/ScheduledTaskAction" }, "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "hostId": { "type": "string", "format": "uuid" }, "host": { "$ref": "#/components/schemas/Host" }, "credentialId": { "type": "string", "format": "uuid", "nullable": true }, "hostUserId": { "type": "string", "format": "uuid", "nullable": true }, "deleted": { "type": "boolean" }, "lastSeenUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "HostScheduledTaskView": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "hostId": { "type": "string", "format": "uuid" }, "userName": { "type": "string", "nullable": true }, "name": { "type": "string", "nullable": true }, "taskPath": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "source": { "type": "string", "nullable": true }, "nextRunTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "lastRunTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "lastRunResult": { "type": "integer", "format": "int32", "nullable": true }, "hostScanHostId": { "type": "string", "format": "uuid", "nullable": true }, "serviceAccountId": { "type": "string", "format": "uuid", "nullable": true }, "serviceAccountName": { "type": "string", "nullable": true }, "serviceAccountType": { "$ref": "#/components/schemas/CredentialType" }, "managedType": { "$ref": "#/components/schemas/ManagedStatus" } }, "additionalProperties": false }, "HostService": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "displayName": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "startType": { "$ref": "#/components/schemas/ServiceStartType" }, "userName": { "type": "string", "nullable": true }, "binaryPathName": { "type": "string", "nullable": true }, "dependentServices": { "type": "string", "nullable": true }, "canPauseAndContinue": { "type": "boolean" }, "canShutdown": { "type": "boolean" }, "canStop": { "type": "boolean" }, "serviceType": { "$ref": "#/components/schemas/ServiceTypeFlags" }, "delayedStart": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "discoveredDateTimeUtc": { "type": "string", "format": "date-time" }, "hostId": { "type": "string", "format": "uuid" }, "host": { "$ref": "#/components/schemas/Host" }, "credentialId": { "type": "string", "format": "uuid", "nullable": true }, "hostUserId": { "type": "string", "format": "uuid", "nullable": true }, "deleted": { "type": "boolean" }, "lastSeenUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "HostServiceView": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "hostId": { "type": "string", "format": "uuid" }, "displayName": { "type": "string", "nullable": true }, "serviceName": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "startType": { "$ref": "#/components/schemas/ServiceStartType" }, "serviceType": { "type": "integer", "format": "int32" }, "userName": { "type": "string", "nullable": true }, "serviceAccountId": { "type": "string", "description": "The ID of the credential record for the local account on the host that runs the service and that Privilege Secure manages.", "format": "uuid", "nullable": true }, "serviceAccountType": { "$ref": "#/components/schemas/CredentialType" }, "serviceAccountName": { "type": "string", "nullable": true }, "managedType": { "$ref": "#/components/schemas/ManagedStatus" }, "dependencyCount": { "type": "integer", "description": "How many other local services depend on this one's existence?", "format": "int32" } }, "additionalProperties": false }, "HostUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this host.", "format": "uuid", "example": "e0f1a2b3-c4d5-4e6f-8a7b-8c9d0e1f2a3b" }, "activeDirectoryObjectId": { "type": "string", "description": "Unique id from AD sync (usually same as Id).", "format": "uuid", "nullable": true }, "name": { "type": "string", "nullable": true }, "distinguishedName": { "type": "string", "description": "Distingished name from active directory", "nullable": true, "example": "CN=Host, CN=Computers, DC=example, DC=local" }, "ipAddress": { "type": "string", "description": "IP address of host.", "nullable": true, "example": "192.0.2.10" }, "os": { "type": "string", "description": "Name of OS on host.", "nullable": true, "example": "Windows Server 2022" }, "version": { "type": "string", "description": "Verion of OS on host.", "nullable": true, "example": "192.0.2.10" }, "lsaLookupCache": { "type": "string", "description": "Most recent value of the LSA lookup cache size setting on the host.", "nullable": true, "example": "10" }, "lastUpdatedDateTimeUtc": { "type": "string", "description": "Date/time of last system update.", "format": "date-time", "nullable": true, "example": "2024-03-27T18:25:43.511Z" }, "credentialId": { "type": "string", "description": "Id of service account for this host", "format": "uuid", "nullable": true, "example": "f2a3b4c5-d6e7-4f8a-9b9c-0d1e2f3a4b5c" }, "hasSSH": { "type": "boolean", "description": "True if the host supports SSH.", "example": false }, "activeDirectoryDomainId": { "type": "string", "description": "Id of active directory domain if host is a member of a domain.", "format": "uuid", "nullable": true, "example": "b4c5d6e7-f8a9-4b0c-9d1e-2f3a4b5c6d7e" }, "activeDirectoryDomain": { "$ref": "#/components/schemas/ActiveDirectoryDomain" }, "dnsHostName": { "type": "string", "description": "DNS hostname.", "nullable": true, "example": "host.example.local" }, "netBiosName": { "type": "string", "description": "NetBios hostname.", "nullable": true, "example": "HOST" }, "users": { "type": "array", "items": { "$ref": "#/components/schemas/HostUser" }, "description": "List of users associated with this host.", "nullable": true, "readOnly": true }, "groups": { "type": "array", "items": { "$ref": "#/components/schemas/HostGroup" }, "description": "List of groups associated with this host.", "nullable": true, "readOnly": true }, "features": { "type": "array", "items": { "$ref": "#/components/schemas/HostFeature" }, "description": "List of features installed on this host.", "nullable": true, "readOnly": true }, "services": { "type": "array", "items": { "$ref": "#/components/schemas/HostService" }, "description": "List of services that have accounts that can be managed.", "nullable": true, "readOnly": true }, "scheduledTasks": { "type": "array", "items": { "$ref": "#/components/schemas/HostScheduledTask" }, "description": "List of scheduled tasks that have accounts that can be managed.", "nullable": true, "readOnly": true }, "databases": { "type": "array", "items": { "$ref": "#/components/schemas/HostDatabase" }, "description": "List of SQL Server database server instances found on Windows host", "nullable": true, "readOnly": true }, "databaseDbs": { "type": "array", "items": { "$ref": "#/components/schemas/HostDatabaseDb" }, "description": "List of SQL Server databases found on Windows host", "nullable": true, "readOnly": true }, "databaseRoles": { "type": "array", "items": { "$ref": "#/components/schemas/HostDatabaseRole" }, "description": "List of SQL Server database roles found on Windows host", "nullable": true, "readOnly": true }, "samaccountname": { "type": "string", "description": "sAMAccountname for host (from ActiveDirectory) NOTE: this includes the NETBIOS name to make it unique", "nullable": true }, "isDomainController": { "type": "boolean", "description": "Boolean indicating if this host is a Domain Controller", "example": false }, "isGlobalCatalog": { "type": "boolean", "description": "Boolean indicating if this host is a Global Catalog server", "nullable": true, "example": false }, "usnChanged": { "type": "integer", "description": "USN from Active Directory", "format": "int64", "example": 12345 }, "objectSid": { "type": "string", "description": "SID from Active Directory", "nullable": true, "example": "S-1-5-21-1234567890-1234567890-123456789-123456" }, "added": { "type": "string", "description": "UTC Time of when host was Added to NPS", "format": "date-time", "example": "2024-03-27T01:01:01.555Z" }, "deleted": { "type": "boolean", "description": "True if this host has been deleted.", "example": false }, "isVirtual": { "type": "boolean", "description": "True if not a real host Used for AzureAD tenants", "example": false }, "nodeId": { "type": "string", "description": "Identifier of the server node that stores this record. Do not send it when you create the record.", "format": "uuid", "example": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" }, "createdDateTimeUtc": { "type": "string", "description": "Date and time in UTC when the record was created.", "format": "date-time", "example": "2024-01-01T05:07:08.555Z" }, "modifiedDateTimeUtc": { "type": "string", "description": "Date and time in UTC when the record was last modified.", "format": "date-time", "example": "2024-01-02T05:07:08.555Z" }, "lastScannedUtc": { "type": "string", "format": "date-time" }, "platformId": { "type": "string", "nullable": true }, "scanStartedUtc": { "type": "string", "format": "date-time", "nullable": true } }, "additionalProperties": false, "description": "A host machine.", "required": [ "id" ] }, "HostUser": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this user.", "format": "uuid" }, "activeDirectoryObjectId": { "type": "string", "description": "Unique id from AD sync (usually same as Id).", "format": "uuid", "nullable": true }, "activeDirectoryDomainId": { "type": "string", "description": "Id of active directory domain to which this user belongs.", "format": "uuid", "nullable": true }, "activeDirectoryDomain": { "$ref": "#/components/schemas/ActiveDirectoryDomain" }, "displayName": { "type": "string", "description": "Display name for this user.", "nullable": true }, "enabled": { "type": "boolean", "description": "True if this user is enabled." }, "unixId": { "type": "integer", "description": "Unix id if this is a user on a Unix host.", "format": "int32", "nullable": true }, "unixGroupId": { "type": "integer", "description": "Unix group id if this is a user on a Unix host.", "format": "int32", "nullable": true }, "homeDirectory": { "type": "string", "description": "Home directory for user if this is a user on a Unix host.", "nullable": true }, "shell": { "type": "string", "description": "Shell for user if this is a user on a Unix host.", "nullable": true }, "expirationDate": { "type": "string", "description": "Expiration date for this user.", "format": "date-time", "nullable": true }, "managed": { "type": "boolean", "description": "True if this user should be managed." }, "hostId": { "type": "string", "description": "Id of host to which this user belongs.", "format": "uuid", "nullable": true }, "host": { "$ref": "#/components/schemas/Host" }, "primaryGroupTokenId": { "type": "integer", "description": "Id of primary group token.", "format": "int32", "nullable": true }, "primaryGroupToken": { "type": "string", "description": "Primary group token.", "format": "byte", "nullable": true }, "managerSamaccountname": { "type": "string", "description": "SAM account name of Manager.", "nullable": true }, "title": { "type": "string", "description": "Title of this user.", "nullable": true }, "samaccountname": { "type": "string", "description": "SAM account name of user, e.g. Domain\\Username. See [Microsoft documentation](https://learn.microsoft.com/en-us/windows/win32/ad/naming-properties#samaccountname).", "nullable": true }, "userPrincipalName": { "type": "string", "description": "The userPrincipalName attribute is the logon name for the user. See [Microsoft documentation](https://learn.microsoft.com/en-us/windows/win32/ad/naming-properties#userprincipalname).", "nullable": true }, "distinguishedName": { "type": "string", "description": "Distinguished name of user from active directory.", "nullable": true }, "department": { "type": "string", "description": "Department to which this user belongs.", "nullable": true }, "email": { "type": "string", "description": "Email address for this user.", "nullable": true }, "lastLogonTimestamp": { "type": "string", "description": "When this user last logged in.", "format": "date-time", "nullable": true }, "name": { "type": "string", "description": "Short name", "nullable": true }, "sid": { "type": "string", "description": "Windows Security ID for user", "nullable": true }, "firstName": { "type": "string", "description": "User's first name - AD attribute 'givenName'", "nullable": true }, "lastName": { "type": "string", "description": "User's surname - AD attribute 'sn'", "nullable": true }, "passwordHash": { "type": "string", "description": "Stored password hash for the account.", "nullable": true }, "passwordChangedDateTimeUtc": { "type": "string", "description": "Time of the last password change.", "format": "date-time", "nullable": true }, "passwordExpirationDateTimeUtc": { "type": "string", "description": "When does password expire?", "format": "date-time", "nullable": true }, "forcePasswordReset": { "type": "boolean", "description": "If true, need to change password." }, "privilege": { "$ref": "#/components/schemas/UserPrivilege" }, "hostUserGroupJoin": { "type": "array", "items": { "$ref": "#/components/schemas/HostUserGroupJoin" }, "description": "Groups to which this user belongs.", "nullable": true, "readOnly": true }, "hostDatabaseDbs": { "type": "array", "items": { "$ref": "#/components/schemas/HostDatabaseDb" }, "nullable": true, "readOnly": true }, "hostDatabaseRoles": { "type": "array", "items": { "$ref": "#/components/schemas/HostDatabaseRole" }, "nullable": true, "readOnly": true }, "deleted": { "type": "boolean", "description": "True if this user has been deleted." }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "lastSeenUtc": { "type": "string", "format": "date-time", "nullable": true }, "resourceObjectId": { "type": "string", "nullable": true } }, "additionalProperties": false, "description": "A user that can be associated with a target host." }, "HostUserGroupJoin": { "type": "object", "properties": { "userId": { "type": "string", "description": "Id of AD user.", "format": "uuid" }, "user": { "$ref": "#/components/schemas/HostUser" }, "groupId": { "type": "string", "description": "Id of AD group.", "format": "uuid" }, "group": { "$ref": "#/components/schemas/HostGroup" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "deleted": { "type": "boolean" }, "lastSeenUtc": { "type": "string", "format": "date-time", "nullable": true } }, "additionalProperties": false }, "HostUserOrGroupId": { "type": "object", "properties": { "entityType": { "$ref": "#/components/schemas/ManagedAccountCandidateKind" }, "id": { "type": "string", "format": "uuid" } }, "additionalProperties": false }, "HostUserUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this user.", "format": "uuid" }, "activeDirectoryObjectId": { "type": "string", "description": "Unique id from AD sync (usually same as Id).", "format": "uuid", "nullable": true }, "activeDirectoryDomainId": { "type": "string", "description": "Id of active directory domain to which this user belongs.", "format": "uuid", "nullable": true }, "activeDirectoryDomain": { "$ref": "#/components/schemas/ActiveDirectoryDomain" }, "displayName": { "type": "string", "description": "Display name for this user.", "nullable": true }, "enabled": { "type": "boolean", "description": "True if this user is enabled." }, "unixId": { "type": "integer", "description": "Unix id if this is a user on a Unix host.", "format": "int32", "nullable": true }, "unixGroupId": { "type": "integer", "description": "Unix group id if this is a user on a Unix host.", "format": "int32", "nullable": true }, "homeDirectory": { "type": "string", "description": "Home directory for user if this is a user on a Unix host.", "nullable": true }, "shell": { "type": "string", "description": "Shell for user if this is a user on a Unix host.", "nullable": true }, "expirationDate": { "type": "string", "description": "Expiration date for this user.", "format": "date-time", "nullable": true }, "managed": { "type": "boolean", "description": "True if this user should be managed." }, "hostId": { "type": "string", "description": "Id of host to which this user belongs.", "format": "uuid", "nullable": true }, "host": { "$ref": "#/components/schemas/Host" }, "primaryGroupTokenId": { "type": "integer", "description": "Id of primary group token.", "format": "int32", "nullable": true }, "primaryGroupToken": { "type": "string", "description": "Primary group token.", "format": "byte", "nullable": true }, "managerSamaccountname": { "type": "string", "description": "SAM account name of Manager.", "nullable": true }, "title": { "type": "string", "description": "Title of this user.", "nullable": true }, "samaccountname": { "type": "string", "description": "SAM account name of user, e.g. Domain\\Username. See [Microsoft documentation](https://learn.microsoft.com/en-us/windows/win32/ad/naming-properties#samaccountname).", "nullable": true }, "userPrincipalName": { "type": "string", "description": "The userPrincipalName attribute is the logon name for the user. See [Microsoft documentation](https://learn.microsoft.com/en-us/windows/win32/ad/naming-properties#userprincipalname).", "nullable": true }, "distinguishedName": { "type": "string", "description": "Distinguished name of user from active directory.", "nullable": true }, "department": { "type": "string", "description": "Department to which this user belongs.", "nullable": true }, "email": { "type": "string", "description": "Email address for this user.", "nullable": true }, "lastLogonTimestamp": { "type": "string", "description": "When this user last logged in.", "format": "date-time", "nullable": true }, "name": { "type": "string", "description": "Short name", "nullable": true }, "sid": { "type": "string", "description": "Windows Security ID for user", "nullable": true }, "firstName": { "type": "string", "description": "User's first name - AD attribute 'givenName'", "nullable": true }, "lastName": { "type": "string", "description": "User's surname - AD attribute 'sn'", "nullable": true }, "passwordHash": { "type": "string", "description": "Stored password hash for the account.", "nullable": true }, "passwordChangedDateTimeUtc": { "type": "string", "description": "Time of the last password change.", "format": "date-time", "nullable": true }, "passwordExpirationDateTimeUtc": { "type": "string", "description": "When does password expire?", "format": "date-time", "nullable": true }, "forcePasswordReset": { "type": "boolean", "description": "If true, need to change password." }, "privilege": { "$ref": "#/components/schemas/UserPrivilege" }, "hostUserGroupJoin": { "type": "array", "items": { "$ref": "#/components/schemas/HostUserGroupJoin" }, "description": "Groups to which this user belongs.", "nullable": true, "readOnly": true }, "hostDatabaseDbs": { "type": "array", "items": { "$ref": "#/components/schemas/HostDatabaseDb" }, "nullable": true, "readOnly": true }, "hostDatabaseRoles": { "type": "array", "items": { "$ref": "#/components/schemas/HostDatabaseRole" }, "nullable": true, "readOnly": true }, "deleted": { "type": "boolean", "description": "True if this user has been deleted." }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "lastSeenUtc": { "type": "string", "format": "date-time", "nullable": true }, "resourceObjectId": { "type": "string", "nullable": true } }, "additionalProperties": false, "description": "A user that can be associated with a target host.", "required": [ "id" ] }, "IPAddressRule": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "address": { "type": "string", "nullable": true }, "allowed": { "type": "boolean" }, "ipAddressRuleType": { "$ref": "#/components/schemas/IPAddressRuleType" }, "activityConfigurationId": { "type": "string", "format": "uuid", "nullable": true }, "managedAccountId": { "type": "string", "format": "uuid", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "IPAddressRuleCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "address": { "type": "string" }, "allowed": { "type": "boolean" }, "ipAddressRuleType": { "$ref": "#/components/schemas/IPAddressRuleType" }, "activityConfigurationId": { "type": "string", "format": "uuid", "nullable": true }, "managedAccountId": { "type": "string", "format": "uuid", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "address" ] }, "IPAddressRuleType": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Standard", "Range", "CIDR" ], "description": "Integer values: 0 = Standard, 1 = Range, 2 = CIDR." }, "IPAddressRuleUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "address": { "type": "string" }, "allowed": { "type": "boolean" }, "ipAddressRuleType": { "$ref": "#/components/schemas/IPAddressRuleType" }, "activityConfigurationId": { "type": "string", "format": "uuid", "nullable": true }, "managedAccountId": { "type": "string", "format": "uuid", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "id", "address" ] }, "IntPair": { "type": "object", "properties": { "item1": { "type": "integer", "format": "int32", "description": "Number of items that succeeded." }, "item2": { "type": "integer", "format": "int32", "description": "Number of items that failed." } }, "additionalProperties": false, "description": "A pair of counts: item1 is the number of items that succeeded and item2 is the number that failed." }, "IntegrationConnector": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this integration connector.", "format": "uuid" }, "name": { "type": "string", "description": "Name for integration connector.", "nullable": true }, "description": { "type": "string", "description": "Description for integration connector", "nullable": true }, "connectorConfigurationId": { "type": "string", "description": "Configuration Id for integration connector", "format": "uuid" }, "connectorTemplateId": { "type": "string", "description": "The template that this connector is based on.", "format": "uuid" }, "monitorActionQueueId": { "type": "string", "description": "Id of periodic action queue to execute, e.g. to fetch managed user list for a password vault.", "format": "uuid", "nullable": true }, "monitorActionQueue": { "$ref": "#/components/schemas/ActionQueue" }, "configuration": { "$ref": "#/components/schemas/ConnectorConfiguration" }, "configurationValues": { "type": "array", "items": { "$ref": "#/components/schemas/ConnectorConfigurationValue" }, "description": "Settings for this connector", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "An integration connector for Netwrix products and available third-party apps." }, "IntegrationConnectorTemplate": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this integration connector.", "format": "uuid" }, "name": { "type": "string", "description": "Name for integration connector, this corresponds to the \"type\" of the connector", "nullable": true }, "description": { "type": "string", "description": "Description for integration connector template.", "nullable": true }, "type": { "$ref": "#/components/schemas/IntegrationConnectorType" }, "configurationId": { "type": "string", "description": "Configuration Id for integration connector template. The configuration of a template provide defaults for a new instance of a connector.", "format": "uuid" }, "configurationValues": { "type": "array", "items": { "$ref": "#/components/schemas/ConnectorConfigurationValue" }, "description": "List of available connector settings", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "IntegrationConnectorType": { "enum": [ 0, 1, 2, 3 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "GenericConnector", "StealthAUDITConnector", "PasswordVaultConnector", "ServiceNowConnector" ], "description": "Integer values: 0 = GenericConnector, 1 = StealthAUDITConnector, 2 = PasswordVaultConnector, 3 = ServiceNowConnector." }, "Job": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "actionGroupJob": { "type": "array", "items": { "$ref": "#/components/schemas/ActionGroupJob" }, "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "LiveSessionRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID (not required)", "format": "uuid", "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, "activitySessionIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "description": "List of ActivitySession IDs to perform operation for", "nullable": true, "example": [ "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" ] }, "lockMessage": { "type": "string", "description": "Lock message", "nullable": true, "example": "Your session has been temporarily locked, please see a Netwrix Privilege Secure administrator for more information." }, "lockTitle": { "type": "string", "description": "Title for lock message dialog", "nullable": true, "example": "Netwrix Privilege Secure" }, "locked": { "type": "boolean", "description": "true if locked" }, "lockActivity": { "type": "boolean", "description": "Lock the activity", "example": true }, "lockResource": { "type": "boolean", "description": "Lock the resource", "example": false }, "lockUser": { "type": "boolean", "description": "Lock the user", "example": true } }, "additionalProperties": false }, "LiveSessionUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID (not required)", "format": "uuid", "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6" }, "activitySessionIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "description": "List of ActivitySession IDs to perform operation for", "example": [ "d8e9f0a1-b2c3-4d4e-9f5a-6b7c8d9e0f1a" ] }, "lockMessage": { "type": "string", "description": "Lock message", "nullable": true, "example": "Your session has been temporarily locked, please see a Netwrix Privilege Secure administrator for more information." }, "lockTitle": { "type": "string", "description": "Title for lock message dialog", "nullable": true, "example": "Netwrix Privilege Secure" }, "locked": { "type": "boolean", "description": "true if locked" }, "lockActivity": { "type": "boolean", "description": "Lock the activity", "example": true }, "lockResource": { "type": "boolean", "description": "Lock the resource", "example": false }, "lockUser": { "type": "boolean", "description": "Lock the user", "example": true } }, "additionalProperties": false, "required": [ "activitySessionIds", "locked" ] }, "LocalUserPasswordChangeRequest": { "type": "object", "properties": { "managedAccountId": { "type": "string", "format": "uuid", "nullable": true }, "username": { "type": "string", "nullable": true }, "passwordOld": { "type": "string", "nullable": true }, "passwordNew": { "type": "string", "nullable": true } }, "additionalProperties": false }, "LocalUserPasswordChangeUpdateRequest": { "type": "object", "properties": { "managedAccountId": { "type": "string", "format": "uuid" }, "username": { "type": "string", "nullable": true }, "passwordOld": { "type": "string", "nullable": true }, "passwordNew": { "type": "string" } }, "additionalProperties": false, "required": [ "managedAccountId", "passwordNew" ] }, "LogFileOptions": { "type": "object", "properties": { "name": { "type": "string", "nullable": true }, "minimumLogLevel": { "type": "string", "nullable": true }, "retainedFileCountLimit": { "type": "integer", "format": "int32" }, "fileSizeLimitBytes": { "type": "integer", "format": "int32" }, "outputTemplate": { "type": "string", "nullable": true }, "shared": { "type": "boolean" } }, "additionalProperties": false }, "LogFileOptionsCreateRequest": { "type": "object", "properties": { "name": { "type": "string" }, "minimumLogLevel": { "type": "string", "nullable": true }, "retainedFileCountLimit": { "type": "integer", "format": "int32" }, "fileSizeLimitBytes": { "type": "integer", "format": "int32" }, "outputTemplate": { "type": "string", "nullable": true }, "shared": { "type": "boolean" } }, "additionalProperties": false, "required": [ "name" ] }, "LoginFormInfoCreateRequest": { "type": "object", "properties": { "login": { "type": "string" }, "password": { "type": "string" } }, "additionalProperties": false, "required": [ "login", "password" ] }, "LoginSessionState": { "enum": [ -1, 0, 1 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Unknown", "Inactive", "Active" ], "description": "Integer values: -1 = Unknown, 0 = Inactive, 1 = Active." }, "ManageResourceGroupProtectionPolicyJoin": { "type": "object", "properties": { "managedResourceGroupId": { "type": "string", "description": "Id of managed resource group.", "format": "uuid" }, "managedResourceGroup": { "$ref": "#/components/schemas/ManagedResourceGroup" }, "protectionPolicyId": { "type": "string", "description": "Id of protect group policy.", "format": "uuid" }, "protectionPolicy": { "$ref": "#/components/schemas/ProtectionPolicy" } }, "additionalProperties": false, "description": "Links managed resource groups to protected group policies." }, "ManageResourceProtectionPolicyJoin": { "type": "object", "properties": { "managedResourceId": { "type": "string", "description": "Id of managed resource.", "format": "uuid" }, "managedResource": { "$ref": "#/components/schemas/ManagedResource" }, "protectionPolicyId": { "type": "string", "description": "Id of protect group policy.", "format": "uuid" }, "protectionPolicy": { "$ref": "#/components/schemas/ProtectionPolicy" } }, "additionalProperties": false, "description": "Links managed resources to protected group policies." }, "ManagedAccount": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this account.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this user.", "nullable": true }, "type": { "$ref": "#/components/schemas/ManagedAccountType" }, "locked": { "type": "boolean", "description": "Activity Lock - while true prevents from creating new activities" }, "userId": { "type": "string", "description": "AD user id associated with this user.", "format": "uuid", "nullable": true }, "managedAccountJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountJoin" }, "description": "Groups to which this account belongs.", "nullable": true }, "managedAccountPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountPolicyJoin" }, "description": "Policies which reference this account.", "nullable": true }, "sid": { "type": "string", "description": "The security identifier (SID) of the user. It must match an existing host user.", "nullable": true }, "userCollectionJoin": { "type": "array", "items": { "$ref": "#/components/schemas/UserCollectionJoin" }, "nullable": true, "readOnly": true }, "isReviewer": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "deletedDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true, "description": "The UTC timestamp when this account was tombstoned. Null if not deleted." }, "isDeleted": { "type": "boolean", "description": "Indicates whether this account has been soft-deleted (tombstoned)." } }, "additionalProperties": false, "description": "A managed account." }, "ManagedAccountAndCollectionsView": { "type": "object", "properties": { "id": { "type": "string", "description": "Account/Group/Collection Id", "format": "uuid" }, "name": { "type": "string", "description": "Account/Group/Collection Name", "nullable": true }, "email": { "type": "string", "description": "Account/Group/Collection Email", "nullable": true }, "samAccountName": { "type": "string", "description": "Account/Group/Collection SamAccountName", "nullable": true }, "domain": { "type": "string", "description": "Account/Group/Collection Domain", "nullable": true }, "entityType": { "$ref": "#/components/schemas/ManagedAccountKind" }, "isReviewer": { "type": "boolean" }, "displayName": { "type": "string", "nullable": true }, "lastLogonTimestamp": { "type": "string", "format": "date-time", "nullable": true } }, "additionalProperties": false }, "ManagedAccountCandidateKind": { "enum": [ 0, 1, 2, 3 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "HostUser", "DomainGroup", "ApplicationUser", "DomainGroupMember" ], "description": "Integer values: 0 = HostUser, 1 = DomainGroup, 2 = ApplicationUser, 3 = DomainGroupMember." }, "ManagedAccountCandidateView": { "type": "object", "properties": { "entityType": { "$ref": "#/components/schemas/ManagedAccountCandidateKind" }, "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "displayName": { "type": "string", "nullable": true }, "userPrincipalName": { "type": "string", "nullable": true }, "samAccountName": { "type": "string", "nullable": true }, "email": { "type": "string", "nullable": true }, "managed": { "type": "boolean" }, "domainConfigId": { "type": "string", "format": "uuid", "nullable": true }, "domainName": { "type": "string", "nullable": true }, "managedAccountId": { "type": "string", "description": "The ID of the managed account or managed account group, if Privilege Secure manages this item.", "format": "uuid", "nullable": true } }, "additionalProperties": false }, "ManagedAccountGroup": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this group.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this group.", "nullable": true }, "type": { "$ref": "#/components/schemas/ManagedAccountGroupType" }, "groupId": { "type": "string", "description": "AD group id if this is an active directory group", "format": "uuid", "nullable": true }, "mfaConnectorId": { "type": "string", "description": "Alternate MFA provider for members of this group. Override this at the User level.", "format": "uuid", "nullable": true }, "isReviewer": { "type": "boolean", "description": "Is assigned reviewer role (for AccessCertification)" }, "managedAccountJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountJoin" }, "description": "Managed accounts in this group.", "nullable": true }, "managedAccountGroupPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountGroupPolicyJoin" }, "description": "Policies which reference this account group.", "nullable": true }, "groupCollectionJoin": { "type": "array", "items": { "$ref": "#/components/schemas/GroupCollectionJoin" }, "nullable": true, "readOnly": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A group of managed accounts." }, "ManagedAccountGroupAppGroupType": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "NotEnrolled", "CanLogIn", "Admin" ], "description": "Integer values: 0 = NotEnrolled, 1 = CanLogIn, 2 = Admin." }, "ManagedAccountGroupCandidateView": { "type": "object", "properties": { "appGroupType": { "$ref": "#/components/schemas/ManagedAccountGroupAppGroupType" }, "id": { "type": "string", "format": "uuid" }, "displayName": { "type": "string", "nullable": true }, "samAccountName": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "distinguishedName": { "type": "string", "nullable": true }, "domainConfigId": { "type": "string", "format": "uuid" }, "domainName": { "type": "string", "nullable": true }, "managedAccountGroupId": { "type": "string", "format": "uuid", "nullable": true } }, "additionalProperties": false }, "ManagedAccountGroupCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this group.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this group." }, "type": { "$ref": "#/components/schemas/ManagedAccountGroupType" }, "groupId": { "type": "string", "description": "AD group id if this is an active directory group", "format": "uuid", "nullable": true }, "mfaConnectorId": { "type": "string", "description": "Alternate MFA provider for members of this group. Override this at the User level.", "format": "uuid", "nullable": true }, "isReviewer": { "type": "boolean", "description": "Is assigned reviewer role (for AccessCertification)" }, "managedAccountJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountJoin" }, "description": "Managed accounts in this group.", "nullable": true }, "managedAccountGroupPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedAccountGroupPolicyJoin" }, "description": "Policies which reference this account group.", "nullable": true }, "groupCollectionJoin": { "type": "array", "items": { "$ref": "#/components/schemas/GroupCollectionJoin" }, "nullable": true, "readOnly": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A group of managed accounts.", "required": [ "name" ] }, "ManagedAccountGroupInfo": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this group.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this group.", "nullable": true }, "type": { "$ref": "#/components/schemas/ManagedAccountGroupType" }, "groupId": { "type": "string", "description": "AD group id if this is an active directory group", "format": "uuid", "nullable": true }, "mfaConnectorId": { "type": "string", "description": "Alternate MFA provider for members of this group. Override this at the User level.", "format": "uuid", "nullable": true }, "isReviewer": { "type": "boolean", "description": "Is assigned reviewer role (for AccessCertification)" }, "distinguishedName": { "type": "string", "nullable": true }, "domain": { "type": "string", "nullable": true }, "email": { "type": "string", "nullable": true }, "samaccountname": { "type": "string", "nullable": true }, "sid": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "displayName": { "type": "string", "nullable": true } }, "additionalProperties": false, "description": "A group of managed accounts." }, "ManagedAccountGroupPolicyJoin": { "type": "object", "properties": { "managedAccountGroupId": { "type": "string", "description": "Id of managed account group.", "format": "uuid" }, "managedAccountGroup": { "$ref": "#/components/schemas/ManagedAccountGroup" }, "accessControlPolicyId": { "type": "string", "description": "Id of access control policy.", "format": "uuid" }, "accessControlPolicy": { "$ref": "#/components/schemas/AccessControlPolicy" } }, "additionalProperties": false }, "ManagedAccountGroupType": { "enum": [ 0, 1 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Local", "ActiveDirectory" ], "description": "Integer values: 0 = Local, 1 = ActiveDirectory." }, "ManagedAccountInfo": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "userId": { "type": "string", "format": "uuid" }, "loginId": { "type": "string", "nullable": true }, "displayName": { "type": "string", "nullable": true }, "samaccountname": { "type": "string", "nullable": true }, "email": { "type": "string", "nullable": true }, "mfaConnectorId": { "type": "string", "format": "uuid", "nullable": true }, "policies": { "type": "array", "items": { "$ref": "#/components/schemas/AccessControlPolicy" }, "nullable": true }, "resources": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResource" }, "nullable": true }, "activeSessions": { "type": "array", "items": { "$ref": "#/components/schemas/SessionSummary" }, "nullable": true }, "lastLogonDateUtc": { "type": "string", "format": "date-time", "nullable": true }, "scheduledSessionCount": { "type": "integer", "format": "int32" }, "type": { "type": "string", "nullable": true }, "sid": { "type": "string", "nullable": true }, "userPrincipalName": { "type": "string", "nullable": true }, "locked": { "type": "boolean" }, "isReviewer": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ManagedAccountJoin": { "type": "object", "properties": { "managedAccountId": { "type": "string", "description": "Id of managed account.", "format": "uuid" }, "managedAccount": { "$ref": "#/components/schemas/ManagedAccount" }, "managedAccountGroupId": { "type": "string", "description": "Id of managed account group.", "format": "uuid" }, "managedAccountGroup": { "$ref": "#/components/schemas/ManagedAccountGroup" } }, "additionalProperties": false, "description": "Links managed accounts to managed account groups." }, "ManagedAccountKind": { "enum": [ 0, 1, 2, 3, 4 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "ManagedAccount", "ManagedAccountGroup", "Application", "Collection", "Local" ], "description": "Integer values: 0 = ManagedAccount, 1 = ManagedAccountGroup, 2 = Application, 3 = Collection, 4 = Local." }, "ManagedAccountOrGroupId": { "type": "object", "properties": { "entityType": { "$ref": "#/components/schemas/ManagedAccountKind" }, "id": { "type": "string", "format": "uuid" } }, "additionalProperties": false }, "ManagedAccountOrGroupReference": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "entityType": { "$ref": "#/components/schemas/ManagedAccountKind" } }, "additionalProperties": false }, "ManagedAccountPolicyJoin": { "type": "object", "properties": { "managedAccountId": { "type": "string", "description": "Id of managed account.", "format": "uuid" }, "managedAccount": { "$ref": "#/components/schemas/ManagedAccount" }, "accessControlPolicyId": { "type": "string", "description": "Id of access control policy.", "format": "uuid" }, "accessControlPolicy": { "$ref": "#/components/schemas/AccessControlPolicy" } }, "additionalProperties": false }, "ManagedAccountSessionCount": { "type": "object", "properties": { "managedAccountId": { "type": "string", "description": "ID of the managed account of the user.", "format": "uuid" }, "managedAccountName": { "type": "string", "description": "User's account name", "nullable": true }, "countSessions": { "type": "integer", "description": "Total number of sessions", "format": "int32" }, "sumDuration": { "type": "integer", "description": "Total duration of all sessions by user", "format": "int32" }, "avgDuration": { "type": "integer", "description": "Average duration of all sessions by user", "format": "int32" }, "minDuration": { "type": "integer", "description": "Duration of shortest session by user", "format": "int32" }, "maxDuration": { "type": "integer", "description": "Duration of longest session by user", "format": "int32" } }, "additionalProperties": false }, "ManagedAccountType": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "HostUser", "HostService", "HostScheduledTask" ], "description": "Integer values: 0 = HostUser, 1 = HostService, 2 = HostScheduledTask." }, "ManagedAccountView": { "type": "object", "properties": { "entityType": { "$ref": "#/components/schemas/ManagedAccountKind" }, "id": { "type": "string", "format": "uuid" }, "hostUserId": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "nullable": true }, "displayName": { "type": "string", "nullable": true }, "samAccountName": { "type": "string", "nullable": true }, "department": { "type": "string", "nullable": true }, "userPrincipalName": { "type": "string", "nullable": true }, "email": { "type": "string", "nullable": true }, "domainConfigId": { "type": "string", "format": "uuid", "nullable": true }, "domainName": { "type": "string", "nullable": true }, "lastLogonTimestamp": { "type": "string", "format": "date-time", "nullable": true }, "activeSessionCount": { "type": "integer", "description": "Number of active sessions found for this account. Active sessions are sessions that are currently active or scheduled for the future.", "format": "int32" }, "scheduledSessionCount": { "type": "integer", "description": "Number of pending sessions found for this account.", "format": "int32" }, "accessPolicyCount": { "type": "integer", "description": "Number of access policies this account participates in.", "format": "int32" }, "certificateSerialNumber": { "type": "string", "description": "Serial number required for certificate auth", "nullable": true }, "locked": { "type": "boolean" }, "lockoutEnd": { "type": "string", "format": "date-time", "nullable": true }, "isReviewer": { "type": "boolean", "nullable": true }, "licenseCount": { "type": "integer", "format": "int32" } }, "additionalProperties": false }, "ManagedAccountViewCreateRequest": { "type": "object", "properties": { "entityType": { "$ref": "#/components/schemas/ManagedAccountKind" }, "id": { "type": "string", "format": "uuid" }, "hostUserId": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string" }, "displayName": { "type": "string", "nullable": true }, "samAccountName": { "type": "string", "nullable": true }, "department": { "type": "string", "nullable": true }, "userPrincipalName": { "type": "string", "nullable": true }, "email": { "type": "string", "nullable": true }, "domainConfigId": { "type": "string", "format": "uuid", "nullable": true }, "domainName": { "type": "string", "nullable": true }, "lastLogonTimestamp": { "type": "string", "format": "date-time", "nullable": true }, "activeSessionCount": { "type": "integer", "description": "Number of active sessions found for this account. Active sessions are sessions that are currently active or scheduled for the future.", "format": "int32" }, "scheduledSessionCount": { "type": "integer", "description": "Number of pending sessions found for this account.", "format": "int32" }, "accessPolicyCount": { "type": "integer", "description": "Number of access policies this account participates in.", "format": "int32" }, "certificateSerialNumber": { "type": "string", "description": "Serial number required for certificate auth" }, "locked": { "type": "boolean" }, "lockoutEnd": { "type": "string", "format": "date-time", "nullable": true }, "isReviewer": { "type": "boolean", "nullable": true }, "licenseCount": { "type": "integer", "format": "int32" } }, "additionalProperties": false, "required": [ "name", "certificateSerialNumber" ] }, "ManagedAccountViewUpdateLocalUserRequest": { "type": "object", "properties": { "entityType": { "$ref": "#/components/schemas/ManagedAccountKind" }, "id": { "type": "string", "format": "uuid" }, "hostUserId": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "nullable": true }, "displayName": { "type": "string", "nullable": true }, "samAccountName": { "type": "string", "nullable": true }, "department": { "type": "string", "nullable": true }, "userPrincipalName": { "type": "string", "nullable": true }, "email": { "type": "string", "nullable": true }, "domainConfigId": { "type": "string", "format": "uuid", "nullable": true }, "domainName": { "type": "string", "nullable": true }, "lastLogonTimestamp": { "type": "string", "format": "date-time", "nullable": true }, "activeSessionCount": { "type": "integer", "description": "Number of active sessions found for this account. Active sessions are sessions that are currently active or scheduled for the future.", "format": "int32" }, "scheduledSessionCount": { "type": "integer", "description": "Number of pending sessions found for this account.", "format": "int32" }, "accessPolicyCount": { "type": "integer", "description": "Number of access policies this account participates in.", "format": "int32" }, "certificateSerialNumber": { "type": "string", "description": "Serial number required for certificate auth", "nullable": true }, "locked": { "type": "boolean" }, "lockoutEnd": { "type": "string", "format": "date-time", "nullable": true }, "isReviewer": { "type": "boolean", "nullable": true }, "licenseCount": { "type": "integer", "format": "int32" } }, "additionalProperties": false, "required": [ "id", "hostUserId", "name" ] }, "ManagedAccountViewUpdateRequest": { "type": "object", "properties": { "entityType": { "$ref": "#/components/schemas/ManagedAccountKind" }, "id": { "type": "string", "format": "uuid" }, "hostUserId": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "displayName": { "type": "string", "nullable": true }, "samAccountName": { "type": "string", "nullable": true }, "department": { "type": "string", "nullable": true }, "userPrincipalName": { "type": "string", "nullable": true }, "email": { "type": "string", "nullable": true }, "domainConfigId": { "type": "string", "format": "uuid", "nullable": true }, "domainName": { "type": "string", "nullable": true }, "lastLogonTimestamp": { "type": "string", "format": "date-time", "nullable": true }, "activeSessionCount": { "type": "integer", "description": "Number of active sessions found for this account. Active sessions are sessions that are currently active or scheduled for the future.", "format": "int32" }, "scheduledSessionCount": { "type": "integer", "description": "Number of pending sessions found for this account.", "format": "int32" }, "accessPolicyCount": { "type": "integer", "description": "Number of access policies this account participates in.", "format": "int32" }, "certificateSerialNumber": { "type": "string", "description": "Serial number required for certificate auth" }, "locked": { "type": "boolean" }, "lockoutEnd": { "type": "string", "format": "date-time", "nullable": true }, "isReviewer": { "type": "boolean", "nullable": true }, "licenseCount": { "type": "integer", "format": "int32" } }, "additionalProperties": false, "required": [ "id", "hostUserId", "name", "certificateSerialNumber" ] }, "ManagedDatabase": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this resource.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this managed resource.", "nullable": true }, "server": { "type": "string", "nullable": true }, "port": { "type": "integer", "format": "int32" }, "type": { "$ref": "#/components/schemas/DatabaseType" }, "hostDatabaseId": { "type": "string", "format": "uuid", "nullable": true }, "domainId": { "type": "string", "format": "uuid", "nullable": true }, "integratedSecurity": { "type": "boolean", "description": "For SQL Server databases: true to connect with integrated security." }, "trustServerCertificate": { "type": "boolean" }, "encrypted": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ManagedDatabaseUpdateRequest": { "type": "object", "properties": { "resourceId": { "type": "string", "format": "uuid" }, "ipAddress": { "type": "string", "nullable": true }, "serviceAccountId": { "type": "string", "format": "uuid", "nullable": true }, "virtualHostId": { "type": "string", "format": "uuid", "nullable": true }, "platformId": { "type": "string", "format": "uuid" }, "databaseId": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "server": { "type": "string" }, "port": { "type": "integer", "format": "int32" }, "domainId": { "type": "string", "format": "uuid", "nullable": true }, "type": { "$ref": "#/components/schemas/DatabaseType" }, "hostDatabaseId": { "type": "string", "format": "uuid", "nullable": true }, "integratedSecurity": { "type": "boolean", "description": "For SQL Server databases: true to connect with integrated security." }, "trustServerCertificate": { "type": "boolean" }, "encrypted": { "type": "boolean" } }, "additionalProperties": false, "description": "A managed database together with the managed resource that it belongs to.", "required": [ "databaseId", "resourceId", "name", "server", "port", "platformId" ] }, "ManagedDatabaseWithResource": { "type": "object", "properties": { "resourceId": { "type": "string", "format": "uuid", "nullable": true }, "ipAddress": { "type": "string", "nullable": true }, "serviceAccountId": { "type": "string", "format": "uuid", "nullable": true }, "virtualHostId": { "type": "string", "format": "uuid", "nullable": true }, "platformId": { "type": "string", "format": "uuid", "nullable": true }, "databaseId": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "nullable": true }, "server": { "type": "string", "nullable": true }, "port": { "type": "integer", "format": "int32" }, "domainId": { "type": "string", "format": "uuid", "nullable": true }, "type": { "$ref": "#/components/schemas/DatabaseType" }, "hostDatabaseId": { "type": "string", "format": "uuid", "nullable": true }, "integratedSecurity": { "type": "boolean", "description": "For SQL Server databases: true to connect with integrated security." }, "trustServerCertificate": { "type": "boolean" }, "encrypted": { "type": "boolean" } }, "additionalProperties": false, "description": "A managed database together with the managed resource that it belongs to." }, "ManagedResource": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this resource.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this managed resource.", "nullable": true }, "type": { "$ref": "#/components/schemas/ManagedResourceType" }, "hostId": { "type": "string", "description": "The ID of the host, if this resource is a host.", "format": "uuid", "nullable": true }, "host": { "$ref": "#/components/schemas/Host" }, "domainConfigId": { "type": "string", "description": "The ID of the Active Directory domain configuration, if this resource represents a domain.", "format": "uuid", "nullable": true }, "websiteId": { "type": "string", "description": "The ID of the website, if this resource represents a website.", "format": "uuid", "nullable": true }, "website": { "$ref": "#/components/schemas/Website" }, "azureAdTenantId": { "type": "string", "description": "The ID of the Azure AD tenant, if this resource represents an Azure AD tenant.", "format": "uuid", "nullable": true }, "azureAdTenant": { "$ref": "#/components/schemas/AzureAdTenant" }, "secretVaultId": { "type": "string", "description": "The ID of the secret vault, if this resource represents a secret vault.", "format": "uuid", "nullable": true }, "secretVault": { "$ref": "#/components/schemas/SecretVault" }, "managedDatabaseId": { "type": "string", "description": "The ID of the database, if this resource represents a database.", "format": "uuid", "nullable": true }, "managedDatabase": { "$ref": "#/components/schemas/ManagedDatabase" }, "platformId": { "type": "string", "description": "Id of platform that this activity can be performed on.", "format": "uuid", "nullable": true }, "platform": { "$ref": "#/components/schemas/Platform" }, "displayName": { "type": "string", "description": "Display name for resource.", "nullable": true }, "ipAddress": { "type": "string", "description": "IP Address for resource.", "nullable": true }, "serviceAccountId": { "type": "string", "description": "Service Account used to connect to the resource.", "format": "uuid", "nullable": true }, "serviceAccount": { "$ref": "#/components/schemas/Credential" }, "manageAccount": { "$ref": "#/components/schemas/ManagedResourceManageAccount" }, "protectedGroup": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectedGroup" }, "description": "Group(s) protected by this resource.", "nullable": true }, "activityConfigurationId": { "type": "string", "description": "Id of configuration collection for this policy.", "format": "uuid", "nullable": true }, "activityConfiguration": { "$ref": "#/components/schemas/ActivityConfiguration" }, "actionQueueId": { "type": "string", "description": "Id of Action queue which manages this resource.", "format": "uuid", "nullable": true }, "actionQueue": { "$ref": "#/components/schemas/ActionQueue" }, "managedResourceJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceJoin" }, "description": "Groups to which this resource belongs.", "nullable": true }, "managedResourcePolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourcePolicyJoin" }, "description": "Policies which reference this resource.", "nullable": true }, "manageResourceProtectionPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManageResourceProtectionPolicyJoin" }, "description": "Policies which reference this group.", "nullable": true }, "verificationScheduleId": { "type": "string", "description": "Id for the managed user verification schedule (can override platform, resource schedule id)", "format": "uuid", "nullable": true }, "verificationSchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "passwordComplexityPolicyId": { "type": "string", "description": "Id for password complexity (can override platform, resource password policy id)", "format": "uuid", "nullable": true }, "passwordComplexityPolicy": { "$ref": "#/components/schemas/PasswordComplexity" }, "portSsh": { "type": "integer", "format": "int32" }, "portRdp": { "type": "integer", "format": "int32" }, "portWinRm": { "type": "integer", "format": "int32" }, "portWinRmHttps": { "type": "integer", "format": "int32" }, "winRmHttpSetting": { "$ref": "#/components/schemas/WinRmHttpSettings" }, "disableWinRm": { "type": "boolean" }, "acceptThumbprintOnFirstDiscovery": { "type": "boolean" }, "trustedThumbprint": { "type": "string", "nullable": true }, "discoveredThumbprint": { "type": "string", "nullable": true }, "sshTrustActionType": { "$ref": "#/components/schemas/SshTrustActionType" }, "certificateType": { "$ref": "#/components/schemas/CertificateType" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A managed resource, such as a host." }, "ManagedResourceAndGroupView": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "platformId": { "type": "string", "format": "uuid", "nullable": true }, "websiteId": { "type": "string", "format": "uuid", "nullable": true }, "secretVaultId": { "type": "string", "format": "uuid", "nullable": true }, "azureAdTenantId": { "type": "string", "format": "uuid", "nullable": true }, "databaseId": { "type": "string", "format": "uuid", "nullable": true }, "dnsHostName": { "type": "string", "nullable": true }, "activeSessionCount": { "type": "integer", "format": "int32", "nullable": true }, "os": { "type": "string", "nullable": true }, "entityType": { "$ref": "#/components/schemas/ManagedResourceOrGroupKind" } }, "additionalProperties": false }, "ManagedResourceAppResourceType": { "enum": [ 0, 1 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "NotEnrolled", "Resource" ], "description": "Integer values: 0 = NotEnrolled, 1 = Resource." }, "ManagedResourceBatchOfGuidRequest": { "type": "object", "properties": { "resourceIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "description": "List of resource ids" }, "property": { "type": "string", "description": "ID of the service account to set.", "format": "uuid" } }, "additionalProperties": false, "required": [ "property", "resourceIds" ] }, "ManagedResourceBatchOfGuidUpdateRequest": { "type": "object", "properties": { "resourceIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "description": "List of resource ids" }, "property": { "type": "string", "description": "ID of the service account to set.", "format": "uuid" } }, "additionalProperties": false, "required": [ "resourceIds", "property" ] }, "ManagedResourceCandidateView": { "type": "object", "properties": { "appResourceType": { "$ref": "#/components/schemas/ManagedResourceAppResourceType" }, "id": { "type": "string", "format": "uuid" }, "displayName": { "type": "string", "nullable": true }, "platformId": { "type": "string", "format": "uuid", "nullable": true }, "platformName": { "type": "string", "nullable": true }, "os": { "type": "string", "nullable": true }, "version": { "type": "string", "nullable": true }, "ipAddress": { "type": "string", "nullable": true }, "isDomainController": { "type": "boolean" }, "dnsHostName": { "type": "string", "nullable": true }, "distinguishedName": { "type": "string", "nullable": true }, "domainConfigId": { "type": "string", "format": "uuid", "nullable": true }, "domainName": { "type": "string", "nullable": true }, "managedResourceId": { "type": "string", "format": "uuid", "nullable": true }, "serviceAccountId": { "type": "string", "format": "uuid", "nullable": true }, "serviceAccountName": { "type": "string", "nullable": true } }, "additionalProperties": false }, "ManagedResourceGroup": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this group.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this group.", "nullable": true }, "type": { "$ref": "#/components/schemas/ManagedResourceGroupType" }, "platformId": { "type": "string", "description": "If this is a built-in platform resource group then for which platform?", "format": "uuid", "nullable": true }, "manageAccounts": { "$ref": "#/components/schemas/ManagedResourceGroupManageAccounts" }, "notificationEmailList": { "type": "string", "description": "Comma-delimited list of email addresses to send notifications to", "nullable": true }, "nodeId": { "type": "string", "description": "Support multi-master data clustering", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "managedResourceJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceJoin" }, "description": "Managed resources in this group.", "nullable": true, "readOnly": true }, "platform": { "$ref": "#/components/schemas/Platform" }, "managedResourceGroupPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceGroupPolicyJoin" }, "description": "Policies which reference this group.", "nullable": true, "readOnly": true }, "manageResourceGroupProtectionPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManageResourceGroupProtectionPolicyJoin" }, "description": "Policies which reference this group.", "nullable": true, "readOnly": true }, "ouMappingEnabled": { "type": "boolean", "description": "Is mapping enabled for this group" }, "ouFqdn": { "type": "string", "description": "Fully Qualified Domain Name for the mapped OU", "nullable": true }, "ouDomainConfigId": { "type": "string", "description": "Id of Domain which contains the mapped OU", "format": "uuid", "nullable": true }, "ouDomainConfig": { "$ref": "#/components/schemas/ActiveDirectoryDomainConfiguration" }, "ouAutoOnboard": { "type": "boolean", "description": "Automatically onboard to Privilege Secure." }, "ouIncludeChildren": { "type": "boolean", "description": "Include chiild OUs in the group" }, "defaultPlatform": { "$ref": "#/components/schemas/Platform" }, "defaultPlatformId": { "type": "string", "format": "uuid", "nullable": true, "description": "Default platform for auto-onboarded resources from OU. If null, existing auto-detection logic is used." }, "defaultServiceAccount": { "$ref": "#/components/schemas/Credential" }, "defaultServiceAccountId": { "type": "string", "format": "uuid", "nullable": true, "description": "Default service account for auto-onboarded resources from OU. If null, no service account is assigned." } }, "additionalProperties": false }, "ManagedResourceGroupCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this group.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this group." }, "type": { "$ref": "#/components/schemas/ManagedResourceGroupType" }, "platformId": { "type": "string", "description": "If this is a built-in platform resource group then for which platform?", "format": "uuid", "nullable": true }, "manageAccounts": { "$ref": "#/components/schemas/ManagedResourceGroupManageAccounts" }, "notificationEmailList": { "type": "string", "description": "Comma-delimited list of email addresses to send notifications to", "nullable": true }, "nodeId": { "type": "string", "description": "Support multi-master data clustering", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "managedResourceJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceJoin" }, "description": "Managed resources in this group.", "nullable": true, "readOnly": true }, "platform": { "$ref": "#/components/schemas/Platform" }, "managedResourceGroupPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceGroupPolicyJoin" }, "description": "Policies which reference this group.", "nullable": true, "readOnly": true }, "manageResourceGroupProtectionPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManageResourceGroupProtectionPolicyJoin" }, "description": "Policies which reference this group.", "nullable": true, "readOnly": true }, "ouMappingEnabled": { "type": "boolean", "description": "Is mapping enabled for this group" }, "ouFqdn": { "type": "string", "description": "Fully Qualified Domain Name for the mapped OU", "nullable": true }, "ouDomainConfigId": { "type": "string", "description": "Id of Domain which contains the mapped OU", "format": "uuid", "nullable": true }, "ouDomainConfig": { "$ref": "#/components/schemas/ActiveDirectoryDomainConfiguration" }, "ouAutoOnboard": { "type": "boolean", "description": "Automatically onboard to Privilege Secure." }, "ouIncludeChildren": { "type": "boolean", "description": "Include chiild OUs in the group" }, "defaultPlatform": { "$ref": "#/components/schemas/Platform" }, "defaultPlatformId": { "type": "string", "format": "uuid", "nullable": true, "description": "Default platform for auto-onboarded resources from OU. If null, existing auto-detection logic is used." }, "defaultServiceAccount": { "$ref": "#/components/schemas/Credential" }, "defaultServiceAccountId": { "type": "string", "format": "uuid", "nullable": true, "description": "Default service account for auto-onboarded resources from OU. If null, no service account is assigned." } }, "additionalProperties": false, "required": [ "name" ] }, "ManagedResourceGroupManageAccounts": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "PerResource", "Unmanaged", "Managed" ], "description": "Integer values: 0 = PerResource, 1 = Unmanaged, 2 = Managed." }, "ManagedResourceGroupMultiItemSelector": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "all": { "type": "boolean" }, "filterText": { "type": "string", "nullable": true } }, "additionalProperties": false }, "ManagedResourceGroupNameAndId": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "platformId": { "type": "string", "format": "uuid", "nullable": true }, "basePlatformId": { "type": "string", "format": "uuid", "nullable": true } }, "additionalProperties": false }, "ManagedResourceGroupPolicyJoin": { "type": "object", "properties": { "managedResourceGroupId": { "type": "string", "description": "Id of managed resource group.", "format": "uuid" }, "managedResourceGroup": { "$ref": "#/components/schemas/ManagedResourceGroup" }, "accessControlPolicyId": { "type": "string", "description": "Id of access control policy.", "format": "uuid" }, "accessControlPolicy": { "$ref": "#/components/schemas/AccessControlPolicy" } }, "additionalProperties": false }, "ManagedResourceGroupSkeleton": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "ouMappingEnabled": { "type": "boolean" }, "ouFqdn": { "type": "string", "nullable": true }, "ouAutoOnboard": { "type": "boolean" }, "ouIncludeChildren": { "type": "boolean" }, "ouDomainConfig": { "$ref": "#/components/schemas/ActiveDirectoryDomainConfiguration" }, "resources": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceSkeleton" }, "nullable": true } }, "additionalProperties": false }, "ManagedResourceGroupType": { "enum": [ 0 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Local" ], "description": "Integer values: 0 = Local." }, "ManagedResourceGroupUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this group.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this group." }, "type": { "$ref": "#/components/schemas/ManagedResourceGroupType" }, "platformId": { "type": "string", "description": "If this is a built-in platform resource group then for which platform?", "format": "uuid", "nullable": true }, "manageAccounts": { "$ref": "#/components/schemas/ManagedResourceGroupManageAccounts" }, "notificationEmailList": { "type": "string", "description": "Comma-delimited list of email addresses to send notifications to", "nullable": true }, "nodeId": { "type": "string", "description": "Support multi-master data clustering", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "managedResourceJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceJoin" }, "description": "Managed resources in this group.", "nullable": true, "readOnly": true }, "platform": { "$ref": "#/components/schemas/Platform" }, "managedResourceGroupPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManagedResourceGroupPolicyJoin" }, "description": "Policies which reference this group.", "nullable": true, "readOnly": true }, "manageResourceGroupProtectionPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManageResourceGroupProtectionPolicyJoin" }, "description": "Policies which reference this group.", "nullable": true, "readOnly": true }, "ouMappingEnabled": { "type": "boolean", "description": "Is mapping enabled for this group" }, "ouFqdn": { "type": "string", "description": "Fully Qualified Domain Name for the mapped OU", "nullable": true }, "ouDomainConfigId": { "type": "string", "description": "Id of Domain which contains the mapped OU", "format": "uuid", "nullable": true }, "ouDomainConfig": { "$ref": "#/components/schemas/ActiveDirectoryDomainConfiguration" }, "ouAutoOnboard": { "type": "boolean", "description": "Automatically onboard to Privilege Secure." }, "ouIncludeChildren": { "type": "boolean", "description": "Include chiild OUs in the group" }, "defaultPlatform": { "$ref": "#/components/schemas/Platform" }, "defaultPlatformId": { "type": "string", "format": "uuid", "nullable": true, "description": "Default platform for auto-onboarded resources from OU. If null, existing auto-detection logic is used." }, "defaultServiceAccount": { "$ref": "#/components/schemas/Credential" }, "defaultServiceAccountId": { "type": "string", "format": "uuid", "nullable": true, "description": "Default service account for auto-onboarded resources from OU. If null, no service account is assigned." } }, "additionalProperties": false, "required": [ "id", "name" ] }, "ManagedResourceJoin": { "type": "object", "properties": { "managedResourceId": { "type": "string", "description": "Id of managed resource.", "format": "uuid" }, "managedResource": { "$ref": "#/components/schemas/ManagedResource" }, "managedResourceGroupId": { "type": "string", "description": "Id of managed resource group.", "format": "uuid" }, "managedResourceGroup": { "$ref": "#/components/schemas/ManagedResourceGroup" } }, "additionalProperties": false }, "ManagedResourceLocalUserAppUserType": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "NonUser", "User", "Admin" ], "description": "Integer values: 0 = NonUser, 1 = User, 2 = Admin." }, "ManagedResourceLocalUserView": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "displayName": { "type": "string", "nullable": true }, "email": { "type": "string", "nullable": true }, "managed": { "type": "boolean" }, "managedType": { "$ref": "#/components/schemas/ManagedType" }, "rotationType": { "$ref": "#/components/schemas/ManagedUserType" }, "title": { "type": "string", "nullable": true }, "department": { "type": "string", "nullable": true }, "samAccountName": { "type": "string", "nullable": true }, "userPrincipalName": { "type": "string", "nullable": true }, "distinguishedName": { "type": "string", "nullable": true }, "enabled": { "type": "boolean" }, "unixId": { "type": "integer", "format": "int32", "nullable": true }, "privilege": { "$ref": "#/components/schemas/UserPrivilege" }, "lastLogonUtc": { "type": "string", "format": "date-time", "nullable": true }, "passwordChangedUtc": { "type": "string", "format": "date-time", "nullable": true }, "domainConfigId": { "type": "string", "format": "uuid", "nullable": true }, "domainConfigName": { "type": "string", "nullable": true }, "hostId": { "type": "string", "format": "uuid", "nullable": true }, "hostName": { "type": "string", "nullable": true }, "managedAccountId": { "type": "string", "format": "uuid", "nullable": true }, "managedAccountName": { "type": "string", "nullable": true }, "appUserType": { "$ref": "#/components/schemas/ManagedResourceLocalUserAppUserType" }, "managedUserId": { "type": "string", "format": "uuid", "nullable": true }, "scheduleId": { "type": "string", "format": "uuid", "nullable": true }, "scheduleName": { "type": "string", "nullable": true }, "passwordComplexityId": { "type": "string", "format": "uuid", "nullable": true }, "passwordComplexityName": { "type": "string", "nullable": true }, "credentialId": { "type": "string", "format": "uuid", "nullable": true }, "dependencyCount": { "type": "integer", "format": "int32" }, "passwordStatus": { "$ref": "#/components/schemas/VerificationScanStatus" }, "passwordLastCheckedUtc": { "type": "string", "format": "date-time", "nullable": true }, "passwordNextChangeUtc": { "type": "string", "format": "date-time", "nullable": true }, "changeOnCheckout": { "type": "boolean", "nullable": true }, "changeOnRelease": { "type": "boolean", "nullable": true }, "age": { "type": "integer", "format": "int32" }, "postSessionAction": { "$ref": "#/components/schemas/PostSessionAction" } }, "additionalProperties": false, "description": "One local user of a managed resource. The console uses it to list all the users of a domain on the domain detail page." }, "ManagedResourceManageAccount": { "enum": [ 0, 1 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Unmanaged", "Managed" ], "description": "Integer values: 0 = Unmanaged, 1 = Managed." }, "ManagedResourceOrGroupKind": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Resource", "ResourceGroup", "SecretVault" ], "description": "Integer values: 0 = Resource, 1 = ResourceGroup, 2 = SecretVault." }, "ManagedResourceOrGroupReference": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "entityType": { "$ref": "#/components/schemas/ManagedResourceOrGroupKind" } }, "additionalProperties": false }, "ManagedResourcePolicyJoin": { "type": "object", "properties": { "managedResourceId": { "type": "string", "description": "Id of managed resource.", "format": "uuid" }, "managedResource": { "$ref": "#/components/schemas/ManagedResource" }, "accessControlPolicyId": { "type": "string", "description": "Id of access control policy.", "format": "uuid" }, "accessControlPolicy": { "$ref": "#/components/schemas/AccessControlPolicy" } }, "additionalProperties": false }, "ManagedResourceReference": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "entityType": { "$ref": "#/components/schemas/ManagedResourceOrGroupKind" } }, "additionalProperties": false }, "ManagedResourceSkeleton": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "displayName": { "type": "string", "nullable": true }, "hostId": { "type": "string", "format": "uuid", "nullable": true }, "dnsHostName": { "type": "string", "nullable": true }, "hostDistinguishedName": { "type": "string", "nullable": true }, "hostObjectSid": { "type": "string", "nullable": true }, "onboardState": { "$ref": "#/components/schemas/ResourceOnboardState" }, "onboardStateName": { "type": "string", "nullable": true }, "ipAddress": { "type": "string", "nullable": true }, "manageAccount": { "$ref": "#/components/schemas/ManagedResourceManageAccount" }, "os": { "type": "string", "nullable": true }, "saName": { "type": "string", "nullable": true }, "platformId": { "type": "string", "format": "uuid", "nullable": true }, "builtInAccount": { "type": "string", "nullable": true }, "lastScanDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "platformName": { "type": "string", "nullable": true, "description": "Name of the platform assigned to the resource." } }, "additionalProperties": false, "description": "A reduced view of a managed resource that carries only the fields the action service needs, together with some host information." }, "ManagedResourceType": { "enum": [ 0, 1, 2, 3, 4, 5 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Host", "Domain", "Website", "AzureAdTenant", "SecretVault", "Database" ], "description": "Integer values: 0 = Host, 1 = Domain, 2 = Website, 3 = AzureAdTenant, 4 = SecretVault, 5 = Database." }, "ManagedResourceView": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this resource.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this managed resource.", "nullable": true }, "type": { "$ref": "#/components/schemas/ManagedResourceType" }, "hostId": { "type": "string", "description": "The ID of the Active Directory host, if this resource is a host.", "format": "uuid", "nullable": true }, "host": { "$ref": "#/components/schemas/Host" }, "domainConfigId": { "type": "string", "description": "AD domain definition id", "format": "uuid", "nullable": true }, "domainName": { "type": "string", "description": "AD domain name", "nullable": true }, "websiteId": { "type": "string", "description": "Website id If this resource is a website", "format": "uuid", "nullable": true }, "website": { "$ref": "#/components/schemas/Website" }, "azureAdTenantId": { "type": "string", "description": "Entra ID Tenant id If this resource is an Entra ID tenant", "format": "uuid", "nullable": true }, "azureAdTenant": { "$ref": "#/components/schemas/AzureAdTenant" }, "secretVaultId": { "type": "string", "description": "Secret Vault id if this resource is a Secret Vault", "format": "uuid", "nullable": true }, "secretVault": { "$ref": "#/components/schemas/SecretVault" }, "managedDatabaseId": { "type": "string", "description": "Managed Database id if this resource is a Managed Database", "format": "uuid", "nullable": true }, "managedDatabase": { "$ref": "#/components/schemas/ManagedDatabase" }, "platformId": { "type": "string", "description": "Id of platform that this activity can be performed on.", "format": "uuid", "nullable": true }, "platform": { "$ref": "#/components/schemas/Platform" }, "platformName": { "type": "string", "nullable": true }, "builtInAccount": { "type": "string", "nullable": true }, "displayName": { "type": "string", "description": "Display name for resource.", "nullable": true }, "serviceAccountId": { "type": "string", "description": "Service Account used to connect to the resource.", "format": "uuid", "nullable": true }, "serviceAccount": { "$ref": "#/components/schemas/Credential" }, "manageAccount": { "$ref": "#/components/schemas/ManagedResourceManageAccount" }, "activityConfigurationId": { "type": "string", "description": "Id of configuration collection for this policy.", "format": "uuid", "nullable": true }, "activityConfiguration": { "$ref": "#/components/schemas/ActivityConfiguration" }, "actionQueueId": { "type": "string", "description": "Id of Action queue which manages this resource.", "format": "uuid", "nullable": true }, "hostName": { "type": "string", "nullable": true }, "dnsHostName": { "type": "string", "nullable": true }, "ipAddress": { "type": "string", "nullable": true }, "os": { "type": "string", "nullable": true }, "sourceDnsHostName": { "type": "string", "nullable": true }, "sourceIPAddress": { "type": "string", "nullable": true }, "sourceOS": { "type": "string", "nullable": true }, "hostVersion": { "type": "string", "nullable": true }, "saName": { "type": "string", "nullable": true }, "saUsername": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "lastScanTimeUtc": { "type": "string", "description": "Last time that this host was scanned by protect mode", "format": "date-time", "nullable": true }, "activeSessionCount": { "type": "integer", "description": "Number of active sessions found for this resource. Active sessions are sessions that are currently active or scheduled for the future.", "format": "int32" }, "scheduledSessionCount": { "type": "integer", "description": "Number of pending sessions found for this resource.", "format": "int32" }, "accessPolicyCount": { "type": "integer", "description": "Number of access policies this resource participates in.", "format": "int32" }, "protectionPolicyCount": { "type": "integer", "description": "Number of protection policies this resource participates in.", "format": "int32" }, "portSsh": { "type": "integer", "format": "int32" }, "portRdp": { "type": "integer", "format": "int32" }, "portWinRm": { "type": "integer", "format": "int32" }, "acceptThumbprintOnFirstDiscovery": { "type": "boolean" }, "trustedThumbprint": { "type": "string", "nullable": true }, "discoveredThumbprint": { "type": "string", "nullable": true }, "sshTrustActionType": { "$ref": "#/components/schemas/SshTrustActionType" }, "certificateType": { "$ref": "#/components/schemas/CertificateType" }, "portWinRmHttps": { "type": "integer", "format": "int32" }, "disableWinRm": { "type": "boolean" } }, "additionalProperties": false, "description": "One row of the managed resource listing: the hosts under management, plus Active Directory domains and other items that act as lists of users." }, "ManagedResourceViewUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this resource.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this managed resource.", "nullable": true }, "type": { "$ref": "#/components/schemas/ManagedResourceType" }, "hostId": { "type": "string", "description": "The ID of the Active Directory host, if this resource is a host.", "format": "uuid", "nullable": true }, "host": { "$ref": "#/components/schemas/Host" }, "domainConfigId": { "type": "string", "description": "AD domain definition id", "format": "uuid", "nullable": true }, "domainName": { "type": "string", "description": "AD domain name", "nullable": true }, "websiteId": { "type": "string", "description": "Website id If this resource is a website", "format": "uuid", "nullable": true }, "website": { "$ref": "#/components/schemas/Website" }, "azureAdTenantId": { "type": "string", "description": "Entra ID Tenant id If this resource is an Entra ID tenant", "format": "uuid", "nullable": true }, "azureAdTenant": { "$ref": "#/components/schemas/AzureAdTenant" }, "secretVaultId": { "type": "string", "description": "Secret Vault id if this resource is a Secret Vault", "format": "uuid", "nullable": true }, "secretVault": { "$ref": "#/components/schemas/SecretVault" }, "managedDatabaseId": { "type": "string", "description": "Managed Database id if this resource is a Managed Database", "format": "uuid", "nullable": true }, "managedDatabase": { "$ref": "#/components/schemas/ManagedDatabase" }, "platformId": { "type": "string", "description": "Id of platform that this activity can be performed on.", "format": "uuid", "nullable": true }, "platform": { "$ref": "#/components/schemas/Platform" }, "platformName": { "type": "string", "nullable": true }, "builtInAccount": { "type": "string", "nullable": true }, "displayName": { "type": "string", "description": "Display name for resource.", "nullable": true }, "serviceAccountId": { "type": "string", "description": "Service Account used to connect to the resource.", "format": "uuid", "nullable": true }, "serviceAccount": { "$ref": "#/components/schemas/Credential" }, "manageAccount": { "$ref": "#/components/schemas/ManagedResourceManageAccount" }, "activityConfigurationId": { "type": "string", "description": "Id of configuration collection for this policy.", "format": "uuid", "nullable": true }, "activityConfiguration": { "$ref": "#/components/schemas/ActivityConfiguration" }, "actionQueueId": { "type": "string", "description": "Id of Action queue which manages this resource.", "format": "uuid", "nullable": true }, "hostName": { "type": "string", "nullable": true }, "dnsHostName": { "type": "string", "nullable": true }, "ipAddress": { "type": "string", "nullable": true }, "os": { "type": "string", "nullable": true }, "sourceDnsHostName": { "type": "string", "nullable": true }, "sourceIPAddress": { "type": "string", "nullable": true }, "sourceOS": { "type": "string", "nullable": true }, "hostVersion": { "type": "string", "nullable": true }, "saName": { "type": "string", "nullable": true }, "saUsername": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "lastScanTimeUtc": { "type": "string", "description": "Last time that this host was scanned by protect mode", "format": "date-time", "nullable": true }, "activeSessionCount": { "type": "integer", "description": "Number of active sessions found for this resource. Active sessions are sessions that are currently active or scheduled for the future.", "format": "int32" }, "scheduledSessionCount": { "type": "integer", "description": "Number of pending sessions found for this resource.", "format": "int32" }, "accessPolicyCount": { "type": "integer", "description": "Number of access policies this resource participates in.", "format": "int32" }, "protectionPolicyCount": { "type": "integer", "description": "Number of protection policies this resource participates in.", "format": "int32" }, "portSsh": { "type": "integer", "format": "int32" }, "portRdp": { "type": "integer", "format": "int32" }, "portWinRm": { "type": "integer", "format": "int32" }, "acceptThumbprintOnFirstDiscovery": { "type": "boolean" }, "trustedThumbprint": { "type": "string", "nullable": true }, "discoveredThumbprint": { "type": "string", "nullable": true }, "sshTrustActionType": { "$ref": "#/components/schemas/SshTrustActionType" }, "certificateType": { "$ref": "#/components/schemas/CertificateType" }, "portWinRmHttps": { "type": "integer", "format": "int32" }, "disableWinRm": { "type": "boolean" } }, "additionalProperties": false, "description": "One row of the managed resource listing: the hosts under management, plus Active Directory domains and other items that act as lists of users.", "required": [ "id" ] }, "ManagedStatus": { "enum": [ 0, 1 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Unmanaged", "Managed" ], "description": "Integer values: 0 = Unmanaged, 1 = Managed." }, "ManagedType": { "enum": [ -1, 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "All", "Internal", "Standard", "Service" ], "description": "Integer values: -1 = All, 0 = Internal, 1 = Standard, 2 = Service." }, "ManagedUser": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this managed user.", "format": "uuid" }, "domainId": { "type": "string", "description": "Id of domain associated with this managed user.", "format": "uuid", "nullable": true }, "hostId": { "type": "string", "description": "Id of host associated with this managed user.", "format": "uuid", "nullable": true }, "userId": { "type": "string", "description": "Id of user associated with this managed user.", "format": "uuid", "nullable": true }, "credentialId": { "type": "string", "description": "ID of the actual credentials managed by this system", "format": "uuid", "nullable": true }, "managedResourceId": { "type": "string", "description": "Each managed user is associated with exactly one managed resource", "format": "uuid" }, "managedResource": { "$ref": "#/components/schemas/ManagedResource" }, "managedType": { "$ref": "#/components/schemas/ManagedUserType" }, "verificationScheduleId": { "type": "string", "description": "Id for the managed user verification schedule (can override platform, resource schedule id)", "format": "uuid", "nullable": true }, "verificationSchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "passwordStatus": { "$ref": "#/components/schemas/VerificationScanStatus" }, "passwordComplexityPolicyId": { "type": "string", "description": "Id for password complexity (can override platform, resource password policy id)", "format": "uuid", "nullable": true }, "passwordComplexityPolicy": { "$ref": "#/components/schemas/PasswordComplexity" }, "passwordLastCheckedUtc": { "type": "string", "description": "The last time a managed users password was changed", "format": "date-time", "nullable": true }, "passwordNextChangeUtc": { "type": "string", "description": "The next time a managed users password is scheduled to change", "format": "date-time", "nullable": true }, "actionQueueId": { "type": "string", "description": "Id of action queue to execute to managed this user.", "format": "uuid", "nullable": true }, "actionQueue": { "$ref": "#/components/schemas/ActionQueue" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "isActivityToken": { "type": "boolean" } }, "additionalProperties": false, "description": "This model is used to manage a user." }, "ManagedUserAddRequest": { "type": "object", "properties": { "userId": { "type": "string", "format": "uuid", "nullable": true }, "credentialId": { "type": "string", "format": "uuid", "nullable": true }, "managedType": { "$ref": "#/components/schemas/ManagedUserType" } }, "additionalProperties": false }, "ManagedUserCredential": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "credentialId": { "type": "string", "format": "uuid" }, "managedResourceId": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "username": { "type": "string", "nullable": true }, "password": { "type": "string", "nullable": true }, "managedType": { "$ref": "#/components/schemas/ManagedUserType" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "comment": { "type": "string", "nullable": true } }, "additionalProperties": false, "description": "A managed user together with its credential details, for website managed users, who do not have host user records." }, "ManagedUserCredentialCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "credentialId": { "type": "string", "format": "uuid" }, "managedResourceId": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "username": { "type": "string" }, "password": { "type": "string" }, "managedType": { "$ref": "#/components/schemas/ManagedUserType" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "comment": { "type": "string", "nullable": true } }, "additionalProperties": false, "description": "A managed user together with its credential details, for website managed users, who do not have host user records.", "required": [ "name", "username", "password", "managedResourceId" ] }, "ManagedUserCredentialUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "credentialId": { "type": "string", "format": "uuid" }, "managedResourceId": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "username": { "type": "string" }, "password": { "type": "string", "nullable": true }, "managedType": { "$ref": "#/components/schemas/ManagedUserType" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "comment": { "type": "string", "nullable": true } }, "additionalProperties": false, "description": "A managed user together with its credential details, for website managed users, who do not have host user records.", "required": [ "id", "credentialId", "name", "username", "managedResourceId" ] }, "ManagedUserCredentialUserRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "credentialId": { "type": "string", "format": "uuid" }, "managedResourceId": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "username": { "type": "string", "nullable": true }, "password": { "type": "string", "nullable": true }, "managedType": { "$ref": "#/components/schemas/ManagedUserType" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "comment": { "type": "string", "nullable": true } }, "additionalProperties": false, "description": "A managed user together with its credential details, for website managed users, who do not have host user records.", "required": [ "id", "credentialId", "managedResourceId" ] }, "ManagedUserType": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "NotManaged", "Manual", "Automatic" ], "description": "Integer values: 0 = NotManaged, 1 = Manual, 2 = Automatic." }, "MaxIdleTimeout": { "type": "object", "properties": { "maxIdleUserDays": { "type": "integer", "format": "int32", "description": "Days of inactivity after which a user is treated as idle. Valid values are 0, which turns the feature off, or 90 to 365. The server rejects 1 to 89. The minimum and maximum below give the outer bounds only.", "minimum": 0, "maximum": 365 } }, "additionalProperties": false }, "MetadataRecord": { "type": "object", "properties": { "type": { "$ref": "#/components/schemas/StreamType" }, "timestamp": { "type": "integer", "format": "int64" }, "entries": { "type": "array", "items": { "type": "string" }, "nullable": true } }, "additionalProperties": false }, "MfaConnector": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "enabled": { "type": "boolean" }, "radiusOptionsId": { "type": "string", "format": "uuid", "nullable": true }, "isDefault": { "type": "boolean" }, "isExclusive": { "type": "boolean" }, "connectorType": { "$ref": "#/components/schemas/MfaConnectorType" }, "openIdOptionsId": { "type": "string", "format": "uuid", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "samlOptionsId": { "type": "string", "format": "uuid", "nullable": true }, "useRemoteAccessGateway": { "type": "boolean" } }, "additionalProperties": false }, "MfaConnectorRequest": { "type": "object", "properties": { "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "remoteHost": { "type": "string", "nullable": true }, "remotePort": { "type": "integer", "format": "int32" }, "sendNasIdentifier": { "type": "boolean" }, "sharedSecret": { "type": "string", "nullable": true }, "timeout": { "type": "integer", "format": "int32" }, "maxRetries": { "type": "integer", "format": "int32" }, "authType": { "$ref": "#/components/schemas/RadiusAuthType" }, "dialogTitle": { "type": "string", "nullable": true }, "loginText": { "type": "string", "nullable": true }, "autoResponse": { "type": "boolean" }, "autoResponseText": { "type": "string", "nullable": true }, "responsePrefix": { "type": "string", "nullable": true } }, "additionalProperties": false }, "MfaConnectorType": { "enum": [ -1, 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "MFANotRequired", "MFAConnector", "OpenIdConnect", "Saml" ], "description": "Integer values: -1 = MFANotRequired, 0 = MFAConnector, 1 = OpenIdConnect, 2 = Saml." }, "NameAndId": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true } }, "additionalProperties": false }, "NameIdAndType": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "type": { "type": "integer", "format": "int32" } }, "additionalProperties": false }, "NodeDetail": { "type": "object", "properties": { "id": { "type": "string", "nullable": true }, "nid": { "type": "string", "nullable": true }, "subject": { "type": "string", "nullable": true }, "hostname": { "type": "string", "nullable": true }, "advertise": { "type": "array", "items": { "type": "string" }, "nullable": true }, "tags": { "type": "array", "items": { "type": "string" }, "nullable": true }, "properties": { "type": "object", "additionalProperties": { "type": "string", "nullable": true }, "nullable": true } }, "additionalProperties": false }, "NodeStats": { "type": "object", "properties": { "mem": { "type": "number", "format": "double" }, "cpu": { "type": "number", "format": "float" }, "feature": { "type": "string", "nullable": true }, "pid": { "type": "integer", "format": "int32" }, "ppid": { "type": "integer", "format": "int32" } }, "additionalProperties": false }, "OpenIdLoginType": { "enum": [ 0, 1, 2, 3 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "SamAccountName", "UserPrincipalName", "EmailAddress", "Sid" ], "description": "Integer values: 0 = SamAccountName, 1 = UserPrincipalName, 2 = EmailAddress, 3 = Sid." }, "OpenIdOptions": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "clientId": { "type": "string", "description": "Application client Id from the provider", "nullable": true }, "authority": { "type": "string", "description": "Uri for provider authorization", "nullable": true }, "login": { "$ref": "#/components/schemas/OpenIdLoginType" }, "userIdSource": { "$ref": "#/components/schemas/OpenIdUserIdSource" }, "userIdSourceField": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "OpenIdOptionsUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "clientId": { "type": "string", "description": "Application client Id from the provider", "nullable": true }, "authority": { "type": "string", "description": "Uri for provider authorization", "nullable": true }, "login": { "$ref": "#/components/schemas/OpenIdLoginType" }, "userIdSource": { "$ref": "#/components/schemas/OpenIdUserIdSource" }, "userIdSourceField": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "id" ] }, "OpenIdUserIdSource": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Introspection", "UserInfo", "TokenParse" ], "description": "Integer values: 0 = Introspection, 1 = UserInfo, 2 = TokenParse." }, "OsPlatformMap": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "os": { "type": "string", "nullable": true }, "platformId": { "type": "string", "format": "uuid" }, "platform": { "$ref": "#/components/schemas/Platform" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "OverridePolicy": { "required": [ "name" ], "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "name": { "minLength": 1, "type": "string" }, "description": { "type": "string", "nullable": true }, "type": { "$ref": "#/components/schemas/OverridePolicyType" }, "platformId": { "type": "string", "format": "uuid" }, "scanScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "scanSchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "protectScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "protectSchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "rotateScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "rotateSchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "verifyScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "verifySchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" } }, "additionalProperties": false }, "OverridePolicyType": { "enum": [ 0, 1 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Credential", "Resource" ], "description": "Integer values: 0 = Credential, 1 = Resource." }, "OverridePolicyUpdateRequest": { "required": [ "name", "id" ], "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "name": { "minLength": 1, "type": "string" }, "description": { "type": "string", "nullable": true }, "type": { "$ref": "#/components/schemas/OverridePolicyType" }, "platformId": { "type": "string", "format": "uuid" }, "scanScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "scanSchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "protectScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "protectSchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "rotateScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "rotateSchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "verifyScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "verifySchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" } }, "additionalProperties": false }, "PassFailReport": { "type": "object", "properties": { "passed": { "type": "integer", "format": "int32" }, "failed": { "type": "integer", "format": "int32" }, "report": { "type": "array", "items": { "type": "string" }, "nullable": true } }, "additionalProperties": false }, "PasswordComplexity": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "lowerCase": { "type": "boolean" }, "upperCase": { "type": "boolean" }, "specialCharacter": { "type": "boolean" }, "space": { "type": "boolean" }, "numeric": { "type": "boolean" }, "mustEndWith": { "$ref": "#/components/schemas/CharacterTypeFlags" }, "mustStartWith": { "$ref": "#/components/schemas/CharacterTypeFlags" }, "length": { "type": "integer", "format": "int32" }, "maxConsecutive": { "type": "integer", "format": "int32" }, "charsToExclude": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "type": { "$ref": "#/components/schemas/PasswordComplexityType" } }, "additionalProperties": false }, "PasswordComplexityCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "lowerCase": { "type": "boolean" }, "upperCase": { "type": "boolean" }, "specialCharacter": { "type": "boolean" }, "space": { "type": "boolean" }, "numeric": { "type": "boolean" }, "mustEndWith": { "$ref": "#/components/schemas/CharacterTypeFlags" }, "mustStartWith": { "$ref": "#/components/schemas/CharacterTypeFlags" }, "length": { "type": "integer", "format": "int32", "minimum": 2 }, "maxConsecutive": { "type": "integer", "format": "int32", "minimum": 1, "maximum": 128 }, "charsToExclude": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "type": { "$ref": "#/components/schemas/PasswordComplexityType" } }, "additionalProperties": false, "required": [ "name", "length", "maxConsecutive" ] }, "PasswordComplexityType": { "enum": [ 0, 1 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Password", "Samaccountname" ], "description": "Integer values: 0 = Password, 1 = Samaccountname." }, "PasswordComplexityUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "lowerCase": { "type": "boolean" }, "upperCase": { "type": "boolean" }, "specialCharacter": { "type": "boolean" }, "space": { "type": "boolean" }, "numeric": { "type": "boolean" }, "mustEndWith": { "$ref": "#/components/schemas/CharacterTypeFlags" }, "mustStartWith": { "$ref": "#/components/schemas/CharacterTypeFlags" }, "length": { "type": "integer", "format": "int32" }, "maxConsecutive": { "type": "integer", "format": "int32" }, "charsToExclude": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "type": { "$ref": "#/components/schemas/PasswordComplexityType" } }, "additionalProperties": false, "required": [ "id", "name", "length", "maxConsecutive" ] }, "PasswordOptions": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "requiredLength": { "type": "integer", "format": "int32" }, "requiredUniqueChars": { "type": "integer", "format": "int32" }, "requireNonAlphanumeric": { "type": "boolean" }, "requireLowercase": { "type": "boolean" }, "requireUppercase": { "type": "boolean" }, "requireDigit": { "type": "boolean" }, "passwordExpirationInDays": { "type": "integer", "format": "int32" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "PasswordRulesUpdateRequest": { "type": "object", "properties": { "needs": { "$ref": "#/components/schemas/CharacterTypeFlags" }, "mustEndWith": { "$ref": "#/components/schemas/CharacterTypeFlags" }, "mustStartWith": { "$ref": "#/components/schemas/CharacterTypeFlags" }, "length": { "type": "integer", "format": "int32" }, "maxConsecutive": { "type": "integer", "format": "int32" }, "charsToExclude": { "type": "string", "nullable": true } }, "additionalProperties": false, "required": [ "length" ] }, "PermissionNamesAndId": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "permissionName": { "type": "string", "nullable": true }, "groupName": { "type": "string", "nullable": true } }, "additionalProperties": false }, "Platform": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this platform.", "format": "uuid" }, "name": { "type": "string", "description": "Name for this platform.", "nullable": true }, "description": { "type": "string", "description": "Description for this platform.", "nullable": true }, "builtInAccount": { "type": "string", "nullable": true }, "passwordComplexityPolicyId": { "type": "string", "format": "uuid", "nullable": true }, "passwordComplexityPolicy": { "$ref": "#/components/schemas/PasswordComplexity" }, "scheduledChangePolicyId": { "type": "string", "format": "uuid", "nullable": true }, "scheduledChangePolicy": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "protectionPolicyScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "protectionPolicySchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "scanScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "scanSchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "verificationScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "verificationSchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "resetOnMismatch": { "type": "boolean" }, "icon": { "type": "string", "format": "byte", "nullable": true }, "basePlatformId": { "type": "string", "format": "uuid", "nullable": true }, "type": { "$ref": "#/components/schemas/PlatformType" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "os": { "type": "string", "nullable": true, "description": "OS is the list of operating systems returned by uname - this is for custom platform support" }, "permanent": { "type": "boolean", "description": "Permanent is set true for base platforms that cannot be deleted" }, "showCommandPlans": { "type": "boolean", "description": "Indicates to show command plans." } }, "additionalProperties": false, "description": "A platform on which an activity can be performed." }, "PlatformCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this platform.", "format": "uuid" }, "name": { "type": "string", "description": "Name for this platform." }, "description": { "type": "string", "description": "Description for this platform.", "nullable": true }, "builtInAccount": { "type": "string", "nullable": true }, "passwordComplexityPolicyId": { "type": "string", "format": "uuid", "nullable": true }, "passwordComplexityPolicy": { "$ref": "#/components/schemas/PasswordComplexity" }, "scheduledChangePolicyId": { "type": "string", "format": "uuid", "nullable": true }, "scheduledChangePolicy": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "protectionPolicyScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "protectionPolicySchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "scanScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "scanSchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "verificationScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "verificationSchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "resetOnMismatch": { "type": "boolean" }, "icon": { "type": "string", "format": "byte", "nullable": true }, "basePlatformId": { "type": "string", "format": "uuid", "nullable": true, "readOnly": true }, "type": { "$ref": "#/components/schemas/PlatformType" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "os": { "type": "string", "nullable": true, "description": "OS is the list of operating systems returned by uname - this is for custom platform support" }, "permanent": { "type": "boolean", "description": "Permanent is set true for base platforms that cannot be deleted" }, "showCommandPlans": { "type": "boolean", "description": "Indicates to show command plans.", "readOnly": true } }, "additionalProperties": false, "description": "A platform on which an activity can be performed.", "required": [ "name" ] }, "PlatformNameIdBase": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "basePlatformId": { "type": "string", "format": "uuid", "nullable": true }, "permanent": { "type": "boolean" } }, "additionalProperties": false }, "PlatformType": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Unspecified", "Cloud", "Database" ], "description": "Integer values: 0 = Unspecified, 1 = Cloud, 2 = Database." }, "PlatformUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier for this platform.", "format": "uuid" }, "name": { "type": "string", "description": "Name for this platform." }, "description": { "type": "string", "description": "Description for this platform.", "nullable": true }, "builtInAccount": { "type": "string", "nullable": true }, "passwordComplexityPolicyId": { "type": "string", "format": "uuid", "nullable": true }, "passwordComplexityPolicy": { "$ref": "#/components/schemas/PasswordComplexity" }, "scheduledChangePolicyId": { "type": "string", "format": "uuid", "nullable": true }, "scheduledChangePolicy": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "protectionPolicyScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "protectionPolicySchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "scanScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "scanSchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "verificationScheduleId": { "type": "string", "format": "uuid", "nullable": true }, "verificationSchedule": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "resetOnMismatch": { "type": "boolean" }, "icon": { "type": "string", "format": "byte", "nullable": true }, "basePlatformId": { "type": "string", "format": "uuid", "nullable": true }, "type": { "$ref": "#/components/schemas/PlatformType" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "os": { "type": "string", "nullable": true, "description": "OS is the list of operating systems returned by uname - this is for custom platform support" }, "permanent": { "type": "boolean", "description": "Permanent is set true for base platforms that cannot be deleted" }, "showCommandPlans": { "type": "boolean", "description": "Indicates to show command plans." } }, "additionalProperties": false, "description": "A platform on which an activity can be performed.", "required": [ "id", "name" ] }, "PolicyInfo": { "type": "object", "properties": { "activityId": { "type": "string", "format": "uuid" }, "managedAccountId": { "type": "string", "format": "uuid" }, "policyId": { "type": "string", "format": "uuid" }, "policyName": { "type": "string", "nullable": true }, "policyType": { "$ref": "#/components/schemas/PolicyType" }, "maxSessionLength": { "type": "integer", "format": "int32" }, "notesRequired": { "type": "boolean" }, "ticketRequired": { "type": "boolean" }, "activityCard": { "$ref": "#/components/schemas/ActivityCardWithPolicies" }, "customFields": { "type": "array", "items": { "$ref": "#/components/schemas/CustomField" }, "nullable": true } }, "additionalProperties": false }, "PolicyType": { "enum": [ 0, 1 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Resource", "Credential" ], "description": "Integer values: 0 = Resource, 1 = Credential." }, "PostSessionAction": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "description": "Integer values: 0 = Disable, 1 = Enable, 2 = KeepPrevious.", "x-enum-varnames": [ "Disable", "Enable", "KeepPrevious" ] }, "ProtectedGroup": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this group.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this group.", "nullable": true }, "allowedProtectedGroupMember": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectedGroupMember" }, "description": "Members allowed in this group.", "nullable": true }, "currentProtectedGroupMember": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectedGroupMember" }, "description": "Current members in this group.", "nullable": true }, "managedResourceId": { "type": "string", "description": "Id of managed resource which protects this group.", "format": "uuid" }, "managedResource": { "$ref": "#/components/schemas/ManagedResource" }, "isSystem": { "type": "boolean", "description": "Protection policy created by" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A protected group associated with a managed resource." }, "ProtectedGroupCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this group.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this group.", "nullable": true }, "allowedProtectedGroupMember": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectedGroupMember" }, "description": "Members allowed in this group.", "nullable": true }, "currentProtectedGroupMember": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectedGroupMember" }, "description": "Current members in this group.", "nullable": true }, "managedResourceId": { "type": "string", "description": "Id of managed resource which protects this group.", "format": "uuid" }, "managedResource": { "$ref": "#/components/schemas/ManagedResource" }, "isSystem": { "type": "boolean", "description": "Protection policy created by" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A protected group associated with a managed resource.", "required": [ "managedResourceId" ] }, "ProtectedGroupMember": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this member.", "format": "uuid" }, "userName": { "type": "string", "description": "UserName of this member.", "nullable": true }, "userId": { "type": "string", "description": "Id of user if this member is a user.", "format": "uuid", "nullable": true }, "allowedProtectedGroupId": { "type": "string", "description": "Id of group to which this member is allowed.", "format": "uuid", "nullable": true }, "allowedProtectedGroup": { "$ref": "#/components/schemas/ProtectedGroup" }, "currentProtectedGroupId": { "type": "string", "description": "Id of group to which this member belongs.", "format": "uuid", "nullable": true }, "currentProtectedGroup": { "$ref": "#/components/schemas/ProtectedGroup" }, "isTransient": { "type": "boolean", "description": "Transient group membership (was added by a session)" }, "isSystem": { "type": "boolean", "description": "System group membership (was added by policy)" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A member of a protected group associated with a managed resource." }, "ProtectedGroupMemberInfo": { "type": "object", "properties": { "groupName": { "type": "string", "nullable": true }, "groupMember": { "type": "string", "nullable": true } }, "additionalProperties": false }, "ProtectionPolicy": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this policy.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this policy.", "nullable": true }, "description": { "type": "string", "description": "Human readable description of this policy.", "nullable": true }, "groupMonitorInterval": { "type": "integer", "format": "int32" }, "isDisabled": { "type": "boolean", "description": "True if this policy has been disabled." }, "isDeleted": { "type": "boolean", "description": "True if this policy has been deleted." }, "protectionPolicyGroup": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectionPolicyGroup" }, "description": "Protected groups which belong to this policy.", "nullable": true }, "manageResourceProtectionPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManageResourceProtectionPolicyJoin" }, "description": "Managed resources which use this policy.", "nullable": true }, "manageResourceGroupProtectionPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/ManageResourceGroupProtectionPolicyJoin" }, "description": "Managed resource groups which use this policy.", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A policy that specifies the groups to protect on a collection of managed resources." }, "ProtectionPolicyGroup": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this group.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this group.", "nullable": true }, "deleted": { "type": "boolean", "description": "Has this group been removed from policy?" }, "protectionPolicyId": { "type": "string", "description": "Id of policy to which this group belongs.", "format": "uuid" }, "protectionPolicy": { "$ref": "#/components/schemas/ProtectionPolicy" }, "protectionPolicyGroupMember": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectionPolicyGroupMember" }, "description": "Members allowed in this group.", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A group that is protected by a protection policy." }, "ProtectionPolicyGroupMember": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this member.", "format": "uuid" }, "userName": { "type": "string", "description": "UserName of this member.", "nullable": true }, "deleted": { "type": "boolean", "description": "Has this member been removed from its group?" }, "userId": { "type": "string", "description": "Id of user if this member is a user.", "format": "uuid", "nullable": true }, "protectionPolicyGroupId": { "type": "string", "description": "Id of group in which this member is allowed.", "format": "uuid", "nullable": true }, "protectionPolicyGroup": { "$ref": "#/components/schemas/ProtectionPolicyGroup" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A member of a group that a protection policy protects." }, "ProxySession": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "activitySessionId": { "type": "string", "format": "uuid" }, "record": { "type": "boolean" }, "type": { "type": "string", "nullable": true }, "active": { "type": "boolean" }, "startDateTimeUtc": { "type": "string", "format": "date-time" }, "endDateTimeUtc": { "type": "string", "format": "date-time" }, "key": { "type": "string", "nullable": true }, "locked": { "type": "boolean" }, "lockedMessage": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "sessionMetadata": { "$ref": "#/components/schemas/ReplayMetadata" } }, "additionalProperties": false }, "RadiusAuthType": { "enum": [ 0, 1 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "MSCHAPv2", "PAP" ], "description": "Authentication protocol. Integer values: 0 = MSCHAPv2, 1 = PAP." }, "RecurrenceType": { "enum": [ 0, 1, 2, 3, 4 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "None", "Minutes", "Daily", "Weekly", "Monthly" ], "description": "Integer values: 0 = None, 1 = Minutes, 2 = Daily, 3 = Weekly, 4 = Monthly." }, "RegisteredService": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this service.", "format": "uuid" }, "type": { "$ref": "#/components/schemas/RegisteredServiceType" }, "name": { "type": "string", "description": "Host name for this service.", "nullable": true }, "added": { "type": "string", "description": "When this service was registered.", "format": "date-time" }, "refreshToken": { "type": "string", "description": "Refresh token to the service (encrypted)", "nullable": true }, "appTokenId": { "type": "string", "description": "Id of App token assigned to this service.", "format": "uuid", "nullable": true }, "appToken": { "$ref": "#/components/schemas/AppToken" }, "status": { "$ref": "#/components/schemas/RegisteredServiceStatus" }, "description": { "type": "string", "description": "Human readable description of service status.", "nullable": true }, "version": { "type": "string", "description": "Version number reported by the service.", "nullable": true }, "serviceRegistrationId": { "type": "string", "description": "Id of service registration associated with this service.", "format": "uuid", "nullable": true }, "serviceRegistration": { "$ref": "#/components/schemas/ServiceRegistration" }, "actionServiceProperty": { "type": "array", "items": { "$ref": "#/components/schemas/ActionServiceProperty" }, "description": "A list of properties associated with this service.", "nullable": true }, "actionQueueAction": { "type": "array", "items": { "$ref": "#/components/schemas/ActionQueueAction" }, "description": "A list of action queue actions currently active on this service if this is an action service.", "nullable": true }, "serviceNodeId": { "type": "string", "description": "Id of the node this service is running from", "format": "uuid", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A registration for a service." }, "RegisteredServiceStatus": { "enum": [ 0, 1 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Offline", "Running" ], "description": "Integer values: 0 = Offline, 1 = Running." }, "RegisteredServiceType": { "enum": [ -2, -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Unknown", "TestService", "ActionService", "ProxyService", "AgentService", "EmailService", "ServiceNode", "SchedulerService", "SiemService", "ActiveDirectoryService", "WebService", "RagGateway", "RagPortal", "HostScanService" ], "description": "Integer values: -2 = Unknown, -1 = TestService, 0 = ActionService, 1 = ProxyService, 2 = AgentService, 3 = EmailService, 4 = ServiceNode, 5 = SchedulerService, 6 = SiemService, 7 = ActiveDirectoryService, 8 = WebService, 9 = RagGateway, 10 = RagPortal, 11 = HostScanService." }, "ReplayMetadata": { "type": "object", "properties": { "id": { "type": "string", "nullable": true }, "nid": { "type": "string", "nullable": true }, "size": { "type": "integer", "format": "int32" }, "startTimestamp": { "type": "string", "format": "date-time" }, "endTimestamp": { "type": "string", "format": "date-time", "nullable": true }, "recordingStartTimestamp": { "type": "string", "format": "date-time", "nullable": true }, "recordingEndTimestamp": { "type": "string", "format": "date-time", "nullable": true }, "records": { "type": "array", "items": { "$ref": "#/components/schemas/MetadataRecord" }, "nullable": true } }, "additionalProperties": false }, "Report": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "reportFolder": { "$ref": "#/components/schemas/ReportFolder" }, "reportFolderId": { "type": "string", "format": "uuid" }, "source": { "$ref": "#/components/schemas/ReportSource" }, "sourceId": { "type": "string", "format": "uuid" }, "reportAttributes": { "type": "array", "items": { "$ref": "#/components/schemas/ReportAttribute" }, "nullable": true }, "createdBy": { "type": "string", "format": "uuid", "nullable": true }, "reportFavorites": { "type": "array", "items": { "$ref": "#/components/schemas/ReportFavorite" }, "nullable": true }, "durationType": { "$ref": "#/components/schemas/ReportDurationType" }, "startDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "endDateTimeUtc": { "type": "string", "format": "date-time", "nullable": true }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "nodeId": { "type": "string", "format": "uuid" } }, "additionalProperties": false }, "ReportAttribute": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "reportId": { "type": "string", "format": "uuid" }, "report": { "$ref": "#/components/schemas/Report" }, "reportAttributeTemplateId": { "type": "string", "format": "uuid" }, "reportAttributeTemplate": { "$ref": "#/components/schemas/ReportAttributeTemplate" }, "value": { "type": "string", "nullable": true }, "operator": { "$ref": "#/components/schemas/ReportOperator" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "nodeId": { "type": "string", "format": "uuid" } }, "additionalProperties": false }, "ReportAttributeDataType": { "enum": [ 0, 1, 2, 3, 4 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Boolean", "Number", "String", "Options", "FreeSolo" ], "description": "Integer values: 0 = Boolean, 1 = Number, 2 = String, 3 = Options, 4 = FreeSolo." }, "ReportAttributeTemplate": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "displayName": { "type": "string", "nullable": true }, "dataType": { "$ref": "#/components/schemas/ReportAttributeDataType" }, "type": { "$ref": "#/components/schemas/ReportAttributeType" }, "reportAttributeTemplateJoins": { "type": "array", "items": { "$ref": "#/components/schemas/ReportAttributeTemplateJoin" }, "nullable": true }, "reportOperatorJoins": { "type": "array", "items": { "$ref": "#/components/schemas/ReportOperatorJoin" }, "nullable": true }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "nodeId": { "type": "string", "format": "uuid" } }, "additionalProperties": false }, "ReportAttributeTemplateJoin": { "type": "object", "properties": { "reportSourceId": { "type": "string", "format": "uuid" }, "reportSource": { "$ref": "#/components/schemas/ReportSource" }, "reportAttributeTemplateId": { "type": "string", "format": "uuid" }, "reportAttributeTemplate": { "$ref": "#/components/schemas/ReportAttributeTemplate" }, "attributeName": { "type": "string", "nullable": true } }, "additionalProperties": false }, "ReportAttributeType": { "enum": [ -1, 0, 1, 2, 3, 4, 5, 6, 7, 8 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "None", "User", "Host", "Domain", "Platform", "Activity", "Credential", "Privilege", "RotationType", "RotationStatus" ], "description": "Integer values: -1 = None, 0 = User, 1 = Host, 2 = Domain, 3 = Platform, 4 = Activity, 5 = Credential, 6 = Privilege, 7 = RotationType, 8 = RotationStatus." }, "ReportColumn": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "reportSourceId": { "type": "string", "format": "uuid" }, "source": { "$ref": "#/components/schemas/ReportSource" }, "name": { "type": "string", "nullable": true }, "title": { "type": "string", "nullable": true }, "columnOrder": { "type": "integer", "format": "int32" }, "dataType": { "type": "string", "nullable": true }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "nodeId": { "type": "string", "format": "uuid" } }, "additionalProperties": false }, "ReportDurationType": { "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "LastHour", "Last4Hours", "Last8Hours", "Last24Hours", "Last5Days", "Last7Days", "Last14Days", "Last30Days", "Custom" ], "description": "Integer values: 0 = LastHour, 1 = Last4Hours, 2 = Last8Hours, 3 = Last24Hours, 4 = Last5Days, 5 = Last7Days, 6 = Last14Days, 7 = Last30Days, 8 = Custom." }, "ReportFavorite": { "type": "object", "properties": { "reportId": { "type": "string", "format": "uuid" }, "report": { "$ref": "#/components/schemas/Report" }, "userId": { "type": "string", "format": "uuid" } }, "additionalProperties": false }, "ReportFolder": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "reportFolderId": { "type": "string", "format": "uuid", "nullable": true }, "reports": { "type": "array", "items": { "$ref": "#/components/schemas/Report" }, "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ReportOperator": { "enum": [ 0, 1, 2, 3, 4, 5, 6, 7 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Equals", "NotEquals", "Contains", "NotContains", "StartsWith", "EndsWith", "LessThan", "GreaterThan" ], "description": "Integer values: 0 = Equals, 1 = NotEquals, 2 = Contains, 3 = NotContains, 4 = StartsWith, 5 = EndsWith, 6 = LessThan, 7 = GreaterThan." }, "ReportOperatorJoin": { "type": "object", "properties": { "reportAttributeTemplateId": { "type": "string", "format": "uuid" }, "reportAttributeTemplate": { "$ref": "#/components/schemas/ReportAttributeTemplate" }, "reportOperator": { "$ref": "#/components/schemas/ReportOperator" } }, "additionalProperties": false }, "ReportRenderTree": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "parentId": { "type": "string", "format": "uuid", "nullable": true }, "name": { "type": "string", "nullable": true }, "isFavorite": { "type": "boolean" }, "children": { "type": "array", "items": { "$ref": "#/components/schemas/ReportRenderTree" }, "nullable": true } }, "additionalProperties": false }, "ReportSource": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "dbSet": { "type": "string", "nullable": true }, "reportAttributeTemplateJoins": { "type": "array", "items": { "$ref": "#/components/schemas/ReportAttributeTemplateJoin" }, "nullable": true }, "columns": { "type": "array", "items": { "$ref": "#/components/schemas/ReportColumn" }, "nullable": true }, "dateColumn": { "type": "string", "nullable": true }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "nodeId": { "type": "string", "format": "uuid" } }, "additionalProperties": false }, "ReportSubscription": { "type": "object", "properties": { "reportId": { "type": "string", "format": "uuid" }, "report": { "$ref": "#/components/schemas/Report" }, "managedAccountId": { "type": "string", "format": "uuid" }, "managedAccount": { "$ref": "#/components/schemas/ManagedAccount" }, "scheduledChangePolicyId": { "type": "string", "format": "uuid" }, "scheduledChangePolicy": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "actionJobId": { "type": "string", "format": "uuid", "nullable": true }, "actionJob": { "$ref": "#/components/schemas/ActionJob" }, "subscribedToCsv": { "type": "boolean" }, "subscribedToPdf": { "type": "boolean" } }, "additionalProperties": false }, "ReportSubscriptionUpdateRequest": { "type": "object", "properties": { "reportId": { "type": "string", "format": "uuid" }, "report": { "$ref": "#/components/schemas/Report" }, "managedAccountId": { "type": "string", "format": "uuid" }, "managedAccount": { "$ref": "#/components/schemas/ManagedAccount" }, "scheduledChangePolicyId": { "type": "string", "format": "uuid" }, "scheduledChangePolicy": { "$ref": "#/components/schemas/ScheduledChangePolicy" }, "actionJobId": { "type": "string", "format": "uuid", "nullable": true }, "actionJob": { "$ref": "#/components/schemas/ActionJob" }, "subscribedToCsv": { "type": "boolean" }, "subscribedToPdf": { "type": "boolean" } }, "additionalProperties": false, "required": [ "reportId", "managedAccountId", "scheduledChangePolicyId" ] }, "ReportTree": { "type": "object", "properties": { "folders": { "type": "array", "items": { "$ref": "#/components/schemas/ReportRenderTree" }, "nullable": true }, "reports": { "type": "array", "items": { "$ref": "#/components/schemas/ReportRenderTree" }, "nullable": true } }, "additionalProperties": false }, "RequesterLoginFormat": { "enum": [ 0, 1, 2, 3, 4 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Samaccountname", "UPN", "Email", "SamAccountNameOnly", "Custom" ], "description": "Integer values: 0 = Samaccountname, 1 = UPN, 2 = Email, 3 = SamAccountNameOnly, 4 = Custom." }, "ResourceOnboardState": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "NotOnboard", "Onboard", "OnboardInGroup" ], "description": "Integer values: 0 = NotOnboard, 1 = Onboard, 2 = OnboardInGroup." }, "RoleAssignmentCounts": { "type": "object", "additionalProperties": false, "description": "How many role assignments succeeded (item1) and how many failed (item2).", "properties": { "item1": { "type": "integer", "format": "int32", "description": "Number of role assignments that succeeded." }, "item2": { "type": "integer", "format": "int32", "description": "Number of role assignments that failed." } } }, "RoleMember": { "type": "object", "properties": { "memberId": { "type": "string", "format": "uuid" }, "memberName": { "type": "string", "nullable": true }, "memberType": { "$ref": "#/components/schemas/ManagedAccountKind" } }, "additionalProperties": false }, "RoleTarget": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "AccessPolicies", "Credentials", "Auditors" ], "description": "Integer values: 0 = AccessPolicies, 1 = Credentials, 2 = Auditors." }, "RolesRole": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "roleTarget": { "$ref": "#/components/schemas/RoleTarget" }, "isDeleted": { "type": "boolean" }, "builtInRole": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "allActivities": { "type": "boolean" }, "allCredentials": { "type": "boolean" }, "allPolicies": { "type": "boolean" }, "allResources": { "type": "boolean" }, "allUsers": { "type": "boolean" } }, "additionalProperties": false }, "RolesRoleCopyRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "roleTarget": { "$ref": "#/components/schemas/RoleTarget" }, "isDeleted": { "type": "boolean" }, "builtInRole": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "allActivities": { "type": "boolean" }, "allCredentials": { "type": "boolean" }, "allPolicies": { "type": "boolean" }, "allResources": { "type": "boolean" }, "allUsers": { "type": "boolean" } }, "additionalProperties": false, "required": [ "id", "name" ] }, "RolesRoleCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "roleTarget": { "$ref": "#/components/schemas/RoleTarget" }, "isDeleted": { "type": "boolean" }, "builtInRole": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "allActivities": { "type": "boolean" }, "allCredentials": { "type": "boolean" }, "allPolicies": { "type": "boolean" }, "allResources": { "type": "boolean" }, "allUsers": { "type": "boolean" } }, "additionalProperties": false, "required": [ "name" ] }, "RolesRolePermissionView": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "permissionId": { "type": "string", "format": "uuid" }, "permissionName": { "type": "string", "nullable": true }, "permissionDescription": { "type": "string", "nullable": true }, "groupId": { "type": "string", "format": "uuid" }, "groupName": { "type": "string", "nullable": true }, "groupDescription": { "type": "string", "nullable": true } }, "additionalProperties": false }, "RolesRoleUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "roleTarget": { "$ref": "#/components/schemas/RoleTarget" }, "isDeleted": { "type": "boolean" }, "builtInRole": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" }, "allActivities": { "type": "boolean" }, "allCredentials": { "type": "boolean" }, "allPolicies": { "type": "boolean" }, "allResources": { "type": "boolean" }, "allUsers": { "type": "boolean" } }, "additionalProperties": false, "required": [ "id", "name" ] }, "RuntimeParameterOverride": { "type": "object", "description": "A value that replaces one action parameter for a single run.", "properties": { "actionId": { "type": "string", "format": "uuid" }, "parameterName": { "type": "string", "nullable": true }, "value": { "type": "string", "nullable": true } } }, "SamlOptions": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "issuer": { "type": "string", "nullable": true }, "logoutUri": { "type": "string", "nullable": true }, "loginType": { "$ref": "#/components/schemas/OpenIdLoginType" }, "claim": { "type": "string", "nullable": true }, "checkCertificate": { "type": "boolean" }, "certificate": { "type": "string", "nullable": true }, "nameIdPolicy": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "SamlOptionsUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "issuer": { "type": "string", "nullable": true }, "logoutUri": { "type": "string", "nullable": true }, "loginType": { "$ref": "#/components/schemas/OpenIdLoginType" }, "claim": { "type": "string", "nullable": true }, "checkCertificate": { "type": "boolean" }, "certificate": { "type": "string", "nullable": true }, "nameIdPolicy": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "id" ] }, "SamlRequest": { "type": "object", "properties": { "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "issuer": { "type": "string", "nullable": true }, "logoutUri": { "type": "string", "nullable": true }, "loginType": { "$ref": "#/components/schemas/OpenIdLoginType" }, "claim": { "type": "string", "nullable": true }, "checkCertificate": { "type": "boolean" }, "certificate": { "type": "string", "nullable": true }, "nameIdPolicy": { "type": "string", "nullable": true } }, "additionalProperties": false }, "ScheduledChangePolicy": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "frequency": { "$ref": "#/components/schemas/ScheduledChangePolicyFrequencyType" }, "periodValue": { "type": "integer", "format": "int32" }, "daysOfWeek": { "type": "string", "nullable": true }, "dayNumber": { "type": "integer", "format": "int32" }, "localTime": { "type": "string", "format": "date-time" }, "utcTime": { "type": "string", "format": "date-time", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ScheduledChangePolicyFrequencyType": { "enum": [ 0, 1, 2, 3, 4 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Hours", "DaysAtTime", "WeeklyOnDaysOfWeek", "MonthlyOnDay", "Minutes" ], "description": "Integer values: 0 = Hours, 1 = DaysAtTime, 2 = WeeklyOnDaysOfWeek, 3 = MonthlyOnDay, 4 = Minutes." }, "ScheduledTaskAction": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "classId": { "type": "string", "format": "uuid", "nullable": true }, "data": { "type": "string", "nullable": true }, "arguments": { "type": "string", "nullable": true }, "execute": { "type": "string", "nullable": true }, "workingDirectory": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "ScheduledTaskTrigger": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "enabled": { "type": "boolean" }, "endBoundary": { "type": "string", "nullable": true }, "executionThrottleLimit": { "type": "string", "nullable": true }, "taskName": { "type": "string", "nullable": true }, "startBoundary": { "type": "string", "nullable": true }, "repetitionDuration": { "type": "string", "nullable": true }, "repetitionInterval": { "type": "string", "nullable": true }, "repetitionStopAtDurationEnd": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "SearchParams": { "type": "object", "properties": { "skip": { "type": "integer", "description": "Start at this item (default: 0)", "format": "int32" }, "take": { "type": "integer", "description": "Return this number of items (default: 100)", "format": "int32" }, "orderBy": { "type": "string", "description": "Property name to order results by", "nullable": true }, "orderDescending": { "type": "boolean", "description": "Use descending sort order (default: false)" }, "filterText": { "type": "string", "description": "Filter by entries that contain this text. Properties match vary by endpoint.", "nullable": true }, "filterColumns": { "type": "array", "items": { "type": "string" }, "description": "Columns to include in filter", "nullable": true } }, "additionalProperties": false, "description": "Common search parameters for controllers" }, "SecretVault": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "readOnly": true }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "SecretVaultCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "managedResourceId": { "type": "string", "format": "uuid" }, "platformId": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "policyIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true } }, "additionalProperties": false, "required": [ "name" ] }, "SecretVaultSummary": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "managedResourceId": { "type": "string", "format": "uuid" }, "platformId": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "policyIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true } }, "additionalProperties": false }, "SecretVaultUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "managedResourceId": { "type": "string", "format": "uuid" }, "platformId": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "policyIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true } }, "additionalProperties": false, "required": [ "id", "name", "managedResourceId" ] }, "ServiceRegistration": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this service registration.", "format": "uuid" }, "type": { "$ref": "#/components/schemas/RegisteredServiceType" }, "dnsHostName": { "type": "string", "description": "Host name for this service registration.", "nullable": true }, "credentialId": { "type": "string", "description": "Id of credentials for host.", "format": "uuid", "nullable": true }, "serviceName": { "type": "string", "description": "Service name for this service registration.", "nullable": true }, "settingsFilePath": { "type": "string", "description": "Settings file path for this service registration.", "nullable": true }, "settingsFileContents": { "type": "string", "description": "Settings file contents for this service registration.", "nullable": true }, "createdBy": { "type": "string", "description": "Id of logged in user who created this registration.", "format": "uuid", "nullable": true }, "actionQueueId": { "type": "string", "description": "Id of action queue which registers this service.", "format": "uuid", "nullable": true }, "actionQueue": { "$ref": "#/components/schemas/ActionQueue" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "A registration for a remote service." }, "ServiceStartType": { "enum": [ 0, 1, 2, 3, 4 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Boot", "System", "Automatic", "Manual", "Disabled" ], "description": "Integer values: 0 = Boot, 1 = System, 2 = Automatic, 3 = Manual, 4 = Disabled." }, "ServiceStatus": { "enum": [ 1, 2, 3, 4, 5, 6, 7 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Stopped", "StartPending", "StopPending", "Running", "ContinuePending", "PausePending", "Paused" ], "description": "Integer values: 1 = Stopped, 2 = StartPending, 3 = StopPending, 4 = Running, 5 = ContinuePending, 6 = PausePending, 7 = Paused." }, "ServiceTypeFlags": { "enum": [ 1, 2, 4, 8, 16, 32, 256 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "KernelDriver", "FileSystemDriver", "Adapter", "RecognizerDriver", "Win32OwnProcess", "Win32ShareProcess", "InteractiveProcess" ], "description": "Integer values: 1 = KernelDriver, 2 = FileSystemDriver, 4 = Adapter, 8 = RecognizerDriver, 16 = Win32OwnProcess, 32 = Win32ShareProcess, 256 = InteractiveProcess. A flags value: add the numbers together to combine members." }, "SessionStatus": { "enum": [ -1, 0, 1, 2, 3, 4, 5, 6, 7 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "ApprovalRequired", "Pending", "Active", "Cancelling", "Complete", "Failed", "Cancelled", "ApprovalDenied", "ApprovalFailed" ], "description": "Integer values: -1 = ApprovalRequired, 0 = Pending, 1 = Active, 2 = Cancelling, 3 = Complete, 4 = Failed, 5 = Cancelled, 6 = ApprovalDenied, 7 = ApprovalFailed." }, "SessionSummary": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this session.", "format": "uuid" }, "hostId": { "type": "string", "description": "Id of host associated with this session.", "format": "uuid", "nullable": true }, "hostDisplayName": { "type": "string", "description": "The display name for the host", "nullable": true }, "domainId": { "type": "string", "description": "Id of domain associated with this session.", "format": "uuid", "nullable": true }, "domainName": { "type": "string", "description": "The display name for the host", "nullable": true }, "userId": { "type": "string", "description": "Id of user associated with this session.", "format": "uuid", "nullable": true }, "userDisplayName": { "type": "string", "description": "The display for the user.", "nullable": true }, "targetUserId": { "type": "string", "description": "Id of target user associated with this session. Note: This may be a local user on the target.", "format": "uuid", "nullable": true }, "targetUserDisplayName": { "type": "string", "description": "The display for the target user. Note: This may be a local user on the target.", "nullable": true }, "canViewPassword": { "type": "boolean", "description": "If true caller can view the password for this session." }, "canAutofillPassword": { "type": "boolean", "description": "If true browser extension can autofill the password for this session." }, "viewPasswordInSeconds": { "type": "integer", "description": "Timeout period for displaying session password (if canViewPassword is true)", "format": "int32" }, "recordAudio": { "type": "boolean" }, "createdBy": { "type": "string", "description": "Id of the user that created the session.", "format": "uuid", "nullable": true }, "managedAccountId": { "type": "string", "description": "Id of managed user that created the session.", "format": "uuid", "nullable": true }, "managedResourceId": { "type": "string", "description": "ID of the managed resource associated with the target host.", "format": "uuid", "nullable": true }, "managedResourceName": { "type": "string", "description": "Name of the managed resource associated with the target host.", "nullable": true }, "managedResourceOs": { "type": "string", "description": "Name of the managed resource associated with the target host.", "nullable": true }, "managedResourceDisplayName": { "type": "string", "description": "Optional display name of the managed resource associated with the target host.", "nullable": true }, "createdByDisplayName": { "type": "string", "description": "The display name of the user that created the session.", "nullable": true }, "startDateTimeUtc": { "type": "string", "description": "Scheduled date/time when the session should start.", "format": "date-time", "nullable": true }, "actualStartDateTimeUtc": { "type": "string", "description": "Actual date/time when the session started.", "format": "date-time", "nullable": true }, "endDateTimeUtc": { "type": "string", "description": "Scheduled date/time when the session should end.", "format": "date-time", "nullable": true }, "actualEndDateTimeUtc": { "type": "string", "description": "Actual date/time when the session ended.", "format": "date-time", "nullable": true }, "durationInSeconds": { "type": "integer", "description": "Session Duration calculated into seconds", "format": "int32" }, "createdDateTimeUtc": { "type": "string", "format": "date-time", "description": "Date and time in UTC when the record was created." }, "expirationDateTimeUtc": { "type": "string", "description": "When this session will expire.", "format": "date-time", "nullable": true }, "sessionStatus": { "$ref": "#/components/schemas/SessionStatus" }, "sessionStatusDescription": { "type": "string", "description": "ActivitySession status description", "nullable": true }, "status": { "$ref": "#/components/schemas/SessionSummaryStatus" }, "statusMessage": { "type": "string", "description": "Information text that provides additional information about the status.", "nullable": true }, "loginDateTimeUtc": { "type": "string", "description": "Last login date time.", "format": "date-time", "nullable": true }, "loginSessionState": { "$ref": "#/components/schemas/LoginSessionState" }, "activityName": { "type": "string", "description": "The selected Activity for this Flip", "nullable": true }, "activityId": { "type": "string", "format": "uuid", "nullable": true }, "activityType": { "$ref": "#/components/schemas/ActivityType" }, "connectionUri": { "type": "string", "description": "Uri for connect now icon. RDP URL for RDP file download. SSH URL for SSH is of the form ssh://username+activty+dnshostname@proxy", "nullable": true }, "platformId": { "type": "string", "format": "uuid" }, "platformName": { "type": "string", "nullable": true }, "userType": { "$ref": "#/components/schemas/AccountType" }, "proxySessions": { "type": "array", "items": { "$ref": "#/components/schemas/ProxySession" }, "nullable": true }, "accessPolicyId": { "type": "string", "format": "uuid", "nullable": true }, "accessPolicyName": { "type": "string", "nullable": true }, "note": { "type": "string", "nullable": true }, "ticket": { "type": "string", "nullable": true }, "managedResourceType": { "$ref": "#/components/schemas/ManagedResourceType" }, "targetId": { "type": "string", "format": "uuid", "nullable": true }, "targetName": { "type": "string", "nullable": true }, "loginAccountName": { "type": "string", "nullable": true }, "loginDisplayName": { "type": "string", "nullable": true }, "websiteId": { "type": "string", "format": "uuid", "nullable": true }, "azureAdTenantId": { "type": "string", "format": "uuid", "nullable": true }, "vaultId": { "type": "string", "format": "uuid", "nullable": true }, "managedDatabaseId": { "type": "string", "format": "uuid", "nullable": true }, "locked": { "type": "boolean" }, "allowSessionExtension": { "type": "boolean" }, "sessionExtensionCount": { "type": "integer", "format": "int32" }, "sessionExtensionMinutes": { "type": "integer", "format": "int32" }, "expirationTimeoutThreshold": { "type": "integer", "format": "int32" }, "encryptedFileId": { "type": "string", "format": "uuid", "description": "Encrypted File id", "nullable": true }, "encryptedFileName": { "type": "string", "nullable": true, "description": "Encrypted File name" }, "loginAccount": { "$ref": "#/components/schemas/ActivityLoginType" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time", "description": "Date and time in UTC when the record was last modified." }, "nodeId": { "type": "string", "format": "uuid", "description": "Identifier of the server node that stores this record. Do not send it when you create the record." }, "notesRequired": { "type": "boolean" }, "serviceNowTicketLink": { "type": "string", "nullable": true }, "ticketRequired": { "type": "boolean" } }, "additionalProperties": false }, "SessionSummaryStatus": { "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Unknown", "Active", "ActiveNoLogon", "Cancelling", "Completed", "CompletedWithErrors", "Pending", "Cancelled", "ApprovalRequired", "ApprovalDenied", "ApprovalFailed", "Locked" ], "description": "Integer values: 0 = Unknown, 1 = Active, 2 = ActiveNoLogon, 3 = Cancelling, 4 = Completed, 5 = CompletedWithErrors, 6 = Pending, 7 = Cancelled, 8 = ApprovalRequired, 9 = ApprovalDenied, 10 = ApprovalFailed, 11 = Locked." }, "SiemServer": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "serverType": { "type": "string", "nullable": true }, "name": { "type": "string", "nullable": true }, "host": { "type": "string", "nullable": true }, "enabled": { "type": "boolean" }, "port": { "type": "integer", "format": "int32" }, "siemTemplateId": { "type": "string", "format": "uuid" }, "protocol": { "type": "string", "nullable": true }, "useSsl": { "type": "boolean" }, "enabledTime": { "type": "string", "format": "date-time", "nullable": true }, "maxEventCreationTime": { "type": "string", "format": "date-time", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "SiemServerUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "serverType": { "type": "string", "nullable": true }, "name": { "type": "string", "nullable": true }, "host": { "type": "string", "nullable": true }, "enabled": { "type": "boolean" }, "port": { "type": "integer", "format": "int32" }, "siemTemplateId": { "type": "string", "format": "uuid" }, "protocol": { "type": "string", "nullable": true }, "useSsl": { "type": "boolean" }, "enabledTime": { "type": "string", "format": "date-time", "nullable": true }, "maxEventCreationTime": { "type": "string", "format": "date-time", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "id" ] }, "SiemSettings": { "type": "object", "additionalProperties": false, "description": "The SIEM settings of a SIEM server: its connection details and the template it uses.", "properties": { "id": { "type": "string", "format": "uuid" }, "serverType": { "type": "string", "nullable": true }, "host": { "type": "string", "nullable": true }, "enabled": { "type": "boolean" }, "port": { "type": "integer", "format": "int32" }, "siemTemplateId": { "type": "string", "format": "uuid" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } } }, "SiemTemplate": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "templateFormat": { "type": "string", "nullable": true }, "version": { "type": "string", "nullable": true }, "charactersToEscape": { "type": "string", "nullable": true }, "escapeCharacter": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "SiemTemplateUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "templateFormat": { "type": "string", "nullable": true }, "version": { "type": "string", "nullable": true }, "charactersToEscape": { "type": "string", "nullable": true }, "escapeCharacter": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "id" ] }, "SimpleAccessControlPolicy": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this item.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this policy.", "nullable": true }, "description": { "type": "string", "description": "Human readable description of this policy.", "nullable": true }, "priority": { "type": "integer", "description": "Priority of this policy relative to other matching policies. Note: 0 is the lowest priority.", "format": "int32" }, "notesRequired": { "type": "boolean", "description": "Access policy requires users provide notes when requesting a session." }, "ticketRequired": { "type": "boolean", "description": "Access policy requires users provide a service ticket number when requesting a session." }, "approvalTypeRequired": { "$ref": "#/components/schemas/ApprovalType" }, "policyType": { "$ref": "#/components/schemas/PolicyType" }, "managedAccountIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "managedAccountGroupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "managedResourceIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "managedResourceGroupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "credentialIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "activityIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "activities": { "type": "array", "items": { "$ref": "#/components/schemas/Activity" }, "nullable": true }, "activityConfiguration": { "type": "string", "nullable": true }, "activityConfigurationMaxSessionLength": { "type": "integer", "format": "int32", "nullable": true }, "activityConfigurationId": { "type": "string", "format": "uuid", "nullable": true }, "activityGroups": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityGroup" }, "nullable": true }, "activityGroupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true } }, "additionalProperties": false }, "SimpleAccessControlPolicyCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this item.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this policy." }, "description": { "type": "string", "description": "Human readable description of this policy.", "nullable": true }, "priority": { "type": "integer", "description": "Priority of this policy relative to other matching policies. Note: 0 is the lowest priority.", "format": "int32" }, "notesRequired": { "type": "boolean", "description": "Access policy requires users provide notes when requesting a session.", "readOnly": true }, "ticketRequired": { "type": "boolean", "description": "Access policy requires users provide a service ticket number when requesting a session.", "readOnly": true }, "approvalTypeRequired": { "readOnly": true, "allOf": [ { "$ref": "#/components/schemas/ApprovalType" } ] }, "policyType": { "$ref": "#/components/schemas/PolicyType" }, "managedAccountIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "managedAccountGroupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "managedResourceIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "managedResourceGroupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "credentialIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "activityIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "activities": { "type": "array", "items": { "$ref": "#/components/schemas/Activity" }, "nullable": true, "readOnly": true }, "activityConfiguration": { "type": "string", "nullable": true, "readOnly": true }, "activityConfigurationMaxSessionLength": { "type": "integer", "format": "int32", "nullable": true, "readOnly": true }, "activityConfigurationId": { "type": "string", "format": "uuid" }, "activityGroups": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityGroup" }, "nullable": true, "readOnly": true }, "activityGroupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true } }, "additionalProperties": false, "required": [ "name", "activityConfigurationId" ] }, "SimpleAccessControlPolicyUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this item.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this policy." }, "description": { "type": "string", "description": "Human readable description of this policy.", "nullable": true }, "priority": { "type": "integer", "description": "Priority of this policy relative to other matching policies. Note: 0 is the lowest priority.", "format": "int32" }, "notesRequired": { "type": "boolean", "description": "Access policy requires users provide notes when requesting a session." }, "ticketRequired": { "type": "boolean", "description": "Access policy requires users provide a service ticket number when requesting a session." }, "approvalTypeRequired": { "$ref": "#/components/schemas/ApprovalType" }, "policyType": { "$ref": "#/components/schemas/PolicyType" }, "managedAccountIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "managedAccountGroupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "managedResourceIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "managedResourceGroupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "credentialIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "activityIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "activities": { "type": "array", "items": { "$ref": "#/components/schemas/Activity" }, "nullable": true }, "activityConfiguration": { "type": "string", "nullable": true }, "activityConfigurationMaxSessionLength": { "type": "integer", "format": "int32", "nullable": true }, "activityConfigurationId": { "type": "string", "format": "uuid" }, "activityGroups": { "type": "array", "items": { "$ref": "#/components/schemas/ActivityGroup" }, "nullable": true }, "activityGroupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true } }, "additionalProperties": false, "required": [ "id", "name", "activityConfigurationId" ] }, "SimpleProtectionPolicy": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this item.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this policy.", "nullable": true }, "description": { "type": "string", "description": "Human readable description of this policy.", "nullable": true }, "groupMonitorInterval": { "type": "integer", "format": "int32" }, "managedResourceIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "managedResourceGroupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "groupMembers": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectedGroupMemberInfo" }, "nullable": true } }, "additionalProperties": false }, "SimpleProtectionPolicyCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this item.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this policy." }, "description": { "type": "string", "description": "Human readable description of this policy.", "nullable": true }, "groupMonitorInterval": { "type": "integer", "format": "int32" }, "managedResourceIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "managedResourceGroupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "groupMembers": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectedGroupMemberInfo" }, "nullable": true } }, "additionalProperties": false, "required": [ "name" ] }, "SimpleProtectionPolicyResourcesAndGroupsRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this item.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this policy.", "nullable": true }, "description": { "type": "string", "description": "Human readable description of this policy.", "nullable": true }, "groupMonitorInterval": { "type": "integer", "format": "int32" }, "managedResourceIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "managedResourceGroupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "groupMembers": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectedGroupMemberInfo" }, "nullable": true } }, "additionalProperties": false, "required": [ "id", "name" ] }, "SimpleProtectionPolicyUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique ID of this item.", "format": "uuid" }, "name": { "type": "string", "description": "Name of this policy.", "nullable": true }, "description": { "type": "string", "description": "Human readable description of this policy.", "nullable": true }, "groupMonitorInterval": { "type": "integer", "format": "int32" }, "managedResourceIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "managedResourceGroupIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true }, "groupMembers": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectedGroupMemberInfo" }, "nullable": true } }, "additionalProperties": false, "required": [ "id" ] }, "SimpleRdpFileOptions": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique Id", "format": "uuid" }, "defaultResolution": { "type": "string", "description": "Default resolution for RDP sessions", "nullable": true }, "allowedResolutions": { "type": "array", "items": { "type": "string" }, "description": "Allowed resolutions", "nullable": true }, "multiMonitor": { "type": "boolean", "description": "Enable multi-monitor for RDP connections" }, "smartSizing": { "type": "boolean", "description": "Enable smart sizing for RDP connections" }, "certificateThumbprint": { "type": "string", "description": "Use the certificate for signing RDP files", "nullable": true }, "nodeId": { "type": "string", "description": "Identifier of the server node that stores this record.", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "description": "Created date time UTC", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "description": "Modified date time UTC", "format": "date-time" } }, "additionalProperties": false }, "SimpleRdpFileOptionsCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique Id", "format": "uuid" }, "defaultResolution": { "type": "string", "description": "Default resolution for RDP sessions", "nullable": true }, "allowedResolutions": { "type": "array", "items": { "type": "string" }, "description": "Allowed resolutions" }, "multiMonitor": { "type": "boolean", "description": "Enable multi-monitor for RDP connections" }, "smartSizing": { "type": "boolean", "description": "Enable smart sizing for RDP connections" }, "certificateThumbprint": { "type": "string", "description": "Use the certificate for signing RDP files", "nullable": true }, "nodeId": { "type": "string", "description": "Identifier of the server node that stores this record.", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "description": "Created date time UTC", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "description": "Modified date time UTC", "format": "date-time" } }, "additionalProperties": false, "required": [ "allowedResolutions", "id" ] }, "SshCertificateInfo": { "type": "object", "additionalProperties": false, "description": "The SSH key settings of a credential.", "properties": { "credentialId": { "type": "string", "format": "uuid" }, "credentialType": { "$ref": "#/components/schemas/CredentialType" }, "authenticationMethod": { "$ref": "#/components/schemas/AuthenticationMethodType" }, "autoGenPassphrase": { "type": "boolean", "nullable": true }, "keyGenAlgorithm": { "type": "string", "nullable": true }, "keyLength": { "type": "integer", "format": "int32", "nullable": true }, "privateKey": { "type": "string", "nullable": true }, "passphrase": { "type": "string", "nullable": true }, "publicKey": { "type": "string", "nullable": true }, "sudoCommand": { "type": "string", "nullable": true } } }, "SshCertificateInfoResponse": { "type": "object", "additionalProperties": false, "description": "The response body for the SSH key settings of a credential. The settings are in value.", "properties": { "value": { "$ref": "#/components/schemas/SshCertificateInfo" }, "formatters": { "type": "array", "items": { "type": "object" }, "nullable": true }, "contentTypes": { "type": "array", "items": { "type": "string" }, "nullable": true }, "declaredType": { "type": "string", "nullable": true }, "statusCode": { "type": "integer", "format": "int32", "nullable": true } } }, "SshTrustActionType": { "enum": [ 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "AlwaysTrustIgnoreThumbprint", "WarnOnThumbprintMismatch", "ErrorOnThumbprintMismatch" ], "description": "Integer values: 0 = AlwaysTrustIgnoreThumbprint, 1 = WarnOnThumbprintMismatch, 2 = ErrorOnThumbprintMismatch." }, "StreamType": { "enum": [ -1, 0, 1, 2, 3 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Unknown", "All", "Windows_Audit", "StdIn", "StdOut" ], "description": "Integer values: -1 = Unknown, 0 = All, 1 = Windows_Audit, 2 = StdIn, 3 = StdOut." }, "TestResourceStatus": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "managedResourceId": { "type": "string", "format": "uuid", "nullable": true }, "hostId": { "type": "string", "format": "uuid", "nullable": true }, "status": { "$ref": "#/components/schemas/TestStepStatus" }, "startedDateTimeUtc": { "type": "string", "format": "date-time" }, "finishedDateTimeUtc": { "type": "string", "format": "date-time" }, "errorMessage": { "type": "string", "nullable": true }, "steps": { "type": "array", "items": { "$ref": "#/components/schemas/TestResourceStatusStep" }, "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "TestResourceStatusStep": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "testResourceStatusId": { "type": "string", "format": "uuid" }, "testResourceStatus": { "$ref": "#/components/schemas/TestResourceStatus" }, "stepName": { "type": "string", "nullable": true }, "index": { "type": "integer", "format": "int32" }, "status": { "$ref": "#/components/schemas/TestStepStatus" }, "errorMessage": { "type": "string", "nullable": true }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "TestStepStatus": { "enum": [ 0, 1, 2, 3, 4 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Pending", "Running", "Passed", "Failed", "NotRun" ], "description": "Integer values: 0 = Pending, 1 = Running, 2 = Passed, 3 = Failed, 4 = NotRun." }, "TimeoutSettings": { "type": "object", "properties": { "timeoutMinutes": { "type": "integer", "format": "int32" } }, "additionalProperties": false }, "UserAndGroupCollection": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "userCollectionJoin": { "type": "array", "items": { "$ref": "#/components/schemas/UserCollectionJoin" }, "nullable": true, "readOnly": true }, "groupCollectionJoin": { "type": "array", "items": { "$ref": "#/components/schemas/GroupCollectionJoin" }, "nullable": true, "readOnly": true }, "userAndGroupCollectionPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/UserAndGroupCollectionPolicyJoin" }, "nullable": true, "readOnly": true }, "isReviewer": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "UserAndGroupCollectionCopyRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "description": { "type": "string", "nullable": true }, "userCollectionJoin": { "type": "array", "items": { "$ref": "#/components/schemas/UserCollectionJoin" }, "nullable": true, "readOnly": true }, "groupCollectionJoin": { "type": "array", "items": { "$ref": "#/components/schemas/GroupCollectionJoin" }, "nullable": true, "readOnly": true }, "userAndGroupCollectionPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/UserAndGroupCollectionPolicyJoin" }, "nullable": true, "readOnly": true }, "isReviewer": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "id", "name" ] }, "UserAndGroupCollectionCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "userCollectionJoin": { "type": "array", "items": { "$ref": "#/components/schemas/UserCollectionJoin" }, "nullable": true, "readOnly": true }, "groupCollectionJoin": { "type": "array", "items": { "$ref": "#/components/schemas/GroupCollectionJoin" }, "nullable": true, "readOnly": true }, "userAndGroupCollectionPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/UserAndGroupCollectionPolicyJoin" }, "nullable": true, "readOnly": true }, "isReviewer": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "name" ] }, "UserAndGroupCollectionMultiItemSelector": { "type": "object", "properties": { "userAndGroupIdAndTypes": { "type": "array", "items": { "$ref": "#/components/schemas/UserAndGroupIdAndType" }, "nullable": true }, "all": { "type": "boolean" }, "filterText": { "type": "string", "nullable": true }, "entityType": { "$ref": "#/components/schemas/ManagedAccountKind" } }, "additionalProperties": false }, "UserAndGroupCollectionPolicyJoin": { "type": "object", "properties": { "accessControlPolicyId": { "type": "string", "format": "uuid" }, "userAndGroupCollectionId": { "type": "string", "format": "uuid" }, "userAndGroupCollection": { "$ref": "#/components/schemas/UserAndGroupCollection" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "UserAndGroupCollectionUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "userCollectionJoin": { "type": "array", "items": { "$ref": "#/components/schemas/UserCollectionJoin" }, "nullable": true, "readOnly": true }, "groupCollectionJoin": { "type": "array", "items": { "$ref": "#/components/schemas/GroupCollectionJoin" }, "nullable": true, "readOnly": true }, "userAndGroupCollectionPolicyJoin": { "type": "array", "items": { "$ref": "#/components/schemas/UserAndGroupCollectionPolicyJoin" }, "nullable": true, "readOnly": true }, "isReviewer": { "type": "boolean" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "id", "name" ] }, "UserAndGroupIdAndType": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "entityType": { "$ref": "#/components/schemas/ManagedAccountKind" } }, "additionalProperties": false }, "UserCollectionJoin": { "type": "object", "properties": { "managedAccountId": { "type": "string", "description": "Id of Managed Account.", "format": "uuid" }, "managedAccount": { "$ref": "#/components/schemas/ManagedAccount" }, "userAndGroupCollectionId": { "type": "string", "description": "Id of User Collection.", "format": "uuid" }, "userAndGroupCollection": { "$ref": "#/components/schemas/UserAndGroupCollection" } }, "additionalProperties": false, "description": "Links managed accounts to user collections." }, "UserPrivilege": { "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "NotSet", "Administrator", "PowerUser", "Guest", "User", "SuperUser", "LinuxUser", "CiscoPrivilege_0", "CiscoPrivilege_1", "CiscoPrivilege_2", "CiscoPrivilege_3", "CiscoPrivilege_4", "CiscoPrivilege_5", "CiscoPrivilege_6", "CiscoPrivilege_7", "CiscoPrivilege_8", "CiscoPrivilege_9", "CiscoPrivilege_10", "CiscoPrivilege_11", "CiscoPrivilege_12", "CiscoPrivilege_13", "CiscoPrivilege_14", "CiscoPrivilege_15", "DomainAdmin", "EnterpriseAdmin" ], "description": "Integer values: 0 = NotSet, 1 = Administrator, 2 = PowerUser, 3 = Guest, 4 = User, 5 = SuperUser, 6 = LinuxUser, 7 = CiscoPrivilege_0, 8 = CiscoPrivilege_1, 9 = CiscoPrivilege_2, 10 = CiscoPrivilege_3, 11 = CiscoPrivilege_4, 12 = CiscoPrivilege_5, 13 = CiscoPrivilege_6, 14 = CiscoPrivilege_7, 15 = CiscoPrivilege_8, 16 = CiscoPrivilege_9, 17 = CiscoPrivilege_10, 18 = CiscoPrivilege_11, 19 = CiscoPrivilege_12, 20 = CiscoPrivilege_13, 21 = CiscoPrivilege_14, 22 = CiscoPrivilege_15, 23 = DomainAdmin, 24 = EnterpriseAdmin." }, "UserRoleAssignment": { "type": "object", "properties": { "id": { "type": "string", "nullable": true }, "roleName": { "type": "string", "description": "Name of the role", "nullable": true }, "isAssigned": { "type": "boolean", "description": "Whether the role is assigned" } }, "additionalProperties": false }, "UserRoleLevel": { "enum": [ 0, 50, 150 ], "type": "integer", "description": "Integer values: 0 = None, 50 = Administrator, 150 = Reviewer.", "format": "int32", "x-enum-varnames": [ "None", "Administrator", "Reviewer" ] }, "VerificationScanStatus": { "enum": [ 0, 1, 2, 3, 4, 5 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Unspecified", "Verified", "Pending", "Changed", "Failed", "Mismatch" ], "description": "Integer values: 0 = Unspecified, 1 = Verified, 2 = Pending, 3 = Changed, 4 = Failed, 5 = Mismatch." }, "Website": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique Id", "format": "uuid" }, "name": { "type": "string", "description": "required - name of Website", "nullable": true }, "avatarUrl": { "type": "string", "description": "optional - URL to avatar image (size 96x96)", "nullable": true }, "associatedResourceId": { "type": "string", "description": "The ID of the managed resource that represents the server that hosts this website.", "format": "uuid", "nullable": true }, "logonUrl": { "type": "string", "description": "Where to send the browser for the user to get into the site; typically a login page", "nullable": true }, "uris": { "type": "array", "items": { "$ref": "#/components/schemas/WebsiteUri" }, "description": "List of whole URIs or match patterns that this website incorporates", "nullable": true }, "isVirtual": { "type": "boolean", "description": "True if not a real website Used for AzureAD tenants" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "description": "This is the detail record for web-type manged resources" }, "WebsiteResource": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "managedResourceId": { "type": "string", "format": "uuid" }, "name": { "type": "string", "nullable": true }, "avatarUrl": { "type": "string", "nullable": true }, "platformId": { "type": "string", "format": "uuid" }, "associatedResourceId": { "type": "string", "format": "uuid", "nullable": true }, "logonUrl": { "type": "string", "nullable": true }, "uris": { "type": "array", "items": { "$ref": "#/components/schemas/WebsiteUri" }, "nullable": true } }, "additionalProperties": false }, "WebsiteUri": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "websiteId": { "type": "string", "format": "uuid" }, "website": { "$ref": "#/components/schemas/Website" }, "uri": { "type": "string", "nullable": true }, "match": { "$ref": "#/components/schemas/WebsiteUriMatchType" }, "matchType": { "$ref": "#/components/schemas/WebsiteUriMatchType" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "WebsiteUriCreateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "websiteId": { "type": "string", "format": "uuid" }, "website": { "$ref": "#/components/schemas/Website" }, "uri": { "type": "string" }, "match": { "$ref": "#/components/schemas/WebsiteUriMatchType" }, "matchType": { "$ref": "#/components/schemas/WebsiteUriMatchType" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "websiteId", "uri" ] }, "WebsiteUriMatchType": { "enum": [ -1, 0, 1, 2, 3, 4, 5 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "All", "Domain", "Exact", "Never", "StartsWith", "Regex", "Host" ], "description": "Integer values: -1 = All, 0 = Domain, 1 = Exact, 2 = Never, 3 = StartsWith, 4 = Regex, 5 = Host." }, "WebsiteUriUpdateRequest": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "websiteId": { "type": "string", "format": "uuid" }, "website": { "$ref": "#/components/schemas/Website" }, "uri": { "type": "string" }, "match": { "$ref": "#/components/schemas/WebsiteUriMatchType" }, "matchType": { "$ref": "#/components/schemas/WebsiteUriMatchType" }, "nodeId": { "type": "string", "format": "uuid" }, "createdDateTimeUtc": { "type": "string", "format": "date-time" }, "modifiedDateTimeUtc": { "type": "string", "format": "date-time" } }, "additionalProperties": false, "required": [ "id", "websiteId", "uri" ] }, "WinRmHttpSettings": { "enum": [ -1, 0, 1, 2 ], "type": "integer", "format": "int32", "x-enum-varnames": [ "Default", "UseHttp", "UseHttpsIfAvailable", "UseHttpsOnly" ], "description": "Integer values: -1 = Default, 0 = UseHttp, 1 = UseHttpsIfAvailable, 2 = UseHttpsOnly." }, "WinRmSettings": { "type": "object", "properties": { "httpSettings": { "$ref": "#/components/schemas/WinRmHttpSettings" }, "thumbprint": { "type": "string", "nullable": true } }, "additionalProperties": false } } } }