openapi: 3.1.0 info: title: openstack-keystone description: OpenStack Keystone service license: name: Apache-2.0 identifier: Apache-2.0 version: 4.0.1 paths: /: get: tags: - version summary: Version discovery endpoint. description: Version discovery operationId: version responses: '200': description: Versions content: application/json: schema: $ref: '#/components/schemas/Versions' /v3: get: tags: - version summary: Version discovery endpoint description: Version discovery operationId: version responses: '200': description: Versions content: application/json: schema: $ref: '#/components/schemas/SingleVersion' /v3/auth/projects: get: tags: - auth summary: Get available project scopes. description: |- This call returns the list of projects that are available to be scoped to based on the X-Auth-Token provided in the request. operationId: list responses: '200': description: Project list content: application/json: schema: $ref: '#/components/schemas/ProjectShortList' /v3/auth/tokens: get: tags: - auth summary: Validate and show information for token. description: |- Validates and shows information for a token, including its expiration date and authorization scope. Pass your own token in the X-Auth-Token request header. Pass the token that you want to validate in the X-Subject-Token request header. operationId: show parameters: - name: nocatalog in: query description: |- The authentication response excludes the service catalog. By default, the response includes the service catalog. required: false schema: type: - boolean - 'null' - name: allow_expired in: query description: |- Allow fetching a token that has expired. By default expired tokens return a 404 exception. required: false schema: type: - boolean - 'null' responses: '200': description: Token object content: application/json: schema: $ref: '#/components/schemas/TokenResponse' post: tags: - auth summary: Authenticate user issuing a new token. description: Issue token operationId: create parameters: - name: nocatalog in: query description: |- The authentication response excludes the service catalog. By default, the response includes the service catalog. required: false schema: type: - boolean - 'null' responses: '200': description: Token object content: application/json: schema: $ref: '#/components/schemas/TokenResponse' '429': description: Rate limit exceeded delete: tags: - auth summary: Revoke token. description: |- Revokes a token. This call is similar to the HEAD /auth/tokens call except that the `X-Subject-Token` token is immediately not valid, regardless of the expires_at attribute value. An additional `X-Auth-Token` is not required. operationId: delete responses: '204': description: Token has been revoked. /v3/credentials: get: tags: - credentials summary: List credentials. description: List credentials operationId: list parameters: - name: type in: query description: Filter by credential type. required: false schema: type: - string - 'null' - name: user_id in: query description: Filter by owning user ID. required: false schema: type: - string - 'null' responses: '200': description: List of credentials content: application/json: schema: $ref: '#/components/schemas/CredentialList' '500': description: Internal error post: tags: - credentials summary: Create a new credential. operationId: create requestBody: content: application/json: schema: $ref: '#/components/schemas/CredentialCreateRequest' required: true responses: '201': description: Credential created content: application/json: schema: $ref: '#/components/schemas/CredentialResponse' '400': description: Invalid input '500': description: Internal error /v3/credentials/{credential_id}: get: tags: - credentials summary: Get single credential. description: Get credential by ID operationId: show parameters: - name: credential_id in: path required: true schema: type: string responses: '200': description: Credential object content: application/json: schema: $ref: '#/components/schemas/CredentialResponse' '404': description: Credential not found delete: tags: - credentials summary: Delete a credential. description: Delete credential by ID operationId: delete parameters: - name: credential_id in: path required: true schema: type: string responses: '204': description: Credential deleted '404': description: Credential not found patch: tags: - credentials summary: Update an existing credential. description: Update credential by ID operationId: update parameters: - name: credential_id in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/CredentialUpdateRequest' required: true responses: '200': description: Updated credential content: application/json: schema: $ref: '#/components/schemas/CredentialResponse' '404': description: Credential not found /v3/domains: get: tags: - domains summary: List domains description: List domains operationId: list parameters: - name: ids in: query description: Filter domains by the `id` attribute. required: false schema: type: - string - 'null' - name: name in: query description: Filter domains by the `name` attribute. required: false schema: type: - string - 'null' responses: '200': description: List of domains content: application/json: schema: $ref: '#/components/schemas/DomainList' '500': description: Internal error post: tags: - domains summary: Create domain. description: Creates a domain, which is a container for projects and users. operationId: create requestBody: content: application/json: schema: $ref: '#/components/schemas/DomainCreateRequest' required: true responses: '201': description: Domain created content: application/json: schema: $ref: '#/components/schemas/DomainResponse' '400': description: Invalid input '500': description: Internal error /v3/domains/{domain_id}: get: tags: - domains summary: Get single domain operationId: show parameters: - name: domain_id in: path required: true schema: type: string responses: '200': description: Single domain content: application/json: schema: $ref: '#/components/schemas/DomainResponse' '404': description: Domain not found delete: tags: - domains summary: Delete domain by ID. operationId: remove parameters: - name: domain_id in: path required: true schema: type: string responses: '204': description: Deleted '404': description: Domain not found /v3/ec2tokens: post: tags: - ec2tokens summary: |- Validate the signed `credentials` object and issue a Keystone token scoped to the referenced EC2 credential's project/user. description: Validate an EC2 request signature and issue a token operationId: create requestBody: content: application/json: schema: $ref: '#/components/schemas/Ec2TokenAuthRequest' required: true responses: '200': description: Token object content: application/json: schema: $ref: '#/components/schemas/TokenResponse' /v3/endpoints: get: tags: - endpoints summary: List endpoints description: List endpoints operationId: list parameters: - name: interface in: query description: Filters the response by an interface. required: false schema: type: - string - 'null' - name: service_id in: query description: Filters the response by a service ID. required: false schema: type: - string - 'null' - name: region_id in: query description: Filters the response by a region ID. required: false schema: type: - string - 'null' responses: '200': description: List of endpoints content: application/json: schema: $ref: '#/components/schemas/EndpointList' '500': description: Internal error post: tags: - endpoints summary: Create a new Endpoint. operationId: create requestBody: content: application/json: schema: $ref: '#/components/schemas/EndpointCreateRequest' required: true responses: '201': description: Endpoint created content: application/json: schema: $ref: '#/components/schemas/EndpointResponse' '400': description: Invalid input '404': description: Service not found '500': description: Internal error /v3/endpoints/{endpoint_id}: get: tags: - endpoints summary: Get single endpoint description: Get endpoint by ID operationId: show parameters: - name: endpoint_id in: path required: true schema: type: string responses: '200': description: Endpoint object content: application/json: schema: $ref: '#/components/schemas/EndpointResponse' '404': description: Endpoint not found delete: tags: - endpoints summary: Delete an endpoint. description: Delete endpoint by ID operationId: delete parameters: - name: endpoint_id in: path required: true schema: type: string responses: '204': description: Endpoint deleted '404': description: Endpoint not found patch: tags: - endpoints summary: Update existing endpoint description: Update endpoint by ID operationId: update parameters: - name: endpoint_id in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/EndpointUpdateRequest' required: true responses: '200': description: Updated endpoint content: application/json: schema: $ref: '#/components/schemas/EndpointResponse' '404': description: Endpoint not found /v3/groups: get: tags: - groups summary: List user groups. operationId: list parameters: - name: domain_id in: query description: Filter users by Domain ID. required: false schema: type: - string - 'null' - name: name in: query description: Filter users by Name. required: false schema: type: - string - 'null' responses: '200': description: List of groups content: application/json: schema: $ref: '#/components/schemas/GroupList' '500': description: Internal error post: tags: - groups summary: Create new user group. operationId: create requestBody: content: application/json: schema: $ref: '#/components/schemas/GroupCreateRequest' required: true responses: '201': description: Group object content: application/json: schema: $ref: '#/components/schemas/GroupResponse' /v3/groups/{group_id}: get: tags: - groups summary: Get a single user group by ID. operationId: show parameters: - name: group_id in: path required: true schema: type: string responses: '200': description: Group object content: application/json: schema: $ref: '#/components/schemas/GroupResponse' '404': description: Group not found delete: tags: - groups summary: Delete group by ID. operationId: delete parameters: - name: group_id in: path required: true schema: type: string responses: '204': description: Deleted '404': description: group not found /v3/projects: get: tags: - projects summary: List projects description: List projects operationId: list parameters: - name: domain_id in: query description: Filter projects by domain ID. required: false schema: type: - string - 'null' - name: ids in: query description: Filter projects by the `id` attribute. required: false schema: type: - string - 'null' - name: name in: query description: Filter projects by name. required: false schema: type: - string - 'null' responses: '200': description: List of projects content: application/json: schema: $ref: '#/components/schemas/ProjectShortList' '500': description: Internal error post: tags: - projects summary: Create project. description: Creates a project, where the project may act as a domain. operationId: create requestBody: content: application/json: schema: $ref: '#/components/schemas/ProjectCreateRequest' required: true responses: '201': description: Project created content: application/json: schema: $ref: '#/components/schemas/ProjectResponse' '400': description: Invalid input '500': description: Internal error /v3/projects/{project_id}: get: tags: - projects summary: Get single project operationId: show parameters: - name: project_id in: path required: true schema: type: string responses: '200': description: Single project content: application/json: schema: $ref: '#/components/schemas/ProjectResponse' '404': description: Project not found delete: tags: - projects summary: Delete project by ID. operationId: remove parameters: - name: project_id in: path required: true schema: type: string responses: '204': description: Deleted '404': description: Project not found /v3/projects/{project_id}/users/{user_id}/roles: get: tags: - role_assignments summary: List the roles that a user has on a project. operationId: /project/user/role:list parameters: - name: project_id in: path description: The project ID. required: true schema: type: string - name: user_id in: path description: The user ID. required: true schema: type: string responses: '200': description: List of roles '404': description: User or project not found security: - x-auth: [] /v3/projects/{project_id}/users/{user_id}/roles/{role_id}: put: tags: - role_assignments summary: Assign role to user on project description: Assigns a role to a user on a project. operationId: /project/user/role:put parameters: - name: role_id in: path description: The role ID. required: true schema: type: string - name: project_id in: path description: The project ID. required: true schema: type: string - name: user_id in: path description: The user ID. required: true schema: type: string responses: '204': description: Grant is created. '404': description: Grant not found security: - x-auth: [] delete: tags: - role_assignments summary: Revoke role from user on project description: Remove a role assignment for a user on a specific project. operationId: /project/user/role:delete parameters: - name: role_id in: path description: The role ID. required: true schema: type: string - name: project_id in: path description: The project ID. required: true schema: type: string - name: user_id in: path description: The user ID. required: true schema: type: string responses: '204': description: Role revoked successfully '401': description: Unauthorized '403': description: Forbidden '404': description: Grant not found security: - X-Auth-Token: [] head: tags: - role_assignments summary: Check whether user has role assignment on project. description: Validates that a user has a role on a project. operationId: /project/user/role:check parameters: - name: role_id in: path description: The user ID. required: true schema: type: string - name: project_id in: path description: The project ID. required: true schema: type: string - name: user_id in: path description: The user ID. required: true schema: type: string responses: '204': description: Grant is present. '404': description: Grant not found security: - x-auth: [] /v3/role_assignments: get: tags: - role_assignments summary: List role assignments. description: List roles operationId: list parameters: - name: scope.domain.id in: query description: Filters the response by a domain ID. required: false schema: type: - string - 'null' - name: group.id in: query description: Filters the response by a group ID. required: false schema: type: - string - 'null' - name: effective in: query description: |- Returns the effective assignments, including any assignments gained by virtue of group membership. required: false schema: type: - boolean - 'null' - name: scope.project.id in: query description: Filters the response by a project ID. required: false schema: type: - string - 'null' - name: role.id in: query description: Filters the response by a role ID. required: false schema: type: - string - 'null' - name: user.id in: query description: Filters the response by a user ID. required: false schema: type: - string - 'null' - name: include_names in: query description: |- If set to true, then the names of any entities returned will be include as well as their IDs. Any value other than 0 (including no value) will be interpreted as true. required: false schema: type: - boolean - 'null' responses: '200': description: List of role assignments content: application/json: schema: $ref: '#/components/schemas/AssignmentList' '500': description: Internal error /v3/role_inferences: get: tags: - roles summary: List all role inference rules. operationId: /role_inferences:list responses: '200': description: List of all role inference rules. content: application/json: schema: $ref: '#/components/schemas/RoleInferencesList' '401': description: Unauthorized '403': description: Forbidden security: - x-auth: [] /v3/roles: get: tags: - roles summary: List roles description: List roles operationId: list parameters: - name: domain_id in: query description: Filter users by Domain ID. required: false schema: type: - string - 'null' - name: name in: query description: Filter users by Name. required: false schema: type: - string - 'null' responses: '200': description: List of roles content: application/json: schema: $ref: '#/components/schemas/RoleList' '500': description: Internal error post: tags: - roles summary: Create a new Role. operationId: create requestBody: content: application/json: schema: $ref: '#/components/schemas/RoleCreateRequest' required: true responses: '201': description: Role created content: application/json: schema: $ref: '#/components/schemas/RoleResponse' '400': description: Invalid input '500': description: Internal error /v3/roles/{prior_role_id}/implies: get: tags: - roles summary: List role imply rules for a prior role. operationId: /roles/prior_role/implies:list parameters: - name: prior_role_id in: path description: The prior role ID. required: true schema: type: string responses: '200': description: List of role imply rules. content: application/json: schema: $ref: '#/components/schemas/RoleInferenceRules' '401': description: Unauthorized '403': description: Forbidden security: - x-auth: [] /v3/roles/{prior_role_id}/implies/{implied_role_id}: get: tags: - roles summary: Get a role imply rule. operationId: /roles/prior_role/implies/implied_role:get parameters: - name: prior_role_id in: path description: The prior role ID. required: true schema: type: string - name: implied_role_id in: path description: The implied role ID. required: true schema: type: string responses: '200': description: Role imply rule details. content: application/json: schema: $ref: '#/components/schemas/RoleImplyResponse' '401': description: Unauthorized '403': description: Forbidden '404': description: Role imply rule not found security: - x-auth: [] put: tags: - roles summary: Create a role imply rule. operationId: /roles/prior_role/implies/implied_role:put parameters: - name: prior_role_id in: path description: The prior role ID. required: true schema: type: string - name: implied_role_id in: path description: The implied role ID. required: true schema: type: string responses: '201': description: Role imply rule created. content: application/json: schema: $ref: '#/components/schemas/RoleImplyResponse' '401': description: Unauthorized '403': description: Forbidden '404': description: Role not found security: - x-auth: [] delete: tags: - roles summary: Delete a role imply rule. operationId: /roles/prior_role/implies/implied_role:delete parameters: - name: prior_role_id in: path description: The prior role ID. required: true schema: type: string - name: implied_role_id in: path description: The implied role ID. required: true schema: type: string responses: '204': description: Role imply rule deleted. '401': description: Unauthorized '403': description: Forbidden '404': description: Role not found security: - x-auth: [] head: tags: - roles summary: Check if a role imply rule exists. operationId: /roles/prior_role/implies/implied_role:check parameters: - name: prior_role_id in: path description: The prior role ID. required: true schema: type: string - name: implied_role_id in: path description: The implied role ID. required: true schema: type: string responses: '204': description: Role imply rule exists. '401': description: Unauthorized '403': description: Forbidden '404': description: Role imply rule not found security: - x-auth: [] /v3/roles/{role_id}: get: tags: - roles summary: Get single role description: Get role by ID operationId: show parameters: - name: role_id in: path required: true schema: type: string responses: '200': description: Role object content: application/json: schema: $ref: '#/components/schemas/RoleResponse' '404': description: Role not found delete: tags: - roles summary: Delete a role. description: Delete role by ID operationId: delete parameters: - name: role_id in: path required: true schema: type: string responses: '204': description: Role deleted '404': description: Role not found /v3/services: get: tags: - services summary: List services description: List services operationId: list parameters: - name: name in: query description: Filters the response by a service name. required: false schema: type: - string - 'null' - name: type in: query description: Filters the response by a service type. required: false schema: type: - string - 'null' responses: '200': description: List of services content: application/json: schema: $ref: '#/components/schemas/ServiceList' '500': description: Internal error post: tags: - services summary: Create a new Service. operationId: create requestBody: content: application/json: schema: $ref: '#/components/schemas/ServiceCreateRequest' required: true responses: '201': description: Service created content: application/json: schema: $ref: '#/components/schemas/ServiceResponse' '400': description: Invalid input '500': description: Internal error /v3/services/{service_id}: get: tags: - services summary: Get single service description: Get service by ID operationId: show parameters: - name: service_id in: path required: true schema: type: string responses: '200': description: Service object content: application/json: schema: $ref: '#/components/schemas/ServiceResponse' '404': description: Service not found delete: tags: - services summary: Delete a service. description: Delete service by ID operationId: delete parameters: - name: service_id in: path required: true schema: type: string responses: '204': description: Service deleted '404': description: Service not found patch: tags: - services summary: Update existing service description: Update service by ID operationId: update parameters: - name: service_id in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/ServiceUpdateRequest' required: true responses: '200': description: Updated service content: application/json: schema: $ref: '#/components/schemas/ServiceResponse' '404': description: Service not found /v3/system/users/{user_id}/roles: get: tags: - role_assignments summary: List the roles that a user has on the system. operationId: /system/user/role:list parameters: - name: user_id in: path description: The user ID. required: true schema: type: string responses: '200': description: List of roles '404': description: User not found security: - x-auth: [] /v3/system/users/{user_id}/roles/{role_id}: put: tags: - role_assignments summary: Assign role to user on system description: Assigns a role to a user on the system. operationId: /system/user/role:put parameters: - name: role_id in: path description: The role ID. required: true schema: type: string - name: user_id in: path description: The user ID. required: true schema: type: string responses: '204': description: Grant is created. '404': description: Grant not found security: - x-auth: [] delete: tags: - role_assignments summary: Revoke role from user on system description: Remove a role assignment for a user on the system. operationId: /system/user/role:delete parameters: - name: role_id in: path description: The role ID. required: true schema: type: string - name: user_id in: path description: The user ID. required: true schema: type: string responses: '204': description: Role revoked successfully '401': description: Unauthorized '403': description: Forbidden '404': description: Grant not found security: - X-Auth-Token: [] head: tags: - role_assignments summary: Check whether user has role assignment on system. description: Validates that a user has a role on the system. operationId: /system/user/role:check parameters: - name: role_id in: path description: The role ID. required: true schema: type: string - name: user_id in: path description: The user ID. required: true schema: type: string responses: '204': description: Grant is present. '404': description: Grant not found security: - x-auth: [] /v3/users: get: tags: - users summary: List users description: List users operationId: list parameters: - name: domain_id in: query description: Filter users by Domain ID. required: false schema: type: - string - 'null' - name: name in: query description: Filter users by Name. required: false schema: type: - string - 'null' - name: unique_id in: query description: Filter users by the federated unique ID. required: false schema: type: - string - 'null' responses: '200': description: List of users content: application/json: schema: $ref: '#/components/schemas/UserList' '500': description: Internal error post: tags: - users summary: Create user description: Create new user operationId: create requestBody: content: application/json: schema: $ref: '#/components/schemas/UserCreateRequest' required: true responses: '201': description: New user content: application/json: schema: $ref: '#/components/schemas/UserResponse' /v3/users/{user_id}: get: tags: - users summary: Get single user operationId: show parameters: - name: user_id in: path required: true schema: type: string responses: '200': description: Single user content: application/json: schema: $ref: '#/components/schemas/UserResponse' '404': description: User not found delete: tags: - users summary: Delete user description: Delete user by ID operationId: delete parameters: - name: user_id in: path required: true schema: type: string responses: '204': description: Deleted '404': description: User not found patch: tags: - users summary: Update existing user description: Update user by ID operationId: update parameters: - name: user_id in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/UserUpdateRequest' required: true responses: '200': description: Updated user content: application/json: schema: $ref: '#/components/schemas/UserResponse' '404': description: User not found /v3/users/{user_id}/credentials/OS-EC2: get: tags: - OS-EC2 summary: List a user's EC2 credentials. description: List a user's EC2 credentials (OS-EC2 legacy API) operationId: list parameters: - name: user_id in: path required: true schema: type: string responses: '200': description: List of EC2 credentials content: application/json: schema: $ref: '#/components/schemas/Ec2CredentialList' post: tags: - OS-EC2 summary: |- Create a new EC2 credential for a user. `access`/`secret` are auto-generated (UUIDs) when omitted from the request (ADR 0019 §2, "Automatic Creation"). description: Create an EC2 credential for a user (OS-EC2 legacy API) operationId: create parameters: - name: user_id in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/Ec2CredentialCreateRequest' required: true responses: '201': description: EC2 credential created content: application/json: schema: $ref: '#/components/schemas/Ec2CredentialResponse' '400': description: Invalid input /v3/users/{user_id}/credentials/OS-EC2/{credential_id}: get: tags: - OS-EC2 summary: |- Get a single EC2 credential. The `credential_id` path segment is the **plaintext access key** (ADR 0019 §2, "Plaintext ID Lookup"), hashed (`SHA-256`) server-side to locate the record. description: Get an EC2 credential by plaintext access key (OS-EC2 legacy API) operationId: show parameters: - name: user_id in: path required: true schema: type: string - name: credential_id in: path required: true schema: type: string responses: '200': description: EC2 credential object content: application/json: schema: $ref: '#/components/schemas/Ec2CredentialResponse' '404': description: EC2 credential not found delete: tags: - OS-EC2 summary: |- Delete an EC2 credential. The `credential_id` path segment is the **plaintext access key** (ADR 0019 §2, "Plaintext ID Lookup"). description: Delete an EC2 credential by plaintext access key (OS-EC2 legacy API) operationId: delete parameters: - name: user_id in: path required: true schema: type: string - name: credential_id in: path required: true schema: type: string responses: '204': description: Deleted '404': description: EC2 credential not found /v3/users/{user_id}/groups: get: tags: - users summary: List groups a user is member of description: List groups a user is member of operationId: groups parameters: - name: user_id in: path required: true schema: type: string responses: '200': description: List of user groups content: application/json: schema: $ref: '#/components/schemas/GroupList' '500': description: Internal error /v3/users/{user_id}/password: post: tags: - users summary: Set or change user password. description: Set or change user password operationId: change_password parameters: - name: user_id in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/UserPasswordRequest' required: true responses: '204': description: Password changed successfully '400': description: Invalid input '401': description: Original password is incorrect '404': description: User not found '409': description: Password change not supported for nonlocal user '500': description: Internal error /v4: get: tags: - version summary: Version discovery endpoint description: Version discovery operationId: version responses: '200': description: Versions content: application/json: schema: $ref: '#/components/schemas/SingleVersion' /v4/api-keys: get: tags: - api_key summary: List API Keys. description: |- `domain_id` is a mandatory filter (ADR 0021 §5.B): unlike mapping rulesets, API Keys are always domain-owned, so there is no "global" or "all visible domains" listing mode. operationId: /api_key:list parameters: - name: domain_id in: query description: Domain to list keys for. required: true schema: type: string - name: enabled in: query description: Restrict to enabled/disabled keys. required: false schema: type: - boolean - 'null' - name: provider_id in: query description: Restrict to keys bound to this `provider_id`. required: false schema: type: - string - 'null' responses: '200': description: List of API Keys content: application/json: schema: $ref: '#/components/schemas/ApiKeyList' security: - x-auth: [] post: tags: - api_key summary: Create a new API Key. operationId: /api_key:create requestBody: content: application/json: schema: $ref: '#/components/schemas/ApiKeyCreateRequest' required: true responses: '201': description: API Key object, including the one-time bearer token content: application/json: schema: $ref: '#/components/schemas/ApiKeyCreateResponse' security: - x-auth: [] /v4/api-keys/simulate-access: post: tags: - api_key summary: |- Perform a mock authentication pass for an API Key, returning its fully resolved authorization topology without presenting a bearer token. operationId: /api_key:simulate_access requestBody: content: application/json: schema: $ref: '#/components/schemas/ApiKeySimulateAccessRequest' required: true responses: '200': description: Simulated authorization topology content: application/json: schema: $ref: '#/components/schemas/ApiKeySimulateAccessResponse' security: - x-auth: [] /v4/api-keys/{client_id}: get: tags: - api_key summary: Show an API Key by `client_id`. operationId: /api_key:show parameters: - name: client_id in: path description: API Key client_id required: true schema: type: string - name: domain_id in: query description: Domain the key belongs to. required: true schema: type: string responses: '200': description: API Key object content: application/json: schema: $ref: '#/components/schemas/ApiKeyResponse' security: - x-auth: [] put: tags: - api_key summary: Update an API Key's configuration. operationId: /api_key:update parameters: - name: client_id in: path description: API Key client_id required: true schema: type: string - name: domain_id in: query description: Domain the key belongs to. required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/ApiKeyUpdateRequest' required: true responses: '200': description: API Key object content: application/json: schema: $ref: '#/components/schemas/ApiKeyResponse' security: - x-auth: [] /v4/api-keys/{client_id}/revoke: post: tags: - api_key summary: |- Revoke an API Key: disables it and stamps the tombstone. Does not hard delete the record (ADR 0021 §5.C) -- physical reclamation is the janitor's job (§6.F). operationId: /api_key:revoke parameters: - name: client_id in: path description: API Key client_id required: true schema: type: string - name: domain_id in: query description: Domain the key belongs to. required: true schema: type: string responses: '200': description: Revoked API Key object content: application/json: schema: $ref: '#/components/schemas/ApiKeyResponse' security: - x-auth: [] /v4/auth/passkey/finish: post: tags: - passkey - auth summary: Finish user passkey authentication. description: |- Exchange the challenge signed with one of the users passkeys or security devices for the unscoped Keystone API token. operationId: /auth/passkey/finish:post requestBody: content: application/json: schema: $ref: '#/components/schemas/PasskeyAuthenticationFinishRequest' required: true responses: '201': description: Authentication Token object headers: x-subject-token: schema: type: string description: Keystone token content: application/json: schema: $ref: '#/components/schemas/TokenResponse' /v4/auth/passkey/start: post: tags: - passkey - auth summary: Start passkey authentication for the user. description: |- Initiate a passkey login for the user. The user must have at least one passkey previously registered. When the user does not exist a fake challenge is being returned to prevent id scanning. operationId: /auth/passkey/start:post requestBody: content: application/json: schema: $ref: '#/components/schemas/PasskeyAuthenticationStartRequest' required: true responses: '201': description: Challenge that must be signed with any of the user passkeys content: application/json: schema: $ref: '#/components/schemas/PasskeyAuthenticationStartResponse' '500': description: Internal error /v4/auth/tokens: get: tags: - auth summary: Validate and show information for token. description: |- Validates and shows information for a token, including its expiration date and authorization scope. Pass your own token in the X-Auth-Token request header. Pass the token that you want to validate in the X-Subject-Token request header. operationId: show parameters: - name: nocatalog in: query description: |- The authentication response excludes the service catalog. By default, the response includes the service catalog. required: false schema: type: - boolean - 'null' - name: allow_expired in: query description: |- Allow fetching a token that has expired. By default expired tokens return a 404 exception. required: false schema: type: - boolean - 'null' responses: '200': description: Token object content: application/json: schema: $ref: '#/components/schemas/TokenResponse' post: tags: - auth summary: Authenticate user issuing a new token. description: Issue token operationId: create parameters: - name: nocatalog in: query description: |- The authentication response excludes the service catalog. By default, the response includes the service catalog. required: false schema: type: - boolean - 'null' responses: '200': description: Token object content: application/json: schema: $ref: '#/components/schemas/TokenResponse' '429': description: Rate limit exceeded delete: tags: - auth summary: Revoke token. description: |- Revokes a token. This call is similar to the HEAD /auth/tokens call except that the `X-Subject-Token` token is immediately not valid, regardless of the expires_at attribute value. An additional `X-Auth-Token` is not required. operationId: delete responses: '204': description: Token has been revoked. /v4/auth_plugins/{plugin_name}/identity_links: post: tags: - auth_plugin summary: Create an admin-authorized `(plugin_name, external_id) -> user_id` link. operationId: /auth_plugin/identity_link:create parameters: - name: plugin_name in: path description: Dynamic plugin name required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/IdentityLinkCreateRequest' required: true responses: '201': description: Identity link content: application/json: schema: $ref: '#/components/schemas/IdentityLinkResponse' '409': description: external_id already linked security: - x-auth: [] /v4/auth_plugins/{plugin_name}/identity_links/{external_id}: delete: tags: - auth_plugin summary: Delete an admin-authorized identity link and revoke the user's tokens. operationId: /auth_plugin/identity_link:delete parameters: - name: plugin_name in: path description: Dynamic plugin name required: true schema: type: string - name: external_id in: path description: External identity id required: true schema: type: string responses: '204': description: Identity link deleted '404': description: No such identity link security: - x-auth: [] /v4/auth_plugins/{plugin_name}/revoke_all: post: tags: - auth_plugin summary: Revoke all persistent state a `full_auth` plugin wrote. operationId: /auth_plugin/revoke_all parameters: - name: plugin_name in: path description: Dynamic plugin name required: true schema: type: string responses: '200': description: Revocation summary content: application/json: schema: $ref: '#/components/schemas/RevokeAllResponse' '404': description: No such dynamic plugin security: - x-auth: [] /v4/federation/identity_providers: get: tags: - identity_providers summary: List identity providers. description: |- List identity providers. Without any filters only global identity providers are returned. With the `domain_id` identity providers owned by the specified identity provider are returned. It is expected that only global or owned identity providers can be returned, while an admin user is able to list all providers. operationId: /federation/identity_provider:list parameters: - name: name in: query description: Filters the response by IDP name. required: false schema: type: string - name: domain_id in: query description: Filters the response by a domain ID. required: false schema: type: string - name: limit in: query description: Limit number of entries on the single response page. required: false schema: type: - integer - 'null' format: int64 minimum: 0 - name: marker in: query description: Page marker (id of the last entry on the previous page. required: false schema: type: - string - 'null' responses: '200': description: List of identity providers content: application/json: schema: $ref: '#/components/schemas/IdentityProviderList' '500': description: Internal error security: - x-auth: [] post: tags: - identity_providers summary: Create the identity provider. description: |- Create the identity provider with the specified properties. It is expected that only admin user is able to create global identity providers. operationId: /federation/identity_provider:create requestBody: content: application/json: schema: $ref: '#/components/schemas/IdentityProviderCreateRequest' required: true responses: '201': description: identity provider object content: application/json: schema: $ref: '#/components/schemas/IdentityProviderResponse' security: - x-auth: [] /v4/federation/identity_providers/{idp_id}: get: tags: - identity_providers summary: Get single identity provider. description: Shows details of the existing identity provider. operationId: /federation/identity_provider:show parameters: - name: idp_id in: path description: The ID of the identity provider required: true schema: type: string responses: '200': description: Identity provider object content: application/json: schema: $ref: '#/components/schemas/IdentityProviderResponse' '404': description: Resource not found security: - x-auth: [] put: tags: - identity_providers summary: Update single identity provider. description: Updates the existing identity provider. operationId: /federation/identity_provider:update parameters: - name: idp_id in: path description: The ID of the identity provider required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/IdentityProviderUpdateRequest' required: true responses: '200': description: IDP object content: application/json: schema: $ref: '#/components/schemas/IdentityProviderResponse' '404': description: IDP not found security: - x-auth: [] delete: tags: - identity_providers summary: Delete Identity provider. description: |- Deletes the existing identity provider. It is expected that only admin user is allowed to delete the global identity provider operationId: /federation/identity_provider:delete parameters: - name: idp_id in: path description: The ID of the identity provider required: true schema: type: string responses: '204': description: Deleted '404': description: identity provider not found security: - x-auth: [] /v4/federation/identity_providers/{idp_id}/auth: post: tags: - identity_providers summary: Authenticate using identity provider. description: |- Initiate the authentication for the given identity provider. Mapping can be passed, otherwise the one which is set as a default on the identity provider level is used. The API returns the link to the identity provider which must be open in the web browser. Once user authenticates in the identity provider UI a redirect to the url passed as a callback in the request is being done as a typical oauth2 authorization code callback. The client is responsible for serving this callback server and use received authorization code and state to exchange it for the Keystone token passing it to the `/v4/federation/oidc/callback`. Desired scope (OpenStack) can be also passed to get immediately scoped token after the authentication completes instead of the unscoped token. This is an unauthenticated API call. User, mapping, scope validation will happen when the callback is invoked. operationId: federation/identity_provider/auth:post parameters: - name: idp_id in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/IdentityProviderAuthRequest' required: true responses: '201': description: Authentication data content: application/json: schema: $ref: '#/components/schemas/IdentityProviderAuthResponse' /v4/federation/identity_providers/{idp_id}/jwt: post: tags: - identity_providers operationId: /federation/identity_provider/jwt:login parameters: - name: openstack-mapping in: header description: Rule name hint for targeted rule matching required: true schema: type: string - name: idp_id in: path required: true schema: type: string responses: '200': description: Authentication Token object headers: x-subject-token: schema: type: string description: Keystone token content: application/json: schema: $ref: '#/components/schemas/TokenResponse' security: - jwt: [] /v4/federation/oidc/callback: post: tags: - identity_providers operationId: federation/oidc/callback requestBody: content: application/json: schema: $ref: '#/components/schemas/AuthCallbackParameters' required: true responses: '200': description: Authentication Token object headers: x-subject-token: schema: type: string description: Keystone token content: application/json: schema: $ref: '#/components/schemas/TokenResponse' security: - oauth2: - openid /v4/groups: get: tags: - groups summary: List user groups. operationId: list parameters: - name: domain_id in: query description: Filter users by Domain ID. required: false schema: type: - string - 'null' - name: name in: query description: Filter users by Name. required: false schema: type: - string - 'null' responses: '200': description: List of groups content: application/json: schema: $ref: '#/components/schemas/GroupList' '500': description: Internal error post: tags: - groups summary: Create new user group. operationId: create requestBody: content: application/json: schema: $ref: '#/components/schemas/GroupCreateRequest' required: true responses: '201': description: Group object content: application/json: schema: $ref: '#/components/schemas/GroupResponse' /v4/groups/{group_id}: get: tags: - groups summary: Get a single user group by ID. operationId: show parameters: - name: group_id in: path required: true schema: type: string responses: '200': description: Group object content: application/json: schema: $ref: '#/components/schemas/GroupResponse' '404': description: Group not found delete: tags: - groups summary: Delete group by ID. operationId: delete parameters: - name: group_id in: path required: true schema: type: string responses: '204': description: Deleted '404': description: group not found /v4/k8s_auth/instances: get: tags: - k8s_auth_instance summary: List K8s auth instances operationId: /k8s_auth/instance:list parameters: - name: domain_id in: query description: Domain id. required: false schema: type: - string - 'null' - name: name in: query description: Name. required: false schema: type: - string - 'null' responses: '200': description: List of instances content: application/json: schema: $ref: '#/components/schemas/K8sAuthInstanceList' '500': description: Internal error security: - x-auth: [] post: tags: - k8s_auth_instance summary: Create the K8s auth instance. description: Create the K8s auth instance with the specified properties. operationId: /k8s_auth/auth_instance:create requestBody: content: application/json: schema: $ref: '#/components/schemas/K8sAuthInstanceCreateRequest' required: true responses: '201': description: auth instance object content: application/json: schema: $ref: '#/components/schemas/K8sAuthInstanceResponse' security: - x-auth: [] /v4/k8s_auth/instances/{instance_id}: get: tags: - k8s_auth_instance summary: Get single K8s auth instance. description: Shows details of the existing instance. operationId: /k8s_auth/instance:show parameters: - name: instance_id in: path description: The ID of the instance required: true schema: type: string responses: '200': description: K8s auth instance object content: application/json: schema: $ref: '#/components/schemas/K8sAuthInstanceResponse' '404': description: Resource not found security: - x-auth: [] put: tags: - k8s_auth_instance summary: Update single K8s auth instance. description: Updates the existing k8s auth instance. operationId: /k8s_auth/instance:update parameters: - name: instance in: path description: The ID of the instance required: true schema: type: string - name: instance_id in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/K8sAuthInstanceUpdateRequest' required: true responses: '200': description: Instance object content: application/json: schema: $ref: '#/components/schemas/K8sAuthInstanceResponse' '404': description: Instance not found security: - x-auth: [] delete: tags: - k8s_auth_instance summary: Delete K8s auth instance. description: Deletes the existing k8s auth instance. operationId: /k8s_auth/instance:delete parameters: - name: instance_id in: path description: The ID of the auth instance required: true schema: type: string responses: '204': description: Deleted '404': description: k8s_auth instance not found security: - x-auth: [] /v4/k8s_auth/instances/{instance_id}/auth: post: tags: - k8s_auth_instance summary: Authenticate using the JWT token of the Kubernetes service account. description: |- Validates the JWT via TokenReview, flattens claims, and delegates to the unified mapping engine for identity resolution and authorization. operationId: /k8s_auth/auth:post parameters: - name: instance_id in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/K8sAuthRequest' required: true responses: '200': description: Authentication Token object headers: x-subject-token: schema: type: string description: Keystone token content: application/json: schema: $ref: '#/components/schemas/TokenResponse' /v4/mappings/rulesets: get: tags: - mapping_ruleset summary: List mapping rulesets. operationId: /mapping_ruleset:list parameters: - name: domain_id in: query description: Filter by domain ID. required: false schema: type: - string - 'null' - name: enabled in: query description: Filter by enabled/disabled state. required: false schema: type: - boolean - 'null' - name: limit in: query description: Limit number of entries per page. required: false schema: type: - integer - 'null' format: int64 minimum: 0 - name: marker in: query description: Page marker (ID of the last entry on the previous page). required: false schema: type: - string - 'null' responses: '200': description: List of rulesets content: application/json: schema: $ref: '#/components/schemas/MappingRuleSetList' security: - x-auth: [] post: tags: - mapping_ruleset summary: Create a new mapping ruleset. operationId: /mapping_ruleset:create requestBody: content: application/json: schema: $ref: '#/components/schemas/MappingRuleSetCreateRequest' required: true responses: '201': description: Ruleset object content: application/json: schema: $ref: '#/components/schemas/MappingRuleSetResponse' security: - x-auth: [] /v4/mappings/rulesets/{mapping_id}: get: tags: - mapping_ruleset summary: Show a mapping ruleset by ID. operationId: /mapping_ruleset:show parameters: - name: mapping_id in: path description: Mapping ruleset ID required: true schema: type: string responses: '200': description: Ruleset object content: application/json: schema: $ref: '#/components/schemas/MappingRuleSetResponse' security: - x-auth: [] put: tags: - mapping_ruleset summary: Update a mapping ruleset. operationId: /mapping_ruleset:update parameters: - name: mapping_id in: path description: Mapping ruleset ID required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/MappingRuleSetUpdateRequest' required: true responses: '200': description: Ruleset object content: application/json: schema: $ref: '#/components/schemas/MappingRuleSetResponse' security: - x-auth: [] delete: tags: - mapping_ruleset summary: Delete a mapping ruleset by ID. operationId: /mapping_ruleset:delete parameters: - name: mapping_id in: path description: Mapping ruleset ID required: true schema: type: string responses: '204': description: Mapping ruleset deleted successfully security: - x-auth: [] /v4/mappings/rulesets/{mapping_id}/rules/mutate: post: tags: - mapping_ruleset summary: Mutate rules within a mapping ruleset imperatively. description: |- Allows insertion, update, and deletion of individual rules at specific positions within the ruleset. operationId: /mapping_ruleset:rules_mutate parameters: - name: mapping_id in: path description: Mapping ruleset ID required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/RuleMutationsRequest' required: true responses: '200': description: Ruleset object content: application/json: schema: $ref: '#/components/schemas/MappingRuleSetResponse' security: - x-auth: [] /v4/oauth2/{domain_id}/.well-known/openid-configuration: get: tags: - oauth2 summary: Publish the OIDC discovery document for a domain. description: |- Unauthenticated by design, same as `jwks` (ADR 0026 §3): relying parties must be able to fetch it without a Keystone token. 404s if the domain has no signing keys provisioned yet (reuses `jwks()`'s own existence check). operationId: /oauth2:well_known parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string responses: '200': description: OIDC discovery document '404': description: No signing keys provisioned for this domain '429': description: Rate limit exceeded /v4/oauth2/{domain_id}/authorize: get: tags: - oauth2 summary: |- `GET /v4/oauth2/{domain_id}/authorize` (RFC 6749 §4.1.1, ADR 0026 §10 Phase 4). operationId: /oauth2:authorize parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string - name: response_type in: query required: false schema: type: - string - 'null' - name: client_id in: query required: false schema: type: - string - 'null' - name: redirect_uri in: query required: false schema: type: - string - 'null' - name: scope in: query required: false schema: type: - string - 'null' - name: state in: query required: false schema: type: - string - 'null' - name: code_challenge in: query required: false schema: type: - string - 'null' - name: code_challenge_method in: query required: false schema: type: - string - 'null' - name: nonce in: query required: false schema: type: - string - 'null' responses: '200': description: Login form rendered content: text/html: {} '303': description: Redirect back to the client with a code or error '400': description: Malformed request or unregistered redirect_uri '429': description: Rate limit exceeded /v4/oauth2/{domain_id}/authorize/consent: post: tags: - oauth2 summary: '`POST /v4/oauth2/{domain_id}/authorize/consent`.' operationId: /oauth2:authorize_consent parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string requestBody: content: application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/ConsentForm' required: true responses: '303': description: Redirect back to the client with a code or error '400': description: Missing/expired session, not signed in, or invalid CSRF token /v4/oauth2/{domain_id}/authorize/login: post: tags: - oauth2 summary: '`POST /v4/oauth2/{domain_id}/authorize/login`.' operationId: /oauth2:authorize_login parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string requestBody: content: application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/LoginForm' required: true responses: '200': description: Consent form rendered, or login form re-rendered on failure content: text/html: {} '303': description: 'Pre-authorized client: redirected straight to the RP with a code' '400': description: Missing/expired session or invalid CSRF token '429': description: Rate limit exceeded /v4/oauth2/{domain_id}/clients: get: tags: - oauth2_client summary: List OAuth2 clients for a domain. operationId: /oauth2/client:list parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string - name: enabled in: query description: |- Filter by enabled/disabled state. `domain_id` comes from the URL path, not the query string. required: false schema: type: - boolean - 'null' responses: '200': description: List of OAuth2 clients content: application/json: schema: $ref: '#/components/schemas/OAuth2ClientList' security: - x-auth: [] post: tags: - oauth2_client summary: Register a new OAuth2 client (relying party). operationId: /oauth2/client:create parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/OAuth2ClientCreateRequest' required: true responses: '201': description: OAuth2 client object content: application/json: schema: $ref: '#/components/schemas/OAuth2ClientCreateResponse' security: - x-auth: [] /v4/oauth2/{domain_id}/clients/{provider_id}: get: tags: - oauth2_client summary: |- Show an OAuth2 client by its `(domain_id, provider_id)` coordinate. Never includes `client_secret_hash`. operationId: /oauth2/client:show parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string - name: provider_id in: path description: Client provider_id required: true schema: type: string responses: '200': description: OAuth2 client object content: application/json: schema: $ref: '#/components/schemas/OAuth2ClientResponse' security: - x-auth: [] put: tags: - oauth2_client summary: Update an OAuth2 client's mutable configuration. operationId: /oauth2/client:update parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string - name: provider_id in: path description: Client provider_id required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/OAuth2ClientUpdateRequest' required: true responses: '200': description: OAuth2 client object content: application/json: schema: $ref: '#/components/schemas/OAuth2ClientResponse' security: - x-auth: [] delete: tags: - oauth2_client summary: Revoke (soft-delete) an OAuth2 client. operationId: /oauth2/client:delete parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string - name: provider_id in: path description: Client provider_id required: true schema: type: string responses: '204': description: OAuth2 client revoked security: - x-auth: [] /v4/oauth2/{domain_id}/clients/{provider_id}/rotate-secret: post: tags: - oauth2_client summary: Generate and persist a fresh client secret, returned exactly once. operationId: /oauth2/client:rotate_secret parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string - name: provider_id in: path description: Client provider_id required: true schema: type: string responses: '200': description: One-time plaintext client secret content: application/json: schema: $ref: '#/components/schemas/OAuth2ClientRotateSecretResponse' security: - x-auth: [] /v4/oauth2/{domain_id}/confirm-rotate-signing-key: post: tags: - oauth2_key operationId: /oauth2/key:confirm_rotate_signing_key parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/ConfirmRotateSigningKeyRequest' required: true responses: '200': description: Confirmation result content: application/json: schema: $ref: '#/components/schemas/ConfirmRotateSigningKeyResponse' security: - x-auth: [] /v4/oauth2/{domain_id}/device: get: tags: - oauth2 summary: |- `GET /v4/oauth2/{domain_id}/device` (RFC 8628 §3.3). Renders the user_code entry form, pre-filled from `verification_uri_complete`'s `user_code` query parameter if present. operationId: /oauth2:device parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string - name: user_code in: query required: false schema: type: - string - 'null' responses: '200': description: Code-entry form rendered content: text/html: {} post: tags: - oauth2 summary: '`POST /v4/oauth2/{domain_id}/device`: submit the `user_code`.' operationId: /oauth2:device_submit_code parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string requestBody: content: application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/DeviceCodeForm' required: true responses: '200': description: Login form rendered, or code-entry form re-rendered on failure content: text/html: {} /v4/oauth2/{domain_id}/device/consent: post: tags: - oauth2 summary: '`POST /v4/oauth2/{domain_id}/device/consent`.' operationId: /oauth2:device_consent parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string requestBody: content: application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/DeviceConsentForm' required: true responses: '200': description: Final result page rendered content: text/html: {} '400': description: Missing/expired grant, not signed in, or invalid CSRF token /v4/oauth2/{domain_id}/device/login: post: tags: - oauth2 summary: '`POST /v4/oauth2/{domain_id}/device/login`.' operationId: /oauth2:device_login parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string requestBody: content: application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/DeviceLoginForm' required: true responses: '200': description: Consent form rendered, login re-rendered on failure, or the final result page for pre_authorized clients content: text/html: {} '400': description: Missing/expired grant or invalid CSRF token /v4/oauth2/{domain_id}/device_authorization: post: tags: - oauth2 operationId: /oauth2:device_authorization parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string requestBody: content: application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/DeviceAuthorizationForm' required: true responses: '200': description: Device authorization grant issued '400': description: Malformed request, unknown client, or invalid scope /v4/oauth2/{domain_id}/ensure-signing-key: post: tags: - oauth2_key operationId: /oauth2/key:ensure_signing_key parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string responses: '200': description: Signing key present content: application/json: schema: $ref: '#/components/schemas/EnsureSigningKeyResponse' security: - x-auth: [] /v4/oauth2/{domain_id}/jwks: get: tags: - oauth2 summary: Publish a domain's active OAuth2 signing keys as a JWKS. description: |- Unauthenticated by design (ADR 0026 §3): relying parties and edge proxies must be able to fetch and cache this without a Keystone token. `Cache-Control: public, max-age=300` aligns with the 300-second cache refresh window relied on by the Python middleware (§3, "Key Lifecycle & The Cache Invalidation Window"). Publishes both `Primary` and `Previous` (when a rotation happened recently) — the multi-generational publishing pool that keeps outstanding tokens verifiable during a key's grace window. operationId: /oauth2:jwks parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string responses: '200': description: JSON Web Key Set '404': description: No signing keys provisioned for this domain '429': description: Rate limit exceeded /v4/oauth2/{domain_id}/jwks/revocation: get: tags: - oauth2 operationId: /oauth2:jwks_revocation parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string responses: '200': description: JTI revocation list content: application/json: schema: $ref: '#/components/schemas/JwksRevocationResponse' '429': description: Rate limit exceeded /v4/oauth2/{domain_id}/local-emergency-candidates: get: tags: - oauth2_key operationId: /oauth2/key:list_local_emergency_candidates parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string responses: '200': description: Local emergency candidates on this node content: application/json: schema: $ref: '#/components/schemas/ListLocalEmergencyCandidatesResponse' security: - x-auth: [] /v4/oauth2/{domain_id}/reconcile-local-emergency-key: post: tags: - oauth2_key operationId: /oauth2/key:reconcile_local_emergency_key parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/ReconcileLocalEmergencyKeyRequest' required: true responses: '200': description: Reconciliation result content: application/json: schema: $ref: '#/components/schemas/ReconcileLocalEmergencyKeyResponse' security: - x-auth: [] /v4/oauth2/{domain_id}/rotate-signing-key: post: tags: - oauth2_key operationId: /oauth2/key:rotate_signing_key parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/RotateSigningKeyRequest' required: true responses: '200': description: Rotation result content: application/json: schema: $ref: '#/components/schemas/RotateSigningKeyResponse' security: - x-auth: [] /v4/oauth2/{domain_id}/token: post: tags: - oauth2 summary: '`client_credentials` machine-to-machine grant (ADR 0026 §5, §7.A).' operationId: /oauth2:token parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string requestBody: content: application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/TokenForm' required: true responses: '200': description: Access token issued '400': description: Malformed request, unsupported grant, or invalid scope '401': description: Invalid client credentials '429': description: Rate limit exceeded /v4/role_assignments/projects/{project_id}/users/{user_id}/roles: get: tags: - role_assignments summary: List the roles that a user has on a project. operationId: /project/user/role:list parameters: - name: project_id in: path description: The project ID. required: true schema: type: string - name: user_id in: path description: The user ID. required: true schema: type: string responses: '200': description: List of roles '404': description: User or project not found security: - x-auth: [] /v4/role_assignments/projects/{project_id}/users/{user_id}/roles/{role_id}: put: tags: - role_assignments summary: Assign role to user on project description: Assigns a role to a user on a project. operationId: /project/user/role:put parameters: - name: role_id in: path description: The role ID. required: true schema: type: string - name: project_id in: path description: The project ID. required: true schema: type: string - name: user_id in: path description: The user ID. required: true schema: type: string responses: '204': description: Grant is created. '404': description: Grant not found security: - x-auth: [] delete: tags: - role_assignments summary: Revoke role from user on project description: Remove a role assignment for a user on a specific project. operationId: /project/user/role:delete parameters: - name: role_id in: path description: The role ID. required: true schema: type: string - name: project_id in: path description: The project ID. required: true schema: type: string - name: user_id in: path description: The user ID. required: true schema: type: string responses: '204': description: Role revoked successfully '401': description: Unauthorized '403': description: Forbidden '404': description: Grant not found security: - X-Auth-Token: [] head: tags: - role_assignments summary: Check whether user has role assignment on project. description: Validates that a user has a role on a project. operationId: /project/user/role:check parameters: - name: role_id in: path description: The user ID. required: true schema: type: string - name: project_id in: path description: The project ID. required: true schema: type: string - name: user_id in: path description: The user ID. required: true schema: type: string responses: '204': description: Grant is present. '404': description: Grant not found security: - x-auth: [] /v4/role_assignments/role_assignments: get: tags: - role_assignments summary: List role assignments. description: List roles operationId: list parameters: - name: scope.domain.id in: query description: Filters the response by a domain ID. required: false schema: type: - string - 'null' - name: group.id in: query description: Filters the response by a group ID. required: false schema: type: - string - 'null' - name: effective in: query description: |- Returns the effective assignments, including any assignments gained by virtue of group membership. required: false schema: type: - boolean - 'null' - name: scope.project.id in: query description: Filters the response by a project ID. required: false schema: type: - string - 'null' - name: role.id in: query description: Filters the response by a role ID. required: false schema: type: - string - 'null' - name: user.id in: query description: Filters the response by a user ID. required: false schema: type: - string - 'null' - name: include_names in: query description: |- If set to true, then the names of any entities returned will be include as well as their IDs. Any value other than 0 (including no value) will be interpreted as true. required: false schema: type: - boolean - 'null' responses: '200': description: List of role assignments content: application/json: schema: $ref: '#/components/schemas/AssignmentList' '500': description: Internal error /v4/role_assignments/system/users/{user_id}/roles: get: tags: - role_assignments summary: List the roles that a user has on the system. operationId: /system/user/role:list parameters: - name: user_id in: path description: The user ID. required: true schema: type: string responses: '200': description: List of roles '404': description: User not found security: - x-auth: [] /v4/role_assignments/system/users/{user_id}/roles/{role_id}: put: tags: - role_assignments summary: Assign role to user on system description: Assigns a role to a user on the system. operationId: /system/user/role:put parameters: - name: role_id in: path description: The role ID. required: true schema: type: string - name: user_id in: path description: The user ID. required: true schema: type: string responses: '204': description: Grant is created. '404': description: Grant not found security: - x-auth: [] delete: tags: - role_assignments summary: Revoke role from user on system description: Remove a role assignment for a user on the system. operationId: /system/user/role:delete parameters: - name: role_id in: path description: The role ID. required: true schema: type: string - name: user_id in: path description: The user ID. required: true schema: type: string responses: '204': description: Role revoked successfully '401': description: Unauthorized '403': description: Forbidden '404': description: Grant not found security: - X-Auth-Token: [] head: tags: - role_assignments summary: Check whether user has role assignment on system. description: Validates that a user has a role on the system. operationId: /system/user/role:check parameters: - name: role_id in: path description: The role ID. required: true schema: type: string - name: user_id in: path description: The user ID. required: true schema: type: string responses: '204': description: Grant is present. '404': description: Grant not found security: - x-auth: [] /v4/roles: get: tags: - roles summary: List roles description: List roles operationId: list parameters: - name: domain_id in: query description: Filter users by Domain ID. required: false schema: type: - string - 'null' - name: name in: query description: Filter users by Name. required: false schema: type: - string - 'null' responses: '200': description: List of roles content: application/json: schema: $ref: '#/components/schemas/RoleList' '500': description: Internal error post: tags: - roles summary: Create a new Role. operationId: create requestBody: content: application/json: schema: $ref: '#/components/schemas/RoleCreateRequest' required: true responses: '201': description: Role created content: application/json: schema: $ref: '#/components/schemas/RoleResponse' '400': description: Invalid input '500': description: Internal error /v4/roles/{prior_role_id}/implies: get: tags: - roles summary: List role imply rules for a prior role. operationId: /roles/prior_role/implies:list parameters: - name: prior_role_id in: path description: The prior role ID. required: true schema: type: string responses: '200': description: List of role imply rules. content: application/json: schema: $ref: '#/components/schemas/RoleInferenceRules' '401': description: Unauthorized '403': description: Forbidden security: - x-auth: [] /v4/roles/{prior_role_id}/implies/{implied_role_id}: get: tags: - roles summary: Get a role imply rule. operationId: /roles/prior_role/implies/implied_role:get parameters: - name: prior_role_id in: path description: The prior role ID. required: true schema: type: string - name: implied_role_id in: path description: The implied role ID. required: true schema: type: string responses: '200': description: Role imply rule details. content: application/json: schema: $ref: '#/components/schemas/RoleImplyResponse' '401': description: Unauthorized '403': description: Forbidden '404': description: Role imply rule not found security: - x-auth: [] put: tags: - roles summary: Create a role imply rule. operationId: /roles/prior_role/implies/implied_role:put parameters: - name: prior_role_id in: path description: The prior role ID. required: true schema: type: string - name: implied_role_id in: path description: The implied role ID. required: true schema: type: string responses: '201': description: Role imply rule created. content: application/json: schema: $ref: '#/components/schemas/RoleImplyResponse' '401': description: Unauthorized '403': description: Forbidden '404': description: Role not found security: - x-auth: [] delete: tags: - roles summary: Delete a role imply rule. operationId: /roles/prior_role/implies/implied_role:delete parameters: - name: prior_role_id in: path description: The prior role ID. required: true schema: type: string - name: implied_role_id in: path description: The implied role ID. required: true schema: type: string responses: '204': description: Role imply rule deleted. '401': description: Unauthorized '403': description: Forbidden '404': description: Role not found security: - x-auth: [] head: tags: - roles summary: Check if a role imply rule exists. operationId: /roles/prior_role/implies/implied_role:check parameters: - name: prior_role_id in: path description: The prior role ID. required: true schema: type: string - name: implied_role_id in: path description: The implied role ID. required: true schema: type: string responses: '204': description: Role imply rule exists. '401': description: Unauthorized '403': description: Forbidden '404': description: Role imply rule not found security: - x-auth: [] /v4/roles/{role_id}: get: tags: - roles summary: Get single role description: Get role by ID operationId: show parameters: - name: role_id in: path required: true schema: type: string responses: '200': description: Role object content: application/json: schema: $ref: '#/components/schemas/RoleResponse' '404': description: Role not found delete: tags: - roles summary: Delete a role. description: Delete role by ID operationId: delete parameters: - name: role_id in: path required: true schema: type: string responses: '204': description: Role deleted '404': description: Role not found /v4/scim_realms: get: tags: - scim_realm summary: List SCIM realms for a domain. operationId: /scim_realm:list parameters: - name: domain_id in: query description: Domain to list realms for. required: true schema: type: string - name: enabled in: query description: Filter by enabled/disabled state. required: false schema: type: - boolean - 'null' responses: '200': description: List of SCIM realms content: application/json: schema: $ref: '#/components/schemas/ScimRealmList' security: - x-auth: [] post: tags: - scim_realm summary: Register a new SCIM realm. operationId: /scim_realm:create requestBody: content: application/json: schema: $ref: '#/components/schemas/ScimRealmCreateRequest' required: true responses: '201': description: SCIM realm object content: application/json: schema: $ref: '#/components/schemas/ScimRealmResponse' security: - x-auth: [] /v4/scim_realms/{domain_id}/{provider_id}: get: tags: - scim_realm summary: Show a SCIM realm by its `(domain_id, provider_id)` coordinate. operationId: /scim_realm:show parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string - name: provider_id in: path description: Realm provider_id required: true schema: type: string responses: '200': description: SCIM realm object content: application/json: schema: $ref: '#/components/schemas/ScimRealmResponse' security: - x-auth: [] put: tags: - scim_realm summary: Update a SCIM realm (including enable/disable). operationId: /scim_realm:update parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string - name: provider_id in: path description: Realm provider_id required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/ScimRealmUpdateRequest' required: true responses: '200': description: SCIM realm object content: application/json: schema: $ref: '#/components/schemas/ScimRealmResponse' security: - x-auth: [] /v4/scim_realms/{domain_id}/{provider_id}/purge/{resource_type}/{keystone_id}: delete: tags: - scim_realm summary: |- Immediately purge a single already-deprovisioned SCIM resource, ignoring the configured retention window. operationId: /scim_realm:purge parameters: - name: domain_id in: path description: Domain ID required: true schema: type: string - name: provider_id in: path description: Realm provider_id required: true schema: type: string - name: resource_type in: path description: '`user` or `group`' required: true schema: type: string - name: keystone_id in: path description: The resource's Keystone `User.id`/`Group.id` required: true schema: type: string responses: '204': description: Resource purged security: - x-auth: [] /v4/tokens/restrictions: get: tags: - token_restriction summary: List token restrictions. description: |- List existing token restrictions. By default only admin user is allowed to leave `domain_id` query parameter empty, what means that token restrictions for all domains should be listed. operationId: /token_restriction:list parameters: - name: domain_id in: query description: Domain id. required: false schema: type: - string - 'null' - name: user_id in: query description: User id. required: false schema: type: - string - 'null' - name: project_id in: query description: Project id. required: false schema: type: - string - 'null' responses: '200': description: List of token restrictions. content: application/json: schema: $ref: '#/components/schemas/TokenRestrictionList' '500': description: Internal error. security: - x-auth: [] post: tags: - token_restriction summary: Create the token restriction. description: |- Create the token restriction with the specified properties. It is expected that only admin user is able to create token restriction in other domain. operationId: /token_restriction:create requestBody: content: application/json: schema: $ref: '#/components/schemas/TokenRestrictionCreateRequest' required: true responses: '201': description: token restriction object content: application/json: schema: $ref: '#/components/schemas/TokenRestrictionResponse' security: - x-auth: [] /v4/tokens/restrictions/{id}: get: tags: - token_restriction summary: Get single token restriction. description: Shows details of the existing token restriction. operationId: /token_restriction:show parameters: - name: id in: path description: The ID of the token restriction required: true schema: type: string responses: '200': description: Token restriction object content: application/json: schema: $ref: '#/components/schemas/TokenRestrictionResponse' '404': description: Resource not found security: - x-auth: [] put: tags: - token_restriction summary: Update existing token restriction by the ID. description: |- Updates the existing token restriction. It is expected that only admin user is able to update token restriction in other domain. operationId: /token_restriction:update parameters: - name: id in: path description: The ID of the token restriction required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/TokenRestrictionUpdateRequest' required: true responses: '200': description: Token restriction object content: application/json: schema: $ref: '#/components/schemas/TokenRestrictionResponse' '404': description: Token restriction not found security: - x-auth: [] delete: tags: - token_restriction summary: Delete Token restriction. description: Deletes the existing token restriction by the ID. operationId: /token_restriction:delete parameters: - name: id in: path description: The ID of the token restriction. required: true schema: type: string responses: '204': description: Deleted. '404': description: Token restriction not found security: - x-auth: [] /v4/users: get: tags: - users summary: List users description: List users operationId: list parameters: - name: domain_id in: query description: Filter users by Domain ID. required: false schema: type: - string - 'null' - name: name in: query description: Filter users by Name. required: false schema: type: - string - 'null' - name: unique_id in: query description: Filter users by the federated unique ID. required: false schema: type: - string - 'null' responses: '200': description: List of users content: application/json: schema: $ref: '#/components/schemas/UserList' '500': description: Internal error post: tags: - users summary: Create user description: Create new user operationId: create requestBody: content: application/json: schema: $ref: '#/components/schemas/UserCreateRequest' required: true responses: '201': description: New user content: application/json: schema: $ref: '#/components/schemas/UserResponse' /v4/users/{user_id}: get: tags: - users summary: Get single user operationId: show parameters: - name: user_id in: path required: true schema: type: string responses: '200': description: Single user content: application/json: schema: $ref: '#/components/schemas/UserResponse' '404': description: User not found put: tags: - users summary: Update existing user description: Update user by ID operationId: update parameters: - name: user_id in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/UserUpdateRequest' required: true responses: '200': description: Updated user content: application/json: schema: $ref: '#/components/schemas/UserResponse' '404': description: User not found delete: tags: - users summary: Delete user description: Delete user by ID operationId: remove parameters: - name: user_id in: path required: true schema: type: string responses: '204': description: Deleted '404': description: User not found /v4/users/{user_id}/groups: get: tags: - users summary: List groups a user is member of description: List groups a user is member of operationId: groups parameters: - name: user_id in: path required: true schema: type: string responses: '200': description: List of user groups content: application/json: schema: $ref: '#/components/schemas/GroupList' '404': description: User not found '500': description: Internal error /v4/users/{user_id}/passkeys/register_finish: post: tags: - passkey summary: Finish passkey registration for the user. operationId: /user/passkey/register:finish parameters: - name: user_id in: path description: The ID of the user. required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/UserPasskeyRegistrationFinishRequest' required: true responses: '201': description: Passkey successfully registered content: application/json: schema: $ref: '#/components/schemas/PasskeyResponse' '500': description: Internal error /v4/users/{user_id}/passkeys/register_start: post: tags: - passkey summary: Start passkey registration for the user. description: |- Generate a challenge that the user must sign with the passkey or security device. Signed challenge must be sent to the `/v4/users/{user_id}/passkey/register_finish` endpoint. operationId: /user/passkey/register:start parameters: - name: user_id in: path description: The ID of the user. required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/UserPasskeyRegistrationStartRequest' required: true responses: '201': description: Passkey successfully registered content: application/json: schema: $ref: '#/components/schemas/UserPasskeyRegistrationStartResponse' '500': description: Internal error v4auth_plugins/{plugin_name}/identity_links: post: tags: - auth_plugin summary: Create an admin-authorized `(plugin_name, external_id) -> user_id` link. operationId: /auth_plugin/identity_link:create parameters: - name: plugin_name in: path description: Dynamic plugin name required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/IdentityLinkCreateRequest' required: true responses: '201': description: Identity link content: application/json: schema: $ref: '#/components/schemas/IdentityLinkResponse' '409': description: external_id already linked security: - x-auth: [] v4auth_plugins/{plugin_name}/identity_links/{external_id}: delete: tags: - auth_plugin summary: Delete an admin-authorized identity link and revoke the user's tokens. operationId: /auth_plugin/identity_link:delete parameters: - name: plugin_name in: path description: Dynamic plugin name required: true schema: type: string - name: external_id in: path description: External identity id required: true schema: type: string responses: '204': description: Identity link deleted '404': description: No such identity link security: - x-auth: [] v4auth_plugins/{plugin_name}/revoke_all: post: tags: - auth_plugin summary: Revoke all persistent state a `full_auth` plugin wrote. operationId: /auth_plugin/revoke_all parameters: - name: plugin_name in: path description: Dynamic plugin name required: true schema: type: string responses: '200': description: Revocation summary content: application/json: schema: $ref: '#/components/schemas/RevokeAllResponse' '404': description: No such dynamic plugin security: - x-auth: [] components: schemas: AllowCredentials: type: object description: A descriptor of a credential that can be used. required: - id - type_ properties: id: type: string format: binary description: The id of the credential. contentEncoding: base64 transports: type: array items: $ref: '#/components/schemas/AuthenticatorTransport' description: may be usb, nfc, ble, internal. type_: type: string description: The type of credential. ApiKey: type: object description: |- A domain-owned machine identity credential used for stateless SCIM ingress authentication. Never carries `secret_hash`/`lookup_hash` -- those are internal to the authentication hot path and are not part of the admin surface (ADR 0021 §2.B). required: - client_id - created_at - domain_id - enabled - expires_at - provider_id properties: allowed_ips: type: - array - 'null' items: type: string description: |- CIDR allowlist restricting the source IP of the request. `None` means no restriction applies. client_id: type: string description: Public UUID used for management API references. created_at: type: string format: date-time description: UTC timestamp the key was created. description: type: - string - 'null' description: Free-form administrative description. domain_id: type: string description: Domain owning this machine identity. enabled: type: boolean description: Whether the key currently authenticates. expires_at: type: string format: date-time description: Mandatory TTL. last_used_at: type: - string - 'null' format: date-time description: |- UTC timestamp of the last successful authentication. Updated asynchronously and may lag actual usage (ADR 0021 §6.F). provider_id: type: string description: |- The Unified Mapping Engine (ADR 0020) `provider_id` this key authenticates against. revoked_at: type: - string - 'null' format: date-time description: UTC timestamp the key was revoked, if any. revoked_by: type: - string - 'null' description: User ID of the operator who revoked the key, if any. ApiKeyCreate: type: object description: API Key creation request payload. required: - domain_id - expires_at - provider_id properties: allowed_ips: type: - array - 'null' items: type: string description: CIDR allowlist restricting the source IP of the request. description: type: - string - 'null' description: Free-form administrative description. domain_id: type: string description: Domain owning this machine identity. expires_at: type: string format: date-time description: Mandatory TTL. provider_id: type: string description: |- The Unified Mapping Engine (ADR 0020) `provider_id` this key authenticates against. ApiKeyCreateRequest: type: object description: API Key creation request wrapper. required: - api_key properties: api_key: $ref: '#/components/schemas/ApiKeyCreate' description: API Key creation payload. ApiKeyCreateResponse: type: object description: |- API Key creation response. `token` is the full opaque bearer value and is returned exactly once -- it is never retrievable again after this response (ADR 0021 §2.C). required: - api_key - token properties: api_key: $ref: '#/components/schemas/ApiKey' description: The created API Key's metadata. token: type: string description: The full `kscim_...` bearer token. Shown once; store it now. ApiKeyList: type: object description: API Key list response. required: - api_keys properties: api_keys: type: array items: $ref: '#/components/schemas/ApiKey' description: Collection of API Keys. ApiKeyResponse: type: object description: API Key response wrapper (show, update, revoke). required: - api_key properties: api_key: $ref: '#/components/schemas/ApiKey' description: API Key object. ApiKeySimulateAccessRequest: type: object description: |- Dry-run auditing request (`POST /v4/api-keys/simulate-access`). Shifted to the body to prevent `client_id` leakage in proxy access logs (ADR 0021 §5.E). ADR 0021 specifies the payload as `{"client_id": ""}` only. `domain_id` is added here because this implementation's storage partitions `ApiClientResource` by domain (ADR 0021 §2.A), so a lookup by `client_id` alone is not possible without it -- the same constraint applies to show/update/revoke, which take `domain_id` as a query parameter. required: - client_id - domain_id properties: client_id: type: string description: Public UUID of the key to simulate. domain_id: type: string description: Domain the key belongs to. ApiKeySimulateAccessResponse: type: object description: |- Dry-run auditing response: the API Key's fully resolved authorization topology, as it would be hydrated by a real SCIM ingress request right now, without presenting the bearer token or performing cryptographic verification (ADR 0021 §5.E). required: - client_id - domain_id - matched - provider_id - roles properties: client_id: type: string description: Public UUID of the simulated key. domain_id: type: string description: Domain owning the key. matched: type: boolean description: Whether the key would successfully authenticate. provider_id: type: string description: The `provider_id` the key is bound to. reason: type: - string - 'null' description: Explains why `matched` is `false`. Absent when `matched` is `true`. roles: type: array items: type: string description: |- Effective role names, deduplicated and sorted. Empty when `matched` is `false`. scope: oneOf: - type: 'null' - $ref: '#/components/schemas/SimulatedScope' description: The scope the key would be granted. Absent when `matched` is `false`. ApiKeyUpdate: type: object description: |- API Key update request payload (`PUT /v4/api-keys/{client_id}`). `allowed_ips` and `description` use nested `Option`s: the field being absent from the JSON body means "leave unchanged", while an explicit `null` clears it. properties: allowed_ips: type: - array - 'null' items: type: string description: Absent = unchanged. `null` = clear. Present = set. description: type: - string - 'null' description: Absent = unchanged. `null` = clear. Present = set. enabled: type: - boolean - 'null' description: Absent = unchanged. ApiKeyUpdateRequest: type: object description: API Key update request wrapper. required: - api_key properties: api_key: $ref: '#/components/schemas/ApiKeyUpdate' description: API Key update payload. Assignment: type: object description: Assignment. required: - role - scope properties: group: oneOf: - type: 'null' - $ref: '#/components/schemas/Group' description: Group. role: $ref: '#/components/schemas/Role' description: Role. scope: $ref: '#/components/schemas/Scope' description: Target scope. user: oneOf: - type: 'null' - $ref: '#/components/schemas/User' description: User. AssignmentList: type: object description: Assignments. required: - role_assignments properties: role_assignments: type: array items: $ref: '#/components/schemas/Assignment' description: Collection of role assignment objects. AttestationConveyancePreference: type: string description: . enum: - None - Indirect - Direct AttestationFormat: type: string description: |- The type of attestation on the credential. . enum: - Packed - Tpm - AndroidKey - AndroidSafetyNet - FIDOU2F - AppleAnonymous - None AuthCallbackParameters: type: object description: |- Authentication callback request the user is sending to complete the authentication request. required: - state - code properties: code: type: string description: Authorization code. state: type: string description: Authentication state. AuthenticationExtensionsClientOutputs: type: object description: |- [AuthenticationExtensionsClientOutputs](https://w3c.github.io/webauthn/#dictdef-authenticationextensionsclientoutputs). The default option here for Options are None, so it can be derived. properties: appid: type: boolean description: Indicates whether the client used the provided appid extension. hmac_get_secret: $ref: '#/components/schemas/HmacGetSecretOutput' description: The response to a hmac get secret request. AuthenticatorAssertionResponseRaw: type: object description: '[AuthenticatorAssertionResponseRaw](https://w3c.github.io/webauthn/#authenticatorassertionresponse).' required: - authenticator_data - client_data_json - signature - user_handle properties: authenticator_data: type: string format: binary description: Raw authenticator data. contentEncoding: base64 client_data_json: type: string format: binary description: Signed client data. contentEncoding: base64 signature: type: string format: binary description: Signature. contentEncoding: base64 user_handle: type: string format: binary description: Optional user handle. contentEncoding: base64 AuthenticatorAttachment: type: string description: |- The authenticator attachment hint. This is NOT enforced, and is only used to help a user select a relevant authenticator type. . enum: - Platform - CrossPlatform AuthenticatorAttestationResponseRaw: type: object description: . required: - attestation_object - client_data_json properties: attestation_object: type: string format: binary description: . contentEncoding: base64 client_data_json: type: string format: binary description: . contentEncoding: base64 transports: type: array items: $ref: '#/components/schemas/AuthenticatorTransport' description: . AuthenticatorSelectionCriteria: type: object description: . required: - require_resident_key - user_verification properties: authenticator_attachment: $ref: '#/components/schemas/AuthenticatorAttachment' description: |- How the authenticator should be attached to the client machine. Note this is only a hint. It is not enforced in anyway shape or form. . require_resident_key: type: boolean description: |- Hint to the credential to create a resident key. Note this can not be enforced or validated, so the authenticator may choose to ignore this parameter. . resident_key: $ref: '#/components/schemas/ResidentKeyRequirement' description: |- Hint to the credential to create a resident key. Note this value should be a member of ResidentKeyRequirement, but client must ignore unknown values, treating an unknown value as if the member does not exist. . user_verification: $ref: '#/components/schemas/UserVerificationPolicy' description: |- The user verification level to request during registration. Depending on if this authenticator provides verification may affect future interactions as this is associated to the credential during registration. AuthenticatorTransport: type: string description: . enum: - Ble - Hybrid - Internal - Nfc - Test - Unknown - Usb Authorization: oneOf: - type: object description: Domain-level role assignment. required: - domain_id - roles - type properties: domain_id: type: string description: Domain ID to assign the roles on. roles: type: array items: $ref: '#/components/schemas/RoleRef' description: Roles to assign. type: type: string enum: - domain - type: object description: Project-level role assignment. required: - project_domain_id - project_id - roles - type properties: project_domain_id: type: string description: Project domain ID. project_id: type: string description: Project ID to assign the roles on. roles: type: array items: $ref: '#/components/schemas/RoleRef' description: Roles to assign. type: type: string enum: - project - type: object description: System-level role assignment. required: - roles - system_id - type properties: roles: type: array items: $ref: '#/components/schemas/RoleRef' description: Roles to assign. system_id: type: string description: System ID (typically `all` for global system scope). type: type: string enum: - system description: Authorization assignment within a mapping rule. Catalog: type: array items: $ref: '#/components/schemas/CatalogService' description: A catalog object. CatalogService: type: object description: A catalog object. required: - id - endpoints properties: endpoints: type: array items: $ref: '#/components/schemas/Endpoint' id: type: string name: type: - string - 'null' type: type: - string - 'null' ConfirmRotateSigningKeyRequest: type: object description: Request body for `POST /v4/oauth2/{domain_id}/confirm-rotate-signing-key`. required: - rotation_id properties: revoke_jtis: type: array items: type: string description: |- JTIs known to have been issued by the compromised key during the incident window, to add to the JTI revocation list (ADR 0026 §3). rotation_id: type: string description: The `pending_rotation_id` returned by `rotate-signing-key`. ConfirmRotateSigningKeyResponse: type: object description: Response body for `POST /v4/oauth2/{domain_id}/confirm-rotate-signing-key`. required: - kid properties: kid: type: string description: The newly active `Primary` key's `kid`. ConsentForm: type: object required: - csrf_token - decision properties: csrf_token: type: string decision: type: string CredProps: type: object description: . properties: rk: type: - boolean - 'null' description: |- A user agent supplied hint that this credential may have created a resident key. It is returned from the user agent, not the authenticator meaning that this is an unreliable signal. Note that this extension is UNSIGNED and may have been altered by page javascript. CredProtect: type: object description: |- The desired options for the client's use of the credProtect extension. . required: - credential_protection_policy properties: credential_protection_policy: $ref: '#/components/schemas/CredentialProtectionPolicy' description: The credential policy to enforce. enforce_credential_protection_policy: type: boolean description: |- Whether it is better for the authenticator to fail to create a credential rather than ignore the protection policy If no value is provided, the client treats it as false. Credential: type: object description: |- The credential data, as returned to API clients. `blob` is the decrypted secret serialised as a JSON-encoded string (ADR 0019 §2, "Wire format of `blob`") — never a nested object. `encrypted_blob`/`key_hash` are never exposed. required: - id - blob - type - user_id properties: blob: type: string description: The decrypted secret blob, as a JSON-encoded string. id: type: string description: |- Credential ID. For `ec2` this is `SHA-256(blob['access'])` hex-encoded; otherwise a random UUID. project_id: type: - string - 'null' description: The project associated with the credential (mandatory for `ec2`). type: type: string description: The credential type (`ec2`, `totp`, or an arbitrary custom string). user_id: type: string description: The ID of the user who owns the credential. additionalProperties: {} CredentialCreate: type: object description: Credential create request body. required: - blob - type properties: blob: type: string description: |- The decrypted secret blob, as a JSON string. For `ec2` must contain an `access` key. project_id: type: - string - 'null' description: |- The project to associate the credential with. Required if `type` is `ec2`. type: type: string description: The credential type. user_id: type: - string - 'null' description: |- The user to own the credential. Defaults to the authenticated user under user scope; must be supplied explicitly under system scope (ADR 0019 §2). additionalProperties: description: Extra attributes for the credential. CredentialCreateRequest: type: object description: New credential creation request. required: - credential properties: credential: $ref: '#/components/schemas/CredentialCreate' description: Credential object. CredentialList: type: object description: Credentials list envelope. required: - credentials properties: credentials: type: array items: $ref: '#/components/schemas/Credential' description: Collection of credential objects. CredentialProtectionPolicy: type: string description: Valid credential protection policies. enum: - Optional - OptionalWithCredentialIDList - Required CredentialResponse: type: object description: Single credential envelope. required: - credential properties: credential: $ref: '#/components/schemas/Credential' description: Credential object. CredentialUpdate: type: object description: |- Credential update request body. Only `blob`, `type`, and `project_id` are updatable; `user_id` is immutable (CVE-2020-12691). properties: blob: type: - string - 'null' description: New decrypted secret blob (triggers re-encryption). type: type: - string - 'null' description: New credential type. CredentialUpdateRequest: type: object description: Credential update request. required: - credential properties: credential: $ref: '#/components/schemas/CredentialUpdate' description: Credential update patch. DeviceAuthorizationForm: type: object properties: client_id: type: - string - 'null' scope: type: - string - 'null' DeviceCodeForm: type: object required: - user_code properties: user_code: type: string DeviceConsentForm: type: object required: - csrf_token - decision properties: csrf_token: type: string decision: type: string DeviceLoginForm: type: object required: - csrf_token - username - password properties: csrf_token: type: string password: type: string username: type: string Domain: type: object description: Domain information. properties: id: type: - string - 'null' description: Domain ID. name: type: - string - 'null' description: Domain Name. DomainCreate: type: object description: New domain data. required: - name properties: description: type: - string - 'null' description: The description of the domain. enabled: type: boolean description: If set to true, domain is enabled. If set to false, domain is disabled. id: type: - string - 'null' description: The domain ID. name: type: string description: The domain name. additionalProperties: description: Additional domain properties. DomainCreateRequest: type: object description: New domain creation request. required: - domain properties: domain: $ref: '#/components/schemas/DomainCreate' description: Domain object. DomainList: type: object description: List of domains. required: - domains properties: domains: type: array items: $ref: '#/components/schemas/Domain' description: Collection of domain objects. DomainResolutionMode: oneOf: - type: object description: Domain is resolved exclusively from claims. required: - allowed_domains - type properties: allowed_domains: type: array items: type: string description: Allowed domain IDs that may be resolved from claims. type: type: string enum: - claims_only - type: object description: Domain is resolved from the mapping ruleset, falling back to claims. required: - allowed_domains - type properties: allowed_domains: type: array items: type: string description: Allowed domain IDs that may be resolved from claims. type: type: string enum: - claims_or_mapping - type: object description: Domain is fixed to the `domain_id` set on the ruleset. required: - type properties: type: type: string enum: - fixed description: Domain resolution mode for the mapping ruleset. DomainResponse: type: object description: Complete response with the domain data. required: - domain properties: domain: $ref: '#/components/schemas/Domain' description: Domain object. Ec2Credential: type: object description: |- An EC2 credential, as returned to API clients with `blob` flattened into `access`/`secret`. required: - access - secret - user_id - tenant_id properties: access: type: string description: |- The plaintext EC2 access key. Also the value hashed (`SHA-256`) to form the credential's storage ID. secret: type: string description: The plaintext EC2 secret key. tenant_id: type: string description: The project the credential is bound to. trust_id: type: - string - 'null' description: The trust used to create the credential, if any. user_id: type: string description: The ID of the user who owns the credential. Ec2CredentialCreateRequest: type: object description: |- `POST /v3/users/{user_id}/credentials/OS-EC2` request body. Unlike every other Keystone v3 create request, this legacy body is **not** wrapped in a resource key (a historical quirk carried over from the v2.0 EC2 credentials API). required: - tenant_id properties: access: type: - string - 'null' description: |- The access key. Auto-generated (UUID) when omitted (ADR 0019 §2, "Automatic Creation"). secret: type: - string - 'null' description: |- The secret key. Auto-generated (UUID) when omitted (ADR 0019 §2, "Automatic Creation"). tenant_id: type: string description: The project to bind the new EC2 credential to. Ec2CredentialList: type: object description: EC2 credentials list envelope. required: - credentials properties: credentials: type: array items: $ref: '#/components/schemas/Ec2Credential' description: Collection of EC2 credential objects. Ec2CredentialResponse: type: object description: Single EC2 credential envelope. required: - credential properties: credential: $ref: '#/components/schemas/Ec2Credential' description: EC2 credential object. Ec2SignatureCredentials: type: object description: |- The `credentials` object: a signed AWS-style request description used to authenticate the owner of the referenced EC2 access key. required: - access properties: access: type: string description: The EC2 access key identifying the credential record. body_hash: type: - string - 'null' description: |- SHA-256 hex digest of the request body (required for SigV4; use the empty-string hash for requests with no body). headers: type: object description: Headers included in the signed request (used for SigV4). additionalProperties: type: string propertyNames: type: string host: type: string description: The `Host` the request was signed against. params: type: object description: Query parameters included in the signed request. additionalProperties: type: string propertyNames: type: string path: type: string description: The HTTP path the request was signed against. signature: type: - string - 'null' description: The client-computed signature to verify. verb: type: string description: The HTTP verb the request was signed with (e.g. `GET`, `POST`). Ec2TokenAuthRequest: type: object description: |- `POST /v3/ec2tokens` request body. Python Keystone accepts the `credentials` object under either the `credentials` key or the legacy `ec2Credentials` key. required: - credentials properties: credentials: $ref: '#/components/schemas/Ec2SignatureCredentials' description: The signed request description. Endpoint: type: object description: A Catalog Endpoint. required: - id - url - interface properties: id: type: string interface: type: string region: type: - string - 'null' region_id: type: - string - 'null' url: type: string EndpointCreate: type: object description: Endpoint create request body. required: - interface - service_id - url - enabled properties: enabled: type: boolean description: Defines whether the endpoint appears in the service catalog. interface: type: string description: |- The interface type, which describes the visibility of the endpoint (`public`, `internal`, or `admin`). region_id: type: - string - 'null' description: The ID of the region that contains the service endpoint. service_id: type: string description: The UUID of the service to which the endpoint belongs. url: type: string description: The endpoint URL. additionalProperties: description: Extra attributes for the endpoint. EndpointCreateRequest: type: object description: New endpoint creation request. required: - endpoint properties: endpoint: $ref: '#/components/schemas/EndpointCreate' description: Endpoint object. EndpointList: type: object description: Endpoints. required: - endpoints properties: endpoints: type: array items: $ref: '#/components/schemas/Endpoint' description: Collection of endpoint objects. EndpointResponse: type: object required: - endpoint properties: endpoint: $ref: '#/components/schemas/Endpoint' description: Endpoint object. EndpointUpdate: type: object description: Update endpoint data. properties: enabled: type: - boolean - 'null' description: Defines whether the endpoint appears in the service catalog. interface: type: - string - 'null' description: |- The interface type, which describes the visibility of the endpoint (`public`, `internal`, or `admin`). region_id: type: - string - 'null' description: The ID of the region that contains the service endpoint. service_id: type: - string - 'null' description: The UUID of the service to which the endpoint belongs. url: type: - string - 'null' description: The endpoint URL. additionalProperties: description: Extra attributes for the endpoint (replaces the existing extra). EndpointUpdateRequest: type: object description: Endpoint update request. required: - endpoint properties: endpoint: $ref: '#/components/schemas/EndpointUpdate' description: Endpoint object. EnsureSigningKeyResponse: type: object description: Response body for `POST /v4/oauth2/{domain_id}/ensure-signing-key`. required: - kid properties: kid: type: string description: |- The domain's `Primary` key's `kid` -- pre-existing if one was already provisioned, freshly generated otherwise. Federation: type: object description: User federation data. required: - idp_id - protocols properties: idp_id: type: string description: Identity provider ID. protocols: type: array items: $ref: '#/components/schemas/FederationProtocol' description: Protocols. FederationProtocol: type: object description: Federation protocol data. required: - protocol_id - unique_id properties: protocol_id: type: string description: Federation protocol ID. unique_id: type: string description: |- Unique ID of the associated user. Unlike other `*_id` fields this is not a Keystone-generated ID, but an arbitrary subject string supplied by the external IdP (e.g. a GitHub Actions OIDC `sub` claim), which for merge-queue-triggered runs can exceed 100 characters. The limit is kept below the backing column width (`VARCHAR(255)`) rather than the usual 64-char ID convention. GrantType: type: string description: OAuth2/OIDC grant type a client is authorized to use. enum: - authorization_code - client_credentials - device_code - refresh_token - urn:ietf:params:oauth:grant-type:token-exchange Group: type: object required: - domain_id - id - name properties: description: type: - string - 'null' description: Group description. domain_id: type: string description: Group domain ID. id: type: string description: Group ID. name: type: string description: Group name. additionalProperties: {} GroupAssignment: type: object description: Group assignment within a mapping rule. required: - group_name properties: group_domain_id: type: - string - 'null' description: Group domain ID. group_id: type: - string - 'null' description: Group identifier. group_name: type: string description: Group name. strategy: oneOf: - type: 'null' - $ref: '#/components/schemas/GroupStrategy' description: Strategy for resolving the group. Defaults to `CreateOrGet`. GroupCreate: type: object required: - domain_id - name properties: description: type: - string - 'null' description: Group description. domain_id: type: string description: Group domain ID. name: type: string description: Group name. additionalProperties: {} GroupCreateRequest: type: object required: - group properties: group: $ref: '#/components/schemas/GroupCreate' description: Group object. GroupList: type: object description: Groups. required: - groups properties: groups: type: array items: $ref: '#/components/schemas/Group' description: Collection of group objects. GroupResponse: type: object required: - group properties: group: $ref: '#/components/schemas/Group' description: group object. GroupStrategy: type: string description: Group resolution strategy. enum: - create_or_get - get HmacGetSecretInput: type: object description: |- The inputs to the hmac secret if it was created during registration. . required: - output1 properties: output1: type: string format: binary description: Retrieve a symmetric secrets from the authenticator with this input. contentEncoding: base64 output2: type: string format: binary description: Rotate the secret in the same operation. contentEncoding: base64 HmacGetSecretOutput: type: object description: The response to a hmac get secret request. required: - output1 properties: output1: type: string format: binary description: Output of HMAC(Salt 1 || Client Secret). contentEncoding: base64 output2: type: string format: binary description: Output of HMAC(Salt 2 || Client Secret). contentEncoding: base64 IdentityBinding: type: object description: |- Identity binding that defines how the external identity maps to a localized Keystone identity. required: - user_name properties: identity_mode: oneOf: - type: 'null' - $ref: '#/components/schemas/IdentityMode' description: |- Identity mode for the resolved principal. When absent, defaults to `Local` for `Federation` source and `Ephemeral` for others. is_system: type: boolean description: Whether the resolved identity has system-level privileges. user_domain_id: type: - string - 'null' description: User domain ID for the resolved identity. user_id: type: - string - 'null' description: User ID for the resolved identity. user_name: type: string description: User name for the resolved identity. IdentityLink: type: object description: |- A single `(plugin_name, external_id) -> user_id` identity link, as returned by the admin linking API. `plugin_name` comes from the request path, not the body. required: - plugin_name - external_id - user_id properties: external_id: type: string plugin_name: type: string user_id: type: string IdentityLinkCreate: type: object description: |- Body of a link-create request: pair an existing Keystone `user_id` with the `external_id` a `full_auth` plugin's `find_user` will present (ADR 0025 §4). The plugin never populates this table itself for a pre-existing user - an administrator does, out of band, gated by ordinary RBAC. required: - external_id - user_id properties: external_id: type: string user_id: type: string IdentityLinkCreateRequest: type: object required: - identity_link properties: identity_link: $ref: '#/components/schemas/IdentityLinkCreate' IdentityLinkResponse: type: object required: - identity_link properties: identity_link: $ref: '#/components/schemas/IdentityLink' IdentityMode: type: string description: |- Identity mode determines whether the matched identity should be resolved as a real federated user row (`Local`) or a virtual shadow record (`Ephemeral`). enum: - local - ephemeral IdentityProvider: type: object description: Identity provider data. required: - id - name - enabled properties: allowed_redirect_uris: type: - array - 'null' items: type: string description: List of allowed redirect URIs for OIDC flows. bound_issuer: type: - string - 'null' description: The bound issuer that is verified when using the identity provider. default_mapping_name: type: - string - 'null' description: |- Default attribute mapping name which is automatically used when no mapping is explicitly requested. The referred attribute mapping must exist. domain_id: type: - string - 'null' description: |- The ID of the domain this identity provider belongs to. Empty value identifies that the identity provider can be used by other domains as well. enabled: type: boolean description: |- Identity provider `enabled` property. Inactive Identity Providers can not be used for login. id: type: string description: The ID of the federated identity provider. jwks_url: type: - string - 'null' description: |- URL to fetch JsonWebKeySet. This must be set for "jwt" mapping when the provider does not provide discovery endpoint or when it is not standard compliant. jwt_validation_pubkeys: type: - array - 'null' items: type: string description: List of the jwt validation public keys. name: type: string description: The Name of the federated identity provider. oidc_client_id: type: - string - 'null' description: |- The oidc `client_id` to use for the private client. The `client_secret` is never returned and can be only overwritten. oidc_discovery_url: type: - string - 'null' description: OIDC discovery endpoint for the identity provider. oidc_response_mode: type: - string - 'null' description: The oidc response mode. oidc_response_types: type: - array - 'null' items: type: string description: List of supported response types. oidc_scopes: type: - array - 'null' items: type: string description: List of OIDC scopes to request during the OIDC authorization flow. provider_config: type: object description: Additional provider configuration. IdentityProviderAuthRequest: type: object description: Request for initializing the federated authentication. required: - redirect_uri properties: redirect_uri: type: string description: Redirect URI to include in the auth request. scope: oneOf: - type: 'null' - $ref: '#/components/schemas/Scope' description: Authentication scope. IdentityProviderAuthResponse: type: object description: Authentication initialization response. required: - auth_url properties: auth_url: type: string description: Url the client must open in the browser to continue the authentication. IdentityProviderCreate: type: object description: Identity provider data. required: - name properties: allowed_redirect_uris: type: array items: type: string description: |- List of allowed redirect URIs for OIDC flows. When set, the redirect URI passed at auth-init must match one of these values. bound_issuer: type: string description: The bound issuer that is verified when using the identity provider. default_mapping_name: type: - string - 'null' description: |- Default attribute mapping name which is automatically used when no mapping is explicitly requested. The referred attribute mapping must exist. domain_id: type: string description: |- The ID of the domain this identity provider belongs to. Empty value identifies that the identity provider can be used by other domains as well. enabled: type: boolean description: |- Identity provider `enabled` property. Inactive Identity Providers can not be used for login. jwks_url: type: string description: |- Optional URL to fetch JsonWebKeySet. Must be specified for JWT authentication when discovery for the provider is not available or not standard compliant. jwt_validation_pubkeys: type: array items: type: string description: List of the jwt validation public keys. name: type: string description: Identity provider name. oidc_client_id: type: string description: The oidc `client_id` to use for the private client. oidc_client_secret: type: string description: |- The oidc `client_secret` to use for the private client. It is never returned back. oidc_discovery_url: type: string description: OIDC discovery endpoint for the identity provider. oidc_response_mode: type: string description: The oidc response mode. oidc_response_types: type: array items: type: string description: List of supported response types. oidc_scopes: type: array items: type: string description: List of OIDC scopes to request during the OIDC authorization flow. provider_config: type: object description: Additional special provider specific configuration. IdentityProviderCreateRequest: type: object description: Identity provider create request. required: - identity_provider properties: identity_provider: $ref: '#/components/schemas/IdentityProviderCreate' description: Identity provider object. IdentityProviderList: type: object description: List of Identity Providers. required: - identity_providers properties: identity_providers: type: array items: $ref: '#/components/schemas/IdentityProvider' description: Collection of identity provider objects. links: type: - array - 'null' items: $ref: '#/components/schemas/Link' description: Pagination links. IdentityProviderResponse: type: object description: Identity provider response. required: - identity_provider properties: identity_provider: $ref: '#/components/schemas/IdentityProvider' description: Identity provider object. IdentityProviderUpdate: type: object description: New identity provider data. required: - provider_config properties: allowed_redirect_uris: type: - array - 'null' items: type: string description: List of allowed redirect URIs for OIDC flows. bound_issuer: type: - string - 'null' description: The new bound issuer that is verified when using the identity provider. default_mapping_name: type: - string - 'null' description: |- New default attribute mapping name which is automatically used when no mapping is explicitly requested. The referred attribute mapping must exist. enabled: type: - boolean - 'null' description: |- Identity provider `enabled` property. Inactive Identity Providers can not be used for login. jwks_url: type: - string - 'null' description: |- New URL to fetch JsonWebKeySet. This must be set for "jwt" mapping when the provider does not provide discovery endpoint or when it is not standard compliant. jwt_validation_pubkeys: type: - array - 'null' items: type: string description: The list of the jwt validation public keys. name: type: - string - 'null' description: The new name of the federated identity provider. oidc_client_id: type: - string - 'null' description: The new oidc `client_id` to use for the private client. oidc_client_secret: type: - string - 'null' description: The new oidc `client_secret` to use for the private client. oidc_discovery_url: type: - string - 'null' description: The new OIDC discovery endpoint for the identity provider. oidc_response_mode: type: - string - 'null' description: The new oidc response mode. oidc_response_types: type: - array - 'null' items: type: string description: The new oidc response mode. oidc_scopes: type: - array - 'null' items: type: string description: List of OIDC scopes to request during the OIDC authorization flow. provider_config: type: object description: New additional provider configuration. IdentityProviderUpdateRequest: type: object description: Identity provider update request. required: - identity_provider properties: identity_provider: $ref: '#/components/schemas/IdentityProviderUpdate' description: Identity provider object. IdentitySource: oneOf: - type: object description: Federation-based identity source. required: - idp_id - type properties: idp_id: type: string description: ID of the IdP that supplies the tokens. type: type: string enum: - federation - type: object description: Kubernetes-based identity source. required: - cluster_id - type properties: cluster_id: type: string description: Kubernetes cluster identifier. type: type: string enum: - k8s - type: object description: SPIFFE-based identity source. required: - trust_domain - type properties: trust_domain: type: string description: SPIFFE trust domain identifier. type: type: string enum: - spiffe - type: object description: API Key (SCIM ingress) machine identity source (ADR 0021). required: - provider_id - type properties: provider_id: type: string description: The API Key `provider_id` this ruleset is bound to. type: type: string enum: - api_client - type: object description: '`mapping`-mode dynamic auth plugin identity source (ADR 0025 §4).' required: - plugin_name - type properties: plugin_name: type: string description: The dynamic plugin's configured name. type: type: string enum: - wasm_plugin - type: object description: OAuth2 `client_credentials` machine identity source (ADR 0026 §5). required: - provider_id - type properties: provider_id: type: string description: The OAuth2 client's `provider_id` this ruleset is bound to. type: type: string enum: - o_auth2_client description: Identity source type identifying the ingress provider. ImplyGroup: type: object description: Grouped structure for listing implied roles of a specific prior role. required: - prior_role - implies properties: implies: type: array items: $ref: '#/components/schemas/RoleRef' description: List of roles that are implied by the prior role. prior_role: $ref: '#/components/schemas/RoleRef' description: The prior role. JwksRevocationResponse: type: object description: Response body for `jwks/revocation`. required: - revoked_jtis properties: revoked_jtis: type: array items: type: string description: JTIs revoked by an emergency signing-key rotation, not yet expired. K8sAuthInstance: type: object description: K8s authentication instance. required: - disable_local_ca_jwt - domain_id - enabled - host - id properties: ca_cert: type: - string - 'null' description: |- PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API. NOTE: Every line must end with a newline: \n If not set, the local CA cert will be used if running in a Kubernetes pod. disable_local_ca_jwt: type: boolean description: |- Disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod. domain_id: type: string description: Domain ID owning the K8s auth configuration. enabled: type: boolean host: type: string description: |- Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server. id: type: string description: K8s auth configuration ID. name: type: - string - 'null' description: K8s auth name. K8sAuthInstanceCreate: type: object description: New K8s authentication instance. required: - domain_id - enabled - host properties: ca_cert: type: - string - 'null' description: |- PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API. NOTE: Every line must end with a newline: \n If not set, the local CA cert will be used if running in a Kubernetes pod. disable_local_ca_jwt: type: - boolean - 'null' description: |- Disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod. domain_id: type: string description: Domain ID owning the K8s auth instance. enabled: type: boolean host: type: string description: |- Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server. name: type: - string - 'null' description: K8s auth name. K8sAuthInstanceCreateRequest: type: object description: K8s auth instance create request. required: - instance properties: instance: $ref: '#/components/schemas/K8sAuthInstanceCreate' description: K8s auth instance object. K8sAuthInstanceList: type: object description: List of K8s auth instances. required: - instances properties: instances: type: array items: $ref: '#/components/schemas/K8sAuthInstance' description: Collection of k8s auth instance objects. links: type: - array - 'null' items: $ref: '#/components/schemas/Link' description: Pagination links. K8sAuthInstanceResponse: type: object description: K8s auth instance response. required: - instance properties: instance: $ref: '#/components/schemas/K8sAuthInstance' description: K8s auth instance object. K8sAuthInstanceUpdate: type: object description: Update K8s authentication instance. properties: ca_cert: type: - string - 'null' description: |- PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API. NOTE: Every line must end with a newline: \n If not set, the local CA cert will be used if running in a Kubernetes pod. disable_local_ca_jwt: type: - boolean - 'null' description: |- Disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod. enabled: type: - boolean - 'null' host: type: - string - 'null' description: |- Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server. name: type: - string - 'null' description: K8s auth name. K8sAuthInstanceUpdateRequest: type: object description: K8s auth instance update request. required: - instance properties: instance: $ref: '#/components/schemas/K8sAuthInstanceUpdate' description: K8s auth instance object. K8sAuthRequest: type: object description: |- K8s authentication request. Identity and authorization are resolved by the unified mapping engine. required: - jwt properties: jwt: type: string description: JWT service account token. rule_name: type: - string - 'null' description: |- Optional rule name hint for the mapping-engine path. When set, the mapping engine evaluates the named rule first. Link: type: object description: Link object. required: - rel - href properties: href: type: string description: link href attribute. rel: type: string description: Link rel attribute. ListLocalEmergencyCandidatesResponse: type: object description: |- Response body for `GET /v4/oauth2/{domain_id}/local-emergency-candidates`. required: - candidates properties: candidates: type: array items: $ref: '#/components/schemas/LocalEmergencyCandidateSummary' description: |- Every candidate on this node for the requested domain (including revoked ones, for audit visibility). LocalEmergencyCandidateSummary: type: object description: One node-local emergency rotation candidate (ADR 0028 §6). required: - rotation_id - initiator - justification - created_at_unix - conflicted - revoked properties: conflicted: type: boolean description: |- Set if gossip detected a different active candidate for this domain on another node -- the operator must explicitly pick one side. created_at_unix: type: integer format: int64 description: Unix epoch seconds the candidate was created. initiator: type: string description: Identity of the operator who staged this candidate. justification: type: string description: The operator-supplied justification recorded with the candidate. origin_node_id: type: - integer - 'null' format: int64 description: |- `None` if staged on the node answering this request; `Some(node_id)` if it arrived via gossip from another node (ADR 0028 §5). minimum: 0 revoked: type: boolean description: Set once this candidate has lost reconciliation. Never reconcilable. rotation_id: type: string description: Opaque identifier to pass to `reconcile-local-emergency-key`. LoginForm: type: object required: - csrf_token - username - password properties: csrf_token: type: string password: type: string username: type: string MappingRule: type: object description: A single rule within a `MappingRuleSet`. required: - authorizations - groups - identity - match - name properties: authorizations: type: array items: $ref: '#/components/schemas/Authorization' description: Role assignments granted when this rule matches. description: type: - string - 'null' description: Human-readable description of the rule purpose. groups: type: array items: $ref: '#/components/schemas/GroupAssignment' description: Group assignments granted when this rule matches. identity: $ref: '#/components/schemas/IdentityBinding' description: Identity binding that defines the localized Keystone identity. match: description: Claim match criteria that determine when this rule applies. name: type: string description: Unique rule name within the ruleset. MappingRuleSet: type: object description: A complete mapping ruleset stored in the distributed store. required: - domain_resolution_mode - enabled - mapping_id - rules - source properties: domain_id: type: - string - 'null' description: Owning domain boundary; `None` for global rulesets. domain_resolution_mode: $ref: '#/components/schemas/DomainResolutionMode' description: Domain resolution mode. enabled: type: boolean description: Whether the ruleset is enabled. mapping_id: type: string description: Unique ruleset identifier. rules: type: array items: $ref: '#/components/schemas/MappingRule' description: Ordered rules; array position defines execution priority. source: $ref: '#/components/schemas/IdentitySource' description: Identifies the ingress provider instance. MappingRuleSetCreate: type: object description: Mapping ruleset creation request payload. required: - domain_resolution_mode - enabled - rules - source properties: domain_id: type: - string - 'null' description: Owning domain boundary; `None` for global rulesets. domain_resolution_mode: $ref: '#/components/schemas/DomainResolutionMode' description: Domain resolution mode. enabled: type: boolean description: Whether the ruleset is enabled. mapping_id: type: - string - 'null' description: Optional ruleset identifier (auto-generated if `None`). rules: type: array items: $ref: '#/components/schemas/MappingRule' description: Ordered rules; array position defines execution priority. source: $ref: '#/components/schemas/IdentitySource' description: Identifies the ingress provider instance. MappingRuleSetCreateRequest: type: object description: Mapping ruleset creation request wrapper. required: - mapping properties: mapping: $ref: '#/components/schemas/MappingRuleSetCreate' description: Mapping ruleset creation payload. MappingRuleSetList: type: object description: Mapping ruleset list response. required: - mappings properties: links: type: - array - 'null' items: $ref: '#/components/schemas/Link' description: Pagination links. mappings: type: array items: $ref: '#/components/schemas/MappingRuleSet' description: Collection of mapping rulesets. MappingRuleSetResponse: type: object description: Mapping ruleset response. required: - mapping properties: mapping: $ref: '#/components/schemas/MappingRuleSet' description: Mapping ruleset object. MappingRuleSetUpdate: type: object description: |- Mapping ruleset update request payload. Only mutable fields are included. `domain_id`, `source`, and `domain_resolution_mode` are immutable after creation. properties: allowed_domains: type: - array - 'null' items: type: string description: |- Replace `allowed_domains` within the existing `DomainResolutionMode` variant. The mode variant itself cannot change. enabled: type: - boolean - 'null' description: Toggle ruleset enabled/disabled. rules: type: - array - 'null' items: $ref: '#/components/schemas/MappingRule' description: Replace the entire rules vector. MappingRuleSetUpdateRequest: type: object description: Mapping ruleset update request wrapper. required: - mapping properties: mapping: $ref: '#/components/schemas/MappingRuleSetUpdate' description: Mapping ruleset update payload. MediaType: type: object required: - base - type properties: base: type: string type: type: string Mediation: type: string description: |- Request in resident key workflows that conditional mediation should be used in the UI, or not. enum: - Conditional OAuth2Client: type: object description: |- A registered OAuth2/OIDC relying party. Never carries `client_secret` or its hash -- the plaintext secret is only ever returned once, by `create` or `rotate-secret`. required: - allowed_scopes - claims_template - confidential - client_id - created_at - domain_id - enabled - grant_types - pre_authorized - provider_id - redirect_uris - require_pkce - token_endpoint_auth_method - updated_at properties: allowed_scopes: type: array items: type: string description: Scopes this client may request. claims_template: type: object description: Per-client output claim templates (ADR 0026 §4, "Claim Safety"). additionalProperties: type: string propertyNames: type: string client_id: type: string description: Globally unique public client identifier (server-generated). confidential: type: boolean description: Whether this is a confidential client (has a `client_secret`). created_at: type: integer format: int64 description: UTC epoch seconds. deleted_at: type: - integer - 'null' format: int64 description: UTC epoch seconds of soft-delete, if revoked. domain_id: type: string description: Domain owning this client registration. enabled: type: boolean description: Whether the client is currently usable. grant_types: type: array items: $ref: '#/components/schemas/GrantType' description: Grant types this client is authorized to use. pre_authorized: type: boolean description: Whether consent is pre-authorized. SystemAdmin-only to set. provider_id: type: string description: |- The Unified Mapping Engine (ADR 0020) `provider_id` coordinate. Unique within `domain_id`. redirect_uris: type: array items: type: string description: Allowed redirect URIs for the `authorization_code` grant. require_pkce: type: boolean description: Whether PKCE (RFC 7636) is mandatory for this client. token_endpoint_auth_method: type: string description: Token endpoint authentication method. Immutable after creation. updated_at: type: integer format: int64 description: UTC epoch seconds. OAuth2ClientCreate: type: object description: OAuth2 client creation payload. required: - confidential - provider_id - token_endpoint_auth_method properties: allowed_scopes: type: array items: type: string description: Scopes this client may request. claims_template: type: object description: Per-client output claim templates. additionalProperties: type: string propertyNames: type: string confidential: type: boolean description: |- Whether to register a confidential client (server generates and returns a `client_secret` exactly once) or a public client (no secret, PKCE mandatory). grant_types: type: array items: $ref: '#/components/schemas/GrantType' description: Grant types this client is authorized to use. pre_authorized: type: boolean description: Whether consent is pre-authorized. SystemAdmin-only to set. provider_id: type: string description: |- The `provider_id` coordinate this client registers under. `domain_id` comes from the URL path, not the body. redirect_uris: type: array items: type: string description: Allowed redirect URIs for the `authorization_code` grant. require_pkce: type: boolean description: Whether PKCE is mandatory. Always `true` for public clients. token_endpoint_auth_method: type: string description: |- Token endpoint authentication method (e.g. `client_secret_basic`, `none`). OAuth2ClientCreateRequest: type: object description: OAuth2 client creation request wrapper. required: - oauth2_client properties: oauth2_client: $ref: '#/components/schemas/OAuth2ClientCreate' description: OAuth2 client creation payload. OAuth2ClientCreateResponse: type: object description: |- OAuth2 client creation response. `client_secret` is populated exactly once for a confidential client, and never again on any subsequent read. required: - oauth2_client properties: client_secret: type: - string - 'null' description: One-time plaintext client secret. `None` for a public client. oauth2_client: $ref: '#/components/schemas/OAuth2Client' description: The created OAuth2 client. OAuth2ClientList: type: object description: OAuth2 client list response. required: - oauth2_clients properties: links: type: - array - 'null' items: $ref: '#/components/schemas/Link' description: Pagination links. oauth2_clients: type: array items: $ref: '#/components/schemas/OAuth2Client' description: Collection of OAuth2 clients. OAuth2ClientResponse: type: object description: OAuth2 client response. required: - oauth2_client properties: oauth2_client: $ref: '#/components/schemas/OAuth2Client' description: OAuth2 client object. OAuth2ClientRotateSecretResponse: type: object description: Response to `POST .../{provider_id}/rotate-secret`. required: - client_secret properties: client_secret: type: string description: One-time plaintext client secret. OAuth2ClientUpdate: type: object description: |- OAuth2 client update payload. `None` fields are left unchanged. `client_id`, `provider_id`, `domain_id`, and `token_endpoint_auth_method` are immutable after creation. properties: allowed_scopes: type: - array - 'null' items: type: string description: New allowed scopes. claims_template: type: - object - 'null' description: New claim templates. additionalProperties: type: string propertyNames: type: string enabled: type: - boolean - 'null' description: Enable/disable toggle. grant_types: type: - array - 'null' items: $ref: '#/components/schemas/GrantType' description: New grant types. pre_authorized: type: - boolean - 'null' description: New pre-authorized flag. SystemAdmin-only to set to `true`. redirect_uris: type: - array - 'null' items: type: string description: New redirect URIs. require_pkce: type: - boolean - 'null' description: New PKCE requirement. OAuth2ClientUpdateRequest: type: object description: OAuth2 client update request wrapper. required: - oauth2_client properties: oauth2_client: $ref: '#/components/schemas/OAuth2ClientUpdate' description: OAuth2 client update payload. Passkey: type: object description: Passkey information. required: - credential_id properties: credential_id: type: string description: Credential ID. description: type: string description: Credential description. PasskeyAuthenticationFinishRequest: type: object description: |- A client response to an authentication challenge. This contains all required information to asses and assert trust in a credentials legitimacy, followed by authentication to a user. You should not need to handle the inner content of this structure - you should provide this to the correctly handling function of Webauthn only. required: - id - extensions - raw_id - response - type_ - user_id properties: extensions: $ref: '#/components/schemas/AuthenticationExtensionsClientOutputs' description: Unsigned Client processed extensions. id: type: string description: The credential Id, likely base64. raw_id: type: string format: binary description: The binary of the credential id. contentEncoding: base64 response: $ref: '#/components/schemas/AuthenticatorAssertionResponseRaw' description: The authenticator response. type_: type: string description: The authenticator type. user_id: type: string description: The ID of the user. PasskeyAuthenticationStartRequest: type: object description: Request for initialization of the passkey authentication. required: - passkey properties: passkey: $ref: '#/components/schemas/PasskeyUserAuthenticationRequest' description: The user authentication data. PasskeyAuthenticationStartResponse: type: object description: |- Passkey Authorization challenge. A JSON serializable challenge which is issued to the user's webbrowser for handling. This is meant to be opaque, that is, you should not need to inspect or alter the content of the struct - you should serialise it and transmit it to the client only. required: - public_key properties: mediation: $ref: '#/components/schemas/Mediation' description: The mediation requested. public_key: $ref: '#/components/schemas/PublicKeyCredentialRequestOptions' description: The options. PasskeyCreate: type: object description: Passkey information. properties: description: type: string description: Passkey description. maxLength: 64 PasskeyResponse: type: object description: Passkey. required: - passkey properties: passkey: $ref: '#/components/schemas/Passkey' description: The description for the passkey (name). PasskeyUser: type: object description: User Entity. required: - id - name - display_name properties: display_name: type: string description: |- The user's preferred name for display. This value can change, so must not be used as a primary key. id: type: string format: binary description: |- The user's id in base64 form. This MUST be a unique id, and must NOT contain personally identifying information, as this value can NEVER be changed. If in doubt, use a UUID. contentEncoding: base64 name: type: string description: |- A detailed name for the account, such as an email address. This value can change, so must not be used as a primary key. PasskeyUserAuthenticationRequest: type: object description: Request for initialization of the passkey authentication. required: - user_id properties: user_id: type: string description: The ID of the user that is authenticating. Project: type: object description: Project information. required: - id - name - domain properties: domain: $ref: '#/components/schemas/Domain' description: project domain. id: type: string description: Project ID. name: type: string description: Project Name. ProjectCreate: type: object description: New project data. required: - name properties: description: type: - string - 'null' description: The description of the project. domain_id: type: - string - 'null' description: |- The ID of the domain for the project. If not specified, the domain is resolved from `parent_id`'s domain, or falls back to the domain the caller's token is scoped to. enabled: type: boolean description: |- If set to true, project is enabled. If set to false, project is disabled. The defaults is `true`. is_domain: type: boolean description: |- Indicates whether the project also acts as a domain. If set to true, this project acts as both a project and domain. As a domain, the project provides a name space in which you can create users, groups, and other projects. If set to false, this project behaves as a regular project that contains only resources. Default is false. You cannot update this parameter after you create the project. name: type: string description: |- The name of the project, which must be unique within the owning domain. A project can have the same name as its domain. parent_id: type: - string - 'null' description: |- The ID of the parent of the project. If specified on project creation, this places the project within a hierarchy and implicitly defines the owning domain, which will be the same domain as the parent specified. If `parent_id` is not specified and `is_domain` is false, then the project will use its owning domain as its parent. If `is_domain` is true (i.e. the project is acting as a domain), then `parent_id` must not specified (or if it is, it must be null) since domains have no parents. `parent_id` is immutable, and can’t be updated after the project is created - hence a project cannot be moved within the hierarchy. additionalProperties: description: Additional project properties. ProjectCreateRequest: type: object description: New project creation request. required: - project properties: project: $ref: '#/components/schemas/ProjectCreate' description: Project object. ProjectResponse: type: object description: Complete response with the project data. required: - project properties: project: $ref: '#/components/schemas/Project' description: Project object. ProjectShort: type: object description: Short Project representation. required: - domain_id - enabled - id - name properties: domain_id: type: string description: The ID of the domain for the project. enabled: type: boolean description: |- If set to true, project is enabled. If set to false, project is disabled. id: type: string description: The ID for the project. name: type: string description: The name of the project. ProjectShortList: type: object description: List of projects. required: - projects properties: projects: type: array items: $ref: '#/components/schemas/ProjectShort' description: Collection of project objects. PubKeyCredParams: type: object description: Public key cryptographic parameters. required: - alg - type_ properties: alg: type: integer format: int64 description: The algorithm in use defined by CASE. type_: type: string description: The type of public-key credential. PublicKeyCredentialCreationOptions: type: object description: The requested options for the authentication. required: - challenge - pub_key_cred_params - rp - user properties: attestation: $ref: '#/components/schemas/AttestationConveyancePreference' description: The requested attestation level from the device. attestation_formats: type: array items: $ref: '#/components/schemas/AttestationFormat' description: The list of attestation formats that the RP will accept. authenticator_selection: $ref: '#/components/schemas/AuthenticatorSelectionCriteria' description: Criteria defining which authenticators may be used in this operation. challenge: type: string format: binary description: The challenge that should be signed by the authenticator. contentEncoding: base64 exclude_credentials: type: array items: $ref: '#/components/schemas/PublicKeyCredentialDescriptor' description: Credential ID's that are excluded from being able to be registered. extensions: $ref: '#/components/schemas/RequestRegistrationExtensions' description: extensions. hints: type: - array - 'null' items: $ref: '#/components/schemas/PublicKeyCredentialHints' description: Hints defining which types credentials may be used in this operation. pub_key_cred_params: type: array items: $ref: '#/components/schemas/PubKeyCredParams' description: The set of cryptographic types allowed by this server. rp: $ref: '#/components/schemas/RelyingParty' description: The relying party. timeout: type: integer format: int32 description: The timeout for the authenticator in case of no interaction. minimum: 0 user: $ref: '#/components/schemas/PasskeyUser' description: The user. PublicKeyCredentialDescriptor: type: object description: . required: - type_ - id properties: id: type: string format: binary description: The credential id. contentEncoding: base64 transports: type: array items: $ref: '#/components/schemas/AuthenticatorTransport' description: |- The allowed transports for this credential. Note this is a hint, and is NOT enforced. type_: type: string description: The type of credential. PublicKeyCredentialHints: type: string description: |- A hint as to the class of device that is expected to fulfill this operation. . enum: - ClientDevice - Hybrid - SecurityKey PublicKeyCredentialRequestOptions: type: object description: The requested options for the authentication. required: - allow_credentials - challenge - rp_id - user_verification properties: allow_credentials: type: array items: $ref: '#/components/schemas/AllowCredentials' description: The set of credentials that are allowed to sign this challenge. challenge: type: string format: binary description: The challenge that should be signed by the authenticator. contentEncoding: base64 extensions: $ref: '#/components/schemas/RequestAuthenticationExtensions' description: extensions. hints: type: array items: $ref: '#/components/schemas/PublicKeyCredentialHints' description: Hints defining which types credentials may be used in this operation. rp_id: type: string description: The relying party ID. timeout: type: - integer - 'null' format: int32 description: The timeout for the authenticator in case of no interaction. minimum: 0 user_verification: $ref: '#/components/schemas/UserVerificationPolicy' description: The verification policy the browser will request. ReconcileLocalEmergencyKeyRequest: type: object description: |- Request body for `POST /v4/oauth2/{domain_id}/reconcile-local-emergency-key`. required: - rotation_id properties: rotation_id: type: string description: |- The `rotation_id` of the node-local candidate to promote, from `GET .../local-emergency-candidates`. The operator's explicit choice when multiple (possibly conflicting) candidates exist (ADR 0028 §6). ReconcileLocalEmergencyKeyResponse: type: object description: |- Response body for `POST /v4/oauth2/{domain_id}/reconcile-local-emergency-key`. required: - kid properties: kid: type: string description: The newly active `Primary` key's `kid`. RegistrationExtensionsClientOutputs: type: object description: |- The default option here for Options are None, so it can be derived. properties: appid: type: boolean description: Indicates whether the client used the provided appid extension. cred_props: $ref: '#/components/schemas/CredProps' description: |- Indicates if the client believes it created a resident key. This property is managed by the webbrowser, and is NOT SIGNED and CAN NOT be trusted! cred_protect: $ref: '#/components/schemas/CredentialProtectionPolicy' description: |- Indicates if the client successfully applied a credential protection policy. hmac_secret: type: boolean description: Indicates if the client successfully applied a HMAC Secret. min_pin_length: type: integer format: int32 description: Indicates the current minimum PIN length. minimum: 0 RelyingParty: type: object description: Relying Party Entity. required: - id - name properties: id: type: string description: The id of the relying party. name: type: string description: The name of the relying party. RequestAuthenticationExtensions: type: object description: |- Extension option inputs for PublicKeyCredentialRequestOptions. Implements AuthenticatorExtensionsClientInputs from the spec. properties: appid: type: string description: The appid extension options. hmac_get_secret: $ref: '#/components/schemas/HmacGetSecretInput' description: |- ⚠️ - Browsers do not support this! Hmac get secret. uvm: type: boolean description: ⚠️ - Browsers do not support this! Uvm. RequestRegistrationExtensions: type: object description: |- Extension option inputs for PublicKeyCredentialCreationOptions. Implements `AuthenticatorExtensionsClientInputs` from the spec. properties: cred_props: type: boolean description: |- ⚠️ - This extension result is always unsigned, and only indicates if the browser requests a residentKey to be created. It has no bearing on the true rk state of the credential. cred_protect: $ref: '#/components/schemas/CredProtect' description: The credProtect extension options. hmac_create_secret: type: boolean description: |- ⚠️ - Browsers support the creation of the secret, but not the retrieval of it. CTAP2.1 create hmac secret. min_pin_length: type: boolean description: CTAP2.1 Minimum pin length. uvm: type: boolean description: ⚠️ - Browsers do not support this! Uvm. ResidentKeyRequirement: type: string description: |- The Relying Party's requirements for client-side discoverable credentials. . enum: - Discouraged - Preferred - Required RevokeAllResponse: type: object required: - revoke_all properties: revoke_all: $ref: '#/components/schemas/RevokeAllSummary' RevokeAllSummary: type: object description: |- Per-category blast-radius counts returned by `revoke_all` (ADR 0025 §4 "Bulk Revocation on Plugin Compromise"). An empty run reports all zeros. required: - users_disabled - links_deleted properties: links_deleted: type: integer minimum: 0 users_disabled: type: integer minimum: 0 Role: type: object description: The role data. required: - id - name properties: description: type: - string - 'null' description: Role description. domain_id: type: - string - 'null' description: Role domain ID. id: type: string description: Role ID. name: type: string description: Role name. additionalProperties: {} RoleCreate: type: object description: Role create request body. required: - name properties: description: type: - string - 'null' description: The role description. domain_id: type: - string - 'null' description: The domain ID of the role. name: type: string description: The role name. additionalProperties: description: Extra attributes for the role. RoleCreateRequest: type: object description: New role creation request. required: - role properties: role: $ref: '#/components/schemas/RoleCreate' description: Role object. RoleImply: type: object description: The role imply data. required: - prior_role - implies properties: implies: $ref: '#/components/schemas/RoleRef' description: The role that is implied by the prior role. prior_role: $ref: '#/components/schemas/RoleRef' description: The prior role that implies another role. RoleImplyResponse: type: object description: Response for a single role inference rule. required: - role_inference properties: role_inference: $ref: '#/components/schemas/RoleImply' description: The role inference rule. RoleInferenceRules: type: object description: Response for listing implied roles by prior role. required: - role_inference properties: role_inference: $ref: '#/components/schemas/ImplyGroup' description: The role inference group. RoleInferencesList: type: object description: Response for listing all role inference rules. required: - role_inferences properties: role_inferences: type: array items: $ref: '#/components/schemas/ImplyGroup' description: Collection of role inference rules. RoleList: type: object description: Roles. required: - roles properties: roles: type: array items: $ref: '#/components/schemas/Role' description: Collection of role objects. RoleRef: type: object description: The role reference data. required: - id - name properties: domain_id: type: - string - 'null' description: Role domain ID. id: type: string description: Role ID. name: type: string description: Role name. RoleResponse: type: object required: - role properties: role: $ref: '#/components/schemas/Role' description: Role object. RotateSigningKeyRequest: type: object description: Request body for `POST /v4/oauth2/{domain_id}/rotate-signing-key`. properties: emergency: type: boolean description: |- Stage an emergency (dual-control) rotation instead of committing immediately. justification: type: - string - 'null' description: |- Required when `local_quorum_bypass` is set: the operator's reason for invoking the bypass, recorded with the candidate for audit. local_quorum_bypass: type: boolean description: |- Stage a `--local-quorum-bypass` rotation (ADR 0028 §2): written only to this node's local emergency store, bypassing Raft/quorum entirely. Mutually exclusive with `emergency` (Raft-backed staging); when set, `emergency` is ignored. Requires `justification` and a node whose `[local_emergency]` guardrail currently permits it. RotateSigningKeyResponse: type: object description: Response body for `POST /v4/oauth2/{domain_id}/rotate-signing-key`. properties: expires_at: type: - integer - 'null' format: int64 description: |- Set when `emergency` was `true`: Unix epoch seconds after which the pending rotation auto-aborts. kid: type: - string - 'null' description: |- Set when `emergency` was `false`: the newly active `Primary` key's `kid`. local_rotation_id: type: - string - 'null' description: |- Set when `local_quorum_bypass` was `true`: the candidate's `rotation_id`, for later reconciliation once quorum returns. pending_rotation_id: type: - string - 'null' description: |- Set when `emergency` was `true`: pass this to `confirm-rotate-signing-key`. RuleMutation: oneOf: - type: object description: Delete a rule by name. required: - rule_name - operation properties: operation: type: string enum: - delete rule_name: type: string description: Name of the rule to delete. - type: object description: Insert a new rule into the ruleset. required: - rule - operation properties: operation: type: string enum: - insert position: oneOf: - type: 'null' - $ref: '#/components/schemas/RulePosition' description: Optional position hint for the inserted rule. rule: $ref: '#/components/schemas/MappingRule' description: Rule to insert. - type: object description: Update an existing rule by name. required: - rule_name - rule - operation properties: operation: type: string enum: - update rule: $ref: '#/components/schemas/MappingRule' description: Updated rule definition. rule_name: type: string description: Name of the existing rule to update. description: Rule mutation for imperative operations. RuleMutationsRequest: type: object description: Rule mutations request wrapper. required: - mutations properties: mutations: type: array items: $ref: '#/components/schemas/RuleMutation' description: List of mutations to apply. RulePosition: oneOf: - type: object description: Insert after the rule with the given name. required: - anchor - type properties: anchor: type: string description: Name of the existing rule to anchor to. type: type: string enum: - after - type: object description: Insert before the rule with the given name. required: - anchor - type properties: anchor: type: string description: Name of the existing rule to anchor to. type: type: string enum: - before description: Rule position for insert operations. ScimRealm: type: object description: A registered SCIM realm. required: - domain_id - provider_id - idp_id - display_name - enabled - created_at - updated_at properties: created_at: type: integer format: int64 description: UTC epoch seconds. display_name: type: string description: Administrative display name for the realm. domain_id: type: string description: Domain owning this realm. enabled: type: boolean description: Whether the realm currently authorizes SCIM resource provisioning. idp_id: type: string description: The federation `IdentityProvider.id` this realm provisions users for. provider_id: type: string description: |- The `provider_id` coordinate this realm authorizes for SCIM resource provisioning. updated_at: type: integer format: int64 description: UTC epoch seconds. ScimRealmCreate: type: object description: SCIM realm creation payload. required: - domain_id - provider_id - idp_id - display_name properties: display_name: type: string description: Administrative display name for the realm. domain_id: type: string description: Domain owning this realm. idp_id: type: string description: |- The federation `IdentityProvider.id` this realm provisions users for. Must resolve to an existing identity provider. provider_id: type: string description: The `provider_id` coordinate this realm authorizes. ScimRealmCreateRequest: type: object description: SCIM realm creation request wrapper. required: - scim_realm properties: scim_realm: $ref: '#/components/schemas/ScimRealmCreate' description: SCIM realm creation payload. ScimRealmList: type: object description: SCIM realm list response. required: - scim_realms properties: links: type: - array - 'null' items: $ref: '#/components/schemas/Link' description: Pagination links. scim_realms: type: array items: $ref: '#/components/schemas/ScimRealm' description: Collection of SCIM realms. ScimRealmResponse: type: object description: SCIM realm response. required: - scim_realm properties: scim_realm: $ref: '#/components/schemas/ScimRealm' description: SCIM realm object. ScimRealmUpdate: type: object description: SCIM realm update payload. `None` fields are left unchanged. properties: display_name: type: - string - 'null' description: New display name. enabled: type: - boolean - 'null' description: Enable/disable toggle (ADR 0024 §2.B, the Realm Activation Gate). idp_id: type: - string - 'null' description: |- New linked `IdentityProvider.id`. Must resolve to an existing identity provider. ScimRealmUpdateRequest: type: object description: SCIM realm update request wrapper. required: - scim_realm properties: scim_realm: $ref: '#/components/schemas/ScimRealmUpdate' description: SCIM realm update payload. Scope: oneOf: - type: object required: - project properties: project: $ref: '#/components/schemas/Project' - type: object required: - domain properties: domain: $ref: '#/components/schemas/Domain' - type: object required: - system properties: system: $ref: '#/components/schemas/System' ScopeProject: type: object description: Project scope information. properties: domain: oneOf: - type: 'null' - $ref: '#/components/schemas/Domain' description: Project domain. id: type: - string - 'null' description: Project ID. name: type: - string - 'null' description: Project Name. Service: type: object description: The service data. required: - id - enabled properties: enabled: type: boolean description: |- Defines whether the service and its endpoints appear in the service catalog. id: type: string description: Service ID. name: type: - string - 'null' description: The service name. type: type: - string - 'null' description: The service type. additionalProperties: {} ServiceCreate: type: object description: Service create request body. properties: enabled: type: boolean description: |- Defines whether the service and its endpoints appear in the service catalog. name: type: - string - 'null' description: The service name. type: type: - string - 'null' description: The service type. additionalProperties: description: Extra attributes for the service. ServiceCreateRequest: type: object description: New service creation request. required: - service properties: service: $ref: '#/components/schemas/ServiceCreate' description: Service object. ServiceList: type: object description: Services. required: - services properties: services: type: array items: $ref: '#/components/schemas/Service' description: Collection of service objects. ServiceResponse: type: object required: - service properties: service: $ref: '#/components/schemas/Service' description: Service object. ServiceUpdate: type: object description: Update service data. properties: enabled: type: - boolean - 'null' description: |- Defines whether the service and its endpoints appear in the service catalog. name: type: - string - 'null' description: The service name. type: type: - string - 'null' description: The service type. additionalProperties: description: Extra attributes for the service (replaces the existing extra). ServiceUpdateRequest: type: object description: Service update request. required: - service properties: service: $ref: '#/components/schemas/ServiceUpdate' description: Service object. SimulatedScope: oneOf: - type: object description: Domain-level scope. required: - domain_id - type properties: domain_id: type: string description: Domain ID the key would be scoped to. type: type: string enum: - domain - type: object description: Project-level scope. required: - project_domain_id - project_id - type properties: project_domain_id: type: string description: Project domain ID. project_id: type: string description: Project ID the key would be scoped to. type: type: string enum: - project description: The scope an API Key would be granted, were it to authenticate right now. SingleVersion: type: object description: Single API version container. required: - version properties: version: $ref: '#/components/schemas/Version' description: The version. System: type: object description: System information. required: - all properties: all: type: boolean description: All. Token: type: object description: Authorization token. required: - audit_ids - methods - expires_at - issued_at - user properties: OS-TRUST:trust: oneOf: - type: 'null' - $ref: '#/components/schemas/TokenTrustRepr' description: A trust object. audit_ids: type: array items: type: string description: |- A list of one or two audit IDs. An audit ID is a unique, randomly generated, URL-safe string that you can use to track a token. The first audit ID is the current audit ID for the token. The second audit ID is present for only re-scoped tokens and is the audit ID from the token before it was re-scoped. A re- scoped token is one that was exchanged for another token of the same or different scope. You can use these audit IDs to track the use of a token or chain of tokens across multiple requests and endpoints without exposing the token ID to non-privileged users. catalog: oneOf: - type: 'null' - $ref: '#/components/schemas/Catalog' description: A catalog object. domain: oneOf: - type: 'null' - $ref: '#/components/schemas/Domain' description: |- A domain object including the id and name representing the domain the token is scoped to. This is only included in tokens that are scoped to a domain. expires_at: type: string format: date-time description: The date and time when the token expires. issued_at: type: string format: date-time description: The date and time when the token was issued. methods: type: array items: type: string description: |- The authentication methods, which are commonly password, token, or other methods. Indicates the accumulated set of authentication methods that were used to obtain the token. For example, if the token was obtained by password authentication, it contains password. Later, if the token is exchanged by using the token authentication method one or more times, the subsequently created tokens contain both password and token in their methods attribute. Unlike multi-factor authentication, the methods attribute merely indicates the methods that were used to authenticate the user in exchange for a token. The client is responsible for determining the total number of authentication factors. project: oneOf: - type: 'null' - $ref: '#/components/schemas/Project' description: |- A project object including the id, name and domain object representing the project the token is scoped to. This is only included in tokens that are scoped to a project. roles: type: - array - 'null' items: $ref: '#/components/schemas/RoleRef' description: A list of role objects. system: oneOf: - type: 'null' - $ref: '#/components/schemas/System' description: A system object. user: $ref: '#/components/schemas/User' description: A user object. TokenForm: type: object properties: client_id: type: - string - 'null' client_secret: type: - string - 'null' code: type: - string - 'null' description: '`authorization_code` grant only (RFC 6749 §4.1.3).' code_verifier: type: - string - 'null' description: '`authorization_code` grant only: PKCE verifier (RFC 7636 §4.5).' device_code: type: - string - 'null' description: |- RFC 8628 `device_code` grant only (§3.4): the value returned by `/device_authorization`. grant_type: type: - string - 'null' redirect_uri: type: - string - 'null' description: |- `authorization_code` grant only -- must exact-match the value recorded at `/authorize`. refresh_token: type: - string - 'null' description: '`refresh_token` grant only (RFC 6749 §6).' requested_token_type: type: - string - 'null' description: |- RFC 8693 Token Exchange grant only. Accepted but not branched on: v1 always returns `urn:ietf:params:oauth:token-type:access_token`, the only token type this grant mints. scope: type: - string - 'null' subject_token: type: - string - 'null' description: |- RFC 8693 Token Exchange grant only: the existing Keystone-native token (Fernet or JWS) being exchanged. subject_token_type: type: - string - 'null' description: |- RFC 8693 Token Exchange grant only. Accepted but not branched on: this repository's `TokenApi::validate_to_context` already decodes either wire format transparently, so there is nothing for the value to select between yet. TokenResponse: type: object required: - token properties: token: $ref: '#/components/schemas/Token' description: Token. TokenRestriction: type: object description: Token restriction data. required: - allow_renew - allow_rescope - domain_id - id - roles properties: allow_renew: type: boolean description: Allow token renew. allow_rescope: type: boolean description: Allow token rescope. domain_id: type: string description: Domain ID the token restriction belongs to. id: type: string description: Token restriction ID. project_id: type: - string - 'null' description: Project ID that the token must be bound to. roles: type: array items: $ref: '#/components/schemas/RoleRef' description: Bound token roles. user_id: type: - string - 'null' description: User ID that the token must be bound to. TokenRestrictionCreate: type: object description: New token restriction data. required: - allow_renew - allow_rescope - domain_id - roles properties: allow_renew: type: boolean description: Allow token renew. allow_rescope: type: boolean description: Allow token rescope. domain_id: type: string description: Domain ID the token restriction belongs to. project_id: type: - string - 'null' description: Project ID that the token must be bound to. roles: type: array items: $ref: '#/components/schemas/RoleRef' description: Bound token roles. user_id: type: - string - 'null' description: User ID that the token must be bound to. TokenRestrictionCreateRequest: type: object description: Token restriction creation request. required: - restriction properties: restriction: $ref: '#/components/schemas/TokenRestrictionCreate' description: Restriction object. TokenRestrictionList: type: object description: Token restrictions. required: - restrictions properties: restrictions: type: array items: $ref: '#/components/schemas/TokenRestriction' description: Token restrictions. TokenRestrictionResponse: type: object description: Token restriction data. required: - restriction properties: restriction: $ref: '#/components/schemas/TokenRestriction' description: Restriction object. TokenRestrictionUpdate: type: object description: New token restriction data. properties: allow_renew: type: - boolean - 'null' description: Allow token renew. allow_rescope: type: - boolean - 'null' description: Allow token rescope. project_id: type: - string - 'null' description: Project ID that the token must be bound to. roles: type: - array - 'null' items: $ref: '#/components/schemas/RoleRef' description: Bound token roles. user_id: type: - string - 'null' description: User ID that the token must be bound to. TokenRestrictionUpdateRequest: type: object description: Token restriction update request. required: - restriction properties: restriction: $ref: '#/components/schemas/TokenRestrictionUpdate' description: Restriction object. TokenTrustRepr: type: object description: A trust object returned in the token. required: - id - impersonation - trustor_user - trustee_user properties: expires_at: type: - string - 'null' format: date-time description: |- Specifies the expiration time of the trust. A trust may be revoked ahead of expiration. If the value represents a time in the past, the trust is deactivated. In the redelegation case it must not exceed the value of the corresponding `expires_at` field of the redelegated trust or it may be omitted, then the `expires_at` value is copied from the redelegated trust. id: type: string description: The ID of the trust. impersonation: type: boolean description: |- If set to `true`, then the user attribute of tokens generated based on the trust will represent that of the `trustor` rather than the `trustee`, thus allowing the `trustee` to impersonate the `trustor`. If impersonation is set to `false`, then the token's user attribute will represent that of the `trustee`. redelegated_trust_id: type: - string - 'null' description: |- Returned with redelegated trust provides information about the predecessor in the trust chain. redelegation_count: type: - integer - 'null' format: int32 description: |- Specifies the maximum remaining depth of the redelegated trust chain. Each subsequent trust has this field decremented by 1 automatically. The initial trustor issuing new trust that can be redelegated, must set allow_redelegation to true and may set `redelegation_count` to an integer value less than or equal to `max_redelegation_count` configuration parameter in order to limit the possible length of derived trust chains. The trust issued by the `trustor` using a project-scoped token (not redelegating), in which `allow_redelegation` is set to true (the new trust is redelegatable), will be populated with the value specified in the `max_redelegation_count` configuration parameter if `redelegation_count` is not set or set to `null`. If `allow_redelegation` is set to `false` then `redelegation_count` will be set to 0 in the trust. If the trust is being issued by the `trustee` of a redelegatable trust-scoped token (redelegation case) then `redelegation_count` should not be set, as it will automatically be set to the value in the redelegatable trust-scoped token decremented by 1. Note, if the resulting value is 0, this means that the new trust will not be redelegatable, regardless of the value of `allow_redelegation`. minimum: 0 remaining_uses: type: - integer - 'null' format: int32 description: |- Specifies how many times the trust can be used to obtain a token. This value is decreased each time a token is issued through the trust. Once it reaches 0, no further tokens will be issued through the trust. The default value is null, meaning there is no limit on the number of tokens issued through the trust. If redelegation is enabled it must not be set. minimum: 0 trustee_user: $ref: '#/components/schemas/TokenTrustUser' description: Represents the user who is capable of consuming the trust. trustor_user: $ref: '#/components/schemas/TokenTrustUser' description: |- Represents the user who created the trust, and who's authorization is being delegated. TokenTrustUser: type: object description: A trust object returned in the token. required: - id properties: id: type: string description: The ID of the user. User: type: object description: User information. required: - id - domain properties: domain: $ref: '#/components/schemas/Domain' description: User domain. id: type: string description: User ID. name: type: - string - 'null' description: User Name. password_expires_at: type: - string - 'null' format: date-time description: User password expiry date. UserCreate: type: object description: Create user data. required: - name properties: default_project_id: type: - string - 'null' description: |- The ID of the default project for the user. A user's default project must not be a domain. Setting this attribute does not grant any actual authorization on the project, and is merely provided for convenience. Therefore, the referenced project does not need to exist within the user domain. If the user does not have authorization to their default project, the default project is ignored at token creation. Additionally, if your default project is not valid, a token is issued without an explicit scope of authorization. domain_id: type: - string - 'null' description: |- User domain ID. When omitted, defaults to the domain of the caller's token scope. enabled: type: boolean description: |- If the user is enabled, this value is true. If the user is disabled, this value is false. name: type: string description: The user name. Must be unique within the owning domain. options: oneOf: - type: 'null' - $ref: '#/components/schemas/UserOptions' description: |- The resource options for the user. Available resource options are ignore_change_password_upon_first_use, ignore_password_expiry, ignore_lockout_failure_attempts, lock_password, multi_factor_auth_enabled, and multi_factor_auth_rules ignore_user_inactivity. password: type: - string - 'null' description: |- The password for the user. Non-emptiness and regex policy are enforced at the service layer via `security_compliance.validate_password`. additionalProperties: description: Additional user properties. UserCreateRequest: type: object description: Complete create user request. required: - user properties: user: $ref: '#/components/schemas/UserCreate' description: User object. UserList: type: object description: List of users. required: - users properties: users: type: array items: $ref: '#/components/schemas/User' description: Collection of user objects. UserOptions: type: object description: User options. properties: ignore_change_password_upon_first_use: type: - boolean - 'null' ignore_lockout_failure_attempts: type: - boolean - 'null' ignore_password_expiry: type: - boolean - 'null' ignore_user_inactivity: type: - boolean - 'null' lock_password: type: - boolean - 'null' multi_factor_auth_enabled: type: - boolean - 'null' multi_factor_auth_rules: type: - array - 'null' items: type: array items: type: string UserPasskeyRegistrationFinishRequest: type: object description: |- A client response to a registration challenge. This contains all required information to assess and assert trust in a credential's legitimacy, followed by registration to a user. You should not need to handle the inner content of this structure - you should provide this to the correctly handling function of Webauthn only. . required: - id - raw_id - response - type_ - extensions properties: description: type: string description: Optional credential description. maxLength: 64 extensions: $ref: '#/components/schemas/RegistrationExtensionsClientOutputs' description: Unsigned Client processed extensions. id: type: string description: |- The id of the PublicKey credential, likely in base64. This is NEVER actually used in a real registration, because the true credential ID is taken from the attestation data. raw_id: type: string format: binary description: |- The id of the credential, as binary. This is NEVER actually used in a real registration, because the true credential ID is taken from the attestation data. contentEncoding: base64 response: $ref: '#/components/schemas/AuthenticatorAttestationResponseRaw' description: . type_: type: string description: The type of credential. UserPasskeyRegistrationStartRequest: type: object description: Passkey registration request. required: - passkey properties: passkey: $ref: '#/components/schemas/PasskeyCreate' description: The description for the passkey (name). UserPasskeyRegistrationStartResponse: type: object description: |- Passkey challenge. This is the WebauthN challenge that need to be signed by the passkey/security device. required: - public_key properties: public_key: $ref: '#/components/schemas/PublicKeyCredentialCreationOptions' description: The options. UserPassword: type: object description: Change user password data. required: - original_password - password properties: original_password: type: string description: The current password for the user. password: type: string description: The new password for the user. UserPasswordRequest: type: object description: Complete password change request. required: - user properties: user: $ref: '#/components/schemas/UserPassword' description: User object. UserResponse: type: object description: Complete response with the user data. required: - user properties: user: $ref: '#/components/schemas/User' description: User object. UserUpdate: type: object description: Update user data. properties: default_project_id: type: - string - 'null' description: |- The ID of the default project for the user. A user's default project must not be a domain. Setting this attribute does not grant any actual authorization on the project, and is merely provided for convenience. Therefore, the referenced project does not need to exist within the user domain. If the user does not have authorization to their default project, the default project is ignored at token creation. Additionally, if your default project is not valid, a token is issued without an explicit scope of authorization. enabled: type: - boolean - 'null' description: |- If the user is enabled, this value is true. If the user is disabled, this value is false. name: type: - string - 'null' description: The user name. Must be unique within the owning domain. options: oneOf: - type: 'null' - $ref: '#/components/schemas/UserOptions' description: |- The resource options for the user. Available resource options are ignore_change_password_upon_first_use, ignore_password_expiry, ignore_lockout_failure_attempts, lock_password, multi_factor_auth_enabled, and multi_factor_auth_rules ignore_user_inactivity. password: type: - string - 'null' description: The password for the user. additionalProperties: description: Additional user properties. UserUpdateRequest: type: object description: Complete update user request. required: - user properties: user: $ref: '#/components/schemas/UserUpdate' description: User object. UserVerificationPolicy: type: string description: |- Defines the User Authenticator Verification policy. This is documented , and each variant lists it's effects. To be clear, Verification means that the Authenticator perform extra or supplementary interaction with the user to verify who they are. An example of this is Apple Touch Id required a fingerprint to be verified, or a yubico device requiring a pin in addition to a touch event. An example of a non-verified interaction is a yubico device with no pin where touch is the only interaction - we only verify a user is present, but we don't have extra details to the legitimacy of that user. As UserVerificationPolicy is only used in credential registration, this stores the verification state of the credential in the persisted credential. These persisted credentials define which UserVerificationPolicy is issued during authentications. IMPORTANT - Due to limitations of the webauthn specification, CTAP devices, and browser implementations, the only secure choice as an RP is required. ⚠️ WARNING - discouraged is marked with a warning, as some authenticators will FORCE verification during registration but NOT during authentication. This makes it impossible for a relying party to consistently enforce user verification, which can confuse users and lead them to distrust user verification is being enforced. ⚠️ WARNING - preferred can lead to authentication errors in some cases due to browser peripheral exchange allowing authentication verification bypass. Webauthn RS is not vulnerable to these bypasses due to our tracking of UV during registration through authentication, however preferred can cause legitimate credentials to not prompt for UV correctly due to browser perhipheral exchange leading Webauthn RS to deny them in what should otherwise be legitimate operations. enum: - Required - Preferred - DiscouragedDoNotUse Values: type: object description: A container with the [Version] list. required: - values properties: values: type: array items: $ref: '#/components/schemas/Version' Version: type: object description: Single API version. required: - id - status properties: id: type: string description: Version id. links: type: - array - 'null' items: $ref: '#/components/schemas/Link' description: Links to the API version. media_types: type: - array - 'null' items: $ref: '#/components/schemas/MediaType' description: Supported media types. status: $ref: '#/components/schemas/VersionStatus' description: Version status. updated: type: - string - 'null' format: date-time description: Date of the version update. VersionStatus: type: string description: Version status. enum: - stable - experimental Versions: type: object description: List of the supported API versions as [Values]. required: - versions properties: versions: $ref: '#/components/schemas/Values' description: List of the versions. securitySchemes: jwt: type: http scheme: bearer bearerFormat: JWT description: JWT (ID) Token issued by the federated IDP oauth2: type: oauth2 flows: authorizationCode: authorizationUrl: https://localhost/authorization/token tokenUrl: https://localhost/token/url scopes: openid: default scope x-auth: type: apiKey in: header name: x-auth-token tags: - name: roles description: |- OpenStack services typically determine whether a user’s API request should be allowed using Role Based Access Control (RBAC). For OpenStack this means the service compares the roles that user has on the project (as indicated by the roles in the token), against the roles required for the API in question (as defined in the service’s policy file). A user obtains roles on a project by having these assigned to them via the Identity service API. Roles must initially be created as entities via the Identity services API and, once created, can then be assigned. You can assign roles to a user or group on a project, including projects owned by other domains. You can also assign roles to a user or group on a domain, although this is only currently relevant for using a domain scoped token to execute domain-level Identity service API requests. - name: role_assignments description: | The creation, checking and deletion of role assignments is done with each of the attributes being specified in the URL. For example to assign a role to a user on a project: ``` PUT /v3/projects/{project_id}/users/{user_id}/roles/{role_id} ``` You can also list roles assigned to the system, or to a specified domain, project, or user using this form of API, however a more generalized API for list assignments is provided where query parameters are used to filter the set of assignments returned in the collection. For example: - List role assignments for the specified user: ``` GET /role_assignments?user.id={user_id} ``` - List role assignments for the specified project: ``` GET /role_assignments?scope.project.id={project_id} ``` - List system role assignments for a specific user: ``` GET /role_assignments?scope.system=all?user.id={user_id} ``` - List system role assignments for all users and groups: ``` GET /role_assignments?scope.system=all ``` Since Identity API v3.10, you can grant role assignments to users and groups on an entity called the system. The role assignment API also supports listing and filtering role assignments on the system. Since Identity API v3.6, you can also list all role assignments within a tree of projects, for example the following would list all role assignments for a specified project and its sub-projects: ``` GET /role_assignments?scope.project.id={project_id}&include_subtree=true ``` If you specify include_subtree=true, you must also specify the scope.project.id. Otherwise, this call returns the Bad Request (400) response code. Each role assignment entity in the collection contains a link to the assignment that created the entity. As mentioned earlier, role assignments can be made to a user or a group on a particular project, domain, or the entire system. A user who is a member of a group that has a role assignment, will also be treated as having that role assignment by virtue of their group membership. The effective role assignments of a user (on a given project or domain) therefore consists of any direct assignments they have, plus any they gain by virtue of membership of groups that also have assignments on the given project or domain. This set of effective role assignments is what is placed in the token for reference by services wishing to check policy. You can list the effective role assignments using the effective query parameter at the user, project, and domain level: - Determine what a user can actually do: ``` GET /role_assignments?user.id={user_id}&effective ``` - Get the equivalent set of role assignments that are included in a project-scoped token response: ``` GET /role_assignments?user.id={user_id}&scope.project.id={project_id}&effective ``` When listing in effective mode, since the group assignments have been effectively expanded out into assignments for each user, the group role assignment entities themselves are not returned in the collection. However, in the response, the links entity section for each assignment gained by virtue of group membership will contain a URL that enables access to the membership of the group. By default only the IDs of entities are returned in collections from the role_assignment API calls. The names of entities may also be returned, in addition to the IDs, by using the include_names query parameter on any of these calls, for example: - List role assignments including names: ``` GET /role_assignments?include_names ``` - name: api_key description: "API Key (SCIM ingress) admin API (ADR 0021).\n\nStateless, domain-owned machine-identity credentials for M2M SCIM provisioning\ningress. Management of these credentials requires the `manager` role\n(DomainManager) scoped to the key's own domain, or `admin` (SystemAdmin).\n " - name: identity_providers description: |- Identity providers API. Identity provider resource allows to federate users from an external Identity Provider (i.e. Keycloak, Azure AD, etc.). Using the Identity provider requires creation of the mapping ruleset (mapping engine), which describes how to map attributes of the remote IdP to local users. Identity provider with an empty domain_id are considered globals and every domain may use it with appropriate mapping. - name: k8s_auth_instance description: | Kubernetes authentication instances (Kubernetes Clusters) API. Authentication Instance represents a remote Kubernetes cluster that issues the JWT token for the service account which could be exchanged for the Keystone token using the unified mapping engine. - name: mapping description: "Mapping engine API.\n\nThe unified mapping engine provides a centralized, protocol-blind rules engine for identity federation.\nRulesets map external claims to localized authorization contexts.\n " - name: mapping_ruleset description: "Mapping ruleset API.\n\nThe unified mapping engine provides a centralized, protocol-blind rules engine for identity federation.\nRulesets map external claims to localized authorization contexts.\n " - name: oauth2 description: OAuth2/OIDC provider public API (ADR 0026). Unauthenticated by design. - name: scim_realm description: |2 SCIM realm administration. A SCIM realm is the explicit administrative activation of an `(domain_id, provider_id)` coordinate for SCIM Users/Groups resource provisioning (ADR 0024). - name: token description: Token API - name: token_restriction description: "Token restrictions API.\n\nToken restrictions allow controlling multiple aspects of the authentication and authorization.\n\n- `allow_rescope` controls whether it is allowed to change the scope of the token. That is by default possible for normal (i.e. password) authentication, is forbidden for the application credentials and may need to be also forbidden for the JWT based authentication.\n\n- `allow_renew` controls whether it is possible to renew the token (get a new token from existing token). This is most likely undisired for the JWT auth.\n\n- `project_id` may control that this token can be only issued for the fixed project scope.\n\n- `user_id` may specify the fixed user_id that will be used when issuing the token independently of the authentication. This is useful for Service Accounts.\n\n- `roles` binds the roles of the issued token on the scope. Using this bypasses necessity to grant the roles explicitly to the user.\n\n " - name: users description: "User API.\n\nUser management endpoints for creating, retrieving, updating, and deleting users.\n " - name: passkey description: Passkey API.