actions.openapi.yaml

openapi: 3.1.0
info:
  title: policy.actions
paths:
  /policy.actions.ActionService/GetAction:
    post:
      tags:
        - policy.actions.ActionService
      summary: GetAction
      operationId: policy.actions.ActionService.GetAction
      parameters:
        - name: Connect-Protocol-Version
          in: header
          required: true
          schema:
            $ref: '#/components/schemas/connect-protocol-version'
        - name: Connect-Timeout-Ms
          in: header
          schema:
            $ref: '#/components/schemas/connect-timeout-header'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/policy.actions.GetActionRequest'
        required: true
      responses:
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/connect.error'
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/policy.actions.GetActionResponse'
  /policy.actions.ActionService/ListActions:
    post:
      tags:
        - policy.actions.ActionService
      summary: ListActions
      operationId: policy.actions.ActionService.ListActions
      parameters:
        - name: Connect-Protocol-Version
          in: header
          required: true
          schema:
            $ref: '#/components/schemas/connect-protocol-version'
        - name: Connect-Timeout-Ms
          in: header
          schema:
            $ref: '#/components/schemas/connect-timeout-header'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/policy.actions.ListActionsRequest'
        required: true
      responses:
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/connect.error'
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/policy.actions.ListActionsResponse'
  /policy.actions.ActionService/CreateAction:
    post:
      tags:
        - policy.actions.ActionService
      summary: CreateAction
      operationId: policy.actions.ActionService.CreateAction
      parameters:
        - name: Connect-Protocol-Version
          in: header
          required: true
          schema:
            $ref: '#/components/schemas/connect-protocol-version'
        - name: Connect-Timeout-Ms
          in: header
          schema:
            $ref: '#/components/schemas/connect-timeout-header'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/policy.actions.CreateActionRequest'
        required: true
      responses:
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/connect.error'
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/policy.actions.CreateActionResponse'
  /policy.actions.ActionService/UpdateAction:
    post:
      tags:
        - policy.actions.ActionService
      summary: UpdateAction
      operationId: policy.actions.ActionService.UpdateAction
      parameters:
        - name: Connect-Protocol-Version
          in: header
          required: true
          schema:
            $ref: '#/components/schemas/connect-protocol-version'
        - name: Connect-Timeout-Ms
          in: header
          schema:
            $ref: '#/components/schemas/connect-timeout-header'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/policy.actions.UpdateActionRequest'
        required: true
      responses:
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/connect.error'
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/policy.actions.UpdateActionResponse'
  /policy.actions.ActionService/DeleteAction:
    post:
      tags:
        - policy.actions.ActionService
      summary: DeleteAction
      operationId: policy.actions.ActionService.DeleteAction
      parameters:
        - name: Connect-Protocol-Version
          in: header
          required: true
          schema:
            $ref: '#/components/schemas/connect-protocol-version'
        - name: Connect-Timeout-Ms
          in: header
          schema:
            $ref: '#/components/schemas/connect-timeout-header'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/policy.actions.DeleteActionRequest'
        required: true
      responses:
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/connect.error'
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/policy.actions.DeleteActionResponse'
components:
  schemas:
    common.MetadataUpdateEnum:
      type: string
      title: MetadataUpdateEnum
      enum:
        - METADATA_UPDATE_ENUM_UNSPECIFIED
        - METADATA_UPDATE_ENUM_EXTEND
        - METADATA_UPDATE_ENUM_REPLACE
    policy.Action.StandardAction:
      type: string
      title: StandardAction
      enum:
        - STANDARD_ACTION_UNSPECIFIED
        - STANDARD_ACTION_DECRYPT
        - STANDARD_ACTION_TRANSMIT
    policy.Algorithm:
      type: string
      title: Algorithm
      enum:
        - ALGORITHM_UNSPECIFIED
        - ALGORITHM_RSA_2048
        - ALGORITHM_RSA_4096
        - ALGORITHM_EC_P256
        - ALGORITHM_EC_P384
        - ALGORITHM_EC_P521
      description: Supported key algorithms.
    policy.AttributeRuleTypeEnum:
      type: string
      title: AttributeRuleTypeEnum
      enum:
        - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED
        - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF
        - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF
        - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY
    policy.ConditionBooleanTypeEnum:
      type: string
      title: ConditionBooleanTypeEnum
      enum:
        - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED
        - CONDITION_BOOLEAN_TYPE_ENUM_AND
        - CONDITION_BOOLEAN_TYPE_ENUM_OR
    policy.KasPublicKeyAlgEnum:
      type: string
      title: KasPublicKeyAlgEnum
      enum:
        - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED
        - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048
        - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096
        - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1
        - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1
        - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1
    policy.SourceType:
      type: string
      title: SourceType
      enum:
        - SOURCE_TYPE_UNSPECIFIED
        - SOURCE_TYPE_INTERNAL
        - SOURCE_TYPE_EXTERNAL
      description: |-
        Describes whether this kas is managed by the organization or if they imported
         the kas information from an external party. These two modes are necessary in order
         to encrypt a tdf dek with an external parties kas public key.
    policy.SubjectMappingOperatorEnum:
      type: string
      title: SubjectMappingOperatorEnum
      enum:
        - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED
        - SUBJECT_MAPPING_OPERATOR_ENUM_IN
        - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN
        - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS
    common.Metadata:
      type: object
      properties:
        createdAt:
          title: created_at
          description: created_at set by server (entity who created will recorded in an audit event)
          $ref: '#/components/schemas/google.protobuf.Timestamp'
        updatedAt:
          title: updated_at
          description: updated_at set by server (entity who updated will recorded in an audit event)
          $ref: '#/components/schemas/google.protobuf.Timestamp'
        labels:
          type: object
          title: labels
          additionalProperties:
            type: string
            title: value
          description: optional short description
      title: Metadata
      additionalProperties: false
      description: Struct to uniquely identify a resource with optional additional metadata
    common.Metadata.LabelsEntry:
      type: object
      properties:
        key:
          type: string
          title: key
        value:
          type: string
          title: value
      title: LabelsEntry
      additionalProperties: false
    common.MetadataMutable:
      type: object
      properties:
        labels:
          type: object
          title: labels
          additionalProperties:
            type: string
            title: value
          description: optional labels
      title: MetadataMutable
      additionalProperties: false
    common.MetadataMutable.LabelsEntry:
      type: object
      properties:
        key:
          type: string
          title: key
        value:
          type: string
          title: value
      title: LabelsEntry
      additionalProperties: false
    google.protobuf.BoolValue:
      type: boolean
      description: |-
        Wrapper message for `bool`.

         The JSON representation for `BoolValue` is JSON `true` and `false`.

         Not recommended for use in new APIs, but still useful for legacy APIs and
         has no plan to be removed.
    google.protobuf.Timestamp:
      type: string
      examples:
        - 1s
        - 1.000340012s
      format: date-time
      description: |-
        A Timestamp represents a point in time independent of any time zone or local
         calendar, encoded as a count of seconds and fractions of seconds at
         nanosecond resolution. The count is relative to an epoch at UTC midnight on
         January 1, 1970, in the proleptic Gregorian calendar which extends the
         Gregorian calendar backwards to year one.

         All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap
         second table is needed for interpretation, using a [24-hour linear
         smear](https://developers.google.com/time/smear).

         The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By
         restricting to that range, we ensure that we can convert to and from [RFC
         3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.

         # Examples

         Example 1: Compute Timestamp from POSIX `time()`.

             Timestamp timestamp;
             timestamp.set_seconds(time(NULL));
             timestamp.set_nanos(0);

         Example 2: Compute Timestamp from POSIX `gettimeofday()`.

             struct timeval tv;
             gettimeofday(&tv, NULL);

             Timestamp timestamp;
             timestamp.set_seconds(tv.tv_sec);
             timestamp.set_nanos(tv.tv_usec * 1000);

         Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.

             FILETIME ft;
             GetSystemTimeAsFileTime(&ft);
             UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;

             // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
             // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
             Timestamp timestamp;
             timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
             timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));

         Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.

             long millis = System.currentTimeMillis();

             Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
                 .setNanos((int) ((millis % 1000) * 1000000)).build();

         Example 5: Compute Timestamp from Java `Instant.now()`.

             Instant now = Instant.now();

             Timestamp timestamp =
                 Timestamp.newBuilder().setSeconds(now.getEpochSecond())
                     .setNanos(now.getNano()).build();

         Example 6: Compute Timestamp from current time in Python.

             timestamp = Timestamp()
             timestamp.GetCurrentTime()

         # JSON Mapping

         In JSON format, the Timestamp type is encoded as a string in the
         [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the
         format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z"
         where {year} is always expressed using four digits while {month}, {day},
         {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional
         seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),
         are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone
         is required. A proto3 JSON serializer should always use UTC (as indicated by
         "Z") when printing the Timestamp type and a proto3 JSON parser should be
         able to accept both UTC and other timezones (as indicated by an offset).

         For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past
         01:30 UTC on January 15, 2017.

         In JavaScript, one can convert a Date object to this format using the
         standard
         [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString)
         method. In Python, a standard `datetime.datetime` object can be converted
         to this format using
         [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with
         the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use
         the Joda Time's [`ISODateTimeFormat.dateTime()`](
         http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime()
         ) to obtain a formatter capable of generating timestamps in this format.
    policy.Action:
      type: object
      oneOf:
        - properties:
            custom:
              type: string
              title: custom
              description: Deprecated
          title: custom
          required:
            - custom
        - properties:
            standard:
              title: standard
              description: Deprecated
              $ref: '#/components/schemas/policy.Action.StandardAction'
          title: standard
          required:
            - standard
      properties:
        id:
          type: string
          title: id
          description: Generated uuid in database
        name:
          type: string
          title: name
        metadata:
          title: metadata
          $ref: '#/components/schemas/common.Metadata'
      title: Action
      additionalProperties: false
      description: An action an entity can take
    policy.Attribute:
      type: object
      properties:
        id:
          type: string
          title: id
        namespace:
          title: namespace
          description: namespace of the attribute
          $ref: '#/components/schemas/policy.Namespace'
        name:
          type: string
          title: name
          description: attribute name
        rule:
          title: rule
          description: attribute rule enum
          $ref: '#/components/schemas/policy.AttributeRuleTypeEnum'
        values:
          type: array
          items:
            $ref: '#/components/schemas/policy.Value'
          title: values
        grants:
          type: array
          items:
            $ref: '#/components/schemas/policy.KeyAccessServer'
          title: grants
          description: Deprecated KAS grants for the attribute. Use kas_keys instead.
        fqn:
          type: string
          title: fqn
        active:
          title: active
          description: active by default until explicitly deactivated
          $ref: '#/components/schemas/google.protobuf.BoolValue'
        kasKeys:
          type: array
          items:
            $ref: '#/components/schemas/policy.SimpleKasKey'
          title: kas_keys
          description: Keys associated with the attribute
        metadata:
          title: metadata
          description: Common metadata
          $ref: '#/components/schemas/common.Metadata'
      title: Attribute
      required:
        - rule
      additionalProperties: false
    policy.Certificate:
      type: object
      properties:
        id:
          type: string
          title: id
          description: generated uuid in database
        x5c:
          type: string
          title: x5c
          description: x5c format - An array of base64-encoded DER certificates (not PEM; no headers/footers)
      title: Certificate
      additionalProperties: false
    policy.Condition:
      type: object
      properties:
        subjectExternalSelectorValue:
          type: string
          title: subject_external_selector_value
          description: |-
            a selector for a field value on a flattened Entity Representation (such as
             from idP/LDAP)
        operator:
          title: operator
          description: the evaluation operator of relation
          $ref: '#/components/schemas/policy.SubjectMappingOperatorEnum'
        subjectExternalValues:
          type: array
          items:
            type: string
            minItems: 1
          title: subject_external_values
          minItems: 1
          description: |-
            list of comparison values for the result of applying the
             subject_external_selector_value on a flattened Entity Representation
             (Subject), evaluated by the operator
      title: Condition
      required:
        - subjectExternalSelectorValue
        - operator
      additionalProperties: false
      description: |-
        *
        A Condition defines a rule of <the value at the flattened 'selector value'
        location> <operator> <subject external values>
    policy.ConditionGroup:
      type: object
      properties:
        conditions:
          type: array
          items:
            $ref: '#/components/schemas/policy.Condition'
          title: conditions
          minItems: 1
        booleanOperator:
          title: boolean_operator
          description: the boolean evaluation type across the conditions
          $ref: '#/components/schemas/policy.ConditionBooleanTypeEnum'
      title: ConditionGroup
      required:
        - booleanOperator
      additionalProperties: false
      description: A collection of Conditions evaluated by the boolean_operator provided
    policy.KasPublicKey:
      type: object
      properties:
        pem:
          type: string
          title: pem
          maxLength: 8192
          minLength: 1
          description: x509 ASN.1 content in PEM envelope, usually
        kid:
          type: string
          title: kid
          maxLength: 32
          minLength: 1
          description: A unique string identifier for this key
        alg:
          not:
            enum:
              - 0
          title: alg
          description: |-
            A known algorithm type with any additional parameters encoded.
             To start, these may be `rsa:2048` for encrypting ZTDF files and
             `ec:secp256r1` for nanoTDF, but more formats may be added as needed.
          $ref: '#/components/schemas/policy.KasPublicKeyAlgEnum'
      title: KasPublicKey
      additionalProperties: false
      description: |-
        Deprecated
         A KAS public key and some associated metadata for further identifcation
    policy.KasPublicKeySet:
      type: object
      properties:
        keys:
          type: array
          items:
            $ref: '#/components/schemas/policy.KasPublicKey'
          title: keys
      title: KasPublicKeySet
      additionalProperties: false
      description: |-
        Deprecated
         A list of known KAS public keys
    policy.KeyAccessServer:
      type: object
      properties:
        id:
          type: string
          title: id
        uri:
          type: string
          title: uri
          description: |+
            Address of a KAS instance
            URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.:
            ```
            this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$')
            ```

        publicKey:
          title: public_key
          description: Deprecated
          $ref: '#/components/schemas/policy.PublicKey'
        sourceType:
          title: source_type
          description: 'The source of the KAS: (INTERNAL, EXTERNAL)'
          $ref: '#/components/schemas/policy.SourceType'
        kasKeys:
          type: array
          items:
            $ref: '#/components/schemas/policy.SimpleKasKey'
          title: kas_keys
          description: Kas keys associated with this KAS
        name:
          type: string
          title: name
          description: |-
            Optional
             Unique name of the KAS instance
        metadata:
          title: metadata
          description: Common metadata
          $ref: '#/components/schemas/common.Metadata'
      title: KeyAccessServer
      additionalProperties: false
      description: Key Access Server Registry
    policy.Namespace:
      type: object
      properties:
        id:
          type: string
          title: id
          description: generated uuid in database
        name:
          type: string
          title: name
          description: |-
            used to partition Attribute Definitions, support by namespace AuthN and
             enable federation
        fqn:
          type: string
          title: fqn
        active:
          title: active
          description: active by default until explicitly deactivated
          $ref: '#/components/schemas/google.protobuf.BoolValue'
        metadata:
          title: metadata
          $ref: '#/components/schemas/common.Metadata'
        grants:
          type: array
          items:
            $ref: '#/components/schemas/policy.KeyAccessServer'
          title: grants
          description: Deprecated KAS grants for the namespace. Use kas_keys instead.
        kasKeys:
          type: array
          items:
            $ref: '#/components/schemas/policy.SimpleKasKey'
          title: kas_keys
          description: Keys for the namespace
        rootCerts:
          type: array
          items:
            $ref: '#/components/schemas/policy.Certificate'
          title: root_certs
          description: Root certificates for chain of trust
      title: Namespace
      additionalProperties: false
    policy.Obligation:
      type: object
      properties:
        id:
          type: string
          title: id
        namespace:
          title: namespace
          $ref: '#/components/schemas/policy.Namespace'
        name:
          type: string
          title: name
        values:
          type: array
          items:
            $ref: '#/components/schemas/policy.ObligationValue'
          title: values
        fqn:
          type: string
          title: fqn
        metadata:
          title: metadata
          $ref: '#/components/schemas/common.Metadata'
      title: Obligation
      additionalProperties: false
    policy.ObligationTrigger:
      type: object
      properties:
        id:
          type: string
          title: id
        obligationValue:
          title: obligation_value
          $ref: '#/components/schemas/policy.ObligationValue'
        action:
          title: action
          $ref: '#/components/schemas/policy.Action'
        attributeValue:
          title: attribute_value
          $ref: '#/components/schemas/policy.Value'
        context:
          type: array
          items:
            $ref: '#/components/schemas/policy.RequestContext'
          title: context
        metadata:
          title: metadata
          $ref: '#/components/schemas/common.Metadata'
      title: ObligationTrigger
      additionalProperties: false
    policy.ObligationValue:
      type: object
      properties:
        id:
          type: string
          title: id
        obligation:
          title: obligation
          $ref: '#/components/schemas/policy.Obligation'
        value:
          type: string
          title: value
        triggers:
          type: array
          items:
            $ref: '#/components/schemas/policy.ObligationTrigger'
          title: triggers
        fqn:
          type: string
          title: fqn
        metadata:
          title: metadata
          $ref: '#/components/schemas/common.Metadata'
      title: ObligationValue
      additionalProperties: false
    policy.PageRequest:
      type: object
      properties:
        limit:
          type: integer
          title: limit
          format: int32
          description: |-
            Optional
             Set to configured default limit if not provided
             Maximum limit set in platform config and enforced by services
        offset:
          type: integer
          title: offset
          format: int32
          description: |-
            Optional
             Defaulted if not provided
      title: PageRequest
      additionalProperties: false
    policy.PageResponse:
      type: object
      properties:
        currentOffset:
          type: integer
          title: current_offset
          format: int32
          description: Requested pagination offset
        nextOffset:
          type: integer
          title: next_offset
          format: int32
          description: |-
            Calculated with request limit + offset or defaults
             Empty when none remain after current page
        total:
          type: integer
          title: total
          format: int32
          description: Total count of entire list
      title: PageResponse
      additionalProperties: false
    policy.PolicyEnforcementPoint:
      type: object
      properties:
        clientId:
          type: string
          title: client_id
          minLength: 1
      title: PolicyEnforcementPoint
      additionalProperties: false
    policy.PublicKey:
      type: object
      oneOf:
        - properties:
            cached:
              title: cached
              description: public key with additional information. Current preferred version
              $ref: '#/components/schemas/policy.KasPublicKeySet'
          title: cached
          required:
            - cached
        - properties:
            remote:
              type: string
              title: remote
              description: |+
                kas public key url - optional since can also be retrieved via public key
                URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.:
                ```
                this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$')
                ```

          title: remote
          required:
            - remote
      title: PublicKey
      additionalProperties: false
      description: Deprecated
    policy.RequestContext:
      type: object
      properties:
        pep:
          title: pep
          $ref: '#/components/schemas/policy.PolicyEnforcementPoint'
      title: RequestContext
      required:
        - pep
      additionalProperties: false
      description: Holds the context needed for obligation fulfillment
    policy.ResourceMapping:
      type: object
      properties:
        id:
          type: string
          title: id
        metadata:
          title: metadata
          $ref: '#/components/schemas/common.Metadata'
        attributeValue:
          title: attribute_value
          $ref: '#/components/schemas/policy.Value'
        terms:
          type: array
          items:
            type: string
          title: terms
        group:
          title: group
          $ref: '#/components/schemas/policy.ResourceMappingGroup'
      title: ResourceMapping
      required:
        - attributeValue
      additionalProperties: false
      description: |-
        Resource Mappings (aka Access Control Resource Encodings aka ACRE) are
        structures supporting the mapping of Resources and Attribute Values
    policy.ResourceMappingGroup:
      type: object
      properties:
        id:
          type: string
          title: id
        namespaceId:
          type: string
          title: namespace_id
          description: the namespace containing the group of resource mappings
        name:
          type: string
          title: name
          description: |-
            the common name for the group of resource mappings, which must be unique
             per namespace
        metadata:
          title: metadata
          description: Common metadata
          $ref: '#/components/schemas/common.Metadata'
      title: ResourceMappingGroup
      required:
        - namespaceId
        - name
      additionalProperties: false
      description: |-
        Resource Mapping Groups are namespaced collections of Resource Mappings
        associated under a common group name.
    policy.SimpleKasKey:
      type: object
      properties:
        kasUri:
          type: string
          title: kas_uri
          description: The URL of the Key Access Server
        publicKey:
          title: public_key
          description: The public key of the Key that belongs to the KAS
          $ref: '#/components/schemas/policy.SimpleKasPublicKey'
        kasId:
          type: string
          title: kas_id
          description: The ID of the Key Access Server
      title: SimpleKasKey
      additionalProperties: false
    policy.SimpleKasPublicKey:
      type: object
      properties:
        algorithm:
          title: algorithm
          $ref: '#/components/schemas/policy.Algorithm'
        kid:
          type: string
          title: kid
        pem:
          type: string
          title: pem
      title: SimpleKasPublicKey
      additionalProperties: false
    policy.SubjectConditionSet:
      type: object
      properties:
        id:
          type: string
          title: id
        subjectSets:
          type: array
          items:
            $ref: '#/components/schemas/policy.SubjectSet'
          title: subject_sets
          minItems: 1
        metadata:
          title: metadata
          $ref: '#/components/schemas/common.Metadata'
      title: SubjectConditionSet
      additionalProperties: false
      description: |-
        A container for multiple Subject Sets, each containing Condition Groups, each
        containing Conditions. Multiple Subject Sets in a SubjectConditionSet are
        evaluated with AND logic. As each Subject Mapping has only one Attribute
        Value, the SubjectConditionSet is reusable across multiple Subject Mappings /
        Attribute Values and is an independent unit.
    policy.SubjectMapping:
      type: object
      properties:
        id:
          type: string
          title: id
        attributeValue:
          title: attribute_value
          description: 'the Attribute Value mapped to; aka: "The Entity Entitlement Attribute"'
          $ref: '#/components/schemas/policy.Value'
        subjectConditionSet:
          title: subject_condition_set
          description: the reusable SubjectConditionSet mapped to the given Attribute Value
          $ref: '#/components/schemas/policy.SubjectConditionSet'
        actions:
          type: array
          items:
            $ref: '#/components/schemas/policy.Action'
          title: actions
          description: The actions permitted by subjects in this mapping
        metadata:
          title: metadata
          $ref: '#/components/schemas/common.Metadata'
      title: SubjectMapping
      additionalProperties: false
      description: |-
        Subject Mapping: A Policy assigning Subject Set(s) to a permitted attribute
        value + action(s) combination
    policy.SubjectSet:
      type: object
      properties:
        conditionGroups:
          type: array
          items:
            $ref: '#/components/schemas/policy.ConditionGroup'
          title: condition_groups
          minItems: 1
          description: multiple Condition Groups are evaluated with AND logic
      title: SubjectSet
      additionalProperties: false
      description: A collection of Condition Groups
    policy.Value:
      type: object
      properties:
        id:
          type: string
          title: id
          description: generated uuid in database
        attribute:
          title: attribute
          $ref: '#/components/schemas/policy.Attribute'
        value:
          type: string
          title: value
        grants:
          type: array
          items:
            $ref: '#/components/schemas/policy.KeyAccessServer'
          title: grants
          description: Deprecated KAS grants for the value. Use kas_keys instead.
        fqn:
          type: string
          title: fqn
        active:
          title: active
          description: active by default until explicitly deactivated
          $ref: '#/components/schemas/google.protobuf.BoolValue'
        subjectMappings:
          type: array
          items:
            $ref: '#/components/schemas/policy.SubjectMapping'
          title: subject_mappings
          description: subject mapping
        kasKeys:
          type: array
          items:
            $ref: '#/components/schemas/policy.SimpleKasKey'
          title: kas_keys
        resourceMappings:
          type: array
          items:
            $ref: '#/components/schemas/policy.ResourceMapping'
          title: resource_mappings
        obligations:
          type: array
          items:
            $ref: '#/components/schemas/policy.Obligation'
          title: obligations
        metadata:
          title: metadata
          description: Common metadata
          $ref: '#/components/schemas/common.Metadata'
      title: Value
      additionalProperties: false
    policy.actions.CreateActionRequest:
      type: object
      properties:
        name:
          type: string
          title: name
          maxLength: 253
          description: |+
            Required
            Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case.:
            ```
            this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')
            ```

        metadata:
          title: metadata
          description: Optional
          $ref: '#/components/schemas/common.MetadataMutable'
      title: CreateActionRequest
      required:
        - name
      additionalProperties: false
      description: |-
        Create a new Custom action name with optional metadata.
         Creation of Standard actions is not supported.
    policy.actions.CreateActionResponse:
      type: object
      properties:
        action:
          title: action
          $ref: '#/components/schemas/policy.Action'
      title: CreateActionResponse
      additionalProperties: false
    policy.actions.DeleteActionRequest:
      type: object
      properties:
        id:
          type: string
          title: id
          format: uuid
          description: Required
      title: DeleteActionRequest
      additionalProperties: false
      description: 'Custom only: deletion of Standard actions is not supported.'
    policy.actions.DeleteActionResponse:
      type: object
      properties:
        action:
          title: action
          $ref: '#/components/schemas/policy.Action'
      title: DeleteActionResponse
      additionalProperties: false
    policy.actions.GetActionRequest:
      type: object
      oneOf:
        - properties:
            id:
              type: string
              title: id
              format: uuid
          title: id
          required:
            - id
        - properties:
            name:
              type: string
              title: name
              maxLength: 253
              description: |+
                Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case.:
                ```
                this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')
                ```

          title: name
          required:
            - name
      title: GetActionRequest
      additionalProperties: false
    policy.actions.GetActionResponse:
      type: object
      properties:
        action:
          title: action
          $ref: '#/components/schemas/policy.Action'
        subjectMappings:
          type: array
          items:
            $ref: '#/components/schemas/policy.SubjectMapping'
          title: subject_mappings
          description: Subject Mappings driving entitlement to the action
      title: GetActionResponse
      additionalProperties: false
    policy.actions.ListActionsRequest:
      type: object
      properties:
        pagination:
          title: pagination
          description: Optional
          $ref: '#/components/schemas/policy.PageRequest'
      title: ListActionsRequest
      additionalProperties: false
    policy.actions.ListActionsResponse:
      type: object
      properties:
        actionsStandard:
          type: array
          items:
            $ref: '#/components/schemas/policy.Action'
          title: actions_standard
        actionsCustom:
          type: array
          items:
            $ref: '#/components/schemas/policy.Action'
          title: actions_custom
        pagination:
          title: pagination
          $ref: '#/components/schemas/policy.PageResponse'
      title: ListActionsResponse
      additionalProperties: false
    policy.actions.UpdateActionRequest:
      type: object
      properties:
        id:
          type: string
          title: id
          format: uuid
          description: Required
        name:
          type: string
          title: name
          maxLength: 253
          description: |+
            Optional
             Custom actions only: replaces the existing action name
            Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case.:
            ```
            size(this) == 0 || this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')
            ```

        metadata:
          title: metadata
          description: Common metadata
          $ref: '#/components/schemas/common.MetadataMutable'
        metadataUpdateBehavior:
          title: metadata_update_behavior
          $ref: '#/components/schemas/common.MetadataUpdateEnum'
      title: UpdateActionRequest
      additionalProperties: false
      description: |-
        Metadata may be updated for either Custom or Standard actions.
         Names may only be updated for Custom actions.
    policy.actions.UpdateActionResponse:
      type: object
      properties:
        action:
          title: action
          $ref: '#/components/schemas/policy.Action'
      title: UpdateActionResponse
      additionalProperties: false
    connect-protocol-version:
      type: number
      title: Connect-Protocol-Version
      enum:
        - 1
      description: Define the version of the Connect protocol
      const: 1
    connect-timeout-header:
      type: number
      title: Connect-Timeout-Ms
      description: Define the timeout, in ms
    connect.error:
      type: object
      properties:
        code:
          type: string
          examples:
            - not_found
          enum:
            - canceled
            - unknown
            - invalid_argument
            - deadline_exceeded
            - not_found
            - already_exists
            - permission_denied
            - resource_exhausted
            - failed_precondition
            - aborted
            - out_of_range
            - unimplemented
            - internal
            - unavailable
            - data_loss
            - unauthenticated
          description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
        message:
          type: string
          description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
        detail:
          $ref: '#/components/schemas/google.protobuf.Any'
      title: Connect Error
      additionalProperties: true
      description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation'
    google.protobuf.Any:
      type: object
      properties:
        type:
          type: string
        value:
          type: string
          format: binary
        debug:
          type: object
          additionalProperties: true
      additionalProperties: true
      description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.
security: []
tags:
  - name: policy.actions.ActionService