openapi: 3.0.0
servers:
  - url: http://conjur.local
  - url: /
info:
  contact:
    email: conj_maintainers@cyberark.com
  description: This is an API definition for CyberArk Conjur Open Source. You can find out more at [Conjur.org](https://www.conjur.org/).
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  title: Conjur
  version: 5.3.0
  x-apisguru-categories:
    - security
  x-origin:
    - format: openapi
      url: https://raw.githubusercontent.com/cyberark/conjur-openapi-spec/main/spec/openapi.yml
      version: "3.0"
  x-providerName: conjur.local
externalDocs:
  description: Find out more about Conjur
  url: https://conjur.org
security:
  - basicAuth: []
  - conjurAuth: []
  - conjurKubernetesMutualTls: []
tags:
  - description: Authentication
    name: authentication
  - description: Secrets
    name: secrets
  - description: Policies
    name: policies
  - description: RBAC
    name: roles
  - description: Host factories
    name: host factory
  - description: SSH keys
    name: public keys
  - description: Resources
    name: resources
  - description: Server status
    name: status
  - description: Certificate authority
    name: certificate authority
paths:
  /authenticators:
    get:
      description: |
        Response contains three members: installed, configured, and enabled.

        installed: The authenticator is implemented in Conjur and is available for configuration
        configured: The authenticator has a webservice in the DB that was loaded by policy
        enabled: The authenticator is enabled (in the DB or in the ENV) and is ready for authentication
      operationId: getAuthenticators
      responses:
        "200":
          content:
            application/json:
              schema:
                properties:
                  configured:
                    description: The authenticators configured on the Conjur server
                    example:
                      - authn
                    items:
                      type: string
                    type: array
                  enabled:
                    description: The authenticators enabled on the Conjur server
                    example:
                      - authn
                    items:
                      type: string
                    type: array
                  installed:
                    description: The authenticators installed on the Conjur server
                    example:
                      - authn
                    items:
                      type: string
                    type: array
                type: object
          description: Details about authenticators for this Conjur server
      summary: Details about which authenticators are on the Conjur Server
      tags:
        - status
    parameters:
      - $ref: "#/components/parameters/RequestID"
  "/authn-azure/{service_id}/{account}/{login}/authenticate":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        The access token is used to communicate to the REST API that
        the bearer of the token has been authorized to access the API and perform
        specific actions specified by the scope that was granted during authorization.

        For API usage, the base64-encoded access token is ordinarily passed as an HTTP
        Authorization header as `Authorization: Token token=<base64-encoded token>`.

        The `login` must be URL encoded and the host ID must have the prefix
        `host/`. For example, the host webserver would login as `host/webserver`,
        and would be encoded as `host%2Fwebserver`.

        The `service_id`, if given, must be URL encoded. For example,
        `prod/gke` must be encoded as `prod%2Fgke`.

        To authenticate to Conjur using this endpoint, reference the detailed
        documentation: [Azure Authenticator](https://docs.conjur.org/Latest/en/Content/Operations/Services/azure_authn.htm) (`authn-azure`).
      operationId: getAccessTokenViaAzure
      parameters:
        - $ref: "#/components/parameters/ServiceID"
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: URL-encoded login name. For users, it’s the user ID. For hosts, the login name is `host/<host-id>`
          in: path
          name: login
          required: true
          schema:
            $ref: "#/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/parameters/1/schema"
        - description: Setting the Accept-Encoding header to base64 will return a pre-encoded access token
          in: header
          name: Accept-Encoding
          schema:
            default: application/json
            enum:
              - application/json
              - base64
            type: string
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              description: Azure instance identity token
              example:
                jwt: eyJhbGciOiJSUzI1NiIs......uTonCA
              properties:
                jwt:
                  type: string
              type: object
        description: Azure identity token
        required: true
      responses:
        "200":
          $ref: "#/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/responses/200"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "500":
          $ref: "#/components/responses/InternalServerError"
      security: []
      summary: Gets a short-lived access token for applications running in Azure.
      tags:
        - authentication
  "/authn-gcp/{account}/authenticate":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        Use the GCP Authenticator API to send an authentication
        request from a Google Cloud service to Conjur.

        For more information, see [the documentation](https://docs.conjur.org/Latest/en/Content/Operations/Services/cjr-gcp-authn.htm).
      operationId: getAccessTokenViaGCP
      parameters:
        - description: Organization account name
          example: dev
          in: path
          name: account
          required: true
          schema:
            type: string
        - description: Setting the Accept-Encoding header to base64 will return a pre-encoded access token
          in: header
          name: Accept-Encoding
          schema:
            enum:
              - base64
            type: string
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              description: Google Cloud instance identity token
              example:
                jwt: eyJhbGciOiJSUzI1NiIs......uTonCA
              properties:
                jwt:
                  type: string
              type: object
        description: Google JWT identity token for the Google Cloud service
        required: true
      responses:
        "200":
          $ref: "#/paths/~1authn~1%7Baccount%7D~1login/get/responses/200"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "500":
          $ref: "#/components/responses/InternalServerError"
      security: []
      summary: |
        Gets a short-lived access token for applications running in
        Google Cloud Platform.
      tags:
        - authentication
  "/authn-gcp/{account}/status":
    get:
      description: |
        Once the status webservice has been properly configured and the relevant user
        groups have been given permissions to access the status webservice, the
        users in those groups can check the status of the authenticator.

        This operation only supports the GCP authenticator

        See [Conjur Documentation](https://docs.conjur.org/Latest/en/Content/Integrations/Authn-status.htm)
        for details on setting up the authenticator status webservice.
      operationId: getGCPAuthenticatorStatus
      parameters:
        - description: The organization account name
          example: dev
          in: path
          name: account
          required: true
          schema:
            type: string
      responses:
        "200":
          $ref: "#/paths/~1%7Bauthenticator%7D~1%7Bservice_id%7D~1%7Baccount%7D~1status/get/responses/200"
        "400":
          $ref: "#/components/responses/BadRequest"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "404":
          description: The service was not found
        "500":
          $ref: "#/paths/~1%7Bauthenticator%7D~1%7Bservice_id%7D~1%7Baccount%7D~1status/get/responses/200"
        "501":
          $ref: "#/paths/~1%7Bauthenticator%7D~1%7Bservice_id%7D~1%7Baccount%7D~1status/get/responses/200"
      security:
        - conjurAuth: []
      summary: Details whether an authentication service has been configured properly
      tags:
        - status
    parameters:
      - $ref: "#/components/parameters/RequestID"
  "/authn-iam/{service_id}/{account}/{login}/authenticate":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        The access token is used to communicate to the REST API that
        the bearer of the token has been authorized to access the API and perform
        specific actions specified by the scope that was granted during authorization.

        For API usage, the base64-encoded access token is ordinarily passed as an HTTP
        Authorization header as `Authorization: Token token=<base64-encoded token>`.

        The `login` must be URL encoded and the host ID must have the prefix
        `host/`. For example, the host webserver would login as `host/webserver`,
        and would be encoded as `host%2Fwebserver`.

        The `service_id`, if given, must be URL encoded. For example,
        `prod/gke` must be encoded as `prod%2Fgke`.

        For detailed instructions on authenticating to Conjur using this endpoint,
        reference the documentation:
        [AWS IAM Authenticator](https://docs.conjur.org/Latest/en/Content/Operations/Services/AWS_IAM_Authenticator.htm) (`authn-iam`).
      operationId: getAccessTokenViaAWS
      parameters:
        - $ref: "#/components/parameters/ServiceID"
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: URL-encoded login name. For hosts, the login name is `host/<host-id>`
          in: path
          name: login
          required: true
          schema:
            $ref: "#/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/parameters/1/schema"
        - description: Setting the Accept-Encoding header to base64 will return a pre-encoded access token
          in: header
          name: Accept-Encoding
          schema:
            default: application/json
            enum:
              - application/json
              - base64
            type: string
      requestBody:
        content:
          text/plain:
            schema:
              description: AWS Signature Version 4 header
              type: string
        description: AWS Signature header
        required: true
      responses:
        "200":
          $ref: "#/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/responses/200"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "500":
          $ref: "#/components/responses/InternalServerError"
      security: []
      summary: Get a short-lived access token for applications running in AWS.
      tags:
        - authentication
  "/authn-jwt/{service_id}/{account}/authenticate":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        Use the JWT Authenticator to leverage the identity layer
        provided by JWT to authenticate with Conjur.
      operationId: getAccessTokenViaJWT
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - $ref: "#/components/parameters/ServiceID"
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              example:
                jwt: eyJhbGciOiJSUzI1NiIs......uTonCA
              properties:
                jwt:
                  type: string
              type: object
        description: ID token
        required: true
      responses:
        "200":
          $ref: "#/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/responses/200"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "500":
          $ref: "#/components/responses/InternalServerError"
      security: []
      summary: |
        Gets a short-lived access token for applications using JSON Web Token (JWT)
        to access the Conjur API.
      tags:
        - authentication
  "/authn-jwt/{service_id}/{account}/{id}/authenticate":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        Use the JWT Authenticator to leverage the identity layer
        provided by JWT to authenticate with Conjur.
      operationId: getAccessTokenViaJWTWithId
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: Organization user id
          in: path
          name: id
          required: true
          schema:
            description: Represents the user/host identity
            example: SomeUserID
            minLength: 1
            type: string
        - $ref: "#/components/parameters/ServiceID"
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/paths/~1authn-jwt~1%7Bservice_id%7D~1%7Baccount%7D~1authenticate/post/requestBody/content/application~1x-www-form-urlencoded/schema"
        description: ID token
        required: true
      responses:
        "200":
          $ref: "#/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/responses/200"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "500":
          $ref: "#/components/responses/InternalServerError"
      security: []
      summary: |
        Gets a short-lived access token for applications using JSON Web Token (JWT)
        to access the Conjur API. Covers the case of use of optional URL parameter "ID"
      tags:
        - authentication
  "/authn-k8s/{service_id}/inject_client_cert":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        This request sends a Certificate Signing Request to Conjur,
        which uses the Kubernetes API to inject a client certificate into the
        application pod.

        This endpoint requires a properly configured Conjur Certificate Authority
        service alongside a properly configured and enabled Kubernetes authenticator.
        For detailed instructions,
        see [the documentation](https://docs.conjur.org/Latest/en/Content/Integrations/kubernetes.htm).
      operationId: k8sInjectClientCert
      parameters:
        - $ref: "#/components/parameters/ServiceID"
        - description: Dot-separated policy tree, prefixed by `host.`, where the application identity is defined
          example: host/conjur/authn-k8s/my-authenticator-id/apps
          in: header
          name: Host-Id-Prefix
          schema:
            type: string
      requestBody:
        content:
          text/plain:
            schema:
              type: string
        description: |
          Valid certificate signing request that includes the host
          identity suffix as the CSR common name
        required: true
      responses:
        "202":
          description: The injected certificate was accepted.
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
      summary: |
        For applications running in Kubernetes; sends Conjur a certificate
        signing request (CSR) and requests a client certificate injected into
        the application's Kubernetes pod.
      tags:
        - authentication
  "/authn-k8s/{service_id}/{account}/{login}/authenticate":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        The access token is used to communicate to the REST API that
        the bearer of the token has been authorized to access the API and perform
        specific actions specified by the scope that was granted during authorization.

        For API usage, the base64-encoded access token is ordinarily passed as an HTTP
        Authorization header as `Authorization: Token token=<base64-encoded token>`.

        The `login` must be URL encoded and the host ID must have the prefix
        `host/`. For example, the host webserver would login as `host/webserver`,
        and would be encoded as `host%2Fwebserver`.

        The `service_id`, if given, must be URL encoded. For example,
        `prod/gke` must be encoded as `prod%2Fgke`.

        To authenticate to Conjur using this endpoint, reference the detailed
        documentation: [Kubernetes Authenticator](https://docs.conjur.org/Latest/en/Content/Operations/Services/k8s_auth.htm) (`authn-k8s`).
      operationId: getAccessTokenViaKubernetes
      parameters:
        - $ref: "#/components/parameters/ServiceID"
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: URL-encoded login name. For users, it’s the user ID. For hosts, the login name is `host/<host-id>`
          in: path
          name: login
          required: true
          schema:
            $ref: "#/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/parameters/1/schema"
        - description: Setting the Accept-Encoding header to base64 will return a pre-encoded access token
          in: header
          name: Accept-Encoding
          schema:
            default: application/json
            enum:
              - application/json
              - base64
            type: string
      responses:
        "200":
          $ref: "#/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/responses/200"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "500":
          $ref: "#/components/responses/InternalServerError"
      security:
        - conjurKubernetesMutualTls: []
      summary: Gets a short-lived access token for applications running in Kubernetes.
      tags:
        - authentication
  "/authn-ldap/{service_id}/{account}/login":
    get:
      description: |
        Exchange your LDAP credentials for a Conjur API key. Once the
        API key is obtained, it may be used to inexpensively obtain access
        tokens by calling the Authenticate method. An access token
        is required to use most other parts of the Conjur API.

        The Basic authentication-compliant header is formed by:
        1. Concatenating the LDAP username, a literal colon character ':',
           and the password to create the authentication string.
        2. Base64-encoding the authentication string.
        3. Prefixing the authentication string with the scheme: `Basic `
           (note the required space).
        4. Providing the result as the value of the `Authorization` HTTP header:
           `Authorization: Basic <authentication string>`.

        Your HTTP/REST client probably provides HTTP basic authentication support.
      operationId: getAPIKeyViaLDAP
      parameters:
        - $ref: "#/components/parameters/ServiceID"
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
      responses:
        "200":
          $ref: "#/paths/~1authn~1%7Baccount%7D~1login/get/responses/200"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
        "500":
          $ref: "#/components/responses/InternalServerError"
      security:
        - basicAuth: []
      summary: |
        Gets the Conjur API key of a user given the LDAP username and
        password via HTTP Basic Authentication.
      tags:
        - authentication
    parameters:
      - $ref: "#/components/parameters/RequestID"
  "/authn-ldap/{service_id}/{account}/{login}/authenticate":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        The access token is used to communicate to the REST API that
        the bearer of the token has been authorized to access the API and perform
        specific actions specified by the scope that was granted during authorization.

        For API usage, the base64-encoded access token is ordinarily passed as an HTTP
        Authorization header as `Authorization: Token token=<base64-encoded token>`.

        The `login` must be URL encoded. For example, `alice@devops` must be
        encoded as `alice%40devops`.

        The `service_id`, if given, must be URL encoded. For example,
        `prod/gke` must be encoded as `prod%2Fgke`.

        For host authentication, the `login` is the host ID with the prefix
        `host/`. For example, the host webserver would login as `host/webserver`,
        and would be encoded as `host%2Fwebserver`.

        To authenticate to Conjur using a LDAP, reference the detailed documentation:
        [LDAP Authenticator](https://docs.conjur.org/Latest/en/Content/Integrations/ldap/ldap_authenticator.html) (`authn-ldap`).
      operationId: getAccessTokenViaLDAP
      parameters:
        - $ref: "#/components/parameters/ServiceID"
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: URL-encoded login name. For users, it’s the user ID. For hosts, the login name is `host/<host-id>`
          in: path
          name: login
          required: true
          schema:
            $ref: "#/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/parameters/1/schema"
        - description: Setting the Accept-Encoding header to base64 will return a pre-encoded access token
          in: header
          name: Accept-Encoding
          schema:
            default: application/json
            enum:
              - application/json
              - base64
            type: string
      requestBody:
        content:
          text/plain:
            schema:
              $ref: "#/paths/~1authn~1%7Baccount%7D~1login/get/responses/200/content/text~1plain/schema"
        description: API key
        required: false
      responses:
        "200":
          $ref: "#/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/responses/200"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "500":
          $ref: "#/components/responses/InternalServerError"
      security: []
      summary: |
        Gets a short-lived access token for users and hosts using their
        LDAP identity to access the Conjur API.
      tags:
        - authentication
  "/authn-oidc/{service_id}/{account}/authenticate":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        Use the OIDC Authenticator to leverage the identity layer
        provided by OIDC to authenticate with Conjur.

        For more information see [the documentation](https://docs.conjur.org/Latest/en/Content/OIDC/OIDC.htm).
      operationId: getAccessTokenViaOIDC
      parameters:
        - $ref: "#/components/parameters/ServiceID"
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              description: OpenID Connect ID token
              example:
                id_token: eyJhbGciOiJSUzI1NiIs......uTonCA
              properties:
                id_token:
                  type: string
              type: object
        description: ID token
        required: true
      responses:
        "200":
          $ref: "#/paths/~1authn~1%7Baccount%7D~1%7Blogin%7D~1authenticate/post/responses/200"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
      security: []
      summary: |
        Gets a short-lived access token for applications using OpenID
        Connect (OIDC) to access the Conjur API.
      tags:
        - authentication
  "/authn/{account}/api_key":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    put:
      description: |
        Any role can rotate its own API key. The name and password
        (for users) or current API key (for hosts and users) of the role must
        be provided via HTTP Basic Authorization.

        To rotate another role's API key, you may provide your name and password
        (for users) or current API key (for hosts and users) via HTTP Basic
        Authorization with the request. Alternatively, you may provide your
        Conjur access token via the standard Conjur `Authorization` header.

        The Basic authentication-compliant header is formed by:
        1. Concatenating the role's name, a literal colon character ':',
           and the password or API key to create the authentication string.
        2. Base64-encoding the authentication string.
        3. Prefixing the authentication string with the scheme: `Basic `
           (note the required space).
        4. Providing the result as the value of the `Authorization` HTTP header:
           `Authorization: Basic <authentication string>`.

        Your HTTP/REST client probably provides HTTP basic authentication support.
        For example, `curl` and all of the Conjur client libraries provide this.

        If using the Conjur `Authorization` header, its value should be set to
        `Token token=<base64-encoded access token>`.

        Note that the body of the request must be the empty string.
      operationId: rotateApiKey
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: |
            (**Optional**) role specifier in `{kind}:{identifier}` format

            ##### Permissions required

            `update` privilege on the role whose API key is being rotated.
          in: query
          name: role
          schema:
            $ref: "#/components/schemas/RoleType"
      responses:
        "200":
          $ref: "#/paths/~1authn~1%7Baccount%7D~1login/get/responses/200"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
        "500":
          $ref: "#/components/responses/InternalServerError"
      security:
        - basicAuth: []
          conjurAuth: []
      summary: Rotates a role's API key.
      tags:
        - authentication
  "/authn/{account}/login":
    get:
      description: |
        Passwords are stored in the Conjur database using `bcrypt`
        with a work factor of 12. Therefore, login is a fairly expensive operation.
        However, once the API key is obtained, it may be used to inexpensively
        obtain access tokens by calling the Authenticate method. An access token
        is required to use most other parts of the Conjur API.

        The Basic authentication-compliant header is formed by:
        1. Concatenating the role's name, a literal colon character ':',
           and the password or API key to create the authentication string.
        2. Base64-encoding the authentication string.
        3. Prefixing the authentication string with the scheme: `Basic `
           (note the required space).
        4. Providing the result as the value of the `Authorization` HTTP header:
           `Authorization: Basic <authentication string>`.

        Your HTTP/REST client probably provides HTTP basic authentication support.
        For example, `curl` and all of the Conjur client libraries provide this.

        Note that machine roles (Hosts) do not have passwords and do not need to
        use this endpoint.
      operationId: getAPIKey
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
      responses:
        "200":
          content:
            text/plain:
              schema:
                description: Example of a Conjur API key
                example: 14m9cf91wfsesv1kkhevg12cdywm2wvqy6s8sk53z1ngtazp1t9tykc
                minLength: 55
                type: string
          description: The response body is the API key
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
        "500":
          $ref: "#/components/responses/InternalServerError"
      security:
        - basicAuth: []
      summary: |
        Gets the API key of a user given the username and password
        via HTTP Basic Authentication.
      tags:
        - authentication
    parameters:
      - $ref: "#/components/parameters/RequestID"
  "/authn/{account}/password":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    put:
      description: |
        You must provide the login name and current password or
        API key of the user whose password is to be updated in an HTTP Basic
        Authentication header. Also replaces the user’s API key with a new
        securely generated random value. You can fetch the new API key using
        the Login method.

        The Basic authentication-compliant header is formed by:
        1. Concatenating the role's name, a literal colon character ':',
           and the password or API key to create the authentication string.
        2. Base64-encoding the authentication string.
        3. Prefixing the authentication string with the scheme: `Basic `
           (note the required space).
        4. Providing the result as the value of the `Authorization` HTTP header:
           `Authorization: Basic <authentication string>`.

        Your HTTP/REST client probably provides HTTP basic authentication
        support. For example, `curl` and all of the Conjur client libraries
        provide this.

        Note that machine roles (Hosts) do not have passwords. They authenticate
        using their API keys, while passwords are only used by human users.
      operationId: changePassword
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
      requestBody:
        content:
          text/plain:
            schema:
              format: password
              minLength: 1
              type: string
        description: New password
        required: true
      responses:
        "204":
          description: The password has been changed
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
        "500":
          $ref: "#/components/responses/InternalServerError"
      security:
        - basicAuth: []
      summary: Changes a user’s password.
      tags:
        - authentication
  "/authn/{account}/{login}/authenticate":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        A client can obtain an access token by presenting a valid
        login name and API key.

        The access token is used to communicate to the REST API that the bearer
        of the token has been authorized to access the API and perform specific
        actions specified by the scope that was granted during authorization.

        The `login` must be URL encoded. For example, `alice@devops` must be
        encoded as `alice%40devops`.

        The `service_id`, if given, must be URL encoded. For example,
        `prod/gke` must be encoded as `prod%2Fgke`.

        For host authentication, the `login` is the host ID with the prefix
        `host/`. For example, the host webserver would login as `host/webserver`,
        and would be encoded as `host%2Fwebserver`.

        For API usage, the base64-encoded access token is ordinarily passed as an HTTP
        Authorization header as `Authorization: Token token=<base64-encoded token>`.

        This is the default authentication endpoint only. See other endpoints for
        details on authenticating to Conjur using another method, e.g. for
        applications running in Azure or Kubernetes.
      operationId: getAccessToken
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: URL-encoded login name. For users, it’s the user ID. For hosts, the login name is `host/<host-id>`
          in: path
          name: login
          required: true
          schema:
            example: admin
            minLength: 1
            type: string
        - description: Setting the Accept-Encoding header to base64 will return a pre-encoded access token
          in: header
          name: Accept-Encoding
          schema:
            default: application/json
            enum:
              - application/json
              - base64
            type: string
      requestBody:
        content:
          text/plain:
            schema:
              $ref: "#/paths/~1authn~1%7Baccount%7D~1login/get/responses/200/content/text~1plain/schema"
        description: API Key
        required: true
      responses:
        "200":
          content:
            text/plain:
              schema:
                type: string
          description: The response is an access token for conjur
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "500":
          $ref: "#/components/responses/InternalServerError"
      security: []
      summary: |
        Gets a short-lived access token, which is required in the header
        of most subsequent API requests.
      tags:
        - authentication
  "/ca/{account}/{service_id}/sign":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        Gets a signed certificate from the configured Certificate Authority service.

        The request must include a valid Certificate Signing Request, and a desired TTL in ISO 8601 format.

        *** IMPORTANT ***
        This endpoint is part of an early implementation of support for using Conjur as a certificate
        authority, and is currently available at the Community (or early alpha) level.
        This endpoint is still subject to breaking changes in the future.
      operationId: sign
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: Name of the Certificate Authority service
          in: path
          name: service_id
          required: true
          schema:
            example: ca-service
            minLength: 1
            type: string
        - description: Setting the Accept header to `application/x-pem-file` allows Conjur to respond with a formatted certificate
          in: header
          name: Accept
          schema:
            example: application/x-pem-file
            minLength: 1
            type: string
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              properties:
                csr:
                  type: string
                ttl:
                  type: string
              required:
                - csr
                - ttl
              type: object
        description: Client Certificate Signing Request
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                properties:
                  certificate:
                    type: string
                type: object
            application/x-pem-file:
              schema:
                format: base64
                type: string
          description: The response body is the newly signed certificate
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          description: |
            Either          
            - The authenticated role is not a Host role,
            - The authenticated Host does not have `sign` privilege for the CA service, or
            - The authenticated Host ID does not match the of the CSR Common Name (CN).
        "404":
          description: CA Service with the given ID does not exist
      security:
        - conjurAuth: []
      summary: Gets a signed certificate from the configured Certificate Authority service.
      tags:
        - certificate authority
  /health:
    get:
      description: |
        You can request health checks against any cluster node using the Conjur API.
        These routes do not require authentication.

        The health check attempts an internal HTTP or TCP connection to
        each Conjur Enterprise service. It also attempts a simple transaction against all internal databases.
      operationId: health
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
          description: The tests were successful
        "502":
          description: The tests failed
      summary: Health info about conjur
      tags:
        - status
      x-conjur-settings:
        enterprise-only: true
    x-conjur-settings:
      enterprise-only: true
  /host_factories/hosts:
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        Creates a Host using the Host Factory and returns a JSON description of it.

        Requires a host factory token, which can be created using the create tokens API.
        In practice, this token is usually provided automatically as part of Conjur integration with your
        host provisioning infrastructure.

        Note: If the token was created with a CIDR restriction, you must make this API request from a whitelisted address.
      operationId: createHost
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              example:
                id: new-host
              properties:
                annotations:
                  description: Annotations to apply to the new host
                  example:
                    description: new db host
                    puppet: "true"
                  type: object
                id:
                  description: Identifier of the host to be created. It will be created within the account of the host factory.
                  example: my-new-host
                  type: string
              required:
                - id
              type: object
        description: Parameters
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                description: Contains information about a created host
                example:
                  annotations: []
                  api_key: rq5bk73nwjnm52zdj87993ezmvx3m75k3whwxszekvmnwdqek0r
                  created_at: 2017-08-07T22:30:00.145+00:00
                  id: myorg:host:brand-new-host
                  owner: myorg:host_factory:hf-db
                  permissions: []
                properties:
                  annotations:
                    items:
                      type: string
                    type: array
                  api_key:
                    type: string
                  created_at:
                    type: string
                  id:
                    type: string
                  owner:
                    type: string
                  permissions:
                    items:
                      type: string
                    type: array
                required:
                  - created_at
                  - id
                  - api_key
                  - owner
                  - permissions
                  - annotations
                type: object
          description: The response body contains the newly-created host
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Creates a Host using the Host Factory.
      tags:
        - host factory
  /host_factory_tokens:
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        Creates one or more tokens which can be used to bootstrap host identity. Responds with a JSON document containing the tokens and their restrictions.

        If the tokens are created with a CIDR restriction, Conjur will only accept them from the whitelisted IP ranges.

        ##### Permissions required
        #
        `execute` privilege on the Host Factory."
      operationId: createToken
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              example:
                expiration: 2017-08-04T22:27:20+00:00
                host_factory: myorg:hosty_factory:hf-db
              properties:
                cidr:
                  description: Number of host tokens to create
                  example:
                    - 127.0.0.1/32
                  items:
                    type: string
                  type: array
                count:
                  description: Number of host tokens to create
                  example: 2
                  type: integer
                expiration:
                  description: "`ISO 8601 datetime` denoting a requested expiration time."
                  example: 2017-08-04T22:27:20+00:00
                  type: string
                host_factory:
                  description: Fully qualified host factory ID
                  example: myorg:host_factory:hf-db
                  type: string
              required:
                - expiration
                - host_factory
              type: object
        description: Parameters
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                example:
                  - cidr:
                      - 127.0.0.1/32
                      - 127.0.0.2/32
                    expiration: 2017-08-04T22:27:20+00:00
                    token: 281s2ag1g8s7gd2ezf6td3d619b52t9gaak3w8rj0p38124n384sq7x
                  - cidr:
                      - 127.0.0.1/32
                      - 127.0.0.2/32
                    expiration: 2017-08-04T22:27:20+00:00
                    token: 2c0vfj61pmah3efbgpcz2x9vzcy1ycskfkyqy0kgk1fv014880f4
                items:
                  properties:
                    cidr:
                      items:
                        type: string
                      type: array
                    expiration:
                      type: string
                    token:
                      type: string
                  required:
                    - expiration
                    - cidr
                    - token
                  type: object
                type: array
          description: Zero or more tokens were created and delivered in the response body
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Creates one or more host identity tokens.
      tags:
        - host factory
  "/host_factory_tokens/{token}":
    delete:
      description: |
        Revokes a token, immediately disabling it.

        ##### Permissions required

        `update` privilege on the host factory."
      operationId: revokeToken
      parameters:
        - description: The host factory token to revoke
          in: path
          name: token
          required: true
          schema:
            example: 2c0vfj61pmah3efbgpcz2x9vzcy1ycskfkyqy0kgk1fv014880f4
            type: string
      responses:
        "204":
          description: Token was successfully revoked
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
      security:
        - conjurAuth: []
      summary: Revokes a token, immediately disabling it.
      tags:
        - host factory
    parameters:
      - $ref: "#/components/parameters/RequestID"
  /info:
    get:
      description: |
        Information about the Conjur Enterprise node which was queried against.

        Includes authenticator info, release/version info, configuration details,
        internal services, and role information.
      operationId: info
      responses:
        "200":
          content:
            application/json:
              schema:
                properties:
                  authenticators:
                    properties:
                      configured:
                        items:
                          type: string
                        type: array
                      enabled:
                        items:
                          type: string
                        type: array
                      installed:
                        items:
                          type: string
                        type: array
                    type: object
                  configuration:
                    type: object
                  container:
                    type: string
                  release:
                    type: string
                  role:
                    type: string
                  services:
                    type: object
                  version:
                    type: string
                type: object
          description: info
      summary: Basic information about the Conjur Enterprise server
      tags:
        - status
      x-conjur-settings:
        enterprise-only: true
    x-conjur-settings:
      enterprise-only: true
  "/policies/{account}/policy/{identifier}":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    patch:
      description: |
        Modifies an existing Conjur policy. Data may be explicitly deleted using
        the `!delete`, `!revoke`, and `!deny` statements. Unlike `replace` mode,
        no data is ever implicitly deleted.

        ##### Permissions required
      operationId: updatePolicy
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: ID of the policy to update
          example: root
          in: path
          name: identifier
          required: true
          schema:
            $ref: "#/components/schemas/ResourceID"
      requestBody:
        content:
          application/x-yaml:
            schema:
              $ref: "#/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema"
          text/plain:
            schema:
              $ref: "#/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema"
          text/x-yaml:
            schema:
              $ref: "#/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema"
          text/yaml:
            schema:
              $ref: "#/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema"
        description: Policy
        required: true
      responses:
        "201":
          $ref: "#/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/responses/201"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "409":
          $ref: "#/components/responses/Busy"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Modifies an existing Conjur policy.
      tags:
        - policies
    post:
      description: |
        Adds data to the existing Conjur policy. Deletions are not allowed.
        Any policy objects that exist on the server but are omitted from the
        policy file will not be deleted and any explicit deletions in the policy file will result in an error.

        ##### Permissions required

        `create` privilege on the policy."
      operationId: loadPolicy
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: ID of the policy to update
          example: root
          in: path
          name: identifier
          required: true
          schema:
            $ref: "#/components/schemas/ResourceID"
      requestBody:
        content:
          application/x-yaml:
            schema:
              $ref: "#/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema"
          text/plain:
            schema:
              $ref: "#/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema"
          text/x-yaml:
            schema:
              $ref: "#/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema"
          text/yaml:
            schema:
              $ref: "#/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema"
        description: Policy
        required: true
      responses:
        "201":
          $ref: "#/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/responses/201"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "409":
          $ref: "#/components/responses/Busy"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Adds data to the existing Conjur policy.
      tags:
        - policies
    put:
      description: |
        Loads or replaces a Conjur policy document.

        **Any policy data which already exists on the server but is not
        explicitly specified in the new policy file will be deleted!**.
      operationId: replacePolicy
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: ID of the policy to load (root if no root policy has been loaded yet)
          example: root
          in: path
          name: identifier
          required: true
          schema:
            $ref: "#/components/schemas/ResourceID"
      requestBody:
        content:
          application/x-yaml:
            schema:
              $ref: "#/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema"
          text/plain:
            schema:
              $ref: "#/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema"
          text/x-yaml:
            schema:
              $ref: "#/paths/~1policies~1%7Baccount%7D~1policy~1%7Bidentifier%7D/put/requestBody/content/text~1yaml/schema"
          text/yaml:
            schema:
              example: |
                - !policy
                  id: database
                  body:
                  - !host
                    id: db-host
                  - !variable
                    id: db-password
                    owner: !host db-host
              minLength: 1
              type: string
        description: Policy
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                example:
                  created_roles:
                    myorg:host:database/db-host:
                      api_key: 309yzpa1n5kp932waxw6d37x4hew2x8ve8w11m8xn92acfy672m929en
                      id: myorg:host:database/db-host
                  version: 1
                properties:
                  created_roles:
                    type: object
                  version:
                    type: number
                type: object
          description: Decsribes new data created by a successful policy load
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "409":
          $ref: "#/components/responses/Busy"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Loads or replaces a Conjur policy document.
      tags:
        - policies
  "/public_keys/{account}/{kind}/{identifier}":
    get:
      description: |
        Shows all public keys for a resource as newline delimited string for compatibility with the authorized_keys SSH format.
        Returns an empty string if the resource does not exist, to prevent attackers from determining whether a resource exists.
      operationId: showPublicKeys
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: Type of resource
          example: user
          in: path
          name: kind
          required: true
          schema:
            $ref: "#/components/schemas/Kind"
        - description: ID of the resource for which to get the information about
          example: admin
          in: path
          name: identifier
          required: true
          schema:
            $ref: "#/components/schemas/ResourceID"
      responses:
        "200":
          content:
            text/plain:
              example: |
                ssh-rsa AAAAB3Nzabc2 admin@alice.com

                ssh-rsa AAAAB3Nza3nx alice@example.com
              schema:
                type: string
          description: Public keys for a resource as newline delimited string for compatibility with the authorized_keys SSH format. Empty string if the resource does not exist
        "400":
          $ref: "#/components/responses/BadRequest"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
        "500":
          $ref: "#/components/responses/InternalServerError"
      summary: Shows all public keys for a resource.
      tags:
        - public keys
    parameters:
      - $ref: "#/components/parameters/RequestID"
  "/remote_health/{remote}":
    get:
      description: |
        Use the remote_health route to check the health of any Conjur Enterprise Server from any other Conjur Enterprise Server.
        With this route, you can check master health relative to a follower, or follower health relative
        to a standby, and so on.
      operationId: remoteHealth
      parameters:
        - description: The hostname of the remote to check
          example: conjur.myorg.com
          in: path
          name: remote
          required: true
          schema:
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
          description: The tests were successful
        "502":
          description: The tests failed
      summary: Health info about a given Conjur Enterprise server
      tags:
        - status
      x-conjur-settings:
        enterprise-only: true
    x-conjur-settings:
      enterprise-only: true
  /resources:
    get:
      description: |
        Lists resources within an organization account.

        In the absence of an `account` query parameter, shows results for the account of the authorization token user.

        If an `account` query parameter is given, shows results for the specified account.

        If a `kind` query parameter is given, narrows results to only resources of that kind.

        If a `limit` is given, returns no more than that number of results. Providing an `offset`
        skips a number of resources before returning the rest. In addition, providing an `offset`
        will give `limit` a default value of 10 if none other is provided. These two parameters can
        be combined to page through results.

        If the parameter `count` is `true`, returns only the number of items in the list.

        ##### Text search

        If the `search` parameter is provided, narrows results to those pertaining to the search query.
        Search works across resource IDs and the values of annotations. It weighs results so that those
        with matching id or a matching value of an annotation called `name` appear first, then those with
        another matching annotation value, and finally those with a matching  `kind`."
      operationId: showResourcesForAllAccounts
      parameters:
        - description: Organization account name
          example: myorg
          in: query
          name: account
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: Type of resource
          example: user
          in: query
          name: kind
          schema:
            $ref: "#/components/schemas/Kind"
        - description: Filter resources based on this value by name
          example: db
          in: query
          name: search
          schema:
            description: Only returns results that contain this string value
            example: password
            minLength: 1
            type: string
        - description: When listing resources, start at this item number.
          in: query
          name: offset
          schema:
            $ref: "#/components/schemas/Offset"
        - description: When listing resources, return up to this many results.
          in: query
          name: limit
          schema:
            $ref: "#/components/schemas/Limit"
        - description: When listing resources, if `true`, return only the count of the results.
          in: query
          name: count
          schema:
            $ref: "#/components/schemas/Count"
        - description: Retrieves the resources list for a different role if the authenticated role has access
          example: myorg:host:host1
          in: query
          name: role
          schema:
            $ref: "#/components/schemas/RoleType"
        - description: Retrieves the resources list for a different role if the authenticated role has access
          example: myorg:host:host1
          in: query
          name: acting_as
          schema:
            $ref: "#/components/schemas/RoleType"
      responses:
        "200":
          content:
            application/json:
              schema:
                example:
                  - annotations: []
                    created_at: 2021-03-23T16:37:14.455+00:00
                    id: dev:policy:conjur/authn-ldap/test
                    owner: dev:user:admin
                    permissions: []
                    policy: dev:policy:root
                    policy_versions: []
                items:
                  example:
                    annotations: []
                    created_at: 2021-03-23T16:37:14.455+00:00
                    id: dev:policy:conjur/authn-ldap/test
                    owner: dev:user:admin
                    permissions: []
                    policy: dev:policy:root
                    policy_versions: []
                  properties:
                    annotations:
                      items:
                        type: string
                      type: array
                    created_at:
                      type: string
                    id:
                      type: string
                    owner:
                      type: string
                    permissions:
                      items:
                        properties:
                          policy:
                            type: string
                          privilege:
                            type: string
                          role:
                            type: string
                        type: object
                      type: array
                    policy:
                      type: string
                    policy_versions:
                      items:
                        example:
                          client_ip: 172.19.0.6
                          created_at: 2021-03-23T16:37:09.250+00:00
                          finished_at: 2021-03-23T16:37:09.435+00:00
                          id: dev:policy:root
                          policy_sha256: 73d7b43ab17d69d163dedfaac88ec02a9c18ed8675abe4fe5643cd33470baf86
                          policy_text: |
                            - !variable one/password
                            - !variable testSecret
                          role: dev:user:admin
                          version: 15
                        properties:
                          client_ip:
                            type: string
                          created_at:
                            type: string
                          finished_at:
                            type: string
                          id:
                            type: string
                          policy_sha256:
                            type: string
                          policy_text:
                            type: string
                          role:
                            type: string
                          version:
                            type: number
                        type: object
                      type: array
                    restricted_to:
                      items:
                        type: string
                      type: array
                    secrets:
                      items:
                        properties:
                          expires_at:
                            type: string
                          version:
                            type: number
                        type: object
                      type: array
                  type: object
                type: array
          description: The response body contains a list of resources
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Lists resources within an organization account.
      tags:
        - resources
    parameters:
      - $ref: "#/components/parameters/RequestID"
  "/resources/{account}":
    get:
      description: |
        Lists resources within an organization account.

        If a `kind` query parameter is given, narrows results to only resources of that kind.

        If a `limit` is given, returns no more than that number of results. Providing an `offset`
        skips a number of resources before returning the rest. In addition, providing an `offset`
        will give `limit` a default value of 10 if none other is provided. These two parameters
        can be combined to page through results.

        If the parameter `count` is `true`, returns only the number of items in the list.

        ##### Text search

        If the `search` parameter is provided, narrows results to those pertaining to the search query.
        Search works across resource IDs and the values of annotations. It weighs results so that those
        with matching id or a matching value of an annotation called `name` appear first, then those with
        another matching annotation value, and finally those with a matching  `kind`.
      operationId: showResourcesForAccount
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: Type of resource
          example: user
          in: query
          name: kind
          schema:
            $ref: "#/components/schemas/Kind"
        - description: Filter resources based on this value by name
          example: db
          in: query
          name: search
          schema:
            $ref: "#/paths/~1resources/get/parameters/2/schema"
        - description: When listing resources, start at this item number.
          in: query
          name: offset
          schema:
            $ref: "#/components/schemas/Offset"
        - description: When listing resources, return up to this many results.
          in: query
          name: limit
          schema:
            $ref: "#/components/schemas/Limit"
        - description: When listing resources, if `true`, return only the count of the results.
          in: query
          name: count
          schema:
            $ref: "#/components/schemas/Count"
        - description: Retrieves the resources list for a different role if the authenticated role has access
          example: myorg:host:host1
          in: query
          name: role
          schema:
            $ref: "#/components/schemas/RoleType"
        - description: Retrieves the resources list for a different role if the authenticated role has access
          example: myorg:host:host1
          in: query
          name: acting_as
          schema:
            $ref: "#/components/schemas/RoleType"
      responses:
        "200":
          $ref: "#/paths/~1resources/get/responses/200"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Lists resources within an organization account.
      tags:
        - resources
    parameters:
      - $ref: "#/components/parameters/RequestID"
  "/resources/{account}/{kind}":
    get:
      description: |
        Lists resources of the same kind within an organization account.

        Kinds of resources include: policy, user, host, group, layer, or variable

        If a `limit` is given, returns no more than that number of results.
        Providing an `offset` skips a number of resources before returning the rest.
        In addition, providing an `offset` will give `limit` a default value of 10 if
        none other is provided. These two parameters can be combined to page through results.

        If the parameter `count` is `true`, returns only the number of items in the list.

        ##### Text search

        If the `search` parameter is provided, narrows results to those pertaining to the search query.
        Search works across resource IDs and the values of annotations. It weighs results so that those
        with matching id or a matching value of an annotation called `name` appear first, then those with
        another matching annotation value, and finally those with a matching  `kind`.
      operationId: showResourcesForKind
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: Type of resource
          example: user
          in: path
          name: kind
          required: true
          schema:
            $ref: "#/components/schemas/Kind"
        - description: Filter resources based on this value by name
          example: db
          in: query
          name: search
          schema:
            $ref: "#/paths/~1resources/get/parameters/2/schema"
        - description: When listing resources, start at this item number.
          in: query
          name: offset
          schema:
            $ref: "#/components/schemas/Offset"
        - description: When listing resources, return up to this many results.
          in: query
          name: limit
          schema:
            $ref: "#/components/schemas/Limit"
        - description: When listing resources, if `true`, return only the count of the results.
          in: query
          name: count
          schema:
            $ref: "#/components/schemas/Count"
        - description: Retrieves the resources list for a different role if the authenticated role has access
          example: myorg:host:host1
          in: query
          name: role
          schema:
            $ref: "#/components/schemas/RoleType"
        - description: Retrieves the resources list for a different role if the authenticated role has access
          example: myorg:host:host1
          in: query
          name: acting_as
          schema:
            $ref: "#/components/schemas/RoleType"
      responses:
        "200":
          $ref: "#/paths/~1resources/get/responses/200"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Lists resources of the same kind within an organization account.
      tags:
        - resources
    parameters:
      - $ref: "#/components/parameters/RequestID"
  "/resources/{account}/{kind}/{identifier}":
    get:
      description: |
        Details about a single resource.

        If `permitted_roles` and `privilege` are given, Conjur lists the
        roles with the specified privilege on the resource.

        If `check`, `privilege` and `role` are given, Conjur checks if the
        specified role has the privilege on the resource.

        If `permitted_roles` and `check` are both given, Conjur responds to the `check` call ONLY.

        ##### Permissions Required
      operationId: showResource
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: Type of resource
          example: user
          in: path
          name: kind
          required: true
          schema:
            $ref: "#/components/schemas/Kind"
        - description: ID of the resource for which to get the information about
          example: conjur/authn-iam/test
          in: path
          name: identifier
          required: true
          schema:
            $ref: "#/components/schemas/ResourceID"
        - description: Lists the roles which have the named privilege on a resource.
          in: query
          name: permitted_roles
          schema:
            example: true
            type: boolean
        - description: Level of privilege to filter on. Can only be used in combination with `permitted_roles` or `check` parameter.
          in: query
          name: privilege
          schema:
            description: Denotes a type of permission allowed on a resource
            example: execute
            minLength: 1
            type: string
        - description: Check whether a role has a privilege on a resource.
          in: query
          name: check
          schema:
            description: Checks whether a role has a privilege on a resource.
            example: true
            type: boolean
        - description: Role to check privilege on. Can only be used in combination with `check` parameter.
          example: myorg:host:host1
          in: query
          name: role
          schema:
            $ref: "#/components/schemas/RoleType"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/paths/~1resources/get/responses/200/content/application~1json/schema/items"
          description: The response body contains the list of role memberships or permitted roles
        "204":
          description: Permissions check was successful
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Shows a description of a single resource.
      tags:
        - resources
    parameters:
      - $ref: "#/components/parameters/RequestID"
  "/roles/{account}/{kind}/{identifier}":
    delete:
      description: |
        Deletes an existing role membership.

        If a role A is granted to a role B, then role A is said to have role B as a member.
        These relationships are described in the “members” portion of the returned JSON.

        When the `members` query parameter is provided, you will get the members of a role.

        When the `members` and `member` query parameters are provided, the role specfified by
        `member` will be removed as a member of the role specified in the endpoint URI.
      operationId: removeMemberFromRole
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: Type of resource
          example: user
          in: path
          name: kind
          required: true
          schema:
            $ref: "#/components/schemas/Kind"
        - description: ID of the role for which to get the information about
          example: admin
          in: path
          name: identifier
          required: true
          schema:
            $ref: "#/components/schemas/ResourceID"
        - description: Returns a list of the Role's members.
          in: query
          name: members
          required: true
          schema:
            type: string
        - description: The identifier of the Role to be added as a member.
          in: query
          name: member
          required: true
          schema:
            $ref: "#/components/schemas/RoleType"
      responses:
        "204":
          description: Member was deleted from role successfully
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Deletes an existing role membership
      tags:
        - roles
    get:
      description: |
        Gets detailed information about a specific role, including the role members.

        If a role A is granted to a role B, then role A is said to have role B as a member.
        These relationships are described in the “members” portion of the returned JSON.

        ##### Listing members

        If `members` is provided, you will get the members of a role.

        If a `kind` query parameter is given, narrows results to only resources of that kind.

        If a `limit` is given, returns no more than that number of results. Providing an `offset`
        skips a number of resources before returning the rest. In addition, providing an `offset`
        will give limit a default value of 10 if none other is provided. These two parameters
        can be combined to page through results.

        If the parameter `count` is true, returns only the number of items in the list.

        ##### Text search

        If the search parameter is provided, narrows results to those pertaining to the search query.
        Search works across resource IDs and the values of annotations. It weights results so that
        those with matching id or a matching value of an annotation called name appear first, then
        those with another matching annotation value, and finally those with a matching kind.

        ##### Parameter Priority

        If Conjur is given any combination of optional parameters, it responds with ONLY results
        for the parameter of the highest priority.

        1. `graph`
        2. `all`
        3. `memberships`
        4. `members`
      operationId: showRole
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: Type of resource
          example: user
          in: path
          name: kind
          required: true
          schema:
            $ref: "#/components/schemas/Kind"
        - description: ID of the role for which to get the information about
          example: admin
          in: path
          name: identifier
          required: true
          schema:
            $ref: "#/components/schemas/ResourceID"
        - description: Returns an array of Role IDs representing all role memberships, expanded recursively.
          in: query
          name: all
          schema:
            type: string
        - description: Returns all direct role memberships (members not expanded recursively).
          in: query
          name: memberships
          schema:
            type: string
        - description: Returns a list of the Role's members.
          in: query
          name: members
          schema:
            type: string
        - description: When listing members, start at this item number.
          in: query
          name: offset
          schema:
            $ref: "#/components/schemas/Offset"
        - description: When listing members, return up to this many results.
          in: query
          name: limit
          schema:
            $ref: "#/components/schemas/Limit"
        - description: When listing members, if `true`, return only the count of members.
          in: query
          name: count
          schema:
            $ref: "#/components/schemas/Count"
        - description: When listing members, the results will be narrowed to only those matching the provided string
          in: query
          name: search
          schema:
            example: user
            minLength: 1
            type: string
        - description: If included in the query returns a graph view of the role
          in: query
          name: graph
          schema:
            example: ""
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                example:
                  created_at: 2020-12-31:12:34:56.789+00:00
                  id: myorg:user:admin
                  members: []
                type: object
          description: The response body contains the requested role(s)/member(s)
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Get role information
      tags:
        - roles
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        Updates or modifies an existing role membership.

        If a role A is granted to a role B, then role A is said to have role B as a member.
        These relationships are described in the “members” portion of the returned JSON.

        When the `members` query parameter is provided, you will get the members of a role.

        When the `members` and `member` query parameters are provided, the role specfified by
        `member` will be added as a member of the role specified in the endpoint URI.
      operationId: addMemberToRole
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: Type of resource
          example: user
          in: path
          name: kind
          required: true
          schema:
            $ref: "#/components/schemas/Kind"
        - description: ID of the role for which to get the information about
          example: admin
          in: path
          name: identifier
          required: true
          schema:
            $ref: "#/components/schemas/ResourceID"
        - description: Returns a list of the Role's members.
          in: query
          name: members
          required: true
          schema:
            type: string
        - description: The identifier of the Role to be added as a member.
          in: query
          name: member
          required: true
          schema:
            $ref: "#/components/schemas/RoleType"
      responses:
        "204":
          description: Member was added to role successfully
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Update or modify an existing role membership
      tags:
        - roles
  /secrets:
    get:
      description: Fetches multiple secret values in one invocation. It’s faster to fetch secrets in batches than to fetch them one at a time.
      operationId: getSecrets
      parameters:
        - description: Comma-delimited, URL-encoded resource IDs of the variables.
          in: query
          name: variable_ids
          required: true
          schema:
            description: |
              Comma-delimited, URL-encoded resource identifiers.

              ##### Resources IDs encoding:

              - `myapp-01` -> `myapp-01` (unchanged)
              - `alice@devops` -> `alice%40devops`
              - `prod/aws/db-password` -> `prod%2Faws%2Fdb-password`
              - `research+development` -> `research%2Bdevelopment`
              - `sales&marketing` -> `sales%26marketing`
            example: myorg:variable:secret1,myorg:variable:secret1
            type: string
        - description: Set the encoding of the response object
          in: header
          name: Accept-Encoding
          schema:
            enum:
              - base64
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                example:
                  myorg:variable:secret1: secret1Value
                  myorg:variable:secret2: secret2Value
                type: object
          description: The batch secret values
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "404":
          $ref: "#/components/responses/ResourcesNotFound"
        "406":
          content:
            application/json:
              schema:
                type: object
          description: Issue encoding secret into JSON format
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Fetch multiple secrets
      tags:
        - secrets
    parameters:
      - $ref: "#/components/parameters/RequestID"
  "/secrets/{account}/{kind}/{identifier}":
    get:
      description: |
        Fetches the value of a secret from the specified Secret. The latest version
        will be retrieved unless the version parameter is specified. The twenty most recent secret versions are retained.

        The secret data is returned in the response body.

        Note: Conjur will allow you to add a secret to any resource, but the best practice is to store
        and retrieve secret data only using Secret resources.
      operationId: getSecret
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: Type of resource - in almost all cases this should be `variable`
          in: path
          name: kind
          required: true
          schema:
            $ref: "#/components/schemas/Kind"
        - description: URL-encoded variable ID
          in: path
          name: identifier
          required: true
          schema:
            $ref: "#/components/schemas/ResourceID"
        - description: (**Optional**) Version you want to retrieve (Conjur keeps the last 20 versions of a secret)
          in: query
          name: version
          schema:
            $ref: "#/components/schemas/ResourceVersion"
      responses:
        "200":
          content:
            text/plain:
              schema:
                example: supersecret
                type: string
          description: The secret value was added successfully
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Fetches the value of a secret from the specified Secret.
      tags:
        - secrets
    parameters:
      - $ref: "#/components/parameters/RequestID"
    post:
      description: |
        Creates a secret value within the specified Secret.


        Note: Conjur will allow you to add a secret to any resource, but the
        best practice is to store and retrieve secret data only using Secret resources.
      operationId: createSecret
      parameters:
        - description: Organization account name
          in: path
          name: account
          required: true
          schema:
            $ref: "#/components/schemas/AccountName"
        - description: Type of resource - in almost all cases this should be `variable`
          in: path
          name: kind
          required: true
          schema:
            $ref: "#/components/schemas/Kind"
        - description: URL-encoded variable ID
          in: path
          name: identifier
          required: true
          schema:
            $ref: "#/components/schemas/ResourceID"
        - description: Tells the server to reset the variables expiration date
          in: query
          name: expirations
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/octet-stream:
            schema:
              type: string
        description: Secret data
        required: false
      responses:
        "201":
          description: The secret value was added successfully
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "422":
          $ref: "#/components/responses/UnprocessableEntity"
      security:
        - conjurAuth: []
      summary: Creates a secret value within the specified variable.
      tags:
        - secrets
  /whoami:
    get:
      description: |
        WhoAmI provides information about the client making an API request.
        It can be used to help troubleshoot configuration by verifying authentication
        and the client IP address for audit and network access restrictions.
        For more information, see Host Attributes.
      operationId: whoAmI
      responses:
        "200":
          content:
            application/json:
              schema:
                description: Information about the client making a request
                properties:
                  account:
                    description: The account attribute of the client provided access token.
                    example: dev
                    type: string
                  client_ip:
                    description: The request client IP address as determined by Conjur. This same IP address appears in application logs and audit logs.
                    example: 127.0.0.1
                    type: string
                  token_issued_at:
                    description: The issued timestamp, that is, when the provided access token was created (iat field in the JWT)
                    example: 2017-08-04T22:27:20+00:00
                    type: string
                  user_agent:
                    description: The incoming request HTTP user agent header.
                    example: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
                    type: string
                  username:
                    description: The username attribute of the provided access token.
                    example: admin
                    type: string
                type: object
          description: Details about the client making the request
        "401":
          $ref: "#/components/responses/UnauthorizedError"
      security:
        - conjurAuth: []
      summary: Provides information about the client making an API request.
      tags:
        - status
    parameters:
      - $ref: "#/components/parameters/RequestID"
  "/{authenticator}/{account}":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    patch:
      description: |
        Allows you to either enable or disable a given authenticator that does not have service_id (For example: authn-gcp).

        When you enable or disable an authenticator via this
        endpoint, the status of the authenticator is stored
        in the Conjur database. The enablement status of the authenticator
        service may be overridden by setting the `CONJUR_AUTHENTICATORS`
        environment variable on the Conjur server; in the case where this
        environment variable is set, the database record of whether the
        authenticator service is enabled will be ignored.

        **This endpoint is part of an early implementation of support for enabling Conjur
        authenticators via the API, and is currently available at the Community
        (or early alpha) level. This endpoint is still subject to breaking
        changes in the future.**
      operationId: enableAuthenticator
      parameters:
        - description: The authenticator to update
          example: authn-gcp
          in: path
          name: authenticator
          required: true
          schema:
            enum:
              - authn-iam
              - authn-oidc
              - authn-ldap
              - authn-k8s
              - authn-gcp
              - authn-azure
              - authn-jwt
            type: string
        - description: Organization account name
          example: dev
          in: path
          name: account
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              properties:
                enabled:
                  type: boolean
              type: object
        description: |
          Contains either `enabled=true` or `enabled=false` to
          enable or disable an authenticator
        required: true
      responses:
        "204":
          description: The config was updated properly
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "500":
          $ref: "#/components/responses/InternalServerError"
      summary: Enables or disables authenticator defined without service_id.
      tags:
        - authentication
  "/{authenticator}/{service_id}/{account}":
    parameters:
      - $ref: "#/components/parameters/RequestID"
    patch:
      description: |
        Allows you to either enable or disable a given authenticator
        service instance.

        When you enable or disable an authenticator service instance via this
        endpoint, the status of the authenticator service instance is stored
        in the Conjur database. The enablement status of the authenticator
        service instance may be overridden by setting the `CONJUR_AUTHENTICATORS`
        environment variable on the Conjur server; in the case where this
        environment variable is set, the database record of whether the
        authenticator service instance is enabled will be ignored.

        **This endpoint is part of an early implementation of support for enabling Conjur
        authenticators via the API, and is currently available at the Community
        (or early alpha) level. This endpoint is still subject to breaking
        changes in the future.**
      operationId: enableAuthenticatorInstance
      parameters:
        - description: The authenticator to update
          example: authn-oidc
          in: path
          name: authenticator
          required: true
          schema:
            $ref: "#/paths/~1%7Bauthenticator%7D~1%7Baccount%7D/patch/parameters/0/schema"
        - $ref: "#/components/parameters/ServiceID"
        - description: Organization account name
          example: dev
          in: path
          name: account
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/paths/~1%7Bauthenticator%7D~1%7Baccount%7D/patch/requestBody/content/application~1x-www-form-urlencoded/schema"
        description: |
          Contains either `enabled=true` or `enabled=false` to
          enable or disable an authenticator
        required: true
      responses:
        "204":
          description: The config was updated properly
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "404":
          $ref: "#/components/responses/ResourceNotFound"
        "500":
          $ref: "#/components/responses/InternalServerError"
      security:
        - conjurAuth: []
      summary: Enables or disables authenticator service instances.
      tags:
        - authentication
  "/{authenticator}/{service_id}/{account}/status":
    get:
      description: |
        Once the status webservice has been properly configured and the relevant user
        groups have been given permissions to access the status webservice, the
        users in those groups can check the status of the authenticator.

        Supported Authenticators:
          - Azure
          - OIDC

        Not Supported:
          - AWS IAM
          - Kubernetes
          - LDAP

        See [Conjur Documentation](https://docs.conjur.org/Latest/en/Content/Integrations/Authn-status.htm)
        for details on setting up the authenticator status webservice.
      operationId: getServiceAuthenticatorStatus
      parameters:
        - description: The type of authenticator
          example: authn-oidc
          in: path
          name: authenticator
          required: true
          schema:
            type: string
        - $ref: "#/components/parameters/ServiceID"
        - description: The organization account name
          example: dev
          in: path
          name: account
          required: true
          schema:
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                properties:
                  error:
                    description: The error message if there was an error
                    example: "#<Errors::Authentication::AuthenticatorNotFound: CONJ00001E Authenticator 'authn-oidc' is not implemented in Conjur>"
                    type: string
                  status:
                    description: The status of the endpoint, 'error' if there was an error
                    example: error
                    type: string
                required:
                  - status
                type: object
          description: The response contains info about the result
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/UnauthorizedError"
        "403":
          $ref: "#/components/responses/InadequatePrivileges"
        "404":
          description: The service was not found
        "500":
          $ref: "#/paths/~1%7Bauthenticator%7D~1%7Bservice_id%7D~1%7Baccount%7D~1status/get/responses/200"
        "501":
          $ref: "#/paths/~1%7Bauthenticator%7D~1%7Bservice_id%7D~1%7Baccount%7D~1status/get/responses/200"
      security:
        - conjurAuth: []
      summary: Details whether an authentication service has been configured properly
      tags:
        - status
    parameters:
      - $ref: "#/components/parameters/RequestID"
components:
  parameters:
    RequestID:
      description: |
        Add an ID to the request being made so it can be tracked in Conjur.
        If not provided the server will automatically generate one.
      example: test-id
      in: header
      name: X-Request-Id
      required: false
      schema:
        pattern: ^[a-zA-Z\d-]{1,255}$
        type: string
    ServiceID:
      description: URL-Encoded authenticator service ID
      example: prod%2fgke
      in: path
      name: service_id
      required: true
      schema:
        type: string
  responses:
    BadRequest:
      description: The server cannot process the request due to malformed request syntax
    Busy:
      description: Similar operation already in progress, retry after a delay
    InadequatePrivileges:
      description: The authenticated user lacks the necessary privileges
    InternalServerError:
      description: Malfromed request, rejected by the server
    ResourceNotFound:
      description: The requested resource does not exist, the authenticated user lacks the required privileges to enumerate this resource, or its value has not been set
    ResourcesNotFound:
      description: At least one resource was unable to be found
    UnauthorizedError:
      description: Authentication information is missing or invalid
    UnprocessableEntity:
      description: A request parameter was either missing or invalid.
  schemas:
    AccountName:
      description: Conjur account name
      example: default
      minLength: 1
      type: string
    Count:
      description: Return only the count of results
      example: true
      type: boolean
    Kind:
      example: variable
      minLength: 1
      type: string
    Limit:
      description: Return no more than this number of results
      example: 10
      type: integer
    Offset:
      description: Skips this many items before returning the rest
      example: 20
      type: integer
    ResourceID:
      description: |
        Resource identifier. Requires to be encoded when in path.

        ##### Examples:

        - `myapp-01` -> `myapp-01` (unchanged)
        - `alice@devops` -> `alice%40devops`
        - `prod/aws/db-password` -> `prod%2Faws%2Fdb-password`
        - `research+development` -> `research%2Bdevelopment`
        - `sales&marketing` -> `sales%26marketing`
      example: prod%2Faws%2Fdb-password
      minLength: 1
      type: string
    ResourceVersion:
      description: Version of the resource (Conjur keeps the last 20 versions of a secret)
      example: 1
      type: integer
    RoleType:
      description: |
        ##### Kinds of roles:

        - User: one unique wonderful human
        - Host: a single logical machine (in the broad sense, not just physical)
        - Layer: a collection of hosts that have the same privileges
        - Group: a collection of users and groups that have the same privileges
        - Policy: a role which owns of a set of related object

        Any identifier included in the URL must be URL-encoded to be recognized by the Conjur API.

        ##### Resource Identifiers:

        - `myapp-01` -> `myapp-01` (unchanged)
        - `alice@devops` -> `alice%40devops`
        - `prod/aws/db-password` -> `prod%2Faws%2Fdb-password`
        - `research+development` -> `research%2Bdevelopment`
        - `sales&marketing` -> `sales%26marketing`
      minLength: 1
      type: string
  securitySchemes:
    basicAuth:
      description: |
        Basic authentication with Conjur username and password (users only)
        or API key (hosts and users).
      scheme: basic
      type: http
    conjurAuth:
      description: Conjur access token in `Token token=<base64_encoded_token>` format.
      in: header
      name: Authorization
      type: apiKey
    conjurKubernetesMutualTls:
      description: |
        Conjur Kubernetes authenticator mutual TLS authentication.
        To authenticate using this method, you must provide a trusted client
        certificate
      scheme: mutual
      type: http
