diff --git a/skyflow-skills-plugin/README.md b/skyflow-skills-plugin/README.md index d304ebe..9891e80 100644 --- a/skyflow-skills-plugin/README.md +++ b/skyflow-skills-plugin/README.md @@ -51,7 +51,7 @@ The **create-vault** skill guides you through creating Skyflow vaults programmat **Slash command:** `/skyflow-skills:call-rest-apis` -The **call-rest-apis** skill provides expertise on Skyflow REST APIs including management APIs, data APIs, and detect APIs. It covers API endpoints, request/response formats, authentication methods, and code examples. The skill includes an API quick reference table, OpenAPI specifications for data, detect, and management APIs, authentication guidance for bearer tokens and service accounts, error handling patterns, rate limiting information, and links to SDK documentation. +The **call-rest-apis** skill provides expertise on Skyflow REST APIs including management APIs, data APIs, detect APIs, and the Flow Vault API. It covers API endpoints, request/response formats, authentication methods, and code examples. The skill includes an API quick reference table, OpenAPI specifications for data, detect, management, and Flow Vault APIs, authentication guidance for bearer tokens and service accounts, error handling patterns, rate limiting information, and links to SDK documentation. ### Migrate SDK V1 to V2 diff --git a/skyflow-skills-plugin/skills/call-rest-apis/CONTRIBUTING.md b/skyflow-skills-plugin/skills/call-rest-apis/CONTRIBUTING.md index 9b1e3be..c169474 100644 --- a/skyflow-skills-plugin/skills/call-rest-apis/CONTRIBUTING.md +++ b/skyflow-skills-plugin/skills/call-rest-apis/CONTRIBUTING.md @@ -9,8 +9,9 @@ Locate the OpenAPI spec for the API you're documenting: | API Guide | OpenAPI Spec | | ------------------- | ------------------------- | | `management-api.md` | `management.openapi.json` | -| `vault-api.md` | `data.openapi.json` | +| `data-api.md` | `data.openapi.json` | | `detect-api.md` | `detect.openapi.json` | +| `flow-vault-api.md` | `flow-vault.openapi.json` | ## 2. Find the Operation diff --git a/skyflow-skills-plugin/skills/call-rest-apis/SKILL.md b/skyflow-skills-plugin/skills/call-rest-apis/SKILL.md index 7408e73..6add1ce 100644 --- a/skyflow-skills-plugin/skills/call-rest-apis/SKILL.md +++ b/skyflow-skills-plugin/skills/call-rest-apis/SKILL.md @@ -1,6 +1,6 @@ --- name: call-rest-apis -description: Call the Skyflow REST APIs - including management APIs, data APIs, and detect APIs. +description: Call the Skyflow REST APIs - including management APIs, data APIs, detect APIs, and the Flow Vault API. --- # Skyflow REST APIs @@ -39,6 +39,18 @@ You are an expert on Skyflow's REST APIs. Your role is to provide quick, accurat | Update vault/schema | Management | PATCH | `/v1/vaults/{id}` | [management-api.md](management-api.md) | | Create policy | Management | POST | `/v1/policies` | [management-api.md](management-api.md) | | Get audit events | Management | GET | `/v1/audit/events` | [management-api.md](management-api.md) | +| Create vault (V2) | Flow Vault | POST | `/v2/vaults` | [flow-vault-api.md](flow-vault-api.md) | +| List vaults (V2) | Flow Vault | GET | `/v2/vaults` | [flow-vault-api.md](flow-vault-api.md) | +| Insert records | Flow Vault | POST | `/v2/records/insert` | [flow-vault-api.md](flow-vault-api.md) | +| Get records | Flow Vault | POST | `/v2/records/get` | [flow-vault-api.md](flow-vault-api.md) | +| Update records | Flow Vault | POST | `/v2/records/update` | [flow-vault-api.md](flow-vault-api.md) | +| Delete records | Flow Vault | POST | `/v2/records/delete` | [flow-vault-api.md](flow-vault-api.md) | +| Query data | Flow Vault | POST | `/v2/query` | [flow-vault-api.md](flow-vault-api.md) | +| Get tokens | Flow Vault | POST | `/v2/records/getTokens` | [flow-vault-api.md](flow-vault-api.md) | +| Detokenize | Flow Vault | POST | `/v2/tokens/detokenize` | [flow-vault-api.md](flow-vault-api.md) | +| Create policy (V1) | Flow Vault | POST | `/v1/policies` | [flow-vault-api.md](flow-vault-api.md) | +| Create role (V1) | Flow Vault | POST | `/v1/roles` | [flow-vault-api.md](flow-vault-api.md) | +| Create service account (V1) | Flow Vault | POST | `/v1/serviceAccounts` | [flow-vault-api.md](flow-vault-api.md) | ## OpenAPI Specifications @@ -47,6 +59,7 @@ Complete API schemas are available in these OpenAPI 3.0 spec files: - **[data.openapi.json](data.openapi.json)** - Data API (insert, retrieve, update, delete) - **[detect.openapi.json](detect.openapi.json)** - Detect API (PII detection and de-identification), including v1 and v2 (beta) endpoints - **[management.openapi.json](management.openapi.json)** - Management API (vaults, schemas, policies) +- **[flow-vault.openapi.json](flow-vault.openapi.json)** - Flow Vault API (V2 vault management, records, query, and tokens; V1 policies, roles, service accounts, users, workspaces, and authentication) ## Authentication @@ -82,6 +95,8 @@ Include in all requests: Authorization: Bearer {accessToken} ``` +> **Flow Vault**: The Flow Vault API additionally requires an `X-SKYFLOW-ACCOUNT-ID` header on every request and uses distinct base URLs (a `skyvault` domain for records, query, and tokens). See [flow-vault-api.md](flow-vault-api.md) for details. + ## Error Handling **Standard error format**: @@ -129,8 +144,8 @@ For language-specific SDKs with additional features: When helping users with API operations: -1. **Identify the API** - Data, Detect, or Management -2. **Link to the detailed doc** - data-api.md, detect-api.md, or management-api.md +1. **Identify the API** - Data, Detect, Management, or Flow Vault +2. **Link to the detailed doc** - data-api.md, detect-api.md, management-api.md, or flow-vault-api.md 3. **Show the endpoint** - HTTP method and URL pattern 4. **Provide a curl example** - Complete, copy-pastable command 5. **Explain key parameters** - Required fields and common options diff --git a/skyflow-skills-plugin/skills/call-rest-apis/flow-vault-api.md b/skyflow-skills-plugin/skills/call-rest-apis/flow-vault-api.md new file mode 100644 index 0000000..529a21a --- /dev/null +++ b/skyflow-skills-plugin/skills/call-rest-apis/flow-vault-api.md @@ -0,0 +1,826 @@ +# Flow Vault API + +Flow Vault is Skyflow's high-performance vault product. It exposes a **V2** API surface for vault management, records, query, and tokenization, plus **V1** governance endpoints for policies, roles, service accounts, users, workspaces, and authentication. + +**OpenAPI Spec**: See [flow-vault.openapi.json](flow-vault.openapi.json) for complete request/response schemas. + +## Base URLs + +Flow Vault uses two domains, depending on the operation: + +| Operations | Environment | Base URL | +| ------------------------------------------------------------------------------------------- | ----------- | ------------------------------------------------- | +| Records, Query, Tokens | Production | `https://{identifier}.skyvault.skyflowapis.com` | +| Vault management, Policies, Roles, Service accounts, Authentication, Token exchange, Users, Workspaces | Production | `https://{identifier}.skyflowapis.com` | +| Records, Query, Tokens | Sandbox | `https://{identifier}.skyvault.skyflowapis-preview.com` | +| Vault management, Policies, Roles, Service accounts, Authentication, Token exchange, Users, Workspaces | Sandbox | `https://{identifier}.skyflowapis-preview.com` | + +Replace `{identifier}` with your vault-specific identifier. In the examples below, `$VAULT_URL` refers to the appropriate base URL for the operation. + +## Authentication + +Every request requires **both** of these headers: + +```text +Authorization: Bearer +X-SKYFLOW-ACCOUNT-ID: +``` + +`X-SKYFLOW-ACCOUNT-ID` is required by Flow Vault on all requests (unlike the classic Data API, where it's optional). See the [Authentication](#get-bearer-token) section below to generate a bearer token. + +## Common Headers + +```text +Authorization: Bearer $TOKEN +X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID +Content-Type: application/json +``` + +Set these environment variables to run the examples: + +```bash +export VAULT_URL=$VAULT_URL +export ACCOUNT_ID=$ACCOUNT_ID +export TOKEN=$TOKEN +export VAULT_ID=$VAULT_ID +export TABLE_NAME=$TABLE_NAME +export WORKSPACE_ID=$WORKSPACE_ID +``` + +--- + +## Vault Management (V2) + +### LIST VAULTS + +**Endpoint**: `GET /v2/vaults` +**Operation**: `list-vaults` + +Returns all vaults in your account. + +```bash +curl -s -X GET "$VAULT_URL/v2/vaults" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" +``` + +**Response**: + +```json +{ + "vaults": [ + { + "ID": "d408485953784308a000f8dcf81901ef", + "name": "my_vault", + "description": "Production data vault", + "status": "ACTIVE" + } + ] +} +``` + +--- + +### CREATE VAULT + +**Endpoint**: `POST /v2/vaults` +**Operation**: `create-vault` + +Creates a vault from a `CreateVaultRequest` body. The `schema` object defines the vault structure. + +```bash +curl -s -X POST "$VAULT_URL/v2/vaults" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "name": "my_vault", + "description": "Production data vault for employee records", + "workspaceID": "'"$WORKSPACE_ID"'", + "schema": { + "vaultType": "STRUCTURED", + "tables": [ + { "name": "employees" } + ], + "columns": [ + { "name": "name", "tableName": "employees", "dataType": "STRING", "tokenGroups": ["det"] }, + { "name": "email", "tableName": "employees", "dataType": "STRING", "tokenGroups": ["det_rtf"] }, + { "name": "ssn", "tableName": "employees", "dataType": "STRING", "tokenGroups": ["det_reg"], "hashings": ["ssn_hash"] } + ], + "tokenGroup": [ + { "name": "det", "type": "DETERMINISTIC" }, + { "name": "det_rtf", "type": "DETERMINISTIC", "rightToForget": true }, + { "name": "det_reg", "type": "DETERMINISTIC", "format": "FPT", "regex": "^[A-Za-z0-9]{10}$" } + ], + "hashings": [ + { "name": "ssn_hash", "algorithm": "SHA256" } + ] + } + }' +``` + +**Response**: + +```json +{ + "ID": "d408485953784308a000f8dcf81901ef" +} +``` + +**Schema fields**: + +- `schema.vaultType`\* (string): Vault type. Only `STRUCTURED` is supported. +- `schema.tables`\* (array): Each table requires a `name`. Optionally set `unique` column constraints and a `deleteTTL` (days) for automatic row expiration. +- `schema.columns`\* (array): Each column requires `name`, `tableName`, and `dataType` (`STRING`, `NUMBER`, `BOOL`, or `JSON`). Reference `tokenGroups` for tokenization and `hashings` for hashing. +- `schema.tokenGroup` (array): Each group requires `name` and `type` (`DETERMINISTIC` or `NONDETERMINISTIC`). Optional: `format` (`UUID` or `FPT`), `regex`, `transientTime` (TTL seconds), `rightToForget`. +- `schema.redactions` (array): Custom redaction patterns with `name`, `findPattern`, `replacePattern`. +- `schema.hashings` (array): Named hashing configs with `name` and `algorithm` (`SHA256`). +- `dryRun` (boolean): Validate the request without creating the vault. When `true`, the response includes `schemaValid` and `validationErrors`. + +To enable SQL queries, set `queryService.enabled: true` in the schema. + +--- + +### GET VAULT + +**Endpoint**: `GET /v2/vaults/{ID}` +**Operation**: `get-vault` + +Returns a vault's schema, status, and metadata. + +```bash +curl -s -X GET "$VAULT_URL/v2/vaults/$VAULT_ID" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" +``` + +**Response**: + +```json +{ + "vault": { + "ID": "d408485953784308a000f8dcf81901ef", + "name": "my_vault", + "description": "Production data vault for employee records", + "status": "ACTIVE" + }, + "workspaceID": "z10198d5553411def9f2360c609gt3yx" +} +``` + +--- + +### UPDATE VAULT + +**Endpoint**: `PATCH /v2/vaults/{ID}` +**Operation**: `update-vault` + +Updates a vault's name, description, or schema. + +```bash +curl -s -X PATCH "$VAULT_URL/v2/vaults/$VAULT_ID" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "description": "Updated vault for employee and customer records", + "schema": { + "vaultType": "STRUCTURED", + "tables": [ + { "name": "employees" }, + { "name": "customers" } + ], + "columns": [ + { "name": "name", "tableName": "employees", "dataType": "STRING" }, + { "name": "name", "tableName": "customers", "dataType": "STRING" } + ] + } + }' +``` + +**Request Body**: + +- `name`, `description`, `schema`: Fields to update. +- `dryRun` (boolean): Validate schema changes before applying them. +- `skipDataValidation` (boolean): Bypass data validation during the update. + +--- + +### DELETE VAULT + +**Endpoint**: `DELETE /v2/vaults/{ID}` +**Operation**: `delete-vault` + +Permanently removes the vault, including all records and tokens. This cannot be undone. + +```bash +curl -s -X DELETE "$VAULT_URL/v2/vaults/$VAULT_ID" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" +``` + +--- + +### VAULT METRICS + +**Endpoint**: `POST /v2/vaults/metrics` +**Operation**: `flow-vault-metrics` + +Returns record counts per table. + +```bash +curl -s -X POST "$VAULT_URL/v2/vaults/metrics" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ "vaultID": "'"$VAULT_ID"'" }' +``` + +**Response**: + +```json +{ + "data": { + "tables": { + "employees": { "recordsCount": 1345 }, + "customers": { "recordsCount": 500 } + } + }, + "error": null +} +``` + +--- + +### UPLOAD SECRETS + +**Endpoint**: `POST /v2/uploadSecrets` +**Operation**: `upload-vault-secrets` + +Uploads a secret for each hashing configuration in the vault schema. `hashName` must exactly match a hashing config name. The secret acts as an HMAC key for hash computation; an empty string is valid. Columns with hashing don't return hash values until secrets are uploaded. + +```bash +curl -s -X POST "$VAULT_URL/v2/uploadSecrets" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "vaultID": "'"$VAULT_ID"'", + "secrets": [ + { "hashName": "ssn_hash", "secret": "my-secret-value" } + ] + }' +``` + +**Response**: + +```json +{ "vaultID": "d408485953784308a000f8dcf81901ef" } +``` + +--- + +## Records (V2) + +Records are the primary data units in Flow Vault. Responses return tokens alongside data based on the vault's token group configuration, and a `hashedData` field when columns have hashing configured. Batch operations support **partial success**: each record in the response has its own `httpCode` and `error` field. + +### INSERT RECORDS + +**Endpoint**: `POST /v2/records/insert` +**Operation**: `insert-records` + +Inserts one or more records. `tableName` can be set at the request level or per-record (per-record takes precedence). + +```bash +curl -s -X POST "$VAULT_URL/v2/records/insert" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "vaultID": "'"$VAULT_ID"'", + "tableName": "'"$TABLE_NAME"'", + "records": [ + { "data": { "name": "Jane Doe", "email": "jane.doe@example.com", "ssn": "123-45-6789" } } + ] + }' +``` + +**Response**: + +```json +{ + "records": [ + { + "skyflowID": "97cdd1af-02ac-47eb-ab0d-8339dbef6ccb", + "tokens": { + "email": [{ "token": "6a37c40a-7e4a-4f6b-b202-a84ca6a5857e", "tokenGroupName": "det_rtf" }], + "ssn": [{ "token": "AMmmtFZyRO", "tokenGroupName": "det_reg" }] + }, + "error": null, + "httpCode": 200 + } + ] +} +``` + +**Upsert**: To insert-or-update by matching unique column values, include an `upsert` object per record with `updateType` and `uniqueColumns`: + +```json +"upsert": { "updateType": "UPDATE", "uniqueColumns": ["email"] } +``` + +--- + +### GET RECORDS + +**Endpoint**: `POST /v2/records/get` +**Operation**: `get-records` + +Retrieves records by `skyflowIDs` **or** `uniqueValues` (not both). Use `columnRedactions` to set the redaction per column, `columns` to limit returned columns, and `limit`/`offset` for pagination. + +```bash +curl -s -X POST "$VAULT_URL/v2/records/get" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "vaultID": "'"$VAULT_ID"'", + "tableName": "'"$TABLE_NAME"'", + "skyflowIDs": ["97cdd1af-02ac-47eb-ab0d-8339dbef6ccb"], + "columnRedactions": [ + { "columnName": "name", "redaction": "plain_text" }, + { "columnName": "ssn", "redaction": "redacted" } + ] + }' +``` + +**Response**: + +```json +{ + "records": [ + { + "skyflowID": "97cdd1af-02ac-47eb-ab0d-8339dbef6ccb", + "data": { "name": "Jane Doe", "ssn": "XXX-XX-6789" }, + "error": null, + "httpCode": 200 + } + ] +} +``` + +Get by unique values instead of Skyflow IDs: + +```json +"uniqueValues": [ { "data": { "email": "jane.doe@example.com" } } ] +``` + +--- + +### UPDATE RECORDS + +**Endpoint**: `POST /v2/records/update` +**Operation**: `update-records` + +Updates records by `skyflowID`. The `updateType` controls behavior: + +- `UPDATE`: Merges provided data with existing data (fields not sent are preserved). +- `REPLACE`: Replaces the entire record (fields not sent are removed). + +```bash +curl -s -X POST "$VAULT_URL/v2/records/update" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "vaultID": "'"$VAULT_ID"'", + "tableName": "'"$TABLE_NAME"'", + "records": [ + { "skyflowID": "97cdd1af-02ac-47eb-ab0d-8339dbef6ccb", "data": { "email": "jane.updated@example.com" } } + ], + "updateType": "UPDATE" + }' +``` + +--- + +### DELETE RECORDS + +**Endpoint**: `POST /v2/records/delete` +**Operation**: `delete-records` + +Deletes records by `skyflowIDs` or `uniqueValues`. + +```bash +curl -s -X POST "$VAULT_URL/v2/records/delete" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "vaultID": "'"$VAULT_ID"'", + "tableName": "'"$TABLE_NAME"'", + "skyflowIDs": ["97cdd1af-02ac-47eb-ab0d-8339dbef6ccb"] + }' +``` + +--- + +## Query (V2) + +### EXECUTE QUERY + +**Endpoint**: `POST /v2/query` +**Operation**: `execute-query` + +Runs a SQL `SELECT` query against vault data. Requires `queryService.enabled: true` on the vault. + +```bash +curl -s -X POST "$VAULT_URL/v2/query" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "vaultID": "'"$VAULT_ID"'", + "query": "SELECT name, email FROM employees WHERE age > 21 LIMIT 10" + }' +``` + +**Response**: + +```json +{ + "records": [ + { "data": { "name": "Jane Doe", "email": "jane.doe@example.com" } } + ] +} +``` + +**Supported SQL**: + +- Clauses: `SELECT`, `WHERE`, `JOIN`, `GROUP BY`, `ORDER BY`, `LIMIT`, `OFFSET`. `INSERT`/`UPDATE`/`DELETE` are **not** supported. +- Functions: `AVG`, `COUNT`, `MAX`, `MIN`, `SUM`, and `REDACT(column, 'redaction')` to apply redaction to column values. + +**Constraints**: Maximum 25 records per response. Token and file URL values aren't returned. Use `LIMIT`/`OFFSET` to paginate. + +--- + +## Tokens (V2) + +### GET TOKENS + +**Endpoint**: `POST /v2/records/getTokens` +**Operation**: `getTokens` + +Retrieves the deterministic token previously issued for a plaintext value in a token group, enabling token-based lookups without storing raw PII. Only **deterministic** token groups are supported. Requires `TOKENLOOKUP` permission on each referenced token group. + +```bash +curl -s -X POST "$VAULT_URL/v2/records/getTokens" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "vaultID": "'"$VAULT_ID"'", + "records": [ + { "value": "9988998899", "tokenGroupName": "phoneNumberGroup" }, + { "value": "john@example.com", "tokenGroupName": "emailGroup" } + ] + }' +``` + +**Response**: + +```json +{ + "records": [ + { "token": "3232-4444-3232-1234", "tokenGroupName": "phoneNumberGroup", "value": "9988998899", "error": null, "httpCode": 200 } + ] +} +``` + +When some records succeed and others fail, the API returns HTTP 207 (Partial Success); a per-record HTTP 404 indicates the value doesn't exist in the token group. + +--- + +### DETOKENIZE + +**Endpoint**: `POST /v2/tokens/detokenize` +**Operation**: `detokenize` + +Converts tokens back to original values. Use `tokenGroupRedactions` to control the returned redaction per token group. + +```bash +curl -s -X POST "$VAULT_URL/v2/tokens/detokenize" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "vaultID": "'"$VAULT_ID"'", + "tokens": ["a1b2c3d4-e5f6-7890-abcd-ef1234567890"], + "tokenGroupRedactions": [ + { "tokenGroupName": "deterministic_group", "redaction": "plain_text" } + ] + }' +``` + +**Response**: + +```json +{ + "response": [ + { "token": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "value": "123-45-6789", "tokenGroupName": "deterministic_group", "error": null, "httpCode": 200 } + ] +} +``` + +--- + +## Policies (V1) + +Flow Vault uses a policy-based access control (PBAC) model. Each policy contains rules at the column, table, or token group level. Each rule has `actions`, an `effect` (`ALLOW` or `DENY`), an optional `redaction`, and an optional row filter. + +**Policy operations**: `ALL`, `CREATE`, `READ`, `UPDATE`, `DELETE`, `TOKENLOOKUP`, `DETOKENIZATION`. + +### LIST POLICIES + +**Endpoint**: `GET /v1/policies` +**Operation**: `list-policies` + +```bash +curl -s -X GET "$VAULT_URL/v1/policies?resource.ID=$VAULT_ID&resource.type=VAULT" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" +``` + +**Query Parameters**: + +- `resource.ID`: The resource (for example, vault) ID. +- `resource.type`: The resource type (for example, `VAULT`). + +--- + +### CREATE POLICY + +**Endpoint**: `POST /v1/policies` +**Operation**: `create-policy` + +```bash +curl -s -X POST "$VAULT_URL/v1/policies" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "name": "read_pii_plaintext", + "displayName": "Read PII Plain Text", + "description": "Allows reading PII columns in plain text", + "resource": { "ID": "'"$VAULT_ID"'", "type": "VAULT" }, + "ruleParams": [ + { + "name": "read_employee_names", + "columnRuleParams": { + "vaultID": "'"$VAULT_ID"'", + "columns": ["employees.name", "employees.email"], + "actions": ["READ"], + "effect": "ALLOW", + "redaction": "plain_text" + } + } + ], + "activated": true + }' +``` + +**Response**: + +```json +{ "ID": "p3a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5" } +``` + +Rules can use `columnRuleParams`, `tableRuleParams`, or token group rules. Set `activated` to `false` (the default) to create a disabled policy. + +--- + +### GET / UPDATE / DELETE POLICY + +- **Get**: `GET /v1/policies/{ID}` (`get-policy`) +- **Update**: `PATCH /v1/policies/{ID}` (`update-policy`) — update `name`, `description`, `ruleParams`, or `activated`. +- **Delete**: `DELETE /v1/policies/{ID}` (`delete-policy`) + +### ASSIGN / UNASSIGN POLICY + +**Endpoint**: `POST /v1/policies/assign` (`assign-policy`) and `POST /v1/policies/unassign` (`unassign-policy`) + +Assign a policy to roles and/or members. Use `exceptions` to exclude specific members from a role-based assignment. + +```bash +curl -s -X POST "$VAULT_URL/v1/policies/assign" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "ID": "'"$POLICY_ID"'", + "roleIDs": ["r1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6"] + }' +``` + +--- + +## Roles (V1) + +Roles group permissions and policies that you assign to users and service accounts. A role's `type` is either `SYSTEM` (Skyflow-defined, immutable) or `CUSTOM` (user-defined). Only `CUSTOM` roles can be updated or deleted. + +### LIST ROLES + +**Endpoint**: `GET /v1/roles` +**Operation**: `list-roles` + +```bash +curl -s -X GET "$VAULT_URL/v1/roles?resource.ID=$VAULT_ID&resource.type=VAULT" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" +``` + +--- + +### CREATE ROLE + +**Endpoint**: `POST /v1/roles` +**Operation**: `create-role` + +```bash +curl -s -X POST "$VAULT_URL/v1/roles" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "roleDefinition": { + "name": "data_analyst", + "displayName": "Data Analyst", + "description": "Read-only access to vault data with redaction", + "permissions": ["READ"], + "levels": ["VAULT"] + }, + "resource": { "ID": "'"$VAULT_ID"'" } + }' +``` + +**Response**: + +```json +{ "ID": "r1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6" } +``` + +--- + +### GET / UPDATE / DELETE ROLE + +- **Get**: `GET /v1/roles/{ID}` (`get-role`) +- **Update**: `PATCH /v1/roles/{ID}` (`update-role`) — update the `roleDefinition`. +- **Delete**: `DELETE /v1/roles/{ID}` (`delete-role`) — `CUSTOM` roles only. + +### ASSIGN / UNASSIGN ROLE + +**Endpoint**: `POST /v1/roles/assign` (`assign-role`) and `POST /v1/roles/unassign` (`unassign-role`) + +Assign a role to members. Optionally include a `condition` expression that restricts when the role applies. + +```bash +curl -s -X POST "$VAULT_URL/v1/roles/assign" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "ID": "'"$ROLE_ID"'", + "members": [ { "ID": "m4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9" } ] + }' +``` + +--- + +## Service Accounts (V1) + +Service accounts are machine identities that applications use to authenticate. Each has a key pair for generating JWT tokens. Optional controls: `enforceContextID` (require a `ctx` claim in JWT assertions) and `enforceSignedDataTokens` (require data tokens to be signed). + +### CREATE SERVICE ACCOUNT + +**Endpoint**: `POST /v1/serviceAccounts` +**Operation**: `create-service-account` + +```bash +curl -s -X POST "$VAULT_URL/v1/serviceAccounts" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-SKYFLOW-ACCOUNT-ID: $ACCOUNT_ID" \ + -H "Content-Type: application/json" \ + -d '{ + "serviceAccount": {}, + "clientConfiguration": { "enforceContextID": false, "enforceSignedDataTokens": false }, + "accountID": "'"$ACCOUNT_ID"'" + }' +``` + +**Response** (credentials are returned **only once** — store `privateKey` and `apiKey` securely): + +```json +{ + "clientID": "sa1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6", + "keyID": "k1a2b3c4d5e6f7a8", + "privateKey": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----", + "apiKeyID": "ak1a2b3c4d5e6f7a8", + "apiKey": "sky-ab12c-d3ef4567890abcdef1234567890abcdef", + "keyAlgorithm": "KEY_ALG_RSA_2048" +} +``` + +**Other operations**: + +- List: `GET /v1/serviceAccounts` (`list-service-accounts`) +- Get: `GET /v1/serviceAccounts/{ID}` (`get-service-account`) +- Update: `PATCH /v1/serviceAccounts/{ID}` (`update-service-account`) +- Delete: `DELETE /v1/serviceAccounts/{ID}` (`delete-service-account`) +- API keys: `.../apikey` (`create-api-key`, `list-api-keys`, `get-api-key`, `delete-api-key`, `rotate-api-key`) +- Keys: `.../keys` (`create-service-account-key`, `list-service-account-keys`, `get-service-account-key`, `delete-service-account-key`, `rotate-service-account-key`) +- Signed token keys: `.../signedtokenkey` (`create-signed-data-token-key`, `list-signed-data-token-keys`, `get-signed-data-token-key`, `delete-signed-data-token-key`, `rotate-signed-data-token-key`) + +--- + +## Authentication (V1) + +### GET BEARER TOKEN + +**Endpoint**: `POST /v1/auth/sa/oauth/token` +**Operation**: `get-bearer-token` + +Exchanges a signed JWT assertion (built from your service account credentials) for a bearer token. This endpoint does not require an existing `Authorization` header. + +```bash +curl -s -X POST "$VAULT_URL/v1/auth/sa/oauth/token" \ + -H "Content-Type: application/json" \ + -d '{ + "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer", + "assertion": "" + }' +``` + +**Response**: + +```json +{ + "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...", + "tokenType": "Bearer" +} +``` + +**Request Body**: + +- `grant_type`\*: Must be `urn:ietf:params:oauth:grant-type:jwt-bearer`. +- `assertion`\*: A signed JWT with claims `iss` (issuer), `key` (key ID), `aud` (recipient), `exp` (expiry), `sub` (subject), and optional `ctx` (context for context-aware authorization). +- `scope`: Subset of roles: `"role: role:"`. + +**Token exchange (STS)**: For delegation/impersonation flows, use `POST /v1/auth/sts/token` (`get-sts-token`) and manage configs via `/v1/sts/config` (`create-sts-config`, `list-sts-configs`, `get-sts-config`, `update-sts-config`, `delete-sts-config`). + +--- + +## Users and Workspaces (V1) + +- **Users**: `/v1/users` — `create-user`, `list-users`, `get-user`, `update-user`, `delete-user`. +- **Workspaces**: `/v1/workspaces` — `create-workspace`, `list-workspaces`, `get-workspace`, `update-workspace`, `delete-workspace`, and `list-workspace-members` (`GET /v1/workspaces/{ID}/members`). +- **Accounts / Resources**: `/v1/accounts` (`list-accounts`, `get-account`, `update-account`, `list-regions`) and `/v1/resources` (`list-resources`). + +--- + +## Redaction Levels + +Flow Vault redaction values are lowercase (unlike the classic Data API): + +| Level | Description | +| --------------------- | ----------------------------------------------------------------------- | +| `plain_text` | Returns the full original value (requires permissions) | +| `redacted` | Returns a fully redacted placeholder | +| Custom redaction name | Returns the value per a user-defined redaction in the schema (e.g. `emailMask`) | + +If no redaction is specified, Flow Vault applies the default configured for the column or token group. + +## Token Groups + +Token groups define tokenization behavior. Each has a `type`: + +- `DETERMINISTIC`: Same input always yields the same token. Required for standalone `getTokens`. +- `NONDETERMINISTIC`: Same input can yield different tokens. + +Optional properties: `format` (`UUID` or `FPT` for format-preserving tokens), `regex` (with `format: FPT`), `transientTime` (token TTL in seconds, `NONDETERMINISTIC` only), and `rightToForget` (when `true` on `DETERMINISTIC` tokens, deleting the last record with a value invalidates its tokens for detokenization). + +## Hashings + +Hashings compute deterministic cryptographic fingerprints (`SHA256`) of column data during Insert, Get, and Update. Hashes are **not stored** — they're recomputed each time. Configure them in the vault `schema.hashings`, subscribe columns via `columns[].hashings`, and upload one secret per hashing config with `POST /v2/uploadSecrets`. Responses then include a `hashedData` map (column → array of `{ hashName, data }`). + +## Error Handling + +Batch operations (records, tokens) support **partial success**. Inspect the per-item `httpCode` and `error` fields to identify which items succeeded and which failed. A batch with mixed results returns HTTP 207. + +```json +{ + "records": [ + { "skyflowID": "97cdd1af-02ac-47eb-ab0d-8339dbef6ccb", "error": null, "httpCode": 200 }, + { "skyflowID": "", "error": "Database rate limit exceeded.", "httpCode": 429 } + ] +} +``` diff --git a/skyflow-skills-plugin/skills/call-rest-apis/flow-vault.openapi.json b/skyflow-skills-plugin/skills/call-rest-apis/flow-vault.openapi.json new file mode 100644 index 0000000..2e84d52 --- /dev/null +++ b/skyflow-skills-plugin/skills/call-rest-apis/flow-vault.openapi.json @@ -0,0 +1,8944 @@ +{ + "openapi": "3.0.3", + "info": { + "title": "Flow Vault API", + "description": "Flow Vault data and management operations.", + "license": { + "name": "Proprietary", + "url": "https://docs.skyflow.com" + }, + "version": "2026.06" + }, + "servers": [ + { + "url": "https://{vault_url}", + "description": "Production", + "variables": { + "vault_url": { + "default": "{{vault_url}}", + "description": "The unique URL for the vault." + } + } + }, + { + "url": "https://{vault_url}", + "description": "Sandbox", + "variables": { + "vault_url": { + "default": "{{vault_url}}", + "description": "The unique URL for the vault." + } + } + } + ], + "paths": { + "/v1/accounts": { + "get": { + "tags": [ + "Accounts" + ], + "summary": "List Accounts", + "description": "Lists accounts that the user can access.", + "operationId": "list-accounts", + "parameters": [], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ListAccountsResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/accounts/{ID}": { + "get": { + "tags": [ + "Accounts" + ], + "summary": "Get Account", + "description": "Returns an account.", + "operationId": "get-account", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetAccountResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "patch": { + "tags": [ + "Accounts" + ], + "summary": "Update Account", + "description": "Updates an account.", + "operationId": "update-account", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the account.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateAccountRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateAccountResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/accounts/{accountID}/regions": { + "get": { + "tags": [ + "Accounts" + ], + "summary": "List Regions", + "description": "List regions available to an account.", + "operationId": "list-regions", + "parameters": [ + { + "name": "accountID", + "in": "path", + "description": "ID of the account.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ListRegionsResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/auth/sa/oauth/token": { + "post": { + "tags": [ + "Authentication" + ], + "summary": "Get Bearer Token", + "description": "Generates a Bearer Token to authenticate with Skyflow.", + "operationId": "get-bearer-token", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetAuthTokenRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetAuthTokenResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/auth/sts/token": { + "post": { + "tags": [ + "Token Exchange" + ], + "summary": "Get STS Token", + "description": "Generates a Bearer Token to authenticate with Skyflow.", + "operationId": "get-sts-token", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetSTSTokenRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetSTSTokenResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/policies": { + "get": { + "tags": [ + "Policies" + ], + "summary": "List Policies", + "description": "Lists policies associated with a resource.", + "operationId": "list-policies", + "parameters": [], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ListPoliciesResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "post": { + "tags": [ + "Policies" + ], + "summary": "Create Policy", + "description": "Creates a policy for the specified resource.", + "operationId": "create-policy", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/CreatePolicyRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/CreatePolicyResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/policies/assign": { + "post": { + "tags": [ + "Policies" + ], + "summary": "Assign Policy", + "description": "Assigns a policy to one or more roles.", + "operationId": "assign-policy", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/AssignPolicyRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/AssignPolicyResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/policies/unassign": { + "post": { + "tags": [ + "Policies" + ], + "summary": "Unassign Policy", + "description": "Unassigns a policy from one or more roles.", + "operationId": "unassign-policy", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UnassignPolicyRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UnassignPolicyResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/policies/{ID}": { + "get": { + "tags": [ + "Policies" + ], + "summary": "Get Policy", + "description": "Returns the specified policy.", + "operationId": "get-policy", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the policy.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetPolicyResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "delete": { + "tags": [ + "Policies" + ], + "summary": "Delete Policy", + "description": "Deletes the specified policy.", + "operationId": "delete-policy", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the policy.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DeletePolicyResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "patch": { + "tags": [ + "Policies" + ], + "summary": "Update Policy", + "description": "Updates the specified policy.", + "operationId": "update-policy", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the policy.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdatePolicyRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdatePolicyResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/resources": { + "get": { + "tags": [ + "Accounts" + ], + "summary": "List Resources", + "description": "List resources under a given resource.", + "operationId": "list-resources", + "parameters": [], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ListResourcesResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/roles": { + "get": { + "tags": [ + "Roles" + ], + "summary": "List Roles", + "description": "Lists roles associated with a resource.", + "operationId": "list-roles", + "parameters": [], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ListRolesResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "post": { + "tags": [ + "Roles" + ], + "summary": "Create Role", + "description": "Creates a custom role for the specified resource. After you create a role, you need to assign the role to a user or service account.", + "operationId": "create-role", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/CreateRoleRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/CreateRoleResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/roles/assign": { + "post": { + "tags": [ + "Roles" + ], + "summary": "Assign Role", + "description": "Assigns a role to a member.", + "operationId": "assign-role", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/AssignRoleRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/AssignRoleResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/roles/unassign": { + "post": { + "tags": [ + "Roles" + ], + "summary": "Unassign Role", + "description": "Removes a role from members.", + "operationId": "unassign-role", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UnassignRoleRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UnassignRoleResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/roles/{ID}": { + "get": { + "tags": [ + "Roles" + ], + "summary": "Get Role", + "description": "Returns the specified role.", + "operationId": "get-role", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the role.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetRoleResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "delete": { + "tags": [ + "Roles" + ], + "summary": "Delete Role", + "description": "Deletes a custom role. Attempting to delete Skyflow-defined roles results in an error.", + "operationId": "delete-role", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the role.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DeleteRoleResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "patch": { + "tags": [ + "Roles" + ], + "summary": "Update Role", + "description": "Updates a custom role. Attempting to update Skyflow-defined roles results in an error.", + "operationId": "update-role", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the role.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateRoleRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateRoleResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/serviceAccounts": { + "get": { + "tags": [ + "Service Accounts" + ], + "summary": "List Service Accounts", + "description": "Lists service accounts associated with the specified resource.", + "operationId": "list-service-accounts", + "parameters": [], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ListServiceAccountsResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "post": { + "tags": [ + "Service Accounts" + ], + "summary": "Create Service Account", + "description": "Creates a service account for the specified resource.", + "operationId": "create-service-account", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/CreateServiceAccountRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ServiceAccountResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/serviceAccounts/{ID}": { + "get": { + "tags": [ + "Service Accounts" + ], + "summary": "Get Service Account", + "description": "Returns the specified service account.", + "operationId": "get-service-account", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the service account.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetServiceAccountResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "delete": { + "tags": [ + "Service Accounts" + ], + "summary": "Delete Service Account", + "description": "Deletes the specified service account.", + "operationId": "delete-service-account", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the service account.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DeleteServiceAccountResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "patch": { + "tags": [ + "Service Accounts" + ], + "summary": "Update Service Account", + "description": "Updates the specified service account.", + "operationId": "update-service-account", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the service account.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateServiceAccountRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ServiceAccount" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/serviceAccounts/{ID}/apikey": { + "get": { + "tags": [ + "Service Accounts" + ], + "summary": "List API Keys", + "description": "Lists API keys for the specified service account.", + "operationId": "list-api-keys", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ListAPIKeysResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "post": { + "tags": [ + "Service Accounts" + ], + "summary": "Create API Key", + "description": "Creates an API key for the specified service account.", + "operationId": "create-api-key", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ServiceAccountResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/serviceAccounts/{ID}/apikey/{keyID}": { + "get": { + "tags": [ + "Service Accounts" + ], + "summary": "Get API Key", + "description": "Returns the specified API key.", + "operationId": "get-api-key", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "keyID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/APIKey" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "delete": { + "tags": [ + "Service Accounts" + ], + "summary": "Delete API Key", + "description": "Deletes the specified API key.", + "operationId": "delete-api-key", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "keyID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DeleteAPIKeyResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/serviceAccounts/{ID}/apikey/{keyID}/rotate": { + "put": { + "tags": [ + "Service Accounts" + ], + "summary": "Rotate API Key", + "description": "Rotates the specified API key.", + "operationId": "rotate-api-key", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "keyID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/RotateAPIKeyRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ServiceAccountResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/serviceAccounts/{ID}/keys": { + "get": { + "tags": [ + "Service Accounts" + ], + "summary": "List Keys", + "description": "Lists keys for the specified service account.", + "operationId": "list-service-account-keys", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the service account.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ListServiceAccountKeysResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "post": { + "tags": [ + "Service Accounts" + ], + "summary": "Create Key", + "description": "Creates a key for the specified service account.", + "operationId": "create-service-account-key", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the service account.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ServiceAccountResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/serviceAccounts/{ID}/keys/{KeyID}/rotate": { + "put": { + "tags": [ + "Service Accounts" + ], + "summary": "Rotate Key", + "description": "Rotates the specified key.", + "operationId": "rotate-service-account-key", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "KeyID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/RotateServiceAccountKeyRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ServiceAccountResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/serviceAccounts/{ID}/keys/{keyID}": { + "get": { + "tags": [ + "Service Accounts" + ], + "summary": "Get Key", + "description": "Returns the specified key.", + "operationId": "get-service-account-key", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the service account.", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "keyID", + "in": "path", + "description": "ID of the service account key.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ServiceAccountKey" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "delete": { + "tags": [ + "Service Accounts" + ], + "summary": "Delete Key", + "description": "Deletes the specified key.", + "operationId": "delete-service-account-key", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the service account.", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "keyID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DeleteServiceAccountKeyResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/serviceAccounts/{ID}/signedtokenkey": { + "get": { + "tags": [ + "Service Accounts" + ], + "summary": "List Signed Token Keys", + "description": "Returns signed token keys for the specified service account.", + "operationId": "list-signed-data-token-keys", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ListSignedDataTokenKeyResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "post": { + "tags": [ + "Service Accounts" + ], + "summary": "Create Signed Token Key", + "description": "Creates a signed token key for the specified service account.", + "operationId": "create-signed-data-token-key", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/SignedDataTokenKeyResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/serviceAccounts/{ID}/signedtokenkey/{KeyID}/rotate": { + "put": { + "tags": [ + "Service Accounts" + ], + "summary": "Rotate Signed Token Key", + "description": "Rotates the specified signed token key.", + "operationId": "rotate-signed-data-token-key", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "KeyID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/RotateSignedDataTokenKeyRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/SignedDataTokenKeyResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/serviceAccounts/{ID}/signedtokenkey/{keyID}": { + "get": { + "tags": [ + "Service Accounts" + ], + "summary": "Get Signed Token Key", + "description": "Returns the specified signed token key.", + "operationId": "get-signed-data-token-key", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "keyID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/SignedDataTokenKey" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "delete": { + "tags": [ + "Service Accounts" + ], + "summary": "Delete Signed Token Key", + "description": "Deletes the specified signed token key.", + "operationId": "delete-signed-data-token-key", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "keyID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DeleteSignedDataTokenKeyResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/sts/config": { + "get": { + "tags": [ + "Token Exchange" + ], + "summary": "List STS Configs", + "description": "Lists STS configurations for the given account.", + "operationId": "list-sts-configs", + "parameters": [], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ListSTSConfigResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "post": { + "tags": [ + "Token Exchange" + ], + "summary": "Create STS Config", + "description": "Creates a new STS configuration.", + "operationId": "create-sts-config", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/CreateSTSConfigRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/CreateSTSConfigResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/sts/config/{ID}": { + "get": { + "tags": [ + "Token Exchange" + ], + "summary": "Get STS Config", + "description": "Fetches an STS configuration by ID.", + "operationId": "get-sts-config", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/STSConfig" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "post": { + "tags": [ + "Token Exchange" + ], + "summary": "Update STS Config", + "description": "Updates an existing STS configuration.", + "operationId": "update-sts-config", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateSTSConfigRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/STSConfig" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "delete": { + "tags": [ + "Token Exchange" + ], + "summary": "Delete STS Config", + "description": "Deletes an STS configuration.", + "operationId": "delete-sts-config", + "parameters": [ + { + "name": "ID", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DeleteSTSConfigResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/users": { + "get": { + "tags": [ + "Users" + ], + "summary": "List Users", + "description": "Lists users in the account.", + "operationId": "list-users", + "parameters": [], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ListUsersResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "post": { + "tags": [ + "Users" + ], + "summary": "Create User", + "description": "Creates a user.", + "operationId": "create-user", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/CreateUserRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/CreateUserResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/users/{ID}": { + "get": { + "tags": [ + "Users" + ], + "summary": "Get User", + "description": "Returns the specified user.", + "operationId": "get-user", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the user.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetUserResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "delete": { + "tags": [ + "Users" + ], + "summary": "Delete User", + "description": "Deletes a user.", + "operationId": "delete-user", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the user.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DeleteUserResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "patch": { + "tags": [ + "Users" + ], + "summary": "Update User", + "description": "Updates the specified user.", + "operationId": "update-user", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the user.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateUserRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateUserResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/workspaces": { + "get": { + "tags": [ + "Workspaces" + ], + "summary": "List Workspaces", + "description": "Lists the workspaces in an account.", + "operationId": "list-workspaces", + "parameters": [], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ListWorkspacesResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "post": { + "tags": [ + "Workspaces" + ], + "summary": "Create Workspace", + "description": "Creates a workspace for an account.", + "operationId": "create-workspace", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/CreateWorkspaceRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/CreateWorkspaceResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/workspaces/{ID}": { + "get": { + "tags": [ + "Workspaces" + ], + "summary": "Get Workspace", + "description": "Returns the specified workspace.", + "operationId": "get-workspace", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the workspace.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetWorkspaceResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "delete": { + "tags": [ + "Workspaces" + ], + "summary": "Delete Workspace", + "description": "Deletes the specified Workspace and the entities it contains.", + "operationId": "delete-workspace", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the workspace.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DeleteWorkspaceResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "patch": { + "tags": [ + "Workspaces" + ], + "summary": "Update Workspace", + "description": "Updates the specified Workspace.", + "operationId": "update-workspace", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the workspace.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateWorkspaceRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateWorkspaceResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v1/workspaces/{ID}/members": { + "get": { + "tags": [ + "Workspaces" + ], + "summary": "List Members by Workspace", + "description": "Lists members for the specified workspace.", + "operationId": "list-workspace-members", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the resource. For example, if the resource is `roles`, this field is the role ID. If the resource is `workspaces`, this field is the workspace ID.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ListMembersResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v2/query": { + "post": { + "tags": [ + "Query" + ], + "summary": "Execute Query", + "description": "Returns records for a valid SQL query. This endpoint\n- Can return masked record values.\n- Supports only the `SELECT` command.\n- Returns a maximum of 25 records. To return additional records, perform another query using the `OFFSET` keyword.\n- Can't modify the vault or perform transactions.\n- Can't return tokens.\n- Can't return file download or render URLs.", + "operationId": "execute-query", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ExecuteQueryRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ExecuteQueryResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "query" + ] + } + }, + "/v2/records/delete": { + "post": { + "tags": [ + "Records" + ], + "summary": "Delete Records", + "description": "Deletes records from a vault.", + "operationId": "delete-records", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DeleteRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DeleteResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v2/records/get": { + "post": { + "tags": [ + "Records" + ], + "summary": "Get Records", + "description": "Returns the specified records from a vault.", + "operationId": "get-records", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v2/records/getTokens": { + "post": { + "tags": [ + "Tokens" + ], + "summary": "Get Tokens From Values", + "description": "Returns the deterministic token previously issued for each supplied plaintext value within the specified token group. Only applicable to deterministic tokengroups.", + "operationId": "getTokens", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetTokensFromValuesRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetTokensFromValuesResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "207": { + "$ref": "#/components/responses/207" + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "403": { + "$ref": "#/components/responses/403" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "429": { + "$ref": "#/components/responses/429" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v2/records/insert": { + "post": { + "tags": [ + "Records" + ], + "summary": "Insert Records", + "description": "Inserts new records into a vault.", + "operationId": "insert-records", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/InsertRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/InsertResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v2/records/update": { + "post": { + "tags": [ + "Records" + ], + "summary": "Update Records", + "description": "Updates the specified records in a vault.", + "operationId": "update-records", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v2/tokens/detokenize": { + "post": { + "tags": [ + "Tokens" + ], + "summary": "Detokenize", + "description": "Returns values that correspond to the specified tokens.", + "operationId": "detokenize", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetokenizeRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DetokenizeResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v2/uploadSecrets": { + "post": { + "tags": [ + "Vaults" + ], + "summary": "Upload Secrets", + "description": "Uploads secrets to a vault.", + "operationId": "upload-vault-secrets", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UploadVaultSecretsRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UploadVaultSecretsResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v2/vaults": { + "get": { + "tags": [ + "Vaults" + ], + "summary": "List Vaults", + "description": "Lists the vaults you can access in a workspace.", + "operationId": "list-vaults", + "parameters": [], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ListVaultsResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "post": { + "tags": [ + "Vaults" + ], + "summary": "Create Vault", + "description": "Creates a vault.", + "operationId": "create-vault", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/CreateVaultRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/CreateVaultResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v2/vaults/metrics": { + "post": { + "tags": [ + "Vaults" + ], + "summary": "Vault Metrics", + "description": "Returns the total number of records for each table in the specified vault.", + "operationId": "flow-vault-metrics", + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/VaultMetricsRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/VaultMetricsResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + }, + "/v2/vaults/{ID}": { + "get": { + "tags": [ + "Vaults" + ], + "summary": "Get Vault", + "description": "Returns the specified vault.", + "operationId": "get-vault", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "Unique ID of the vault.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/GetVaultResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "delete": { + "tags": [ + "Vaults" + ], + "summary": "Delete Vault", + "description": "Deletes the specified vault and everything contained within it.", + "operationId": "delete-vault", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "ID of the vault.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/DeleteVaultResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + }, + "patch": { + "tags": [ + "Vaults" + ], + "summary": "Update Vault", + "description": "Updates the specified vault.", + "operationId": "update-vault", + "parameters": [ + { + "name": "ID", + "in": "path", + "description": "Unique ID of the vault.", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateVaultRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateVaultResponse" + } + } + }, + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + } + }, + "400": { + "$ref": "#/components/responses/400" + }, + "401": { + "$ref": "#/components/responses/401" + }, + "404": { + "$ref": "#/components/responses/404" + }, + "500": { + "$ref": "#/components/responses/500" + } + }, + "security": [ + { + "Bearer": [] + } + ], + "x-fern-audiences": [ + "external" + ] + } + } + }, + "components": { + "schemas": { + "APIKey": { + "type": "object", + "properties": { + "keyID": { + "type": "string", + "description": "ID of the API key." + }, + "identifier": { + "type": "string", + "description": "Identifier for the API key." + }, + "status": { + "type": "string", + "description": "Status of the API key." + }, + "keyValidAfterTime": { + "type": "string", + "description": "Timestamp the API will be valid after.", + "format": "date-time" + } + }, + "description": "APIKey represent fields for service account api key.", + "x-visibility": [ + "external" + ] + }, + "Account": { + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "Name of the account. Can only contain alphanumeric characters, and has to be unique." + }, + "displayName": { + "type": "string", + "description": "Name of the account that displays in the user interface." + }, + "description": { + "type": "string", + "description": "Description of the account." + }, + "ID": { + "type": "string", + "description": "Read-only. ID of the account. Generated by Skyflow." + }, + "namespace": { + "type": "string", + "description": "Read-only. Namespace of the account. Generated by Skyflow." + }, + "contactAddress": { + "$ref": "#/components/schemas/Address" + }, + "BasicAudit": { + "$ref": "#/components/schemas/BasicAudit" + }, + "status": { + "enum": [ + "NONE", + "CREATED", + "PENDING", + "ACTIVE", + "INACTIVE", + "ARCHIVED", + "DELETED", + "CREATION_IN_PROGRESS", + "DELETION_IN_PROGRESS", + "FAILED", + "RUNNING", + "SUCCEEDED", + "DELETION_FAILED" + ], + "type": "string", + "format": "enum" + }, + "tenantType": { + "enum": [ + "NONE_TYPE", + "DEDICATED", + "SHARED", + "PARENT", + "ROOT" + ], + "type": "string", + "format": "enum" + }, + "accountType": { + "enum": [ + "TYPE_NONE", + "SANDBOX" + ], + "type": "string", + "format": "enum" + } + }, + "description": "Account details.", + "x-visibility": [ + "external" + ] + }, + "Address": { + "type": "object", + "properties": { + "streetAddress": { + "type": "string", + "description": "Address number and street name." + }, + "city": { + "type": "string", + "description": "City." + }, + "state": { + "type": "string", + "description": "State or province." + }, + "country": { + "type": "string", + "description": "Country." + }, + "zip": { + "type": "integer", + "description": "Postal code.", + "format": "int32" + } + }, + "description": "A physical address.", + "x-visibility": [ + "external" + ] + }, + "AssignPolicyRequest": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the policy." + }, + "roleIDs": { + "type": "array", + "items": { + "type": "string" + }, + "description": "IDs of the roles to assign the policy to." + }, + "members": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Member" + }, + "description": "Members to assign the policy to." + }, + "exceptions": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Member" + }, + "description": "Members to whom the policy should not be assigned." + } + }, + "description": "Assign policy request.", + "x-visibility": [ + "external" + ] + }, + "AssignPolicyResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the assigned policy." + } + }, + "description": "Assign policy response.", + "x-visibility": [ + "external" + ] + }, + "AssignRoleRequest": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the role." + }, + "members": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Member" + }, + "description": "Members to assign the role to." + }, + "condition": { + "type": "string", + "description": "Condition associated with the role assignment." + } + }, + "description": "Assign role request.", + "x-visibility": [ + "external" + ] + }, + "AssignRoleResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the assigned role." + } + }, + "description": "Assign role response.", + "x-visibility": [ + "external" + ] + }, + "BasicAudit": { + "readOnly": true, + "type": "object", + "properties": { + "CreatedBy": { + "type": "string", + "description": "User who created the resource." + }, + "LastModifiedBy": { + "type": "string", + "description": "User who last modified the resource." + }, + "CreatedOn": { + "type": "string", + "description": "Creation time of the resource." + }, + "LastModifiedOn": { + "type": "string", + "description": "Last modification time of the resource." + } + }, + "description": "Simple audit metadata.", + "x-visibility": [ + "external" + ] + }, + "ClientConfiguration": { + "type": "object", + "properties": { + "enforceContextID": { + "type": "boolean", + "description": "When `true`, all JWT assertions for this service account must contain a `ctx` claim." + }, + "enforceSignedDataTokens": { + "type": "boolean", + "description": "When `true`, all data tokens sent to the vault using this service account must be signed with the associated private key." + } + }, + "description": "Client-side configuration for a service account.", + "x-visibility": [ + "external" + ] + }, + "ColumnRedactions": { + "required": [ + "columnName", + "redaction" + ], + "type": "object", + "properties": { + "columnName": { + "example": "email", + "type": "string", + "description": "Name of the column to redact." + }, + "redaction": { + "example": "plain_text", + "type": "string", + "description": "Name of the redaction type." + } + } + }, + "ColumnRuleParams": { + "type": "object", + "properties": { + "vaultID": { + "type": "string", + "description": "ID of the vault that contains the column(s)." + }, + "columns": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Column(s) that the rule applies to, specified in the format of \"tableName.columnname\"." + }, + "action": { + "enum": [ + "ALL", + "CREATE", + "READ", + "UPDATE", + "DELETE", + "TOKENIZATION", + "DETOKENIZATION" + ], + "type": "string", + "description": "Action that applies to the rule. Deprecated: use `actions` instead.\n`TOKENIZATION` is unavailable for VaultLH vaults with schemas.", + "format": "enum" + }, + "effect": { + "enum": [ + "DENY", + "ALLOW" + ], + "type": "string", + "description": "Effect of the rule (ALLOW or DENY).", + "format": "enum" + }, + "rowFilter": { + "type": "string", + "description": "SQL expression that applies a filter on all rows of a table." + }, + "redaction": { + "type": "string", + "description": "Redaction type applied to values in the specified columns." + }, + "actions": { + "type": "array", + "items": { + "enum": [ + "ALL", + "CREATE", + "READ", + "UPDATE", + "DELETE", + "TOKENIZATION", + "DETOKENIZATION" + ], + "type": "string", + "format": "enum" + }, + "description": "Actions that apply to the rule." + } + }, + "description": "Column-level rule details.", + "x-visibility": [ + "external" + ] + }, + "CreateVaultRequest": { + "type": "object", + "properties": { + "schema": { + "allOf": [ + { + "$ref": "#/components/schemas/VaultLhVaultSchema" + } + ], + "description": "Vault schema." + }, + "workspaceID": { + "type": "string", + "description": "Workspace ID." + }, + "name": { + "type": "string", + "description": "Name of the vault." + }, + "description": { + "type": "string", + "description": "Description of the vault." + }, + "owners": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Member" + }, + "description": "Members who will be assigned as vault owners." + }, + "useMasterKey": { + "allOf": [ + { + "$ref": "#/components/schemas/MasterKey" + } + ], + "description": "Master key configuration." + }, + "dryRun": { + "type": "boolean", + "description": "If true, validates the request without executing it." + } + }, + "x-visibility": [ + "external" + ] + }, + "CreateVaultResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the created vault." + } + }, + "x-visibility": [ + "external" + ] + }, + "CreatePolicyRequest": { + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "Name of the policy." + }, + "displayName": { + "type": "string", + "description": "Display name of the policy as it appears in user interfaces." + }, + "description": { + "type": "string", + "description": "Description of the policy." + }, + "resource": { + "allOf": [ + { + "$ref": "#/components/schemas/Resource" + } + ], + "description": "The primary resource on which the policy will apply." + }, + "ruleParams": { + "type": "array", + "items": { + "$ref": "#/components/schemas/RuleParams" + }, + "description": "Rules that comprise the policy." + }, + "activated": { + "type": "boolean", + "default": false, + "description": "If true, the policy becomes active immediately after creation." + } + }, + "description": "Create policy request.", + "x-visibility": [ + "external" + ] + }, + "CreatePolicyResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the created policy." + } + }, + "description": "Create policy response.", + "x-visibility": [ + "external" + ] + }, + "CreateRoleRequest": { + "type": "object", + "properties": { + "roleDefinition": { + "allOf": [ + { + "$ref": "#/components/schemas/RoleDefinition" + } + ], + "description": "Definition of the role to create." + }, + "resource": { + "allOf": [ + { + "$ref": "#/components/schemas/Resource" + } + ], + "description": "Resource on which the role will be applied." + } + }, + "description": "Create role request.", + "x-visibility": [ + "external" + ] + }, + "CreateRoleResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the newly created role." + } + }, + "description": "Create role response.", + "x-visibility": [ + "external" + ] + }, + "CreateSTSConfigRequest": { + "required": [ + "issuer", + "audience" + ], + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "Name of the config." + }, + "description": { + "type": "string", + "description": "Description of the STS configuration." + }, + "issuer": { + "type": "string", + "description": "Issuer of the public keys." + }, + "publicKeyJWKURI": { + "type": "string", + "description": "Public key as JWK endpoint." + }, + "contextClaims": { + "type": "array", + "items": { + "type": "string" + } + }, + "serviceAccountIDs": { + "type": "array", + "items": { + "type": "string" + }, + "description": "List of service account IDs." + }, + "accountID": { + "type": "string" + }, + "audience": { + "type": "string", + "description": "Audience to which the subject token must belong to" + } + }, + "x-visibility": [ + "external" + ] + }, + "CreateSTSConfigResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "Created STS Config ID." + } + }, + "x-visibility": [ + "external" + ] + }, + "CreateServiceAccountRequest": { + "type": "object", + "properties": { + "serviceAccount": { + "allOf": [ + { + "$ref": "#/components/schemas/ServiceAccount" + } + ], + "description": "Service account details." + }, + "clientConfiguration": { + "allOf": [ + { + "$ref": "#/components/schemas/ClientConfiguration" + } + ], + "description": "Client configuration for the service account." + }, + "accountID": { + "type": "string", + "description": "ID of the account that the service account belongs to." + } + }, + "description": "The service account create request.", + "x-visibility": [ + "external" + ] + }, + "CreateUserRequest": { + "type": "object", + "properties": { + "user": { + "$ref": "#/components/schemas/User" + }, + "accountID": { + "type": "string", + "description": "ID of the account that the user belongs to." + } + }, + "description": "User creation request.", + "x-visibility": [ + "external" + ] + }, + "CreateUserResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "The unique ID of the user that was created." + } + }, + "description": "User creation response.", + "x-visibility": [ + "external" + ] + }, + "CreateWorkspaceRequest": { + "type": "object", + "properties": { + "workspace": { + "$ref": "#/components/schemas/Workspace" + }, + "accountID": { + "type": "string", + "description": "ID of the account." + }, + "regionID": { + "type": "string", + "description": "ID of the region to create the workspace in." + } + }, + "x-visibility": [ + "external" + ] + }, + "CreateWorkspaceResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of created Workspace." + } + }, + "x-visibility": [ + "external" + ] + }, + "DeleteAPIKeyResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the service account." + }, + "keyID": { + "type": "string", + "description": "ID of the deleted API key." + } + }, + "description": "The service account api key delete by id response.", + "x-visibility": [ + "external" + ] + }, + "DeleteVaultResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the deleted vault." + } + }, + "x-visibility": [ + "external" + ] + }, + "DeletePolicyResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the deleted policy." + } + }, + "description": "Delete policy response.", + "x-visibility": [ + "external" + ] + }, + "DeleteRequest": { + "required": [ + "vaultID" + ], + "type": "object", + "properties": { + "vaultID": { + "example": "d408485953784308a000f8dcf81901ef", + "type": "string", + "description": "ID of the vault." + }, + "tableName": { + "example": "employees", + "type": "string", + "description": "Name of the table." + }, + "skyflowIDs": { + "example": [ + "97cdd1af-02ac-47eb-ab0d-8339dbef6ccb" + ], + "type": "array", + "items": { + "type": "string" + }, + "description": "Skyflow IDs of the records to delete." + }, + "uniqueValues": { + "example": [ + { + "data": { + "name": "john wick", + "email": "jhon@example.com" + } + }, + { + "data": { + "email": "robert@example.com" + } + } + ], + "type": "array", + "items": { + "$ref": "#/components/schemas/UniqueValue" + }, + "description": "List of unique constraint values to query records by data." + } + } + }, + "DeleteResponse": { + "required": [ + "records" + ], + "type": "object", + "properties": { + "records": { + "example": [ + { + "skyflowID": "97cdd1af-02ac-47eb-ab0d-8339dbef6ccb", + "error": null, + "httpCode": 200 + } + ], + "type": "array", + "items": { + "$ref": "#/components/schemas/DeleteResponseObject" + }, + "description": "List of deleted records with skyflow ID and any partial errors." + } + } + }, + "DeleteResponseObject": { + "required": [ + "skyflowID", + "httpCode" + ], + "type": "object", + "properties": { + "skyflowID": { + "example": "eac7f72a-32f4-4cdb-875c-3cc70e67351a", + "type": "string", + "description": "Skyflow ID of the deleted record." + }, + "error": { + "example": "Database network rate limit", + "type": "string", + "description": "Error message, if any." + }, + "httpCode": { + "example": 200, + "type": "integer", + "description": "HTTP status code of the response.", + "format": "int32" + } + } + }, + "DeleteRoleResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the deleted role." + } + }, + "description": "Delete role response.", + "x-visibility": [ + "external" + ] + }, + "DeleteSTSConfigResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the deleted STS config." + } + }, + "x-visibility": [ + "external" + ] + }, + "DeleteServiceAccountKeyResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the service account." + }, + "keyID": { + "type": "string", + "description": "ID of the deleted key of the service account." + } + }, + "description": "The service account key delete by id response.", + "x-visibility": [ + "external" + ] + }, + "DeleteServiceAccountResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the deleted service account." + } + }, + "description": "Delete service account response.", + "x-visibility": [ + "external" + ] + }, + "DeleteSignedDataTokenKeyResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the service account." + }, + "keyID": { + "type": "string", + "description": "ID of the deleted signed token key." + } + }, + "description": "Delete response for a signed token key.", + "x-visibility": [ + "external" + ] + }, + "DeleteUserResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the deleted user." + } + }, + "description": "User deletion response.", + "x-visibility": [ + "external" + ] + }, + "DeleteWorkspaceResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string" + } + }, + "description": "Contains status of delete operation.", + "x-visibility": [ + "external" + ] + }, + "ExecuteQueryRecordResponse": { + "type": "object", + "properties": { + "data": { + "example": { + "field_1": "value_1", + "field_2": "value_2" + }, + "type": "object", + "description": "Fields and values for the record." + } + } + }, + "ExecuteQueryRequest": { + "required": [ + "vaultID", + "query" + ], + "type": "object", + "properties": { + "vaultID": { + "example": "d408485953784308a000f8dcf81901ef", + "type": "string", + "description": "ID of the vault where the query is being performed." + }, + "query": { + "type": "string", + "description": "Query to perform." + } + } + }, + "ExecuteQueryResponse": { + "type": "object", + "properties": { + "records": { + "type": "array", + "items": { + "$ref": "#/components/schemas/ExecuteQueryRecordResponse" + }, + "description": "Records corresponding to the specified query." + }, + "metadata": { + "$ref": "#/components/schemas/ExecuteQueryResponseMetadata" + } + } + }, + "ExecuteQueryResponseMetadata": { + "type": "object", + "properties": { + "columns": { + "example": [ + "name", + "email" + ], + "type": "array", + "items": { + "type": "string" + }, + "description": "Columns returned for the query." + } + }, + "description": "Metadata for the query.", + "x-visibility": [ + "external" + ] + }, + "DetokenizeRequest": { + "required": [ + "vaultID", + "tokens" + ], + "type": "object", + "properties": { + "vaultID": { + "example": "d408485953784308a000f8dcf81901ef", + "type": "string", + "description": "ID of the vault." + }, + "tokens": { + "example": [ + "RYtQoeJdSQ", + "8bd036b6-8fe0-4176-945b-3a5a63e8fd18" + ], + "type": "array", + "items": { + "type": "string" + }, + "description": "Token to be detokenized" + }, + "tokenGroupRedactions": { + "example": [ + { + "tokenGroupName": "deterministic", + "redaction": "plain_text" + }, + { + "tokenGroupName": "non-det", + "redaction": "plain_text" + } + ], + "type": "array", + "items": { + "$ref": "#/components/schemas/TokenGroupRedactions" + }, + "description": "List of token groups to redact." + } + } + }, + "DetokenizeResponse": { + "required": [ + "response" + ], + "type": "object", + "properties": { + "response": { + "example": [ + { + "token": "RYtQoeJdSQ", + "value": "Bata Gali", + "tokenGroupName": "nondet_reg", + "error": null, + "httpCode": 200 + }, + { + "token": "8bd036b6-8fe0-4176-945b-3a5a63e8fd18", + "value": [ + 9087, + 6543 + ], + "tokenGroupName": "nondet", + "error": null, + "httpCode": 200 + } + ], + "type": "array", + "items": { + "$ref": "#/components/schemas/DetokenizeResponseObject" + }, + "description": "Detokenized data" + } + } + }, + "DetokenizeResponseObject": { + "required": [ + "token", + "value", + "tokenGroupName" + ], + "type": "object", + "properties": { + "token": { + "example": "1R9kNnLOPM", + "type": "string", + "description": "Token that was detokenized." + }, + "value": { + "$ref": "#/components/schemas/GoogleProtobufValue" + }, + "tokenGroupName": { + "example": "det_reg_rtf", + "type": "string", + "description": "Name of the token group." + }, + "error": { + "example": "Token not found.", + "type": "string", + "description": "Error message, if any." + }, + "httpCode": { + "example": 200, + "type": "integer", + "description": "HTTP status code of the response.", + "format": "int32" + }, + "metadata": { + "example": { + "table": "table1", + "skyflowID": "4524524534623" + }, + "type": "object", + "description": "Additional metadata associated with the token, such as tableName or skyflowID." + } + } + }, + "GetTokensFromValuesRequest": { + "required": [ + "vaultID", + "records" + ], + "type": "object", + "properties": { + "vaultID": { + "example": "d408485953784308a000f8dcf81901ef", + "type": "string", + "description": "ID of the vault." + }, + "records": { + "type": "array", + "items": { + "$ref": "#/components/schemas/GetTokensFromValuesRequestObject" + }, + "description": "Array of value/token-group pairs to look up." + } + } + }, + "GetTokensFromValuesRequestObject": { + "required": [ + "value", + "tokenGroupName" + ], + "type": "object", + "properties": { + "value": { + "$ref": "#/components/schemas/GoogleProtobufValue" + }, + "tokenGroupName": { + "type": "string", + "description": "Name of the deterministic token group." + } + } + }, + "GetTokensFromValuesResponse": { + "required": [ + "records" + ], + "type": "object", + "properties": { + "records": { + "type": "array", + "items": { + "$ref": "#/components/schemas/TokenizeResponseObject" + }, + "description": "Array of token result objects, one per input entry, in the same order as the request." + } + } + }, + "VaultSecret": { + "type": "object", + "properties": { + "hashName": { + "type": "string", + "description": "Hash name for the secret." + }, + "secret": { + "type": "string", + "description": "Value of the secret." + } + }, + "x-visibility": [ + "external" + ] + }, + "TokenizeResponseObject": { + "required": [ + "token", + "value", + "tokenGroupName" + ], + "type": "object", + "properties": { + "token": { + "example": "1R9kNnLOPM", + "type": "string", + "description": "Token that was generated." + }, + "value": { + "$ref": "#/components/schemas/GoogleProtobufValue" + }, + "tokenGroupName": { + "example": "det_reg_rtf", + "type": "string", + "description": "Name of the token group." + }, + "error": { + "example": "Token not found.", + "type": "string", + "description": "Error message, if any." + }, + "httpCode": { + "example": 200, + "type": "integer", + "description": "HTTP status code of the response.", + "format": "int32" + } + } + }, + "VaultValidationError": { + "type": "object", + "properties": { + "path": { + "type": "string", + "description": "Schema path having error." + }, + "message": { + "type": "string", + "description": "Corresponding error message." + } + }, + "x-visibility": [ + "external" + ] + }, + "VaultMetricsData": { + "type": "object", + "properties": { + "tables": { + "example": { + "tableName1": { + "recordsCount": 1345 + }, + "tableName2": { + "recordsCount": 13345 + } + }, + "type": "object", + "description": "Map of table names to their metrics." + } + }, + "x-visibility": [ + "external" + ] + }, + "VaultMetricsRequest": { + "required": [ + "vaultID" + ], + "type": "object", + "properties": { + "vaultID": { + "example": "{{vault_id}}", + "type": "string", + "description": "ID of the vault to get metrics for." + } + } + }, + "VaultMetricsResponse": { + "example": { + "data": { + "tables": { + "tableName1": { + "recordsCount": 1345 + }, + "tableName2": { + "recordsCount": 13345 + } + } + }, + "error": null + }, + "type": "object", + "properties": { + "data": { + "$ref": "#/components/schemas/VaultMetricsData" + }, + "error": { + "example": null, + "type": "object", + "description": "Error information, if any. Returns null on success." + } + }, + "x-visibility": [ + "external" + ] + }, + "VaultLhVaultSchema": { + "required": [ + "vaultType", + "tables", + "columns" + ], + "type": "object", + "properties": { + "vaultType": { + "enum": [ + "STRUCTURED" + ], + "type": "string", + "description": "Type of the vault.", + "format": "enum" + }, + "tables": { + "type": "array", + "items": { + "$ref": "#/components/schemas/FlowTableSchema_create-vault" + }, + "description": "Structured entities that organize and protect Personally Identifiable Information (PII) in rows and columns. A table supports defining a unique key on a column to ensure all values in that column are distinct, and can also enforce composite unique constraints across multiple columns to maintain data uniqueness across their combination." + }, + "tokenGroup": { + "type": "array", + "items": { + "$ref": "#/components/schemas/TokenGroup_create-vault" + }, + "description": "Logical groupings of columns used to apply tokenization and token input validation across multiple related fields. Columns can span multiple tables. tokenGroup defined available token groups. You can tokenize PII in columns by associating columns with a token group, ensuring consistent token generation across related fields for enhanced data protection and usability." + }, + "columns": { + "type": "array", + "items": { + "$ref": "#/components/schemas/FlowColumnSchema_create-vault" + }, + "description": "Columns to protect data within. Columns represent individual data fields within tables, and their schemas define the structure, data types, and privacy attributes of these fields. By defining column schemas, you can specify how data in each column should be handled, including tokenization, hashing, redaction, and validation rules." + }, + "redactions": { + "type": "array", + "items": { + "$ref": "#/components/schemas/MaskRedaction_create-vault" + }, + "description": "Redaction patterns to control how data in columns should be redacted. Redaction doesn't change the underlying data, just how it's displayed." + }, + "hashings": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Hashing_create-vault" + }, + "description": "Hashing configurations that compute a deterministic cryptographic hash of column data during Insert, Get, and Update operations. Hash values aren't stored. They are recomputed on every read and write. Each hashing configuration requires a corresponding secret uploaded via `UploadVaultSecrets`, which acts as an HMAC key. An empty string is a valid secret." + } + } + }, + "GetAccountResponse": { + "type": "object", + "properties": { + "account": { + "$ref": "#/components/schemas/Account" + } + }, + "description": "Contains read request response.", + "x-visibility": [ + "external" + ] + }, + "GetAuthTokenRequest": { + "required": [ + "grant_type", + "assertion" + ], + "type": "object", + "properties": { + "grant_type": { + "type": "string", + "description": "Grant type of the request. Set this to `urn:ietf:params:oauth:grant-type:jwt-bearer`." + }, + "assertion": { + "type": "string", + "description": "User-signed JWT token that contains the following fields: iss (Issuer), key (Unique identifier), aud (Recipient), exp (Expiry), sub (Subject), ctx (Optional context for context-aware authorization)." + }, + "subject_token": { + "type": "string", + "description": "Subject token." + }, + "subject_token_type": { + "type": "string", + "description": "Subject token type." + }, + "requested_token_use": { + "type": "string", + "description": "Token use type. Either `delegation` or `impersonation`." + }, + "scope": { + "type": "string", + "description": "Subset of available roles to associate with the requested token. Uses the format \"role: role:\"." + } + }, + "x-visibility": [ + "external" + ] + }, + "GetAuthTokenResponse": { + "type": "object", + "properties": { + "accessToken": { + "type": "string", + "description": "AccessToken." + }, + "tokenType": { + "type": "string", + "description": "TokenType : Bearer." + } + }, + "x-visibility": [ + "external" + ] + }, + "GetVaultResponse": { + "type": "object", + "properties": { + "vault": { + "allOf": [ + { + "$ref": "#/components/schemas/ObjectVault_create-vault" + } + ], + "description": "The retrieved vault." + }, + "workspaceID": { + "type": "string", + "description": "ID of the workspace under which the vault exists." + } + }, + "x-visibility": [ + "external" + ] + }, + "GetPolicyResponse": { + "type": "object", + "properties": { + "policy": { + "allOf": [ + { + "$ref": "#/components/schemas/Policy" + } + ], + "description": "The retrieved policy." + } + }, + "description": "Get policy response.", + "x-visibility": [ + "external" + ] + }, + "GetRequest": { + "required": [ + "vaultID" + ], + "type": "object", + "properties": { + "vaultID": { + "example": "d408485953784308a000f8dcf81901ef", + "type": "string", + "description": "ID of the vault." + }, + "tableName": { + "example": "employees", + "type": "string", + "description": "Name of the table to perform the operation on." + }, + "skyflowIDs": { + "example": [ + "97cdd1af-02ac-47eb-ab0d-8339dbef6ccb", + "aed32bbc-e7a4-4c7b-8c88-7f52ce8cb066" + ], + "type": "array", + "items": { + "type": "string" + }, + "description": "Skyflow IDs of the records to return. Either `skyflowIDs` or `uniqueValues` are required. If both are provided, the request fails." + }, + "columnRedactions": { + "example": [ + { + "columnName": "email", + "redaction": "plain_text" + }, + { + "columnName": "name", + "redaction": "plain_text" + } + ], + "type": "array", + "items": { + "$ref": "#/components/schemas/ColumnRedactions" + }, + "description": "List of columns to redact." + }, + "columns": { + "example": [ + "name", + "email" + ], + "type": "array", + "items": { + "type": "string" + }, + "description": "List of columns to return." + }, + "limit": { + "example": 10, + "type": "integer", + "description": "Limit for the number of records to be fetched.", + "format": "int32" + }, + "offset": { + "example": 0, + "type": "integer", + "description": "Offset for the number of records to be fetched.", + "format": "int32" + }, + "uniqueValues": { + "example": [ + { + "data": { + "name": "john wick", + "email": "jhon@example.com" + } + }, + { + "data": { + "email": "robert@example.com" + } + } + ], + "type": "array", + "items": { + "$ref": "#/components/schemas/UniqueValue" + }, + "description": "List of unique constraint values to query records by data." + }, + "records": { + "example": [ + { + "tableName": "employees", + "skyflowIDs": [ + "97cdd1af-02ac-47eb-ab0d-8339dbef6ccb", + "aed32bbc-e7a4-4c7b-8c88-7f52ce8cb066" + ] + } + ], + "type": "array", + "items": { + "$ref": "#/components/schemas/GetRequestData" + }, + "description": "List of records to be fetched. This field contains tableName and skyflowIDs belonging to the table." + } + } + }, + "GetRequestData": { + "required": [ + "tableName", + "skyflowIDs" + ], + "type": "object", + "properties": { + "tableName": { + "example": "employees", + "type": "string", + "description": "Name of the table." + }, + "skyflowIDs": { + "example": [ + "97cdd1af-02ac-47eb-ab0d-8339dbef6ccb", + "aed32bbc-e7a4-4c7b-8c88-7f52ce8cb066" + ], + "type": "array", + "items": { + "type": "string" + }, + "description": "Skyflow IDs of the records to return." + }, + "columnRedactions": { + "example": [ + { + "columnName": "email", + "redaction": "plain_text" + }, + { + "columnName": "name", + "redaction": "plain_text" + } + ], + "type": "array", + "items": { + "$ref": "#/components/schemas/ColumnRedactions" + }, + "description": "List of columns to redact." + }, + "columns": { + "example": [ + "name", + "email" + ], + "type": "array", + "items": { + "type": "string" + }, + "description": "List of columns to return." + }, + "uniqueValues": { + "example": [ + { + "data": { + "name": "john wick", + "email": "jhon@example.com" + } + }, + { + "data": { + "email": "robert@example.com" + } + } + ], + "type": "array", + "items": { + "$ref": "#/components/schemas/UniqueValue" + }, + "description": "List of unique constraint values to query records by data." + } + } + }, + "GetResponse": { + "required": [ + "records" + ], + "type": "object", + "properties": { + "records": { + "example": [ + { + "skyflowID": "97cdd1af-02ac-47eb-ab0d-8339dbef6ccb", + "tokens": { + "address": [ + { + "token": "rRTiEDjen9", + "tokenGroupName": "det_reg_rtf" + } + ], + "adult": [ + { + "token": "3af6bc7a-290e-460d-b05b-c5460e4ac45c", + "tokenGroupName": "nondet" + } + ], + "age": [ + { + "token": "d87e8eff-1760-42bf-b49b-a05c8bd7752b", + "tokenGroupName": "nondet" + } + ], + "email": [ + { + "token": "6a37c40a-7e4a-4f6b-b202-a84ca6a5857e", + "tokenGroupName": "det_rtf" + }, + { + "token": "glftzPOEqY", + "tokenGroupName": "det_reg" + } + ], + "name": [ + { + "token": "d2d52f24-a441-4748-8c78-5432e73cfd75", + "tokenGroupName": "det" + }, + { + "token": "950b46dd-bdf8-43b6-b8e1-477125c97b80", + "tokenGroupName": "nondet_trans" + } + ] + }, + "data": { + "address": { + "city": "aligarh", + "country": "India" + }, + "adult": true, + "age": 25, + "email": "asad.public5@gmail.com", + "name": "Vivek" + }, + "error": null, + "httpCode": 200 + }, + { + "skyflowID": "aed32bbc-e7a4-4c7b-8c88-7f52ce8cb066", + "tokens": { + "address": [ + { + "token": "yrzXJMtHO2", + "tokenGroupName": "det_reg_rtf" + } + ], + "adult": [ + { + "token": "b8fd49ff-4973-481f-a188-1e0967c72dd1", + "tokenGroupName": "nondet" + } + ], + "age": [ + { + "token": "0e305463-05cc-428c-aada-c9af41d89152", + "tokenGroupName": "nondet" + } + ], + "email": [ + { + "token": "dmqxUB22IV", + "tokenGroupName": "det_reg" + }, + { + "token": "cc8182e3-c94a-4e27-9cb5-ce1c5bccc1b1", + "tokenGroupName": "det_rtf" + } + ], + "name": [ + { + "token": "19d252b9-194f-4547-8240-08c8026b7e5a", + "tokenGroupName": "nondet_trans" + }, + { + "token": "86df1c7d-5b30-4dd5-a97c-8556bbb76005", + "tokenGroupName": "det" + } + ] + }, + "data": { + "address": { + "city": "deoria", + "country": "India" + }, + "adult": false, + "age": 24, + "email": "asad.public7@gmail.com", + "name": "Asad" + }, + "error": null, + "httpCode": 200 + } + ], + "type": "array", + "items": { + "$ref": "#/components/schemas/RecordResponseObject" + }, + "description": "List of fetched records with skyflow ID, tokens, data, and any partial errors" + } + } + }, + "GetRoleResponse": { + "type": "object", + "properties": { + "role": { + "allOf": [ + { + "$ref": "#/components/schemas/Role" + } + ], + "description": "The requested role." + } + }, + "description": "Get role response.", + "x-visibility": [ + "external" + ] + }, + "GetSTSTokenRequest": { + "required": [ + "grant_type", + "subject_token", + "subject_token_type", + "service_account_id" + ], + "type": "object", + "properties": { + "grant_type": { + "type": "string" + }, + "subject_token": { + "type": "string", + "description": "Subject token." + }, + "subject_token_type": { + "type": "string", + "description": "Subject token type." + }, + "service_account_id": { + "type": "string" + } + }, + "x-visibility": [ + "external" + ] + }, + "GetSTSTokenResponse": { + "type": "object", + "properties": { + "accessToken": { + "type": "string", + "description": "AccessToken." + }, + "issuedTokenType": { + "type": "string", + "description": "IssuedTokenType : urn:ietf:params:oauth:token-type:jwt." + }, + "tokenType": { + "type": "string", + "description": "TokenType : Bearer." + } + }, + "x-visibility": [ + "external" + ] + }, + "GetServiceAccountResponse": { + "type": "object", + "properties": { + "serviceAccount": { + "allOf": [ + { + "$ref": "#/components/schemas/ServiceAccount" + } + ], + "description": "Service account details." + }, + "clientConfiguration": { + "allOf": [ + { + "$ref": "#/components/schemas/ClientConfiguration" + } + ], + "description": "Client configuration for the service account." + } + }, + "description": "The service account get response.", + "x-visibility": [ + "external" + ] + }, + "GetUserResponse": { + "type": "object", + "properties": { + "user": { + "$ref": "#/components/schemas/User" + } + }, + "description": "User retrieval response.", + "x-visibility": [ + "external" + ] + }, + "GetWorkspaceResponse": { + "type": "object", + "properties": { + "workspace": { + "$ref": "#/components/schemas/Workspace" + } + }, + "description": "Contains read request response.", + "x-visibility": [ + "external" + ] + }, + "GoogleProtobufValue": { + "description": "Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values." + }, + "InsertRecordData": { + "required": [ + "data" + ], + "type": "object", + "properties": { + "data": { + "example": { + "address": { + "houseNumber": 123, + "city": "Deoria", + "country": "India" + }, + "age": 24, + "name": "Vivek" + }, + "type": "object", + "description": "Columns and values for the record." + }, + "tableName": { + "type": "string", + "description": "Name of the table to insert data into." + }, + "upsert": { + "$ref": "#/components/schemas/Upsert" + } + } + }, + "InsertRequest": { + "required": [ + "vaultID", + "tableName", + "records" + ], + "type": "object", + "properties": { + "vaultID": { + "example": "d408485953784308a000f8dcf81901ef", + "type": "string", + "description": "ID of the vault." + }, + "tableName": { + "example": "employees", + "type": "string", + "description": "Name of the table to perform the operation on. Can be defined at both the request body level and individual record level. If provided at both levels, the record-level `tableName` takes precedence." + }, + "records": { + "example": [ + { + "data": { + "name": "Vivek1", + "email": "vivek.varshney@skyflow.com", + "age": 23, + "adult": true, + "address": { + "street": "Bata Gali", + "city": "Aligarh", + "state": "UP", + "postal_code": 202001, + "country": "India", + "phone_numbers": [ + { + "type": "home", + "number": [ + 1234, + 5678 + ] + }, + { + "type": "work", + "number": [ + 4321, + 8765 + ] + } + ] + } + } + }, + { + "data": { + "name": "Asad1", + "email": "asad.public@gmail.com", + "age": 16, + "adult": false, + "address": { + "street": "Sarojini", + "city": "Deoria", + "state": "UP", + "postal_code": 274001, + "country": "India", + "phone_numbers": [ + { + "type": "home", + "number": [ + 7890, + 3456 + ] + }, + { + "type": "work", + "number": [ + 9087, + 6543 + ] + } + ] + } + } + } + ], + "type": "array", + "items": { + "$ref": "#/components/schemas/InsertRecordData" + }, + "description": "Data to insert as a list of records." + }, + "upsert": { + "$ref": "#/components/schemas/Upsert" + } + } + }, + "InsertResponse": { + "required": [ + "records" + ], + "type": "object", + "properties": { + "records": { + "example": [ + { + "skyflowID": "97cdd1af-02ac-47eb-ab0d-8339dbef6ccb", + "tokens": { + "address": [ + { + "path": "street", + "token": "AMmmtFZyRO", + "tokenGroupName": "nondet_trans_reg" + }, + { + "path": "postal_code", + "token": "ZI9SCwJ7Gh", + "tokenGroupName": "det_reg_rtf" + }, + { + "path": "phone_numbers[0].type", + "token": "1e4c7e6b-e229-4a20-813f-7ad4eb6471e4", + "tokenGroupName": "det_rtf" + }, + { + "path": "street", + "token": "RYtQoeJdSQ", + "tokenGroupName": "nondet_reg" + }, + { + "path": "phone_numbers[1].number[0]", + "token": "RnHp7u4WE6", + "tokenGroupName": "nondet_reg" + }, + { + "path": "phone_numbers", + "token": "a0484c75-6386-4caa-b1ea-bd4ae323d433", + "tokenGroupName": "det_rtf" + }, + { + "token": "wnC9G6iSkJ", + "tokenGroupName": "det_reg_rtf" + }, + { + "path": "phone_numbers[1].number", + "token": "df3242a7-1d2c-4332-9683-d299a85ec177", + "tokenGroupName": "nondet" + } + ], + "adult": [ + { + "token": "784123e2-22f4-4a3f-8947-ab80b92781f7", + "tokenGroupName": "nondet" + } + ], + "age": [ + { + "token": "50c0facd-7a6e-427e-bd2c-9f2b805c441c", + "tokenGroupName": "nondet" + } + ], + "email": [ + { + "token": "jJbwjDzLUo", + "tokenGroupName": "det_reg" + }, + { + "token": "3253d406-fe33-4b58-b32a-f0651fccf755", + "tokenGroupName": "det_rtf" + } + ], + "name": [ + { + "token": "451bfbba-7de1-4dd3-bb20-e2887768730b", + "tokenGroupName": "det" + }, + { + "token": "d183a01e-bf25-4c8c-be5a-c3db923aab32", + "tokenGroupName": "nondet_trans" + } + ] + }, + "data": { + "address": { + "city": "Aligarh", + "country": "India", + "phone_numbers": [ + { + "number": [ + 1234, + 5678 + ], + "type": "home" + }, + { + "number": [ + 4321, + 8765 + ], + "type": "work" + } + ], + "postal_code": 202001, + "state": "UP", + "street": "Bata Gali" + }, + "adult": true, + "age": 23, + "email": "vivek.varshney@skyflow.com", + "name": "Vivek1" + }, + "error": null, + "httpCode": 200 + }, + { + "skyflowID": "aed32bbc-e7a4-4c7b-8c88-7f52ce8cb066", + "tokens": { + "address": [ + { + "path": "street", + "token": "LAz8bQSQr5", + "tokenGroupName": "nondet_trans_reg" + }, + { + "token": "tkCAi98Sya", + "tokenGroupName": "det_reg_rtf" + }, + { + "path": "phone_numbers[1].number", + "token": "8bd036b6-8fe0-4176-945b-3a5a63e8fd18", + "tokenGroupName": "nondet" + }, + { + "path": "phone_numbers", + "token": "6b34069f-1252-4652-81ff-c28cc7c3a3aa", + "tokenGroupName": "det_rtf" + }, + { + "path": "phone_numbers[1].number[0]", + "token": "XDXbCT63Ng", + "tokenGroupName": "nondet_reg" + }, + { + "path": "postal_code", + "token": "5Depmpk4hd", + "tokenGroupName": "det_reg_rtf" + }, + { + "path": "phone_numbers[0].type", + "token": "1e4c7e6b-e229-4a20-813f-7ad4eb6471e4", + "tokenGroupName": "det_rtf" + }, + { + "path": "street", + "token": "bCgK550gax", + "tokenGroupName": "nondet_reg" + } + ], + "adult": [ + { + "token": "29fa61a7-87ee-4ac7-a470-d7ae9a9b8cef", + "tokenGroupName": "nondet" + } + ], + "age": [ + { + "token": "9a34465b-2a43-4810-80b7-a61962c08e4e", + "tokenGroupName": "nondet" + } + ], + "email": [ + { + "token": "aQjT00ytuD", + "tokenGroupName": "det_reg" + }, + { + "token": "6d4a92bd-48b3-416c-88fa-11d9689a1475", + "tokenGroupName": "det_rtf" + } + ], + "name": [ + { + "token": "39aff677-00a3-4983-bea5-9f323562dd31", + "tokenGroupName": "det" + }, + { + "token": "76b03129-eeaa-40ba-bcea-ce14d3abb76c", + "tokenGroupName": "nondet_trans" + } + ] + }, + "data": { + "address": { + "city": "Deoria", + "country": "India", + "phone_numbers": [ + { + "number": [ + 7890, + 3456 + ], + "type": "home" + }, + { + "number": [ + 9087, + 6543 + ], + "type": "work" + } + ], + "postal_code": 274001, + "state": "UP", + "street": "Sarojini" + }, + "adult": false, + "age": 16, + "email": "asad.public@gmail.com", + "name": "Asad1" + }, + "error": null, + "httpCode": 200 + } + ], + "type": "array", + "items": { + "$ref": "#/components/schemas/RecordResponseObject" + }, + "description": "List of inserted records." + } + } + }, + "JsonSpecifications": { + "required": [ + "path" + ], + "type": "object", + "properties": { + "path": { + "type": "string", + "description": "JSON path to apply settings to." + }, + "operations": { + "type": "array", + "items": { + "enum": [ + "NO_OPERATION", + "EXACT_MATCH", + "RANGE", + "ALL_OPERATIONS" + ], + "type": "string", + "format": "enum" + }, + "description": "Encrypted operations enable when the column is using field-level encryptions. Accepted values:
- `NO_OPERATION`: No encrypted operations are allowed on this field.
- `EXACT_MATCH`: Only exact match operations are allowed on this field. This is the default for encrypted fields.
- `RANGE`: Range operations are allowed on this field. This is only applicable for fields encrypted with order-preserving encryption. Only available if query functionality is available for your deployment.
- `ALL_OPERATIONS`: All encrypted operations are allowed on this field." + }, + "tokenGroups": { + "type": "array", + "items": { + "type": "string" + }, + "description": "`name` values of token groups to apply to this JSON path. Token groups must be defined in the `tokenGroups` field in the vault schema." + } + }, + "x-visibility": [ + "external" + ] + }, + "ListAPIKeysResponse": { + "type": "object", + "properties": { + "apiKeys": { + "type": "array", + "items": { + "$ref": "#/components/schemas/APIKey" + }, + "description": "API keys for the service account." + } + }, + "description": "The service account api keys list response.", + "x-visibility": [ + "external" + ] + }, + "ListAccountsResponse": { + "type": "object", + "properties": { + "accounts": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Account" + } + } + }, + "description": "Contains array of Accounts.", + "x-visibility": [ + "external" + ] + }, + "ListVaultsResponse": { + "type": "object", + "properties": { + "vaults": { + "type": "array", + "items": { + "$ref": "#/components/schemas/ObjectVault_create-vault" + }, + "description": "List of vaults." + } + }, + "x-visibility": [ + "external" + ] + }, + "ListMembersResponse": { + "type": "object", + "properties": { + "members": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Member" + } + } + }, + "description": "Contains array of Members.", + "x-visibility": [ + "external" + ] + }, + "ListPoliciesResponse": { + "type": "object", + "properties": { + "policies": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Policy" + }, + "description": "The retrieved policies." + } + }, + "description": "List policies response.", + "x-visibility": [ + "external" + ] + }, + "ListRegionsResponse": { + "type": "object", + "properties": { + "regions": { + "type": "object", + "additionalProperties": { + "$ref": "#/components/schemas/RegionInfo" + }, + "description": "map" + } + }, + "x-visibility": [ + "external" + ] + }, + "ListResourcesResponse": { + "type": "object", + "properties": { + "resources": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Resource" + } + } + }, + "x-visibility": [ + "external" + ] + }, + "ListRolesResponse": { + "type": "object", + "properties": { + "roles": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Role" + }, + "description": "List of roles belonging to the provided resource." + } + }, + "description": "List roles response.", + "x-visibility": [ + "external" + ] + }, + "ListSTSConfigResponse": { + "type": "object", + "properties": { + "stsConfigs": { + "type": "array", + "items": { + "$ref": "#/components/schemas/STSConfig" + }, + "description": "Retrieved STS Configs." + } + }, + "x-visibility": [ + "external" + ] + }, + "ListServiceAccountKeysResponse": { + "type": "object", + "properties": { + "keys": { + "type": "array", + "items": { + "$ref": "#/components/schemas/ServiceAccountKey" + }, + "description": "The public keys for the service account." + } + }, + "description": "The service account keys list response.", + "x-visibility": [ + "external" + ] + }, + "ListServiceAccountsResponse": { + "type": "object", + "properties": { + "serviceAccounts": { + "type": "array", + "items": { + "$ref": "#/components/schemas/ServiceAccountInfo" + }, + "description": "List of service accounts." + } + }, + "description": "The service account list response.", + "x-visibility": [ + "external" + ] + }, + "ListSignedDataTokenKeyResponse": { + "type": "object", + "properties": { + "keys": { + "type": "array", + "items": { + "$ref": "#/components/schemas/SignedDataTokenKey" + }, + "description": "Signed token keys for the service account." + } + }, + "description": "List response for signed token keys.", + "x-visibility": [ + "external" + ] + }, + "ListUsersResponse": { + "type": "object", + "properties": { + "users": { + "type": "array", + "items": { + "$ref": "#/components/schemas/User" + } + } + }, + "description": "User list response.", + "x-visibility": [ + "external" + ] + }, + "ListWorkspacesResponse": { + "type": "object", + "properties": { + "workspaces": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Workspace" + } + } + }, + "description": "Contains array of workspaces.", + "x-visibility": [ + "external" + ] + }, + "MasterKey": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the master key." + }, + "type": { + "enum": [ + "INTERNAL", + "EXTERNAL" + ], + "type": "string", + "description": "Type of the master key.", + "format": "enum" + } + }, + "description": "A master key.", + "x-visibility": [ + "external" + ] + }, + "Member": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the member." + }, + "type": { + "enum": [ + "NONE", + "USER", + "GROUP", + "SERVICE_ACCOUNT", + "SQL_SERVICE_ACCOUNT" + ], + "type": "string", + "format": "enum" + }, + "name": { + "type": "string", + "description": "Name of the member." + }, + "email": { + "type": "string", + "description": "Email address of the member." + }, + "status": { + "enum": [ + "NONE", + "CREATED", + "PENDING", + "ACTIVE", + "INACTIVE", + "ARCHIVED", + "DELETED", + "CREATION_IN_PROGRESS", + "DELETION_IN_PROGRESS", + "FAILED", + "RUNNING", + "SUCCEEDED", + "DELETION_FAILED" + ], + "type": "string", + "description": "Status of the member.", + "format": "enum" + }, + "user": { + "$ref": "#/components/schemas/User" + }, + "serviceAccountInfo": { + "$ref": "#/components/schemas/ServiceAccountInfo" + }, + "BasicAudit": { + "$ref": "#/components/schemas/BasicAudit" + } + }, + "description": "Member details. *Members* are actors within an account. See `type`.", + "x-visibility": [ + "external" + ] + }, + "PermissionRestrictions": { + "type": "object", + "properties": { + "roleName": { + "type": "string", + "description": "Name of the role to restrict." + }, + "permissions": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Permissions to remove from the specified role." + } + }, + "x-visibility": [ + "external" + ] + }, + "Policy": { + "type": "object", + "properties": { + "BasicAudit": { + "$ref": "#/components/schemas/BasicAudit" + }, + "resource": { + "$ref": "#/components/schemas/Resource" + } + }, + "description": "Policy details." + }, + "PrefixPreserved": { + "type": "object", + "properties": { + "length": { + "type": "integer", + "description": "Number of characters to preserve.", + "format": "int32" + } + }, + "x-visibility": [ + "external" + ] + }, + "PreserveEmailDomain": { + "type": "object", + "properties": { + "preserveAtSymbol": { + "type": "boolean", + "description": "If `true`, preserves the `@` symbol in the email domain." + } + }, + "description": "Token subtype to preserve the email domain.", + "x-visibility": [ + "external" + ] + }, + "RecordResponseObject": { + "required": [ + "skyflowID", + "httpCode" + ], + "type": "object", + "properties": { + "skyflowID": { + "example": "eac7f72a-32f4-4cdb-875c-3cc70e67351a", + "type": "string", + "description": "Skyflow ID for the inserted record" + }, + "tokens": { + "example": { + "address": [ + { + "token": "1R9kNnLOPM", + "tokenGroupName": "det_reg_rtf" + } + ], + "age": [ + { + "token": "02696291-9694-4d46-a7e1-7e6fdbc712fd", + "tokenGroupName": "nondet" + } + ], + "name": [ + { + "token": "78a303c0-1e96-4ea4-bd67-82771a6d857a", + "tokenGroupName": "nondet_trans" + }, + { + "token": "886b8947-9a2c-43f2-a925-e98ef5f8260a", + "tokenGroupName": "det" + } + ] + }, + "type": "object", + "description": "Columns and tokens for the record." + }, + "data": { + "example": { + "address": { + "houseNumber": 123, + "city": "Deoria", + "country": "India" + }, + "age": 24, + "name": "Vivek" + }, + "type": "object", + "description": "Columns and values for the record." + }, + "hashedData": { + "example": { + "name": [ + { + "data": "b3f8b154de8a54c19c4a8b17e20f95c048d84663a04a57a8b73e5b4e0b8c4c3d", + "hashName": "hash1" + } + ], + "age": [ + { + "data": "b63b124f8b1561e0e5f7a7b5e6bdfb2081ce636bfa174b1f8a56e0f2b60abdcf", + "hashName": "hash2" + } + ] + }, + "type": "object", + "description": "Columns and hashed values for the record." + }, + "error": { + "example": "Database rate limit exceeded.", + "type": "string", + "description": "Error message, if any." + }, + "httpCode": { + "example": 200, + "type": "integer", + "description": "HTTP status code of the response.", + "format": "int32" + }, + "tableName": { + "type": "string", + "description": "Name of the table that the record belongs to." + } + } + }, + "RegionInfo": { + "type": "object", + "properties": { + "regionName": { + "type": "string" + }, + "displayName": { + "type": "string" + }, + "regionUrl": { + "type": "string" + }, + "flagUrl": { + "type": "string" + } + }, + "x-visibility": [ + "external" + ] + }, + "Resource": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the resource. For example, if `resource.type` is `VAULT`, this field is the vault ID. If `resource.type` is `WORKSPACE`, this field is the workspace ID." + }, + "type": { + "enum": [ + "NONE", + "ORGANIZATION", + "VAULT", + "ACCOUNT", + "SERVICE_ACCOUNT", + "VAULT_TEMPLATE", + "WORKSPACE", + "FIELD_TEMPLATE", + "RECORD", + "TOKEN", + "CONNECTION", + "ENCRYPTION_KEY", + "NETWORK_TOKEN", + "SUBSCRIPTION", + "PAYMENT_CONFIG", + "DETECT_CONFIG", + "ACCOUNT_UPDATER_CONFIG", + "WEBHOOK", + "TRIGGER", + "STS_CONFIG", + "TRIGGER_RUN" + ], + "type": "string", + "format": "enum" + }, + "name": { + "type": "string", + "description": "Name of the resource." + }, + "namespace": { + "type": "string", + "description": "Unique namespace for the resource. Generated by Skyflow." + }, + "description": { + "type": "string", + "description": "Description of the resource." + }, + "status": { + "enum": [ + "NONE", + "CREATED", + "PENDING", + "ACTIVE", + "INACTIVE", + "ARCHIVED", + "DELETED", + "CREATION_IN_PROGRESS", + "DELETION_IN_PROGRESS", + "FAILED", + "RUNNING", + "SUCCEEDED", + "DELETION_FAILED" + ], + "type": "string", + "description": "Status of the resource.", + "format": "enum" + }, + "displayName": { + "type": "string", + "description": "Display name of the resource that appears in user interfaces." + }, + "BasicAudit": { + "$ref": "#/components/schemas/BasicAudit" + } + }, + "description": "Component of a Skyflow account.", + "x-visibility": [ + "external" + ] + }, + "Role": { + "type": "object", + "properties": { + "definition": { + "$ref": "#/components/schemas/RoleDefinition" + }, + "BasicAudit": { + "$ref": "#/components/schemas/BasicAudit" + } + } + }, + "RoleDefinition": { + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "Name of the role. Must be unique." + }, + "displayName": { + "type": "string", + "description": "Display name of the role." + }, + "description": { + "type": "string", + "description": "Description of the role." + }, + "permissions": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Permissions granted to a role." + }, + "levels": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Levels at which this role is applied." + }, + "type": { + "enum": [ + "SYSTEM", + "CUSTOM" + ], + "type": "string", + "description": "Read-only. Type of the role.", + "format": "enum" + } + }, + "description": "Role details.", + "x-visibility": [ + "external" + ] + }, + "RotateAPIKeyRequest": { + "type": "object", + "properties": {}, + "description": "The service account api key rotate request." + }, + "RotateServiceAccountKeyRequest": { + "type": "object", + "properties": {}, + "description": "The service account key create request." + }, + "RotateSignedDataTokenKeyRequest": { + "type": "object", + "properties": {}, + "description": "Totate request for a signed token key." + }, + "RuleParams": { + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "Name of the rule." + }, + "ID": { + "type": "string", + "description": "ID of the rule. Only specify a rule ID when updating a policy." + }, + "ruleExpression": { + "type": "string", + "description": "Rule expressed as a formatted string." + }, + "columnRuleParams": { + "allOf": [ + { + "$ref": "#/components/schemas/ColumnRuleParams" + } + ], + "description": "Parameters for creating a Column-level Rule." + }, + "tableRuleParams": { + "allOf": [ + { + "$ref": "#/components/schemas/TableRuleParams" + } + ], + "description": "Parameters for creating a Table-level Rule." + }, + "tokenGroupRuleParams": { + "allOf": [ + { + "$ref": "#/components/schemas/TokenGroupRuleParams" + } + ], + "description": "Parameters for creating a TokenGroup-level Rule." + } + }, + "description": "Rule details.", + "x-visibility": [ + "external" + ] + }, + "STSConfig": { + "type": "object", + "properties": { + "ID": { + "type": "string" + }, + "name": { + "type": "string", + "description": "Name of the config." + }, + "description": { + "type": "string", + "description": "Description of the config." + }, + "issuer": { + "type": "string", + "description": "Issuer of the public keys." + }, + "publicKeyJWKURI": { + "type": "string", + "description": "Public key as JWK endpoint." + }, + "serviceAccountIDs": { + "type": "array", + "items": { + "type": "string" + }, + "description": "List of service account IDs." + }, + "contextClaims": { + "type": "array", + "items": { + "type": "string" + } + }, + "accountID": { + "type": "string" + }, + "namespace": { + "type": "string" + }, + "BasicAudit": { + "$ref": "#/components/schemas/BasicAudit" + }, + "audience": { + "type": "string", + "description": "Audience to which the subject token must belong to" + } + }, + "x-visibility": [ + "external" + ] + }, + "Schema": { + "type": "object", + "properties": {}, + "description": "`Schema` is a representation of OpenAPI v2 specification's Schema object.\n\n See: https://github.com/OAI/OpenAPI-Specification/blob/3.0.0/versions/2.0.md#schemaObject" + }, + "ServiceAccount": { + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "Name of the service account." + }, + "displayName": { + "type": "string", + "description": "Display name of the service account that appears in user interfaces." + }, + "description": { + "type": "string", + "description": "Description of the service account." + }, + "ID": { + "type": "string", + "description": "ID of the service account." + }, + "namespace": { + "type": "string", + "description": "Namespace of the service account." + }, + "status": { + "enum": [ + "ACTIVE", + "INACTIVE" + ], + "type": "string", + "description": "Status of the service account.", + "format": "enum" + }, + "BasicAudit": { + "$ref": "#/components/schemas/BasicAudit" + } + }, + "description": "Service account details.", + "x-visibility": [ + "external" + ] + }, + "ServiceAccountInfo": { + "type": "object", + "properties": { + "serviceAccount": { + "allOf": [ + { + "$ref": "#/components/schemas/ServiceAccount" + } + ], + "description": "The service account details." + }, + "clientConfiguration": { + "allOf": [ + { + "$ref": "#/components/schemas/ClientConfiguration" + } + ], + "description": "Client-side configuration for the service account." + } + }, + "description": "Information about a service account, including its configuration.", + "x-visibility": [ + "external" + ] + }, + "ServiceAccountKey": { + "type": "object", + "properties": { + "keyID": { + "type": "string", + "description": "ID of the key." + }, + "keyAlgorithm": { + "enum": [ + "KEY_ALG_RSA_2048" + ], + "type": "string", + "description": "Algorithm used for generating the key.", + "format": "enum" + }, + "privateKeyData": { + "type": "string", + "description": "The private key data. Only provided in CreateServiceAccountKey responses.", + "format": "bytes" + }, + "publicKeyData": { + "type": "string", + "description": "The public key data. Only provided in GetServiceAccountKey responses.", + "format": "bytes" + }, + "validAfterTime": { + "type": "string", + "description": "Timestamp when the key becomes valid.", + "format": "date-time" + }, + "validBeforeTime": { + "type": "string", + "description": "Timestamp the key is valid until.", + "format": "date-time" + } + }, + "description": "A service account key.", + "x-visibility": [ + "external" + ] + }, + "ServiceAccountResponse": { + "type": "object", + "properties": { + "clientID": { + "type": "string", + "description": "ID of the service account." + }, + "clientName": { + "type": "string", + "description": "Name of the service account." + }, + "tokenURI": { + "type": "string", + "description": "Token issuer URI." + }, + "keyID": { + "type": "string", + "description": "ID of the key linked with the service account." + }, + "privateKey": { + "type": "string", + "description": "Key linked with the service account." + }, + "keyValidAfterTime": { + "type": "string", + "description": "Timestamp when the key becomes valid.", + "format": "date-time" + }, + "keyValidBeforeTime": { + "type": "string", + "description": "Timestamp the key is valid until.", + "format": "date-time" + }, + "apiKeyID": { + "type": "string", + "description": "ID of the API key linked with the service account." + }, + "apiKey": { + "type": "string", + "description": "API key linked with the service account." + }, + "keyAlgorithm": { + "enum": [ + "KEY_ALG_RSA_2048" + ], + "type": "string", + "description": "Algorithm used for generating the key.", + "format": "enum" + } + }, + "x-visibility": [ + "external" + ] + }, + "SignedDataTokenKey": { + "type": "object", + "properties": { + "keyID": { + "type": "string", + "description": "ID of the signed token key." + }, + "keyAlgorithm": { + "enum": [ + "KEY_ALG_RSA_2048" + ], + "type": "string", + "description": "Algorithm used for generating the key.", + "format": "enum" + }, + "privateKeyData": { + "type": "string", + "description": "The private key data.", + "format": "bytes" + }, + "publicKeyData": { + "type": "string", + "description": "The public key data.", + "format": "bytes" + }, + "validAfterTime": { + "type": "string", + "description": "Timestamp when the key becomes valid.", + "format": "date-time" + }, + "validBeforeTime": { + "type": "string", + "description": "Timestamp the key is valid until.", + "format": "date-time" + } + }, + "x-visibility": [ + "external" + ] + }, + "SignedDataTokenKeyResponse": { + "type": "object", + "properties": { + "clientID": { + "type": "string", + "description": "ID of the service account." + }, + "clientName": { + "type": "string", + "description": "Name of the service account." + }, + "tokenURI": { + "type": "string", + "description": "Token issuer URI." + }, + "keyID": { + "type": "string", + "description": "ID of the key linked with the service account." + }, + "privateKey": { + "type": "string", + "description": "Private key linked with the service account." + }, + "keyValidAfterTime": { + "type": "string", + "description": "Timestamp when the key becomes valid.", + "format": "date-time" + }, + "keyValidBeforeTime": { + "type": "string", + "description": "Timestamp the key is valid until.", + "format": "date-time" + } + }, + "x-visibility": [ + "external" + ] + }, + "TableRuleParams": { + "type": "object", + "properties": { + "vaultID": { + "type": "string", + "description": "ID of the vault that contains the table." + }, + "tableName": { + "type": "string", + "description": "Name of the table that the rule applies to." + }, + "action": { + "enum": [ + "ALL", + "CREATE", + "READ", + "UPDATE", + "DELETE", + "TOKENIZATION", + "DETOKENIZATION" + ], + "type": "string", + "description": "Action that applies to the rule. Deprecated: use `actions` instead.", + "format": "enum" + }, + "effect": { + "enum": [ + "DENY", + "ALLOW" + ], + "type": "string", + "description": "Effect of the rule (ALLOW or DENY).", + "format": "enum" + }, + "rowFilter": { + "type": "string", + "description": "SQL expression that applies a filter on all rows of a table." + }, + "actions": { + "type": "array", + "items": { + "enum": [ + "ALL", + "CREATE", + "READ", + "UPDATE", + "DELETE", + "TOKENIZATION", + "DETOKENIZATION" + ], + "type": "string", + "format": "enum" + }, + "description": "Actions that apply to the rule.\n`TOKENIZATION` is unavailable for VaultLH vaults with schemas." + } + }, + "description": "Table-level rule details.", + "x-visibility": [ + "external" + ] + }, + "Tag": { + "type": "object", + "properties": {}, + "description": "`Tag` is a representation of OpenAPI v2 specification's Tag object.\n\n See: https://github.com/OAI/OpenAPI-Specification/blob/3.0.0/versions/2.0.md#tagObject" + }, + "TokenGroupConstraint": { + "type": "object", + "properties": { + "dataType": { + "enum": [ + "STRING", + "NUMBER", + "BOOL", + "JSON" + ], + "type": "string", + "description": "Data type of the column. Accepted values:
- `STRING`: String values.
- `NUMBER`: Numeric values.
- `BOOL`: Boolean values.
- `JSON`: JSON values.", + "format": "enum" + }, + "inputValidation": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Regex patterns the input values can match. Input values must match at least one regex pattern. Only applicable if `dataType` is `STRING`." + }, + "redactions": { + "type": "array", + "items": { + "type": "string" + }, + "description": "`name` values of redactions applied to the token group. Redactions must be defined in the `redactions` field in the vault schema." + } + }, + "description": "Input contraints for columns in the token group.", + "x-visibility": [ + "external" + ] + }, + "TokenGroupRedactions": { + "type": "object", + "properties": { + "tokenGroupName": { + "example": "deterministic", + "type": "string", + "description": "Name of the token group to redact." + }, + "redaction": { + "example": "plain_text", + "type": "string", + "description": "Name of the redaction to perform." + } + } + }, + "TokenGroupRuleParams": { + "type": "object", + "properties": { + "vaultID": { + "type": "string", + "description": "ID of the vault that contains the token group(s)." + }, + "tokenGroups": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Token group(s) that the rule applies to." + }, + "action": { + "enum": [ + "ALL", + "CREATE", + "READ", + "UPDATE", + "DELETE", + "TOKENIZATION", + "DETOKENIZATION" + ], + "type": "string", + "description": "Action that applies to the rule. Deprecated: use `actions` instead.", + "format": "enum" + }, + "effect": { + "enum": [ + "DENY", + "ALLOW" + ], + "type": "string", + "description": "Effect of the rule (ALLOW or DENY).", + "format": "enum" + }, + "rowFilter": { + "type": "string", + "description": "SQL expression that applies a filter on all rows of a table." + }, + "redaction": { + "type": "string", + "description": "Redaction type applied to values in the specified columns group(s)." + }, + "actions": { + "type": "array", + "items": { + "enum": [ + "ALL", + "CREATE", + "READ", + "UPDATE", + "DELETE", + "TOKENIZATION", + "DETOKENIZATION" + ], + "type": "string", + "format": "enum" + }, + "description": "Actions that apply to the rule." + } + }, + "description": "Token group-level rule details.", + "x-visibility": [ + "external" + ] + }, + "TokenSubType": { + "type": "object", + "properties": { + "prefixPreserved": { + "allOf": [ + { + "$ref": "#/components/schemas/PrefixPreserved" + } + ], + "description": "Preserve the right m characters of the value and redact the rest. Only applicable for format-preserving tokenization." + }, + "preserveEmailDomain": { + "allOf": [ + { + "$ref": "#/components/schemas/PreserveEmailDomain" + } + ], + "description": "Preserve the email domain of the value and redact the rest. Only applicable for format-preserving tokenization." + } + }, + "description": "Subtype of the token group.", + "x-visibility": [ + "external" + ] + }, + "UnassignPolicyRequest": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the policy." + }, + "roleIDs": { + "type": "array", + "items": { + "type": "string" + }, + "description": "IDs of the roles to unassign the policy from." + }, + "members": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Member" + }, + "description": "Members to unassign the policy from." + } + }, + "description": "Unassign policy request.", + "x-visibility": [ + "external" + ] + }, + "UnassignPolicyResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the unassigned policy." + } + }, + "description": "Unassign policy response.", + "x-visibility": [ + "external" + ] + }, + "UnassignRoleRequest": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the role." + }, + "members": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Member" + }, + "description": "Members to remove the role from." + } + }, + "description": "Unassign role request.", + "x-visibility": [ + "external" + ] + }, + "UnassignRoleResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the unassigned role." + } + }, + "description": "Unassign role response.", + "x-visibility": [ + "external" + ] + }, + "UniqueColumnsList": { + "required": [ + "values" + ], + "type": "object", + "properties": { + "values": { + "type": "array", + "items": { + "type": "string" + }, + "description": "List of unique columns for the table. The combination of values in these columns must be unique within the records in the table." + } + }, + "description": "List of unique columns for a table.", + "x-visibility": [ + "external" + ] + }, + "UniqueValue": { + "required": [ + "data" + ], + "type": "object", + "properties": { + "data": { + "example": { + "name": "john wick", + "email": "jhon@example.com" + }, + "type": "object", + "description": "Columns names and values for the unique value entry." + } + } + }, + "UpdateAccountRequest": { + "type": "object", + "properties": { + "account": { + "allOf": [ + { + "$ref": "#/components/schemas/Account" + } + ], + "description": "entity to update." + } + }, + "description": "Request data to update todo task.", + "x-visibility": [ + "external" + ] + }, + "UpdateAccountResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string" + } + }, + "description": "Contains status of update operation.", + "x-visibility": [ + "external" + ] + }, + "UpdateVaultRequest": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "Unique ID of the vault." + }, + "name": { + "type": "string", + "description": "Name of the vault." + }, + "description": { + "type": "string", + "description": "Description of the vault." + }, + "schema": { + "allOf": [ + { + "$ref": "#/components/schemas/VaultLhVaultSchema" + } + ], + "description": "Vault schema." + }, + "dryRun": { + "type": "boolean", + "description": "If true, validates the request without executing it." + }, + "skipDataValidation": { + "type": "boolean", + "description": "If true, skips data validation." + } + }, + "x-visibility": [ + "external" + ] + }, + "UpdateVaultResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the updated vault." + }, + "schemaValid": { + "type": "boolean", + "description": "Indicates if the schema is valid. Populated if dryRun is true." + }, + "validationErrors": { + "type": "array", + "items": { + "$ref": "#/components/schemas/VaultValidationError" + }, + "description": "Validation errors if any. Populated if dryRun is true." + } + }, + "x-visibility": [ + "external" + ] + }, + "UpdatePolicyRequest": { + "type": "object", + "properties": { + "policy": { + "allOf": [ + { + "$ref": "#/components/schemas/Policy" + } + ], + "description": "The policy object with updated values." + }, + "ruleParams": { + "type": "array", + "items": { + "$ref": "#/components/schemas/RuleParams" + }, + "description": "Rules that comprise the policy." + } + }, + "description": "Update policy request.", + "x-visibility": [ + "external" + ] + }, + "UpdatePolicyResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the updated policy." + } + }, + "description": "Update policy response.", + "x-visibility": [ + "external" + ] + }, + "UpdateRecordData": { + "required": [ + "skyflowID", + "data" + ], + "type": "object", + "properties": { + "skyflowID": { + "example": "eac7f72a-32f4-4cdb-875c-3cc70e67351a", + "type": "string", + "description": "Skyflow ID of the record to update." + }, + "data": { + "example": { + "address": { + "houseNumber": 123, + "city": "Deoria", + "country": "India" + }, + "age": 24, + "name": "Vivek" + }, + "type": "object", + "description": "Columns and values for the record." + }, + "tableName": { + "type": "string", + "description": "Name of the table to update data in." + } + } + }, + "UpdateRequest": { + "required": [ + "vaultID", + "tableName", + "records" + ], + "type": "object", + "properties": { + "vaultID": { + "example": "d408485953784308a000f8dcf81901ef", + "type": "string", + "description": "ID of the vault." + }, + "tableName": { + "example": "employees", + "type": "string", + "description": "Name of the table." + }, + "records": { + "example": [ + { + "skyflowID": "97cdd1af-02ac-47eb-ab0d-8339dbef6ccb", + "data": { + "name": "Vivek", + "email": "asad.public5@gmail.com", + "age": 25, + "adult": true, + "address": { + "city": "aligarh", + "country": "India" + } + } + }, + { + "skyflowID": "aed32bbc-e7a4-4c7b-8c88-7f52ce8cb066", + "data": { + "name": "Asad", + "email": "asad.public7@gmail.com", + "age": 24, + "adult": false, + "address": { + "city": "deoria", + "country": "India" + } + } + } + ], + "type": "array", + "items": { + "$ref": "#/components/schemas/UpdateRecordData" + }, + "description": "Data to update as a list of records." + } + } + }, + "UpdateResponse": { + "required": [ + "records" + ], + "type": "object", + "properties": { + "records": { + "example": [ + { + "skyflowID": "97cdd1af-02ac-47eb-ab0d-8339dbef6ccb", + "tokens": { + "address": [ + { + "token": "rRTiEDjen9", + "tokenGroupName": "det_reg_rtf" + } + ], + "adult": [ + { + "token": "3af6bc7a-290e-460d-b05b-c5460e4ac45c", + "tokenGroupName": "nondet" + } + ], + "age": [ + { + "token": "d87e8eff-1760-42bf-b49b-a05c8bd7752b", + "tokenGroupName": "nondet" + } + ], + "email": [ + { + "token": "6a37c40a-7e4a-4f6b-b202-a84ca6a5857e", + "tokenGroupName": "det_rtf" + }, + { + "token": "glftzPOEqY", + "tokenGroupName": "det_reg" + } + ], + "name": [ + { + "token": "950b46dd-bdf8-43b6-b8e1-477125c97b80", + "tokenGroupName": "nondet_trans" + }, + { + "token": "d2d52f24-a441-4748-8c78-5432e73cfd75", + "tokenGroupName": "det" + } + ] + }, + "data": { + "address": { + "city": "aligarh", + "country": "India" + }, + "adult": true, + "age": 25, + "email": "asad.public5@gmail.com", + "name": "Vivek" + }, + "error": null, + "httpCode": 200 + }, + { + "skyflowID": "aed32bbc-e7a4-4c7b-8c88-7f52ce8cb066", + "tokens": { + "address": [ + { + "token": "yrzXJMtHO2", + "tokenGroupName": "det_reg_rtf" + } + ], + "adult": [ + { + "token": "b8fd49ff-4973-481f-a188-1e0967c72dd1", + "tokenGroupName": "nondet" + } + ], + "age": [ + { + "token": "0e305463-05cc-428c-aada-c9af41d89152", + "tokenGroupName": "nondet" + } + ], + "email": [ + { + "token": "cc8182e3-c94a-4e27-9cb5-ce1c5bccc1b1", + "tokenGroupName": "det_rtf" + }, + { + "token": "dmqxUB22IV", + "tokenGroupName": "det_reg" + } + ], + "name": [ + { + "token": "19d252b9-194f-4547-8240-08c8026b7e5a", + "tokenGroupName": "nondet_trans" + }, + { + "token": "86df1c7d-5b30-4dd5-a97c-8556bbb76005", + "tokenGroupName": "det" + } + ] + }, + "data": { + "address": { + "city": "deoria", + "country": "India" + }, + "adult": false, + "age": 24, + "email": "asad.public7@gmail.com", + "name": "Asad" + }, + "error": null, + "httpCode": 200 + } + ], + "type": "array", + "items": { + "$ref": "#/components/schemas/RecordResponseObject" + }, + "description": "List of updated records." + } + } + }, + "UpdateRoleRequest": { + "type": "object", + "properties": { + "roleDefinition": { + "allOf": [ + { + "$ref": "#/components/schemas/RoleDefinition" + } + ], + "description": "Updated role definition." + } + }, + "description": "Update role request.", + "x-visibility": [ + "external" + ] + }, + "UpdateRoleResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the updated role." + } + }, + "description": "Update role response.", + "x-visibility": [ + "external" + ] + }, + "UpdateSTSConfigRequest": { + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "Name of the config." + }, + "description": { + "type": "string", + "description": "Description of the STS configuration." + }, + "issuer": { + "type": "string", + "description": "Issuer of the public keys." + }, + "publicKeyJWKURI": { + "type": "string", + "description": "Public keys as JWK endpoint." + }, + "contextClaims": { + "type": "array", + "items": { + "type": "string" + } + }, + "serviceAccountIDs": { + "type": "array", + "items": { + "type": "string" + }, + "description": "List of service account IDs." + }, + "audience": { + "type": "string", + "description": "Audience to which the subject token must belong to" + } + }, + "x-visibility": [ + "external" + ] + }, + "UpdateServiceAccountRequest": { + "type": "object", + "properties": { + "serviceAccount": { + "allOf": [ + { + "$ref": "#/components/schemas/ServiceAccount" + } + ], + "description": "Updated service account details." + }, + "clientConfiguration": { + "allOf": [ + { + "$ref": "#/components/schemas/ClientConfiguration" + } + ], + "description": "Client configuration for the service account." + } + }, + "description": "Update service account request.", + "x-visibility": [ + "external" + ] + }, + "UpdateUserRequest": { + "type": "object", + "properties": { + "user": { + "$ref": "#/components/schemas/User" + } + }, + "description": "User update request.", + "x-visibility": [ + "external" + ] + }, + "UpdateUserResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the updated user." + } + }, + "description": "User update response.", + "x-visibility": [ + "external" + ] + }, + "UpdateWorkspaceRequest": { + "type": "object", + "properties": { + "workspace": { + "$ref": "#/components/schemas/Workspace" + } + }, + "description": "Request data to update an Workspace.", + "x-visibility": [ + "external" + ] + }, + "UpdateWorkspaceResponse": { + "type": "object", + "properties": { + "ID": { + "type": "string" + } + }, + "description": "Contains status of update operation.", + "x-visibility": [ + "external" + ] + }, + "UploadVaultSecretsRequest": { + "type": "object", + "properties": { + "vaultID": { + "type": "string", + "description": "ID of the vault." + }, + "secrets": { + "type": "array", + "items": { + "$ref": "#/components/schemas/VaultSecret" + }, + "description": "Secrets to upload." + } + }, + "x-visibility": [ + "external" + ] + }, + "UploadVaultSecretsResponse": { + "type": "object", + "properties": { + "vaultID": { + "type": "string", + "description": "ID of the vault." + } + }, + "x-visibility": [ + "external" + ] + }, + "Upsert": { + "required": [ + "uniqueColumns" + ], + "type": "object", + "properties": { + "uniqueColumns": { + "example": [ + "email", + "phone_number" + ], + "type": "array", + "items": { + "type": "string" + }, + "description": "List of unique columns in the table that upsert operations use to identify if a record with matching values exists. If a matching record exists, the record updates with the specified values. If a matching record doesn't exist, the upsert operation inserts a new record." + } + }, + "description": "Upsert details.", + "x-visibility": [ + "external" + ] + }, + "User": { + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "Name of the user." + }, + "contactAddress": { + "$ref": "#/components/schemas/Address" + }, + "userIdentity": { + "$ref": "#/components/schemas/UserIdentity" + }, + "ID": { + "type": "string", + "description": "ID of the user. Generated by Skyflow." + }, + "status": { + "enum": [ + "NONE", + "CREATED", + "PENDING", + "ACTIVE", + "INACTIVE", + "ARCHIVED", + "DELETED", + "CREATION_IN_PROGRESS", + "DELETION_IN_PROGRESS", + "FAILED", + "RUNNING", + "SUCCEEDED", + "DELETION_FAILED" + ], + "type": "string", + "description": "Status of the user.", + "format": "enum" + }, + "BasicAudit": { + "$ref": "#/components/schemas/BasicAudit" + } + }, + "description": "User details.", + "x-visibility": [ + "external" + ] + }, + "UserIdentity": { + "type": "object", + "properties": { + "email": { + "type": "string", + "description": "Email address of the user." + }, + "oktaID": { + "type": "string", + "description": "Okta ID of the user." + } + }, + "description": "Identity information of the user.", + "x-visibility": [ + "external" + ] + }, + "Workspace": { + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "Name of the workspace." + }, + "displayName": { + "type": "string", + "description": "Display name of the workspace that appears in user interfaces." + }, + "description": { + "type": "string", + "description": "Description of the workspace." + }, + "ID": { + "type": "string", + "description": "ID of the workspace. Generated by Skyflow." + }, + "namespace": { + "type": "string", + "description": "Namespace that uniquely identifies the workspace." + }, + "contactAddress": { + "$ref": "#/components/schemas/Address" + }, + "status": { + "enum": [ + "NONE", + "CREATED", + "PENDING", + "ACTIVE", + "INACTIVE", + "ARCHIVED", + "DELETED", + "CREATION_IN_PROGRESS", + "DELETION_IN_PROGRESS", + "FAILED", + "RUNNING", + "SUCCEEDED", + "DELETION_FAILED" + ], + "type": "string", + "description": "Status of the workspace.", + "format": "enum" + }, + "BasicAudit": { + "$ref": "#/components/schemas/BasicAudit" + }, + "type": { + "enum": [ + "NONE_TYPE", + "SANDBOX", + "PRODUCTION" + ], + "type": "string", + "description": "Type of the workspace.", + "format": "enum" + }, + "url": { + "type": "string", + "description": "URL of the workspace." + }, + "limits": { + "allOf": [ + { + "$ref": "#/components/schemas/Workspace_Limits" + } + ], + "description": "Limits applied to the workspace and its contained resources." + }, + "regionID": { + "type": "string", + "description": "ID of the workspace's region." + } + }, + "description": "Workspace details.", + "x-visibility": [ + "external" + ] + }, + "Workspace_Limits": { + "type": "object", + "properties": { + "vaultCountLimit": { + "type": "string", + "description": "Maximum number of vaults." + }, + "vaultSizeLimit": { + "type": "string", + "description": "Maximum size of a vault." + }, + "vaultOwnerLimit": { + "type": "string", + "description": "Maximum number of owners for a vault." + }, + "permissionRestrictions": { + "type": "array", + "items": { + "$ref": "#/components/schemas/PermissionRestrictions" + }, + "description": "Permissions removed from specified roles." + }, + "enableExternalSharing": { + "type": "boolean", + "description": "Identifier for whether vaults can be shared externally." + } + }, + "x-visibility": [ + "external" + ] + }, + "http_code": { + "description": "HTTP status codes. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Status.", + "x-visibility": [ + "external" + ], + "type": "integer", + "format": "int32", + "minimum": 100, + "maximum": 599 + }, + "error_response": { + "type": "object", + "additionalProperties": false, + "required": [ + "error" + ], + "properties": { + "error": { + "type": "object", + "additionalProperties": false, + "required": [ + "grpc_code", + "http_code", + "http_status", + "message" + ], + "properties": { + "grpc_code": { + "description": "gRPC status codes. See https://grpc.io/docs/guides/status-codes.", + "type": "integer", + "format": "int32", + "minimum": 0, + "maximum": 16 + }, + "http_code": { + "$ref": "#/components/schemas/http_code" + }, + "http_status": { + "type": "string", + "maxLength": 100 + }, + "message": { + "type": "string", + "maxLength": 1000 + }, + "details": { + "type": "array", + "maxItems": 25, + "items": { + "x-visibility": [ + "external" + ], + "type": "object", + "additionalProperties": true + } + } + } + } + } + }, + "FlowColumnSchema_create-vault": { + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "Name of the column." + }, + "description": { + "type": "string", + "description": "Description of the column." + }, + "tableName": { + "type": "string", + "description": "Name of the table that contains this column." + }, + "dataType": { + "enum": [ + "STRING", + "NUMBER", + "BOOL", + "JSON" + ], + "type": "string", + "description": "Data type of the column. Accepted values:
- `STRING`: String values.
- `NUMBER`: Numeric values.
- `BOOL`: Boolean values.
- `JSON`: JSON values.", + "format": "enum" + }, + "tokenGroups": { + "type": "array", + "items": { + "type": "string" + }, + "description": "`name` values of token groups this column belongs to. Token groups must be defined in the `tokenGroups` field in the vault schema." + }, + "operations": { + "type": "array", + "items": { + "enum": [ + "NO_OPERATION", + "EXACT_MATCH", + "RANGE", + "ALL_OPERATIONS" + ], + "type": "string", + "format": "enum" + }, + "description": "Encrypted operations enable when the column is using field-level encryptions. Accepted values:
- `NO_OPERATION`: No encrypted operations are allowed on this column.
- `EXACT_MATCH`: Only exact match operations are allowed on this column. This is the default for encrypted columns.
- `RANGE`: Range operations are allowed on this column. This is only applicable for columns encrypted with order-preserving encryption. Only available if query functionality is available for your deployment.
- `ALL_OPERATIONS`: All encrypted operations are allowed on this column." + }, + "notNull": { + "type": "boolean", + "default": false, + "description": "If `true`, the column must contain a non-null value." + }, + "inputValidation": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Regular expression to validate input values for this column. Input values must match at least one pattern. Only applicable if `dataType` is `STRING`." + }, + "redactions": { + "type": "array", + "items": { + "type": "string" + }, + "description": "`name` values of redactions applied to this column. Redactions must be defined in the `redactions` field in the vault schema." + }, + "hashings": { + "type": "array", + "items": { + "type": "string" + }, + "description": "`name` values of hashings for this column. Hashings must be defined in the `hashings` field in the vault schema." + }, + "inner": { + "type": "array", + "items": { + "$ref": "#/components/schemas/JsonSpecifications" + }, + "description": "Operations and tokenization settings for JSON paths within the column value. Only applicable if `dataType` is `JSON`." + } + }, + "x-visibility": [ + "external" + ] + }, + "FlowTableSchema_create-vault": { + "required": [ + "name" + ], + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "Name of the table." + }, + "unique": { + "type": "array", + "items": { + "$ref": "#/components/schemas/UniqueColumnsList" + }, + "description": "Unique columns for the table." + }, + "deleteTTL": { + "type": "string", + "description": "TTL in days for the records of the table. By default, the records aren't automatically deleted." + } + }, + "x-visibility": [ + "external" + ] + }, + "Hashing_create-vault": { + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "Unique name for this hashing configuration. This name must be referenced when uploading the associated secret via `UploadVaultSecrets`, and in each column's `hashings` array to subscribe the column to this configuration." + }, + "algorithm": { + "enum": [ + "SHA256" + ], + "type": "string", + "description": "Hash algorithm used to compute the hash value. Accepted values: `SHA256` — uses the SHA-256 algorithm.", + "format": "enum" + } + }, + "description": "A hashing configuration that computes a deterministic cryptographic hash of column data during Insert, Get, and Update operations. Hash values are not stored; they are recomputed on every read and write. Each hashing configuration requires a corresponding secret uploaded via `UploadVaultSecrets`, which acts as an HMAC key. An empty string is a valid secret.", + "x-visibility": [ + "external" + ] + }, + "MaskRedaction_create-vault": { + "required": [ + "name", + "findPattern", + "replacePattern" + ], + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "Name of the redaction. Can't be reserved strings 'plain_text' or 'redacted'." + }, + "findPattern": { + "type": "string", + "description": "Regular expression used to identify specific patterns within a field that need to be masked." + }, + "replacePattern": { + "type": "string", + "description": "Regular expression or string with special characters used to replace the found pattern in the data. For example, if `findPattern` is `\\\\d{4}$` and `replacePattern` is `XXXX`, the last 4 digits of the value will be replaced with `XXXX`." + } + }, + "x-visibility": [ + "external" + ] + }, + "TokenGroup_create-vault": { + "required": [ + "name", + "type" + ], + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "Name of the token group." + }, + "type": { + "enum": [ + "DETERMINISTIC", + "NONDETERMINISTIC" + ], + "type": "string", + "description": "Token type used for the token group. Accepted values:
- `DETERMINISTIC`: Use deterministic tokenization, where the same input value always produces the same token.
- `NONDETERMINISTIC`: Use non-deterministic tokenization, where the same input value can produce different tokens.", + "format": "enum" + }, + "format": { + "enum": [ + "UUID", + "FPT" + ], + "type": "string", + "description": "Token format used in the token group. Accepted values:
- `UUID`: Use random tokenization, where generated tokens aren't associated with the original value.
- `FPT`: Use format-preserving tokenization, where tokens are generated in the a format based on the original value.", + "format": "enum" + }, + "transientTime": { + "type": "integer", + "description": "Time in seconds for the token to live.\n Transient tokens can't be queried based on token.", + "format": "int32" + }, + "regex": { + "type": "string", + "description": "Regular expression to define the token format.\n Only applicable if `format` is `FPT`." + }, + "rightToForget": { + "type": "boolean", + "description": "If `true`, the tokens are deleted when all corresponding values are deleted from the column.\n Only applicable if `type` is `DETERMINISTIC`." + }, + "subType": { + "allOf": [ + { + "$ref": "#/components/schemas/TokenSubType" + } + ], + "description": "Subtype of the token group. Only applicable if `format` is `FPT`." + }, + "constraints": { + "allOf": [ + { + "$ref": "#/components/schemas/TokenGroupConstraint" + } + ], + "description": "Input constraints for columns in this token group." + }, + "skipValidationForBYOT": { + "type": "boolean", + "default": false, + "description": "If `true`, tokens inserted (via BYOT) aren't validated against patterns defined in token group, including format, regex and subtype. Default value is `false`. This field is immutable and can only be set when you create the token group." + } + }, + "description": "Token group details.", + "x-visibility": [ + "external" + ] + }, + "ObjectVault_create-vault": { + "type": "object", + "properties": { + "ID": { + "type": "string", + "description": "ID of the vault." + }, + "BasicAudit": { + "allOf": [ + { + "$ref": "#/components/schemas/BasicAudit" + } + ], + "description": "Audit metadata for the vault." + }, + "name": { + "type": "string", + "description": "Name of the vault." + }, + "description": { + "type": "string", + "description": "Description of the vault." + }, + "schemas": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Schema" + }, + "description": "Schemas in the vault." + }, + "namespace": { + "type": "string", + "description": "Namespace of the vault." + }, + "status": { + "enum": [ + "CREATED", + "PENDING", + "ACTIVE", + "INACTIVE", + "ARCHIVED", + "DELETED", + "CREATION_IN_PROGRESS", + "DELETION_IN_PROGRESS", + "FAILED", + "RUNNING", + "SUCCEEDED" + ], + "type": "string", + "description": "Status of the vault.", + "format": "enum" + }, + "tags": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Tag" + }, + "description": "Vault-level tags." + }, + "openapiSpec": { + "type": "string", + "description": "OpenAPI document for the vault." + }, + "useMasterKey": { + "allOf": [ + { + "$ref": "#/components/schemas/MasterKey" + } + ], + "description": "Master Key used to encrypt data keys." + } + }, + "description": "A vault.", + "x-visibility": [ + "external" + ] + } + }, + "securitySchemes": { + "Bearer": { + "type": "http", + "description": "Access token, prefixed by `Bearer `.", + "scheme": "bearer", + "bearerFormat": "JWT" + } + }, + "headers": { + "x-request-id": { + "description": "Unique identifier for the request.", + "schema": { + "type": "string", + "minLength": 36, + "maxLength": 36 + }, + "example": "d4410ea0-1d83-473c-a09a-24c6b03096d4" + } + }, + "examples": { + "400_response": { + "value": { + "error": { + "grpc_code": 3, + "http_code": 400, + "http_status": "Bad Request", + "message": "The request was invalid or cannot be served. Check the request parameters and try again.", + "details": [] + } + } + }, + "401_response": { + "value": { + "error": { + "grpc_code": 16, + "http_code": 401, + "http_status": "Unauthorized", + "message": "The request is unauthorized. Make sure you have a valid access token.", + "details": [] + } + } + }, + "404_response": { + "value": { + "error": { + "grpc_code": 5, + "http_code": 404, + "http_status": "Not Found", + "message": "The requested resource wasn't found.", + "details": [] + } + } + }, + "500_response": { + "value": { + "error": { + "grpc_code": 13, + "http_code": 500, + "http_status": "Internal Server Error", + "message": "Skyflow services experienced an internal error. Contact Skyflow support with request ID d4410ea0-1d83-473c-a09a-24c6b03096d4 for more information.", + "details": [] + } + } + }, + "403_response": { + "value": { + "error": { + "grpc_code": 7, + "http_code": 403, + "http_status": "Forbidden", + "message": "The requester does not have permission to access this resource.", + "details": [] + } + } + }, + "429_response": { + "value": { + "error": { + "grpc_code": 8, + "http_code": 429, + "http_status": "Too Many Requests", + "message": "The requester has exceeded the rate limit. Retry the request after a delay.", + "details": [] + } + } + } + }, + "responses": { + "207": { + "description": "Returned when a bulk request partially succeeds. Check per-record status codes and error messages in the response body.", + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + }, + "content": { + "application/json": { + "schema": { + "type": "object", + "additionalProperties": true + } + } + } + }, + "400": { + "description": "Returned when the request is invalid or cannot be served.", + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + }, + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/error_response" + }, + "examples": { + "Bad request": { + "$ref": "#/components/examples/400_response" + } + } + } + } + }, + "401": { + "description": "Returned when the request is unauthorized.", + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + }, + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/error_response" + }, + "examples": { + "Unauthorized": { + "$ref": "#/components/examples/401_response" + } + } + } + } + }, + "403": { + "description": "Returned when the requester lacks permission to access the resource.", + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + }, + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/error_response" + }, + "examples": { + "Forbidden": { + "$ref": "#/components/examples/403_response" + } + } + } + } + }, + "404": { + "description": "Returned when a resource doesn't exist.", + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + }, + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/error_response" + }, + "examples": { + "Not found": { + "$ref": "#/components/examples/404_response" + } + } + } + } + }, + "429": { + "description": "Returned when the requester has exceeded the rate limit.", + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + }, + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/error_response" + }, + "examples": { + "Too many requests": { + "$ref": "#/components/examples/429_response" + } + } + } + } + }, + "500": { + "description": "An unexpected error response.", + "headers": { + "X-Request-ID": { + "$ref": "#/components/headers/x-request-id" + } + }, + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/error_response" + }, + "examples": { + "Internal server error": { + "$ref": "#/components/examples/500_response" + } + } + } + } + } + } + } +} \ No newline at end of file