{ "components": { "schemas": { "authwise.tenancy.v1alpha1.CreateMyTenantRequest": { "properties": { "displayName": { "description": "Required. The tenant's name; at most 255 characters.", "type": "string" }, "home": { "description": "The install to host the tenant, one of tenancy.selfService.homes. Optional when exactly one is configured.", "type": "string" }, "slug": { "description": "Required. The label of the tenant's native host: 3-40 characters, a DNS label, not reserved, unique. Immutable.", "type": "string" } }, "type": "object" }, "authwise.tenancy.v1alpha1.InviteTenantAdministratorResponse": { "properties": { "acceptUrl": { "description": "INVITED only: the link the mail carries, the only copy of the invitation's token.", "type": "string" }, "deliveryMessageId": { "description": "Platform's id for the message when one was enqueued.", "type": "string" }, "deliveryReason": { "description": "Why the message was not queued.", "type": "string" }, "deliveryStatus": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.MessageDeliveryStatus" }, "expiresAt": { "description": "INVITED only: when the invitation lapses.", "format": "date-time", "type": "string" }, "outcome": { "description": "INVITED: a new account was invited and seated. SEATED: the address already signs in, and that account was seated and told.", "type": "string" }, "subjectId": { "description": "The administrator (u-…), new or existing.", "type": "string" }, "tenantMembership": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.TenantMembership" } }, "type": "object" }, "authwise.tenancy.v1alpha1.ListMyTenantsResponse": { "properties": { "nextPageToken": { "type": "string" }, "tenantMemberships": { "items": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.TenantMembership" }, "type": "array" } }, "type": "object" }, "authwise.tenancy.v1alpha1.ListServiceAccountsResponse": { "properties": { "nextPageToken": { "type": "string" }, "serviceAccounts": { "items": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.ServiceAccount" }, "type": "array" } }, "type": "object" }, "authwise.tenancy.v1alpha1.ListTenantMembershipsResponse": { "properties": { "nextPageToken": { "type": "string" }, "tenantMemberships": { "items": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.TenantMembership" }, "type": "array" } }, "type": "object" }, "authwise.tenancy.v1alpha1.MintServiceAccountSecretResponse": { "properties": { "audience": { "description": "The audience to ask for: the estate audience the admin API accepts.", "type": "string" }, "rotatedSecrets": { "description": "With rotate, how many previous secrets now lapse at the end of the grace.", "format": "int32", "type": "integer" }, "secret": { "description": "The client_secret, shown this once. It is stored only as a salted digest.", "type": "string" }, "serviceAccount": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.ServiceAccount" }, "tokenUrl": { "description": "Where to exchange it: the admin issuer's token endpoint.", "type": "string" } }, "type": "object" }, "authwise.tenancy.v1alpha1.SelfServiceTenant": { "properties": { "createdAt": { "description": "Output only.", "format": "date-time", "readOnly": true, "type": "string" }, "displayName": { "description": "Output only. The name the owner asked for.", "readOnly": true, "type": "string" }, "home": { "description": "Output only. install.name of the one install that may host the tenant: where MaterializeMyTenant and every write after it go.", "readOnly": true, "type": "string" }, "name": { "description": "Output only. tenants/{tenant}/self-service.", "readOnly": true, "type": "string" }, "owner": { "description": "Output only. The subject (u-…) who created it and holds its OWNER seat.", "readOnly": true, "type": "string" }, "slug": { "description": "Output only. The native-host label the owner chose, \u003cslug\u003e.id.\u003cestate\u003e.", "readOnly": true, "type": "string" }, "tenantId": { "description": "Output only. The tenant's AWID (t-…), minted by central. The row does not exist until MaterializeMyTenant on the home.", "readOnly": true, "type": "string" } }, "type": "object" }, "authwise.tenancy.v1alpha1.ServiceAccount": { "properties": { "clientId": { "description": "Output only. The client's AWID (c-…): the client_id at the token endpoint and the subject its tokens carry.", "readOnly": true, "type": "string" }, "createdAt": { "description": "Output only.", "format": "date-time", "readOnly": true, "type": "string" }, "displayName": { "description": "Required on create, unique within the tenant's service accounts.", "type": "string" }, "expiresAt": { "description": "When set, the token endpoint refuses the account after it. Optional on create; never changed here.", "format": "date-time", "type": "string" }, "name": { "description": "Output only. tenants/{tenant}/service-accounts/{client}.", "readOnly": true, "type": "string" }, "roles": { "description": "Output only. The roles bound to the account at its tenant, beside its seat, sorted.", "items": { "type": "string" }, "readOnly": true, "type": "array" }, "secrets": { "description": "Output only. The live secrets: unexpired, newest last. The plaintext is never here.", "items": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.ServiceAccountSecret" }, "readOnly": true, "type": "array" }, "status": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.ClientStatus" }, "tenantId": { "description": "Output only. The owning tenant's AWID (t-…): the tenant the account's credential administers, for a consumer to print beside the token URL, client id and audience (kit#861).", "readOnly": true, "type": "string" }, "updatedAt": { "description": "Output only.", "format": "date-time", "readOnly": true, "type": "string" } }, "type": "object" }, "authwise.tenancy.v1alpha1.ServiceAccountSecret": { "properties": { "createdAt": { "format": "date-time", "type": "string" }, "expiresAt": { "description": "Unset: the secret does not expire.", "format": "date-time", "type": "string" }, "id": { "description": "The secret's AWID: the part of the minted secret before the underscore.", "type": "string" } }, "type": "object" }, "authwise.types.core.v1alpha1.Branding": { "description": "Branding is a tenant's brand, by reference to its own assets. kit never\nrenders it; the admin console and the mail brand resolver do.", "properties": { "logoAssetId": { "description": "The id segment of an Asset in this tenant whose mime_type is an image\ntype (authwise.io/Asset). Refused when it names no such asset in this\ntenant; deleting the asset is refused while this names it.", "type": "string" }, "logoDarkAssetId": { "description": "The same, for a dark colour scheme. Optional: a reader falls back to\nlogo_asset_id. Refused without logo_asset_id — a dark variant of no\nlogo is not a logo.", "type": "string" } }, "type": "object" }, "authwise.types.core.v1alpha1.Classification": { "default": "CLASSIFICATION_UNSPECIFIED", "description": "Classification records which product a Tenant belongs to. The Tenant\nis the isolation boundary in Authwise's product split, so the value\nlives on the Tenant and nowhere else.\n\nCLASSIFICATION_UNSPECIFIED is the protobuf zero value; it is rejected\nby validation and never persists. CLASSIFICATION_WORKPLACE marks the\nhigh-trust population (employees, SSO, MFA, SCIM, no open signup) —\nthe workplace product. CLASSIFICATION_OMNI marks the open-\npopulation, self-signup-friendly tier — the omni product.", "enum": [ "CLASSIFICATION_UNSPECIFIED", "CLASSIFICATION_WORKPLACE", "CLASSIFICATION_OMNI" ], "type": "string" }, "authwise.types.core.v1alpha1.ClientStatus": { "default": "CLIENT_STATUS_UNSPECIFIED", "description": "ClientStatus is the client's standing (kit#404). DISABLED and QUARANTINED\nboth refuse the token endpoint with invalid_client, and introspection\nanswers their tokens inactive. QUARANTINED is the kill switch: kit#428\nadds revoking every live token of the client.", "enum": [ "CLIENT_STATUS_UNSPECIFIED", "CLIENT_STATUS_ACTIVE", "CLIENT_STATUS_DISABLED", "CLIENT_STATUS_QUARANTINED" ], "type": "string" }, "authwise.types.core.v1alpha1.CorsConfig": { "properties": { "allowedOrigins": { "items": { "type": "string" }, "type": "array" }, "allowedOriginsRegexp": { "items": { "type": "string" }, "type": "array" } }, "type": "object" }, "authwise.types.core.v1alpha1.MessageDeliveryStatus": { "default": "MESSAGE_DELIVERY_STATUS_UNSPECIFIED", "description": "MessageDeliveryStatus reports what happened when kit asked the platform\nmessaging service to deliver a message it rendered (kit#344). Values 1-5\nmirror platform's MessagingStatus one for one; SKIPPED is kit's own and\nmeans no request was made at all — delivery is unconfigured\n(messaging.delivery: none) or the recipient is not addressable on the\nchannel.\n\nQUEUED is the most a synchronous send can promise: platform's Send returns\nafter one durable write, and the provider call happens later in its own\ndispatch loop, so a send that a provider ultimately refuses still reports\nQUEUED here with an empty reason and a populated message id. Never render\nQUEUED as delivered.\n\nOn the invitation path, a caller that receives anything but QUEUED or SENT\nstill holds the accept URL and passes it on itself, exactly as before\ndelivery existed. That sentence is scoped to invitations on purpose: this\nenum is also returned by SendTestMessage, where there is no accept URL and\nnothing for the caller to fall back to.\n\n - MESSAGE_DELIVERY_STATUS_QUEUED: Durably enqueued by platform, not yet handed to a provider.\n - MESSAGE_DELIVERY_STATUS_SENT: Accepted by the provider. Not a delivery receipt.\n - MESSAGE_DELIVERY_STATUS_FAILED: Platform could not be reached, or exhausted its retries.\n - MESSAGE_DELIVERY_STATUS_REJECTED: Refused before enqueue: no provider for the channel, malformed address.\n - MESSAGE_DELIVERY_STATUS_SUPPRESSED: Refused because the recipient is on platform's suppression list.\n - MESSAGE_DELIVERY_STATUS_SKIPPED: kit made no request: delivery is unconfigured or the recipient is not\nan e-mail address. The reason field on whichever response carried this\nstatus says which — spelled delivery_reason on InviteUserResponse and\nreason on SendTestMessageResponse. Both are named because this enum is\nshared by both paths and naming only the first sent a reader looking\nfor a delivery_reason that a test send does not have.", "enum": [ "MESSAGE_DELIVERY_STATUS_UNSPECIFIED", "MESSAGE_DELIVERY_STATUS_QUEUED", "MESSAGE_DELIVERY_STATUS_SENT", "MESSAGE_DELIVERY_STATUS_FAILED", "MESSAGE_DELIVERY_STATUS_REJECTED", "MESSAGE_DELIVERY_STATUS_SUPPRESSED", "MESSAGE_DELIVERY_STATUS_SKIPPED" ], "type": "string" }, "authwise.types.core.v1alpha1.Plan": { "default": "PLAN_UNSPECIFIED", "description": "Plan is a tenant's commercial plan, lowest first. A plan-gated feature\nadmits a tenant at or above its plan, and a tenant with no plan at all.", "enum": [ "PLAN_UNSPECIFIED", "PLAN_FREE", "PLAN_TEAM", "PLAN_BUSINESS", "PLAN_ENTERPRISE" ], "type": "string" }, "authwise.types.core.v1alpha1.Tenant": { "properties": { "classification": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.Classification" }, "config": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.TenantConfig" }, "displayName": { "type": "string" }, "labels": { "additionalProperties": { "type": "string" }, "type": "object" }, "name": { "description": "Output only. The resource name, rendered from the row's id: the address\nused to GET, PATCH and DELETE this row, not a label. A value sent on\ncreate or update is ignored — the server always builds it from the id.\nFor a human-readable label, use display_name.", "readOnly": true, "type": "string" }, "owner": { "description": "owner is the tenant's owner as the provisioning system knows it — an\norganization or account id in the caller's own namespace (the portal's,\nor whatever an operator types). Opaque to Authwise: stored and returned,\ninterpreted nowhere, and not a subject (TENANT_CREATION.md\nD3). Who administers the tenant is its `tenancy.owner` seats at central,\nnot this field. Optional.", "type": "string" }, "plan": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.Plan" }, "products": { "additionalProperties": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.TenantProduct" }, "description": "Output only. The products this tenant is enabled for, keyed by product\n(\"guard\"), each naming the issuer and the audience the product's end\nusers sign in to (docswip/ESTATE_TENANCY.md E24). Written only by the\ntenancy admin service's EnableProduct / DisableProduct; every other\nwrite ignores it. Default empty, for every tenant.", "readOnly": true, "type": "object" }, "selfService": { "description": "Output only. True when the tenant was created by its owner through\nCreateMyTenant / MaterializeMyTenant rather than by an operator.", "readOnly": true, "type": "boolean" }, "slug": { "description": "Output only. The label of the tenant's native host,\n`\u003cslug\u003e.id.\u003cestate\u003e`, chosen by its owner on CreateMyTenant (kit#873,\nLAUNCH_EXPERIENCE.md L4): 3–40 characters, a DNS label, not reserved,\nunique, immutable. Empty for a tenant an operator created. kit does not\ncreate the host; the owner's own domain write does, under the same rule.", "readOnly": true, "type": "string" } }, "type": "object" }, "authwise.types.core.v1alpha1.TenantConfig": { "properties": { "accessTokenExpireSeconds": { "format": "int32", "type": "integer" }, "branding": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.Branding" }, "cors": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.CorsConfig" }, "interactionForwardUri": { "type": "string" }, "refreshTokenAbsoluteExpireSeconds": { "format": "int32", "type": "integer" }, "refreshTokenExpireSeconds": { "format": "int32", "type": "integer" } }, "title": "TODO - config split between this and issuer", "type": "object" }, "authwise.types.core.v1alpha1.TenantMembership": { "description": "TenantMembership is a SEAT: it joins a console-realm subject (typically a\nuser, but also clients via client_credentials) to a customer tenant, and\nsays the subject may interact with that tenant at all. It says nothing\nabout what they may do inside it — that is what access bindings say.\n\nSince kit#501 this message is a PROJECTION, not a table. A seat is an\naccess binding of a role carrying the `tenancy.member` permission, anchored\nat the tenant or at the platform root; `tenant_memberships` is gone. The\nwire shape is unchanged, and so is every semantic below it. See\ndocswip/TENANCY.md Part 5.", "properties": { "createdAt": { "format": "date-time", "title": "@gotags: yaml:\"created_at\"", "type": "string" }, "createdBy": { "title": "@gotags: yaml:\"created_by\"", "type": "string" }, "kind": { "description": "The seat role, rendered in the OWNER / MEMBER / OPERATOR vocabulary.\n\nOn READ all three occur: OWNER is `tenancy.owner`, OPERATOR is a\nroot-anchored `tenancy.operator` binding reaching this tenant, and MEMBER\nis `tenancy.member` or any other role carrying the permission.\n\nOn WRITE only OWNER and MEMBER are accepted. Operator status is an estate\nproperty conferred by the tenancy admin's GrantOperator, never by a seat\nwrite, so OPERATOR is rejected here with INVALID_ARGUMENT.\n\n@gotags: yaml:\"kind\"", "type": "string" }, "name": { "description": "Output only. The resource name, \"tenants/{tenantId}/tenant-memberships/\n{userId}\": the address used to GET, PATCH and DELETE this seat. The last\nsegment is the SUBJECT id, because the (subject, tenant) pair is what\nidentifies a seat here — a subject holds one seat at a tenant whatever\nrole carries it. The binding underneath has an id of its own, which this\nsurface deliberately does not expose; a caller that wants to address the\nrow goes to the Access API. A value sent on create or update is ignored.", "readOnly": true, "type": "string" }, "targetTenantId": { "title": "@gotags: yaml:\"target_tenant_id\"", "type": "string" }, "updatedAt": { "format": "date-time", "title": "@gotags: yaml:\"updated_at\"", "type": "string" }, "userDisplayName": { "description": "Output only. The seated person's display name and e-mail, read at\ncentral from the administrators realm when the seat is read (kit#764),\nso a tenant's console names its administrators without reading central's\nrealm itself. Empty for a subject that is not a user there (a service\naccount, an operator's client).\n\n@gotags: yaml:\"user_display_name\"", "readOnly": true, "type": "string" }, "userEmail": { "title": "@gotags: yaml:\"user_email\"", "type": "string" }, "userEnrollment": { "description": "Output only. The seated person's enrollment in the administrators realm,\nas User.enrollment says it: \"active\", \"invited\" (a live invitation, not\nyet redeemed), \"expired\" (an invitation that lapsed unredeemed) or\n\"none\" (kit#788). Read at central with the names. An invited or expired\nadministrator is one a console offers to re-send the invitation to —\nInviteTenantAdministrator with reissue, for user_email, which for such a\nperson is the address the invitation went to. Empty where the names are.\n\n@gotags: yaml:\"user_enrollment\"", "readOnly": true, "type": "string" }, "userId": { "title": "@gotags: yaml:\"user_id\"", "type": "string" } }, "type": "object" }, "authwise.types.core.v1alpha1.TenantProduct": { "description": "TenantProduct is one product enabled on a tenant (E24): the issuer its\nend users sign in at and the audience their tokens carry, whose catalog\nholds the product's end-user vocabulary. The issuer's\n`/.well-known/authwise-configuration` advertises the audience while the\nentry stands.", "properties": { "audienceId": { "description": "The audience (`a-…`) EnableProduct created on it.", "type": "string" }, "consoleClientId": { "description": "The public PKCE client (`c-…`) EnableProduct created on the issuer for\nthe product's console (kit#775). Empty when no console origin was known.", "type": "string" }, "consoleOrigins": { "description": "The console origins that client's redirect URIs are built from.", "items": { "type": "string" }, "type": "array" }, "issuerId": { "description": "The issuer (`i-…`) the product was enabled on.", "type": "string" }, "stepUpConditionId": { "description": "The access condition (`axc-…`) EnableProduct seeded in the audience\nthat requires a multi-factor `acr` (`guardcontrol.stepUp`, D13). A\nproduct attaches it by id to the administrative bindings it writes.", "type": "string" } }, "type": "object" }, "google.protobuf.Any": { "additionalProperties": {}, "description": "`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nProtobuf library provides support to pack/unpack Any values in the form\nof utility functions or additional generated methods of the Any type.\n\nExample 1: Pack and unpack a message in C++.\n\n Foo foo = ...;\n Any any;\n any.PackFrom(foo);\n ...\n if (any.UnpackTo(\u0026foo)) {\n ...\n }\n\nExample 2: Pack and unpack a message in Java.\n\n Foo foo = ...;\n Any any = Any.pack(foo);\n ...\n if (any.is(Foo.class)) {\n foo = any.unpack(Foo.class);\n }\n\nExample 3: Pack and unpack a message in Python.\n\n foo = Foo(...)\n any = Any()\n any.Pack(foo)\n ...\n if any.Is(Foo.DESCRIPTOR):\n any.Unpack(foo)\n ...\n\nExample 4: Pack and unpack a message in Go\n\n foo := \u0026pb.Foo{...}\n any, err := anypb.New(foo)\n if err != nil {\n ...\n }\n ...\n foo := \u0026pb.Foo{}\n if err := any.UnmarshalTo(foo); err != nil {\n ...\n }\n\nThe pack methods provided by protobuf library will by default use\n'type.googleapis.com/full.type.name' as the type URL and the unpack\nmethods only use the fully qualified type name after the last '/'\nin the type URL, for example \"foo.bar.com/x/y.z\" will yield type\nname \"y.z\".\n\n\nJSON\n\nThe JSON representation of an `Any` value uses the regular\nrepresentation of the deserialized, embedded message, with an\nadditional field `@type` which contains the type URL. Example:\n\n package google.profile;\n message Person {\n string first_name = 1;\n string last_name = 2;\n }\n\n {\n \"@type\": \"type.googleapis.com/google.profile.Person\",\n \"firstName\": \u003cstring\u003e,\n \"lastName\": \u003cstring\u003e\n }\n\nIf the embedded message type is well-known and has a custom JSON\nrepresentation, that representation will be embedded adding a field\n`value` which holds the custom JSON in addition to the `@type`\nfield. Example (for message [google.protobuf.Duration][]):\n\n {\n \"@type\": \"type.googleapis.com/google.protobuf.Duration\",\n \"value\": \"1.212s\"\n }", "properties": { "@type": { "description": "A URL/resource name that uniquely identifies the type of the serialized\nprotocol buffer message. This string must contain at least\none \"/\" character. The last segment of the URL's path must represent\nthe fully qualified name of the type (as in\n`path/google.protobuf.Duration`). The name should be in a canonical form\n(e.g., leading \".\" is not accepted).\n\nIn practice, teams usually precompile into the binary all types that they\nexpect it to use in the context of Any. However, for URLs which use the\nscheme `http`, `https`, or no scheme, one can optionally set up a type\nserver that maps type URLs to message definitions as follows:\n\n* If no scheme is provided, `https` is assumed.\n* An HTTP GET on the URL must yield a [google.protobuf.Type][]\n value in binary format, or produce an error.\n* Applications are allowed to cache lookup results based on the\n URL, or have them precompiled into a binary to avoid any\n lookup. Therefore, binary compatibility needs to be preserved\n on changes to types. (Use versioned type names to manage\n breaking changes.)\n\nNote: this functionality is not currently available in the official\nprotobuf release, and it is not used for type URLs beginning with\ntype.googleapis.com.\n\nSchemes other than `http`, `https` (or the empty scheme) might be\nused with implementation specific semantics.", "type": "string" } }, "type": "object" }, "google.rpc.Status": { "properties": { "code": { "format": "int32", "type": "integer" }, "details": { "items": { "$ref": "#/components/schemas/google.protobuf.Any" }, "type": "array" }, "message": { "type": "string" } }, "type": "object" } }, "securitySchemes": { "Authwise": { "type": "openIdConnect", "openIdConnectUrl": "/.well-known/openid-configuration" } } }, "info": { "title": "authwise/tenancy/v1alpha1/grpc.proto", "version": "version not set" }, "openapi": "3.0.3", "paths": { "/v1/tenants": { "get": { "operationId": "AuthwiseTenancyService_ListMyTenants", "parameters": [ { "in": "query", "name": "pageSize", "schema": { "format": "int32", "type": "integer" } }, { "in": "query", "name": "pageToken", "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.ListMyTenantsResponse" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Tenants" ] }, "post": { "operationId": "AuthwiseTenancyService_CreateMyTenant", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.CreateMyTenantRequest" } } }, "required": true, "x-originalParamName": "body" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.SelfServiceTenant" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Tenants" ] } }, "/v1/tenants/{tenantId}": { "get": { "operationId": "AuthwiseTenancyService_GetTenant", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "readMask", "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.Tenant" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Tenants" ] }, "patch": { "operationId": "AuthwiseTenancyService_PatchTenant", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "properties": { "tenant": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.Tenant" }, "updateMask": { "type": "string" } }, "type": "object" } } }, "required": true, "x-originalParamName": "body" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.Tenant" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Tenants" ] }, "put": { "operationId": "AuthwiseTenancyService_UpdateTenant", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.Tenant" } } }, "required": true, "x-originalParamName": "tenant" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.Tenant" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Tenants" ] } }, "/v1/tenants/{tenantId}/service-accounts": { "get": { "operationId": "AuthwiseTenancyService_ListServiceAccounts", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "pageSize", "schema": { "format": "int32", "type": "integer" } }, { "in": "query", "name": "pageToken", "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.ListServiceAccountsResponse" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Service Accounts" ] }, "post": { "operationId": "AuthwiseTenancyService_CreateServiceAccount", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.ServiceAccount" } } }, "description": "display_name is required and expires_at optional; every other field is the server's.", "required": true, "x-originalParamName": "serviceAccount" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.ServiceAccount" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Service Accounts" ] } }, "/v1/tenants/{tenantId}/service-accounts/{serviceAccountId}": { "delete": { "operationId": "AuthwiseTenancyService_DeleteServiceAccount", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "serviceAccountId", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Service Accounts" ] }, "get": { "operationId": "AuthwiseTenancyService_GetServiceAccount", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "serviceAccountId", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.ServiceAccount" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Service Accounts" ] } }, "/v1/tenants/{tenantId}/service-accounts/{serviceAccountId}:mintSecret": { "post": { "operationId": "AuthwiseTenancyService_MintServiceAccountSecret", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "serviceAccountId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "properties": { "expiresAt": { "description": "When the new secret stops authenticating. Optional; in the future when set.", "format": "date-time", "type": "string" }, "grace": { "description": "With rotate, how long the previous secrets keep working. Empty is 24 hours; at most 30 days.", "type": "string" }, "rotate": { "description": "Give every other live secret a bounded grace: each expires at now + grace, or sooner if it already would.", "type": "boolean" } }, "type": "object" } } }, "required": true, "x-originalParamName": "body" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.MintServiceAccountSecretResponse" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Service Accounts" ] } }, "/v1/tenants/{tenantId}/service-accounts/{serviceAccountId}:setRoles": { "post": { "operationId": "AuthwiseTenancyService_SetServiceAccountRoles", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "serviceAccountId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "properties": { "roles": { "description": "The roles the account holds at its tenant afterwards: set semantics, empty unbinds them all. Each must be one a service account may hold (tenant.admin, tenant.viewer, guardcontrol.admin) and in this estate's catalog.", "items": { "type": "string" }, "type": "array" } }, "type": "object" } } }, "required": true, "x-originalParamName": "body" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.ServiceAccount" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Service Accounts" ] } }, "/v1/tenants/{tenantId}/tenant-memberships": { "get": { "operationId": "AuthwiseTenancyService_ListTenantMemberships", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "pageSize", "schema": { "format": "int32", "type": "integer" } }, { "in": "query", "name": "pageToken", "schema": { "type": "string" } }, { "in": "query", "name": "filter", "schema": { "type": "string" } }, { "in": "query", "name": "orderBy", "schema": { "type": "string" } }, { "in": "query", "name": "readMask", "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.ListTenantMembershipsResponse" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Tenant Memberships" ] }, "post": { "operationId": "AuthwiseTenancyService_CreateTenantMembership", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.TenantMembership" } } }, "required": true, "x-originalParamName": "tenantMembership" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.TenantMembership" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Tenant Memberships" ] } }, "/v1/tenants/{tenantId}/tenant-memberships/{tenantMembershipId}": { "delete": { "operationId": "AuthwiseTenancyService_DeleteTenantMembership", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "tenantMembershipId", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Tenant Memberships" ] }, "get": { "operationId": "AuthwiseTenancyService_GetTenantMembership", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "tenantMembershipId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "readMask", "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.TenantMembership" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Tenant Memberships" ] }, "patch": { "operationId": "AuthwiseTenancyService_PatchTenantMembership", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "tenantMembershipId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "properties": { "tenantMembership": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.TenantMembership" }, "updateMask": { "type": "string" } }, "type": "object" } } }, "required": true, "x-originalParamName": "body" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.TenantMembership" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Tenant Memberships" ] } }, "/v1/tenants/{tenantId}/tenant-memberships:invite": { "post": { "operationId": "AuthwiseTenancyService_InviteTenantAdministrator", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "properties": { "continueUrl": { "description": "Where the accept page continues once the invitation is redeemed. Absolute https, on install.consoleUrl or one of install.trustedConsoleUrls; anything else is INVALID_ARGUMENT. Empty is install.consoleUrl.", "type": "string" }, "email": { "description": "The administrator's e-mail, their login name in the administrators realm. Required.", "type": "string" }, "kind": { "description": "OWNER (may change the tenant's administrators) or MEMBER. Empty is MEMBER.", "type": "string" }, "locale": { "description": "BCP 47 tag the mail is written in. Optional.", "type": "string" }, "reissue": { "description": "Mint a fresh invitation for an address invited and not yet redeemed, voiding the earlier one. Without it such an address is ALREADY_EXISTS.", "type": "boolean" }, "ttl": { "description": "How long a new invitation can be redeemed. Empty takes the install's default; at most 30 days.", "type": "string" } }, "type": "object" } } }, "required": true, "x-originalParamName": "body" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.InviteTenantAdministratorResponse" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Tenant Memberships" ] } }, "/v1/tenants/{tenantId}:materialize": { "post": { "operationId": "AuthwiseTenancyService_MaterializeMyTenant", "parameters": [ { "in": "path", "name": "tenantId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "properties": { "displayName": { "description": "Optional. A name to use instead of the one CreateMyTenant recorded, when that one is taken on this install (ALREADY_EXISTS DISPLAY_NAME_TAKEN).", "type": "string" } }, "type": "object" } } }, "required": true, "x-originalParamName": "body" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.types.core.v1alpha1.Tenant" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Tenants" ] } }, "/v1/{name_3}": { "get": { "operationId": "AuthwiseTenancyService_GetSelfServiceTenant", "parameters": [ { "description": "tenants/{tenant}/self-service.", "in": "path", "name": "name_3", "required": true, "schema": { "pattern": "tenants/[^/]+/self-service", "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/authwise.tenancy.v1alpha1.SelfServiceTenant" } } }, "description": "A successful response." }, "default": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/google.rpc.Status" } } }, "description": "An unexpected error response." } }, "tags": [ "Tenants" ] } } }, "security": [ { "Authwise": [] } ], "tags": [ { "name": "AuthwiseTenancyService" } ] }