openapi: 3.1.0
info:
  title: HPE GreenLake for Authorization API
  description: >-
    The HPE GreenLake for Authorization API provides a unified way to manage
    the  authorization function for HPE GreenLake cloud.
  version: 1.0.0-beta
  license:
    name: HPE End User License Agreement
    url: https://www.hpe.com/us/en/software/licensing.html
servers:
  - url: https://global.api.greenlake.hpe.com
security:
  - bearerAuth: []
tags:
  - name: Roles
    description: >-
      Roles are created in a Workspace, typically by an IAM administrator. They
      may be created by a Resource Provider (RP) if the RP has been granted the
      required privileges in the Workspace.

      <br><br> Requirements <ul> <li>Roles must include at least one inline
      permission.</li> </ul>

      Known limitations <ul> <li>There is a max limit of 100 Roles per workspace
      (in addition to the global predefined roles).</li> </ul>
  - name: Role Assignments
    description: >-
      Role assignments are composed of three pieces (principal, role, and
      scope).  Role assigments associate a user, group, or service (principal)
      with a  specific role (along with its permissions) at a particular scope
      (a  resource or group of resources) to grant them access and specify their
      responsibilities  within HPE GreenLake.

      <br><br>**Note:** There is a maximum limit of 50 role assignments per user
      per workspace.
  - name: Scope Groups
    description: >-
      A scope group is composed of scopes and allows a single role assignment
      against multiple scopes.

      <br><br> Known limitations <ul> <li>There is a max limit of 500 scopes per
      Scope Group.</li> <li>There is a max limit of 500 Scope Groups per
      workspace.</li> </ul>
paths:
  /authorization/v1beta1/roles:
    post:
      summary: Create a role
      tags:
        - Roles
      operationId: createRoleV1beta1
      description: >-
        This endpoint creates a new role within the workspace context of the
        caller.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CustomRoleV1beta1'
      responses:
        '201':
          description: Created
          headers:
            Location:
              schema:
                type: string
              description: URL to the newly created resource.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CustomRoleV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
    get:
      summary: Retrieve all roles
      tags:
        - Roles
      operationId: getRolesV1beta1
      description: >
        Retrieves role by applying [OData
        4.0](https://www.odata.org/documentation/) filters. Use the `filter`
        parameter to provide a filter string. Supports `in` operator on `kind`
        and `grn` attributes. <br>*Example Request:*
        <br>`/authorization/v1beta1/roles?filter=kind in ('PREDEFINED')`

        <br><br>**Note:**

        <br>- **No duplicate attributes in OData filter**: Each attribute
        (`kind`, `grn`) can only appear once in the OData filter expression.
        Multiple occurrences will result in a `400 Bad Request` error.

        <br>- **Supported operators**: Only `in` operator is supported.
      parameters:
        - in: query
          name: filter
          description: >
            OData style filter for filtering roles. Supports `in` operator on
            `kind` and `grn` attributes.
          schema:
            type: string
          example: kind in ("PREDEFINED")
        - in: query
          name: sort
          description: >
            Sort results by a single attribute and allow setting a sorting
            direction as ascending (`asc`). Sorting is valid only for the `slug`
            and `name` attributes. If omitted, default sorting direction is
            ascending and default sorting attribute is `name`.
          example: name asc
          schema:
            type: string
        - $ref: '#/components/parameters/LimitV1beta1'
        - $ref: '#/components/parameters/Offset'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RolesListV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
  /authorization/v1beta1/roles/{id}:
    parameters:
      - name: id
        description: >-
          The role instance identifier. The ID can be found in the response body
          of  `POST /authorization/v1beta1/roles`.
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      summary: Get a role instance by ID
      tags:
        - Roles
      operationId: getRoleV1beta1
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleGetV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
    put:
      summary: Update a role instance by ID
      tags:
        - Roles
      operationId: putRoleV1beta1
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleUpdateV1beta1'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleUpdateV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
    delete:
      summary: Delete a role instance by ID
      tags:
        - Roles
      operationId: deleteRoleV1beta1
      responses:
        '204':
          description: No Content
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '412':
          $ref: '#/components/responses/PreconditionFailed'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
  /authorization/v1beta1/roles/{id}/permissions:
    parameters:
      - name: id
        description: >-
          The role instance identifier. The ID can be found in the response body
          of  `POST /authorization/v1beta1/roles`.
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      summary: Retrieve the role permission list
      description: >-
        The permission list is sorted by the permission slug string
        alphabetically by default.
      tags:
        - Roles
      operationId: getRolePermissionsV1beta1
      parameters:
        - in: query
          name: limit
          description: >-
            The total number of results to be returned. If the parameter is not
            provided, it will return all records found.
          schema:
            type: integer
            default: 0
            maximum: 200
        - $ref: '#/components/parameters/Offset'
        - in: query
          name: sort
          description: >
            Sort results by a single attribute and allow setting a sorting
            direction as ascending (`asc`) or descending (`desc`). Sorting is
            valid only for the `id` attribute (permission slug string). The
            default sorting direction, if omitted, is ascending.
          schema:
            type: string
            example: id desc
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RolePermissionsListV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
  /authorization/v1beta1/roles/{id}/permissions/batch:
    parameters:
      - name: id
        in: path
        required: true
        description: >-
          The role instance identifier. The ID can be found in the response body
          of `POST /authorization/v1beta1/roles`.
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      summary: Add items to the role permission list
      tags:
        - Roles
      operationId: addRolePermissionsV1beta1
      description: >-
        Use to add items to a role permission list. This operation is
        synchronous and non-atomic. '**Note:** For assistance finding the
        permission identifiers, see the [developer
        guide](https://developer.greenlake.hpe.com/docs/greenlake/services/authorization/guide#making-it-all-work).'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RolePermissionsAddV1beta1'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RolePermissionsAddResponseV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
  /authorization/v1beta1/roles/{id}/permissions/bulk:
    parameters:
      - name: id
        in: path
        required: true
        description: >-
          **Note:** The role instance identifier. The ID can be found in the
          response body of POST `/authorization/v1beta1/roles`.
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      summary: Delete items from the role permission list
      tags:
        - Roles
      operationId: deleteRolePermissionsV1beta1
      description: >-
        The ID of the permission to be deleted can be found in the response body
        of GET `/authorization/v1beta1/roles/{id}/permissions/batch`. This
        operation is synchronous and atomic.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RolePermissionsDeleteV1beta1'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RolePermissionsDeleteResponseV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
  /authorization/v1beta1/role-assignments:
    post:
      summary: Create a role assignment
      tags:
        - Role Assignments
      operationId: createRoleAssignmentV1beta1
      description: >-
        Create a role assignment.

        <br><br>By creating a role assignment, you grant access to resources.
        Role assignments allow for controlled management of permissions and
        responsibilities.

        <br><br>**Note:** For assistance finding the `principal`, `scope`, and
        `role` identifiers, see the [developer
        guide](https://developer.greenlake.hpe.com/docs/greenlake/services/authorization/guide#making-it-all-work).
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleAssignmentV1beta1'
      responses:
        '201':
          description: Created
          headers:
            Location:
              schema:
                type: string
              description: URL to the newly created resource.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAssignmentV1beta1'
              examples:
                workspaceScope:
                  $ref: >-
                    #/components/examples/roleAssignmentMultipleScopeWorkspaceV1beta1
                tenantGroupScope:
                  $ref: >-
                    #/components/examples/roleAssignmentMultipleScopeTenantGroupV1beta1
                scopeGroupScope:
                  $ref: >-
                    #/components/examples/roleAssignmentMultipleScopeScopeGroupV1beta1
                workspaceAndTenantGroup:
                  $ref: >-
                    #/components/examples/roleAssignmentMultipleScopeWorkspaceAndTenantGroupV1beta1
                tenantGroupAndScopeGroup:
                  $ref: >-
                    #/components/examples/roleAssignmentMultipleScopeTenantGroupAndScopeGroupV1beta1
                userSubject:
                  $ref: >-
                    #/components/examples/roleAssignmentMultipleScopeUserSubjectV1beta1
                userGroupSubject:
                  $ref: >-
                    #/components/examples/roleAssignmentMultipleScopeUserGroupSubjectV1beta1
                apiClientSubject:
                  $ref: >-
                    #/components/examples/roleAssignmentMultipleScopeAPIClientSubjectV1beta1
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
        '412':
          $ref: '#/components/responses/PreconditionFailed'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
    get:
      summary: Retrieve all role assignments
      tags:
        - Role Assignments
      operationId: getRoleAssignmentsV1beta1
      description: >
        Retrieves role assignments by applying [OData
        4.0](https://www.odata.org/documentation/) filters. Use the `filter`
        parameter to provide a filter string. Supports `in` and `and` operators
        on `role`, `scope` and `principal` attributes. <br>*Example Request:*
        <br>`/authorization/v1beta1/role-assignments?filter=role in
        ('grn:glp/providers/authorization/roles/storageservices.LimitedAdmin')
        and principal in ('user:123981y2zxhiz1890')`

        <br><br>**Note:**

        <br>- **No duplicate attributes in OData filter**: Each attribute
        (`role`, `scope`, `principal`) can only appear once in the OData filter
        expression. Multiple occurrences will result in a `400 Bad Request`
        error.

        <br>- **Supported operators**: Only the `in` and `and` operators are
        supported.
      parameters:
        - $ref: '#/components/parameters/LimitV1beta1'
        - $ref: '#/components/parameters/Offset'
        - in: query
          name: filter
          description: >
            The filter query parameter is used to filter the set of resources
            returned in a collection-level GET. The returned set of resources
            matches the criteria in the filter query parameter. <br><br>Supports
            `in` and `and` operators on `role`, `scope` and `principal`
            attributes.
          schema:
            type: string
          example: >-
            role in
            ('grn:glp/providers/authorization/roles/storageservices.LimitedAdmin')
            and principal in ('user:123981y2zxhiz1890')
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAssignmentListV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
  /authorization/v1beta1/role-assignments/{id}:
    parameters:
      - name: id
        in: path
        required: true
        description: >-
          The role assignment instance identifier. The ID can be found in the
          response body of POST `/authorization/v1beta1/role-assignments`.
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      summary: Retrieve a role assignment instance by ID
      tags:
        - Role Assignments
      operationId: getRoleAssignmentV1beta1
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAssignmentGetV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
    put:
      summary: Update a role assignment instance by ID
      tags:
        - Role Assignments
      operationId: updateRoleAssignmentV1beta1
      description: >
        Request body must contain `id`, `principal`, `scope`, and `role`
        attributes even though they are immutable.

        <br><br>The `id` can be found at the response body of POST
        `/authorization/v1beta1/role-assignments`.

        <br><br>**Note:** For assistance finding the `principal`, `scope`, and
        `role` identifiers, see the [developer
        guide](https://developer.greenlake.hpe.com/docs/greenlake/services/authorization/guide#making-it-all-work).
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleAssignmentV1beta1Update'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAssignmentV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
    delete:
      summary: Delete a role assignment instance by ID
      tags:
        - Role Assignments
      operationId: deleteRoleAssignmentV1beta1
      responses:
        '204':
          description: No content
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
  /authorization/v1beta1/scope-groups:
    post:
      summary: Create a scope group
      description: >
        A scope group is a collection of scopes that can be assigned to a role
        assignment. This allows a single role assignment to cover multiple
        scopes. <br><br>**Note:**  <ul> <li>

        A scope group cannot contain another scope group (no nesting). Once
        created, a scope group will belong to a organization/workspace based on
        the caller context. The returned `grn` attribute will include this
        context and can be used as a globally unique identifier.
      tags:
        - Scope Groups
      operationId: createScopeGroupV1beta1
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScopeGroupV1beta1'
      responses:
        '201':
          description: Created
          headers:
            Location:
              schema:
                type: string
              description: URL to the newly created resource.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeGroupV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
    get:
      summary: Retrieve all scope groups
      tags:
        - Scope Groups
      operationId: getScopeGroupsV1beta1
      description: >
        Retrieves scope groups by applying [OData
        4.0](https://www.odata.org/documentation/) filters. Use the `filter`
        parameter to provide a filter string. Supports `in` operator on `name`
        or `grn` attributes. <br>*Example Request:*
        <br>`/authorization/v1beta1/scope-groups?filter=grn in
        ('grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/authorization/scope-groups/123')`

        <br><br>**Note:**

        <br>- **Supported operators**: Only `in` operator is supported.
      parameters:
        - in: query
          name: limit
          description: >-
            Total number of results to be returned. If the parameter is not
            provided, it will return all records found.
          schema:
            type: integer
            default: 0
            maximum: 30
        - $ref: '#/components/parameters/Offset'
        - in: query
          name: filter
          description: >
            OData style filter for filtering scope groups. Supports `in`
            operator on `name` or `grn` attributes.
          schema:
            type: string
          example: >-
            grn in
            ('grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/authorization/scope-groups/123')
        - in: query
          name: sort
          description: >
            Sort results by a single attribute and allow setting a sorting
            direction as ascending (asc) or descending (desc). Sorting is valid
            only for name attribute. Default sorting direction if omitted is
            ascending.
          schema:
            type: string
            example: name desc
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeGroupListV1beta1'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
  /authorization/v1beta1/scope-groups/{id}:
    parameters:
      - name: id
        description: >-
          The scope group instance identifier. The ID can be found in the
          response body of POST `/authorization/v1beta1/scope-groups`.
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      summary: Retrieve a scope group instance by ID
      tags:
        - Scope Groups
      operationId: getScopeGroupV1beta1
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeGroupV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
    put:
      summary: Update a scope group instance by ID
      tags:
        - Scope Groups
      description: >
        Request body must contains both 'id' and 'name' attributes even though
        they are immutable.
      operationId: updateScopeGroupV1beta1
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScopeGroupUpdateV1beta1'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeGroupV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
    delete:
      summary: Delete a scope group instance by ID
      tags:
        - Scope Groups
      operationId: deleteScopeGroupV1beta1
      responses:
        '204':
          description: No Content
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '412':
          $ref: '#/components/responses/PreconditionFailed'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
  /authorization/v1beta1/scope-groups/{id}/scopes:
    parameters:
      - name: id
        in: path
        required: true
        description: >-
          The scope group instance identifier. The ID can be found in the
          response body of POST `/authorization/v1beta1/scope-groups`.
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      summary: Retrieve the scope group scope list
      tags:
        - Scope Groups
      operationId: getScopeGroupScopesV1beta1
      description: >-
        The scope list is sorted by description and GRN alphabetically by
        default.
      parameters:
        - in: query
          name: limit
          description: >-
            Total number of results to be returned. If the parameter is not
            provided, it will return all records found.
          schema:
            type: integer
            default: 0
            maximum: 200
        - $ref: '#/components/parameters/Offset'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeGroupScopesListV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
  /authorization/v1beta1/scope-groups/{id}/scopes/batch:
    parameters:
      - name: id
        in: path
        required: true
        description: >-
          The scope group instance identifier. ID can be found at the response
          body of POST `/authorization/v1beta1/scope-groups`.
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      summary: Add items to the scope group scope list
      description: This operation is synchronous and non-atomic.
      tags:
        - Scope Groups
      operationId: addScopeGroupScopesV1beta1
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScopeGroupScopesAddV1beta1'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeGroupScopesAddResponseV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
  /authorization/v1beta1/scope-groups/{id}/scopes/bulk:
    parameters:
      - name: id
        in: path
        required: true
        description: >-
          The scope group instance identifier. ID can be found at the response
          body of POST `/authorization/v1beta1/scope-groups`.
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      summary: Delete items from the scope group scope list
      description: >-
        The ID of the scope to be deleted can be found in the response body of
        GET `/authorization/v1beta1/scope-groups/{id}/scopes/batch`. This
        operation is synchronous and atomic.
      tags:
        - Scope Groups
      operationId: deleteScopeGroupScopesV1beta1
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScopeGroupScopesDeleteV1beta1'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeGroupScopesDeleteResponseV1beta1'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
  examples:
    roleAssignmentMultipleScopeWorkspaceV1beta1:
      summary: Workspace scope
      value:
        id: 05f2523c-fe03-47fc-981b-9c4333a37b01
        type: authorization/role-assignment
        principal: user:123981y2zxhiz1890
        role: grn:glp/providers/authorization/roles/storageservices.LimitedAdmin
        scope:
          - grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b60
        principalMetadata:
          id: 123981y2zxhiz1890
          type: identity/user
        roleMetadata:
          id: e54415a9-4f46-43c0-893e-67ec778c6c45
          type: authorization/role
        generation: 1
        createdAt: '2023-04-06T22:45:59.759943+00:00'
        updatedAt: '2023-04-06T22:45:59.759943+00:00'
    roleAssignmentMultipleScopeTenantGroupV1beta1:
      summary: Tenant group scope
      value:
        id: 05f2523c-fe03-47fc-981b-9c4333a37b01
        type: authorization/role-assignment
        principal: user:123981y2zxhiz1890
        role: grn:glp/providers/authorization/roles/storageservices.LimitedAdmin
        scope:
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/msp/tenant-groups/ab315a9e-4a76-44c0-93ea-7ec800c6c458
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/msp/tenant-groups/e54415a9-4f46-43c0-893e-67ec778c6c45
        principalMetadata:
          id: 123981y2zxhiz1890
          type: identity/user
        roleMetadata:
          id: e54415a9-4f46-43c0-893e-67ec778c6c45
          type: authorization/role
        generation: 1
        createdAt: '2023-04-06T22:45:59.759943+00:00'
        updatedAt: '2023-04-06T22:45:59.759943+00:00'
    roleAssignmentMultipleScopeScopeGroupV1beta1:
      summary: Scope group scope
      value:
        id: 05f2523c-fe03-47fc-981b-9c4333a37b01
        type: authorization/role-assignment
        principal: user:123981y2zxhiz1890
        role: grn:glp/providers/authorization/roles/storageservices.LimitedAdmin
        scope:
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/authorization/scope-groups/ab315a9e-4a76-44c0-93ea-7ec800c6c458
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/authorization/scope-groups/e54415a9-4f46-43c0-893e-67ec778c6c45
        principalMetadata:
          id: 123981y2zxhiz1890
          type: identity/user
        roleMetadata:
          id: e54415a9-4f46-43c0-893e-67ec778c6c45
          type: authorization/role
        generation: 1
        createdAt: '2023-04-06T22:45:59.759943+00:00'
        updatedAt: '2023-04-06T22:45:59.759943+00:00'
    roleAssignmentMultipleScopeTenantGroupAndScopeGroupV1beta1:
      summary: Tenant group scope and Scope group scope
      value:
        id: 05f2523c-fe03-47fc-981b-9c4333a37b01
        type: authorization/role-assignment
        principal: user:123981y2zxhiz1890
        role: grn:glp/providers/authorization/roles/storageservices.LimitedAdmin
        scope:
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/msp/tenant-groups/ab315a9e-4a76-44c0-93ea-7ec800c6c458
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/msp/tenant-groups/e54415a9-4f46-43c0-893e-67ec778c6c45
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/msp/tenant-groups/10e60abe-e51f-411d-9a92-e64119e28586
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/authorization/scope-groups/409596bf-11ba-4a6b-8080-3dda91ef55ea
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/authorization/scope-groups/0928bc56-d6be-4f2d-a396-5e8fb5be2bf3
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/authorization/scope-groups/0ff7ddb2-fa71-481a-8275-f7f22e90db3f
        principalMetadata:
          id: 123981y2zxhiz1890
          type: identity/user
        roleMetadata:
          id: e54415a9-4f46-43c0-893e-67ec778c6c45
          type: authorization/role
        generation: 1
        createdAt: '2023-04-06T22:45:59.759943+00:00'
        updatedAt: '2023-04-06T22:45:59.759943+00:00'
    roleAssignmentMultipleScopeWorkspaceAndTenantGroupV1beta1:
      summary: Workspace scope and Tenant group scope
      value:
        id: 05f2523c-fe03-47fc-981b-9c4333a37b01
        type: authorization/role-assignment
        principal: user:123981y2zxhiz1890
        role: grn:glp/providers/authorization/roles/storageservices.LimitedAdmin
        scope:
          - grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/msp/tenant-groups/ab315a9e-4a76-44c0-93ea-7ec800c6c458
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/msp/tenant-groups/e54415a9-4f46-43c0-893e-67ec778c6c45
        principalMetadata:
          id: 123981y2zxhiz1890
          type: identity/user
        roleMetadata:
          id: e54415a9-4f46-43c0-893e-67ec778c6c45
          type: authorization/role
        generation: 1
        createdAt: '2023-04-06T22:45:59.759943+00:00'
        updatedAt: '2023-04-06T22:45:59.759943+00:00'
    roleAssignmentMultipleScopeUserSubjectV1beta1:
      summary: User principal identifier
      value:
        id: 05f2523c-fe03-47fc-981b-9c4333a37b01
        type: authorization/role-assignment
        principal: user:123981y2zxhiz1890
        role: grn:glp/providers/authorization/roles/storageservices.LimitedAdmin
        scope:
          - grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/msp/tenant-groups/ab315a9e-4a76-44c0-93ea-7ec800c6c458
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/msp/tenant-groups/e54415a9-4f46-43c0-893e-67ec778c6c45
        principalMetadata:
          id: 123981y2zxhiz1890
          type: identity/user
        roleMetadata:
          id: e54415a9-4f46-43c0-893e-67ec778c6c45
          type: authorization/role
        generation: 1
        createdAt: '2023-04-06T22:45:59.759943+00:00'
        updatedAt: '2023-04-06T22:45:59.759943+00:00'
    roleAssignmentMultipleScopeUserGroupSubjectV1beta1:
      summary: User-group principal identifier
      value:
        id: 05f2523c-fe03-47fc-981b-9c4333a37b01
        type: authorization/role-assignment
        principal: user-group:123981y2zxhiz1890
        role: grn:glp/providers/authorization/roles/storageservices.LimitedAdmin
        scope:
          - grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/msp/tenant-groups/ab315a9e-4a76-44c0-93ea-7ec800c6c458
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/msp/tenant-groups/e54415a9-4f46-43c0-893e-67ec778c6c45
          - ''
        principalMetadata:
          id: 123981y2zxhiz1890
          type: identity/user-group
        roleMetadata:
          id: e54415a9-4f46-43c0-893e-67ec778c6c45
          type: authorization/role
        generation: 1
        createdAt: '2023-04-06T22:45:59.759943+00:00'
        updatedAt: '2023-04-06T22:45:59.759943+00:00'
    roleAssignmentMultipleScopeAPIClientSubjectV1beta1:
      summary: API-client principal identifier
      value:
        id: 05f2523c-fe03-47fc-981b-9c4333a37b01
        type: authorization/role-assignment
        principal: api-client:123981y2zxhiz1890
        role: grn:glp/providers/authorization/roles/storageservices.LimitedAdmin
        scope:
          - grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/msp/tenant-groups/ab315a9e-4a76-44c0-93ea-7ec800c6c458
          - >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/msp/tenant-groups/e54415a9-4f46-43c0-893e-67ec778c6c45
        principalMetadata:
          id: 123981y2zxhiz1890
          type: identity/api-client
        roleMetadata:
          id: e54415a9-4f46-43c0-893e-67ec778c6c45
          type: authorization/role
        generation: 1
        createdAt: '2023-04-06T22:45:59.759943+00:00'
        updatedAt: '2023-04-06T22:45:59.759943+00:00'
  schemas:
    RoleCommonV1beta1:
      type: object
      required:
        - type
        - name
        - kind
        - generation
        - grn
        - createdAt
        - updatedAt
      properties:
        type:
          type: string
          enum:
            - authorization/role
          readOnly: true
          example: authorization/role
        slug:
          type: string
          maxLength: 64
          description: >-
            Empty for `CUSTOM` roles. Unique name for `PREDEFINED` roles and the
            pattern is provider name followed by the actual name (i.e.
            `<providerName>.<name>`).
          example: ''
        name:
          type: string
          maxLength: 100
          description: >-
            Friendly name for user interface. Allowed char set is [a-z A-Z 0-9
            -(dash) (space)]
          example: Storage Limited Admin
        description:
          type: string
          maxLength: 256
          example: Storage Limited Admin
        releaseStage:
          type: string
          readOnly: true
          description: It is only defined for `PREDEFINED` roles.
          enum:
            - ALPHA
            - BETA
            - STABLE
            - DEPRECATED
          example: ''
        kind:
          $ref: '#/components/schemas/KindV1beta1'
          description: Specifies the type of role
        generation:
          $ref: '#/components/schemas/Generation'
        grn:
          type: string
          readOnly: true
          example: >-
            grn:glp/workspaces/428466023dbe11eeb7837e8589f701ca/regions/default/providers/authorization/custom-roles/123e4567-e89b-12d3-a456-426614174002
        createdAt:
          $ref: '#/components/schemas/CreatedAt'
        updatedAt:
          $ref: '#/components/schemas/UpdatedAt'
    CustomRoleCommonV1beta1:
      type: object
      required:
        - type
        - name
        - generation
        - grn
        - createdAt
        - updatedAt
      properties:
        type:
          type: string
          enum:
            - authorization/role
          readOnly: true
          example: authorization/role
        slug:
          type: string
          readOnly: true
          description: Defined only for `PREDEFINED` roles.
          example: ''
        name:
          type: string
          maxLength: 100
          description: >-
            Friendly name for user interface. Allowed char set is [a-z A-Z 0-9
            -(dash) (space)]
          example: Storage Limited Admin
        description:
          type: string
          maxLength: 256
          example: Storage Limited Admin
        releaseStage:
          type: string
          readOnly: true
          description: Empty string for `CUSTOM` roles.
          enum:
            - ALPHA
            - BETA
            - STABLE
            - DEPRECATED
          example: ''
        kind:
          $ref: '#/components/schemas/CustomKindV1beta1'
          description: Specifies the type of role
        generation:
          $ref: '#/components/schemas/Generation'
        grn:
          type: string
          readOnly: true
          example: >-
            grn:glp/workspaces/428466023dbe11eeb7837e8589f701ca/regions/default/providers/authorization/custom-roles/123e4567-e89b-12d3-a456-426614174002
        createdAt:
          $ref: '#/components/schemas/CreatedAt'
        updatedAt:
          $ref: '#/components/schemas/UpdatedAt'
    CustomRoleV1beta1:
      allOf:
        - type: object
          required:
            - id
          properties:
            id:
              $ref: '#/components/schemas/UUID'
        - $ref: '#/components/schemas/CustomRoleCommonV1beta1'
    RoleUpdateV1beta1:
      allOf:
        - type: object
          required:
            - id
          properties:
            id:
              type: string
              format: uuid
              description: Immutable
        - $ref: '#/components/schemas/CustomRoleCommonV1beta1'
    RoleGetV1beta1:
      allOf:
        - type: object
          required:
            - id
            - source
          properties:
            id:
              $ref: '#/components/schemas/UUID'
            source:
              type: string
              enum:
                - LOCAL
                - EXTERNAL
              description: Source of the role.
              example: LOCAL
              readOnly: true
        - $ref: '#/components/schemas/RoleCommonV1beta1'
    RolePermissionsGetV1beta1:
      type: object
      required:
        - id
        - type
      properties:
        id:
          type: string
          description: The permission slug string
          example: compute.server.edit
        type:
          type: string
          enum:
            - authorization/permission
          example: authorization/permission
          readOnly: true
    RolePermissionsV1beta1:
      type: object
      required:
        - id
        - type
      properties:
        id:
          type: string
          description: The permission slug string
          example: compute.server.edit
        type:
          enum:
            - authorization/scope-group/scope
          example: authorization/scope-group/scope
          readOnly: true
    RolePermissionsAddV1beta1:
      type: object
      required:
        - items
      properties:
        items:
          type: array
          maxItems: 1000
          items:
            $ref: '#/components/schemas/RolePermissionsV1beta1'
    RolePermissionsListV1beta1:
      type: object
      required:
        - items
        - offset
        - count
        - total
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/RolePermissionsGetV1beta1'
        count:
          $ref: '#/components/schemas/Count'
        total:
          $ref: '#/components/schemas/Total'
        offset:
          $ref: '#/components/schemas/Offset'
    RolePermissionsIdsAddV1beta1:
      type: object
      required:
        - id
      properties:
        id:
          type: string
          description: The permission slug string
          example: compute.server.edit
    RolePermissionsIdsV1beta1:
      type: object
      required:
        - id
      properties:
        id:
          type: string
          description: The permission slug string
          example: compute.server.edit
    RolePermissionsDeleteV1beta1:
      type: object
      required:
        - items
      properties:
        items:
          type: array
          maxItems: 1000
          items:
            $ref: '#/components/schemas/RolePermissionsIdsV1beta1'
    RolePermissionsIdsErrorsV1beta1:
      type: object
      required:
        - id
        - httpStatusCode
        - errorCode
        - message
        - debugId
      properties:
        id:
          type: string
          description: The permission slug that caused the error
          example: compute.server.read
        httpStatusCode:
          type: integer
          description: The HTTP equivalent status code
          example: 500
        errorCode:
          type: string
          description: >-
            A unique machine-friendly identifier for the error from a global
            list of enumerated identifier strings.
          example: HPE_GL_ERROR_INTERNAL_SERVER_ERROR
        message:
          type: string
          description: A user-friendly error message
          example: >-
            The server encountered an unexpected condition which prevented it
            from fulfilling the request
        debugId:
          $ref: '#/components/schemas/DebugId'
        errorDetails:
          type: array
          description: Additional detailed information about the error
          items:
            $ref: '#/components/schemas/RetryData'
    RolePermissionsDeleteResponseV1beta1:
      type: object
      required:
        - successCount
        - errorCount
        - successes
        - errors
      properties:
        successCount:
          type: integer
          example: 1
        errorCount:
          type: integer
          example: 1
        successes:
          type: array
          items:
            $ref: '#/components/schemas/RolePermissionsIdsV1beta1'
        errors:
          type: array
          items:
            $ref: '#/components/schemas/RolePermissionsIdsErrorsV1beta1'
    RolePermissionsAddErrorsV1beta1:
      type: object
      required:
        - httpStatusCode
        - errorCode
        - message
        - debugId
      properties:
        httpStatusCode:
          type: integer
          description: The HTTP equivalent status code
          example: 500
        errorCode:
          type: string
          description: >-
            A unique machine-friendly identifier for the error from a global
            list of enumerated identifier strings.
          example: HPE_GL_ERROR_INTERNAL_SERVER_ERROR
        message:
          type: string
          description: A user-friendly error message
          example: >-
            The server encountered an unexpected condition which prevented it
            from fulfilling the request
        debugId:
          $ref: '#/components/schemas/DebugId'
        errorDetails:
          type: array
          description: Additional detailed information about the error
          items:
            $ref: '#/components/schemas/RetryData'
    RolePermissionsAddResponseV1beta1:
      type: object
      required:
        - successCount
        - errorCount
        - successes
        - errors
      properties:
        successCount:
          type: integer
          example: 1
        errorCount:
          type: integer
          example: 1
        successes:
          type: array
          items:
            $ref: '#/components/schemas/RolePermissionsIdsAddV1beta1'
        errors:
          type: array
          items:
            $ref: '#/components/schemas/RolePermissionsAddErrorsV1beta1'
    RolesListV1beta1:
      type: object
      required:
        - items
        - count
        - total
        - offset
      properties:
        items:
          type: array
          maxItems: 200
          items:
            $ref: '#/components/schemas/RoleGetV1beta1'
        count:
          $ref: '#/components/schemas/Count'
        total:
          $ref: '#/components/schemas/Total'
        offset:
          $ref: '#/components/schemas/Offset'
    RoleAssignmentV1beta1Common:
      type: object
      required:
        - type
        - principal
        - scope
        - role
        - principalMetadata
        - roleMetadata
        - generation
        - createdAt
        - updatedAt
      properties:
        type:
          type: string
          enum:
            - authorization/role-assignment
          description: The type of the resource.
          example: authorization/role-assignment
          readOnly: true
        principal:
          type: string
          description: >-
            The security principal identifier `{type}:{id}`. A principal is the
            entity that receives a role. The supported types are `user`,
            `user-group`, and `api-client`.
          example: user:123981y2zxhiz1890
        role:
          type: string
          description: >-
            The unique role identifier in GRN syntax. A role is a collection of
            permissions defining what actions the principal can perform.
          example: grn:glp/providers/authorization/roles/storageservices.LimitedAdmin
        scope:
          type: array
          description: >-
            Fully qualified scope string in GRN syntax. A scope is the specific
            resource or set of resources to which the role and its permissions
            apply. The scopes can be at the workspace level (limited to 1),
            tenant groups (up to 10), and scope groups (up to 10), and can be
            combined: `Workspace + Tenant Group` or `Tenant Group + Scope
            Group`.
          items:
            type: string
          minItems: 1
          maxItems: 20
          example:
            - >-
              grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/msp/tenant-groups/d88d38c9-8cf7-4ab8-a808-126b47bb787d
            - >-
              grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b70/regions/default/providers/authorization/scope-groups/21e582d3-fb24-4162-9fca-350defe24d3c
        principalMetadata:
          readOnly: true
          allOf:
            - type: object
              required:
                - id
                - type
              properties:
                id:
                  type: string
                  description: The unique identifier of the principal.
                  example: 123981y2zxhiz1890
                type:
                  type: string
                  description: The type of the principal.
                  enum:
                    - identity/user
                    - identity/user-group
                    - identity/api-client
        roleMetadata:
          readOnly: true
          allOf:
            - type: object
              required:
                - id
                - type
              properties:
                id:
                  type: string
                  format: uuid
                  description: The unique identifier of the role.
                  example: 44f0443c-fd03-47fc-981b-9c4333a37b44
                type:
                  type: string
                  example: authorization/role
                  description: The type of the role.
        generation:
          $ref: '#/components/schemas/Generation'
        createdAt:
          $ref: '#/components/schemas/CreatedAt'
        updatedAt:
          $ref: '#/components/schemas/UpdatedAt'
    RoleAssignmentV1beta1:
      allOf:
        - type: object
          required:
            - id
          properties:
            id:
              $ref: '#/components/schemas/UUID'
        - $ref: '#/components/schemas/RoleAssignmentV1beta1Common'
    RoleAssignmentV1beta1Update:
      allOf:
        - type: object
          required:
            - id
          properties:
            id:
              type: string
              format: uuid
              description: Immutable
        - $ref: '#/components/schemas/RoleAssignmentV1beta1Common'
    RoleAssignmentGetV1beta1:
      allOf:
        - type: object
          required:
            - id
          properties:
            id:
              $ref: '#/components/schemas/UUID'
        - $ref: '#/components/schemas/RoleAssignmentV1beta1Common'
        - type: object
          properties:
            source:
              $ref: '#/components/schemas/Source'
    RoleAssignmentListV1beta1:
      type: object
      required:
        - items
        - offset
        - count
        - total
      properties:
        items:
          type: array
          maxItems: 200
          items:
            $ref: '#/components/schemas/RoleAssignmentGetV1beta1'
        count:
          $ref: '#/components/schemas/Count'
        total:
          $ref: '#/components/schemas/Total'
        offset:
          $ref: '#/components/schemas/Offset'
    ScopeGroupCommonV1beta1:
      type: object
      required:
        - type
        - name
      properties:
        type:
          type: string
          enum:
            - authorization/scope-group
          readOnly: true
          example: authorization/scope-group
        name:
          type: string
          maxLength: 150
          description: >-
            Must be unique within the context it is being created (the
            organization or the organization and the workspace). Most ASCII
            chars are allowed, except [`&`, `<`, `>`, `|`, `:`, `,`] and leading
            or trailing space. Immutable.
          example: sg1
        description:
          type: string
          description: A short description of the scope group.
          maxLength: 256
          example: This group gives access to resource "host/123"
        grn:
          type: string
          description: >-
            The HPE GreenLake Resource Notation (GRN) is the standardized,
            URI-compatible syntax used to define and specify this scope within
            the HPE GreenLake.
          readOnly: true
          example: >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b60/regions/default/providers/authorization/scope-groups/05f0523c-fd03-47fc-981b-9c4333a37b78
        generation:
          $ref: '#/components/schemas/Generation'
        createdAt:
          $ref: '#/components/schemas/CreatedAt'
        updatedAt:
          $ref: '#/components/schemas/UpdatedAt'
    ScopeGroupV1beta1:
      allOf:
        - type: object
          required:
            - id
          properties:
            id:
              $ref: '#/components/schemas/UUID'
        - $ref: '#/components/schemas/ScopeGroupCommonV1beta1'
    ScopeGroupUpdateV1beta1:
      allOf:
        - type: object
          required:
            - id
          properties:
            id:
              type: string
              format: uuid
              description: The unique identifier and immutable
        - $ref: '#/components/schemas/ScopeGroupCommonV1beta1'
    ScopeGroupListV1beta1:
      type: object
      required:
        - items
        - offset
        - count
        - total
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/ScopeGroupV1beta1'
        count:
          $ref: '#/components/schemas/Count'
        total:
          $ref: '#/components/schemas/Total'
        offset:
          $ref: '#/components/schemas/Offset'
    ScopeGroupScopesGetV1beta1:
      type: object
      required:
        - id
        - type
        - grn
        - description
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        type:
          enum:
            - authorization/scope-group/scope
          type: string
          description: The type of the resource.
          example: authorization/scope-group/scope
          readOnly: true
        grn:
          type: string
          example: >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b60/regions/us-east/providers/bmaas/host/123
        description:
          type: string
          example: host 123
        region:
          type: string
          example: us-east-2
          readOnly: true
        allScopes:
          type: boolean
          example: false
          readOnly: true
        resourceTypeDisplayName:
          type: string
          example: Hosts
          readOnly: true
    ScopeGroupScopesV1beta1:
      type: object
      required:
        - grn
        - description
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        type:
          enum:
            - authorization/scope-group/scope
          example: authorization/scope-group/scope
          description: The type of the resource.
          readOnly: true
        grn:
          type: string
          example: >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b60/regions/us-east/providers/bmaas/host/123
        description:
          type: string
          example: host 123
        region:
          type: string
          example: us-east-2
          readOnly: true
        allScopes:
          type: boolean
          example: false
          readOnly: true
        resourceTypeDisplayName:
          type: string
          example: Hosts
          readOnly: true
    ScopeGroupScopesAddV1beta1:
      type: object
      required:
        - items
      properties:
        items:
          type: array
          maxItems: 500
          items:
            $ref: '#/components/schemas/ScopeGroupScopesV1beta1'
    ScopeGroupScopesListV1beta1:
      type: object
      required:
        - items
        - offset
        - count
        - total
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/ScopeGroupScopesGetV1beta1'
        count:
          $ref: '#/components/schemas/Count'
        total:
          $ref: '#/components/schemas/Total'
        offset:
          $ref: '#/components/schemas/Offset'
    ScopeGroupScopeIdsAddV1beta1:
      type: object
      required:
        - id
        - grn
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        grn:
          type: string
          example: >-
            grn:glp/workspaces/05f0523c-fd03-47fc-981b-9c4333a37b60/regions/us-east/providers/bmaas/host/123
    ScopeGroupScopeIdsV1beta1:
      type: object
      required:
        - id
      properties:
        id:
          type: string
          format: uuid
          example: e7b8f8e1-9ad5-432d-a858-499d9f279647
    ScopeGroupScopesDeleteV1beta1:
      type: object
      required:
        - items
      properties:
        items:
          type: array
          maxItems: 500
          items:
            $ref: '#/components/schemas/ScopeGroupScopeIdsV1beta1'
    ScopeGroupScopeIdsErrorsV1beta1:
      type: object
      required:
        - id
        - httpStatusCode
        - errorCode
        - message
        - debugId
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        httpStatusCode:
          type: integer
          description: The HTTP equivalent status code
          example: 500
        errorCode:
          type: string
          description: >-
            A unique machine-friendly identifier for the error from a global
            list of enumerated identifier strings.
          example: HPE_GL_ERROR_INTERNAL_SERVER_ERROR
        message:
          type: string
          description: A user-friendly error message
          example: >-
            The server encountered an unexpected condition which prevented it
            from fulfilling the request
        debugId:
          $ref: '#/components/schemas/DebugId'
        errorDetails:
          type: array
          description: Additional detailed information about the error
          items:
            $ref: '#/components/schemas/RetryData'
    ScopeGroupScopesDeleteResponseV1beta1:
      type: object
      required:
        - successCount
        - errorCount
        - successes
        - errors
      properties:
        successCount:
          type: integer
          example: 1
        errorCount:
          type: integer
          example: 1
        successes:
          type: array
          items:
            $ref: '#/components/schemas/ScopeGroupScopeIdsV1beta1'
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ScopeGroupScopeIdsErrorsV1beta1'
    ScopeGroupScopeAddErrorsV1beta1:
      type: object
      required:
        - httpStatusCode
        - errorCode
        - message
        - debugId
      properties:
        httpStatusCode:
          type: integer
          description: The HTTP equivalent status code
          example: 500
        errorCode:
          type: string
          description: >-
            A unique machine-friendly identifier for the error from a global
            list of enumerated identifier strings.
          example: HPE_GL_ERROR_INTERNAL_SERVER_ERROR
        message:
          type: string
          description: A user-friendly error message
          example: >-
            The server encountered an unexpected condition which prevented it
            from fulfilling the request.
        debugId:
          $ref: '#/components/schemas/DebugId'
        errorDetails:
          type: array
          description: Additional detailed information about the error
          items:
            $ref: '#/components/schemas/RetryData'
    ScopeGroupScopesAddResponseV1beta1:
      type: object
      required:
        - successCount
        - errorCount
        - successes
        - errors
      properties:
        successCount:
          type: integer
          example: 1
        errorCount:
          type: integer
          example: 1
        successes:
          type: array
          items:
            $ref: '#/components/schemas/ScopeGroupScopeIdsAddV1beta1'
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ScopeGroupScopeAddErrorsV1beta1'
    KindV1beta1:
      type: string
      description: Determines the type of role. Kind is immutable.
      enum:
        - CUSTOM
        - PREDEFINED
      example: CUSTOM
    CustomKindV1beta1:
      type: string
      readOnly: true
      description: Determines the type of role. Kind is immutable.
      enum:
        - CUSTOM
      example: CUSTOM
    Source:
      type: string
      enum:
        - LOCAL
        - EXTERNAL
      description: |
        The location where the configuration item is defined and managed <dl>
          <dt>LOCAL:</dt>
          <dd>The object is managed in the current workspace.</dd>
          <dt>EXTERNAL:</dt>
          <dd>The object is managed in another workspace or organization and projected into the current context.</dd>
        </dl>
    UUID:
      type: string
      description: The unique identifier of the role assignment.
      format: uuid
      readOnly: true
    Count:
      type: integer
      description: The number of items returned.
      example: 1
    Offset:
      type: integer
      description: The zero-based resource offset.
      example: 0
    Total:
      type: integer
      description: >-
        The total number of items in the collection that match the filter query,
        if one was provided in the request.
      example: 1
    Generation:
      type: integer
      format: int64
      example: 1
      readOnly: true
    CreatedAt:
      type: string
      description: The date and time the resource was created.
      format: date-time
      example: '2023-04-06T22:45:59.759943+00:00'
      readOnly: true
    UpdatedAt:
      type: string
      description: The date and time the resource was last updated.
      format: date-time
      example: '2023-04-06T22:45:59.759943+00:00'
      readOnly: true
    BadRequestError:
      type: object
      required:
        - httpStatusCode
        - errorCode
        - message
        - debugId
      properties:
        httpStatusCode:
          type: integer
          description: The HTTP equivalent status code.
          example: 400
        errorCode:
          type: string
          description: A unique machine-friendly identifier for the error.
          example: HPE_AUTHZ_INVALID_FORMAT
        message:
          type: string
          description: A user-friendly error message.
          example: Invalid format of field "foo"
        debugId:
          $ref: '#/components/schemas/DebugId'
        errorDetails:
          type: array
          description: Additional detailed information about the error
          items:
            type: object
            required:
              - type
              - issues
            properties:
              type:
                type: string
                description: The type of error details.
                example: hpe.greenlake.bad_request
              issues:
                type: array
                description: Array of bad request issues
                items:
                  $ref: '#/components/schemas/BadRequestIssues'
    BadRequestIssues:
      type: object
      required:
        - source
        - subject
      properties:
        source:
          type: string
          description: The part of the request with an issue.
          enum:
            - field
            - header
            - query.parameter
          example: field
        subject:
          type: string
          description: The specific issue key.
          example: foo.bar
        description:
          type: string
          description: >-
            An elaborate description of the issue. This can be used by
            developers to understand how the failure can be addressed.
          example: 'Invalid format: field "foo" is incompatible'
    UnauthorizedError:
      type: object
      required:
        - httpStatusCode
        - errorCode
        - message
        - debugId
      properties:
        httpStatusCode:
          type: integer
          description: The HTTP equivalent status code.
          example: 401
        errorCode:
          type: string
          description: A unique machine-friendly identifier for the error.
          example: HPE_AUTHZ_EXPIRED_TOKEN
        message:
          type: string
          description: A user-friendly error message.
          example: Authentication error
        debugId:
          $ref: '#/components/schemas/DebugId'
    ForbiddenError:
      type: object
      required:
        - httpStatusCode
        - errorCode
        - message
        - debugId
      properties:
        httpStatusCode:
          type: integer
          description: The HTTP equivalent status code.
          example: 403
        errorCode:
          type: string
          description: A unique machine-friendly identifier for the error.
          example: HPE_AUTHZ_BLOCKED_USER
        message:
          type: string
          description: A user-friendly error message.
          example: Action is blocked for this user
        debugId:
          $ref: '#/components/schemas/DebugId'
    NotFoundError:
      type: object
      required:
        - httpStatusCode
        - errorCode
        - message
        - debugId
      properties:
        httpStatusCode:
          type: integer
          description: The HTTP equivalent status code.
          example: 404
        errorCode:
          type: string
          description: A unique machine-friendly identifier for the error.
          example: HPE_GL_ERROR_NOT_FOUND
        message:
          type: string
          description: A user-friendly error message.
          example: The resource was not found
        debugId:
          $ref: '#/components/schemas/DebugId'
    ConflictError:
      type: object
      required:
        - httpStatusCode
        - errorCode
        - message
        - debugId
      properties:
        httpStatusCode:
          type: integer
          description: The HTTP equivalent status code.
          example: 409
        errorCode:
          type: string
          enum:
            - HPE_GL_AUTHORIZATION_ALREADY_CREATED
            - HPE_GL_AUTHORIZATION_RESOURCE_CONFLICT
          description: |
            A unique machine-friendly identifier for the error. <dl>
              <dt>HPE_GL_AUTHORIZATION_ALREADY_CREATED:</dt>
              <dd>An exact copy of this resource already exists</dd>
              <dt>HPE_GL_AUTHORIZATION_RESOURCE_CONFLICT:</dt>
              <dd>An instance with same unique identifier(s) already exists</dd>
            </dl>
          example: HPE_GL_AUTHORIZATION_ALREADY_CREATED
        message:
          type: string
          description: A user-friendly error message.
          example: There is a conflict with the current state of the target resource
        debugId:
          $ref: '#/components/schemas/DebugId'
    PreconditionFailedError:
      type: object
      required:
        - httpStatusCode
        - errorCode
        - message
        - debugId
      properties:
        httpStatusCode:
          type: integer
          description: The HTTP equivalent status code.
          example: 412
        errorCode:
          type: string
          description: A unique machine-friendly identifier for the error.
          example: HPE_GL_AUTHORIZATION_ALREADY_CREATED
        message:
          type: string
          description: A user-friendly error message.
          example: Precondition Failed
        debugId:
          $ref: '#/components/schemas/DebugId'
        errorDetails:
          type: array
          description: Additional data on why the request is bad.
          items:
            type: object
            required:
              - type
              - issues
            properties:
              type:
                type: string
                description: The type of error details.
                example: hpe.greenlake.precondition_failed
              issues:
                type: array
                description: Array of precondition issues
                items:
                  $ref: '#/components/schemas/PreconditionFailedIssues'
    PreconditionFailedIssues:
      type: object
      required:
        - source
        - subject
      properties:
        source:
          type: string
          description: A service specific type.
          example: hpe.greenlake.organizations.verification
        subject:
          type: string
          description: The specific issue key.
          example: Not allowed to delete object in use
        description:
          type: string
          description: >-
            An elaborate description of how the precondition failed. This can be
            used by developers to understand how the failure can be fixed.
          example: Scope Group used in role assignment.
    TooManyRequestsError:
      type: object
      required:
        - httpStatusCode
        - errorCode
        - message
        - debugId
      properties:
        httpStatusCode:
          type: integer
          description: The HTTP equivalent status code.
          example: 429
        errorCode:
          type: string
          description: >-
            A unique machine-friendly identifier for the error from a global
            list  of enumerated identifier strings.
          example: HPE_GL_ERROR_TOO_MANY_REQUESTS
        message:
          type: string
          description: A user-friendly error message.
          example: User sent too many requests
        debugId:
          $ref: '#/components/schemas/DebugId'
    InternalError:
      type: object
      required:
        - httpStatusCode
        - errorCode
        - message
        - debugId
      properties:
        httpStatusCode:
          type: integer
          description: The HTTP equivalent status code.
          example: 500
        errorCode:
          type: string
          description: >-
            A unique machine-friendly identifier for the error from a global
            list of enumerated identifier strings.
          example: HPE_GL_ERROR_INTERNAL_SERVER_ERROR
        message:
          type: string
          description: A user-friendly error message.
          example: >-
            The server encountered an unexpected condition which prevented it 
            from fulfilling the request.
        debugId:
          $ref: '#/components/schemas/DebugId'
        errorDetails:
          type: array
          description: Additional detailed information about the error
          items:
            $ref: '#/components/schemas/RetryData'
    ServiceUnavailableError:
      type: object
      required:
        - httpStatusCode
        - errorCode
        - message
        - debugId
      properties:
        httpStatusCode:
          type: integer
          description: The HTTP equivalent status code.
          example: 503
        errorCode:
          type: string
          description: A unique machine-friendly identifier for the error.
          example: HPE_GL_ERROR_SERVICE_UNAVAILABLE
        message:
          type: string
          description: A user-friendly error message.
          example: The server is not ready to handle the request
        debugId:
          $ref: '#/components/schemas/DebugId'
        errorDetails:
          type: array
          description: Additional detailed information about the error
          items:
            $ref: '#/components/schemas/RetryData'
    RetryData:
      type: object
      required:
        - type
        - retryAfterSeconds
      properties:
        type:
          type: string
          description: The type of error details.
          example: hpe.greenlake.retry_info
        retryAfterSeconds:
          type: integer
          description: Seconds to wait before retrying.
          example: 30
    DebugId:
      type: string
      description: A unique identifier for the instance of this error.
      example: 12312-123123-123123-1231212
  parameters:
    LimitV1beta1:
      in: query
      name: limit
      description: Total number of results to be returned
      schema:
        type: integer
        default: 100
        maximum: 200
    Offset:
      in: query
      name: offset
      description: Zero-based resource offset to start the response from
      schema:
        type: integer
        default: 0
  responses:
    BadRequest:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/BadRequestError'
    Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/UnauthorizedError'
    Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ForbiddenError'
    NotFound:
      description: Not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/NotFoundError'
    Conflict:
      description: Conflict
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ConflictError'
    PreconditionFailed:
      description: Precondition Failed
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/PreconditionFailedError'
    TooManyRequests:
      description: Too Many Requests
      headers:
        X-RateLimit-Limit:
          schema:
            type: string
          description: Limit of requests per period or created objects.
        X-RateLimit-Remaining:
          schema:
            type: string
          description: >-
            Remaining number of requests for the current period or objects to
            create.
        X-RateLimit-Reset:
          schema:
            type: string
          description: Time remaining in the current period in seconds.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/TooManyRequestsError'
    InternalServerError:
      description: Internal Server Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/InternalError'
    ServiceUnavailable:
      description: Service Unavailable
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ServiceUnavailableError'
