-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathapi_data.js
More file actions
10598 lines (10598 loc) · 401 KB
/
api_data.js
File metadata and controls
10598 lines (10598 loc) · 401 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
define({ "api": [
{
"group": "Auth",
"type": "post",
"url": "/v0/auth/opa/decision[/path...]",
"title": "Get Auth Decision From OPA",
"description": "<p>Ask OPA (<a href=\"https://www.openpolicyagent.org/\">Open Policy Agent</a>) make authorisation decision on proposed resource operation URI. The resource operation URI is supplied as part of request URL path. e.g. a request sent to URL <code>https://<host>/api/v0/auth/opa/decision/object/dataset/draft/read</code> indicates an authorisation decision for is sought:</p> <ul> <li>operation uri: <code>object/dataset/draft/read</code></li> <li>resource uri: <code>object/dataset/draft</code></li> </ul> <p>The <code>resource uri</code> & <code>operation uri</code> info together with:</p> <ul> <li>other optional extra context data supplied</li> <li>current user profile. e.g. roles & permissions</li> </ul> <p>will be used to construct the context data object <code>input</code> that will be used to assist OPA's auth decision making.</p> <p>Regardless the <code>operation uri</code> supplied, this endpoint will always ask OPA to make decision using entrypoint policy <code>entrypoint/allow.rego</code>. The <code>entrypoint/allow.rego</code> should be responsible for delegating the designated policy to make the actual auth decision for a particular type of resource.</p> <p>e.g. The default policy <code>entrypoint/allow.rego</code> will delegate policy <code>object/dataset/allow.rego</code> to make decision for operation uri: <code>object/dataset/draft/read</code>.</p> <p>Please note: you can <a href=\"https://github.com/magda-io/magda/blob/master/docs/docs/how-to-add-custom-opa-policies.md\">replace built-in policy files</a> (including <code>entrypoint/allow.rego</code>) when deploy Magda with helm config.</p> <blockquote> <p>This API endpoint is also available as a HTTP GET endpoint. You can access the same functionality via the GET endpoint except not being able to supply parameters via HTTP request body.</p> </blockquote>",
"parameter": {
"fields": {
"Request URL Path": [
{
"group": "Request URL Path",
"type": "String",
"optional": false,
"field": "path",
"description": "<p>The URI of the resource operation that you propose to perform. From this URI (e.g. <code>object/dataset/draft/read</code>), we can also work out resource URI(e.g. <code>object/dataset/draft</code>). Depends on policy logic, URI pattern (e.g. <code>object/dataset/*&#47;read</code>) might be supported.</p> <blockquote> <p>If you request the decision for a non-exist resource type, the default policy will evaluate to <code>false</code> (denied).</p> </blockquote>"
}
],
"Query String Parameters": [
{
"group": "Query String Parameters",
"type": "String",
"optional": true,
"field": "operationUri",
"description": "<p>Use to supply / overwrite the operation uri. Any parameters supplied via <code>Query String Parameters</code> have higher priority. Thus, can overwrite the same parameter supplied via <code>Request Body JSON</code>. However, <code>operationUri</code> supplied via <code>Query String Parameters</code> can't overwrite the <code>operationUri</code> supplied via <code>Request URL Path</code>.</p>"
},
{
"group": "Query String Parameters",
"type": "String",
"optional": true,
"field": "resourceUri",
"description": "<p>Use to supply / overwrite the resource uri. Please note: Magda's built-in policies don't utilise <code>resourceUri</code> as we can figure it out from <code>operationUri</code> instead. This interface is provided to facilitate users' own customised implementation only.</p>"
},
{
"group": "Query String Parameters",
"type": "String[]",
"optional": true,
"field": "unknowns",
"description": "<p>Use to supply A list of references that should be considered as "unknown" during the policy evaluation. If a conclusive/unconditional auth decision can't be made without knowing "unknown" data, the residual rules of the "partial evaluation" result will be responded in <a href=\"https://www.openpolicyagent.org/docs/latest/policy-language/\">rego</a> AST JSON format. e.g. When <code>unknowns=["input.object.dataset"]</code>, any rules related to dataset's attributes will be kept and output as residual rules, unless existing context info is sufficient to make a conclusive/unconditional auth decision (e.g. admin can access all datasets the values of regardless dataset attributes).</p> <blockquote> <p>Please note: When <code>unknowns</code> is NOT supplied, this endpoint will auto-generate a JSON path that is made up of string "input" and the first segment of <code>operationUri</code> as the unknown reference. e.g. When <code>operationUri</code> = <code>object/dataset/draft/read</code> and <code>unknowns</code> parameter is not supplied, by default, this endpoint will set <code>unknowns</code> parameter's value to array ["input.object"].</p> </blockquote> <blockquote> <p>However, when extra context data is supplied as part request data at JSON path <code>input.object</code>, the <code>unknowns</code> will not be auto-set.</p> </blockquote> <blockquote> <p>If you want to force stop the endpoint from auto-generating <code>unknowns</code>, you can supply <code>unknowns</code> parameter as an empty string. Please note: When <code>unknowns</code> is set to an empty string, the request will be send to <a href=\"https://www.openpolicyagent.org/docs/latest/rest-api/#get-a-document-with-input\">"full evaluation endpoint"</a>, instead of <a href=\"https://www.openpolicyagent.org/docs/latest/rest-api/#compile-api\">"partial evaluation endpoint"</a>. You will always get definite answer from "full evaluation endpoint".</p> </blockquote> <blockquote> <p>Please note: you can supply an array by a query string like <code>unknowns=ref1&unknowns=ref2</code></p> </blockquote>"
},
{
"group": "Query String Parameters",
"type": "string",
"allowedValues": [
"\"true\""
],
"optional": true,
"field": "rawAst",
"description": "<p>Output RAW AST response from OPA instead parsed & processed result. As long as the parameter present in query string, the RAW AST option will be turned on. e.g. both <code>?rawAst</code> & <code>?rawAst=true</code> will work.</p>"
},
{
"group": "Query String Parameters",
"type": "string",
"allowedValues": [
"\"full\""
],
"optional": true,
"field": "explain",
"description": "<p>Include OPA decision explanation in the RAW AST response from OPA. Only work when <code>rawAst</code> is on.</p>"
},
{
"group": "Query String Parameters",
"type": "string",
"allowedValues": [
"\"true\""
],
"optional": true,
"field": "pretty",
"description": "<p>Include human readable OPA decision explanation in the RAW AST response from OPA. Only work when <code>rawAst</code> is on & <code>explain</code>="full".</p>"
},
{
"group": "Query String Parameters",
"type": "string",
"allowedValues": [
"\"true\""
],
"optional": true,
"field": "humanReadable",
"description": "<p>Output parsed & processed result in human readable format. This option will not work when <code>rawAst</code> is on. As long as the parameter present in query string, the <code>humanReadable</code> option will be turned on. e.g. both <code>?humanReadable</code> & <code>?humanReadable=true</code> will work.</p>"
},
{
"group": "Query String Parameters",
"type": "string",
"allowedValues": [
"\"false\""
],
"optional": true,
"field": "concise",
"description": "<p>Output parsed & processed result in a concise format. This is default output format. This option will not work when <code>rawAst</code> is on. You can set <code>concise</code>=<code>false</code> to output a format more similar to original OPA AST (with more details).</p>"
}
],
"Request Body JSON": [
{
"group": "Request Body JSON",
"type": "String",
"optional": true,
"field": "operationUri",
"description": "<p>Same as <code>operationUri</code> in query parameter. Users can also opt to supply <code>operationUri</code> via request body instead.</p>"
},
{
"group": "Request Body JSON",
"type": "String",
"optional": true,
"field": "resourceUri",
"description": "<p>Same as <code>resourceUri</code> in query parameter. Users can also opt to supply <code>resourceUri</code> via request body instead.</p>"
},
{
"group": "Request Body JSON",
"type": "String[]",
"optional": true,
"field": "unknowns",
"description": "<p>Same as <code>unknowns</code> in query parameter. Users can also opt to supply <code>unknowns</code> via request body instead.</p>"
},
{
"group": "Request Body JSON",
"type": "Object",
"optional": true,
"field": "input",
"description": "<p>OPA "<code>input</code> data". Use to provide extra context data to support the auth decision making. e.g. When you need to make decision on one particular dataset (rather than a group of dataset), you can supply the <code>input</code> data object as the following:</p> <pre><code class=\"language-json\">{ "object": { "dataset": { // all dataset attributes ... } } } </code></pre> <blockquote> <p>Please note: It's not possible to overwrite system generated context data fields via <code>input</code> data object. e.g:</p> <ul> <li><code>input.user</code></li> <li><code>input.timestamp</code></li> </ul> </blockquote>"
}
]
}
},
"success": {
"fields": {
"Success JSON Response Body": [
{
"group": "Success JSON Response Body",
"type": "bool",
"optional": false,
"field": "hasResidualRules",
"description": "<p>indicates whether or not the policy engine can make a conclusive/unconditional auth decision. When a conclusive/unconditional auth decision is made (i.e. <code>hasResidualRules</code>=<code>false</code>), the auth decision is returned as policy evaluation value in <code>result</code> field. Usually, <code>true</code> means the operation should be <code>allowed</code>.</p>"
},
{
"group": "Success JSON Response Body",
"type": "any",
"optional": true,
"field": "result",
"description": "<p>Only presents when <code>hasResidualRules</code>=<code>false</code>. The result field contains the policy evaluation result value. <code>true</code> means the operation is allowed and <code>false</code> means otherwise. By default, it should be in <code>bool</code> type. However, you can opt to overwrite the policy to return other type of data.</p>"
},
{
"group": "Success JSON Response Body",
"type": "string[]",
"optional": true,
"field": "unknowns",
"description": "<p>Will include any <code>unknowns</code> references set (either explicitly set or auto-set by this API) when request an auth decision from the policy engine.</p>"
},
{
"group": "Success JSON Response Body",
"type": "object[]",
"optional": true,
"field": "residualRules",
"description": "<p>Only presents when <code>hasResidualRules</code>=<code>true</code>. A list of residual rules as the result of the partial evaluation of policy due to <code>unknowns</code>. The residual rules can be used to generate storage engine DSL (e.g. SQL or Elasticsearch DSL) for policy enforcement.</p>"
},
{
"group": "Success JSON Response Body",
"type": "bool",
"optional": true,
"field": "hasWarns",
"description": "<p>indicates whether or not the warning messages have been produced during OPA AST parsing. Not available when <code>rawAst</code> query parameter is set.</p>"
},
{
"group": "Success JSON Response Body",
"type": "string[]",
"optional": true,
"field": "warns",
"description": "<p>Any warning messages that are produced during OPA AST parsing. Only available when <code>hasWarns</code>=<code>true</code>.</p>"
}
]
},
"examples": [
{
"title": "Unconditional Result Example",
"content": "{\n \"hasResidualRules\" : false,\n \"unknowns\": [],\n \"result\": true // -- the evaluation value of the policy. By default, `true` means operation should be `allowed`.\n}",
"type": "json"
},
{
"title": "Partial Evaluation Result Example (Default Concise Format)",
"content": "\n{\n \"hasResidualRules\":true,\n \"residualRules\": [{\"default\":false,\"value\":true,\"fullName\":\"data.partial.object.record.allow\",\"name\":\"allow\",\"expressions\":[{\"negated\":false,\"operator\":null,\"operands\":[{\"isRef\":true,\"value\":\"input.object.dataset.dcat-dataset-strings\"}]},{\"negated\":false,\"operator\":\"=\",\"operands\":[{\"isRef\":true,\"value\":\"input.object.record.publishing.state\"},{\"isRef\":false,\"value\":\"published\"}]}]}],\n \"unknowns\": [\"input.object.dataset\"],\n \"hasWarns\":false\n }",
"type": "json"
},
{
"title": "Partial Evaluation Result Example (Raw AST)",
"content": "\n{\n \"hasResidualRules\": true,\n \"unknowns\": [\"input.object.dataset\"],\n \"residualRules\": [{\"default\":true,\"head\":{\"name\":\"allow\",\"value\":{\"type\":\"boolean\",\"value\":false}},\"body\":[{\"terms\":{\"type\":\"boolean\",\"value\":true},\"index\":0}]},{\"head\":{\"name\":\"allow\",\"value\":{\"type\":\"boolean\",\"value\":true}},\"body\":[{\"terms\":[{\"type\":\"ref\",\"value\":[{\"type\":\"var\",\"value\":\"eq\"}]},{\"type\":\"ref\",\"value\":[{\"type\":\"var\",\"value\":\"input\"},{\"type\":\"string\",\"value\":\"object\"},{\"type\":\"string\",\"value\":\"dataset\"},{\"type\":\"string\",\"value\":\"publishingState\"}]},{\"type\":\"string\",\"value\":\"published\"}],\"index\":0}]}]\n}",
"type": "json"
}
]
},
"error": {
"examples": [
{
"title": "Error Response Example / Status Code: 500/400",
"content": "Failed to get auth decision: xxxxxxxxx",
"type": "string"
}
]
},
"version": "0.0.0",
"filename": "/home/runner/work/magda/magda/magda-authorization-api/src/createOpaRouter.ts",
"groupTitle": "Authorization API",
"name": "PostV0AuthOpaDecisionPath"
},
{
"group": "Auth_API_Keys",
"type": "delete",
"url": "/v0/auth/users/:userId/apiKeys/:apiKeyId",
"title": "Delete an API Key of the user",
"description": "<p>Delete an API Key of the user You need have <code>authObject/apiKey/delete</code> permission in order to access this API. As the default <code>Authenticated Users</code> roles contains the permission to all <code>authObject/apiKey/*</code> type operations with ownership constraint. All <code>Authenticated Users</code> (i.e. non-anonymous) users should always have access to their own API keys.</p>",
"parameter": {
"fields": {
"Path": [
{
"group": "Path",
"type": "string",
"optional": false,
"field": "userId",
"description": "<p>the id of the user.</p>"
},
{
"group": "Path",
"type": "string",
"optional": false,
"field": "apiKeyId",
"description": "<p>the id of the api key.</p>"
}
]
}
},
"success": {
"examples": [
{
"title": "200",
"content": "{\n \"deleted\": true\n}",
"type": "json"
}
]
},
"error": {
"examples": [
{
"title": "401/404/500",
"content": "{\n \"isError\": true,\n \"errorCode\": 401, //--- or 404, 500 depends on error type\n \"errorMessage\": \"Not authorized\"\n}",
"type": "json"
}
]
},
"version": "0.0.0",
"filename": "/home/runner/work/magda/magda/magda-authorization-api/src/apiRouters/createUserApiRouter.ts",
"groupTitle": "Auth_API_Keys",
"name": "DeleteV0AuthUsersUseridApikeysApikeyid"
},
{
"group": "Auth_API_Keys",
"type": "get",
"url": "/v0/auth/users/:userId/apiKeys",
"title": "Get all API keys of a user",
"description": "<p>Returns an array of api keys. When no api keys can be found, an empty array will be returned. You need have <code>authObject/apiKey/read</code> permission in order to access this API. As the default <code>Authenticated Users</code> roles contains the permission to all <code>authObject/apiKey/*</code> type operations with ownership constraint. All <code>Authenticated Users</code> (i.e. non-anonymous) users should always have access to their own API keys.</p>",
"parameter": {
"fields": {
"Path": [
{
"group": "Path",
"type": "string",
"optional": false,
"field": "userId",
"description": "<p>the id of the user.</p>"
}
]
}
},
"success": {
"examples": [
{
"title": "200",
"content": "[{\n id: \"b559889a-2843-4a60-9c6d-103d51eb4410\",\n user_id: \"be374b6e-d428-4211-b642-b2b65abcf051\",\n created_timestamp: \"2022-05-16T13:02:59.430Z\",\n expiry_time: null,\n last_successful_attempt_time: null,\n last_failed_attempt_time: null,\n enabled: true\n}]",
"type": "json"
}
]
},
"error": {
"examples": [
{
"title": "401/500",
"content": "{\n \"isError\": true,\n \"errorCode\": 401, //--- or 500 depends on error type\n \"errorMessage\": \"Not authorized\"\n}",
"type": "json"
}
]
},
"version": "0.0.0",
"filename": "/home/runner/work/magda/magda/magda-authorization-api/src/apiRouters/createUserApiRouter.ts",
"groupTitle": "Auth_API_Keys",
"name": "GetV0AuthUsersUseridApikeys"
},
{
"group": "Auth_API_Keys",
"type": "get",
"url": "/v0/auth/users/:userId/apiKeys/:apiKeyId",
"title": "Get an API key of a user by ID",
"description": "<p>Get an API key record of a user by ID by API key ID. You need have <code>authObject/apiKey/read</code> permission in order to access this API. As the default <code>Authenticated Users</code> roles contains the permission to all <code>authObject/apiKey/*</code> type operations with ownership constraint. All <code>Authenticated Users</code> (i.e. non-anonymous) users should always have access to their own API keys.</p>",
"parameter": {
"fields": {
"Path": [
{
"group": "Path",
"type": "string",
"optional": false,
"field": "userId",
"description": "<p>the id of the user.</p>"
},
{
"group": "Path",
"type": "string",
"optional": false,
"field": "apiKeyId",
"description": "<p>the id of the api key.</p>"
}
]
}
},
"success": {
"examples": [
{
"title": "200",
"content": "{\n id: \"b559889a-2843-4a60-9c6d-103d51eb4410\",\n user_id: \"be374b6e-d428-4211-b642-b2b65abcf051\",\n created_timestamp: \"2022-05-16T13:02:59.430Z\",\n expiry_time: null,\n last_successful_attempt_time: null,\n last_failed_attempt_time: null,\n enabled: true\n}",
"type": "json"
}
]
},
"error": {
"examples": [
{
"title": "401/500",
"content": "{\n \"isError\": true,\n \"errorCode\": 401, //--- or 500 depends on error type\n \"errorMessage\": \"Not authorized\"\n}",
"type": "json"
}
]
},
"version": "0.0.0",
"filename": "/home/runner/work/magda/magda/magda-authorization-api/src/apiRouters/createUserApiRouter.ts",
"groupTitle": "Auth_API_Keys",
"name": "GetV0AuthUsersUseridApikeysApikeyid"
},
{
"group": "Auth_API_Keys",
"type": "get",
"url": "/v0/private/users/apikey/:apiKeyId",
"title": "Api Key Verification API",
"description": "<p>Retrieve user info with api key id & api key. This api is only available within cluster (i.e. it's not available via gateway) and only created for the gateway for purpose of verifying incoming API keys. This route doesn't require auth decision to be made as a user must provide valid API key id & key to retrieve his own user info only.</p>",
"success": {
"examples": [
{
"title": "200",
"content": "{\n \"id\":\"...\",\n \"displayName\":\"Fred Nerk\",\n \"photoURL\":\"...\",\n \"OrgUnitId\": \"xxx\"\n ...\n}",
"type": "json"
}
]
},
"error": {
"examples": [
{
"title": "401/500",
"content": "{\n \"isError\": true,\n \"errorCode\": 401, //--- or 500 depends on error type\n \"errorMessage\": \"Not authorized\"\n}",
"type": "json"
}
]
},
"version": "0.0.0",
"filename": "/home/runner/work/magda/magda/magda-authorization-api/src/createApiRouter.ts",
"groupTitle": "Auth_API_Keys",
"name": "GetV0PrivateUsersApikeyApikeyid"
},
{
"group": "Auth_API_Keys",
"type": "post",
"url": "/v0/auth/users/:userId/apiKeys",
"title": "Create a new API key for the user",
"description": "<p>Create a new API key for the specified user. Optional supply a JSON object that contains <code>expiry_time</code> in body. You need have <code>authObject/apiKey/create</code> permission in order to access this API. As the default <code>Authenticated Users</code> roles contains the permission to all <code>authObject/apiKey/*</code> type operations with ownership constraint. All <code>Authenticated Users</code> (i.e. non-anonymous) users should always have access to their own API keys.</p>",
"parameter": {
"fields": {
"Path": [
{
"group": "Path",
"type": "string",
"optional": false,
"field": "userId",
"description": "<p>the id of the user.</p>"
}
],
"Json Body": [
{
"group": "Json Body",
"type": "string",
"optional": true,
"field": "expiryTime",
"description": "<p>The expiry time (in ISO format (ISO 8601)) of the API key that is about to be created.</p>"
}
]
},
"examples": [
{
"title": "(Body) {json}:",
"content": "{\n expiryTime: \"2022-05-16T13:02:59.430Z\"\n}",
"type": "json"
}
]
},
"success": {
"examples": [
{
"title": "200",
"content": "{\n id: \"b559889a-2843-4a60-9c6d-103d51eb4410\",\n key: \"1RoGs0+MMYxjJlGH6UkyRnXC8Wrc9Y1ecREAnm5D2GM=\"\n}",
"type": "json"
}
]
},
"error": {
"examples": [
{
"title": "401/404/500",
"content": "{\n \"isError\": true,\n \"errorCode\": 401, //--- or 404, 500 depends on error type\n \"errorMessage\": \"Not authorized\"\n}",
"type": "json"
}
]
},
"version": "0.0.0",
"filename": "/home/runner/work/magda/magda/magda-authorization-api/src/apiRouters/createUserApiRouter.ts",
"groupTitle": "Auth_API_Keys",
"name": "PostV0AuthUsersUseridApikeys"
},
{
"group": "Auth_API_Keys",
"type": "put",
"url": "/v0/auth/users/:userId/apiKeys/:apiKeyId",
"title": "Update an API Key of the user",
"description": "<p>Update an API Key of the user. You need have <code>authObject/apiKey/update</code> permission in order to access this API. As the default <code>Authenticated Users</code> roles contains the permission to all <code>authObject/apiKey/*</code> type operations with ownership constraint. All <code>Authenticated Users</code> (i.e. non-anonymous) users should always have access to their own API keys.</p>",
"parameter": {
"fields": {
"Path": [
{
"group": "Path",
"type": "string",
"optional": false,
"field": "userId",
"description": "<p>the id of the user.</p>"
},
{
"group": "Path",
"type": "string",
"optional": false,
"field": "apiKeyId",
"description": "<p>the id of the api key.</p>"
}
],
"Json Body": [
{
"group": "Json Body",
"type": "string",
"optional": true,
"field": "expiryTime",
"description": "<p>The expiry time (in ISO format (ISO 8601)) of the API key.</p>"
},
{
"group": "Json Body",
"type": "boolean",
"optional": true,
"field": "enabled",
"description": "<p>Whether the api key is enabled.</p>"
}
]
},
"examples": [
{
"title": "(Body) {json}:",
"content": "{\n \"enabled\": false\n}",
"type": "json"
}
]
},
"success": {
"examples": [
{
"title": "200",
"content": "{\n id: \"b559889a-2843-4a60-9c6d-103d51eb4410\",\n user_id: \"be374b6e-d428-4211-b642-b2b65abcf051\",\n created_timestamp: \"2022-05-16T13:02:59.430Z\",\n hash: \"$2b$10$6DD8hle27X/dVdDD3Sl3Y.V6NtJ9jBiy2cyS8SnBO5EEWMD5Wpdwe\",\n expiry_time: null,\n last_successful_attempt_time: null,\n last_failed_attempt_time: null,\n enabled: false\n}",
"type": "json"
}
]
},
"error": {
"examples": [
{
"title": "401/404/500",
"content": "{\n \"isError\": true,\n \"errorCode\": 401, //--- or 404, 500 depends on error type\n \"errorMessage\": \"Not authorized\"\n}",
"type": "json"
}
]
},
"version": "0.0.0",
"filename": "/home/runner/work/magda/magda/magda-authorization-api/src/apiRouters/createUserApiRouter.ts",
"groupTitle": "Auth_API_Keys",
"name": "PutV0AuthUsersUseridApikeysApikeyid"
},
{
"group": "Auth_Access_Groups",
"type": "delete",
"url": "/v0/auth/accessGroups/:groupId",
"title": "Delete an access group",
"description": "<p>Delete an access group You can only delete an access group when all resources (e.g. datasets) that are associated with the access group are removed from the access group. Once an access group is deleted, the role & permission that are associated with the access group will be also deleted.</p> <p>You need <code>object/record/delete</code> permission to the access group record in order to access this API.</p>",
"parameter": {
"fields": {
"URL Path": [
{
"group": "URL Path",
"type": "string",
"optional": false,
"field": "groupId",
"description": "<p>id of the access group</p>"
}
]
}
},
"success": {
"fields": {
"Success 200": [
{
"group": "Success 200",
"optional": true,
"field": "Response",
"description": "<p>Body] {boolean} result Indicates whether the deletion action is actually performed or the access group doesn't exist.</p>"
}
]
},
"examples": [
{
"title": "200",
"content": "{\n result: true\n}",
"type": "json"
}
]
},
"error": {
"examples": [
{
"title": "401/500",
"content": "{\n \"isError\": true,\n \"errorCode\": 401, //--- or 500 depends on error type\n \"errorMessage\": \"Not authorized\"\n}",
"type": "json"
}
]
},
"version": "0.0.0",
"filename": "/home/runner/work/magda/magda/magda-authorization-api/src/apiRouters/createAccessGroupApiRouter.ts",
"groupTitle": "Auth_Access_Groups",
"name": "DeleteV0AuthAccessgroupsGroupid"
},
{
"group": "Auth_Access_Groups",
"type": "delete",
"url": "/v0/auth/accessGroups/:groupId/datasets/:datasetId",
"title": "Remove an Dataset from an Access Group",
"description": "<p>Remove an Dataset from an Access Group</p> <p>Access group users will lost the access (granted by the access group) to the removed dataset.</p> <p>You need <code>object/record/update</code> permission to the access group.</p>",
"parameter": {
"fields": {
"URL Path": [
{
"group": "URL Path",
"type": "string",
"optional": false,
"field": "groupId",
"description": "<p>id of the access group</p>"
},
{
"group": "URL Path",
"type": "string",
"optional": false,
"field": "datasetId",
"description": "<p>id of the dataset</p>"
}
]
}
},
"success": {
"fields": {
"Success 200": [
{
"group": "Success 200",
"optional": true,
"field": "Response",
"description": "<p>Body] {boolean} result Indicates whether the action is actually performed or the dataset had already been removed from the access group.</p>"
}
]
},
"examples": [
{
"title": "200",
"content": "{\n result: true\n}",
"type": "json"
}
]
},
"error": {
"examples": [
{
"title": "401/500",
"content": "{\n \"isError\": true,\n \"errorCode\": 401, //--- or 500 depends on error type\n \"errorMessage\": \"Not authorized\"\n}",
"type": "json"
}
]
},
"version": "0.0.0",
"filename": "/home/runner/work/magda/magda/magda-authorization-api/src/apiRouters/createAccessGroupApiRouter.ts",
"groupTitle": "Auth_Access_Groups",
"name": "DeleteV0AuthAccessgroupsGroupidDatasetsDatasetid"
},
{
"group": "Auth_Access_Groups",
"type": "delete",
"url": "/v0/auth/accessGroups/:groupId/users/:userId",
"title": "Remove an User from an Access Group",
"description": "<p>Remove an User from an Access Group</p> <p>You need <code>object/record/update</code> permission to the access group record in order to access this API.</p>",
"parameter": {
"fields": {
"URL Path": [
{
"group": "URL Path",
"type": "string",
"optional": false,
"field": "groupId",
"description": "<p>id of the access group</p>"
},
{
"group": "URL Path",
"type": "string",
"optional": false,
"field": "userId",
"description": "<p>id of the user to be added to the access group</p>"
}
]
}
},
"success": {
"fields": {
"Success 200": [
{
"group": "Success 200",
"optional": true,
"field": "Response",
"description": "<p>Body] {boolean} result Indicates whether the action is actually performed or the user had already been added to the access group.</p>"
}
]
},
"examples": [
{
"title": "200",
"content": "{\n result: true\n}",
"type": "json"
}
]
},
"error": {
"examples": [
{
"title": "401/500",
"content": "{\n \"isError\": true,\n \"errorCode\": 401, //--- or 500 depends on error type\n \"errorMessage\": \"Not authorized\"\n}",
"type": "json"
}
]
},
"version": "0.0.0",
"filename": "/home/runner/work/magda/magda/magda-authorization-api/src/apiRouters/createAccessGroupApiRouter.ts",
"groupTitle": "Auth_Access_Groups",
"name": "DeleteV0AuthAccessgroupsGroupidUsersUserid"
},
{
"group": "Auth_Access_Groups",
"type": "get",
"url": "/v0/auth/accessGroups/:groupId/users",
"title": "Get all matched users in an access group",
"description": "<p>return a list matched users of an access group. Required <code>object/record/read</code> permission to the access group in order to access this API.</p>",
"parameter": {
"fields": {
"URL Path": [
{
"group": "URL Path",
"type": "string",
"optional": false,
"field": "groupId",
"description": "<p>id of the access group</p>"
}
],
"Query String": [
{
"group": "Query String",
"type": "number",
"optional": true,
"field": "offset",
"description": "<p>The index of the first record in the result set to retrieve.</p>"
},
{
"group": "Query String",
"type": "number",
"optional": true,
"field": "limit",
"description": "<p>The maximum number of records of the result set to receive. If not present, a default value of 500 will be used.</p>"
},
{
"group": "Query String",
"type": "string",
"optional": true,
"field": "keyword",
"description": "<p>When set, will only return user records whose "displayName", "email" or "source" field contains the specified keyword.</p>"
},
{
"group": "Query String",
"type": "string",
"optional": true,
"field": "id",
"description": "<p>When set, will only return records whose id is the specified ID.</p>"
},
{
"group": "Query String",
"type": "string",
"optional": true,
"field": "source",
"description": "<p>When set, will only return records whose source is the specified source name.</p>"
},
{
"group": "Query String",
"type": "string",
"optional": true,
"field": "sourceId",
"description": "<p>When set, will only return records whose sourceId is the specified source ID.</p>"
},
{
"group": "Query String",
"type": "string",
"optional": true,
"field": "orgUnitId",
"description": "<p>When set, will only return records whose orgUnitId is the specified org unit id.</p>"
}
]
}
},
"success": {
"examples": [
{
"title": "200",
"content": "[{\n \"id\":\"...\",\n \"displayName\":\"Fred Nerk\",\n \"email\":\"fred.nerk@data61.csiro.au\",\n \"photoURL\":\"...\",\n \"source\":\"google\",\n \"orgUnitId\": \"...\"\n}]",
"type": "json"
}
]
},
"error": {
"examples": [
{
"title": "401/500",
"content": "{\n \"isError\": true,\n \"errorCode\": 401, //--- or 500 depends on error type\n \"errorMessage\": \"Not authorized\"\n}",
"type": "json"
}
]
},
"version": "0.0.0",
"filename": "/home/runner/work/magda/magda/magda-authorization-api/src/apiRouters/createAccessGroupApiRouter.ts",
"groupTitle": "Auth_Access_Groups",
"name": "GetV0AuthAccessgroupsGroupidUsers"
},
{
"group": "Auth_Access_Groups",
"type": "get",
"url": "/v0/auth/accessGroups/:groupId/users/count",
"title": "Get the count of all matched users in an access group",
"description": "<p>return the count number of all matched users of an access group. Required <code>object/record/read</code> permission to the access group in order to access this API.</p>",
"parameter": {
"fields": {
"URL Path": [
{
"group": "URL Path",
"type": "string",
"optional": false,
"field": "groupId",
"description": "<p>id of the access group</p>"
}
],
"Query String": [
{
"group": "Query String",
"type": "string",
"optional": true,
"field": "keyword",
"description": "<p>When set, will only return user records whose "displayName", "email" or "source" field contains the specified keyword.</p>"
},
{
"group": "Query String",
"type": "string",
"optional": true,
"field": "id",
"description": "<p>When set, will only return records whose id is the specified ID.</p>"
},
{
"group": "Query String",
"type": "string",
"optional": true,
"field": "source",
"description": "<p>When set, will only return records whose source is the specified source name.</p>"
},
{
"group": "Query String",
"type": "string",
"optional": true,
"field": "sourceId",
"description": "<p>When set, will only return records whose sourceId is the specified source ID.</p>"
},
{
"group": "Query String",
"type": "string",
"optional": true,
"field": "orgUnitId",
"description": "<p>When set, will only return records whose orgUnitId is the specified org unit id.</p>"
}
]
}
},
"success": {
"examples": [
{
"title": "200",
"content": "{\n \"count\" : 5\n}",
"type": "json"
}
]
},
"error": {
"examples": [
{
"title": "401/500",
"content": "{\n \"isError\": true,\n \"errorCode\": 401, //--- or 500 depends on error type\n \"errorMessage\": \"Not authorized\"\n}",
"type": "json"
}
]
},
"version": "0.0.0",
"filename": "/home/runner/work/magda/magda/magda-authorization-api/src/apiRouters/createAccessGroupApiRouter.ts",
"groupTitle": "Auth_Access_Groups",
"name": "GetV0AuthAccessgroupsGroupidUsersCount"
},
{
"group": "Auth_Access_Groups",
"type": "post",
"url": "/v0/auth/accessGroups",
"title": "Create a new access group",
"description": "<p>Create a new access group. Returns the newly created access group. Required <code>object/accessGroup/create</code> permission to access this API.</p>",
"parameter": {
"fields": {
"Request Body": [
{
"group": "Request Body",
"type": "string",
"optional": false,
"field": "name",
"description": "<p>A name given to the access group</p>"
},
{
"group": "Request Body",
"type": "string",
"optional": true,
"field": "description",
"description": "<p>The free text description for the access group</p>"
},
{
"group": "Request Body",
"type": "string[]",
"optional": true,
"field": "keywords",
"description": "<p>Tags (or keywords) help users discover the access-group</p>"
},
{
"group": "Request Body",
"type": "string",
"optional": false,
"field": "resourceUri",
"description": "<p>The Resource URI specifies the type of resources that the access group manages. At this moment, only one value <code>object/record</code> (registry records) is supported.</p>"
},
{
"group": "Request Body",
"type": "string",
"optional": false,
"field": "operationUris",
"description": "<p>A list of operations that the access group allows enrolled users to perform on included resources.</p>"
},
{
"group": "Request Body",
"type": "string",
"optional": true,
"field": "ownerId",
"description": "<p>The user ID of the access group owner. If not specified, the request user (if available) will be the owner. If a <code>null</code> value is supplied, the owner of the access group will be set to <code>null</code>.</p>"
},
{
"group": "Request Body",
"type": "string",
"optional": true,
"field": "orgUnitId",
"description": "<p>The ID of the orgUnit that the access group belongs to. If not specified, the request user's orgUnit (if available) will be used. If a <code>null</code> value is supplied, the orgUnit of the access group will be set to <code>null</code>.</p>"
}
]
},
"examples": [
{
"title": "(Body) {json}:",
"content": "{\n \"name\": \"a test access group\",\n \"description\": \"a test access group\",\n \"resourceUri\": \"object/record\",\n \"keywords\": [\"keyword 1\", \"keyword2\"],\n \"operationUris\": [\"object/record/read\", \"object/record/update\"],\n \"ownerId\": \"3535fdad-1804-4614-a9ce-ce196e880238\",\n \"orgUnitId\": \"36ef9450-6579-421c-a178-d3b5b4f1a3df\"\n}",
"type": "json"
}
]
},
"success": {
"examples": [
{
"title": "200",
"content": "{\n \"id\": \"e30135df-523f-46d8-99f6-2450fd8d6a37\",\n \"name\": \"a test access group\",\n \"description\": \"a test access group\",\n \"resourceUri\": \"object/record\",\n \"operationUris\": [\"object/record/read\", \"object/record/update\"],\n \"keywords\": [\"keyword 1\", \"keyword2\"],\n \"permissionId\": \"2b117a5f-dadb-4130-bf44-b72ee67d009b\",\n \"roleId\": \"5b616fa0-a123-4e9c-b197-65b3db8522fa\",\n \"ownerId\": \"3535fdad-1804-4614-a9ce-ce196e880238\",\n \"orgUnitId\": \"36ef9450-6579-421c-a178-d3b5b4f1a3df\",\n \"createBy\": \"3535fdad-1804-4614-a9ce-ce196e880238\",\n \"editTime\": \"2022-03-28T10:18:10.479Z\",\n \"editBy\": \"3535fdad-1804-4614-a9ce-ce196e880238\",\n \"editTime\": \"2022-03-28T10:18:10.479Z\"\n}",
"type": "json"
}
]
},
"error": {
"examples": [
{
"title": "401/500",
"content": "{\n \"isError\": true,\n \"errorCode\": 401, //--- or 500 depends on error type\n \"errorMessage\": \"Not authorized\"\n}",
"type": "json"
}
]
},
"version": "0.0.0",
"filename": "/home/runner/work/magda/magda/magda-authorization-api/src/apiRouters/createAccessGroupApiRouter.ts",
"groupTitle": "Auth_Access_Groups",
"name": "PostV0AuthAccessgroups"
},
{
"group": "Auth_Access_Groups",
"type": "post",
"url": "/v0/auth/accessGroups/:groupId/datasets/:datasetId",
"title": "Add an Dataset to an Access Group",
"description": "<p>Add an Dataset to an Access Group</p> <p>Access group users will all granted access (specified by the access group permission) to all added datasets.</p> <p>You need <code>object/record/update</code> permission to both access group and dataset record in order to access this API.</p>",
"parameter": {
"fields": {
"URL Path": [
{
"group": "URL Path",
"type": "string",
"optional": false,
"field": "groupId",
"description": "<p>id of the access group</p>"
},
{
"group": "URL Path",
"type": "string",
"optional": false,
"field": "datasetId",
"description": "<p>id of the dataset</p>"
}
]
}
},
"success": {
"fields": {
"Success 200": [
{
"group": "Success 200",
"optional": true,
"field": "Response",
"description": "<p>Body] {boolean} result Indicates whether the action is actually performed or the dataset had already been added to the access group.</p>"
}
]
},
"examples": [
{
"title": "200",
"content": "{\n result: true\n}",
"type": "json"
}
]
},
"error": {
"examples": [
{
"title": "401/500",
"content": "{\n \"isError\": true,\n \"errorCode\": 401, //--- or 500 depends on error type\n \"errorMessage\": \"Not authorized\"\n}",
"type": "json"
}
]
},
"version": "0.0.0",
"filename": "/home/runner/work/magda/magda/magda-authorization-api/src/apiRouters/createAccessGroupApiRouter.ts",
"groupTitle": "Auth_Access_Groups",
"name": "PostV0AuthAccessgroupsGroupidDatasetsDatasetid"
},
{
"group": "Auth_Access_Groups",
"type": "post",
"url": "/v0/auth/accessGroups/:groupId/users/:userId",
"title": "Add an User to an Access Group",
"description": "<p>Add an User to an Access Group</p> <p>Access group users have access (specified by the access group permission) to all datasets in the access group.</p> <p>You need <code>object/record/update</code> permission to the access group record in order to access this API.</p>",
"parameter": {