keystone.yaml

# Copyright 2017 EasyStack, Inc.

openapi: 3.0.0
info:
  title: Keystone API
  version: '3'
servers:
  - description: Service domain
    url: http://keystone-api.openstack.svc.cluster.local
  - description: For local test
    url: http://localhost
paths:
  /v3/domains:
    get:
      operationId: list_domains
      description: List domains
      tags:
        - domain
      parameters:
        - $ref: '#/components/parameters/query_enabled'
        - $ref: '#/components/parameters/query_name'
        - description: Return root domains only.
          in: query
          name: root_only
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  domains:
                    items:
                      $ref: '#/components/schemas/domain'
                    type: array
                  links:
                    $ref: '#/components/schemas/links'
                title: DomainListResponse
                type: object
          description: A list of domains
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '405':
          $ref: '#/components/responses/405'
        '413':
          $ref: '#/components/responses/413'
        '503':
          $ref: '#/components/responses/503'
    post:
      tags:
        - domain
      operationId: create_domain
      description: Creates a domain.
      requestBody:
        content:
          application/json:
            schema:
              properties:
                domain:
                  properties:
                    description:
                      description: The description of the domain.
                      type: string
                    enabled:
                      description: 'If set to true, domain is created enabled. If
                        set to false, domain is created disabled. The default is true.

                        Users can only authorize against an enabled domain (and any
                        of its projects). In addition, users can only authenticate
                        if the domain that owns them is also enabled. Disabling a
                        domain prevents both of these things.'
                      type: boolean
                    explicit_domain_id:
                      description: 'The ID of the domain. A domain created this way
                        will not use an auto-generated ID, but will use the ID passed
                        in instead. Identifiers passed in this way must conform to
                        the existing ID generation scheme: UUID4 without dashes.'
                      type: string
                    name:
                      description: The name of the domain.
                      type: string
                  required:
                    - name
                  title: DomainCreate
                  type: object
              required:
                - domain
              title: DomainCreateRequest
              type: object
      responses:
        '201':
          $ref: '#/components/responses/domain_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '405':
          $ref: '#/components/responses/405'
        '409':
          $ref: '#/components/responses/409'
        '413':
          $ref: '#/components/responses/413'
        '415':
          $ref: '#/components/responses/415'
        '503':
          $ref: '#/components/responses/503'
  /v3/domains/{domain_id}:
    parameters:
      - description: The domain ID.
        in: path
        name: domain_id
        required: true
        schema:
          type: string
    delete:
      description: 'Deletes a domain. To minimize the risk of accidentally
        deleting a domain, you must first disable the domain by using the update domain method.'
      operationId: delete_domain
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '405':
          $ref: '#/components/responses/405'
        '409':
          $ref: '#/components/responses/409'
        '413':
          $ref: '#/components/responses/413'
        '415':
          $ref: '#/components/responses/415'
        '503':
          $ref: '#/components/responses/503'
      tags:
        - domain
    get:
      description: Shows details for a domain.
      operationId: get_domain
      responses:
        '200':
          $ref: '#/components/responses/domain_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '405':
          $ref: '#/components/responses/405'
        '413':
          $ref: '#/components/responses/413'
        '503':
          $ref: '#/components/responses/503'
      tags:
        - domain
    patch:
      description: Updates a domain.
      operationId: update_domain
      requestBody:
        content:
          application/json:
            schema:
              properties:
                domain:
                  properties:
                    description:
                      description: The new description of the domain.
                      type: string
                    enabled:
                      description: 'If set to true, domain is enabled. If set
                        to false, domain is disabled.'
                      type: boolean
                    name:
                      description: The new name of the domain.
                      type: string
                  title: DomainUpdate
                  type: object
              required:
                - domain
              title: DomainUpdateRequest
              type: object
      responses:
        '200':
          $ref: '#/components/responses/domain_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '405':
          $ref: '#/components/responses/405'
        '409':
          $ref: '#/components/responses/409'
        '413':
          $ref: '#/components/responses/413'
        '415':
          $ref: '#/components/responses/415'
        '503':
          $ref: '#/components/responses/503'
      tags:
        - domain
  /v3/domains/{domain_id}/config:
    parameters:
      - description: The domain ID.
        in: path
        name: domain_id
        required: true
        schema:
          type: string
    put:
      description: Creates a domain configuration.
      operationId: create_domain_config
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/domain_config"
      responses:
        '200':
          description: Domain configuration request.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/domain_config"
        '201':
          description: Resource was created and is ready to use.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '405':
          $ref: '#/components/responses/405'
        '413':
          $ref: '#/components/responses/413'
        '503':
          $ref: '#/components/responses/503'
      tags:
        - domain
    patch:
      description: Updates a domain configuration.
      operationId: update_domain_config
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/domain_config"
      responses:
        '200':
          description: Request was successful.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/domain_config"
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '405':
          $ref: '#/components/responses/405'
        '409':
          $ref: '#/components/responses/409'
        '413':
          $ref: '#/components/responses/413'
        '415':
          $ref: '#/components/responses/415'
        '503':
          $ref: '#/components/responses/503'
      tags:
        - domain
    get:
      description: Shows details for a domain configuration.
      operationId: get_domain_config
      responses:
        '200':
          description: Request was successful.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/domain_config"
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '405':
          $ref: '#/components/responses/405'
        '413':
          $ref: '#/components/responses/413'
        '503':
          $ref: '#/components/responses/503'
      tags:
        - domain
    delete:
      description: Deletes a domain configuration.
      operationId: delete_domain_config
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '405':
          $ref: '#/components/responses/405'
        '409':
          $ref: '#/components/responses/409'
        '413':
          $ref: '#/components/responses/413'
        '415':
          $ref: '#/components/responses/415'
        '503':
          $ref: '#/components/responses/503'
      tags:
        - domain
  /v3/domains/{domain_id}/config/verify:
    parameters:
      - description: The domain ID.
        in: path
        name: domain_id
        required: true
        schema:
          type: string
    post:
      tags:
        - domain
      operationId: verify_domain_config
      description: Verify LDAP domain config. (Easystack extension)
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: DomainConfigVerifyRequest
              properties:
                domain_ldap_config:
                  $ref: '#/components/schemas/domain_config_ldap'
      responses:
        '200':
          description: Request was successful.
          content:
            application/json:
              schema:
                type: object
                title: DomainConfigVerifyResponse
                properties:
                  domain_ldap_config:
                    type: object
                    title: DomainLDAPConfig
                    properties:
                      user_count:
                        type: integer
        '400':
          description: Invalid config.
  /v3/projects:
    get:
      operationId: list_projects
      description: List projects.
      tags:
        - project
      parameters:
        - $ref: '#/components/parameters/query_enabled'
        - $ref: '#/components/parameters/query_name'
        - $ref: '#/components/parameters/query_domain_id'
        - name: parent_id
          description: Filters the response by a parent ID.
          in: query
          schema:
            default: false
            type: string
        - name: is_domain
          description: 'If this is specified as `true`, then only projects
            acting as a domain are included. Otherwise, only projects
            that are not acting as a domain are included.'
          in: query
          schema:
            type: boolean
      responses:
        '200':
          $ref: '#/components/responses/project_list_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
    post:
      tags:
        - project
      operationId: create_project
      description: Creates a project, where the project may act as a domain.
      requestBody:
        content:
          application/json:
            schema:
              properties:
                project:
                  properties:
                    parent_id:
                      description: |
                        The ID of the parent of the project.

                        If specified on project creation, this places the project
                        within a hierarchy and implicitly defines the owning
                        domain, which will be the same domain as the parent
                        specified. If `parent_id` is not specified and `is_domain`
                        is `false`, then the project will use its owning domain as
                        its parent. If `is_domain` is `true` (i.e. the project is
                        acting as a domain), then `parent_id` must not specified
                        (or if it is, it must be null) since domains have no parents.

                        `parent_id` is immutable, and can’t be updated after the
                        project is created - hence a project cannot be moved within
                        the hierarchy.
                      type: string
                    name:
                      description: 'The new name of the project, which must be unique
                        within the owning domain. A project can have the same name
                        as its domain.'
                      type: string
                    is_domain:
                      description: 'Indicates whether the project also acts as
                        a domain. If set to `true`, this project acts as both a
                        project and domain. As a domain, the project provides a
                        name space in which you can create users, groups, and
                        other projects. If set to `false`, this project behaves
                        as a regular project that contains only resources.
                        Default is `false`. You cannot update this parameter
                        after you create the project.'
                      type: boolean
                    description:
                      description: The new description of the project.
                      type: string
                    enabled:
                      description: 'If set to true, project is enabled. If set
                        to false, project is disabled. The default is true.'
                      type: boolean
                    domain_id:
                      type: string
                      description: |
                        The ID of the domain for the project.

                        For projects acting as a domain, the domain_id must not be specified,
                        it will be generated by the Identity service implementation.

                        For regular projects (i.e. those not acing as a domain), if `domain_id`
                        is not specified, but `parent_id` is specified, then the domain ID of the
                        parent will be used. If neither `domain_id` or `parent_id` is specified,
                        the Identity service implementation will default to the domain to which
                        the client’s token is scoped. If both `domain_id` and `parent_id` are
                        specified, and they do not indicate the same domain, an
                        `Bad Request (400)` will be returned.
                  required:
                    - name
                  title: ProjectCreate
                  type: object
              required:
                - project
              title: ProjectCreateRequest
              type: object
      responses:
        '201':
          $ref: '#/components/responses/project_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '409':
          $ref: '#/components/responses/409'
  /v3/projects/{project_id}:
    parameters:
      - description: The project ID.
        in: path
        name: project_id
        required: true
        schema:
          type: string
    get:
      description: Shows details for a project.
      operationId: get_project
      parameters:
        - name: parents_as_list
          in: query
          schema:
            type: integer
            default: 0
          description: |
            0 is treated as False. Any other value is considered to
            be equivalent to True, including the absence of a value.

            The parent hierarchy will be included as a list in
            the response. This list will contain the projects found by
            traversing up the hierarchy to the top-level project. The
            returned list will be filtered against the projects the user
            has an effective role assignment on.
        - name: subtree_as_list
          in: query
          schema:
            type: integer
            default: 0
          description: |
            0 is treated as False. Any other value is considered to
            be equivalent to True, including the absence of a value.

            The child hierarchy will be included as a list in the
            response. This list will contain the projects found by
            traversing down the hierarchy. The returned list will be
            filtered against the projects the user has an effective
            role assignment on.
        - name: parents_as_ids
          in: query
          schema:
            type: integer
            default: 0
          description: |
            0 is treated as False. Any other value is considered to
            be equivalent to True, including the absence of a value.

            The entire parent hierarchy will be included as nested
            dictionaries in the response. It will contain all projects
            ids found by traversing up the hierarchy to the top-level
            project.
        - name: subtree_as_ids
          in: query
          schema:
            type: integer
            default: 0
          description: |
            0 is treated as False. Any other value is considered to
            be equivalent to True, including the absence of a value.

            The entire child hierarchy will be included as nested
            dictionaries in the response. It will contain all the
            projects ids found by traversing down the hierarchy.
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
                title: ProjectGetResponse
                properties:
                  project:
                    type: object
                    title: ProjectGet
                    properties:
                      is_domain:
                        type: boolean
                        description: Indicates whether the project also acts as a domain.
                          If set to true, this project acts as both a project and domain.
                          As a domain, the project provides a name space in which you can
                          create users, groups, and other projects. If set to false, this
                          project behaves as a regular project that contains only resources.
                      enabled:
                        type: boolean
                        description: If set to true, project is enabled. If set to false, project is disabled.
                      description:
                        type: string
                        description: The description of the project.
                      domain_id:
                        description: The ID of the domain for the project.
                        type: string
                      id:
                        description: The ID of the project.
                        type: string
                      name:
                        description: The name of the project.
                        type: string
                      parent_id:
                        type: string
                        description: The ID of the parent for the project.
                      links:
                        $ref: '#/components/schemas/self_link'
                      parents:
                        type: array
                        items:
                          oneOf:
                            - type: string
                            - $ref: '#/components/schemas/project_response'
                      subtree:
                        type: array
                        items:
                          oneOf:
                            - type: string
                            - $ref: '#/components/schemas/project_response'
          description: Request was successful.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
      tags:
        - project
    patch:
      description: Updates a project.
      operationId: update_project
      requestBody:
        content:
          application/json:
            schema:
              properties:
                project:
                  properties:
                    name:
                      description: 'The new name of the project, which must be unique
                        within the owning domain. A project can have the same name
                        as its domain.'
                      type: string
                    is_domain:
                      description: 'Indicates whether the project also acts as
                        a domain. If set to `true`, this project acts as both a
                        project and domain. As a domain, the project provides a
                        name space in which you can create users, groups, and
                        other projects. If set to `false`, this project behaves
                        as a regular project that contains only resources.
                        Default is `false`. You cannot update this parameter
                        after you create the project.'
                      type: boolean
                    description:
                      description: The new description of the project.
                      type: string
                    enabled:
                      description: 'If set to true, project is enabled. If set
                        to false, project is disabled. The default is true.'
                      type: boolean
                  title: ProjectUpdate
                  type: object
              required:
                - project
              title: ProjectUpdateRequest
              type: object
      responses:
        '200':
          $ref: '#/components/responses/project_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409'
      tags:
        - project
    delete:
      description: Deletes a project.
      operationId: delete_project
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
      tags:
        - project
  /v3/groups:
    get:
      description: Lists groups.
      operationId: list_groups
      parameters:
        - $ref: '#/components/parameters/query_name'
        - $ref: '#/components/parameters/query_domain_id'
      responses:
        '200':
          $ref: '#/components/responses/group_list_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
      tags:
        - group
    post:
      operationId: create_group
      tags:
        - group
      description: Creates a group.
      requestBody:
        content:
          application/json:
            schema:
              properties:
                group:
                  properties:
                    description:
                      description: The description of the group.
                      type: string
                    domain_id:
                      description: The ID of the domain of the group. If the domain
                        ID is not provided in the request, the Identity service will
                        attempt to pull the domain ID from the token used in the request.
                        Note that this requires the use of a domain-scoped token.
                      type: string
                    name:
                      description: The name of the group.
                      type: string
                    created_at:
                      type: string

                      description: The creation time of the group. Stored in `keystone.group.extra`.
                  required:
                    - name
                  title: GroupCreate
                  type: object
              required:
                - group
              title: GroupCreateRequest
              type: object
      responses:
        '201':
          $ref: '#/components/responses/group_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '409':
          $ref: '#/components/responses/409'
  /v3/groups/{group_id}:
    parameters:
      - description: The group ID.
        in: path
        name: group_id
        required: true
        schema:
          type: string
    delete:
      description: Deletes a group.
      operationId: delete_group
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
      tags:
        - group
    get:
      description: Shows details for a group.
      operationId: get_group
      responses:
        '200':
          $ref: '#/components/responses/group_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
      tags:
        - group
    patch:
      description: Updates a group.
      operationId: update_group
      requestBody:
        content:
          application/json:
            schema:
              properties:
                group:
                  properties:
                    description:
                      description: The new description for the group.
                      type: string
                    domain_id:
                      deprecated: true
                      description: The ID of the new domain for the group. The ability
                        to change the domain of a group is now deprecated, and will
                        be removed in subsequent release. It is already disabled by
                        default in most Identity service implementations.
                      type: string
                    name:
                      description: The new name for the group.
                      type: string
                  title: GroupUpdate
                  type: object
              required:
                - group
              title: GroupUpdateRequest
              type: object
      responses:
        '200':
          $ref: '#/components/responses/group_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409'
        '501':
          $ref: '#/components/responses/501'
      tags:
        - group
  /v3/groups/{group_id}/users:
    parameters:
      - description: The group ID.
        in: path
        name: group_id
        required: true
        schema:
          type: string
    get:
      description: Lists the users that belong to a group.
      operationId: list_group_users
      tags:
        - group
      parameters:
        - $ref: '#/components/parameters/query_password_expires_at'
      responses:
        '200':
          $ref: '#/components/responses/user_list_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
  /v3/groups/{group_id}/users/{user_id}:
    parameters:
      - description: The group ID.
        in: path
        name: group_id
        required: true
        schema:
          type: string
      - description: The user ID.
        in: path
        name: user_id
        required: true
        schema:
          type: string
    put:
      operationId: add_user
      description: Adds a user to a group.
      tags:
        - group
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
    head:
      operationId: check_user
      tags:
        - group
      description: Validates that a user belongs to a group.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
    delete:
      operationId: remove_user
      tags:
        - group
      description: Removes a user from a group.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
  /v3/roles:
    get:
      operationId: list_roles
      tags:
        - role
      description: List roles.
      parameters:
        - $ref: '#/components/parameters/query_name'
        - $ref: '#/components/parameters/query_domain_id'
      responses:
        '200':
          $ref: '#/components/responses/role_list_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
    post:
      tags:
        - role
      operationId: create_role
      description: Create role.
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: RoleCreateRequest
              required:
                - role
              properties:
                role:
                  type: object
                  title: RoleCreate
                  required:
                    - name
                  properties:
                    name:
                      type: string
                      description: The role name.
                    type:
                      type: string
                      description: The role type.
                    domain_id:
                      type: string
                      description: The ID of the domain of the role.
                    description:
                      description: Add description about the role.
                      type: string
                    display:
                      description: Show this role in ECP or not.
                      type: boolean
      responses:
        '201':
          $ref: '#/components/responses/role_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '409':
          $ref: '#/components/responses/409'
  /v3/roles/{role_id}:
    parameters:
      - description: The role ID.
        in: path
        name: role_id
        required: true
        schema:
          type: string
    get:
      tags:
        - role
      operationId: get_role
      description: Show details for a role.
      responses:
        '200':
          $ref: '#/components/responses/role_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '409':
          $ref: '#/components/responses/409'
    patch:
      tags:
        - role
      operationId: update_role
      description: Updates a role.
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: RoleUpdateRequest
              properties:
                role:
                  type: object
                  title: RoleUpdate
                  properties:
                    name:
                      type: string
                      description: The new role name.
                    description:
                      type: string
                      description: The new role description.
      responses:
        '200':
          $ref: '#/components/responses/role_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409'
    delete:
      tags:
        - role
      description: Deletes a role.
      operationId: delete_role
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
  /v3/role_assignments:
    get:
      tags:
        - role_assignment
      operationId: list_role_assignments
      description: |
        Get a list of role assignments.

        If no query parameters are specified, then this API will
        return a list of all role assignments.
      parameters:
        - name: effective
          in: query
          description: 'Returns the effective assignments, including any
            assignments gained by virtue of group membership.
            key-only (no value required)'
          schema:
            type: string
        - name: include_subtree
          in: query
          schema:
            type: integer
            default: 0
          description: |
            If set to true, then relevant assignments in the project hierarchy
            below the project specified in the `scope.project_id` query parameter
            are also included in the response. Any value other than `0`
            (including no value) for `include_subtree` will be interpreted as true.
        - name: group.id
          in: query
          schema:
            type: string
          description: Filters the response by a group ID.
        - name: role.id
          in: query
          schema:
            type: string
          description: Filters the response by a role ID.
        - name: scope.domain.id
          in: query
          schema:
            type: string
          description: Filters the response by a domain ID.
        - name: scope.project.id
          in: query
          schema:
            type: string
          description: Filters the response by a project ID.
        - name: user.id
          in: query
          schema:
            type: string
          description: Filters the response by a user ID.
      responses:
        '200':
          description: Request was successful.
          content:
            application/json:
              schema:
                type: object
                title: RoleAssignmentListResponse
                properties:
                  links:
                    $ref: '#/components/schemas/links'
                  role_assignments:
                    type: array
                    items:
                      type: object
                      title: RoleAssignment
                      properties:
                        links:
                          $ref: '#/components/schemas/role_assignment_links'
                        role:
                          type: object
                          properties:
                            id:
                              type: string
                        user:
                          type: object
                          properties:
                            id:
                              type: string
                        scope:
                          type: object
                          title: RoleAssignmentScope
                          description: Only one type of scope is valid, others will be null.
                          properties:
                            domain:
                              type: object
                              properties:
                                id:
                                  type: string
                            project:
                              type: object
                              properties:
                                id:
                                  type: string
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '405':
          $ref: '#/components/responses/405'
        '413':
          $ref: '#/components/responses/413'
        '503':
          $ref: '#/components/responses/503'
  /v3/role_assignments#including_names:
    get:
      tags:
        - role_assignment
      operationId: list_role_assignments_including_names
      description: |
        Get a list of role assignments.

        If no query parameters are specified, then this API will
        return a list of all role assignments.
      parameters:
        - name: effective
          in: query
          description: 'Returns the effective assignments, including any
            assignments gained by virtue of group membership.
            key-only (no value required)'
          schema:
            type: boolean
        - name: include_names
          in: query
          schema:
            type: integer
            default: 1
          description: |
            If set to true, then the names of any entities returned will be include
            as well as their IDs. Any value other than 0 (including no value) will
            be interpreted as true.

            New in version 3.6
        - name: include_subtree
          in: query
          schema:
            type: integer
            default: 0
          description: |
            If set to true, then relevant assignments in the project hierarchy
            below the project specified in the `scope.project_id` query parameter
            are also included in the response. If set to `0`, . Any value other than `0`
            (including no value) for `include_subtree` will be interpreted as true.

            New in version 3.6
        - name: group.id
          in: query
          schema:
            type: string
          description: Filters the response by a group ID.
        - name: role.id
          in: query
          schema:
            type: string
          description: Filters the response by a role ID.
        - name: scope.domain.id
          in: query
          schema:
            type: string
          description: Filters the response by a domain ID.
        - name: scope.project.id
          in: query
          schema:
            type: string
          description: Filters the response by a project ID.
        - name: user.id
          in: query
          schema:
            type: string
          description: Filters the response by a user ID.
      responses:
        '200':
          description: Request was successful.
          content:
            application/json:
              schema:
                type: object
                title: RoleAssignmentListResponseWithNames
                properties:
                  links:
                    $ref: '#/components/schemas/links'
                  role_assignments:
                    type: array
                    items:
                      type: object
                      title: RoleAssignmentWithNames
                      properties:
                        links:
                          $ref: '#/components/schemas/role_assignment_links'
                        role:
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                            domain:
                              $ref: '#/components/schemas/id_and_name'
                        user:
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                            domain:
                              $ref: '#/components/schemas/id_and_name'
                        scope:
                          type: object
                          title: RoleAssignmentScopeWithNames
                          description: Only one type of scope is valid, others will be null.
                          properties:
                            domain:
                              $ref: '#/components/schemas/id_and_name'
                            project:
                              type: object
                              properties:
                                id:
                                  type: string
                                name:
                                  type: string
                                domain:
                                  $ref: '#/components/schemas/id_and_name'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '405':
          $ref: '#/components/responses/405'
        '413':
          $ref: '#/components/responses/413'
        '503':
          $ref: '#/components/responses/503'
  /v3/domains/{domain_id}/groups/{group_id}/roles:
    parameters:
      - description: The domain ID.
        in: path
        name: domain_id
        required: true
        schema:
          type: string
      - description: The group ID.
        in: path
        name: group_id
        required: true
        schema:
          type: string
    get:
      operationId: list_group_domain_roles
      tags:
        - role_assignment
      description: |
        Lists role assignments for a group on a domain.

        The functionality of this request can also be achieved using the generalized list assignments API:
        ```
        GET /role_assignments?group.id={group_id}&scope.domain.id={domain_id}
        ```
      responses:
        '200':
          $ref: '#/components/responses/role_list_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
  /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id}:
    parameters:
      - description: The domain ID.
        in: path
        name: domain_id
        required: true
        schema:
          type: string
      - description: The group ID.
        in: path
        name: group_id
        required: true
        schema:
          type: string
      - description: The role ID.
        in: path
        name: role_id
        required: true
        schema:
          type: string
    put:
      tags:
        - role_assignment
      operationId: assign_group_domain_role
      description: Assigns a role to a group on a domain.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409'
    head:
      tags:
        - role_assignment
      operationId: check_group_domain_role
      description: Validates that a group has a role assignment on a domain.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
    delete:
      tags:
        - role_assignment
      operationId: unassign_group_domain_role
      description: Unssigns a role from a group on a domain.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
  /v3/domains/{domain_id}/users/{user_id}/roles:
    parameters:
      - description: The domain ID.
        in: path
        name: domain_id
        required: true
        schema:
          type: string
      - description: The user ID.
        in: path
        name: user_id
        required: true
        schema:
          type: string
    get:
      operationId: list_user_domain_roles
      tags:
        - role_assignment
      description: |
        Lists role assignments for a user on a domain.

        The functionality of this request can also be achieved using the generalized list assignments API:
        ```
        GET /role_assignments?user.id={user_id}&scope.domain.id={domain_id}
        ```
      responses:
        '200':
          $ref: '#/components/responses/role_list_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
  /v3/domains/{domain_id}/users/{user_id}/roles/{role_id}:
    parameters:
      - description: The domain ID.
        in: path
        name: domain_id
        required: true
        schema:
          type: string
      - description: The user ID.
        in: path
        name: user_id
        required: true
        schema:
          type: string
      - description: The role ID.
        in: path
        name: role_id
        required: true
        schema:
          type: string
    put:
      tags:
        - role_assignment
      operationId: assign_user_domain_role
      description: Assigns a role to a user on a domain.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
    head:
      tags:
        - role_assignment
      operationId: check_user_domain_role
      description: Validates that a user has a role assignment on a domain.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
    delete:
      tags:
        - role_assignment
      operationId: unassign_user_domain_role
      description: Unssigns a role from a user on a domain.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409'
  /v3/projects/{project_id}/groups/{group_id}/roles:
    parameters:
      - description: The project ID.
        in: path
        name: project_id
        required: true
        schema:
          type: string
      - description: The group ID.
        in: path
        name: group_id
        required: true
        schema:
          type: string
    get:
      operationId: list_group_project_roles
      tags:
        - role_assignment
      description: |
        Lists role assignments for a group on a project.

        The functionality of this request can also be achieved using the generalized list assignments API:
        ```
        GET /role_assignments?group.id={group_id}&scope.project.id={project_id}
        ```
      responses:
        '200':
          $ref: '#/components/responses/role_list_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
  /v3/projects/{project_id}/groups/{group_id}/roles/{role_id}:
    parameters:
      - description: The project ID.
        in: path
        name: project_id
        required: true
        schema:
          type: string
      - description: The group ID.
        in: path
        name: group_id
        required: true
        schema:
          type: string
      - description: The role ID.
        in: path
        name: role_id
        required: true
        schema:
          type: string
    put:
      tags:
        - role_assignment
      operationId: assign_group_project_role
      description: Assigns a role to a group on a project.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409'
    head:
      tags:
        - role_assignment
      operationId: check_group_project_role
      description: Validates that a group has a role assignment on a project.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
    delete:
      tags:
        - role_assignment
      operationId: unassign_group_project_role
      description: Unssigns a role from a group on a project.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
  /v3/projects/{project_id}/users/{user_id}/roles:
    parameters:
      - description: The project ID.
        in: path
        name: project_id
        required: true
        schema:
          type: string
      - description: The user ID.
        in: path
        name: user_id
        required: true
        schema:
          type: string
    get:
      operationId: list_user_project_roles
      tags:
        - role_assignment
      description: |
        Lists role assignments for a user on a project.

        The functionality of this request can also be achieved using the generalized list assignments API:
        ```
        GET /role_assignments?user.id={user_id}&scope.project.id={project_id}
        ```
      responses:
        '200':
          $ref: '#/components/responses/role_list_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
  /v3/projects/{project_id}/users/{user_id}/roles/{role_id}:
    parameters:
      - description: The project ID.
        in: path
        name: project_id
        required: true
        schema:
          type: string
      - description: The user ID.
        in: path
        name: user_id
        required: true
        schema:
          type: string
      - description: The role ID.
        in: path
        name: role_id
        required: true
        schema:
          type: string
    put:
      tags:
        - role_assignment
      operationId: assign_user_project_role
      description: Assigns a role to a user on a project.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
    head:
      tags:
        - role_assignment
      operationId: check_user_project_role
      description: Validates that a user has a role assignment on a project.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
    delete:
      tags:
        - role_assignment
      operationId: unassign_user_project_role
      description: Unssigns a role from a user on a project.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409'
  /v3/users:
    get:
      tags:
        - user
      operationId: list_users
      description: List users.
      parameters:
        - $ref: '#/components/parameters/query_domain_id'
        - $ref: '#/components/parameters/query_name'
        - $ref: '#/components/parameters/query_enabled'
        - $ref: '#/components/parameters/query_password_expires_at'
        - description: Filters the response by an identity provider ID.
          in: query
          name: idp_id
          schema:
            type: string
        - description: Filters the response by a protocol id.
          in: query
          name: protocol_id
          schema:
            type: string
        - description: Filters the response by a unique id.
          in: query
          name: unique_id
          schema:
            type: string
        - in: query
          name: skip_cache
          schema:
            type: boolean
            default: false
      responses:
        '200':
          $ref: '#/components/responses/user_list_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
    post:
      tags:
        - user
      operationId: create_user
      description: Creates a user.
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: UserCreateRequest
              required:
                - user
              properties:
                user:
                  type: object
                  title: UserCreate
                  required:
                    - name
                  properties:
                    name:
                      type: string
                      description: The user name. Must be unique within the owning domain.
                    default_project_id:
                      type: string
                      description: The ID of the default project for the user.
                        A user’s default project must not be a domain. Setting
                        this attribute does not grant any actual authorization
                        on the project, and is merely provided for convenience.
                        Therefore, the referenced project does not need to exist
                        within the user domain. (Since v3.1) If the user does not
                        have authorization to their default project, the default
                        project is ignored at token creation. (Since v3.1) Additionally,
                        if your default project is not valid, a token is issued without
                        an explicit scope of authorization.
                    domain_id:
                      type: string
                      description: The ID of the domain of the user.
                        If the domain ID is not provided in the request,
                        the Identity service will attempt to pull the domain
                        ID from the token used in the request. Note that this
                        requires the use of a domain-scoped token.
                    federated:
                      $ref: '#/components/schemas/federated'
                    enabled:
                      type: boolean
                      description: If the user is enabled, this value is `true`.
                        If the user is disabled, this value is `false`.
                    password:
                      type: string
                      description: The password of the user.
                    email:
                      type: string
                      format: email
                      description: The email of the user.
                    description:
                      description: Description of the user.
                      type: string
                    options:
                      $ref: '#/components/schemas/user_options'
      responses:
        '200':
          $ref: '#/components/responses/user_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '409':
          $ref: '#/components/responses/409'
  /v3/users/{user_id}:
    parameters:
      - name: user_id
        description: The user id.
        in: path
        required: true
        schema:
          type: string
    get:
      tags:
        - user
      operationId: get_user
      description: Shows details for a user.
      responses:
        '200':
          $ref: '#/components/responses/user_get_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
    patch:
      tags:
        - user
      operationId: update_user
      description: Updates a user.
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: UserUpdateRequest
              required:
                - user
              properties:
                user:
                  type: object
                  title: UserUpdate
                  properties:
                    name:
                      type: string
                      description: The user name. Must be unique within the owning domain.
                    default_project_id:
                      type: string
                      description: The ID of the default project for the user.
                        A user’s default project must not be a domain. Setting
                        this attribute does not grant any actual authorization
                        on the project, and is merely provided for convenience.
                        Therefore, the referenced project does not need to exist
                        within the user domain. (Since v3.1) If the user does not
                        have authorization to their default project, the default
                        project is ignored at token creation. (Since v3.1) Additionally,
                        if your default project is not valid, a token is issued without
                        an explicit scope of authorization.
                    domain_id:
                      type: string
                      description: The ID of the domain of the user.
                        If the domain ID is not provided in the request,
                        the Identity service will attempt to pull the domain
                        ID from the token used in the request. Note that this
                        requires the use of a domain-scoped token.
                    federated:
                      $ref: '#/components/schemas/federated'
                    enabled:
                      type: boolean
                      description: If the user is enabled, this value is `true`.
                        If the user is disabled, this value is `false`.
                    password:
                      type: string
                      description: The password of the user.
                    email:
                      type: string
                      format: email
                      description: The email of the user.
                    description:
                      description: Description of the user.
                      type: string
                    options:
                      $ref: '#/components/schemas/user_options'
      responses:
        '200':
          $ref: '#/components/responses/user_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409'
        '501':
          $ref: '#/components/responses/501'
    delete:
      tags:
        - user
      operationId: delete_user
      description: Deletes a user.
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
  /v3/users/{user_id}/groups:
    parameters:
      - name: user_id
        description: The user ID.
        in: path
        required: true
        schema:
          type: string
    get:
      tags:
        - user
      operationId: list_user_groups
      description: Lists groups to which a user belongs.
      responses:
        '200':
          $ref: '#/components/responses/group_list_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
  /v3/users/{user_id}/projects:
    parameters:
      - name: user_id
        description: The user ID.
        in: path
        required: true
        schema:
          type: string
    get:
      tags:
        - user
      operationId: list_user_projects
      description: Lists projects for user.
      responses:
        '200':
          $ref: '#/components/responses/project_list_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
  /v3/users/{user_id}/password:
    parameters:
      - name: user_id
        description: The user ID.
        in: path
        required: true
        schema:
          type: string
    post:
      tags:
        - user
      operationId: update_user_password
      description: |
        Lists projects for user.

        Note: This API call does not require a token for authentication.
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: UserPasswordUpdateRequest
              required:
                - user
              properties:
                user:
                  type: object
                  title: UserPasswordUpdate
                  required:
                    - original_password
                    - password
                  properties:
                    original_password:
                      type: string
                      format: password
                    password:
                      type: string
                      format: password
      responses:
        '204':
          description: The server has fulfilled the request.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409'
  /v3/users/{user_id}/application_credentials:
    parameters:
      - name: user_id
        in: path
        required: true
        schema:
          type: string
        description: The ID of the user who owns the application credential.
    post:
      operationId: create_application_credential
      tags:
        - application_credential
      description: 'Creates an application credential for a user on
        the project to which the current token is scoped.'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: ApplicationCredentialCreateRequest
              required:
                - application_credential
              properties:
                application_credential:
                  type: object
                  required:
                    - name
                  title: ApplicationCredentialCreate
                  properties:
                    name:
                      type: string
                      description: The name of the application credential. Must be unique to a user.
                    secret:
                      type: string
                      description: The secret that the application credential will be created with. If not provided, one will be generated.
                    description:
                      type: string
                      description: A description of the application credential’s purpose.
                    expires_at:
                      type: string
                      description: An optional expiry time for the application credential. If unset, the application credential does not expire.
                    roles:
                      type: array
                      items:
                        $ref: '#/components/schemas/id_and_name'
                      description: An optional list of role objects, identified by ID or name.
                        The list may only contain roles that the user has assigned on the
                        project. If not provided, the roles assigned to the application
                        credential will be the same as the roles in the current token.
                    unrestricted:
                      type: boolean
                      description: An optional flag to restrict whether the application
                        credential may be used for the creation or destruction of other
                        application credentials or trusts. Defaults to false.
                    access_rules:
                      type: array
                      description: A list of `access_rules` objects
                      items:
                        type: object
                        title: AccessRuleRequest
                        properties:
                          path:
                            type: string
                          method:
                            type: string
                          service:
                            type: string
      responses:
        '201':
          $ref: '#/components/responses/application_credential_response'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409'
    get:
      operationId: list_user_application_credentials
      tags:
        - application_credential
      parameters:
        - name: name
          in: query
          schema:
            type: string
          description: The name of the application credential. Must be unique to a user.
      responses:
        '200':
          description: Request was successful.
          content:
            application/json:
              schema:
                type: object
                title: ApplicationCredentialListResponse
                properties:
                  links:
                    $ref: '#/components/schemas/links'
                  application_credentials:
                    type: array
                    items:
                      $ref: '#/components/schemas/application_credential'

        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
  /v3/users/{user_id}/application_credentials/{application_credential_id}:
    parameters:
      - name: user_id
        in: path
        required: true
        schema:
          type: string
        description: The ID of the user who owns the application credential.
      - name: application_credential_id
        in: path
        required: true
        schema:
          type: string
        description: The ID of the application credential.
    delete:
      tags:
        - application_credential
      operationId: delete_application_credential
      description: Deletes an application credential.
      responses:
        '204':
          description: Request was successful.
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
  /v3/OS-FEDERATION/service_providers:
    get:
      operationId: list_service_providers
      tags:
        - service_provider
      description: List service providers.
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  service_providers:
                    items:
                      $ref: '#/components/schemas/service_provider'
                    type: array
                  links:
                    $ref: '#/components/schemas/links'
                title: ServiceProviderListResponse
                type: object
          description: A list of service providers
  /v3/OS-FEDERATION/service_providers/{service_provider_id}:
    parameters:
      - name: service_provider_id
        in: path
        required: true
        schema:
          type: string
    get:
      operationId: get_service_provider
      tags:
        - service_provider
      description: Get service provider.
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  service_provider:
                    $ref: '#/components/schemas/service_provider'
                title: ServiceProviderResponse
                type: object
          description: A list of service providers

components:
  parameters:
    query_name:
      description: Filters the response by name.
      in: query
      name: name
      schema:
        type: string
    query_enabled:
      name: enabled
      description: If set to true, then only enabled resources will be returned.
        Any value other than 0 (including no value) will be interpreted as true.
      in: query
      schema:
        type: boolean
    query_domain_id:
      name: domain_id
      description: Filters the response by a domain ID.
      in: query
      schema:
        type: string
    query_password_expires_at:
      description: |
        Filter results based on which user passwords have expired. The
        query should include an `operator` and a `timestamp` with a colon (`:`)
        separating the two, for example:

        ```password_expires_at={operator}:{timestamp}```

        * Valid operators are: `lt`, `lte`, `gt`, `gte`, `eq`, and `neq`
          * lt: expiration time lower than the timestamp
          * lte: expiration time lower than or equal to the timestamp
          * gt: expiration time higher than the timestamp
          * gte: expiration time higher than or equal to the timestamp
          * eq: expiration time equal to the timestamp
          * neq: expiration time not equal to the timestamp
        * Valid timestamps are of the form: `YYYY-MM-DDTHH:mm:ssZ`
      in: query
      name: password_expires_at
      schema:
        type: string
      example: lt:2016-12-08T22:02:00Z
  responses:
    '400':
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
          example:
            error:
              code: 400
              message: Error message
              title: Bad Request

      description: Some content in the request was invalid.
    '401':
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
          example:
            error:
              code: 401
              message: Error message
              title: Unauthorized
      description: User must authenticate before making a request.
    '403':
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
          example:
            error:
              code: 403
              message: Error message
              title: Forbiden
      description: Policy does not allow current user to do this operation.
    '404':
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
          example:
            error:
              code: 404
              message: Error message
              title: Not Found
      description: The requested resource could not be found.
    '405':
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
      description: Method is not valid for this endpoint.
    '409':
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
      description: This operation conflicted with another operation on this resource.
    '413':
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
      description: The request is larger than the server is willing or able to process.
    '415':
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
      description: The request entity has a media type which the server or resource
        does not support.
    '501':
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
      description: The server either does not recognize the request method, or it
        lacks the ability to fulfill the request.
    '503':
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
      description: Service is not available. This is mostly caused by service configuration
        errors which prevents the service from successful start up.
    domain_response:
      description: Request was successful.
      content:
        application/json:
          schema:
            type: object
            title: DomainResponse
            properties:
              domain:
                $ref: '#/components/schemas/domain'
    group_response:
      description: Request was successful.
      content:
        application/json:
          schema:
            title: GroupResponse
            properties:
              group:
                $ref: '#/components/schemas/group'
            type: object
    group_list_response:
      content:
        application/json:
          schema:
            type: object
            title: GroupListResponse
            properties:
              groups:
                items:
                  $ref: '#/components/schemas/group'
                type: array
              links:
                $ref: '#/components/schemas/links'
      description: Request was successful.
    project_response:
      description: Request was successful.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/project_response'
    project_list_response:
      content:
        application/json:
          schema:
            type: object
            title: ProjectListResponse
            properties:
              projects:
                items:
                  $ref: '#/components/schemas/project'
                type: array
              links:
                $ref: '#/components/schemas/links'
      description: A list of projects
    role_response:
      description: Request was successful.
      content:
        application/json:
          schema:
            properties:
              role:
                $ref: '#/components/schemas/role'
            type: object
            title: RoleResponse
    role_list_response:
      description: Request was successful.
      content:
        application/json:
          schema:
            type: object
            title: RoleListResponse
            properties:
              links:
                $ref: '#/components/schemas/links'
              roles:
                type: array
                items:
                  $ref: '#/components/schemas/role'
    user_get_response:
      description: Request was successful.
      content:
        application/json:
          schema:
            properties:
              user:
                $ref: '#/components/schemas/user'
            type: object
            title: UserGetResponse
    user_list_response:
      description: Request was successful.
      content:
        application/json:
          schema:
            type: object
            title: UserListResponse
            properties:
              links:
                $ref: '#/components/schemas/links'
              users:
                type: array
                items:
                  $ref: '#/components/schemas/user'
    user_response:
      description: Request was successful.
      content:
        application/json:
          schema:
            type: object
            title: UserResponse
            properties:
              user:
                $ref: '#/components/schemas/user'

    application_credential_response:
      description: Request was successful.
      content:
        application/json:
          schema:
            type: object
            title: ApplicationCredentialResponse
            properties:
              application_credential:
                $ref: '#/components/schemas/application_credential'
  schemas:
    domain:
      properties:
        description:
          description: The description of the domain.
          type: string
        enabled:
          description: If set to true, domain is enabled. If set to false, domain
            is disabled.
          type: boolean
        id:
          description: The ID of the domain.
          type: string
        links:
          $ref: '#/components/schemas/self_link'
        name:
          description: The name of the domain.
          type: string
        parents:
          type: array
          description: A list of parent ID.
          items:
            type: string
      type: object
    domain_config:
      required:
        - config
      type: object
      properties:
        config:
          title: DomainConfigConfig
          type: object
          properties:
            identity:
              type: object
              title: DomainConfigIdentity
              properties:
                driver:
                  type: string
                  description: The Identity backend driver.
            ldap:
              $ref: '#/components/schemas/domain_config_ldap'
    domain_config_ldap:
      type: object
      title: DomainConfigLDAP
      properties:
        url:
          type: string
          description: The LDAP URL.
          example: ldap://myldap.com:389/
        user_tree_dn:
          type: string
          description: The base distinguished name (DN) of LDAP, from where all users can be reached.
          example: ou=Users,dc=root,dc=org
        user:
          type: string
        password:
          type: string
          format: password
        suffix:
          type: string
        query_scope:
          type: string
          example: one
          description: 定义了在搜索基中搜索的深度。值“one”表示对下面紧接基准对象的对象搜索，但不包括基准对象本身。
            值“sub”表示同时搜索基准对象本身和它下面的整个子树。
        user_objectclass:
          type: string
          default: organizationalPerson
          example: organizationalPerson
          description: The LDAP object class to use for users.
        user_id_attribute:
          type: string
          default: cn
          example: cn
          description: |
            The LDAP attribute mapped to user IDs in keystone. This must NOT be a
            multivalued attribute. User IDs are expected to be globally unique across
            keystone domains and URL-safe.
        user_name_attribute:
          type: string
          example: sn
          default: sn
          description: |
            The LDAP attribute mapped to user names in keystone. User names are expected to
            be unique only within a keystone domain and are not expected to be URL-safe.
        user_mail_attribute:
          type: string
          example: mail
          default: mail
          description: The LDAP attribute mapped to user emails in keystone.
        user_pass_attribute:
          type: string
          example: userPassword
          default: userPassword
          description: The LDAP attribute mapped to user passwords in keystone.
        user_enabled_mask:
          type: string
          example: '0'
          default: '2'
          description: |
            Bitmask integer to select which bit indicates the enabled value if the LDAP
            server represents "enabled" as a bit on an integer rather than as a discrete
            boolean. A value of `0` indicates that the mask is not used. If this is not set
            to `0` the typical value is `2`. This is typically used when `[ldap]
            user_enabled_attribute = userAccountControl`. Setting this option causes
            keystone to ignore the value of `[ldap] user_enabled_invert`.
        user_enabled_default:
          type: string
          default: True
          example: '512'
          description: |
            The default value to enable users. This should match an appropriate integer
            value if the LDAP server uses non-boolean (bitmask) values to indicate if a
            user is enabled or disabled. If this is not set to `True`, then the typical
            value is `512`. This is typically used when `[ldap] user_enabled_attribute =
            userAccountControl`.
        user_allow_create:
          type: string
          default: True
          description: If enabled, keystone is allowed to create users in the LDAP server.
        user_allow_update:
          type: string
          default: True
          description: If enabled, keystone is allowed to update users in the LDAP server.
        user_allow_delete:
          type: string
          default: True
          description: If enabled, keystone is allowed to delete users in the LDAP server.
        page_size:
          type: string
          default: "0"
          example: "0"
          description: set 0 to disable pagination
        user_filter:
          type: string
    id_and_name:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
    error_response:
      properties:
        error:
          type: object
          properties:
            code:
              type: integer
            message:
              type: string
            title:
              type: string
      type: object
    group:
      properties:
        description:
          description: The description of the group.
          type: string
        domain_id:
          description: The ID of the domain of the group.
          type: string
        id:
          description: The ID of the group.
          type: string
        links:
          $ref: '#/components/schemas/self_link'
        name:
          description: The name of the group.
          type: string
        created_at:
          type: string
          description: The creation time.
      type: object
    links:
      description: The links to the resource.
      properties:
        next:
          $ref: '#/components/schemas/uri'
        previous:
          $ref: '#/components/schemas/uri'
        self:
          $ref: '#/components/schemas/uri'
      type: object
    project:
      properties:
        is_domain:
          type: boolean
          description: Indicates whether the project also acts as a domain. If set to true, this project acts as both a project and domain. As a domain, the project provides a name space in which you can create users, groups, and other projects. If set to false, this project behaves as a regular project that contains only resources.
        enabled:
          type: boolean
          description: If set to true, project is enabled. If set to false, project is disabled.
        description:
          type: string
          description: The description of the project.
        domain_id:
          description: The ID of the domain for the project.
          type: string
        id:
          description: The ID of the project.
          type: string
        name:
          description: The name of the project.
          type: string
        parent_id:
          type: string
          description: The ID of the parent for the project.
        links:
          $ref: '#/components/schemas/self_link'
      type: object
    project_response:
      properties:
        project:
          $ref: '#/components/schemas/project'
      type: object
    role:
      properties:
        id:
          type: string
          description: The role ID.
        name:
          type: string
          description: The role name.
        domain_id:
          type: string
          description: The ID of the domain.
        links:
          $ref: '#/components/schemas/self_link'
        description:
          type: string
          description: The role description.
        type:
          type: string
          description: The role type in keystone.roles.extra.
        display:
          description: Show this role in ECP or not.
          type: boolean
      type: object
    self_link:
      description: The links to the resource.
      properties:
        self:
          $ref: '#/components/schemas/uri'
      type: object
    uri:
      default: null
      format: uri
      type: string
      example: http://example.com/identity/v3/some_resource/etc
    user:
      properties:
        id:
          type: string
        name:
          type: string
          description: The user name. Must be unique within the owning domain.
        default_project_id:
          type: string
          description: The ID of the default project for the user.
            A user’s default project must not be a domain. Setting
            this attribute does not grant any actual authorization
            on the project, and is merely provided for convenience.
            Therefore, the referenced project does not need to exist
            within the user domain. (Since v3.1) If the user does not
            have authorization to their default project, the default
            project is ignored at token creation. (Since v3.1) Additionally,
            if your default project is not valid, a token is issued without
            an explicit scope of authorization.
        domain_id:
          type: string
          description: The ID of the domain of the user.
            If the domain ID is not provided in the request,
            the Identity service will attempt to pull the domain
            ID from the token used in the request. Note that this
            requires the use of a domain-scoped token.
        federated:
          $ref: '#/components/schemas/federated'
        enabled:
          type: boolean
          description: If the user is enabled, this value is `true`.
            If the user is disabled, this value is `false`.
        email:
          type: string
          format: email
          description: The email of the user.
        description:
          description: Description of the user.
          type: string
        options:
          $ref: '#/components/schemas/user_options'
        links:
          $ref: '#/components/schemas/self_link'
        password_expires_at:
          type: string
          description: |
            The date and time when the password expires. The time zone is UTC.

            This is a response object attribute; not valid for requests. A `null` value indicates that the password never expires.

            New in version 3.7
        user_type:
          type: string
        user_role:
          type: string
        failed_auth_login_count:
          type: integer
        auth_login_locked_end_time:
          type: string
          description:
            Date time in `YYYYMMDDHHmm` format.
        auth_login_start_time:
          type: string
      type: object
    user_options:
      type: object
      properties:
        ignore_change_password_upon_first_use:
          type: boolean
        ignore_password_expiry:
          type: boolean
        ignore_lockout_failure_attempts:
          type: boolean
        lock_password:
          type: boolean
        multi_factor_auth_enabled:
          type: boolean
        multi_factor_auth_rules:
          type: boolean
        ignore_user_inactivity:
          type: boolean
    federated:
      type: array
      items:
        title: Federated
        type: object
        properties:
          idp_id:
            type: string
        description: List of federated objects associated with a user.
          Each object in the list contains the idp_id and protocols.
          protocols is a list of objects, each of which contains protocol_id
          and unique_id of the protocol and user respectively.
        example:
          "federated":
            - "idp_id": "efbab5a6acad4d108fec6c63d9609d83"
              "protocols":
                - "protocol_id": "mapped"
                  "unique_id": "test@example.com"
    role_assignment_links:
      type: object
      properties:
        assignment:
          type: string
          format: uri
        membership:
          type: string
          format: uri
    application_credential:
      type: object
      properties:
        id:
          type: string
          description: The ID of the application credential.
        name:
          type: string
          description: The name of the application credential.
        secret:
          type: string
          description: The secret for the application credential, either
            generated by the server or provided by the user. This is only
            ever shown once in the response to a create request. It is not
            stored nor ever shown again. If the secret is lost, a new
            application credential must be created.
        description:
          type: string
          description: A description of the application credential’s purpose.
        expires_at:
          type: string
          description: The expiration time of the application credential, if one was specified.
        project_id:
          type: string
          description: The ID of the project the application credential was
            created for and that authentication requests using this application
            credential will be scoped to.
        roles:
          type: array
          items:
            type: object
            title: ApplicationCredentialRole
            properties:
              id:
                type: string
              name:
                type: string
              domain_id:
                type: string
        access_rules:
          type: array
          description: A list of `access_rules` objects
          items:
            type: object
            title: AccessRule
            properties:
              id:
                type: string
              path:
                type: string
              method:
                type: string
              service:
                type: string
        unrestricted:
          type: boolean
          description: A flag indicating whether the application credential may
            be used for creation or destruction of other application credentials
            or trusts.
        links:
          $ref: '#/components/schemas/self_link'
    service_provider:
      type: object
      properties:
        auth_url:
          $ref: '#/components/schemas/uri'
        links:
          $ref: '#/components/schemas/self_link'
        description:
          type: string
        enabled:
          type: boolean
        id:
          type: string
        relay_state_prefix:
          type: string