{
  "swagger": "2.0",
  "info": {
    "title": "Sentry Cluster Authorization Service",
    "version": "2.0",
    "contact": {
      "name": "Paralus Dev"
    }
  },
  "tags": [
    {
      "name": "ClusterAuthorizationService"
    }
  ],
  "schemes": [
    "https"
  ],
  "consumes": [
    "application/json",
    "application/yaml"
  ],
  "produces": [
    "application/json",
    "application/yaml"
  ],
  "paths": {
    "/v2/sentry/authorization/user": {
      "get": {
        "operationId": "ClusterAuthorizationService_GetUserAuthorization",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/rpcGetUserAuthorizationResponse"
            }
          },
          "403": {
            "description": "Returned when the user does not have permission to access the resource.",
            "schema": {}
          },
          "404": {
            "description": "Returned when the resource does not exist.",
            "schema": {
              "type": "string",
              "format": "string"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/googlerpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "userCN",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "clusterID",
            "in": "query",
            "required": false,
            "type": "string"
          },
          {
            "name": "certIssueSeconds",
            "in": "query",
            "required": false,
            "type": "string",
            "format": "int64"
          }
        ],
        "tags": [
          "ClusterAuthorizationService"
        ]
      }
    }
  },
  "definitions": {
    "controllerStepObject": {
      "type": "object",
      "properties": {
        "typeMeta": {
          "$ref": "#/definitions/metav1TypeMeta"
        },
        "objectMeta": {
          "$ref": "#/definitions/v1ObjectMeta"
        },
        "name": {
          "type": "string"
        },
        "raw": {
          "type": "string",
          "format": "byte"
        }
      },
      "title": "+kubebuilder:object:generate=true\nStepObject can represent any kubernetes object"
    },
    "googlerpcStatus": {
      "type": "object",
      "properties": {
        "code": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "details": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/protobufAny"
          }
        }
      }
    },
    "metav1TypeMeta": {
      "type": "object",
      "properties": {
        "kind": {
          "type": "string",
          "title": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\n+optional"
        },
        "apiVersion": {
          "type": "string",
          "title": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\n+optional"
        }
      },
      "description": "TypeMeta describes an individual object in an API response or request\nwith strings representing the type of the object and its API schema version.\nStructures that are versioned or persisted should inline TypeMeta.\n\n+k8s:deepcopy-gen=false"
    },
    "protobufAny": {
      "type": "object",
      "properties": {
        "@type": {
          "type": "string"
        }
      },
      "additionalProperties": {}
    },
    "rpcGetUserAuthorizationResponse": {
      "type": "object",
      "properties": {
        "userName": {
          "type": "string"
        },
        "serviceAccount": {
          "$ref": "#/definitions/controllerStepObject"
        },
        "clusterRoles": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/controllerStepObject"
          }
        },
        "clusterRoleBindings": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/controllerStepObject"
          }
        },
        "roles": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/controllerStepObject"
          }
        },
        "roleBindings": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/controllerStepObject"
          }
        },
        "deleteClusterRoleBindings": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/controllerStepObject"
          }
        },
        "deleteRoleBindings": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/controllerStepObject"
          }
        },
        "namespaces": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/controllerStepObject"
          }
        },
        "roleName": {
          "type": "string"
        },
        "isRead": {
          "type": "boolean"
        },
        "enforceOrgAdminOnlySecretAccess": {
          "type": "boolean"
        },
        "isOrgAdmin": {
          "type": "boolean"
        }
      }
    },
    "v1FieldsV1": {
      "type": "object",
      "properties": {
        "Raw": {
          "type": "string",
          "format": "byte",
          "description": "Raw is the underlying serialization of this object."
        }
      },
      "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set,\nor a string representing a sub-field or item. The string will follow one of these four formats:\n'f:\u003cname\u003e', where \u003cname\u003e is the name of a field in a struct, or key in a map\n'v:\u003cvalue\u003e', where \u003cvalue\u003e is the exact json formatted value of a list item\n'i:\u003cindex\u003e', where \u003cindex\u003e is position of a item in a list\n'k:\u003ckeys\u003e', where \u003ckeys\u003e is a map of  a list item's key fields to their unique values\nIf a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff\n+protobuf.options.(gogoproto.goproto_stringer)=false"
    },
    "v1ManagedFieldsEntry": {
      "type": "object",
      "properties": {
        "manager": {
          "type": "string",
          "description": "Manager is an identifier of the workflow managing these fields."
        },
        "operation": {
          "type": "string",
          "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created.\nThe only valid values for this field are 'Apply' and 'Update'."
        },
        "apiVersion": {
          "type": "string",
          "description": "APIVersion defines the version of this resource that this field set\napplies to. The format is \"group/version\" just like the top-level\nAPIVersion field. It is necessary to track the version of a field\nset because it cannot be automatically converted."
        },
        "time": {
          "$ref": "#/definitions/v1Time",
          "title": "Time is timestamp of when these fields were set. It should always be empty if Operation is 'Apply'\n+optional"
        },
        "fieldsType": {
          "type": "string",
          "title": "FieldsType is the discriminator for the different fields format and version.\nThere is currently only one possible value: \"FieldsV1\""
        },
        "fieldsV1": {
          "$ref": "#/definitions/v1FieldsV1",
          "title": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type.\n+optional"
        }
      },
      "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource\nthat the fieldset applies to."
    },
    "v1ObjectMeta": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "title": "Name must be unique within a namespace. Is required when creating resources, although\nsome resources may allow a client to request the generation of an appropriate name\nautomatically. Name is primarily intended for creation idempotence and configuration\ndefinition.\nCannot be updated.\nMore info: http://kubernetes.io/docs/user-guide/identifiers#names\n+optional"
        },
        "generateName": {
          "type": "string",
          "description": "GenerateName is an optional prefix, used by the server, to generate a unique\nname ONLY IF the Name field has not been provided.\nIf this field is used, the name returned to the client will be different\nthan the name passed. This value will also be combined with a unique suffix.\nThe provided value has the same validation rules as the Name field,\nand may be truncated by the length of the suffix required to make the value\nunique on the server.\n\nIf this field is specified and the generated name exists, the server will\nNOT return a 409 - instead, it will either return 201 Created or 500 with Reason\nServerTimeout indicating a unique name could not be found in the time allotted, and the client\nshould retry (optionally after the time indicated in the Retry-After header).\n\nApplied only if Name is not specified.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency\n+optional"
        },
        "namespace": {
          "type": "string",
          "description": "Namespace defines the space within which each name must be unique. An empty namespace is\nequivalent to the \"default\" namespace, but \"default\" is the canonical representation.\nNot all objects are required to be scoped to a namespace - the value of this field for\nthose objects will be empty.\n\nMust be a DNS_LABEL.\nCannot be updated.\nMore info: http://kubernetes.io/docs/user-guide/namespaces\n+optional"
        },
        "selfLink": {
          "type": "string",
          "description": "SelfLink is a URL representing this object.\nPopulated by the system.\nRead-only.\n\nDEPRECATED\nKubernetes will stop propagating this field in 1.20 release and the field is planned\nto be removed in 1.21 release.\n+optional"
        },
        "uid": {
          "type": "string",
          "description": "UID is the unique in time and space value for this object. It is typically generated by\nthe server on successful creation of a resource and is not allowed to change on PUT\noperations.\n\nPopulated by the system.\nRead-only.\nMore info: http://kubernetes.io/docs/user-guide/identifiers#uids\n+optional"
        },
        "resourceVersion": {
          "type": "string",
          "description": "An opaque value that represents the internal version of this object that can\nbe used by clients to determine when objects have changed. May be used for optimistic\nconcurrency, change detection, and the watch operation on a resource or set of resources.\nClients must treat these values as opaque and passed unmodified back to the server.\nThey may only be valid for a particular resource or set of resources.\n\nPopulated by the system.\nRead-only.\nValue must be treated as opaque by clients and .\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency\n+optional"
        },
        "generation": {
          "type": "string",
          "format": "int64",
          "title": "A sequence number representing a specific generation of the desired state.\nPopulated by the system. Read-only.\n+optional"
        },
        "creationTimestamp": {
          "$ref": "#/definitions/v1Time",
          "description": "CreationTimestamp is a timestamp representing the server time when this object was\ncreated. It is not guaranteed to be set in happens-before order across separate operations.\nClients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system.\nRead-only.\nNull for lists.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata\n+optional"
        },
        "deletionTimestamp": {
          "$ref": "#/definitions/v1Time",
          "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This\nfield is set by the server when a graceful deletion is requested by the user, and is not\ndirectly settable by a client. The resource is expected to be deleted (no longer visible\nfrom resource lists, and not reachable by name) after the time in this field, once the\nfinalizers list is empty. As long as the finalizers list contains items, deletion is blocked.\nOnce the deletionTimestamp is set, this value may not be unset or be set further into the\nfuture, although it may be shortened or the resource may be deleted prior to this time.\nFor example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react\nby sending a graceful termination signal to the containers in the pod. After that 30 seconds,\nthe Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup,\nremove the pod from the API. In the presence of network partitions, this object may still\nexist after this timestamp, until an administrator or automated process can determine the\nresource is fully terminated.\nIf not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata\n+optional"
        },
        "deletionGracePeriodSeconds": {
          "type": "string",
          "format": "int64",
          "title": "Number of seconds allowed for this object to gracefully terminate before\nit will be removed from the system. Only set when deletionTimestamp is also set.\nMay only be shortened.\nRead-only.\n+optional"
        },
        "labels": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "title": "Map of string keys and values that can be used to organize and categorize\n(scope and select) objects. May match selectors of replication controllers\nand services.\nMore info: http://kubernetes.io/docs/user-guide/labels\n+optional"
        },
        "annotations": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "title": "Annotations is an unstructured key value map stored with a resource that may be\nset by external tools to store and retrieve arbitrary metadata. They are not\nqueryable and should be preserved when modifying objects.\nMore info: http://kubernetes.io/docs/user-guide/annotations\n+optional"
        },
        "ownerReferences": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v1OwnerReference"
          },
          "title": "List of objects depended by this object. If ALL objects in the list have\nbeen deleted, this object will be garbage collected. If this object is managed by a controller,\nthen an entry in this list will point to this controller, with the controller field set to true.\nThere cannot be more than one managing controller.\n+optional\n+patchMergeKey=uid\n+patchStrategy=merge"
        },
        "finalizers": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "title": "Must be empty before the object is deleted from the registry. Each entry\nis an identifier for the responsible component that will remove the entry\nfrom the list. If the deletionTimestamp of the object is non-nil, entries\nin this list can only be removed.\nFinalizers may be processed and removed in any order.  Order is NOT enforced\nbecause it introduces significant risk of stuck finalizers.\nfinalizers is a shared field, any actor with permission can reorder it.\nIf the finalizer list is processed in order, then this can lead to a situation\nin which the component responsible for the first finalizer in the list is\nwaiting for a signal (field value, external system, or other) produced by a\ncomponent responsible for a finalizer later in the list, resulting in a deadlock.\nWithout enforced ordering finalizers are free to order amongst themselves and\nare not vulnerable to ordering changes in the list.\n+optional\n+patchStrategy=merge"
        },
        "clusterName": {
          "type": "string",
          "title": "The name of the cluster which the object belongs to.\nThis is used to distinguish resources with same name and namespace in different clusters.\nThis field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.\n+optional"
        },
        "managedFields": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/v1ManagedFieldsEntry"
          },
          "description": "ManagedFields maps workflow-id and version to the set of fields\nthat are managed by that workflow. This is mostly for internal\nhousekeeping, and users typically shouldn't need to set or\nunderstand this field. A workflow can be the user's name, a\ncontroller's name, or the name of a specific apply path like\n\"ci-cd\". The set of fields is always in the version that the\nworkflow used when modifying the object.\n\n+optional"
        }
      },
      "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects\nusers must create."
    },
    "v1OwnerReference": {
      "type": "object",
      "properties": {
        "apiVersion": {
          "type": "string",
          "description": "API version of the referent."
        },
        "kind": {
          "type": "string",
          "title": "Kind of the referent.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
        },
        "name": {
          "type": "string",
          "title": "Name of the referent.\nMore info: http://kubernetes.io/docs/user-guide/identifiers#names"
        },
        "uid": {
          "type": "string",
          "title": "UID of the referent.\nMore info: http://kubernetes.io/docs/user-guide/identifiers#uids"
        },
        "controller": {
          "type": "boolean",
          "title": "If true, this reference points to the managing controller.\n+optional"
        },
        "blockOwnerDeletion": {
          "type": "boolean",
          "title": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then\nthe owner cannot be deleted from the key-value store until this\nreference is removed.\nDefaults to false.\nTo set this field, a user needs \"delete\" permission of the owner,\notherwise 422 (Unprocessable Entity) will be returned.\n+optional"
        }
      },
      "description": "OwnerReference contains enough information to let you identify an owning\nobject. An owning object must be in the same namespace as the dependent, or\nbe cluster-scoped, so there is no namespace field."
    },
    "v1Time": {
      "type": "object",
      "properties": {
        "seconds": {
          "type": "string",
          "format": "int64",
          "description": "Represents seconds of UTC time since Unix epoch\n1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to\n9999-12-31T23:59:59Z inclusive."
        },
        "nanos": {
          "type": "integer",
          "format": "int32",
          "description": "Non-negative fractions of a second at nanosecond resolution. Negative\nsecond values with fractions must still have non-negative nanos values\nthat count forward in time. Must be from 0 to 999,999,999\ninclusive. This field may be limited in precision depending on context."
        }
      },
      "description": "Time is a wrapper around time.Time which supports correct\nmarshaling to YAML and JSON.  Wrappers are provided for many\nof the factory methods that the time package offers.\n\n+protobuf.options.marshal=false\n+protobuf.as=Timestamp\n+protobuf.options.(gogoproto.goproto_stringer)=false"
    }
  },
  "securityDefinitions": {
    "ApiKeyAuth": {
      "type": "apiKey",
      "name": "X-API-KEYID",
      "in": "header"
    },
    "ApiTokenAuth": {
      "type": "apiKey",
      "name": "X-API-TOKEN",
      "in": "header"
    },
    "BasicAuth": {
      "type": "basic"
    }
  },
  "security": [
    {
      "BasicAuth": []
    },
    {
      "ApiKeyAuth": [],
      "ApiTokenAuth": []
    }
  ]
}
