swagger: '2.0'
info:
  title: Identity Management API
  description: >-
    The Identity Management API provides a means form managing users, groups and OAuth clients.<br>
    The user and group management is based on SCIM (System for Cross-domain Identity Management).<br><br>
    <i>Note:</i> Unless stated otherwise the Identity Management APIs allow each caller only to act within the context of the tenant to which the caller belong's to.</br>

    <i>Note2:</i> UIAM stands for User Identity Access Management, since users and providers are separated in system. Therefore this API documentation is related to users generally.

  version: '3.3.2'
  x-visibility: external
basePath: /api/identitymanagement/v3
tags:
  - name: uiam user
    description: API for Managing Users in a Tenant
  - name: uiam group
    description: API for Managing Roles/Groups & Roles/Group Memberships of Users in a Tenant<br><i>Note:</i> Roles and groups are made available under /Groups.<br><i>Reserved displayNames:</i> starting with "mdspiam:subtenant:"
  - name: "piam oauth client"
    description: API for managing oauth clients.
  - name: external group mapping
    description: API for managing external group and Insight Hub group mapping.
  - name: IDP
    description: API to update IDP configuration for external group mapping.

paths:
  /Groups:
    get:
      tags:
        - uiam group
      operationId: listGroups
      summary: List all the groups of a tenant.
      description: List all the groups of a tenant.
      parameters:
        - name: filter
          in: query
          description: "SCIM filter for searching see [here](http://www.simplecloud.info/specs/draft-scim-api-01.html). The available filter attributes are: id, displayname, created or meta.created, lastmodified or meta.lastmodified, version or meta.version"
          required: false
          type: string
        - name: count
          in: query
          description: Number of objects to be returned (defaults to 100)
          type: number
          required: false
          default: 100
        - name: startIndex
          in: query
          type: number
          description: >-
            The starting index of the search results when paginated. Index starts with 1.
          required: false
          default: 1
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ScimGroupSearchResults'
        '401':
          description: Unauthorized
        '404':
          description: Not Found
      security:
        - im_group_auth:
            - 'im.g.r'
    post:
      tags:
        - uiam group
      operationId: createGroup
      summary: Create group
      description: Create a group.
      parameters:
        - in: body
          name: group
          description: Details of group
          required: true
          schema:
            $ref: '#/definitions/ScimGroupPost'
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '201':
          description: Created
          schema:
            $ref: '#/definitions/ScimGroup'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
        '409':
          description: Conflict
      security:
        - im_group_auth:
            - 'im.g.c'
  /Groups/{id}:
    get:
      tags:
        - uiam group
      operationId: getGroup
      summary: Get group
      description: Get details of a group.<br/>Example path <b>/api/identitymanagement/v3/Groups/68af46d-e9b8-4t04-5a20-7d557f5da8d
      parameters:
        - name: id
          in: path
          description: Id of group
          required: true
          type: string
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ScimGroup'
        '401':
          description: Unauthorized
        '404':
          description: Not Found
      security:
        - im_group_auth:
            - 'im.g.r'
    put:
      tags:
        - uiam group
      operationId: updateGroup
      summary: Update group.
      description: Update details of a group. If any field is left empty or is is omitted, it will be null.<br/>Example path <b>/api/identitymanagement/v3/Groups/68af46d-e9b8-4t04-5a20-7d557f5da8d
      parameters:
        - name: id
          in: path
          description: Id of group
          required: true
          type: string
        - in: body
          name: group
          description: New details
          required: true
          schema:
            $ref: '#/definitions/ScimGroupPost'
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ScimGroup'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
        '404':
          description: Not Found
      security:
        - im_group_auth:
            - 'im.g.u'
    delete:
      tags:
        - uiam group
      operationId: deleteGroup
      summary: >-
        Delete group
      description: Delete group and every connection to that group, too.<br/>Example path <b>/api/identitymanagement/v3/Groups/68af46d-e9b8-4t04-5a20-7d557f5da8d
      parameters:
        - name: id
          in: path
          description: Id of the group
          required: true
          type: string
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ScimGroup'
        '401':
          description: Unauthorized
        '404':
          description: Not Found
      security:
        - im_group_auth:
            - 'im.g.d'
  /Groups/{id}/members:
    get:
      tags:
        - uiam group
      operationId: listGroupMembers
      summary: >-
        List members of a group
      description: List the members (both users and groups) of a group.<br/>Example path <b>/api/identitymanagement/v3/Groups/68af46d-e9b8-4t04-5a20-7d557f5da8d/members
      parameters:
        - name: id
          in: path
          description: Id of group
          required: true
          type: string
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ScimGroupMemberList'
        '401':
          description: Unauthorized
        '404':
          description: Not Found
      security:
        - im_group_auth:
            - 'im.g.r'
    post:
      tags:
        - uiam group
      operationId: addMemberToGroup
      summary: >-
        Add member to a group
      description: Add new member (either user or group) to an existing group.<br/>Example path <b>/api/identitymanagement/v3/Groups/68af46d-e9b8-4t04-5a20-7d557f5da8d/members
      parameters:
        - name: id
          in: path
          description: Id of group
          required: true
          type: string
        - in: body
          name: member
          description: Details of the new member
          required: true
          schema:
            $ref: '#/definitions/ScimGroupMember'
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '201':
          description: Created
          schema:
            $ref: '#/definitions/ScimGroupMember'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
        '404':
          description: Not Found
        '409':
          description: Conflict
      security:
        - im_group_auth:
            - 'im.g.u'
  /Groups/{id}/members/{memberId}:
    delete:
      tags:
        - uiam group
      operationId: removeMemberFromGroup
      summary: Delete member from a group
      description: Delete member (either user or group) from a group.<br/>Example path <b>/api/identitymanagement/v3/Groups/68af46d-e9b8-4t04-5a20-7d557f5da8d/members/e74ff46d-8bb8-4d04-b420-7d557fe86a8d
      parameters:
        - name: id
          in: path
          description: Id of user group
          required: true
          type: string
        - name: memberId
          in: path
          description: Id of member
          required: true
          type: string
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ScimGroupMember'
        '401':
          description: Unauthorized
        '404':
          description: Not Found
      security:
        - im_group_auth:
            - 'im.g.u'
  /Users:
    get:
      tags:
        - uiam user
      operationId: list
      summary: List of users of a tenant.
      description: List of users of a tenant. Please note, in order to request only the list of users (without the information to which group a user belongs) it is recommended to make use of the "attributes" query parameter as follows /Users?attributes=userName,name,meta (this will significantly improve the performance over simply calling /Users).
      parameters:
        - name: filter
          in: query
          description: |
            "SCIM filter for searching see [here](http://www.simplecloud.info/specs/draft-scim-api-01.html). The available filter attributes are: id, username, email or emails.value, givenname, familyname, active, phonenumber, verified, origin, created or meta.created, lastmodified or meta.lastmodified, version or meta.version, groups.display.
            </br>
            <b>Note</b>: <i>groups.display</i> parameter cannot be used in complex filter expression and only <i>eq</i> operator is allowed eg. <i>filter=groups.display eq "MyGroupName"</i>
          required: false
          type: string
        - name: attributes
          in: query
          description: Comma separated list of attribute names to be returned, e.g., userName, name, meta. The attributes parameters does not support the parameter "subtenants".
          required: false
          type: string
        - name: sortBy
          in: query
          description: Sorting field name, like email or id
          required: false
          type: string
        - name: sortOrder
          in: query
          description: Sort order, ascending/descending (defaults to ascending)
          type: string
          required: false
          default: ascending
        - name: count
          in: query
          description: Number of objects to be returned (defaults to 100)
          type: number
          required: false
          default: 100
        - name: startIndex
          in: query
          type: number
          description: The starting index of the search results when paginated. Index starts with 1 (defaults to 1).
          required: false
          default: 1
        - name: subtenant
          in: query
          description: Filter for subtenant users
          type: string
          required: false
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ScimUserResponseSearchResults'
        '401':
          description: Unauthorized
        '404':
          description: Not Found
      security:
        - im_user_auth:
            - 'im.usr.r'
    post:
      tags:
        - uiam user
      operationId: create
      summary: >-
        Create user
      description: >-
        Create a new user in a tenant.<br/><br/>
        <b>Note</b>: The ‘subtenants’ field is optional. If it is present, the user is considered to be a subtenant user.
      parameters:
        - in: body
          name: user
          description: Details of user
          required: true
          schema:
            $ref: '#/definitions/ScimUserPost'
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '201':
          description: Created
          schema:
            $ref: '#/definitions/ScimUserPostResponse'
        '401':
          description: Unauthorized
        '404':
          description: Not Found
        '409':
          description: Conflict
      security:
        - im_user_auth:
            - 'im.usr.c'
  /Users/{id}:
    get:
      tags:
        - uiam user
      operationId: get
      summary: >-
        Get user
      description: >-
        Get details of a user.<br/>Example path <b>/api/identitymanagement/v3/Users/2f95913-d3d9-4a4a-951a-c21184080cf3
      parameters:
        - name: id
          in: path
          description: Id of user
          required: true
          type: string
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ScimUserResponse'
        '401':
          description: Unauthorized
        '404':
          description: Not Found
      security:
        - im_user_auth:
            - 'im.usr.r'
    put:
      tags:
        - uiam user
      operationId: update
      summary: >-
        Update user
      description: >-
        Update details of user.<br/><br/>
        <b>Note</b>: Username must not be changed. Email address is required and must be equal to the username.<br/>The ‘subtenants’ field is optional. If it is present, the user is considered to be a subtenant user. Upgrading a subtenant user to a tenant user and vice versa is not allowed.<br/>Example path <b>/api/identitymanagement/v3/Users/2f95913-d3d9-4a4a-951a-c21184080cf3
      parameters:
        - name: id
          in: path
          description: Id of user
          required: true
          type: string
        - in: body
          name: user
          description: New details
          required: true
          schema:
            $ref: '#/definitions/ScimUserPut'
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ScimUserResponse'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      security:
        - im_user_auth:
            - 'im.usr.u'
    delete:
      tags:
        - uiam user
      operationId: delete
      summary: >-
        Delete user
      description: >-
        Delete user of tenant.<br/>
        Note that tenant can have user if it purchased at least the <b>simple</b> offering.<br/>Example path <b>/api/identitymanagement/v3/Users/2f95913-d3d9-4a4a-951a-c21184080cf3
      parameters:
        - name: id
          in: path
          description: Id of user
          required: true
          type: string
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ScimUserResponse'
        '401':
          description: Unauthorized
      security:
        - im_user_auth:
            - 'im.usr.d'
  /Users/me:
    get:
      tags:
        - uiam user
      operationId: getUserRoles
      summary: Get list of groups starting with the prefix "mdsp:" in which the user is a member.
      description: Get list of groups starting with the prefix "mdsp:" in which the user is a member.
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          description: OK
          schema:
            type: array
            items:
              $ref: '#/definitions/Group'
        '401':
          description: Unauthorized
        '404':
          description: Not Found
      security:
        - im_user_auth:
            - 'im.usr.me'
  /provider/oauth/clients/{id}:
    get:
      tags:
        - piam oauth client
      operationId: getProviderOAuthClient
      summary: >-
        Get OAuth client details
      description: >-
        Get details of OAuth client currently in use.

        Example path <b>/api/identitymanagement/v3/provider/oauth/clients/assetManagementClient</b>
      parameters:
        - name: id
          in: path
          description: Id of your client. It must be the same as the `client_id` claim in the bearer token.
          required: true
          type: string
      produces:
        - application/json
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/OAuthClient'
        '400':
          description: The `id` path parameter is different from the `client_id` claim of the bearer token.
        '401':
          description: Unauthorized.
        '403':
          description: Insufficient priviledge.
        '404':
          description: No client exists with the given client id.
        '500':
          description: Internal server error.
      security:
        - im_client_auth:
          - 'prv.oc.r'
  /provider/oauth/clients/{id}/secrets:
    post:
      tags:
        - piam oauth client
      operationId: createSecret
      summary: >-
        Add new OAuth client's secret
      description: >-
        Introduce new secret. If a new secret is not provided, it will be automatically generated. Up to two client secrets are supported.
        If the scope is `prv.oc.sec.ch`, then the client can change it's own secret and needs to provide its old secret.
        If the scope is `prv.oc.sec.admin`, then it can change arbitrary client secret in the tenant.
        This is for technical users only.
      parameters:
        - name: id
          in: path
          type: string
          required: true
          description: Client identifier
        - name: Current-Secret
          in: header
          type: string
          description:
            Required, unless your have `prv.oc.sec.admin` scope. It is used to make sure the requestor has permission to modify the given client's secret.
        - name: newSecretRequest
          in: body
          description: Parameters of the new secret.
          required: true
          schema:
            $ref: "#/definitions/ChangeSecretRequest"
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          schema:
            $ref: '#/definitions/ChangedSecretResponse'
          description: Secret has been added successfully.
        '400':
          description:
            Invalid request.
        '401':
          description:
            Authorization information is missing or invalid.
        '403':
          description:
            Insufficient priviledge.
        '404':
          description:
            Client id was not found.
        '500':
          description:
            Internal server error.
      security:
        - im_client_auth:
          - 'prv.oc.sec.ch'
          - 'prv.oc.sec.admin'
    put:
      tags:
        - piam oauth client
      operationId: updateSecret
      summary: >-
        Update OAuth client's secret
      description: >-
        Replaces current client's secret(s) with new one. If a new secret is not provided, it will be automatically generated.
        If the scope is `prv.oc.sec.ch`, then the client can change it's own secret and needs to provide its old secret.
        If the scope is `prv.oc.sec.admin`, then it can change arbitrary client secret in the tenant.
        This is for technical users only.
      parameters:
        - name: id
          in: path
          type: string
          required: true
          description: Client identifier
        - name: Current-Secret
          in: header
          type: string
          description:
            Required, unless your have `prv.oc.sec.admin` scope. It is used to make sure the requestor has permission to modify the given client's secret.
        - name: newSecretRequest
          in: body
          description: Parameters of the new secret.
          required: true
          schema:
            $ref: "#/definitions/ChangeSecretRequest"
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          schema:
            $ref: '#/definitions/ChangedSecretResponse'
          description: Secret has been changed successfully.
        '400':
          description:
            Invalid request.
        '401':
          description:
            Authorization information is missing or invalid.
        '403':
          description:
            Insufficient priviledge.
        '404':
          description:
            Client id was not found.
        '500':
          description:
            Internal server error.
      security:
        - im_client_auth:
          - 'prv.oc.sec.ch'
          - 'prv.oc.sec.admin'
    delete:
      tags:
        - piam oauth client
      operationId: deleteSecret
      summary: >-
        Delete old OAuth client's secret
      description: >-
        Delete the old client's secret. If there is only one secret, the request will fail.
        If the scope is `prv.oc.sec.ch`, then the client can change it's own secret and needs to provide its old secret.
        If the scope is `prv.oc.sec.admin`, then it can change arbitrary client secret in the tenant.
        This is for technical users only.
      parameters:
        - name: id
          in: path
          type: string
          required: true
          description: Client identifier
        - name: Current-Secret
          in: header
          type: string
          description:
            Required, unless your have `prv.oc.sec.admin` scope. It is used to make sure the requestor has permission to modify the given client's secret.
      produces:
        - application/json
      responses:
        '204':
          description: Older secret has been removed successfully.
        '400':
          description:
            Invalid request.
        '401':
          description:
            Authorization information is missing or invalid.
        '403':
          description:
            Insufficient priviledge.
        '404':
          description:
            Client id was not found.
        '500':
          description:
            Internal server error.
      security:
        - im_client_auth:
          - 'prv.oc.sec.ch'
          - 'prv.oc.sec.admin'

  /Groups/Mapping:
    post:
      tags:
        - external group mapping
      summary: Create external group mapping 
      description: Allows to create mapping between external groups from customer IDP to Insight Hub groups.
      parameters:
        - in: body
          name: groupMapping
          description: Details of external group and Insight Hub group.
          required: true
          schema:
            $ref: '#/definitions/externalGroupPost'
      consumes:
        - application/json
      produces:
        - '*/*'
      responses:
        '201':
          description: Created
          schema:
            $ref: '#/definitions/externalGroupPostResponse'
        '400':
          description: Bad request
        '403':
          description: Forbidden - Insufficient scope
        '404':
          description: Not Found - Incorrect group ID provided
      security:
        - im_external_auth:
          - 'im.ex.g.c'
    get:
      tags:
        - external group mapping
      summary: Get external group mapping 
      description: List the mapping between external groups from customer IDP to Insight Hub groups.
      parameters:
        - name: filter
          in: query
          description: SCIM filter for searching see [here](http://www.simplecloud.info/specs/draft-scim-api-01.html).
          required: false
          type: string
        - name: count
          in: query
          description: Number of objects to be returned (defaults to 100)
          type: number
          required: false
          default: 100
        - name: startIndex
          in: query
          type: number
          description: >-
            The starting index of the search results when paginated. Index starts with 1.
          required: false
          default: 1
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/externalGroupMappingResults'
        '403':
          description: Forbidden - Insufficient scope
        '400':
          description: Bad Request - Invalid request parameters
      security:
        - im_external_auth:
          - 'im.ex.g.r'
  /Groups/External/{groupId}/externalGroup/{externalGroup}/origin/{origin}:
    delete:
      tags:
        - external group mapping
      summary: Unmap external group mapping 
      description: Allows to unmap mapping between external groups from customer IDP to Insight Hub groups.
      parameters:
        - name: groupId
          in: path
          description: The globally unique group ID of Insight Hub group
          required: true
          type: string
        - name: externalGroup
          in: path
          description: The identifier for the group in external identity provider that needs to be mapped to internal group
          required: true
          type: string
        - name: origin
          in: path
          description: Unique alias of the identity provider (origin key of idp)
          required: true
          type: string
      consumes:
        - application/json
      produces:
        - application/json
      responses:
        '200':
          description: Ok
          schema:
            $ref: '#/definitions/externalGroupPostResponse'          
        '404':
          description: Not Found - No such group ID, external group, origin combination
        '403':
          description: Forbidden
      security:
        - im_external_auth:
          - 'im.ex.g.d'      

  /idp/attributeMapping/{origin}:
    put:
      tags:
        - IDP
      parameters:
        - name: origin
          in: path
          required: true
          description: Unique alias of the identity provider (origin key of idp).
          type: string
        - in: body
          name: Update IDP with external group attribute
          schema:
            $ref: '#/definitions/oidcIdpExternalGroup'

      summary: Updating the  specific IDP with attribute mapping for external group
      description: This updates  the  specific idp without configuration.
      produces:
        - application/json
      responses:
        '200':
          description: idp description
          schema:
            $ref: '#/definitions/oidcIdpExternalGroupResponse'
        "404":
          description: Not Found - Incorrect IDP id
        "403":
          description: Forbidden - Insufficient scope
      security:
        - im_external_auth:
            - 'im.ex.idp.u'
definitions:
  Email:
    type: object
    required:
      - value
    properties:
      value:
        type: string
        description: The email address.
        example: johndoe@example.com
  Group:
    type: object
    required:
      - display
    properties:
      display:
        type: string
        example: mdsp:core:StandardUser
      type:
        type: string
        enum:
          - DIRECT
          - INDIRECT
        example: DIRECT
      value:
        type: string
        example: 85300c9f-9616-4596-ac1c-1ca837426d7e
  NameRequest:
    type: object
    required:
      - familyName
      - givenName
    properties:
      familyName:
        type: string
        example: Doe
      givenName:
        type: string
        example: John
  UserName:
    type: string
    format: email
    maxLength: 60
    pattern: '^[a-zA-Z0-9._%+&*-]+(?:\.[a-zA-Z0-9_+&*-]+)*@(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}$'
    description: The e-mail address of the user.
    example: johndoe@example.com
  NameResponse:
    type: object
    properties:
      familyName:
        type: string
        example: Doe
      givenName:
        type: string
        example: John
  ScimGroupPost:
    type: object
    required:
      - displayName
    properties:
      description:
        type: string
        example: Very amazing group for amazing people
        description: Human readable description of the group, displayed e.g. when approving scopes
      displayName:
        type: string
        example: AmazingGroup
        description: The identifier specified upon creation of the group, unique within the identity zone
      members:
        type: array
        description: If given members array is empty, all members will be deleted.
        items:
          $ref: '#/definitions/ScimGroupMember'
  ScimGroup:
    type: object
    properties:
      id:
        type: string
        example: 68af46d-e9b8-4t04-5a20-7d557f5da8d
        description: The globally unique group ID
      description:
        type: string
        example: Very amazing group for amazing people
        description: Human readable description of the group, displayed e.g. when approving scopes
      displayName:
        type: string
        example: AmazingGroup
        description: The identifier specified upon creation of the group, unique within the identity zone
      members:
        type: array
        items:
          $ref: '#/definitions/ScimGroupMember'
      meta:
        $ref: '#/definitions/ScimMeta'
  ScimGroupMember:
    type: object
    required:
      - type
      - value
    properties:
      type:
        type: string
        enum:
          - USER
          - GROUP
        description: Either "USER" or "GROUP"
        example: USER
      value:
        type: string
        description: Globally unique identifier of the member, either a user ID or another group ID
        example: e74ff46d-8bb8-4d04-b420-7d557fe86a8d
  ScimMeta:
    type: object
    properties:
      created:
        type: string
        format: date-time
        example: "2018-02-08T15:20:43.000Z"
      lastModified:
        type: string
        format: date-time
        example: "2018-02-08T15:20:43.000Z"
      version:
        type: integer
        format: int32
        example: 0
  ScimUserPut:
    type: object
    required:
      - userName
      - name
      - emails
    description: 'Name object can be null. Example: "name": {}. Name attributes are fetched from WebKey during authentication.'
    properties:
      active:
        type: boolean
        description: 'False means a soft delete.'
      name:
        $ref: '#/definitions/NameRequest'
      userName:
        $ref: '#/definitions/UserName'
      emails:
        type: array
        items:
          $ref: '#/definitions/Email'
      subtenants:
        type: array
        items:
          $ref: '#/definitions/SubtenantId'
  ScimUserPost:
    type: object
    required:
      - userName
    properties:
      active:
        type: boolean
        description: 'False means a soft delete.'
      name:
        $ref: '#/definitions/NameRequest'
      userName:
        $ref: '#/definitions/UserName'
      subtenants:
        type: array
        items:
          $ref: '#/definitions/SubtenantId'
  ScimUserResponse:
    type: object
    properties:
      schemas:
        type: array
        items:
          type: string
          example: urn:scim:schemas:core:1.0
      id:
        example: 2f95913-d3d9-4a4a-951a-c21184080cf3
        type: string
      userName:
        type: string
        description: The e-mail address of the user.
        example: johndoe@example.com
      name:
        $ref: '#/definitions/NameResponse'
      groups:
        type: array
        items:
          $ref: '#/definitions/Group'
      emails:
        type: array
        items:
          $ref: '#/definitions/Email'
      active:
        type: boolean
      meta:
        $ref: '#/definitions/ScimMeta'
      subtenants:
        type: array
        items:
          $ref: '#/definitions/SubtenantId'
  ScimUserPostResponse:
    type: object
    properties:
      schemas:
        type: array
        items:
          type: string
          example: urn:scim:schemas:core:1.0
      id:
        example: 2f95913-d3d9-4a4a-951a-c21184080cf3
        type: string
      userName:
        type: string
        description: The e-mail address of the user.
        example: johndoe@example.com
      name:
        $ref: '#/definitions/NameResponse'
      groups:
        type: array
        items:
          $ref: '#/definitions/Group'
        example: []
      emails:
        type: array
        items:
          $ref: '#/definitions/Email'
      active:
        type: boolean
      meta:
        $ref: '#/definitions/ScimMeta'
      subtenants:
        type: array
        items:
          $ref: '#/definitions/SubtenantId'
  ScimGroupMemberList:
    type: array
    items:
      $ref: '#/definitions/ScimGroupMember'
  ScimGroupSearchResults:
    type: object
    properties:
      itemsPerPage:
        type: integer
        format: int32
        example: 100
      resources:
        type: array
        items:
          $ref: '#/definitions/ScimGroup'
      schemas:
        type: array
        items:
          type: string
          example: "urn:scim:schemas:core:1.0"
      startIndex:
        type: integer
        format: int32
        example: 1
      totalResults:
        type: integer
        format: int32
        example: 1
  ScimUserResponseSearchResults:
    type: object
    properties:
      itemsPerPage:
        type: integer
        format: int32
        example: 100
      resources:
        type: array
        items:
          $ref: '#/definitions/ScimUserResponse'
      schemas:
        type: array
        items:
          type: string
      startIndex:
        type: integer
        format: int32
        example: 1
      totalResults:
        type: integer
        format: int32
        example: 1
  SubtenantId:
    type: object
    example:
      id: octopus
    required:
      - id
    properties:
      id:
        type: string
        example: octopus
        description: The ID / name of the subtenant.
  OAuthClient:
    type: object
    properties:
      clientId:
        type: string
        description: Identifier of the client, unique within the identity zone
      authorizedGrantTypes:
        type: array
        items:
          type: string
        example:
          - client_credentials
        description: List of grant types that can be used to obtain a token with this client. Can include authorization_code, password, implicit, and/or client_credentials.
      redirectUri:
        type: array
        items:
          type: string
        example:
          - https://coreservicesqa-appname.eu-central-rc.mindapps.io/login
      name:
        type: string
        description: A human readable name for the client
        example: Client for calling assetmanagement
      authorities:
        type: array
        items:
          type: string
        description: Scopes which the client is able to grant when creating a client. Defaults to "uaa.none". E.g. with client_credentials as authorized_grant_types, the client will get the scopes listed here.
        example:
          - client.r
          - client.u
      scopes:
        type: array
        items:
          type: string
        description: Scopes allowed for the client. Defaults to "uaa.none". E.g. with *password* as authorized_grant_types the user can get the intersection of his scopes and the scopes listed here.
        example:
          - client.c
          - client.d
      lastModified:
        type: integer
        format: int64
        description: Epoch (milliseconds) of the moment the client information was last altered. Not affected by secret changes.
        example: 1530798206000
      secretCreationTimes:
        $ref: '#/definitions/ClientSecretCreationTimes'
  ClientSecretCreationTimes:
    type: array
    items:
      type: integer
      format: int64
    description: >-
      Epoch (milliseconds) of the moment the client secret was introduced. Array contains creation times in ascending order.

      Most of the time it should contain only one item, except during secret rotation - in that case, two items will be there.
    example: [1530798206000, 1550842313000]
  ChangeSecretRequest:
    type: object
    properties:
      newSecret:
        type: string
        description: |
          New secret for the client. Must meet the following requirements:
            * alphabet is a-zA-Z0-9
            * minimum 43 characters
            * maximum 255 characters
          If parameter is missing, then new secret will be generated.
  ChangedSecretResponse:
    type: object
    properties:
      secret:
        type: string
        description: the new secret.
  Page:
    type: object
    properties:
      size:
        type: integer
      totalElements:
        type: integer
      totalPages:
        type: integer
      number:
        type: integer
  Errors:
    type: object
    properties:
      errors:
        type: array
        description: Concrete error codes and messages are defined at operation
          error response descriptions in this API specification.
        items:
          type: object
          properties:
            code:
              type: string
              description: Unique error code. Every code is bound to one message.
              format: mdsp.core.iam.<suffix>
              example: mdsp.core.iam.exampleCode
            logref:
              type: string
              description: Logging correlation ID for debugging purposes.
              example: 0bff7e7a-cd25-4576-9908-4180ef086174
            message:
              type: string
              description: Human readable error message in English.
              example: Example error message.
            messageParameters:
              type: array
              description: |
                In case an error message is parametrized, the parameter names and values are returned for, e.g., localization purposes. The parametrized error messages are defined at the operation error response descriptions in this API specification. Parameters are denoted by named placeholders '{\<parameter name\>}' in the  message specifications. At runtime, returned message placeholders are substituted by actual parameter values.
              example:
              - name: exampleParameterName
                value: "100"
              items:
                type: object
                properties:
                  name:
                    type: string
                    description: Name of message parameter as specified in parametrized
                      error message.
                  value:
                    type: string
                    description: Value of message parameter as substituted in returned
                      error message.
                description: Message parameter
    description: Error response body model.   

  oidcIdpExternalGroup:
    type: object
    properties:
      external_group: 
        type: string
        description: External group claim from idp to map with idp attribute mapping.
        example: "testGroup"  
  oidcIdpExternalGroupResponse:
    type: object
    properties:
      idpType: 
        type: string
        example: "oidc1.0"
      config:
        type: string
        example: "{\"emailDomain\":[\"Keycloak\"],\"additionalConfiguration\":null,\"providerDescription\":null,\"externalGroupsWhitelist\":[],\"attributeMappings\":{\"given_name\":\"given_name\",\"family_name\":\"family_name\",\"email\":\"email\",\"user_name\":\"email\",\"external_groups\":[\"abc\"]},\"addShadowUserOnLogin\":false,\"storeCustomAttributes\":false,\"authUrl\":null,\"tokenUrl\":null,\"tokenKeyUrl\":null,\"tokenKey\":null,\"linkText\":\"OKTA IDP\",\"showLinkText\":true,\"clientAuthInBody\":true,\"skipSslValidation\":false,\"relyingPartyId\":\"0oacngwwsbW\",\"scopes\":[\"openid\",\"email\",\"profile\"],\"issuer\":null,\"responseType\":\"code\",\"userInfoUrl\":null,\"discoveryUrl\":\"https://dev.okta.com/.well-known/openid-configuration\",\"passwordGrantEnabled\":false}"
      id:
        type: string
        example: "553a31af-7d3e-4192-a0c1-48e8a3ddad22"
      originKey:
        type: string
        example: "OIDC10_KEYCLOAK"
      name:
        type: string
        example: "Keycloak"
      version:
        type: string
        example: 3
      created:
        type: string
        example: 1616479161000
      last_modified:
        type: string
        example: 1616479609000
      active:
        type: string
        example: "false"
      identityZoneId:
        type: string
        example: "aviato"
  externalGroupPost:
    type: object
    properties:
      groupName:
        type: string
        example: "mdsp:core:tenantAdmin"
        description: The globally unique name of Insight Hub group
      externalGroup:
        type: string
        example: "DesignerAdmin"
        description: The identifier for the group in external identity provider that needs to be mapped to internal group
      origin:
        type: string
        example: "OIDC10_KEYCLOAK"
        description: Unique alias of the identity provider (origin key of idp)
  externalGroupPostResponse:
    type: object
    properties:
      meta:
        $ref: '#/definitions/externalGroupMeta'
      groupId:
        type: string
        example: "75df5923-c2d9-4858-b8bc-e1e20d2adf49"
        description: The globally unique group ID of Insight Hub group which is full qualified name of group and can be obtained from GET /Groups API.
      externalGroup:
        type: string
        example: "external group"
        description: The identifier for the group in external identity provider that needs to be mapped to internal group
      displayName:
        type: string
        example: "mdsp:core:AdminUser"
      origin:
        type: string
        example: "OIDC10_KEYCLOAK"
        description: Unique alias of the identity provider (origin key of idp)
  externalGroupMeta:
    type: object
    properties:
      version:
        type: integer
        example: 0
      created:
        type: string
        description: >-
          Creation time of the external group mapping.
          Format is following the ISO 8061 - 'YYYY-MM-DDThh:mm:ss.sssTZD'.
        example: "2023-10-26T07:54:16.522Z"
      lastModified:
        type: string
        description: >-
          Last modified time of the external group mapping.
          Format is following the ISO 8061 - 'YYYY-MM-DDThh:mm:ss.sssTZD'.
        example: "2023-10-26T07:54:16.522Z"
  externalGroupMappingResults:
    type: object
    properties:
      resources:
        type: array
        items:
          $ref: '#/definitions/externalGroupPostResponse'
      startIndex:
        type: integer
        format: int32
        example: 1
      totalResults:
        type: integer
        format: int32
        example: 1
      itemsPerPage:
        type: integer
        format: int32
        example: 1       
      schemas:
        type: array
        items:
          type: string
          example: "urn:scim:schemas:core:1.0"

securityDefinitions:
  im_user_auth:
    type: oauth2
    flow: accessCode
    description: User controller based scopes
    authorizationUrl: http://UAA_DOMAIN/oauth/authorize
    tokenUrl: http://UAA_DOMAIN/oauth/token
    scopes:
      im.usr.c: Create user
      im.usr.r: See details of user; List users
      im.usr.u: Update details of user
      im.usr.d: Delete user
      im.usr.me: See the assigened roles of the user
  im_group_auth:
    type: oauth2
    flow: accessCode
    description: Group controller based scopes
    authorizationUrl: http://UAA_DOMAIN/oauth/authorize
    tokenUrl: http://UAA_DOMAIN/oauth/token
    scopes:
      im.g.c: UserUaa - Create group
      im.g.r: UserUaa - See details of group; UserUaa - List groups; UserUaa - List members of group
      im.g.u: UserUaa - Update details of group; UserUaa - Add member to group; UserUaa - Remove member of group
      im.g.d: UserUaa - Delete group
  im_client_auth:
    type: oauth2
    flow: accessCode
    description: OAuth client controller based scopes
    authorizationUrl: http://UAA_DOMAIN/oauth/authorize
    tokenUrl: http://UAA_DOMAIN/oauth/token
    scopes:
      prv.oc.r: read client informations
      prv.oc.sec.ch: Change own client secret
      prv.oc.sec.admin: Change arbitrary client secret
  im_external_auth:
    type: oauth2
    flow: accessCode
    description: External Group controller based scopes
    authorizationUrl: http://UAA_DOMAIN/oauth/authorize
    tokenUrl: http://UAA_DOMAIN/oauth/token
    scopes:
      im.ex.g.c: Create external group mapping
      im.ex.g.d: Delete external group mapping
      im.ex.g.r: List the external group mapping
      im.ex.idp.u: Modify the IDP with external group attribute