openapi: 3.0.3
info:
  version: "2.22"
  title: NVIDIA Run:ai
  license:
    name: NVIDIA Run:ai
    url: https://www.nvidia.com/en-us/agreements/enterprise-software/nvidia-software-license-agreement/
servers:
  - url: https://app.run.ai
security:
  - bearerAuth: []
tags:
  - name: Organizations
  - name: Tenant
    description: Manage tenant settings.
    x-parent: Organizations
  - name: Authentication and Authorization
  - name: Applications
    description: Create and manage applications in the tenant.
    x-parent: Authentication and Authorization
  - name: Tokens
    description: "Use tokens to facilitate authentication to the NVIDIA Run:ai API. \nThe API server must be configured to use the NVIDIA Run:ai identity \nservice to validate authentication tokens.\n"
    x-parent: Authentication and Authorization
  - name: Users
    description: Manage platform users.
    x-parent: Authentication and Authorization
  - name: User Applications
    description: Manage user applications.
    x-parent: Authentication and Authorization
  - name: Idps
    description: Configure and manage external identity providers.
    x-parent: Authentication and Authorization
  - name: Settings
    description: |
      View and manage configuration settings for your organization.
    x-parent: Authentication and Authorization
  - name: Audit
  - name: AuditLogs
    description: The audit log provides audit trail information for user activity, changes to business objects and other important information. For more information, see [Audit log](https://run-ai-docs.nvidia.com/self-hosted/2.22/infrastructure-setup/procedures/event-history).
    x-parent: Audit
paths:
  /api/v1/tenants:
    get:
      summary: Get a list of tenants.
      description: Retrieve a list of tenants and their details.
      operationId: get_tenants
      tags:
        - Tenant
      parameters:
        - $ref: '#/components/parameters/deleted'
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Tenants'
                x-schema-name: Tenants
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      summary: Create tenant
      operationId: create_tenant
      tags:
        - Tenant
      requestBody:
        description: The tenant to create.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TenantCreationRequest'
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantCreationResponse'
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "409":
          $ref: '#/components/responses/409Conflict'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/tenants/{tenantId}:
    get:
      summary: Get tenant
      operationId: get_tenant_by_id
      tags:
        - Tenant
      parameters:
        - $ref: '#/components/parameters/tenantId'
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Tenant'
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: soft/hard delete tenant
      operationId: delete_tenant_by_id
      tags:
        - Tenant
      parameters:
        - $ref: '#/components/parameters/tenantId'
        - $ref: '#/components/parameters/isHardDelete'
      responses:
        "200":
          description: tenant uid that was deleted.
          content:
            application/json:
              schema:
                type: object
                required:
                  - uid
                properties:
                  uid:
                    type: string
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/idps:
    get:
      summary: Get external idps list
      operationId: get_idps
      parameters:
        - $ref: '#/components/parameters/queryTenantId'
      tags:
        - Idps
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Idps'
              examples:
                saml:
                  value:
                    - alias: saml
                      type: saml
                      redirectUri: https://domain/auth/realms/name/broker/saml/endpoint
                      samlData:
                        signingCertificate: signingCertificateExample
                        singleSignOnServiceUrl: https://authhost/protocol/saml
                        entityId: example.run.ai/runai
                        serviceProviderMetadataUrl: https://example.runai.com/auth/realms/runai/broker/saml/endpoint/descriptor
                      mappers:
                        gid: GID
                        groups: GROUPS
                        supplementaryGroups: SUPPLEMENTARYGROUPS
                        uid: UID
                        email: email
                oidc:
                  value:
                    - alias: oidc
                      type: oidc
                      redirectUri: https://domain/auth/realms/name/broker/oidc/endpoint
                      oidcData:
                        clientId: my-client-id
                        clientSecret: '*******'
                        scopes:
                          - scope1
                          - scope2
                        mandatoryClaim:
                          claim: my-claim
                          values:
                            - val1
                            - val2
                      mappers:
                        gid: GID
                        groups: GROUPS
                        supplementaryGroups: SUPPLEMENTARYGROUPS
                        uid: UID
                        email: email
                openshift-v4:
                  value:
                    - alias: openshift-v4
                      type: openshift-v4
                      redirectUri: https://domain/auth/realms/name/broker/openshift-v4/endpoint
                      ocpData:
                        clientId: my-client-id
                        clientSecret: '*******'
                        idpBaseUrl: https://authhost/ocp
                        scopes:
                          - scope1
                          - scope2
                      mappers:
                        gid: metadata.gid
                        groups: groups
                        supplementaryGroups: supplementarygroups
                        uid: metadata.uid
                        email: metadata.name
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      summary: Configure external idp
      operationId: create_idp
      parameters:
        - $ref: '#/components/parameters/queryTenantId'
      tags:
        - Idps
      requestBody:
        description: Idp configuration
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IdpCreationRequest'
            examples:
              saml (by url):
                value:
                  type: saml
                  samlData:
                    metadataXmlType: url
                    metadataXmlUrl: https://authhost/saml/metadata.xml
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              saml (by file):
                value:
                  type: saml
                  samlData:
                    metadataXmlType: file
                    fileName: descriptor.xml
                    metadataXmlFile: <file content in base64>
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              oidc:
                value:
                  type: oidc
                  oidcData:
                    clientId: my-client-id
                    clientSecret: my-client-secret
                    discoverDocumentUrl: https://authhost/openid-configuration
                    mandatoryClaim:
                      claim: my-claim
                      values:
                        - val1
                        - val2
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              openshift-v4:
                value:
                  type: openshift-v4
                  ocpData:
                    clientId: my-client-id
                    clientSecret: my-client-secret
                    idpBaseUrl: https://authhost/ocp
                  mappers:
                    gid: metadata.gid
                    groups: groups
                    supplementaryGroups: supplementarygroups
                    uid: metadata.uid
                    email: metadata.name
      responses:
        "201":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdpPostResponse'
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "409":
          $ref: '#/components/responses/409Conflict'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/idps/{idp}:
    get:
      summary: Get external idp by alias
      operationId: get_idp
      tags:
        - Idps
      parameters:
        - $ref: '#/components/parameters/idp'
        - $ref: '#/components/parameters/queryTenantId'
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              examples:
                saml:
                  value:
                    alias: saml
                    type: saml
                    redirectUri: https://domain/auth/realms/name/broker/saml/endpoint
                    samlData:
                      signingCertificate: signingCertificateExample
                      singleSignOnServiceUrl: https://authhost/protocol/saml
                      entityId: example.run.ai/runai
                      serviceProviderMetadataUrl: https://example.runai.com/auth/realms/runai/broker/saml/endpoint/descriptor
                    mappers:
                      gid: GID
                      groups: GROUPS
                      supplementaryGroups: SUPPLEMENTARYGROUPS
                      uid: UID
                      email: email
                oidc:
                  value:
                    alias: oidc
                    type: oidc
                    redirectUri: https://domain/auth/realms/name/broker/oidc/endpoint
                    oidcData:
                      clientId: my-client-id
                      clientSecret: '*******'
                      scopes:
                        - scope1
                        - scope2
                      mandatoryClaim:
                        claim: my-claim
                        values:
                          - val1
                          - val2
                    mappers:
                      gid: GID
                      groups: GROUPS
                      supplementaryGroups: SUPPLEMENTARYGROUPS
                      uid: UID
                      email: email
                openshift-v4:
                  value:
                    alias: openshift-v4
                    type: openshift-v4
                    redirectUri: https://domain/auth/realms/name/broker/openshift-v4/endpoint
                    ocpData:
                      clientId: my-client-id
                      clientSecret: '*******'
                      idpBaseUrl: https://authhost/ocp
                      scopes:
                        - scope1
                        - scope2
                    mappers:
                      gid: metadata.gid
                      groups: groups
                      supplementaryGroups: supplementarygroups
                      uid: metadata.uid
                      email: metadata.name
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: Delete external idp by alias
      operationId: delete_idp
      tags:
        - Idps
      parameters:
        - $ref: '#/components/parameters/idp'
        - $ref: '#/components/parameters/queryTenantId'
      responses:
        "200":
          description: Idp successfully deleted
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
    put:
      summary: Update external idp by alias
      operationId: update_idp
      tags:
        - Idps
      parameters:
        - $ref: '#/components/parameters/idp'
        - $ref: '#/components/parameters/queryTenantId'
      requestBody:
        description: Updated idp object
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IdpCreationRequest'
            examples:
              saml (by url):
                value:
                  type: saml
                  samlData:
                    metadataXmlType: url
                    metadataXmlUrl: https://authhost/saml/metadata.xml
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              saml (by file):
                value:
                  type: saml
                  samlData:
                    metadataXmlType: file
                    fileName: descriptor.xml
                    metadataXmlFile: <file content in base64>
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              oidc:
                value:
                  type: oidc
                  oidcData:
                    clientId: my-client-id
                    clientSecret: my-client-secret
                    discoverDocumentUrl: https://authhost/openid-configuration
                    mandatoryClaim:
                      claim: my-claim
                      values:
                        - val1
                        - val2
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              openshift-v4:
                value:
                  type: openshift-v4
                  ocpData:
                    clientId: my-client-id
                    clientSecret: my-client-secret
                    idpBaseUrl: https://authhost/ocp
                  mappers:
                    gid: metadata.gid
                    groups: groups
                    supplementaryGroups: supplementarygroups
                    uid: metadata.uid
                    email: metadata.name
      responses:
        "200":
          description: Idp successfully updated
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/idps/{idp}/mappers:
    get:
      summary: Get idp mappers
      operationId: get_idp_mappers
      tags:
        - Idps
      parameters:
        - $ref: '#/components/parameters/idp'
        - $ref: '#/components/parameters/queryTenantId'
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Mappers'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
    put:
      summary: Update idp mappers
      operationId: update_idp_mappers
      tags:
        - Idps
      parameters:
        - $ref: '#/components/parameters/idp'
        - $ref: '#/components/parameters/queryTenantId'
      requestBody:
        description: Map of our mappers and their source in the external idp
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Mappers'
      responses:
        "202":
          description: Request accepted successfully.
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/users:
    get:
      summary: Get users.
      description: Retrieve a list of platform users.
      operationId: get_users
      tags:
        - Users
      parameters:
        - description: Filter results by user attribute.
          in: query
          name: filter
          required: false
          deprecated: true
          schema:
            type: string
          example: runai.is_local:true
        - $ref: '#/components/parameters/usersFilterBy'
        - $ref: '#/components/parameters/usersSortBy'
        - $ref: '#/components/parameters/SortOrder'
        - $ref: '#/components/parameters/Offset'
        - $ref: '#/components/parameters/limit'
        - $ref: '#/components/parameters/search'
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Users'
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      summary: Create a local user.
      description: Use to create a local platform user.
      operationId: create_user
      tags:
        - Users
      requestBody:
        description: User object to create
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserCreationRequest'
      responses:
        "201":
          description: Created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserPostResponse'
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "409":
          $ref: '#/components/responses/409Conflict'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/users/count:
    get:
      summary: Count users
      operationId: count_users
      description: count users
      tags:
        - Users
      parameters:
        - $ref: '#/components/parameters/usersFilterBy'
        - $ref: '#/components/parameters/search'
      responses:
        "200":
          description: ok
          content:
            application/json:
              schema:
                type: object
                required:
                  - count
                properties:
                  count:
                    type: integer
                    format: int64
                    example: 1
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/users/{userId}/logout:
    post:
      summary: Logout a user.
      description: Use to force a user to logout.
      operationId: logout_user
      tags:
        - Users
      parameters:
        - $ref: '#/components/parameters/userId'
      responses:
        "200":
          description: Executed successfully.
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/users/{userId}/password:
    post:
      summary: Reset a user's password.
      description: Use to to reset a user's password.
      operationId: reset_user_password
      tags:
        - Users
      parameters:
        - $ref: '#/components/parameters/userId'
      responses:
        "200":
          description: Regenerated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  tempPassword:
                    type: string
                example:
                  tempPassword: asdasidjn9d
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/users/{userId}:
    get:
      summary: Get a user by id.
      description: Retrieve a user's details by id.
      operationId: get_user_by_id
      tags:
        - Users
      parameters:
        - $ref: '#/components/parameters/userId'
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: Delete a user by id.
      description: Use to delete a user by id.
      operationId: delete_user_by_id
      tags:
        - Users
      parameters:
        - $ref: '#/components/parameters/userId'
      responses:
        "204":
          description: Executed successfully.
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/me/password:
    post:
      summary: change user password
      operationId: change_user_password
      tags:
        - Users
      requestBody:
        description: Password to change
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserChangePasswordRequest'
      responses:
        "200":
          description: Password changed successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  currentPassword:
                    type: string
                  newPassword:
                    type: string
                example:
                  tempPassword: Abcd!234
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/apps:
    get:
      summary: Get a list of applications.
      description: Retrieve a list of applications.
      operationId: get_applications
      tags:
        - Applications
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Applications'
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      summary: Create an application.
      description: Used to create an application.
      operationId: create_application
      tags:
        - Applications
      requestBody:
        description: Application object to create
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationCreationRequest'
      responses:
        "201":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationPostResponse'
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "409":
          $ref: '#/components/responses/409Conflict'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/apps/{appId}:
    get:
      summary: Get application by id.
      description: Retrieve the details of an application by id.
      operationId: get_application_by_id
      tags:
        - Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Application'
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
    patch:
      summary: Update application details by id.
      description: Use to update the details of an application by id.
      operationId: update_application_by_id
      tags:
        - Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      requestBody:
        description: Application object that needs to be updated.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationPatchRequest'
      responses:
        "200":
          description: Executed successfully.
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: Delete an application by id.
      description: Use to delete an application by id.
      operationId: delete_application_by_id
      tags:
        - Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      responses:
        "204":
          description: Executed successfully.
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/apps/{appId}/secret:
    post:
      summary: Regenerate an application secret.
      description: Use to regenerate the application secret by id.
      operationId: regenerate_application_secret
      tags:
        - Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      responses:
        "200":
          description: Regenerated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  secret:
                    type: string
                example:
                  secret: 189ej2ijd92fj092k049fk0
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/user-applications:
    get:
      summary: Get a list of users applications.
      description: Retrieve a list of the users applications.
      operationId: get_user_applications
      tags:
        - User Applications
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserApps'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      summary: Create a user application.
      description: Used to create a user application.
      operationId: create_user_application
      tags:
        - User Applications
      requestBody:
        description: Application object to create
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserAppCreationRequest'
      responses:
        "201":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAppPostResponse'
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "409":
          $ref: '#/components/responses/409Conflict'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/user-applications/{appId}:
    get:
      summary: Get user application by id.
      description: Retrieve the details of a user's application by app id.
      operationId: get_user_application_by_id
      tags:
        - User Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserApp'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: Delete a user application byid.
      description: Use to user a user application by id.
      operationId: delete_user_application_by_id
      tags:
        - User Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      responses:
        "204":
          description: Executed successfully.
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/user-applications/{appId}/secret:
    post:
      summary: Regenerate a user application secret.
      description: Use to regenerate the user application secret by id.
      operationId: regenerate_user_application_secret
      tags:
        - User Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      responses:
        "200":
          description: Regenerated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  secret:
                    type: string
                example:
                  secret: this-is-my-secret
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/administration/user-applications:
    get:
      summary: Get a list of all users applications.
      description: Retrieve a list of all users applications.
      operationId: get_user_applications_administration
      tags:
        - User Applications
      parameters:
        - description: Filter results by clientId
          in: query
          name: clientId
          required: false
          schema:
            type: string
          example: 3434c-12323ab-4ce2ea6-b44fc-db344d
        - description: Filter results by creatdBy
          in: query
          name: createdBy
          required: false
          schema:
            type: string
          example: test@run.ai
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAppsAdministration'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/administration/user-applications/{appId}:
    delete:
      summary: Delete a user application by id for adminstrations.
      description: Use to delete a user application by id for adminstrations.
      operationId: delete_user_application_by_id_administration
      tags:
        - User Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      responses:
        "204":
          description: Executed successfully.
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/token:
    post:
      tags:
        - Tokens
      summary: Create a token
      description: Create tokens using the `grant_type` parameter.
      operationId: grant_token
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TokenRequest'
            examples:
              client_credentials:
                value:
                  grantType: client_credentials
                  clientID: clientID
                  clientSecret: clientSecret
                description: Obtain the clientID and the clientSecret using applications or user applications endpoints
              refresh_token:
                value:
                  grantType: refresh_token
                  refreshToken: refreshToken
                  clientID: clientID
              exchange_token:
                value:
                  grantType: exchange_token
                  code: code
                  clientID: clientID
                  redirectUri: redirectUri
              external_token_exchange:
                value:
                  grantType: external_token_exchange
                  externalToken: access token from external idp
              app_token (deprecated):
                value:
                  grantType: app_token
                  appID: appID
                  appSecret: appSecret
                description: Deprecated - Obtain the appID and the appSecret using applications or user applications endpoints
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        "400":
          $ref: '#/components/responses/400BadRequest'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/security/settings:
    get:
      summary: Get security settings
      operationId: get_security_settings
      parameters:
        - $ref: '#/components/parameters/queryTenantId'
      tags:
        - Settings
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SettingsGetResponse'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/security/settings/{key}:
    put:
      summary: Update security setting by key
      operationId: update_security_setting_by_key
      tags:
        - Settings
      parameters:
        - $ref: '#/components/parameters/settingsKey'
        - $ref: '#/components/parameters/queryTenantId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              anyOf:
                - $ref: '#/components/schemas/AutoRedirectSsoSetting'
                - $ref: '#/components/schemas/BrowserSessionTimeoutSetting'
                - $ref: '#/components/schemas/LogoutRedirectUriSetting'
            examples:
              autoRedirectSSO:
                value:
                  enabled: false
                  idpAlias: oidc
              browserSessionTimeout:
                value:
                  idleTimeout: 60
              logoutRedirectUri:
                value:
                  uri: https://example.com/logout-success
      responses:
        "200":
          description: Setting successfully updated
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
    get:
      summary: Get security setting by key
      operationId: get_security_setting_by_key
      tags:
        - Settings
      parameters:
        - $ref: '#/components/parameters/settingsKey'
        - $ref: '#/components/parameters/queryTenantId'
      responses:
        "200":
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Settings'
              examples:
                autoRedirectSSO:
                  value:
                    enabled: false
                    idpAlias: oidc
                browserSessionTimeout:
                  value:
                    idleTimeout: 60
                logoutRedirectUri:
                  value:
                    uri: https://example.com/logout-success
        "400":
          $ref: '#/components/responses/400BadRequest'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "404":
          $ref: '#/components/responses/404NotFound'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/audit/log:
    get:
      description: Get audit logs based on query params filter
      summary: Get audit logs
      operationId: getAuditLogs
      tags:
        - AuditLogs
      parameters:
        - $ref: '#/components/parameters/StartRequired'
        - $ref: '#/components/parameters/EndRequired'
        - $ref: '#/components/parameters/Offset'
        - $ref: '#/components/parameters/NumberOfSamples'
        - $ref: '#/components/parameters/SortOrder'
        - $ref: '#/components/parameters/AuditLogSort'
        - $ref: '#/components/parameters/AuditLogFilter'
      responses:
        "200":
          description: Executed successfully
          content:
            application/json:
              schema:
                type: object
                required:
                  - logs
                properties:
                  total:
                    type: integer
                    example: 2000
                  next:
                    type: integer
                    example: 100
                  audit_logs:
                    $ref: '#/components/schemas/AuditLogs'
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/audit/log/file:
    get:
      description: Download audit logs as a file, based on query params filter
      summary: Download audit logs
      operationId: downloadAuditLogs
      tags:
        - AuditLogs
      parameters:
        - in: query
          name: file_type
          schema:
            type: string
            enum:
              - CSV
              - JSON
            default: CSV
          required: false
        - $ref: '#/components/parameters/StartRequired'
        - $ref: '#/components/parameters/EndRequired'
        - $ref: '#/components/parameters/NumberOfSamples'
        - $ref: '#/components/parameters/AuditLogFilter'
      responses:
        "200":
          description: File downloaded
          content:
            application/octet-stream: {}
        "401":
          $ref: '#/components/responses/401Unauthorized'
        "403":
          $ref: '#/components/responses/403Forbidden'
        "500":
          $ref: '#/components/responses/500InternalServerError'
        "503":
          $ref: '#/components/responses/503ServiceUnavailable'
components:
  schemas:
    TenantId:
      description: The id of the tenant.
      type: integer
      format: int32
      example: 1001
    Tenant:
      type: object
      required:
        - id
        - uuid
        - name
        - status
        - contractType
        - createdAt
        - updatedAt
        - smg
      properties:
        id:
          $ref: '#/components/schemas/TenantId'
        mimirId:
          type: string
        uuid:
          type: string
          format: uuid
          description: The universally unique identifier of the tenant.
        name:
          type: string
          description: The internal system name of the tenant.
        displayName:
          type: string
          description: The name of the tenant as shown to users within the tenant.
        smg:
          type: boolean
        status:
          type: string
          enum:
            - Creating
            - Failed
            - Updating
            - Deleted
            - Deleting
            - Ready
          description: |
            The current status of the tenant.
            Possible values:
            - Creating
            - Failed
            - Updating
            - Deleted
            - Deleting
            - Ready
        createdAt:
          type: string
          format: date-time
          description: The date and time when the tenant was created.
        updatedAt:
          type: string
          format: date-time
          description: The date and time when the tenant was last updated.
        contractType:
          type: string
          enum:
            - normal
            - trial
        eula:
          type: string
          description: The signer details for the tenant's EULA (End User License Agreement).
      example:
        id: 1
        name: example
        displayName: Example
        status: Ready
        tenantId: 123
        createdAt: "2020-01-01T00:00:00Z"
        updatedAt: "2020-01-02T00:00:00Z"
        deletedAt: null
    Tenants:
      type: array
      items:
        $ref: '#/components/schemas/Tenant'
      x-schema-name: Tenants
    Error:
      required:
        - code
        - message
      properties:
        code:
          type: integer
          minimum: 100
          maximum: 599
        message:
          type: string
        details:
          type: string
      example:
        code: 400
        message: Bad request - Resource should have a name
    Roles:
      type: string
      description: 'The role assigned to the tenant''s admin user. Possible value: System administrator.'
      nullable: true
      enum:
        - System administrator
        - Cloud operator
    MetricStoreEndpoint:
      required:
        - url
      type: object
      properties:
        url:
          type: string
          format: uri
          example: http://mimir-nginx.mimir-test.svc:80/api/v1/query
        auth:
          nullable: true
          type: object
          properties:
            basic:
              nullable: true
              type: object
              properties:
                username:
                  type: string
                password:
                  type: string
        headers:
          nullable: true
          type: object
          additionalProperties:
            type: string
          example:
            X-Scope-OrgID: id
    MetricStore:
      required:
        - read
        - write
      type: object
      properties:
        read:
          $ref: '#/components/schemas/MetricStoreEndpoint'
        write:
          $ref: '#/components/schemas/MetricStoreEndpoint'
    TenantCreationRequest:
      type: object
      required:
        - name
        - email
      properties:
        name:
          type: string
          pattern: ^[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]$
          description: The name of the tenant.
          example: name
        email:
          type: string
          pattern: ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$
          description: The email of the tenant's admin user.
          example: first@run.ai
        password:
          type: string
          description: The password for the tenant's admin user.
        contractType:
          type: string
          enum:
            - normal
            - trial
            - ""
        role:
          $ref: '#/components/schemas/Roles'
        metricStore:
          writeOnly: true
          nullable: true
          type: object
          allOf:
            - $ref: '#/components/schemas/MetricStore'
    TenantCreationResponse:
      type: object
      required:
        - tenant
      properties:
        tenant:
          $ref: '#/components/schemas/Tenant'
        additionalData:
          description: additional data for tenant creation
          type: object
          nullable: true
      example:
        tenant:
          id: 1
          name: example
          displayName: Example
          status: Ready
          tenantId: 123
          eulaSigningUser:
            email: user@tenant
            date: "2020-01-01T00:00:00Z"
            ip: 192.168.10.210
            contract_type: normal
          created_at: "2020-01-01T00:00:00Z"
          updated_at: "2020-01-02T00:00:00Z"
          deleted_at: null
        additionalData:
          tenantDomain: tenant.test.run.ai
          testUser:
            tenant-test@run.ai: Abc!23
          customerUser:
            user@tenant: Abc!23
    ComplianceIssues:
      properties:
        complianceIssues:
          type: array
          items:
            type: object
            required:
              - details
              - field
            properties:
              field:
                type: string
                example: compute.gpuDevicesRequest
              details:
                type: string
                example: value must be no less than 3
      nullable: true
      type: object
    SubmissionError:
      allOf:
        - $ref: '#/components/schemas/Error'
        - $ref: '#/components/schemas/ComplianceIssues'
    SamlData:
      type: object
      nullable: true
      properties:
        signingCertificate:
          type: string
        singleSignOnServiceUrl:
          type: string
        entityId:
          type: string
        serviceProviderMetadataUrl:
          type: string
          description: Service Provider (SP) metadata url
    MandatoryClaim:
      type: object
      nullable: true
      required:
        - claim
        - values
      properties:
        claim:
          type: string
          pattern: .*[a-zA-Z].*
        values:
          type: array
          minItems: 1
          items:
            type: string
            minLength: 1
            pattern: ^(?!.*\s).*?[a-zA-Z].*$
    OidcData:
      type: object
      nullable: true
      required:
        - clientId
        - clientSecret
        - discoverDocumentUrl
      properties:
        clientId:
          type: string
        clientSecret:
          type: string
        scopes:
          type: array
          items:
            type: string
            pattern: ^([a-zA-Z0-9-._:]+)(\s[a-zA-Z0-9-._:]+)*$
        mandatoryClaim:
          $ref: '#/components/schemas/MandatoryClaim'
    OcpData:
      type: object
      nullable: true
      properties:
        idpBaseUrl:
          type: string
        clientId:
          type: string
        clientSecret:
          type: string
        scopes:
          type: array
          items:
            type: string
    Mappers:
      type: object
      required:
        - alias
      properties:
        gid:
          type: string
        uid:
          type: string
        groups:
          type: string
        supplementaryGroups:
          type: string
        email:
          type: string
    Idp:
      type: object
      required:
        - alias
        - type
        - redirectUri
      properties:
        alias:
          type: string
          pattern: ^[a-z0-9_-]+$
        type:
          type: string
          enum:
            - saml
            - oidc
            - openshift-v4
        redirectUri:
          type: string
        samlData:
          $ref: '#/components/schemas/SamlData'
        oidcData:
          $ref: '#/components/schemas/OidcData'
        ocpData:
          $ref: '#/components/schemas/OcpData'
        mappers:
          $ref: '#/components/schemas/Mappers'
    Idps:
      type: array
      items:
        $ref: '#/components/schemas/Idp'
    IdpCreationRequestTypeEnum:
      type: string
      enum:
        - oidc
        - saml
        - openshift-v4
    SamlCreationDataMetadataXmlTypeEnum:
      type: string
      enum:
        - url
        - file
    SamlCreationData:
      type: object
      nullable: true
      properties:
        metadataXmlUrl:
          type: string
          pattern: /^(https?://)?([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(:[0-9]{1,5})?(/[^\s]*)?$|^$/
        metadataXmlFile:
          type: string
        fileName:
          type: string
        metadataXmlType:
          allOf:
            - $ref: '#/components/schemas/SamlCreationDataMetadataXmlTypeEnum'
        entityId:
          type: string
    OidcCreationData:
      type: object
      nullable: true
      required:
        - clientId
        - clientSecret
        - discoverDocumentUrl
      properties:
        clientId:
          type: string
          minLength: 1
        clientSecret:
          type: string
          minLength: 1
        discoverDocumentUrl:
          type: string
          pattern: /^(https?://)?([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(:[0-9]{1,5})?(/[^\s]*)?$|^$/
        scopes:
          type: array
          items:
            type: string
            pattern: ^([a-zA-Z0-9-._:]+)(\s[a-zA-Z0-9-._:]+)*$
        mandatoryClaim:
          $ref: '#/components/schemas/MandatoryClaim'
    OcpCreationData:
      type: object
      nullable: true
      required:
        - idpBaseUrl
        - clientSecret
      properties:
        clientId:
          type: string
          minLength: 1
        idpBaseUrl:
          type: string
          pattern: /^(https?://)?([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(:[0-9]{1,5})?(/[^\s]*)?$|^$/
        clientSecret:
          type: string
          minLength: 1
        scopes:
          type: array
          items:
            type: string
            pattern: ^([a-zA-Z0-9-._:]+)(\s[a-zA-Z0-9-._:]+)*$
    IdpCreationRequest:
      type: object
      required:
        - type
        - data
      properties:
        name:
          type: string
        type:
          allOf:
            - $ref: '#/components/schemas/IdpCreationRequestTypeEnum'
        samlData:
          $ref: '#/components/schemas/SamlCreationData'
        oidcData:
          $ref: '#/components/schemas/OidcCreationData'
        ocpData:
          $ref: '#/components/schemas/OcpCreationData'
        mappers:
          $ref: '#/components/schemas/Mappers'
    IdpPostResponse:
      type: object
      required:
        - alias
      properties:
        alias:
          type: string
      example:
        alias: oidc
    IdpResources:
      type: object
      properties:
        resourceName:
          type: string
        resource:
          type: string
        type:
          enum:
            - url
            - file
    UsersFilterSortFields:
      type: string
      enum:
        - username
        - createdBy
        - lastLogin
        - creationTime
        - lastUpdated
        - type
    User:
      type: object
      required:
        - id
        - username
        - createdBy
        - createdAt
        - updatedAt
        - lastLogin
        - isLocal
      properties:
        id:
          type: string
        username:
          type: string
        createdBy:
          type: string
        createdAt:
          type: string
          format: date-time
          nullable: true
        updatedAt:
          type: string
          format: date-time
          nullable: true
        lastLogin:
          type: string
          format: date-time
          nullable: true
        isLocal:
          type: boolean
          nullable: true
        groups:
          type: array
          items:
            type: string
          nullable: true
      example:
        id: 3434c-12323ab-4ce2ea6-b44fc-db344d
        username: test@run.ai
        createdBy: devops@run.ai
        createdAt: "2020-01-01T00:00:00Z"
        updatedAt: "2022-01-01T00:00:00Z"
        lastLogin: "2023-02-01T00:00:00Z"
        isLocal: true
        groups:
          - groupA
          - groupB
    Users:
      type: array
      items:
        $ref: '#/components/schemas/User'
    UserCreationRequest:
      type: object
      required:
        - email
      properties:
        email:
          type: string
          pattern: ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$
          description: The email of the user. Must be a valid email address.
        resetPassword:
          type: boolean
          nullable: true
        notify:
          type: boolean
          description: When true, send an email to the user. The email includes a link to reset the password.
          nullable: true
      example:
        email: test@run.ai
        resetPassword: false
        notify: true
    UserPostResponse:
      type: object
      required:
        - id
        - username
        - tempPassword
      properties:
        id:
          type: string
        username:
          type: string
        tempPassword:
          type: string
      example:
        id: 0eeaf222-e503-4f35-9d9c-c419816272e3
        username: test@run.ai
        tempPassword: asdasidjn9d
    UserChangePasswordRequest:
      type: object
      required:
        - currentPassword
        - newPassword
      properties:
        currentPassword:
          type: string
        newPassword:
          type: string
      example:
        currentPassword: Abcd!234
        newPassword: Zxcv!567
    Groups:
      type: array
      items:
        example: group-A
        type: string
    Application:
      type: object
      required:
        - name
        - createdBy
        - createdAt
        - updatedAt
        - enabled
        - lastLogin
        - id
        - clientId
      properties:
        name:
          type: string
        createdBy:
          type: string
        createdAt:
          type: string
          format: date-time
          nullable: true
        updatedAt:
          type: string
          format: date-time
          nullable: true
        enabled:
          type: boolean
        tenantId:
          type: string
        lastLogin:
          type: string
          format: date-time
          nullable: true
        id:
          type: string
        clientId:
          type: string
      example:
        name: app123
        createdBy: test@run.ai
        createdAt: "2020-01-01T00:00:00Z"
        updatedAt: "2020-01-01T00:00:00Z"
        enabled: true
        tenantId: 1234567890
        lastLogin: "2020-01-01T00:00:00Z"
        id: 3434c-12323ab-4ce2ea6-b44fc-db344d
        clientId: app123
    Applications:
      type: array
      items:
        $ref: '#/components/schemas/Application'
    ApplicationCreationRequest:
      type: object
      required:
        - name
      properties:
        name:
          type: string
          pattern: ^[a-z][-_a-z0-9]*[a-z0-9]$
          description: The name of the application. The name must be unique within the organization and can only contain lowercase alphanumeric characters and hyphens. It must start and end with a letter.
      example:
        name: app-123
    ApplicationPostResponse:
      type: object
      required:
        - id
        - name
        - secret
      properties:
        id:
          type: string
        name:
          type: string
        secret:
          type: string
        clientId:
          type: string
      example:
        id: 0eeaf222-e503-4f35-9d9c-c419816272e3
        name: app123
        secret: asdasidjn9d
        clientId: app123
    ApplicationPatchRequest:
      type: object
      required:
        - enabled
      properties:
        enabled:
          type: boolean
      example:
        enabled: true
    UserApp:
      type: object
      required:
        - name
        - id
        - clientId
        - createdAt
        - lastLogin
      properties:
        name:
          type: string
        clientId:
          type: string
        id:
          type: string
        createdAt:
          type: string
          format: date-time
          nullable: true
        lastLogin:
          type: string
          format: date-time
          nullable: true
      example:
        name: my-user-app
        id: 3434c-12323ab-4ce2ea6-b44fc-db344d
        clientId: 3434c-12323ab-4ce2ea6
        createdAt: "2019-01-01T00:00:00Z"
        lastLogin: "2020-01-01T00:00:00Z"
    UserApps:
      type: array
      items:
        $ref: '#/components/schemas/UserApp'
    UserAppCreationRequest:
      type: object
      required:
        - name
      properties:
        name:
          type: string
          pattern: ^[a-z][-_a-z0-9]*[a-z0-9]$
          description: The name of the user application. The name must be unique within the user's applications list and can only contain lowercase alphanumeric characters and hyphens. It must start and end with a letter.
      example:
        name: app-name
    UserAppPostResponse:
      type: object
      required:
        - id
        - name
        - secret
        - clientId
        - createdAt
      properties:
        id:
          type: string
        clientId:
          type: string
        name:
          type: string
        secret:
          type: string
        createdAt:
          format: date-time
          nullable: true
          type: string
      example:
        id: 0eeaf222-e503-4f35-9d9c-c419816272e3
        clientId: 5e7b3b7b4b7b4b7b
        name: app123
        secret: this-is-the-app-secret
        createdAt: "2020-01-01T00:00:00Z"
    UserAppAdministration:
      type: object
      required:
        - name
        - id
        - clientId
        - createdBy
        - createdAt
        - lastLogin
      properties:
        name:
          type: string
        id:
          type: string
        clientId:
          type: string
        createdBy:
          type: string
        createdAt:
          type: string
          format: date-time
          nullable: true
        lastLogin:
          type: string
          format: date-time
          nullable: true
      example:
        name: my-user-app
        id: 3434c-12323ab-4ce2ea6-b44fc-db344d
        clientId: 1434c-123233ab-4ce2ea6-b44fc-db344d
        createdBy: test@run.ai
        createdAt: "2020-01-01T00:00:00Z"
        lastLogin: "2020-01-01T00:00:00Z"
    UserAppsAdministration:
      type: array
      items:
        $ref: '#/components/schemas/UserAppAdministration'
    TokenRequestGrantTypeEnum:
      enum:
        - app_token
        - client_credentials
        - refresh_token
        - exchange_token
        - password
        - external_token_exchange
    TokenRequest:
      type: object
      properties:
        grantType:
          $ref: '#/components/schemas/TokenRequestGrantTypeEnum'
        appID:
          deprecated: true
          type: string
        appSecret:
          deprecated: true
          type: string
        code:
          type: string
        redirectUri:
          type: string
        refreshToken:
          type: string
        username:
          type: string
        password:
          type: string
        clientID:
          type: string
        clientSecret:
          type: string
        externalToken:
          type: string
    TokenResponse:
      type: object
      properties:
        accessToken:
          type: string
        idToken:
          type: string
        refreshToken:
          type: string
    AutoRedirectSsoSetting:
      type: object
      properties:
        enabled:
          type: boolean
          nullable: true
        idpAlias:
          type: string
          pattern: ^[a-z0-9_-]*$
          nullable: true
      example:
        enabled: false
        idpAlias: oidc
    BrowserSessionTimeoutSetting:
      type: object
      description: Settings for user session timeout configuration that manages automatic logout after periods of inactivity.
      properties:
        idleTimeout:
          type: number
          description: Duration in minutes that a user can remain inactive before their browser session automatically expires and requires re-authentication
          default: 60
          minimum: 1
          nullable: true
    LogoutRedirectUriSetting:
      type: object
      description: Settings for configuring the logout redirect URI that determines where users are redirected after logging out.
      properties:
        uri:
          type: string
          description: The URI where users will be redirected after logging out of the application
          nullable: true
          pattern: /^(https?://)?([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(:[0-9]{1,5})?(/[^\s]*)?$|^$/
          example: https://example.com/logout
    SettingsGetResponse:
      type: object
      properties:
        autoRedirectSSO:
          $ref: '#/components/schemas/AutoRedirectSsoSetting'
        browserSessionTimeout:
          $ref: '#/components/schemas/BrowserSessionTimeoutSetting'
        logoutRedirectUri:
          $ref: '#/components/schemas/LogoutRedirectUriSetting'
    settingsKeyEnum:
      type: string
      enum:
        - autoRedirectSSO
        - browserSessionTimeout
        - logoutRedirectUri
    Settings:
      type: object
      additionalProperties: true
    AppTokenRequest:
      type: object
      required:
        - id
        - name
        - secret
      properties:
        id:
          type: string
        name:
          type: string
        secret:
          type: string
    AppTokenResponse:
      type: object
      required:
        - access_token
        - id_token
      properties:
        access_token:
          type: string
        id_token:
          type: string
    IdpResourcdes:
      $ref: '#/components/schemas/IdpResources'
    UserGroups:
      $ref: '#/components/schemas/Groups'
    AuditLog:
      type: object
      required:
        - tenant_id
        - subject
        - subject_type
        - action
        - result
      properties:
        id:
          type: string
          format: uuid
          example: 0000-000000-00000-00000
        timestamp:
          type: string
          format: date-time
          example: "2022-01-01T03:49:52.531Z"
        tenant_id:
          type: string
          description: the ID of the tenant
          example: 12345
        subject:
          type: string
          description: the user/app which triggered this API
          example: researcher@run.ai
        subject_type:
          type: string
          enum:
            - User
            - App
          default: User
        source_ip:
          type: string
          format: ipv4
        action:
          type: string
          enum:
            - create
            - update
            - delete
            - sign-in
            - sign-out
            - reset-password
        http_method:
          type: string
          enum:
            - GET
            - POST
            - PUT
            - PATCH
            - DELETE
            - CREATE
        url:
          type: string
          format: uri
        entity_type:
          type: string
          example: project
        entity_name:
          type: string
          example: project-1
        entity_id:
          type: string
          example: "1234"
        result:
          type: string
          enum:
            - Succeeded
            - Failed
        http_status_code:
          type: integer
          example: 200
        cluster_name:
          type: string
          example: my favorite cluster
        cluster_id:
          type: string
          format: uuid
        request_id:
          type: string
          format: uuid
          example: bb0c4742-e52f-4d5e-bfee-2c4ff57c339c
        metadata:
          type: object
          maxProperties: 10
          additionalProperties:
            type: string
    AuditLogs:
      type: array
      items:
        $ref: '#/components/schemas/AuditLog'
      x-schema-name: AuditLog
  responses:
    400BadRequest:
      description: Bad request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 400
            message: Required parameter is missing
    401Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 401
            message: Issuer is not familiar.
    403Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 403
            message: You do not have sufficient permissions.
    500InternalServerError:
      description: unexpected error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 500
            message: Something went wrong.
    503ServiceUnavailable:
      description: unexpected error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 503
            message: Please try again in few minutes.
    404NotFound:
      description: The specified resource was not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 404
            message: Resource id not found.
    409Conflict:
      description: The specified resource already exists
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 409
            message: Resource with this name already exists
  parameters:
    deleted:
      name: deleted
      in: query
      description: Include soft-deleted tenants in the response when `true`.
      schema:
        type: boolean
        default: false
    tenantId:
      name: tenantId
      in: path
      required: true
      description: The id of the tenant to retrieve
      schema:
        type: integer
        format: int32
        minimum: 0
    isHardDelete:
      name: isHardDelete
      in: query
      description: Boolean indicator for soft/hard delete
      schema:
        type: boolean
    queryTenantId:
      name: tenantId
      in: query
      required: false
      description: If exists will return the relevant resource for the tenant ID
      example: "1008"
      schema:
        type: string
        default: ""
    idp:
      name: idp
      in: path
      required: true
      description: The alias of the idp
      schema:
        type: string
    usersFilterBy:
      name: filterBy
      in: query
      required: false
      description: Filter results by a parameter. Use the format field-name operator value. Operators are <= Less than or equal, >= Greater than or equal, =@ contains. Dates are in ISO 8601 timestamp format and available for operators <=, >= and ==.
      schema:
        type: array
        items:
          type: string
          pattern: ^(username|createdBy|lastLogin|creationTime|lastUpdated|isLocal)(==|<=|>=|=@).+$
        example:
          - username=@test,lastLogin>=2024-09-24T00:00:00.00Z,isLocal==false
      explode: false
    usersSortBy:
      name: sortBy
      in: query
      required: false
      description: Sort results by a parameters.
      schema:
        $ref: '#/components/schemas/UsersFilterSortFields'
    SortOrder:
      name: sortOrder
      in: query
      required: false
      description: Sort results in descending or ascending order.
      schema:
        type: string
        enum:
          - asc
          - desc
        default: asc
    Offset:
      name: offset
      in: query
      required: false
      description: The offset of the first item returned in the collection.
      schema:
        type: integer
        format: int32
        example: 100
    limit:
      name: limit
      in: query
      required: false
      description: The maximum number of entries to return.
      schema:
        type: integer
        format: int32
        default: 500
        minimum: 1
        maximum: 500
    search:
      name: search
      in: query
      required: false
      description: Filter results by a free text search.
      schema:
        type: string
        example: test@run
    userId:
      name: userId
      in: path
      required: true
      description: The id of the user
      schema:
        type: string
    appId:
      name: appId
      in: path
      required: true
      description: The application id to retrieve
      schema:
        type: string
    settingsKey:
      name: key
      in: path
      required: true
      description: The settings key
      schema:
        $ref: '#/components/schemas/settingsKeyEnum'
    exchangeCode:
      name: code
      in: query
      required: true
      description: The exchange code retrieved from the idp server
      schema:
        type: string
    redirectUri:
      name: redirect_uri
      in: query
      required: true
      description: The redirect uri to redirect to after the authorization server completes the authorization flow
      schema:
        type: string
    refreshToken:
      name: refresh_token
      in: query
      required: true
      description: The refresh token retrieved from the idp server
      schema:
        type: string
    appType:
      name: appType
      in: query
      required: true
      description: The type of application
      schema:
        type: string
        enum:
          - Agent
          - MimirWriter
    code:
      $ref: '#/components/parameters/exchangeCode'
    redirect_url:
      $ref: '#/components/parameters/redirectUri'
    refresh_token:
      $ref: '#/components/parameters/refreshToken'
    app_type:
      $ref: '#/components/parameters/appType'
    is_hard_delete:
      $ref: '#/components/parameters/isHardDelete'
    AuditLogSort:
      name: sortBy
      in: query
      required: false
      description: Sort results by a parameters.
      schema:
        type: string
        enum:
          - timestamp
          - subject
          - subject_type
          - source_ip
          - action
          - http_method
          - result
          - url
          - entity_type
          - entity_name
          - entity_id
    AuditLogFilter:
      name: filterBy
      in: query
      required: false
      explode: false
      description: Filter results by a parameter. Use the format field-name operator value. Operators are == Equals, != Not equals, <= Less than or equal, >= Greater than or equal, =@ contains, !@ Does not contains, =^ Starts with and =$ Ends with. Dates are in ISO 8601 timestamp format and available for operators ==, !=, <= and >=.
      schema:
        type: array
        items:
          type: string
          pattern: ^(timestamp|subject|subject_type|source_ip|action|result|url|entity_type|entity_name|cluster_name)(==|!=|<=|>=|=@|!@|=\^|=\$).+$
        example:
          - cluster_name==my-cluster_name
          - entity_type==cluster,entity_name==test
    StartRequired:
      name: start
      in: query
      description: Start date of time range to fetch data in ISO 8601 timestamp format.
      required: true
      schema:
        type: string
        format: date-time
        example: "2023-06-06T12:09:18.211Z"
    EndRequired:
      name: end
      in: query
      description: End date of time range to fetch data in ISO 8601 timestamp format.
      required: true
      schema:
        type: string
        format: date-time
        example: "2023-06-07T12:09:18.211Z"
    NumberOfSamples:
      name: numberOfSamples
      in: query
      description: The number of samples to take in the specified time range.
      required: false
      schema:
        type: integer
        example: 20
        maximum: 1000
        minimum: 0
        default: 20
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer authentication
x-tagGroups:
  - name: Organizations
    tags:
      - Tenant
  - name: Authentication and Authorization
    tags:
      - Applications
      - Tokens
      - Users
      - User Applications
      - Idps
      - Settings
  - name: Audit
    tags:
      - AuditLogs
