openapi: 3.0.3
info:
  version: "2.26"
  description: ""
  title: NVIDIA Run:ai
  x-logo:
    url: ./runai-logo-api.png
    altText: NVIDIA Run:ai
    href: https://run.ai
  license:
    name: NVIDIA Run:ai
    url: https://www.nvidia.com/en-us/agreements/enterprise-software/nvidia-software-license-agreement/
servers:
  - url: https://app.run.ai
security:
  - bearerAuth: []
tags:
  - name: Organizations
  - name: Authentication and Authorization
  - name: Audit
  - name: Settings
    x-parent: Organizations
    description: |
      View and manage configuration settings for your organization.
  - name: Clusters
    x-parent: Organizations
    description: Use these endpoints to create, manage and delete NVIDIA Run:ai Kubernetes clusters.
  - name: Access Keys
    x-parent: Authentication and Authorization
    description: |
      Access Keys allow users to authenticate and interact programmatically with the NVIDIA Run:ai API.
      Each access key consists of a client ID and secret that can be used to obtain authentication tokens.
      Access keys can be managed by individual users for their own use, or by administrators for organization-wide access.
      For more information, see [Access control](https://run-ai-docs.nvidia.com/self-hosted/2.26/infrastructure-setup/authentication/overview/#role-based-access-control).
  - name: Access rules
    x-parent: Authentication and Authorization
    description: "Access rules provide user authorization to system resources and entities.\nIt is managed using Role-based access control (RBAC) which is a policy-neutral \naccess control mechanism defined around roles and privileges. \nThe components of RBAC make it simple to manage access to system resources and entities.\nFor more information, see [Access control](https://run-ai-docs.nvidia.com/self-hosted/2.26/infrastructure-setup/authentication/overview/#role-based-access-control).\n"
  - name: Permissions
    x-parent: Authentication and Authorization
    description: "Permissions define the actions that users can perform on specific resources within the NVIDIA Run:ai platform. \nEach permission consists of a resource type and an allowed action. \nThe Permission Sets API provides a catalog of all available permission sets in the NVIDIA Run:ai platform. \nEach permission set is a predefined collection of permissions that represent the permissions required for a role to perform specific operations. \nPermission sets serve as the building blocks for roles and are used in both NVIDIA Run:ai predefined roles and custom roles defined through the [Roles API](/2.26/#tag/Roles).\n"
  - name: Applications
    x-parent: Authentication and Authorization
    description: |
      **DEPRECATED:** Applications have been renamed to Service Accounts. Please use the [Service Accounts](/2.26/#tag/Service-Accounts) endpoints instead.

      Create and manage applications in the tenant.
  - name: Service Accounts
    x-parent: Authentication and Authorization
    description: "Service accounts enable programmatic access to the NVIDIA Run:ai API, allowing applications or automated systems to authenticate and interact securely. \nEach service account is associated with an access key which includes a client ID and secret used to generate access token. \nService accounts can be managed organization-wide or with a defined scope.\n"
  - name: Roles
    x-parent: Authentication and Authorization
    description: "The Roles API allows administrators to define and manage roles within the NVIDIA Run:ai platform. \nA role represents a collection of permission sets that determine what actions can be performed across NVIDIA Run:ai resources.\nNVIDIA Run:ai provides a list of predefined roles that cover common operational needs, such as managing workloads, projects, or data and storage. \nAdministrators can also use this API to create custom roles by combining specific permission sets to match their organization's access model.\n"
  - name: Tokens
    x-parent: Authentication and Authorization
    description: "Use tokens to facilitate authentication to the NVIDIA Run:ai API. \nThe API server must be configured to use the NVIDIA Run:ai identity \nservice to validate authentication tokens.\n"
  - name: Users
    x-parent: Authentication and Authorization
  - name: User Applications
    x-parent: Authentication and Authorization
    description: |
      **DEPRECATED:** User Applications have been renamed to Access Keys. Please use the [Access Keys](/2.26/#tag/Access-Keys) endpoints instead.

      User Applications allow users to authenticate and interact programmatically with the NVIDIA Run:ai API.
  - name: Idps
    x-parent: Authentication and Authorization
  - name: Me
    x-parent: Authentication and Authorization
    description: "\"Me\" returns the authenticated user's permissions within the system. \nIt provides a comprehensive view of access rules (roles, subjects and scope) assigned to the current user.\nFor more information see [Access control](https://run-ai-docs.nvidia.com/self-hosted/2.26/infrastructure-setup/authentication/overview/#role-based-access-control).\n"
  - name: AuditLogs
    x-parent: Audit
    description: The audit log provides audit trail information for user activity, changes to business objects and other important information. For more information, see [Audit log](https://run-ai-docs.nvidia.com/self-hosted/2.26/infrastructure-setup/procedures/event-history).
  - name: Workloads
  - name: Workload assets
  - name: Policies
  - name: Notifications

paths:
  /api/v1/tenants:
    get:
      summary: Get a list of tenants.
      description: Retrieve a list of tenants and their details.
      operationId: get_tenants
      tags:
        - Tenant
      parameters:
        - $ref: '#/components/parameters/deleted'
        - $ref: '#/components/parameters/filterByName'
        - $ref: '#/components/parameters/filterByAlias'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Tenants'
                x-schema-name: Tenants
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      summary: Create tenant
      operationId: create_tenant
      tags:
        - Tenant
      requestBody:
        description: The tenant to create.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TenantCreationRequest'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantCreationResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '409':
          $ref: '#/components/responses/409Conflict'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/tenants/{tenantId}:
    get:
      summary: Get tenant
      operationId: get_tenant_by_id
      tags:
        - Tenant
      parameters:
        - $ref: '#/components/parameters/tenantId'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Tenant'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    patch:
      summary: Update tenant
      description: Update tenant properties such as alias.
      operationId: update_tenant_by_id
      tags:
        - Tenant
      parameters:
        - $ref: '#/components/parameters/tenantId'
      requestBody:
        description: The tenant properties to update.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TenantUpdateRequest'
      responses:
        '200':
          description: Tenant updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Tenant'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '409':
          $ref: '#/components/responses/409Conflict'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: soft/hard delete tenant
      operationId: delete_tenant_by_id
      tags:
        - Tenant
      parameters:
        - $ref: '#/components/parameters/tenantId'
        - $ref: '#/components/parameters/isHardDelete'
      responses:
        '200':
          description: tenant uid that was deleted.
          content:
            application/json:
              schema:
                type: object
                required:
                  - uid
                properties:
                  uid:
                    type: string
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/clusters:
    get:
      summary: Get a list of clusters.
      description: Retrieve a list of clusters with details.
      operationId: get_clusters
      tags:
        - Clusters
      parameters:
        - $ref: '#/components/parameters/QueryVerbosity'
        - $ref: '#/components/parameters/QueryIncludeRequestedForDelete'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/DisplayedCluster'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      summary: Create a cluster.
      description: Use to create a Kubernetes cluster.
      operationId: create_cluster
      tags:
        - Clusters
      requestBody:
        description: The cluster to create.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ClusterCreationRequest'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DisplayedCluster'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/clusters/{clusterUuid}:
    get:
      summary: Get cluster by id.
      description: Retrieve cluster details by Universally Unique Identifier (UUID).
      operationId: get_cluster_by_uuid
      tags:
        - Clusters
      parameters:
        - $ref: '#/components/parameters/ClusterUuid'
        - $ref: '#/components/parameters/QueryVerbosity'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DisplayedCluster'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: Delete a cluster by id.
      description: "Use to delete a cluster by Universally Unique Identifier (UUID). \nWill return 202 for success if this api was called on a cluster that its version is >=2.20, \nand force query param is false or not provided.\nWill return 204 for success if force query param is true, or if cluster is in a version < 2.20\n"
      operationId: delete_cluster
      tags:
        - Clusters
      parameters:
        - $ref: '#/components/parameters/ClusterUuid'
        - $ref: '#/components/parameters/QueryForceDelete'
      responses:
        '202':
          $ref: '#/components/responses/202Accepted'
        '204':
          $ref: '#/components/responses/204NoContent'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    put:
      summary: Update a cluster by id.
      description: Use to update the details of a Kubernetes cluster by Universally Unique Identifier (UUID).
      operationId: updateCluster
      tags:
        - Clusters
      parameters:
        - $ref: '#/components/parameters/ClusterUuid'
      requestBody:
        description: The cluster details to update
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ClusterUpdateRequest'
      responses:
        '204':
          $ref: '#/components/responses/204NoContent'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/clusters/{clusterUuid}/cluster-install-info:
    get:
      summary: Retrieve the installation instructions of a cluster by ID.
      description: "Use to retrieve installation instruction for a cluster by Universally Unique Identifier (UUID). \nSupports clusters version 2.15 or above.\n"
      operationId: get_cluster_install_info_by_uuid
      tags:
        - Clusters
      parameters:
        - $ref: '#/components/parameters/ClusterUuid'
        - $ref: '#/components/parameters/ClusterVersion'
        - $ref: '#/components/parameters/ClusterRemoteURL'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClusterInstallationInfoResponse'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/idps:
    get:
      summary: Get external idps list
      operationId: get_idps
      parameters:
        - $ref: '#/components/parameters/TenantId'
      tags:
        - Idps
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Idps'
              examples:
                saml:
                  value:
                    - alias: saml
                      type: saml
                      redirectUri: https://domain/auth/realms/name/broker/saml/endpoint
                      samlData:
                        signingCertificate: signingCertificateExample
                        singleSignOnServiceUrl: https://authhost/protocol/saml
                        entityId: example.run.ai/runai
                        serviceProviderMetadataUrl: https://example.runai.com/auth/realms/runai/broker/saml/endpoint/descriptor
                      mappers:
                        gid: GID
                        groups: GROUPS
                        supplementaryGroups: SUPPLEMENTARYGROUPS
                        uid: UID
                        email: email
                oidc:
                  value:
                    - alias: oidc
                      type: oidc
                      redirectUri: https://domain/auth/realms/name/broker/oidc/endpoint
                      oidcData:
                        clientId: my-client-id
                        clientSecret: '*******'
                        scopes:
                          - scope1
                          - scope2
                        mandatoryClaim:
                          claim: my-claim
                          values:
                            - val1
                            - val2
                      mappers:
                        gid: GID
                        groups: GROUPS
                        supplementaryGroups: SUPPLEMENTARYGROUPS
                        uid: UID
                        email: email
                openshift-v4:
                  value:
                    - alias: openshift-v4
                      type: openshift-v4
                      redirectUri: https://domain/auth/realms/name/broker/openshift-v4/endpoint
                      ocpData:
                        clientId: my-client-id
                        clientSecret: '*******'
                        idpBaseUrl: https://authhost/ocp
                        scopes:
                          - scope1
                          - scope2
                      mappers:
                        gid: metadata.gid
                        groups: groups
                        supplementaryGroups: supplementarygroups
                        uid: metadata.uid
                        email: metadata.name
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      summary: Configure external idp
      operationId: create_idp
      parameters:
        - $ref: '#/components/parameters/TenantId'
      tags:
        - Idps
      requestBody:
        description: Idp configuration
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IdpCreationRequest'
            examples:
              saml (by url):
                value:
                  type: saml
                  samlData:
                    metadataXmlType: url
                    metadataXmlUrl: https://authhost/saml/metadata.xml
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              saml (by file):
                value:
                  type: saml
                  samlData:
                    metadataXmlType: file
                    fileName: descriptor.xml
                    metadataXmlFile: <file content in base64>
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              oidc:
                value:
                  type: oidc
                  oidcData:
                    clientId: my-client-id
                    clientSecret: my-client-secret
                    discoverDocumentUrl: https://authhost/openid-configuration
                    mandatoryClaim:
                      claim: my-claim
                      values:
                        - val1
                        - val2
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              openshift-v4:
                value:
                  type: openshift-v4
                  ocpData:
                    clientId: my-client-id
                    clientSecret: my-client-secret
                    idpBaseUrl: https://authhost/ocp
                  mappers:
                    gid: metadata.gid
                    groups: groups
                    supplementaryGroups: supplementarygroups
                    uid: metadata.uid
                    email: metadata.name
      responses:
        '201':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdpPostResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '409':
          $ref: '#/components/responses/409Conflict'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/idps/{idp}:
    get:
      summary: Get external idp by alias
      operationId: get_idp
      tags:
        - Idps
      parameters:
        - $ref: '#/components/parameters/idp'
        - $ref: '#/components/parameters/TenantId'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              examples:
                saml:
                  value:
                    alias: saml
                    type: saml
                    redirectUri: https://domain/auth/realms/name/broker/saml/endpoint
                    samlData:
                      signingCertificate: signingCertificateExample
                      singleSignOnServiceUrl: https://authhost/protocol/saml
                      entityId: example.run.ai/runai
                      serviceProviderMetadataUrl: https://example.runai.com/auth/realms/runai/broker/saml/endpoint/descriptor
                    mappers:
                      gid: GID
                      groups: GROUPS
                      supplementaryGroups: SUPPLEMENTARYGROUPS
                      uid: UID
                      email: email
                oidc:
                  value:
                    alias: oidc
                    type: oidc
                    redirectUri: https://domain/auth/realms/name/broker/oidc/endpoint
                    oidcData:
                      clientId: my-client-id
                      clientSecret: '*******'
                      scopes:
                        - scope1
                        - scope2
                      mandatoryClaim:
                        claim: my-claim
                        values:
                          - val1
                          - val2
                    mappers:
                      gid: GID
                      groups: GROUPS
                      supplementaryGroups: SUPPLEMENTARYGROUPS
                      uid: UID
                      email: email
                openshift-v4:
                  value:
                    alias: openshift-v4
                    type: openshift-v4
                    redirectUri: https://domain/auth/realms/name/broker/openshift-v4/endpoint
                    ocpData:
                      clientId: my-client-id
                      clientSecret: '*******'
                      idpBaseUrl: https://authhost/ocp
                      scopes:
                        - scope1
                        - scope2
                    mappers:
                      gid: metadata.gid
                      groups: groups
                      supplementaryGroups: supplementarygroups
                      uid: metadata.uid
                      email: metadata.name
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: Delete external idp by alias
      operationId: delete_idp
      tags:
        - Idps
      parameters:
        - $ref: '#/components/parameters/idp'
        - $ref: '#/components/parameters/TenantId'
      responses:
        '200':
          description: Idp successfully deleted
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    put:
      summary: Update external idp by alias
      operationId: update_idp
      tags:
        - Idps
      parameters:
        - $ref: '#/components/parameters/idp'
        - $ref: '#/components/parameters/TenantId'
      requestBody:
        description: Updated idp object
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IdpCreationRequest'
            examples:
              saml (by url):
                value:
                  type: saml
                  samlData:
                    metadataXmlType: url
                    metadataXmlUrl: https://authhost/saml/metadata.xml
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              saml (by file):
                value:
                  type: saml
                  samlData:
                    metadataXmlType: file
                    fileName: descriptor.xml
                    metadataXmlFile: <file content in base64>
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              oidc:
                value:
                  type: oidc
                  oidcData:
                    clientId: my-client-id
                    clientSecret: my-client-secret
                    discoverDocumentUrl: https://authhost/openid-configuration
                    mandatoryClaim:
                      claim: my-claim
                      values:
                        - val1
                        - val2
                  mappers:
                    gid: GID
                    groups: GROUPS
                    supplementaryGroups: SUPPLEMENTARYGROUPS
                    uid: UID
                    email: email
              openshift-v4:
                value:
                  type: openshift-v4
                  ocpData:
                    clientId: my-client-id
                    clientSecret: my-client-secret
                    idpBaseUrl: https://authhost/ocp
                  mappers:
                    gid: metadata.gid
                    groups: groups
                    supplementaryGroups: supplementarygroups
                    uid: metadata.uid
                    email: metadata.name
      responses:
        '200':
          description: Idp successfully updated
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/idps/{idp}/mappers:
    get:
      summary: Get idp mappers
      operationId: get_idp_mappers
      tags:
        - Idps
      parameters:
        - $ref: '#/components/parameters/idp'
        - $ref: '#/components/parameters/TenantId'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Mappers'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    put:
      summary: Update idp mappers
      operationId: update_idp_mappers
      tags:
        - Idps
      parameters:
        - $ref: '#/components/parameters/idp'
        - $ref: '#/components/parameters/TenantId'
      requestBody:
        description: Map of our mappers and their source in the external idp
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Mappers'
      responses:
        '202':
          description: Request accepted successfully.
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/users:
    get:
      summary: Get users.
      description: Retrieve a list of platform users.
      operationId: get_users
      tags:
        - Users
      parameters:
        - $ref: '#/components/parameters/usersFilterBy'
        - $ref: '#/components/parameters/usersSortBy'
        - $ref: '#/components/parameters/SortOrder'
        - $ref: '#/components/parameters/Offset'
        - $ref: '#/components/parameters/limit'
        - $ref: '#/components/parameters/search'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Users'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      summary: Create a local user.
      description: Use to create a local platform user.
      operationId: create_user
      tags:
        - Users
      requestBody:
        description: User object to create
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserCreationRequest'
      responses:
        '201':
          description: Created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserPostResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '409':
          $ref: '#/components/responses/409Conflict'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/users-minimal:
    get:
      summary: Get minimal user display information.
      description: |
        Retrieve a list of users with minimal display information (id, username, firstName, lastName).
        At least one of `search`, `id`, or `filterBy` is required to scope the lookup. Requires the users-minimal:read permission.
      operationId: get_users_minimal
      tags:
        - Users
      parameters:
        - $ref: '#/components/parameters/usersMinimalFilterBy'
        - $ref: '#/components/parameters/usersMinimalSearch'
        - $ref: '#/components/parameters/usersMinimalId'
        - $ref: '#/components/parameters/limit'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UsersMinimal'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/users/count:
    get:
      summary: Count users
      operationId: count_users
      description: count users
      tags:
        - Users
      parameters:
        - $ref: '#/components/parameters/usersFilterBy'
        - $ref: '#/components/parameters/search'
      responses:
        '200':
          description: ok
          content:
            application/json:
              schema:
                type: object
                required:
                  - count
                properties:
                  count:
                    type: integer
                    format: int64
                    example: 1
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/users/{userId}/logout:
    post:
      summary: Logout a user.
      description: Use to force a user to logout.
      operationId: logout_user
      tags:
        - Users
      parameters:
        - $ref: '#/components/parameters/userId'
      responses:
        '200':
          description: Executed successfully.
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/users/{userId}/password:
    post:
      summary: Reset a user's password.
      description: Use to reset a user's password.
      operationId: reset_user_password
      tags:
        - Users
      parameters:
        - $ref: '#/components/parameters/userId'
      responses:
        '200':
          description: Regenerated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  tempPassword:
                    type: string
                example:
                  tempPassword: asdasidjn9d
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/users/{userId}:
    get:
      summary: Get a user by id.
      description: Retrieve a user's details by id.
      operationId: get_user_by_id
      tags:
        - Users
      parameters:
        - $ref: '#/components/parameters/userId'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    patch:
      summary: Update a user by id.
      description: Use to update a local user's details by id. SSO users cannot be updated.
      operationId: patch_user_by_id
      tags:
        - Users
      parameters:
        - $ref: '#/components/parameters/userId'
      requestBody:
        description: User patch object with fields to update.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserPatchRequest'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: Delete a user by id.
      description: Use to delete a user by id.
      operationId: delete_user_by_id
      tags:
        - Users
      parameters:
        - $ref: '#/components/parameters/userId'
      responses:
        '204':
          description: Executed successfully.
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/me/password:
    post:
      summary: change user password
      operationId: change_user_password
      tags:
        - Users
      requestBody:
        description: Password to change
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserChangePasswordRequest'
      responses:
        '200':
          description: Password changed successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  currentPassword:
                    type: string
                  newPassword:
                    type: string
                example:
                  tempPassword: Abcd!234
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/apps:
    get:
      deprecated: true
      summary: Get a list of applications.
      description: Retrieve a list of applications.
      operationId: get_applications
      tags:
        - Applications
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Applications'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      deprecated: true
      summary: Create an application.
      description: Used to create an application.
      operationId: create_application
      tags:
        - Applications
      requestBody:
        description: Application object to create
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationCreationRequest'
      responses:
        '201':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationPostResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '409':
          $ref: '#/components/responses/409Conflict'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/apps/{appId}:
    get:
      deprecated: true
      summary: Get application by id.
      description: Retrieve the details of an application by id.
      operationId: get_application_by_id
      tags:
        - Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Application'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    patch:
      deprecated: true
      summary: Update application details by id.
      description: Use to update the details of an application by id.
      operationId: update_application_by_id
      tags:
        - Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      requestBody:
        description: Application object that needs to be updated.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationPatchRequest'
      responses:
        '200':
          description: Executed successfully.
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      deprecated: true
      summary: Delete an application by id.
      description: Use to delete an application by id.
      operationId: delete_application_by_id
      tags:
        - Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      responses:
        '204':
          description: Executed successfully.
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/apps/{appId}/secret:
    post:
      deprecated: true
      summary: Regenerate an application secret.
      description: Use to regenerate the application secret by id.
      operationId: regenerate_application_secret
      tags:
        - Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      responses:
        '200':
          description: Regenerated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  secret:
                    type: string
                example:
                  secret: 189ej2ijd92fj092k049fk0
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/service-accounts:
    get:
      summary: Get a list of service accounts.
      description: Retrieve a list of service accounts.
      operationId: get_service_accounts
      tags:
        - Service Accounts
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccounts'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      summary: Create a service account.
      description: Used to create a service account.
      operationId: create_service_account
      tags:
        - Service Accounts
      requestBody:
        description: Service account object to create
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceAccountCreationRequest'
      responses:
        '201':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccountPostResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '409':
          $ref: '#/components/responses/409Conflict'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/service-accounts/{serviceAccountId}:
    get:
      summary: Get service account by id.
      description: Retrieve the details of a service account by id.
      operationId: get_service_account_by_id
      tags:
        - Service Accounts
      parameters:
        - $ref: '#/components/parameters/serviceAccountId'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccount'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    patch:
      summary: Update service account details by id.
      description: Use to update the details of a service account by id.
      operationId: update_service_account_by_id
      tags:
        - Service Accounts
      parameters:
        - $ref: '#/components/parameters/serviceAccountId'
      requestBody:
        description: Service account object that needs to be updated.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceAccountPatchRequest'
      responses:
        '200':
          description: Executed successfully.
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: Delete a service account by id.
      description: Use to delete a service account by id.
      operationId: delete_service_account_by_id
      tags:
        - Service Accounts
      parameters:
        - $ref: '#/components/parameters/serviceAccountId'
      responses:
        '204':
          description: Executed successfully.
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/service-accounts/{serviceAccountId}/secret:
    post:
      summary: Regenerate a service account secret.
      description: Use to regenerate the service account secret by id.
      operationId: regenerate_service_account_secret
      tags:
        - Service Accounts
      parameters:
        - $ref: '#/components/parameters/serviceAccountId'
      responses:
        '200':
          description: Regenerated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RegenerateServiceAccountSecretResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/access-keys:
    get:
      summary: Get a list of access keys.
      description: Retrieve a list of the user's access keys.
      operationId: get_access_keys
      tags:
        - Access Keys
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessKeys'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      summary: Create an access key.
      description: Used to create an access key.
      operationId: create_access_key
      tags:
        - Access Keys
      requestBody:
        description: Access key object to create
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessKeyCreationRequest'
      responses:
        '201':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessKeyPostResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '409':
          $ref: '#/components/responses/409Conflict'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/access-keys/{accessKeyId}:
    get:
      summary: Get access key by id.
      description: Retrieve the details of an access key by id.
      operationId: get_access_key_by_id
      tags:
        - Access Keys
      parameters:
        - $ref: '#/components/parameters/accessKeyId'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessKey'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: Delete an access key by id.
      description: Use to delete an access key by id.
      operationId: delete_access_key_by_id
      tags:
        - Access Keys
      parameters:
        - $ref: '#/components/parameters/accessKeyId'
      responses:
        '204':
          description: Executed successfully.
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/access-keys/{accessKeyId}/secret:
    post:
      summary: Regenerate an access key secret.
      description: Use to regenerate the access key secret by id.
      operationId: regenerate_access_key_secret
      tags:
        - Access Keys
      parameters:
        - $ref: '#/components/parameters/accessKeyId'
      responses:
        '200':
          description: Regenerated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  clientSecret:
                    type: string
                    description: Secret credential paired with the client ID. Used to obtain authentication tokens.
                example:
                  clientSecret: this-is-my-secret
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/administration/access-keys:
    get:
      summary: Get a list of all access keys.
      description: Retrieve a list of all access keys.
      operationId: get_access_keys_administration
      tags:
        - Access Keys
      parameters:
        - description: Filter results by clientId
          in: query
          name: clientId
          required: false
          schema:
            type: string
          example: 3434c-12323ab-4ce2ea6-b44fc-db344d
        - description: Filter results by creatdBy
          in: query
          name: createdBy
          required: false
          schema:
            type: string
          example: test@run.ai
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessKeysAdministration'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/administration/access-keys/{accessKeyId}:
    delete:
      summary: Delete an access key by id for administrations.
      description: Use to delete an access key by id for administrations.
      operationId: delete_access_key_by_id_administration
      tags:
        - Access Keys
      parameters:
        - $ref: '#/components/parameters/accessKeyId'
      responses:
        '204':
          description: Executed successfully.
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/user-applications:
    get:
      deprecated: true
      summary: Get a list of users applications.
      description: Retrieve a list of the users applications.
      operationId: get_user_applications
      tags:
        - User Applications
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserApps'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      deprecated: true
      summary: Create a user application.
      description: Used to create a user application.
      operationId: create_user_application
      tags:
        - User Applications
      requestBody:
        description: Application object to create
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserAppCreationRequest'
      responses:
        '201':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAppPostResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '409':
          $ref: '#/components/responses/409Conflict'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/user-applications/{appId}:
    get:
      deprecated: true
      summary: Get user application by id.
      description: Retrieve the details of a user's application by app id.
      operationId: get_user_application_by_id
      tags:
        - User Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserApp'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      deprecated: true
      summary: Delete a user application byid.
      description: Use to user a user application by id.
      operationId: delete_user_application_by_id
      tags:
        - User Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      responses:
        '204':
          description: Executed successfully.
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/user-applications/{appId}/secret:
    post:
      deprecated: true
      summary: Regenerate a user application secret.
      description: Use to regenerate the user application secret by id.
      operationId: regenerate_user_application_secret
      tags:
        - User Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      responses:
        '200':
          description: Regenerated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  clientSecret:
                    type: string
                    description: Secret credential paired with the client ID. Used to obtain authentication tokens.
                example:
                  clientSecret: this-is-my-secret
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/administration/user-applications:
    get:
      deprecated: true
      summary: Get a list of all users applications.
      description: Retrieve a list of all users applications.
      operationId: get_user_applications_administration
      tags:
        - User Applications
      parameters:
        - description: Filter results by clientId
          in: query
          name: clientId
          required: false
          schema:
            type: string
          example: 3434c-12323ab-4ce2ea6-b44fc-db344d
        - description: Filter results by creatdBy
          in: query
          name: createdBy
          required: false
          schema:
            type: string
          example: test@run.ai
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAppsAdministration'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/administration/user-applications/{appId}:
    delete:
      deprecated: true
      summary: Delete a user application by id for adminstrations.
      description: Use to delete a user application by id for adminstrations.
      operationId: delete_user_application_by_id_administration
      tags:
        - User Applications
      parameters:
        - $ref: '#/components/parameters/appId'
      responses:
        '204':
          description: Executed successfully.
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/token:
    post:
      tags:
        - Tokens
      summary: Create an access token v1
      deprecated: true
      description: |
        Create tokens using the `grant_type` parameter.
        This endpoint is deprecated. Use `/api/v2/token` instead.
      operationId: grant_token
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TokenRequest'
            examples:
              client_credentials:
                value:
                  grantType: client_credentials
                  clientID: clientID
                  clientSecret: clientSecret
                description: Obtain the clientID and the clientSecret using service accounts or access keys endpoints
              refresh_token:
                value:
                  grantType: refresh_token
                  refreshToken: refreshToken
                  clientID: clientID
              exchange_token:
                value:
                  grantType: exchange_token
                  code: code
                  clientID: clientID
                  redirectUri: redirectUri
              external_token_exchange:
                value:
                  grantType: external_token_exchange
                  externalToken: access token from external idp
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v2/token:
    post:
      tags:
        - Tokens
      summary: Create an access token v2
      description: |
        Use this endpoint to obtain an access token. Compliant with standard OAuth2 protocol and supports the common OAuth2 grant types.
      operationId: grant_token_v2
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - grant_type
              properties:
                grant_type:
                  type: string
                  description: |
                    The OAuth2 grant type. Determines the authentication flow and which parameters are required:

                    `client_credentials` - Authenticate as a service account or user access key using clientId and clientSecret.

                    `password` - Authenticate as a local user using username and password.

                    `external_token_exchange` - Authenticate as a service account or user using a token issued by the configured identity provider (IdP) for a Run:ai token. Requires externalToken.
                  enum:
                    - client_credentials
                    - password
                    - external_token_exchange
                client_id:
                  type: string
                  description: The client identifier for a service account or user access key. Required when using the client_credentials grant type. Must be used together with clientSecret.
                client_secret:
                  type: string
                  description: The client secret corresponding to the clientId. Required when using the client_credentials grant type. Must be used together with clientId.
                  format: password
                username:
                  type: string
                  description: The username of a local user account. Required when using the password grant type. Must be used together with password.
                password:
                  type: string
                  description: The password for the specified username. Required when using the password grant type. Must be used together with username.
                  format: password
                external_token:
                  type: string
                  description: A valid token issued by the identity provider (IdP) that is configured in NVIDIA Run:ai. Required when using the external_token_exchange grant type.
            examples:
              client_credentials:
                value:
                  grant_type: client_credentials
                  client_id: my-client-id
                  client_secret: my-client-secret
                description: Obtain the clientID and the clientSecret using service accounts or access keys endpoints
              password:
                value:
                  grant_type: password
                  username: user@example.com
                  password: password123
                  client_id: my-client-id
              external_token_exchange:
                value:
                  grant_type: external_token_exchange
                  external_token: access_token_from_external_idp
                  client_id: my-client-id
                description: Exchange an external identity provider token for a Run:ai access token
      responses:
        '200':
          description: Successfully issued token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2TokenResponse'
              example:
                access_token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
                token_type: Bearer
                expires_in: 3600
                refresh_token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
                id_token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2Error'
        '401':
          description: Client authentication failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2Error'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/security/settings:
    get:
      summary: Get security settings
      operationId: get_security_settings
      parameters:
        - $ref: '#/components/parameters/TenantId'
      tags:
        - Settings
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SettingsGetResponse'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/security/settings/{key}:
    put:
      summary: Update security setting by key
      operationId: update_security_setting_by_key
      tags:
        - Settings
      parameters:
        - $ref: '#/components/parameters/settingsKey'
        - $ref: '#/components/parameters/TenantId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              anyOf:
                - $ref: '#/components/schemas/UpdateAutoRedirectSsoSettingValue'
                - $ref: '#/components/schemas/UpdateBrowserSessionTimeoutSettingValue'
                - $ref: '#/components/schemas/UpdateLogoutRedirectUriSettingValue'
            examples:
              autoRedirectSSO:
                value:
                  enabled: false
                  idpAlias: oidc
              browserSessionTimeout:
                value:
                  idleTimeout: 60
              logoutRedirectUri:
                value:
                  uri: https://example.com/logout-success
      responses:
        '200':
          description: Setting successfully updated
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    get:
      summary: Get security setting by key
      operationId: get_security_setting_by_key
      tags:
        - Settings
      parameters:
        - $ref: '#/components/parameters/settingsKey'
        - $ref: '#/components/parameters/TenantId'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Settings'
              examples:
                autoRedirectSSO:
                  value:
                    value:
                      enabled: false
                      idpAlias: oidc
                    displayName: Auto Redirect SSO
                    description: Automatically redirect users to the SSO login page after logging in to the application
                browserSessionTimeout:
                  value:
                    value:
                      idleTimeout: 60
                    displayName: Browser Session Timeout
                    description: The idle timeout duration in minutes for browser sessions
                logoutRedirectUri:
                  value:
                    value:
                      uri: https://example.com/logout-success
                    displayName: Logout Redirect URI
                    description: The URI where users will be redirected after logging out of the application
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/audit/log:
    get:
      description: Get audit logs based on query params filter
      summary: Get audit logs
      operationId: getAuditLogs
      tags:
        - AuditLogs
      parameters:
        - $ref: '#/components/parameters/StartRequired'
        - $ref: '#/components/parameters/EndRequired'
        - $ref: '#/components/parameters/Offset'
        - $ref: '#/components/parameters/NumberOfSamples'
        - $ref: '#/components/parameters/SortOrder'
        - $ref: '#/components/parameters/AuditLogSort'
        - $ref: '#/components/parameters/AuditLogFilter'
      responses:
        '200':
          description: Executed successfully
          content:
            application/json:
              schema:
                type: object
                required:
                  - logs
                properties:
                  total:
                    type: integer
                    example: 2000
                  next:
                    type: integer
                    example: 100
                  audit_logs:
                    $ref: '#/components/schemas/AuditLogs'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/audit/log/file:
    get:
      description: Download audit logs as a file, based on query params filter
      summary: Download audit logs
      operationId: downloadAuditLogs
      tags:
        - AuditLogs
      parameters:
        - in: query
          name: file_type
          schema:
            type: string
            enum:
              - CSV
              - JSON
            default: CSV
          required: false
        - $ref: '#/components/parameters/StartRequired'
        - $ref: '#/components/parameters/EndRequired'
        - $ref: '#/components/parameters/Offset'
        - $ref: '#/components/parameters/NumberOfSamplesFileDownload'
        - $ref: '#/components/parameters/AuditLogFilter'
      responses:
        '200':
          description: File downloaded
          content:
            application/octet-stream: {}
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/roles:
    get:
      summary: Get a list of roles.
      description: Use to retrieve a list of roles. This endpoint is deprecated and will be removed in a future release. Use GET /api/v2/authorization/roles instead.
      operationId: get_roles_v1
      deprecated: true
      tags:
        - Roles
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RolesV1'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/roles/{roleIdPath}:
    get:
      summary: Get a role by id.
      description: Retrieve the details of a role by id. This endpoint is deprecated and will be removed in a future release. Use GET /api/v2/authorization/roles/{roleIdPath} instead.
      operationId: get_role_v1
      deprecated: true
      tags:
        - Roles
      parameters:
        - $ref: '#/components/parameters/RoleIdPath'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleV1'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v2/authorization/roles:
    post:
      summary: Create a role.
      description: Creates a custom role with the specified permission sets.
      operationId: create_role
      tags:
        - Roles
      requestBody:
        description: The role to create.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleCreationFieldsInternal'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    get:
      summary: Get a list of roles.
      description: Retrieves a list of all available roles, including both NVIDIA Run:ai predefined roles and custom roles. Use this endpoint to review role configurations, permission sets and permissions.
      operationId: get_roles
      tags:
        - Roles
      parameters:
        - $ref: '#/components/parameters/Limit'
        - $ref: '#/components/parameters/Offset'
        - $ref: '#/components/parameters/SortOrder'
        - $ref: '#/components/parameters/RolesSort'
        - $ref: '#/components/parameters/RolesFilter'
        - $ref: '#/components/parameters/Search'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                type: object
                required:
                  - roles
                properties:
                  roles:
                    $ref: '#/components/schemas/Roles1'
                  next:
                    type: integer
                    example: 1
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v2/authorization/roles/{roleIdPath}:
    get:
      summary: Get a role by id.
      description: Retrieves details for a specific role, including its name, description, scope, and associated permission sets.
      operationId: get_role
      tags:
        - Roles
      parameters:
        - $ref: '#/components/parameters/RoleIdPath'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: Delete a role by id.
      description: Deletes a custom role. Use this endpoint to permanently remove roles that are no longer needed. NVIDIA Run:ai predefined roles cannot be deleted.
      operationId: delete_role
      tags:
        - Roles
      parameters:
        - $ref: '#/components/parameters/RoleIdPath'
      responses:
        '204':
          $ref: '#/components/responses/204NoContent'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    put:
      summary: Update a role by id.
      description: Updates a custom role, including its name, description, or associated permission sets. NVIDIA Run:ai predefined roles cannot be updated.
      operationId: update_role
      tags:
        - Roles
      parameters:
        - $ref: '#/components/parameters/RoleIdPath'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleCreationFieldsInternal'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v2/authorization/roles/{roleIdPath}/enable:
    post:
      summary: Enable a role by id.
      description: Enables a specific role. Disabled roles cannot be assigned to users and do not grant any permissions.
      operationId: role_enable
      tags:
        - Roles
      parameters:
        - $ref: '#/components/parameters/RoleIdPath'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleEnabledDisabledFields'
      responses:
        '204':
          $ref: '#/components/responses/204NoContent'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v2/authorization/roles/{roleIdPath}/disable:
    post:
      summary: Disable a role by id.
      description: Disables a specific role. Disabled roles cannot be assigned to users and do not grant any permissions.
      operationId: role_disable
      tags:
        - Roles
      parameters:
        - $ref: '#/components/parameters/RoleIdPath'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleEnabledDisabledFields'
      responses:
        '204':
          $ref: '#/components/responses/204NoContent'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/permission-sets:
    get:
      summary: Get permission sets.
      description: Retrieve a list of all available permission sets. Each permission set defines a collection of permissions grouped by resource type and associated actions (such as create, read, update, or delete).
      operationId: get_permission_sets
      tags:
        - Permissions
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                type: object
                required:
                  - permissionSets
                properties:
                  permissionSets:
                    $ref: '#/components/schemas/PermissionSets'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/permission-sets/{permissionSetId}:
    get:
      summary: Get permission set by id.
      description: Returns information about a single permission set, including its name, description, and the list of permissions it contains.
      operationId: get_permission_set
      tags:
        - Permissions
      parameters:
        - $ref: '#/components/parameters/PermissionSetId'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionSet'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/access-rules:
    post:
      summary: Create an access rule.
      description: Use to bind a predefined role to a subject (user, group or application) in a scope.
      operationId: create_access_rule
      tags:
        - Access rules
      requestBody:
        description: The access rule to create.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessRuleCreationFields'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessRule'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    get:
      summary: List the access rules.
      description: Retrieve a list of access rules.
      operationId: get_access_rules
      tags:
        - Access rules
      parameters:
        - $ref: '#/components/parameters/SubjectTypeOptional'
        - $ref: '#/components/parameters/SubjectIds'
        - $ref: '#/components/parameters/Limit'
        - $ref: '#/components/parameters/Offset'
        - $ref: '#/components/parameters/LastUpdated'
        - $ref: '#/components/parameters/IncludeDeleted'
        - $ref: '#/components/parameters/FilterByCluster'
        - $ref: '#/components/parameters/ScopeIdOptional'
        - $ref: '#/components/parameters/SortOrder'
        - $ref: '#/components/parameters/AccessRulesSort'
        - $ref: '#/components/parameters/AccessRulesFilter'
        - $ref: '#/components/parameters/Search'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                type: object
                required:
                  - totalRecords
                  - displayRecords
                  - accessRules
                properties:
                  totalRecords:
                    type: integer
                    example: 1
                  displayRecords:
                    type: integer
                    example: 1
                  accessRules:
                    $ref: '#/components/schemas/AccessRules'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/access-rules/{accessRuleId}:
    get:
      summary: Get an access rule.
      description: Use to retrieve the details of an access rule by id.
      operationId: get_access_rule
      tags:
        - Access rules
      parameters:
        - $ref: '#/components/parameters/AccessRuleId'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessRuleById'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: Delete an access rule.
      description: Use to delete the subject permissions assigned by access rule id.
      operationId: delete_access_rule
      tags:
        - Access rules
      parameters:
        - $ref: '#/components/parameters/AccessRuleId'
      responses:
        '204':
          $ref: '#/components/responses/204NoContent'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/access-rules/count:
    get:
      summary: Count access rules.
      description: Use to retrieve the number of access rules.
      operationId: count_access_rules
      tags:
        - Access rules
      parameters:
        - $ref: '#/components/parameters/IncludeDeleted'
        - $ref: '#/components/parameters/AccessRulesFilter'
        - $ref: '#/components/parameters/Search'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                type: object
                required:
                  - count
                properties:
                  count:
                    type: integer
                    format: int64
                    example: 1
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/access-rules/batch:
    post:
      summary: Delete Multiple Access Rules
      operationId: access_rules_batch
      tags:
        - Access rules
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessRulesBatchFields'
      responses:
        '200':
          description: Request completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessRuleDeletionBatchResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/access-rules/batch-create:
    post:
      summary: Create Multiple Access Rules
      description: Creates a batch of access rules in a single operation. Requires a list of access rule objects, each specifying the subject, role, and scope. Returns the result of the operation, including which rules were successfully created and any that failed, along with error messages if applicable.
      operationId: access_rules_batch_create
      tags:
        - Access rules
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessRulesBatchCreateFields'
      responses:
        '200':
          description: Request completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessRulesBatchCreateResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/permissions:
    get:
      summary: Get a summary of user permissions.
      description: Retrieve a summary of user permissions.
      operationId: get_permissions
      tags:
        - Permissions
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Permissions'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/permitted-scopes:
    post:
      summary: Calculate permitted scopes.
      description: Use to calculate user permitted scopes for an action on a resource.
      operationId: get_permitted_scopes
      tags:
        - Permissions
      requestBody:
        description: The request parameters.
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - resourceType
              properties:
                resourceType:
                  $ref: '#/components/schemas/ResourceType'
                action:
                  nullable: true
                  type: string
                  enum:
                    - create
                    - read
                    - update
                    - delete
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermittedScopesActions'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/me/access-rules:
    get:
      summary: List the access rules assigned to the requesting user.
      description: Retrieve the access rules assigned to the requesting user.
      operationId: get_me_access_rules
      tags:
        - Me
      parameters:
        - $ref: '#/components/parameters/Limit'
        - $ref: '#/components/parameters/Offset'
        - $ref: '#/components/parameters/Search'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MeAccessRulesResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/me/access-rules/count:
    get:
      summary: Count the access rules assigned to the requesting user.
      description: Use to retrieve the number of access rules assigned to the requesting user.
      operationId: count_me_access_rules
      tags:
        - Me
      parameters:
        - $ref: '#/components/parameters/Search'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                type: object
                required:
                  - count
                properties:
                  count:
                    type: integer
                    format: int64
                    example: 1
        '400':
          $ref: '#/components/responses/400BadRequest'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/settings:
    get:
      summary: Get authorization settings
      operationId: get_authorization_settings
      parameters:
        - $ref: '#/components/parameters/TenantId'
      tags:
        - Settings
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizationSettingsGetResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/authorization/settings/{key}:
    put:
      summary: Update authorization setting by key
      operationId: update_authorization_setting_by_key
      tags:
        - Settings
      parameters:
        - $ref: '#/components/parameters/AuthorizationSettingsKey'
        - $ref: '#/components/parameters/TenantId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateAuthorizationSettingByKeyRequest'
            examples:
              enableScopedAuthorization:
                value:
                  enabled: false
              tenantIsCspManaged:
                value:
                  enabled: false
      responses:
        '200':
          description: Setting successfully updated
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    get:
      summary: Get authorization setting by key
      operationId: get_authorization_setting_by_key
      tags:
        - Settings
      parameters:
        - $ref: '#/components/parameters/AuthorizationSettingsKey'
        - $ref: '#/components/parameters/TenantId'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EnableScopedAuthorizationSetting'
              examples:
                enableScopedAuthorization:
                  value:
                    enabled: false
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
components:
  schemas:
    TenantId:
      description: The id of the tenant.
      type: integer
      format: int32
      example: 1001
    Tenant:
      type: object
      required:
        - id
        - uuid
        - name
        - status
        - contractType
        - createdAt
        - updatedAt
        - smg
      properties:
        id:
          $ref: '#/components/schemas/TenantId'
        mimirId:
          type: string
        uuid:
          type: string
          format: uuid
          description: The universally unique identifier of the tenant.
        name:
          type: string
          description: The internal system name of the tenant.
        displayName:
          type: string
          description: The name of the tenant as shown to users within the tenant.
        alias:
          type: string
          description: An optional alias for the tenant.
        smg:
          type: boolean
        status:
          type: string
          enum:
            - Creating
            - Failed
            - Updating
            - Deleted
            - Deleting
            - Ready
          description: |
            The current status of the tenant.
            Possible values:
            - Creating
            - Failed
            - Updating
            - Deleted
            - Deleting
            - Ready
        createdAt:
          type: string
          format: date-time
          description: The date and time when the tenant was created.
        updatedAt:
          type: string
          format: date-time
          description: The date and time when the tenant was last updated.
        contractType:
          type: string
          enum:
            - normal
        eula:
          type: string
          description: The signer details for the tenant's EULA (End User License Agreement).
      example:
        id: 1
        name: example
        displayName: Example
        alias: example-alias
        status: Ready
        tenantId: 123
        createdAt: '2020-01-01T00:00:00Z'
        updatedAt: '2020-01-02T00:00:00Z'
        deletedAt: null
    Tenants:
      type: array
      items:
        $ref: '#/components/schemas/Tenant'
      x-schema-name: Tenants
    Error:
      required:
        - code
        - message
      properties:
        code:
          type: integer
          minimum: 100
          maximum: 599
        message:
          type: string
        details:
          type: string
      example:
        code: 400
        message: Bad request - Resource should have a name
    Roles:
      type: string
      description: 'The role assigned to the tenant''s admin user. Possible value: System administrator.'
      nullable: true
      enum:
        - System administrator
        - Cloud operator
    MetricStoreEndpoint:
      required:
        - url
      type: object
      properties:
        url:
          type: string
          format: uri
          example: http://mimir-nginx.mimir-test.svc:80/api/v1/query
          minLength: 1
          maxLength: 2048
        auth:
          nullable: true
          type: object
          properties:
            basic:
              nullable: true
              type: object
              properties:
                username:
                  type: string
                  minLength: 1
                  maxLength: 255
                password:
                  type: string
                  minLength: 1
                  maxLength: 500
        headers:
          nullable: true
          type: object
          additionalProperties:
            type: string
            maxLength: 1000
          minProperties: 0
          maxProperties: 50
          example:
            X-Scope-OrgID: id
    MetricStore:
      required:
        - read
        - write
      type: object
      properties:
        read:
          $ref: '#/components/schemas/MetricStoreEndpoint'
        write:
          $ref: '#/components/schemas/MetricStoreEndpoint'
    TenantCreationRequest:
      type: object
      required:
        - name
        - email
      properties:
        name:
          type: string
          pattern: ^[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]$
          description: The name of the tenant.
          example: name
          minLength: 2
          maxLength: 255
        alias:
          type: string
          nullable: true
          pattern: ^[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]$
          description: An optional alias for the tenant. Must be unique across all tenant names and aliases.
          example: tenant-alias
          minLength: 2
          maxLength: 255
        email:
          type: string
          pattern: ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$
          description: The email of the tenant's admin user.
          example: first@run.ai
          minLength: 5
          maxLength: 254
        password:
          type: string
          nullable: true
          description: The password for the tenant's admin user. Must contain at least 1 special character, 1 uppercase letter, 1 lowercase letter, 1 digit, and be at least 8 characters long.
          minLength: 8
          maxLength: 255
        contractType:
          type: string
          enum:
            - normal
            - ''
        role:
          $ref: '#/components/schemas/Roles'
        metricStore:
          writeOnly: true
          nullable: true
          type: object
          allOf:
            - $ref: '#/components/schemas/MetricStore'
    TenantCreationResponse:
      type: object
      required:
        - tenant
      properties:
        tenant:
          $ref: '#/components/schemas/Tenant'
        additionalData:
          description: additional data for tenant creation
          type: object
          nullable: true
      example:
        tenant:
          id: 1
          name: example
          displayName: Example
          status: Ready
          tenantId: 123
          eulaSigningUser:
            email: user@tenant
            date: '2020-01-01T00:00:00Z'
            ip: 192.168.10.210
            contract_type: normal
          created_at: '2020-01-01T00:00:00Z'
          updated_at: '2020-01-02T00:00:00Z'
          deleted_at: null
        additionalData:
          tenantDomain: tenant.test.run.ai
          customerUser:
            user@tenant: Abc!23
    TenantUpdateRequest:
      type: object
      properties:
        alias:
          type: string
          nullable: true
          pattern: ^[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]$
          description: An optional alias for the tenant. Must be unique across all tenant names and aliases.
          example: tenant-alias
          minLength: 2
          maxLength: 255
    ComplianceIssues:
      properties:
        complianceIssues:
          type: array
          items:
            type: object
            required:
              - details
              - field
            properties:
              field:
                type: string
                example: compute.gpuDevicesRequest
              details:
                type: string
                example: value must be no less than 3
      nullable: true
      type: object
    SubmissionError:
      allOf:
        - $ref: '#/components/schemas/Error'
        - $ref: '#/components/schemas/ComplianceIssues'
    ClusterReportedStatusPlatform:
      nullable: true
      type: object
      properties:
        type:
          nullable: true
          type: string
          enum:
            - vanilla
            - openshift
            - rke
            - gke
            - aks
            - eks
          description: the cluster platform type
        kubeVersion:
          nullable: true
          type: string
          description: the cluster kubernetes version
    ClusterReportedCustomCA:
      description: Custom CA bundle reported by the cluster for a specific consumer (git-sync, S3, oauth2-proxy).
      type: object
      nullable: true
      properties:
        enabled:
          type: boolean
          nullable: true
          description: indicates if a custom CA bundle is configured for this consumer
          example: true
        secretName:
          type: string
          nullable: true
          description: the name of the Secret holding the custom CA bundle
          example: runai-ca
        secretKey:
          type: string
          nullable: true
          description: the key within the Secret that holds the custom CA bundle
          example: runai-ca.pem
        optional:
          type: boolean
          nullable: true
          description: indicates if the Secret is optional (the consumer should tolerate a missing Secret)
          example: false
    ClusterReportedConfig:
      description: Holds cluster configuration values.
      type: object
      properties:
        workloadOwnershipProtection:
          type: boolean
          nullable: true
          description: indicates if the cluster workload ownership protection is enabled
          example: false
        subdomainEnabled:
          type: boolean
          nullable: true
          description: indicates if the cluster subdomain is enabled
          example: false
        ingressClass:
          type: string
          nullable: true
          description: the ingress class that is configured for the cluster
          example: nginx
        ingressEnabled:
          type: boolean
          nullable: true
          description: indicates if Ingress or Route resources should be created for workload external URLs
          example: true
        gatewayName:
          type: string
          nullable: true
          description: the name of the Gateway API gateway resource configured for the cluster
          example: my-gateway
        gatewayNamespace:
          type: string
          nullable: true
          description: the namespace of the Gateway API gateway resource configured for the cluster
          example: gateway-system
        gatewayAPIEnabled:
          type: boolean
          nullable: true
          description: indicates if Gateway API HTTPRoute resources should be created for workload external URLs
          example: false
        gitSyncImage:
          type: string
          nullable: true
          description: the fully qualified git-sync image reference used by init containers (format "registry/name:tag")
          example: gcr.io/runai/git-sync:v4.2.0
        s3FileSystemImage:
          type: string
          nullable: true
          description: the fully qualified s3 file-system image reference used by init containers (format "registry/name:tag")
          example: gcr.io/runai/goofys:v0.24.0
        runaiOauth2ProxyImage:
          type: string
          nullable: true
          description: the fully qualified runai oauth2-proxy image reference used by init containers (format "registry/name:tag")
          example: gcr.io/runai/oauth2-proxy:v7.5.1
        runaiOauth2ProxyUsernameLoaderImage:
          type: string
          nullable: true
          description: the fully qualified runai oauth2-proxy username loader image reference used by init containers (format "registry/name:tag")
          example: gcr.io/runai/oauth2-proxy-username-loader:v1.0.0
        runaiOauth2ProxyRedisFQDN:
          type: string
          nullable: true
          description: the FQDN of the Redis backing oauth2-proxy
          example: cluster-redis.runai.svc.cluster.local:6379
        runaiOauth2ProxyWorkloadAuthSecretName:
          type: string
          nullable: true
          description: the name of the Secret holding the oauth2-proxy workload auth credentials
          example: runai-workload-auth
        runaiOauth2ProxySessionStoreType:
          type: string
          nullable: true
          description: the session store type used by oauth2-proxy
          example: cookie
        runaiOauth2ProxyOidcIssuerUrl:
          type: string
          nullable: true
          description: the absolute OIDC issuer URL oauth2-proxy uses to discover the OpenID provider
          example: https://app.run.ai/auth/realms/runai
        customCAGit:
          $ref: '#/components/schemas/ClusterReportedCustomCA'
        customCAS3:
          $ref: '#/components/schemas/ClusterReportedCustomCA'
        customCAOauth2Proxy:
          $ref: '#/components/schemas/ClusterReportedCustomCA'
        externalAuthUrlEnabled:
          type: boolean
          nullable: true
          description: indicates if OAuth2 proxy is used when submitting workloads with an external URL
          example: true
      nullable: true
    ClusterDependencyStatus:
      type: object
      required:
        - available
      properties:
        available:
          type: boolean
          description: whether the dependency is available
        reason:
          type: string
          description: the reason for the dependency status
        components:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/ClusterDependencyStatus'
    ClusterDependenciesStatus:
      type: object
      required:
        - required
        - optional
      properties:
        required:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/ClusterDependencyStatus'
        optional:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/ClusterDependencyStatus'
    ClusterReportedStatus:
      type: object
      description: the cluster status reported by the cluster
      properties:
        conditions:
          items:
            description: Condition contains details for one aspect of the current state of this API Resource
            properties:
              lastTransitionTime:
                description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                format: date-time
                type: string
              message:
                description: message is a human readable message indicating details about the transition. This may be an empty string.
                maxLength: 32768
                type: string
              observedGeneration:
                description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
                format: int64
                minimum: 0
                type: integer
              reason:
                description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
                maxLength: 1024
                minLength: 1
                pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                type: string
              status:
                description: status of the condition, one of True, False, Unknown.
                enum:
                  - 'True'
                  - 'False'
                  - Unknown
                type: string
              type:
                description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                maxLength: 316
                type: string
            required:
              - lastTransitionTime
              - message
              - reason
              - status
              - type
            type: object
          type: array
        operands:
          additionalProperties:
            description: Status specifies the status of an operand. And operand manages resources, some of which are not immediately available and need their status monitored, such as Deployments, Daemonsets, Ingressess etc. Some resources are immediately available and should not be monitored once accepted by the cluster, such as Services, ConfigMaps, Secrets etc. If all resources of an operand are ready, a Status with Ready set to 'true' and a nil 'Reasons' slice should be returned, otherwise, a Status with 'Reasons' slice containig the reason why the Operand is not ready (Deployment pods are not ready for example.)
            properties:
              lastTransitionTime:
                description: LastTransitionTime specifies the last time the operand readiness changed
                format: date-time
                type: string
              ready:
                description: Ready specifies if the operand is ready or not
                type: boolean
              reasons:
                description: Reasons specifies the reasons why the operand is not ready
                items:
                  type: string
                type: array
              unreadyThresholdCrossed:
                description: UnreadyThresholdCrossed specifies if the operand has been unready for longer than the threshold
                type: boolean
            required:
              - ready
            type: object
          description: OperandStatuses specifies the status of the managed operands
          type: object
        platform:
          $ref: '#/components/schemas/ClusterReportedStatusPlatform'
        config:
          $ref: '#/components/schemas/ClusterReportedConfig'
        dependencies:
          $ref: '#/components/schemas/ClusterDependenciesStatus'
    ClusterState:
      type: string
      description: The cluster's state.
      enum:
        - WaitingToConnect
        - Connected
        - Disconnected
        - MissingPrerequisites
        - ServiceIssues
        - Unknown
    ClusterDisplayedStatus:
      type: object
      description: The cluster's displayed status.
      nullable: true
      allOf:
        - $ref: '#/components/schemas/ClusterReportedStatus'
        - type: object
          properties:
            state:
              $ref: '#/components/schemas/ClusterState'
    DisplayedCluster:
      type: object
      required:
        - uuid
        - tenantId
        - name
        - createdAt
      properties:
        uuid:
          type: string
          format: uuid
        tenantId:
          $ref: '#/components/schemas/TenantId'
        name:
          type: string
          minLength: 1
          maxLength: 253
        createdAt:
          type: string
          format: date-time
        domain:
          type: string
          nullable: true
          minLength: 1
          maxLength: 253
        version:
          type: string
          nullable: true
          minLength: 1
          maxLength: 50
        status:
          $ref: '#/components/schemas/ClusterDisplayedStatus'
        updatedAt:
          type: string
          format: date-time
          nullable: true
        deletedAt:
          type: string
          nullable: true
          format: date-time
        lastLiveness:
          type: string
          nullable: true
          format: date-time
        deleteRequestedAt:
          description: the timestamp value of when the cluster deletion request was received
          type: string
          format: date-time
          nullable: true
      example:
        uuid: A0EEBC99-9C0B-4EF8-BB6D-6BB9BD380A11
        name: example
        tenantId: 1001
        domain: my.company.com
        status: {}
        createdAt: '2020-01-01T00:00:00Z'
        updatedAt: '2020-01-02T00:00:00Z'
        lastLiveness: '2020-01-02T00:00:00Z'
        version: 2.15.0
    NodeStatusConditionDetails:
      type: object
      required:
        - type
        - reason
      properties:
        type:
          type: string
          description: Type of node condition.
        reason:
          type: string
          description: (brief) reason for the condition's last transition.
          example: KubeletNotReady
        message:
          type: string
          description: Human readable message indicating details about last transition.
          example: container runtime status check may not have completed yet
      x-schema-name: NodeStatusConditionDetails
    NodeTaint:
      type: object
      required:
        - key
        - effect
      properties:
        key:
          type: string
          description: The taint key to be applied to a node.
          example: foo
        value:
          type: string
          description: The taint value corresponding to the taint key.
          example: bar
        effect:
          type: string
          description: The effect of the taint on pods that do not tolerate the taint.
          enum:
            - NoSchedule
            - PreferNoSchedule
            - NoExecute
      x-schema-name: NodeTaint
    GpuInfo:
      type: object
      nullable: true
      required:
        - gpuType
        - gpuCount
      properties:
        gpuType:
          type: string
          example: Tesla-V100
        gpuCount:
          type: integer
      x-schema-name: GpuInfo
    LabelValue:
      type: string
      pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
      minLength: 1
      maxLength: 63
    NetworkTopologyLabel:
      type: object
      required:
        - labelKey
        - labelValue
      properties:
        labelKey:
          type: string
          description: The Kubernetes node label key that identifies a topology level (for example, topology.kubernetes.io/zone or cloud.provider.com/topology-rack).
        labelValue:
          $ref: '#/components/schemas/LabelValue'
          description: The value of the Kubernetes node label for the specified labelKey on this node (for example, zone-a or rack-1). This value identifies the node’s placement within the corresponding topology level.
    NetworkTopologyLabelsOptional:
      type: array
      items:
        $ref: '#/components/schemas/NetworkTopologyLabel'
      description: A list of Kubernetes node label key/value pairs that represent the node’s position in the cluster’s network topology (for example, region, zone, block, rack, or hostname). The topology is attached to the node pool on which the workload runs. The label order represents the hierarchy, from farthest (first) to closest (last). These labels are used by the NVIDIA Run:ai Scheduler when making placement decisions.
      nullable: true
    NodeInfo:
      type: object
      required:
        - status
        - nodePool
        - createdAt
      properties:
        status:
          type: string
          enum:
            - Ready
            - NotReady
            - Unknown
          description: The calculated status of the node.
        conditions:
          type: array
          items:
            $ref: '#/components/schemas/NodeStatusConditionDetails'
        taints:
          type: array
          items:
            $ref: '#/components/schemas/NodeTaint'
        nodePool:
          type: string
          description: The node's NodePool.
          example: node-pool-1
        createdAt:
          type: string
          format: date-time
        gpuInfo:
          $ref: '#/components/schemas/GpuInfo'
        nvLinkDomainUid:
          type: string
          description: NV Link Domain Uid
          example: nvlink-domain-uid
          nullable: true
        nvLinkCliqueId:
          type: string
          description: NV Link Clique Id
          example: clique-id
          nullable: true
        networkTopologyLabels:
          $ref: '#/components/schemas/NetworkTopologyLabelsOptional'
      x-schema-name: NodeInfo
    NodeAdditionalFields:
      type: object
      required:
        - name
      properties:
        name:
          type: string
          description: The name of the node
          example: worker-node-1
      x-schema-name: NodeAdditionalFields
    NodeForSync:
      allOf:
        - $ref: '#/components/schemas/NodeAdditionalFields'
        - type: object
          required:
            - nodeInfo
          properties:
            nodeInfo:
              $ref: '#/components/schemas/NodeInfo'
      x-schema-name: NodeForSync
    ClusterCreationRequest:
      type: object
      required:
        - name
      properties:
        name:
          type: string
          minLength: 0
          maxLength: 253
        domain:
          type: string
          minLength: 0
          maxLength: 253
        version:
          type: string
          minLength: 0
          maxLength: 50
    ClustersMinimalData:
      type: object
      required:
        - uuid
        - tenantId
        - name
        - createdAt
      properties:
        uuid:
          type: string
          format: uuid
        name:
          type: string
          format: .*
        tenantId:
          $ref: '#/components/schemas/TenantId'
        version:
          type: string
          format: .*
          nullable: true
        domain:
          type: string
          format: .*
          nullable: true
        platform:
          $ref: '#/components/schemas/ClusterReportedStatusPlatform'
        state:
          $ref: '#/components/schemas/ClusterState'
        ingressClass:
          type: string
          nullable: true
          description: the ingress class that is configured for the cluster
          example: nginx
        dependenciesStatus:
          $ref: '#/components/schemas/ClusterDependenciesStatus'
    ClusterUpdateRequest:
      type: object
      required:
        - name
      properties:
        name:
          type: string
          minLength: 0
          maxLength: 253
    HttpResponse:
      required:
        - code
        - message
      properties:
        code:
          type: integer
          minimum: 100
          maximum: 599
        message:
          type: string
    MetricsType:
      type: string
      description: specifies what data to request
      enum:
        - TOTAL_GPU_NODES
        - GPU_UTILIZATION
        - GPU_UTILIZATION_DISTRIBUTION
        - GPU_MEMORY_UTILIZATION
        - CPU_UTILIZATION
        - CPU_MEMORY_UTILIZATION
        - TOTAL_GPU
        - GPU_QUOTA
        - ALLOCATED_GPU
        - UNALLOCATED_GPU
        - AVG_WORKLOAD_WAIT_TIME
        - WORKLOADS_COUNT
    GroupedMeasurementGroup:
      type: object
      required:
        - key
        - value
      properties:
        key:
          type: string
          example: Nodepool
          description: The grouping key
        value:
          type: string
          example: gpu-pool-1
          description: The grouping value
    GroupedMeasurementResponse:
      type: object
      required:
        - type
        - values
      properties:
        type:
          type: string
          description: specifies what data returned
          example: ALLOCATED_GPU
        labels:
          type: object
          nullable: true
          description: labels of the metric measurement
          example: '{''gpu'': ''3''}'
          additionalProperties:
            type: string
        values:
          type: array
          nullable: true
          items:
            type: object
            required:
              - value
              - timestamp
            properties:
              value:
                type: string
                example: '85'
              timestamp:
                type: string
                format: date-time
                nullable: true
                example: '2023-06-06 12:09:18.211'
        groups:
          type: array
          description: Group information for this measurement
          items:
            $ref: '#/components/schemas/GroupedMeasurementGroup'
    GroupedMetricsResponse:
      type: object
      required:
        - measurements
      properties:
        measurements:
          type: array
          items:
            $ref: '#/components/schemas/GroupedMeasurementResponse'
    NodepoolGPUNetworkAccelerationDetection:
      type: string
      enum:
        - Use
        - DontUse
        - Auto
      nullable: true
      default: Auto
      description: GPUNetworkAccelerationDetection is a strategy to use for GPU Network Acceleration detection
    NetworkTopologyNameOptional:
      type: string
      nullable: true
      description: Name of the network topology
      maxLength: 63
      minLength: 1
      pattern: ^[a-z]([a-z0-9-]*[a-z0-9])?$
      example: default-topology
    NetworkTopologyIdOptional:
      type: string
      format: uuid
      nullable: true
      description: The unique identifier for the network topology
      example: 123e4567-e89b-12d3-a456-426614174000
    GPUResourceOptimization:
      type: object
      nullable: true
      deprecated: true
      properties:
        swapEnabled:
          type: boolean
          description: Indicates if swap is enabled on the node pool
          example: true
          default: false
          nullable: true
          deprecated: true
        cpuSwapMemorySize:
          type: string
          description: Size of the swap cpu memory. Only allowed when swapEnabled is true
          example: 10000M
          default: 100G
          nullable: true
          pattern: ^([+]?[0-9.]+)([eEinumkKMGTP]*[-+]?[0-9]*)$
          deprecated: true
        reservedGpuMemoryForSwapOperations:
          type: string
          description: Reserved GPU memory for swap operations. Only allowed when swapEnabled is true
          example: 10G
          default: 2G
          nullable: true
          pattern: ^([+]?[0-9.]+)([eEinumkKMGTP]*[-+]?[0-9]*)$
          deprecated: true
        nodeLevelSchedulerEnabled:
          type: boolean
          description: Indicates if node level scheduler is enabled on the node pool
          example: true
          default: false
          nullable: true
          deprecated: true
    PlacementStrategy:
      type: string
      enum:
        - spread
        - binpack
      example: spread
      nullable: true
    GpuPodsPlacementStrategy:
      type: object
      nullable: true
      description: Defines the placement strategy for GPU pods within the node pool.
      properties:
        node:
          description: |
            Specifies how GPU pods are placed across nodes.
             - binpack - Place as many GPU pods as possible on each node to use fewer nodes and maximize available capacity.
             - spread - Distribute GPU pods across as many nodes as possible to balance load across nodes.
          allOf:
            - $ref: '#/components/schemas/PlacementStrategy'
        device:
          description: |
            Specifies how GPU pods are placed across GPU devices within a node when using GPU fractions.






             - binpack - Place as many GPU pods as possible on each GPU device to use fewer devices and maximize available capacity, minimizing GPU fraction fragmentation.
             - spread - Distribute GPU pods across as many GPU devices as possible to balance load across devices.
          allOf:
            - $ref: '#/components/schemas/PlacementStrategy'
    CpuPodsPlacementStrategy:
      type: object
      nullable: true
      description: Defines the placement strategy for CPU pods within the node pool.
      properties:
        node:
          description: |
            Specifies how CPU pods are placed across nodes.
             - binpack - Place as many CPU pods as possible on each node to use fewer nodes and maximize available capacity.
             - spread - Distribute CPU pods across as many nodes as possible to balance load across nodes.
          allOf:
            - $ref: '#/components/schemas/PlacementStrategy'
    TimeBasedFairShareWindowType:
      type: string
      enum:
        - sliding
        - tumbling
      example: tumbling
      nullable: true
      default: sliding
      description: |
        The method for evaluating the usage window.
         - sliding: A moving window that always evaluates the most recent time period. For example, a 7-day sliding window always considers the last 7 days.
         - tumbling: Fixed, non-overlapping intervals that reset at the end of each cycle. Requires tumblingWindowStartTime to define the cycle anchor.
    TimeBasedFairShare:
      type: object
      nullable: true
      description: Time-based fairshare configuration for the node pool. [Experimental].
      properties:
        enabled:
          type: boolean
          example: true
          nullable: true
          default: false
          description: |
            Enables time-based fairshare for the node pool. When true, the Scheduler adjusts fairshare based on historical resource usage over a defined time window, allowing past consumption to influence scheduling order. When false, scheduling is based only on the current queue state. [Experimental]
        historicalUsageWeight:
          type: number
          format: float
          nullable: true
          example: 1.5
          default: 1
          description: |
            Set the weight value that determines how a project’s historical resource usage affects its fairshare.






             - 0.0: Ignore historical usage data (100% current usage).
             - 1.0: Historical usage data has higher impact, it may cause fairshare to be 0.
             - Values between 0.0 and 1.0 combine historical and current usage to maintain a balanced fairshare
             - Values above 1 will cause historical usage to have an even higher impact on fairshare.
        decayHalfLife:
          type: string
          nullable: true
          example: 24h
          default: 0h
          pattern: ^(0|[+]?((\d+(\.\d+)?)(m|h|d))+$)
          description: |
            Set the half-life time to define the decay rate of a project’s historical resource usage. The half-life defines how long it takes for past usage to diminish to half of its original influence on a project's fairshare.






             - 0: disables decay; all historical usage is weighted equally.
             - > 0: older usage gradually contributes less over time (e.g., with a 24-hour half-life, usage from 24 hours ago contributes 50%, from 48 hours ago 25%, and so on).
        windowType:
          $ref: '#/components/schemas/TimeBasedFairShareWindowType'
        windowDuration:
          type: string
          nullable: true
          example: 2d
          default: 7d
          pattern: ^(0|[+]?((\d+(\.\d+)?)(m|h|d))+$)
          description: |
            The time period over which historical usage is evaluated. Only usage within this window contributes to fairshare. For sliding windows, this is a moving period (e.g., 7d = always the last 7 days). For tumbling windows, this is the fixed cycle duration after which the window resets.
        tumblingWindowStartTime:
          type: string
          format: date-time
          nullable: true
          example: '2025-01-06T08:00:00Z'
          description: |
            An RFC-3339 timestamp that defines the start time for all tumbling windows. Used only when windowType = Tumbling. This timestamp marks the beginning of the first fixed window, and subsequent windows repeat at intervals equal to the configured WindowDuration.
            For example, with a 7-day window, an anchor of 2025-01-06T08:00:00Z produces weekly windows starting every Monday at 08:00 UTC.
    SchedulingConfiguration:
      type: object
      nullable: true
      properties:
        gpuPodsPlacementStrategy:
          $ref: '#/components/schemas/GpuPodsPlacementStrategy'
        cpuPodsPlacementStrategy:
          $ref: '#/components/schemas/CpuPodsPlacementStrategy'
        placementStrategy:
          description: |
            Deprecated. Use gpuPodsPlacementStrategy and cpuPodsPlacementStrategy instead.
            On write, when a new field is provided it takes precedence over the equivalent field here.
            On read, both this field and the new fields are returned; this field reflects the node-level strategies.
          deprecated: true
          properties:
            cpu:
              $ref: '#/components/schemas/PlacementStrategy'
            gpu:
              $ref: '#/components/schemas/PlacementStrategy'
        minGuaranteedRuntime:
          description: Minimum duration (e.g., 5d8h40m) that a preemptible workload is guaranteed to run once scheduled and bound to a node. During this period, it is considered non-preemptible even if a higher-priority workload becomes eligible. Defaults to 0 (immediate preemption allowed).
          type: string
          example: 5d8h40m
          nullable: true
          pattern: ^(0|[+]?((\d+(\.\d+)?)(ns|us|µs|μs|ms|s|m|h|d|w))+$)
        timeBasedFairShare:
          $ref: '#/components/schemas/TimeBasedFairShare'
        numaAwareScheduling:
          description: When enabled, the Scheduler places workloads so that GPU, CPU, and CPU memory are allocated within the same NUMA node where possible, minimizing cross-NUMA fragmentation and improving performance. Requires the NodeResourceTopology (NRT) component and a Topology Manager policy other than 'none' on the pool's nodes. When disabled, the Scheduler places workloads using aggregate node capacity only, without considering NUMA topology.
          type: boolean
          nullable: true
    NodepoolCreateResponseFields:
      type: object
      required:
        - name
        - labelKey
        - labelValue
        - clusterId
      properties:
        name:
          type: string
          example: v100
          minLength: 1
        labelKey:
          type: string
          description: Label key for associated nodes to the Node Pool (with value as in labelValue)
          example: node-type
          minLength: 1
        labelValue:
          type: string
          description: Label value for associated nodes to the Node Pool (with key as in labelKey)
          example: type-x
          minLength: 1
        clusterId:
          type: string
          format: uuid
          example: d73a738f-fab3-430a-8fa3-5241493d7128
        gpuNetworkAccelerationLabelKey:
          description: Label key by which to determine GPUNetworkAccelerationDetection nodes
          type: string
        gpuNetworkAccelerationDetection:
          $ref: '#/components/schemas/NodepoolGPUNetworkAccelerationDetection'
        networkTopologyName:
          $ref: '#/components/schemas/NetworkTopologyNameOptional'
        networkTopologyId:
          $ref: '#/components/schemas/NetworkTopologyIdOptional'
        gpuResourceOptimization:
          $ref: '#/components/schemas/GPUResourceOptimization'
        schedulingConfiguration:
          $ref: '#/components/schemas/SchedulingConfiguration'
    NodepoolPhase:
      type: string
      enum:
        - Creating
        - Updating
        - Deleting
        - Empty
        - Unschedulable
        - Ready
        - Deleted
      description: Phase of Node Pool
    NodepoolSyncUpdateFields:
      type: object
      properties:
        labelKey:
          type: string
          description: Label key for associated nodes to the Node Pool (with value as in labelValue)
          example: node-type
          minLength: 1
          nullable: true
        labelValue:
          type: string
          description: Label value for associated nodes to the Node Pool (with key as in labelKey)
          example: type-x
          minLength: 1
          nullable: true
        overProvisioningRatio:
          type: integer
          example: 1
          minimum: 1
          maximum: 5
          default: 1
          nullable: true
          deprecated: true
        placementStrategy:
          description: scheduling strategy per resource
          deprecated: true
          properties:
            cpu:
              $ref: '#/components/schemas/PlacementStrategy'
            gpu:
              $ref: '#/components/schemas/PlacementStrategy'
        gpuNetworkAccelerationLabelKey:
          description: Label key by which to determine GPUNetworkAccelerationDetection nodes
          type: string
        gpuNetworkAccelerationDetection:
          $ref: '#/components/schemas/NodepoolGPUNetworkAccelerationDetection'
        gpuResourceOptimization:
          $ref: '#/components/schemas/GPUResourceOptimization'
        schedulingConfiguration:
          $ref: '#/components/schemas/SchedulingConfiguration'
    NodepoolConditionDetails:
      type: object
      required:
        - type
        - reason
      properties:
        type:
          type: string
          description: Type of Nodepool condition.
        reason:
          type: string
          description: (brief) reason for the condition's last transition.
          example: TopologyMismatch
        message:
          type: string
          description: Human readable message indicating details about last transition.
          example: Network Topology labels mismatch
        status:
          type: string
          description: The status of the condition, can be True or False
          enum:
            - 'True'
            - 'False'
        nodes:
          type: array
          description: Names of the nodes related to the nodepool condition
          items:
            type: string
          example:
            - node1
            - node2
      x-schema-name: NodepoolConditionDetails
    NodepoolSyncFields:
      type: object
      required:
        - name
      properties:
        name:
          type: string
          example: v100
        phase:
          $ref: '#/components/schemas/NodepoolPhase'
        phaseMessage:
          type: string
          description: Message for status of Node Pool
          example: all nodes are down
        status:
          allOf:
            - $ref: '#/components/schemas/NodepoolSyncUpdateFields'
            - type: object
              properties:
                conditions:
                  type: array
                  items:
                    $ref: '#/components/schemas/NodepoolConditionDetails'
                gpuNetworkAccelerationDetected:
                  description: Signals to all relevant parties about GPUNetworkAcceleration being detected in some nodepool's nodes
                  type: boolean
                nodes:
                  type: array
                  items:
                    type: string
                    example: node1
    NodepoolCalculatedFields:
      type: object
      required:
        - id
        - tenantId
        - clusterName
        - createdBy
        - createdAt
        - updatedBy
        - updatedAt
        - isDefault
      properties:
        id:
          type: string
          description: The NodePool id
          readOnly: true
          example: 5
        tenantId:
          description: The id of the tenant.
          type: integer
          example: 1
          format: int32
        clusterName:
          type: string
          example: prod-cluster
        createdBy:
          type: string
          example: user@lab.com
        createdAt:
          type: string
          format: date-time
        updatedBy:
          type: string
          example: user@lab.com
        updatedAt:
          type: string
          format: date-time
        deletedBy:
          type: string
          example: user@lab.com
        deletedAt:
          type: string
          nullable: true
          format: date-time
        isDefault:
          type: boolean
          description: Is the Node Pool is the cluster default
          example: false
    Nodepool:
      allOf:
        - $ref: '#/components/schemas/NodepoolCreateResponseFields'
        - $ref: '#/components/schemas/NodepoolSyncFields'
        - $ref: '#/components/schemas/NodepoolCalculatedFields'
    ClusterId:
      description: The id of the cluster.
      type: string
      format: uuid
      example: 71f69d83-ba66-4822-adf5-55ce55efd210
    LegacyPlacementStrategy:
      properties:
        cpu:
          type: string
          enum:
            - spread
            - binpack
          description: scheduling strategy for cpu
          example: spread
        gpu:
          type: string
          enum:
            - spread
            - binpack
          description: scheduling strategy for gpu
          example: spread
    LegacyNodePoolCreateRequest:
      properties:
        name:
          type: string
          description: Node Pool Name
          example: node-pool-a
        overProvisioningRatio:
          type: integer
          example: 1
          default: 1
        labelKey:
          type: string
          description: Label key for associated nodes to the Node Pool (with value as in labelValue)
          example: node-type
        labelValue:
          type: string
          description: Label value for associated nodes to the Node Pool (with key as in labelKey)
          example: type-x
        placementStrategy:
          $ref: '#/components/schemas/LegacyPlacementStrategy'
    LegacyNodePool:
      allOf:
        - $ref: '#/components/schemas/LegacyNodePoolCreateRequest'
        - properties:
            id:
              type: number
              description: Node Pool unique id
              readOnly: true
              example: 5
            clusterId:
              type: string
              format: uuid
              description: Node Pool cluster id
              example: 71f69d83-ba66-4822-adf5-55ce55efd210
            createdAt:
              type: string
              description: Node Pool creation time
              format: date-time
              example: '2021-12-14T16:04:15.099Z'
            updatedAt:
              type: string
              description: Node Pool update time
              format: date-time
              example: '2021-12-14T16:04:15.099Z'
            deletedAt:
              type: string
              description: Node Pool delete time
              format: date-time
              example: '2021-12-14T16:04:15.099Z'
            status:
              type: string
              enum:
                - Creating
                - Updating
                - Deleting
                - Empty
                - Unschedulable
                - Ready
                - Deleted
              description: Node Pool status
              example: Creating
            statusMessage:
              type: string
              description: Node Pool status details
              example: all nodes are down
            nodes:
              type: string
              description: List of Nodes that are assigned to this nodepool - as json string
              example:
                - node-a
                - node-b
            createdBy:
              type: string
              description: Node Pool creator
              example: user@example.com
            updatedBy:
              type: string
              description: Node Pool updater
              example: user@example.com
            isDefault:
              type: boolean
              description: Is the Node Pool the default Node Pool for all nodes not assigned to any other Node Pool
              example: false
    NetworkTopologiesSource:
      type: string
      description: Identifier of the source of the topology. Useful for tracking where the topology data originated (e.g. control-plane, cluster).
      example: control-plane
      minLength: 1
      maxLength: 63
      pattern: ^[a-zA-Z0-9][a-zA-Z0-9_.-]*[a-zA-Z0-9]$
    NetworkTopologyName:
      type: string
      description: Name of the network topology
      maxLength: 63
      minLength: 1
      pattern: ^[a-z]([a-z0-9-]*[a-z0-9])?$
      example: default-topology
    NetworkTopologyLevels:
      type: array
      minItems: 1
      maxItems: 10
      items:
        type: string
        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
        minLength: 1
        maxLength: 63
      description: Ordered array of network topology levels
      example:
        - cloud.provider.com/topology-block
        - cloud.provider.com/topology-rack
        - kubernetes.io/hostname
    ClusterInstallationInfoResponse:
      type: object
      required:
        - installationStr
        - repositoryName
        - chartRepoURL
        - clientSecret
      properties:
        installationStr:
          type: string
        repositoryName:
          type: string
        chartRepoURL:
          type: string
        clientSecret:
          type: string
      example:
        installationStr: helm update --update repo/runai-cluster -n runai --set cluster.url=test_cluster
        repositoryName: runai
        chartRepoURL: https://charts.example.com
        clientSecret: ABC333DDD
    NodeAdditionalReadFields:
      type: object
      required:
        - clusterUuid
        - updatedAt
      properties:
        id:
          type: string
          format: uuid
          description: The unique identifier of the node.
        clusterUuid:
          $ref: '#/components/schemas/ClusterId'
        updatedAt:
          type: string
          format: date-time
      x-schema-name: NodeAdditionalReadFields
    Node:
      allOf:
        - $ref: '#/components/schemas/NodeInfo'
        - $ref: '#/components/schemas/NodeAdditionalFields'
        - $ref: '#/components/schemas/NodeAdditionalReadFields'
      x-schema-name: Node
    NetworkTopologyUpdateFields:
      type: object
      required:
        - levels
      properties:
        levels:
          $ref: '#/components/schemas/NetworkTopologyLevels'
      x-schema-name: NetworkTopologyUpdateFields
    NetworkTopologyCreateRequest:
      allOf:
        - $ref: '#/components/schemas/NetworkTopologyUpdateFields'
        - type: object
          required:
            - name
            - clusterId
          properties:
            name:
              $ref: '#/components/schemas/NetworkTopologyName'
            clusterId:
              $ref: '#/components/schemas/ClusterId'
      x-schema-name: NetworkTopologyCreateRequest
    NetworkTopologyId:
      type: string
      format: uuid
      description: The unique identifier for the network topology
      example: 123e4567-e89b-12d3-a456-426614174000
    NetworkTopologyGroveCondition:
      type: object
      properties:
        type:
          type: string
          description: Type of the condition
        status:
          type: string
          description: Status of the condition
        reason:
          type: string
          description: Indicates the reason for the condition's last transition
        message:
          type: string
          description: A human-readable message describing the condition
        observedGeneration:
          type: integer
          format: int64
          description: Generation of the topology observed when this condition was last updated
    NetworkTopologyGrove:
      type: object
      nullable: true
      description: The linked Grove topology definition. Null if no Grove topology has been linked to this network topology
      required:
        - name
      properties:
        name:
          type: string
          description: Name of the linked Grove ClusterTopology
        domains:
          type: array
          items:
            type: string
          description: Topology levels defined in the linked Grove ClusterTopology
        conditions:
          type: array
          items:
            $ref: '#/components/schemas/NetworkTopologyGroveCondition'
          description: A list of conditions that describe the current state of the Grove ClusterTopology
    NetworkTopology:
      allOf:
        - $ref: '#/components/schemas/NetworkTopologyCreateRequest'
        - type: object
          required:
            - id
            - tenantId
            - createdAt
            - status
          properties:
            id:
              $ref: '#/components/schemas/NetworkTopologyId'
            tenantId:
              $ref: '#/components/schemas/TenantId'
            createdAt:
              type: string
              format: date-time
              description: The timestamp for when the network topology was created
            createdBy:
              type: string
              description: Identifier of the user who created the network topology
              example: user@lab.com
            phase:
              type: string
              description: 'Phase of the network topology in the cluster. Enum: Creating, Ready'
              example: Ready
            source:
              $ref: '#/components/schemas/NetworkTopologiesSource'
            nodePools:
              type: array
              items:
                type: string
              nullable: true
              readOnly: true
              description: List of node-pools associated with this network topology
              example:
                - a100
            groveTopology:
              $ref: '#/components/schemas/NetworkTopologyGrove'
      x-schema-name: NetworkTopology
    Metadata:
      type: object
      required:
        - id
        - createdAt
        - updatedAt
      properties:
        id:
          type: string
          format: uuid
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
        deletedAt:
          type: string
          nullable: true
          format: date-time
        tenantId:
          $ref: '#/components/schemas/TenantId'
    ClusterUserConfig:
      type: object
      description: Cluster configuration
      allOf:
        - $ref: '#/components/schemas/Metadata'
        - type: object
          properties:
            clusterId:
              type: string
              format: uuid
    SamlData:
      type: object
      nullable: true
      properties:
        signingCertificate:
          type: string
        singleSignOnServiceUrl:
          type: string
        entityId:
          type: string
        serviceProviderMetadataUrl:
          type: string
          description: Service Provider (SP) metadata url
    MandatoryClaim:
      type: object
      nullable: true
      required:
        - claim
        - values
      properties:
        claim:
          type: string
          pattern: .*[a-zA-Z].*
          minLength: 1
          maxLength: 255
        values:
          type: array
          minItems: 1
          maxItems: 100
          items:
            type: string
            minLength: 1
            maxLength: 255
            pattern: ^(?!.*\s).*?[a-zA-Z].*$
    OidcData:
      type: object
      nullable: true
      required:
        - clientId
        - clientSecret
        - discoverDocumentUrl
      properties:
        clientId:
          type: string
        clientSecret:
          type: string
        scopes:
          type: array
          items:
            type: string
            pattern: ^([a-zA-Z0-9-._:]+)(\s[a-zA-Z0-9-._:]+)*$
        mandatoryClaim:
          $ref: '#/components/schemas/MandatoryClaim'
    OcpData:
      type: object
      nullable: true
      properties:
        idpBaseUrl:
          type: string
        clientId:
          type: string
        clientSecret:
          type: string
        scopes:
          type: array
          items:
            type: string
    Mappers:
      type: object
      required:
        - alias
      properties:
        gid:
          type: string
          maxLength: 255
        uid:
          type: string
          maxLength: 255
        groups:
          type: string
          maxLength: 255
        supplementaryGroups:
          type: string
          maxLength: 255
        email:
          type: string
          maxLength: 254
        firstName:
          type: string
          maxLength: 255
        lastName:
          type: string
          maxLength: 255
    Idp:
      type: object
      required:
        - alias
        - type
        - redirectUri
      properties:
        alias:
          type: string
          pattern: ^[a-z0-9_-]+$
        type:
          type: string
          enum:
            - saml
            - oidc
            - openshift-v4
        redirectUri:
          type: string
        samlData:
          $ref: '#/components/schemas/SamlData'
        oidcData:
          $ref: '#/components/schemas/OidcData'
        ocpData:
          $ref: '#/components/schemas/OcpData'
        mappers:
          $ref: '#/components/schemas/Mappers'
    Idps:
      type: array
      minItems: 0
      maxItems: 100
      items:
        $ref: '#/components/schemas/Idp'
    IdpCreationRequestTypeEnum:
      type: string
      enum:
        - oidc
        - saml
        - openshift-v4
    SamlCreationDataMetadataXmlTypeEnum:
      type: string
      enum:
        - url
        - file
    SamlCreationData:
      type: object
      nullable: true
      properties:
        metadataXmlUrl:
          type: string
          pattern: /^(https?://)?([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(:[0-9]{1,5})?(/[^\s]*)?$|^$/
          maxLength: 2048
        metadataXmlFile:
          type: string
          maxLength: 100000
        fileName:
          type: string
          maxLength: 255
        metadataXmlType:
          allOf:
            - $ref: '#/components/schemas/SamlCreationDataMetadataXmlTypeEnum'
        entityId:
          type: string
          maxLength: 2048
    OidcCreationData:
      type: object
      nullable: true
      required:
        - clientId
        - clientSecret
        - discoverDocumentUrl
      properties:
        clientId:
          type: string
          minLength: 1
          maxLength: 255
        clientSecret:
          type: string
          minLength: 1
          maxLength: 500
        discoverDocumentUrl:
          type: string
          pattern: /^(https?://)?([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(:[0-9]{1,5})?(/[^\s]*)?$|^$/
          maxLength: 2048
        scopes:
          type: array
          minItems: 0
          maxItems: 50
          items:
            type: string
            pattern: ^([a-zA-Z0-9-._:]+)(\s[a-zA-Z0-9-._:]+)*$
            minLength: 1
            maxLength: 100
        mandatoryClaim:
          $ref: '#/components/schemas/MandatoryClaim'
    OcpCreationData:
      type: object
      nullable: true
      required:
        - idpBaseUrl
        - clientSecret
      properties:
        clientId:
          type: string
          minLength: 1
          maxLength: 255
        idpBaseUrl:
          type: string
          pattern: /^(https?://)?([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(:[0-9]{1,5})?(/[^\s]*)?$|^$/
          maxLength: 2048
        clientSecret:
          type: string
          minLength: 1
          maxLength: 500
        scopes:
          type: array
          minItems: 0
          maxItems: 50
          items:
            type: string
            pattern: ^([a-zA-Z0-9-._:]+)(\s[a-zA-Z0-9-._:]+)*$
            minLength: 1
            maxLength: 100
    IdpCreationRequest:
      type: object
      required:
        - type
        - data
      properties:
        name:
          type: string
          maxLength: 255
        type:
          allOf:
            - $ref: '#/components/schemas/IdpCreationRequestTypeEnum'
        samlData:
          $ref: '#/components/schemas/SamlCreationData'
        oidcData:
          $ref: '#/components/schemas/OidcCreationData'
        ocpData:
          $ref: '#/components/schemas/OcpCreationData'
        mappers:
          $ref: '#/components/schemas/Mappers'
    IdpPostResponse:
      type: object
      required:
        - alias
      properties:
        alias:
          type: string
      example:
        alias: oidc
    IdpResources:
      type: object
      properties:
        resourceName:
          type: string
        resource:
          type: string
        type:
          type: string
          enum:
            - url
            - file
    UsersFilterSortFields:
      type: string
      enum:
        - username
        - createdBy
        - lastLogin
        - creationTime
        - lastUpdated
        - type
        - firstName
        - lastName
        - fullName
    User:
      type: object
      required:
        - id
        - username
        - createdBy
        - createdAt
        - updatedAt
        - lastLogin
        - isLocal
      properties:
        id:
          type: string
        username:
          type: string
        createdBy:
          type: string
        createdAt:
          type: string
          format: date-time
          nullable: true
        updatedAt:
          type: string
          format: date-time
          nullable: true
        lastLogin:
          type: string
          format: date-time
          nullable: true
        isLocal:
          type: boolean
          nullable: true
        groups:
          type: array
          items:
            type: string
          nullable: true
        firstName:
          type: string
          maxLength: 255
        lastName:
          type: string
          maxLength: 255
      example:
        id: 3434c-12323ab-4ce2ea6-b44fc-db344d
        username: test@run.ai
        createdBy: devops@run.ai
        createdAt: '2020-01-01T00:00:00Z'
        updatedAt: '2022-01-01T00:00:00Z'
        lastLogin: '2023-02-01T00:00:00Z'
        isLocal: true
        groups:
          - groupA
          - groupB
    Users:
      type: array
      items:
        $ref: '#/components/schemas/User'
    UserCreationRequest:
      type: object
      required:
        - email
      properties:
        email:
          type: string
          pattern: ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$
          description: The email of the user. Must be a valid email address.
          minLength: 5
          maxLength: 254
        resetPassword:
          type: boolean
          nullable: true
        notify:
          type: boolean
          description: When true, send an email to the user. The email includes a link to reset the password.
          nullable: true
        firstName:
          type: string
          maxLength: 255
        lastName:
          type: string
          maxLength: 255
      example:
        email: test@run.ai
        resetPassword: false
        notify: true
    UserPostResponse:
      type: object
      required:
        - id
        - username
        - tempPassword
      properties:
        id:
          type: string
        username:
          type: string
        tempPassword:
          type: string
      example:
        id: 0eeaf222-e503-4f35-9d9c-c419816272e3
        username: test@run.ai
        tempPassword: asdasidjn9d
    UserMinimal:
      type: object
      required:
        - id
        - username
      properties:
        id:
          type: string
          description: The user's unique identifier.
        username:
          type: string
          description: The user's login name. Typically an email address.
        firstName:
          type: string
          nullable: true
          maxLength: 255
          description: The user's first name.
        lastName:
          type: string
          nullable: true
          maxLength: 255
          description: The user's last name.
      example:
        id: 3434c-12323ab-4ce2ea6-b44fc-db344d
        username: test@run.ai
        firstName: John
        lastName: Doe
    UsersMinimal:
      type: array
      items:
        $ref: '#/components/schemas/UserMinimal'
    UserPatchRequest:
      type: object
      properties:
        firstName:
          type: string
          maxLength: 255
          nullable: true
        lastName:
          type: string
          maxLength: 255
          nullable: true
      example:
        firstName: John
        lastName: Doe
    UserChangePasswordRequest:
      type: object
      required:
        - currentPassword
        - newPassword
      properties:
        currentPassword:
          type: string
          minLength: 8
          maxLength: 255
        newPassword:
          type: string
          minLength: 8
          maxLength: 255
      example:
        currentPassword: Abcd!234
        newPassword: Zxcv!567
    Groups:
      type: array
      items:
        example: group-A
        type: string
    Application:
      type: object
      required:
        - name
        - createdBy
        - createdAt
        - updatedAt
        - enabled
        - lastLogin
        - id
        - clientId
      properties:
        name:
          type: string
        createdBy:
          type: string
        createdAt:
          type: string
          format: date-time
          nullable: true
        updatedAt:
          type: string
          format: date-time
          nullable: true
        enabled:
          type: boolean
        tenantId:
          type: string
        lastLogin:
          type: string
          format: date-time
          nullable: true
        id:
          type: string
        clientId:
          type: string
      example:
        name: app123
        createdBy: test@run.ai
        createdAt: '2020-01-01T00:00:00Z'
        updatedAt: '2020-01-01T00:00:00Z'
        enabled: true
        tenantId: 1234567890
        lastLogin: '2020-01-01T00:00:00Z'
        id: 3434c-12323ab-4ce2ea6-b44fc-db344d
        clientId: app123
    Applications:
      type: array
      minItems: 0
      maxItems: 1000
      items:
        $ref: '#/components/schemas/Application'
    ApplicationCreationRequest:
      type: object
      required:
        - name
      properties:
        name:
          type: string
          pattern: ^[a-z][-_a-z0-9]*[a-z0-9]$
          description: The name of the application. The name must be unique within the organization and can only contain lowercase alphanumeric characters and hyphens. It must start and end with a letter.
          minLength: 2
          maxLength: 255
      example:
        name: app-123
    ApplicationPostResponse:
      type: object
      required:
        - id
        - name
        - secret
      properties:
        id:
          type: string
        name:
          type: string
        secret:
          type: string
        clientId:
          type: string
      example:
        id: 0eeaf222-e503-4f35-9d9c-c419816272e3
        name: app123
        secret: asdasidjn9d
        clientId: app123
    ApplicationPatchRequest:
      type: object
      required:
        - enabled
      properties:
        enabled:
          type: boolean
      example:
        enabled: true
    ServiceAccount:
      type: object
      required:
        - name
        - createdBy
        - createdAt
        - updatedAt
        - enabled
        - lastLogin
        - id
        - clientId
      properties:
        name:
          type: string
          description: The name of the service account.
        createdBy:
          type: string
          description: The email address of the user who created the service account.
        createdAt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp for when the service account was created.
        updatedAt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp for when the service account was last updated.
        enabled:
          type: boolean
          description: Indicates whether the service account is enabled.
        tenantId:
          type: string
          description: The unique identifier of the tenant.
        lastLogin:
          type: string
          format: date-time
          nullable: true
          description: The timestamp of the last time the service account was used to authenticate.
        id:
          type: string
          description: The unique identifier of the service account.
        clientId:
          type: string
          description: The client identifier associated with the service account. Used when requesting authentication tokens.
      example:
        name: service-account-123
        createdBy: test@run.ai
        createdAt: '2020-01-01T00:00:00Z'
        updatedAt: '2020-01-01T00:00:00Z'
        enabled: true
        tenantId: 1234567890
        lastLogin: '2020-01-01T00:00:00Z'
        id: 3434c-12323ab-4ce2ea6-b44fc-db344d
        clientId: service-account-123
    ServiceAccounts:
      type: array
      minItems: 0
      maxItems: 1000
      items:
        $ref: '#/components/schemas/ServiceAccount'
    ServiceAccountCreationRequest:
      type: object
      required:
        - name
      properties:
        name:
          type: string
          pattern: ^[a-z][-_a-z0-9]*[a-z0-9]$
          description: The name of the service account. The name must be unique within the organization and can only contain lowercase alphanumeric characters and hyphens. It must start and end with a letter.
          minLength: 2
          maxLength: 255
      example:
        name: service-account-123
    ServiceAccountPostResponse:
      type: object
      required:
        - id
        - name
        - clientSecret
      properties:
        id:
          type: string
          description: The unique identifier of the service account.
        name:
          type: string
          description: The name of the service account.
        clientSecret:
          type: string
          description: Secret credential paired with the client ID. Used to obtain authentication tokens. Displayed only once upon creation.
        clientId:
          type: string
          description: The client identifier associated with the service account. Used when requesting authentication tokens.
      example:
        id: 0eeaf222-e503-4f35-9d9c-c419816272e3
        name: service-account-123
        clientSecret: asdasidjn9d
        clientId: service-account-123
    ServiceAccountPatchRequest:
      type: object
      required:
        - enabled
      properties:
        enabled:
          type: boolean
          description: Indicates whether the service account is enabled.
      example:
        enabled: true
    RegenerateServiceAccountSecretResponse:
      type: object
      properties:
        clientSecret:
          type: string
          description: Secret credential paired with the client ID. Used to obtain authentication tokens. Displayed only once upon regeneration.
      example:
        clientSecret: 189ej2ijd92fj092k049fk0
    AccessKey:
      type: object
      required:
        - name
        - id
        - clientId
        - createdAt
        - lastLogin
      properties:
        name:
          type: string
          description: The name of the access key.
        clientId:
          type: string
          description: The client identifier associated with the access key. Used when requesting authentication tokens.
        id:
          type: string
          description: The unique identifier of the access key.
        createdAt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp for when the access key was created.
        lastLogin:
          type: string
          format: date-time
          nullable: true
          description: The timestamp of the last time the access key was used to authenticate.
      example:
        name: my-access-key
        id: 3434c-12323ab-4ce2ea6-b44fc-db344d
        clientId: 3434c-12323ab-4ce2ea6
        createdAt: '2019-01-01T00:00:00Z'
        lastLogin: '2020-01-01T00:00:00Z'
    AccessKeys:
      type: object
      required:
        - accessKeys
      properties:
        accessKeys:
          type: array
          minItems: 0
          maxItems: 100
          items:
            $ref: '#/components/schemas/AccessKey'
      example:
        accessKeys:
          - name: my-access-key
            id: 3434c-12323ab-4ce2ea6-b44fc-db344d
            clientId: 3434c-12323ab-4ce2ea6
            createdAt: '2019-01-01T00:00:00Z'
            lastLogin: '2020-01-01T00:00:00Z'
          - name: another-access-key
            id: 5656d-45645cd-6de3fb7-c55gd-ef455e
            clientId: 5656d-45645cd-6de3fb7
            createdAt: '2019-01-01T00:00:00Z'
            lastLogin: '2020-01-01T00:00:00Z'
    AccessKeyCreationRequest:
      type: object
      required:
        - name
      properties:
        name:
          type: string
          pattern: ^[a-z][-_a-z0-9]*[a-z0-9]$
          description: The name of the access key. The name must be unique within the user's access keys list and can only contain lowercase alphanumeric characters and hyphens. It must start and end with a letter.
          minLength: 2
          maxLength: 255
      example:
        name: access-key-name
    AccessKeyPostResponse:
      type: object
      required:
        - id
        - name
        - clientSecret
        - clientId
        - createdAt
      properties:
        id:
          type: string
          description: The unique identifier of the access key.
        clientId:
          type: string
          description: The client identifier associated with the access key. Used when requesting authentication tokens.
        name:
          type: string
          description: The name of the access key.
        clientSecret:
          type: string
          description: Secret credential paired with the client ID. Used to obtain authentication tokens. Displayed only once upon creation.
        createdAt:
          format: date-time
          nullable: true
          type: string
          description: The timestamp for when the access key was created.
      example:
        id: 0eeaf222-e503-4f35-9d9c-c419816272e3
        clientId: 5e7b3b7b4b7b4b7b
        name: access-key-123
        clientSecret: this-is-the-access-key-secret
        createdAt: '2020-01-01T00:00:00Z'
    AccessKeyAdministration:
      type: object
      required:
        - name
        - id
        - clientId
        - createdBy
        - createdAt
        - lastLogin
      properties:
        name:
          type: string
        id:
          type: string
        clientId:
          type: string
        createdBy:
          type: string
        createdAt:
          type: string
          format: date-time
          nullable: true
        lastLogin:
          type: string
          format: date-time
          nullable: true
      example:
        name: my-access-key
        id: 3434c-12323ab-4ce2ea6-b44fc-db344d
        clientId: 1434c-123233ab-4ce2ea6-b44fc-db344d
        createdBy: test@run.ai
        createdAt: '2020-01-01T00:00:00Z'
        lastLogin: '2020-01-01T00:00:00Z'
    AccessKeysAdministration:
      type: object
      required:
        - accessKeys
      properties:
        accessKeys:
          type: array
          minItems: 0
          maxItems: 100
          items:
            $ref: '#/components/schemas/AccessKeyAdministration'
      example:
        accessKeys:
          - name: my-access-key
            id: 3434c-12323ab-4ce2ea6-b44fc-db344d
            clientId: 1434c-123233ab-4ce2ea6-b44fc-db344d
            createdBy: test@run.ai
            createdAt: '2020-01-01T00:00:00Z'
            lastLogin: '2020-01-01T00:00:00Z'
          - name: another-access-key
            id: 5656d-45645cd-6de3fb7-c55gd-ef455e
            clientId: 2545e-234344bc-5df4gc8-d66he-fg566f
            createdBy: user@run.ai
            createdAt: '2020-01-01T00:00:00Z'
            lastLogin: '2020-01-01T00:00:00Z'
    UserApp:
      type: object
      required:
        - name
        - id
        - clientId
        - createdAt
        - lastLogin
      properties:
        name:
          type: string
        clientId:
          type: string
        id:
          type: string
        createdAt:
          type: string
          format: date-time
          nullable: true
        lastLogin:
          type: string
          format: date-time
          nullable: true
      example:
        name: my-user-app
        id: 3434c-12323ab-4ce2ea6-b44fc-db344d
        clientId: 3434c-12323ab-4ce2ea6
        createdAt: '2019-01-01T00:00:00Z'
        lastLogin: '2020-01-01T00:00:00Z'
    UserApps:
      type: array
      minItems: 0
      maxItems: 100
      items:
        $ref: '#/components/schemas/UserApp'
    UserAppCreationRequest:
      type: object
      required:
        - name
      properties:
        name:
          type: string
          pattern: ^[a-z][-_a-z0-9]*[a-z0-9]$
          description: The name of the user application. The name must be unique within the user's applications list and can only contain lowercase alphanumeric characters and hyphens. It must start and end with a letter.
          minLength: 2
          maxLength: 255
      example:
        name: app-name
    UserAppPostResponse:
      type: object
      required:
        - id
        - name
        - secret
        - clientId
        - createdAt
      properties:
        id:
          type: string
        clientId:
          type: string
        name:
          type: string
        secret:
          type: string
        createdAt:
          format: date-time
          nullable: true
          type: string
      example:
        id: 0eeaf222-e503-4f35-9d9c-c419816272e3
        clientId: 5e7b3b7b4b7b4b7b
        name: app123
        secret: this-is-the-app-secret
        createdAt: '2020-01-01T00:00:00Z'
    UserAppAdministration:
      type: object
      required:
        - name
        - id
        - clientId
        - createdBy
        - createdAt
        - lastLogin
      properties:
        name:
          type: string
        id:
          type: string
        clientId:
          type: string
        createdBy:
          type: string
        createdAt:
          type: string
          format: date-time
          nullable: true
        lastLogin:
          type: string
          format: date-time
          nullable: true
      example:
        name: my-user-app
        id: 3434c-12323ab-4ce2ea6-b44fc-db344d
        clientId: 1434c-123233ab-4ce2ea6-b44fc-db344d
        createdBy: test@run.ai
        createdAt: '2020-01-01T00:00:00Z'
        lastLogin: '2020-01-01T00:00:00Z'
    UserAppsAdministration:
      type: array
      minItems: 0
      maxItems: 100
      items:
        $ref: '#/components/schemas/UserAppAdministration'
    TokenRequestGrantTypeEnum:
      enum:
        - client_credentials
        - refresh_token
        - exchange_token
        - password
        - external_token_exchange
    TokenRequest:
      type: object
      properties:
        grantType:
          $ref: '#/components/schemas/TokenRequestGrantTypeEnum'
        code:
          type: string
          maxLength: 2048
        redirectUri:
          type: string
          maxLength: 2048
        refreshToken:
          type: string
          maxLength: 4096
        username:
          type: string
          maxLength: 255
        password:
          type: string
          maxLength: 255
        clientID:
          type: string
          maxLength: 255
        clientSecret:
          type: string
          maxLength: 500
        externalToken:
          type: string
          maxLength: 4096
        codeVerifier:
          type: string
          maxLength: 128
    TokenResponse:
      type: object
      properties:
        accessToken:
          type: string
        idToken:
          type: string
        refreshToken:
          type: string
        expiresIn:
          type: integer
          description: Token lifetime in seconds
    OAuth2TokenResponse:
      type: object
      required:
        - access_token
        - token_type
      properties:
        access_token:
          type: string
          description: The access token issued by the authorization server
        token_type:
          type: string
          description: The type of the token issued (typically "Bearer")
          example: Bearer
        expires_in:
          type: integer
          description: The lifetime in seconds of the access token
          example: 3600
        refresh_token:
          type: string
          description: The refresh token, which can be used to obtain new access tokens
        id_token:
          type: string
          description: ID Token value associated with the authenticated session (OpenID Connect)
        scope:
          type: string
          description: The scope of the access token
    OAuth2Error:
      type: object
      description: OAuth 2.0 error response (RFC 6749 Section 5.2)
      required:
        - error
      properties:
        error:
          type: string
          description: A single ASCII error code
          enum:
            - invalid_request
            - invalid_client
            - invalid_grant
            - unauthorized_client
            - unsupported_grant_type
            - invalid_scope
            - server_error
            - temporarily_unavailable
          example: invalid_client
        error_description:
          type: string
          description: Human-readable ASCII text providing additional information
          example: Client authentication failed
        error_uri:
          type: string
          description: URI identifying a human-readable web page with information about the error
    GetAutoRedirectSsoSetting:
      type: object
      properties:
        value:
          type: object
          properties:
            enabled:
              type: boolean
              nullable: true
            idpAlias:
              type: string
              pattern: ^[a-z0-9_-]*$
              nullable: true
              maxLength: 255
        displayName:
          type: string
          description: Human-readable name for this setting
          readOnly: true
        description:
          type: string
          description: Description of what this setting controls
          readOnly: true
      example:
        value:
          enabled: false
          idpAlias: oidc
        displayName: Auto Redirect SSO
        description: Automatically redirect users to the SSO login page after logging in to the application
    GetBrowserSessionTimeoutSetting:
      type: object
      properties:
        value:
          type: object
          properties:
            idleTimeout:
              type: number
              description: Duration in minutes that a user can remain inactive before their browser session automatically expires and requires re-authentication
              default: 0
              minimum: 0
              maximum: 10080
              nullable: true
        displayName:
          type: string
          description: Human-readable name for this setting
          readOnly: true
        description:
          type: string
          description: Description of what this setting controls
          readOnly: true
      example:
        value:
          idleTimeout: 0
        displayName: Browser Session Timeout
        description: The idle timeout duration in minutes for browser sessions
    GetLogoutRedirectUriSetting:
      type: object
      properties:
        value:
          type: object
          properties:
            uri:
              type: string
              description: The URI where users will be redirected after logging out of the application
              nullable: true
              pattern: /^(https?://)?([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(:[0-9]{1,5})?(/[^\s]*)?$|^$/
              example: https://example.com/logout
              maxLength: 2048
        displayName:
          type: string
          description: Human-readable name for this setting
          readOnly: true
        description:
          type: string
          description: Description of what this setting controls
          readOnly: true
      example:
        value:
          uri: https://example.com/logout-success
        displayName: Logout Redirect URI
        description: The URI where users will be redirected after logging out of the application
    SettingsGetResponse:
      type: object
      properties:
        autoRedirectSSO:
          $ref: '#/components/schemas/GetAutoRedirectSsoSetting'
        browserSessionTimeout:
          $ref: '#/components/schemas/GetBrowserSessionTimeoutSetting'
        logoutRedirectUri:
          $ref: '#/components/schemas/GetLogoutRedirectUriSetting'
    settingsKeyEnum:
      type: string
      enum:
        - autoRedirectSSO
        - browserSessionTimeout
        - logoutRedirectUri
    Settings:
      type: object
      additionalProperties: true
      minProperties: 0
      maxProperties: 50
    UpdateAutoRedirectSsoSettingValue:
      type: object
      properties:
        enabled:
          type: boolean
          nullable: true
        idpAlias:
          type: string
          pattern: ^[a-z0-9_-]*$
          nullable: true
          maxLength: 255
      example:
        enabled: false
        idpAlias: oidc
    UpdateBrowserSessionTimeoutSettingValue:
      type: object
      properties:
        idleTimeout:
          type: number
          description: Duration in minutes that a user can remain inactive before their browser session automatically expires and requires re-authentication
          default: 0
          minimum: 0
          maximum: 10080
          nullable: true
      example:
        idleTimeout: 0
    UpdateLogoutRedirectUriSettingValue:
      type: object
      properties:
        uri:
          type: string
          description: The URI where users will be redirected after logging out of the application
          nullable: true
          pattern: /^(https?://)?([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(:[0-9]{1,5})?(/[^\s]*)?$|^$/
          example: https://example.com/logout
          maxLength: 2048
      example:
        uri: https://example.com/logout-success
    IdpResourcdes:
      $ref: '#/components/schemas/IdpResources'
    UserGroups:
      $ref: '#/components/schemas/Groups'
    AuditLog:
      type: object
      required:
        - tenant_id
        - subject
        - subject_type
        - action
        - result
      properties:
        id:
          type: string
          format: uuid
          maxLength: 40
        timestamp:
          type: string
          format: date-time
          example: '2022-01-01T03:49:52.531Z'
        tenant_id:
          type: string
          description: the ID of the tenant
          example: 12345
        subject:
          type: string
          maxLength: 500
          minLength: 1
          description: the user/app which triggered this API
          example: researcher@run.ai
        subject_type:
          type: string
          enum:
            - User
            - App
          default: User
        source_ip:
          type: string
          format: ipv4
          maxLength: 250
        action:
          type: string
          enum:
            - create
            - update
            - delete
            - sign-in
            - sign-out
            - reset-password
        http_method:
          type: string
          enum:
            - GET
            - POST
            - PUT
            - PATCH
            - DELETE
            - CREATE
        url:
          type: string
          format: uri
          maxLength: 2000
        entity_type:
          type: string
          example: project
          maxLength: 500
        entity_name:
          type: string
          example: project-1
        entity_id:
          type: string
          example: '1234'
        result:
          type: string
          enum:
            - Succeeded
            - Failed
        http_status_code:
          type: integer
          example: 200
          maximum: 599
        cluster_name:
          type: string
          example: my favorite cluster
          maxLength: 500
        cluster_id:
          type: string
          format: uuid
          maxLength: 40
        request_id:
          type: string
          format: uuid
          example: bb0c4742-e52f-4d5e-bfee-2c4ff57c339c
          maxLength: 40
        metadata:
          type: object
          maxProperties: 10
          additionalProperties:
            type: string
    AuditLogs:
      type: array
      items:
        $ref: '#/components/schemas/AuditLog'
      x-schema-name: AuditLog
    ResourceType:
      type: string
      description: "Resource type enum for authorization. \n\nNote: The 'apps' resource type is DEPRECATED. Please use 'service-account' instead for managing service accounts.\n"
      enum:
        - department
        - tenant
        - project
        - cluster
        - cluster-config
        - nodepools
        - nodes
        - settings
        - security-settings
        - notification-settings
        - branding-settings
        - users
        - apps
        - service-account
        - roles
        - access_rules
        - workloads
        - applications
        - workspaces
        - trainings
        - inferences
        - environments
        - pvc-assets
        - git-assets
        - host-path-assets
        - nfs-assets
        - s3-assets
        - compute-resources
        - templates
        - credentials
        - events-history
        - policies
        - cm-volume-assets
        - datavolumes
        - secret-volume-assets
        - storage-class-configuration
        - access-keys
        - workload-properties
        - network-topologies
        - registries
        - workload-integration-metrics
        - nodepools-minimal
        - clusters-minimal
        - users-minimal
    ResourceTypeGroupId:
      type: string
      enum:
        - organization
        - physical-resource
        - iam
        - workload
        - workload-asset
    Action:
      type: string
      enum:
        - create
        - read
        - update
        - delete
        - sync
    Permission:
      type: object
      required:
        - resourceType
        - actions
        - groupId
        - displayName
      properties:
        resourceType:
          $ref: '#/components/schemas/ResourceType'
        displayName:
          type: string
          example: Projects
        groupId:
          $ref: '#/components/schemas/ResourceTypeGroupId'
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Action'
    Permissions:
      type: array
      items:
        $ref: '#/components/schemas/Permission'
      x-schema-name: Permissions
    KubernetesPermissions:
      type: object
      properties:
        predefinedRole:
          type: string
          description: The ID of an NVIDIA Run:ai predefined role. The custom role will include the mapped Kubernetes ClusterRole and its permissions.
          example: '12'
          nullable: true
    RoleV1:
      type: object
      required:
        - name
        - description
        - permissions
        - id
        - createdAt
        - updatedAt
        - createdBy
        - custom
        - effectiveEnabled
      properties:
        id:
          type: integer
          format: int32
          example: 32
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
        deletedAt:
          type: string
          nullable: true
          format: date-time
        createdBy:
          type: string
          example: user@run.ai
        custom:
          type: boolean
        effectiveEnabled:
          type: boolean
          default: true
        permissions:
          $ref: '#/components/schemas/Permissions'
        name:
          type: string
          example: admin
        description:
          type: string
          example: can manage all resources
        enabled:
          type: boolean
          default: true
          nullable: true
        kubernetesPermissions:
          $ref: '#/components/schemas/KubernetesPermissions'
    RolesV1:
      type: array
      items:
        $ref: '#/components/schemas/RoleV1'
    RolesSortFilterFields:
      type: string
      enum:
        - name
        - createdAt
        - createdBy
        - custom
        - scopeType
        - enabled
    RolePermissionSet:
      type: object
      required:
        - id
      properties:
        id:
          type: string
          format: uuid
          description: The universally unique ID (UUID) of the permission set.
        name:
          type: string
          description: The name of the permission set.
          example: test
    RoleCreationFields:
      type: object
      required:
        - name
        - description
      properties:
        name:
          type: string
          description: The name of the role to create. Must be unique within the given scope.
          example: admin
          minLength: 1
        description:
          type: string
          description: A description of the role.
          example: can manage all resources
        scopeType:
          type: string
          default: tenant
          description: 'The type of scope where the role applies. Valid values: system, tenant'
          enum:
            - system
            - tenant
        scopeId:
          type: string
          description: The ID of the scope where this role is defined.
          nullable: true
        enabled:
          type: boolean
          default: true
          description: 'Specifies whether the role is active. Default: true'
          nullable: true
        permissionSets:
          type: array
          description: The permission sets assigned to this role. Each item includes the UUID and name of the permission set.
          items:
            $ref: '#/components/schemas/RolePermissionSet'
        kubernetesPermissions:
          allOf:
            - $ref: '#/components/schemas/KubernetesPermissions'
          description: Defines the Kubernetes cluster permissions associated with this role.
    PermissionAction:
      type: string
      enum:
        - create
        - read
        - update
        - delete
    RolePermission:
      type: object
      required:
        - resourceType
        - actions
      properties:
        resourceType:
          description: The type of resource the permission applies to.
          $ref: '#/components/schemas/ResourceType'
        actions:
          type: array
          description: |
            The list of allowed actions for this resource
            - create
            - read
            - update
            - delete
          items:
            $ref: '#/components/schemas/PermissionAction'
    RolePermissions:
      type: array
      items:
        $ref: '#/components/schemas/RolePermission'
    RoleCalculatedFields:
      type: object
      required:
        - id
        - createdAt
        - updatedAt
        - createdBy
        - custom
        - effectiveEnabled
        - permissions
      properties:
        id:
          type: integer
          format: int32
          description: The ID of the role.
          example: 32
        createdAt:
          type: string
          description: The timestamp for when the role was created.
          format: date-time
        updatedAt:
          type: string
          description: The timestamp for the last time the role was updated.
          format: date-time
        createdBy:
          type: string
          description: Identifier of the user who created the role.
          example: user@run.ai
        effectiveEnabled:
          type: boolean
          description: 'Indicates whether the role is effectively enabled in the tenant. This reflects the role’s operational state after considering tenant-level configuration or restrictions. Default: true'
          default: true
        deprecated:
          type: boolean
          description: Indicates whether the role is deprecated. When set to true, the role is considered deprecated and should not be used for new assignments.
        permissions:
          $ref: '#/components/schemas/RolePermissions'
    Role:
      allOf:
        - $ref: '#/components/schemas/RoleCreationFields'
        - $ref: '#/components/schemas/RoleCalculatedFields'
    Roles1:
      type: array
      items:
        $ref: '#/components/schemas/Role'
      x-schema-name: Roles
    RoleCreationFieldsInternal:
      allOf:
        - $ref: '#/components/schemas/RoleCreationFields'
        - type: object
          required:
            - name
            - description
    RoleEnabledDisabledFields:
      type: object
      properties:
        scopeType:
          type: string
          default: tenant
          enum:
            - system
            - tenant
    PermissionSet:
      allOf:
        - $ref: '#/components/schemas/RolePermissionSet'
        - type: object
          required:
            - name
            - permissions
          properties:
            description:
              type: string
              description: A description of the permission set.
            permissions:
              $ref: '#/components/schemas/RolePermissions'
    PermissionSets:
      type: array
      items:
        $ref: '#/components/schemas/PermissionSet'
    AccessRulesSortFilterFields:
      type: string
      enum:
        - subjectId
        - subjectType
        - roleId
        - scopeId
        - scopeType
        - roleName
        - scopeName
        - createdAt
        - deletedAt
        - createdBy
        - phase
    SubjectType:
      type: string
      description: |
        Subject type enum for access rules.

        Note: The 'app' subject type is DEPRECATED. Please use 'service-account' instead for service accounts.
      enum:
        - user
        - app
        - service-account
        - group
    ScopeType:
      type: string
      enum:
        - system
        - tenant
        - cluster
        - department
        - project
    AccessRuleCreationFields:
      type: object
      required:
        - subjectId
        - subjectType
        - roleId
        - scopeId
        - scopeType
      properties:
        subjectId:
          type: string
          example: user@run.ai
          description: The unique identifier of the subject (e.g., user, group, or app).
        subjectType:
          allOf:
            - $ref: '#/components/schemas/SubjectType'
            - description: 'The subject assigned to the access rule. Valid values: user, group, app.'
        roleId:
          type: integer
          format: int32
          description: The numeric ID of the assigned role.
          example: 53142648
        scopeId:
          type: string
          description: The unique identifier of the scope.
          example: a418ed33-9399-48c0-a890-122cadd13bfd
        scopeType:
          allOf:
            - $ref: '#/components/schemas/ScopeType'
            - description: 'The type of scope the access rule applies to. Valid values: system, tenant, cluster, department, project.'
        clusterId:
          $ref: '#/components/schemas/ClusterId'
    EnrichmentDataFields:
      type: object
      required:
        - roleName
        - scopeName
      properties:
        roleName:
          type: string
          description: The name of the assigned role (e.g., admin, viewer).
          example: admin
        scopeName:
          type: string
          description: Human-readable name of the scope (e.g., tenant-x).
          example: tenant-x
    AccessRuleMetadataFields:
      type: object
      required:
        - id
        - createdAt
        - updatedAt
        - createdBy
      properties:
        id:
          type: integer
          format: int32
          description: The ID of the access rule entry.
          example: 32
        createdAt:
          type: string
          format: date-time
          description: The timestamp for when the access rule was created.
        updatedAt:
          type: string
          format: date-time
          description: The timestamp for the last time the access rule was updated.
        deletedAt:
          type: string
          nullable: true
          format: date-time
          description: The timestamp indicating when the access rule was deleted.
        tenantId:
          $ref: '#/components/schemas/TenantId'
        createdBy:
          type: string
          example: user@run.ai
          description: Identifier of the user who created the access rule.
    AccessRulePhase:
      type: string
      enum:
        - Creating
        - Ready
        - NotReady
        - Deleting
      description: Phase of the Access Rule in the cluster.
      example: Ready
    AccessRuleStatusResponse:
      type: object
      description: Status of the Access Rule in the cluster. Available only for clusters of version 2.22.0 or above.
      properties:
        phase:
          $ref: '#/components/schemas/AccessRulePhase'
        message:
          type: string
          description: Message for status of Access Rule in the cluster
          example: Failed to enforce department 'department-a'
        details:
          type: string
          description: Details for status of Access Rule in the clusters
          example: 'NotReady: [cluster1-uuid]; Ready: [cluster2-uuid, cluster3-uuid]'
    AccessRule:
      allOf:
        - $ref: '#/components/schemas/AccessRuleCreationFields'
        - $ref: '#/components/schemas/EnrichmentDataFields'
        - $ref: '#/components/schemas/AccessRuleMetadataFields'
        - type: object
          properties:
            status:
              $ref: '#/components/schemas/AccessRuleStatusResponse'
        - required:
            - tenantId
    AccessRules:
      type: array
      items:
        $ref: '#/components/schemas/AccessRule'
      x-schema-name: AccessRules
    AccessRuleSync:
      allOf:
        - $ref: '#/components/schemas/AccessRuleCreationFields'
        - $ref: '#/components/schemas/EnrichmentDataFields'
        - $ref: '#/components/schemas/AccessRuleMetadataFields'
        - type: object
          properties:
            predefinedRole:
              type: object
              nullable: true
              properties:
                id:
                  type: string
                  description: Id of the predefined role for cluster permissions
                  example: '12'
                name:
                  type: string
                  description: Name of the predefined role for cluster permissions
                  example: admin
            isDeleting:
              type: boolean
              default: false
              description: Indicates if the access rule is in 'Deleting' phase and should be deleted from the cluster
              example: false
    AccessRuleById:
      allOf:
        - $ref: '#/components/schemas/AccessRule'
        - properties:
            scopePath:
              type: string
              nullable: true
              example: runai/production-cluster/dep-42/prj-73
    AccessRuleClusterPhase:
      type: string
      enum:
        - Ready
        - NotReady
        - Deleted
      description: Phase of the Access Rule in the cluster
      example: Ready
    AccessRuleStatusRequest:
      type: object
      required:
        - phase
        - message
      properties:
        phase:
          $ref: '#/components/schemas/AccessRuleClusterPhase'
        message:
          type: string
          description: Message for status of Access Rule in the cluster
          example: Failed to enforce department 'department-a'
    AccessRuleForSync:
      allOf:
        - $ref: '#/components/schemas/AccessRuleStatusRequest'
        - type: object
          required:
            - accessRuleId
          properties:
            accessRuleId:
              type: integer
              format: int32
              minimum: 0
              description: The id of the access rule to retrieve
              example: 32
    AccessRulesBatchAction:
      type: string
      description: Specifies the operation to perform. Must be set to "delete".
      enum:
        - delete
        - validate_delete
    AccessRulesBatchFields:
      type: object
      description: Deletes a batch of access rules in a single operation. It requires a list of rule IDs and an action flag explicitly set to "delete". It returns the result of the operation, including which items were successfully deleted and which failed.
      required:
        - ids
        - action
      properties:
        ids:
          type: array
          description: List of access rule IDs to delete.
          minItems: 1
          maxItems: 100
          items:
            type: string
            format: uuid
            description: Access rule ID to delete.
        action:
          $ref: '#/components/schemas/AccessRulesBatchAction'
    AccessRuleDeletionBatchId:
      type: string
      format: uuid
      description: The unique ID of the batch operation.
    AccessRuleDeletionBatchIdsList:
      type: array
      description: List of access rule IDs that were successfully deleted.
      items:
        type: string
        format: uuid
      minLength: 1
    AccessRuleDeletionBatchErrorCode:
      type: integer
      format: int32
      description: A numeric code representing the error type.
    AccessRuleDeletionBatchErrorMessage:
      type: string
      description: A human-readable message describing the access rule IDs that failed to delete.
    AccessRuleDeletionBatchResponseFailureItem:
      type: object
      required:
        - id
        - code
        - message
      properties:
        id:
          type: string
          format: uuid
        code:
          $ref: '#/components/schemas/AccessRuleDeletionBatchErrorCode'
        message:
          $ref: '#/components/schemas/AccessRuleDeletionBatchErrorMessage'
    AccessRuleDeletionBatchResponse:
      type: object
      required:
        - id
      properties:
        id:
          $ref: '#/components/schemas/AccessRuleDeletionBatchId'
        succeeded:
          $ref: '#/components/schemas/AccessRuleDeletionBatchIdsList'
        failed:
          type: array
          description: Details of the access rule IDs that failed to delete.
          items:
            $ref: '#/components/schemas/AccessRuleDeletionBatchResponseFailureItem'
    AccessRuleSubjects:
      type: array
      description: subjects for the access rules. must have at least one value
      minItems: 1
      maxItems: 100
      items:
        type: object
        required:
          - subjectId
          - subjectType
        properties:
          subjectId:
            type: string
            description: The unique identifier of the subject e.g., user, group, or app).
            example: user@run.ai
          subjectType:
            allOf:
              - $ref: '#/components/schemas/SubjectType'
              - description: 'The subject assigned to the access rule. Valid values: user, group, app.'
    ScopeId:
      type: string
      description: The id of the cluster, department or project, depending on the scope type.
    AccessRuleScopes:
      type: array
      description: scopes for the access rules. must have at least one value
      minItems: 1
      maxItems: 50
      items:
        type: object
        required:
          - scopeId
          - scopeType
        properties:
          scopeId:
            $ref: '#/components/schemas/ScopeId'
          scopeType:
            allOf:
              - $ref: '#/components/schemas/ScopeType'
              - description: 'The scope to apply the access rule to. Valid values: system, tenant, cluster, department, project.'
    AccessRulesBatchCreateFields:
      type: object
      required:
        - payload
      properties:
        payload:
          type: object
          description: An array of access rule objects, each containing the role, subject, cluster, and scope to apply.
          required:
            - subjects
            - roleId
            - scopes
          properties:
            roleId:
              type: integer
              format: int32
              description: The numeric ID of the role to assign (e.g., admin, viewer).
              example: 53142648
            clusterId:
              $ref: '#/components/schemas/ClusterId'
            subjects:
              $ref: '#/components/schemas/AccessRuleSubjects'
            scopes:
              $ref: '#/components/schemas/AccessRuleScopes'
    ErrorCode:
      type: integer
      format: int32
      description: A numeric code representing the error type.
    AccessRulesBatchCreateResponse:
      type: object
      properties:
        succeeded:
          type: array
          items:
            $ref: '#/components/schemas/AccessRule'
        failed:
          type: array
          items:
            properties:
              payload:
                $ref: '#/components/schemas/AccessRuleCreationFields'
              code:
                $ref: '#/components/schemas/ErrorCode'
              message:
                type: string
                description: A human-readable message describing the access rule IDs that failed to create.
    PermittedScopes:
      type: object
      properties:
        system:
          type: boolean
          example: false
        tenants:
          type: array
          items:
            type: string
            example: '1'
        clusters:
          type: array
          items:
            type: string
            example: a418ed33-9399-48c0-a890-122cadd13bfd
        departments:
          type: array
          items:
            type: string
            example: '7'
        projects:
          type: array
          items:
            type: string
    PermittedScopesActions:
      type: object
      required:
        - create
        - read
        - update
        - delete
      properties:
        create:
          $ref: '#/components/schemas/PermittedScopes'
        read:
          $ref: '#/components/schemas/PermittedScopes'
        update:
          $ref: '#/components/schemas/PermittedScopes'
        delete:
          $ref: '#/components/schemas/PermittedScopes'
    MeAccessRule:
      allOf:
        - $ref: '#/components/schemas/AccessRuleCreationFields'
        - $ref: '#/components/schemas/EnrichmentDataFields'
        - required:
            - tenantId
        - properties:
            id:
              type: integer
              format: int32
              example: 32
            tenantId:
              $ref: '#/components/schemas/TenantId'
    MeAccessRules:
      type: array
      items:
        $ref: '#/components/schemas/MeAccessRule'
      x-schema-name: MeAccessRules
    MeAccessRulesResponse:
      type: object
      properties:
        accessRules:
          type: object
          required:
            - totalRecords
            - displayRecords
            - accessRules
          properties:
            totalRecords:
              type: integer
              example: 1
            displayRecords:
              type: integer
              example: 1
            accessRules:
              $ref: '#/components/schemas/MeAccessRules'
    EnableScopedAuthorizationSetting:
      type: object
      properties:
        enabled:
          type: boolean
          nullable: true
      example:
        enabled: false
    TenantIsCspManagedSetting:
      type: object
      properties:
        enabled:
          type: boolean
          nullable: true
      example:
        enabled: false
    AuthorizationSettingsGetResponse:
      type: object
      properties:
        enableScopedAuthorization:
          $ref: '#/components/schemas/EnableScopedAuthorizationSetting'
        tenantIsCspManaged:
          $ref: '#/components/schemas/TenantIsCspManagedSetting'
    AuthorizationSettingsKeyEnum:
      type: string
      enum:
        - enableScopedAuthorization
        - tenantIsCspManaged
    UpdateAuthorizationSettingByKeyRequest:
      type: object
      properties:
        enabled:
          type: boolean
          nullable: true
      example:
        enabled: false
    AccessRulesFilterFields:
      $ref: '#/components/schemas/AccessRulesSortFilterFields'
  responses:
    400BadRequest:
      description: Bad request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 400
            message: Required parameter is missing
    401Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 401
            message: Issuer is not familiar.
    403Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 403
            message: You do not have sufficient permissions.
    500InternalServerError:
      description: unexpected error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 500
            message: Something went wrong.
    503ServiceUnavailable:
      description: unexpected error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 503
            message: Please try again in few minutes.
    404NotFound:
      description: The specified resource was not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 404
            message: Resource id not found.
    409Conflict:
      description: The specified resource already exists
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 409
            message: Resource with this name already exists
    204NoContent:
      description: No Content.
    202Accepted:
      description: Accepted.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/HttpResponse'
          example:
            code: 202
            message: Request has been accepted.
    422UnprocessableEntity:
      description: Unprocessable entity - The request was well-formed but contains semantic errors.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 422
            message: Validation failed - Invalid workload configuration
  parameters:
    deleted:
      name: deleted
      in: query
      description: Include soft-deleted tenants in the response when `true`.
      schema:
        type: boolean
        default: false
    filterByName:
      name: name
      in: query
      required: false
      description: Filter tenants by name
      schema:
        type: string
    filterByAlias:
      name: alias
      in: query
      required: false
      description: Filter tenants by alias
      schema:
        type: string
    tenantId:
      name: tenantId
      in: path
      required: true
      description: The id of the tenant to retrieve
      schema:
        type: integer
        format: int32
        minimum: 0
    isHardDelete:
      name: isHardDelete
      in: query
      description: Boolean indicator for soft/hard delete
      schema:
        type: boolean
    ClusterUuid:
      name: clusterUuid
      in: path
      required: true
      description: The Universally Unique Identifier (UUID) of the cluster.
      schema:
        type: string
        format: uuid
        minLength: 1
        example: 9f55255e-11ed-47c7-acef-fc4054768dbc
    Search:
      name: search
      in: query
      required: false
      description: Filter results by a free text search.
      schema:
        type: string
        example: test project
    NodeName:
      name: nodeName
      in: path
      description: The node name.
      schema:
        type: string
      required: true
    QueryVerbosity:
      name: verbosity
      in: query
      required: false
      description: |
        response verbosity level.
      example: full
      schema:
        type: string
        enum:
          - metadata
          - full
        default: full
    QueryIncludeRequestedForDelete:
      name: includeRequestedForDelete
      in: query
      required: false
      example: true
      schema:
        type: boolean
      description: When true, includes clusters that are marked for deletion
    ClustersMinimalFilterBy:
      name: filterBy
      in: query
      required: false
      description: Filter clusters by a parameter. Use the format field-name operator value. Operators are == Equals, != Not equals, <= Less than or equal, >= Greater than or equal. Dates are in ISO 8601 timestamp format and available for operators ==, !=, <= and >=.
      schema:
        type: array
        maxItems: 10
        items:
          type: string
          pattern: ^(name)(==|!=|<=|>=|=@|!@|=\^|=\$).+$
        example:
          - name==my-cluster
      explode: false
    Offset:
      name: offset
      in: query
      required: false
      description: The offset of the first item returned in the collection.
      schema:
        type: integer
        format: int32
        example: 100
    Limit:
      name: limit
      in: query
      required: false
      description: The maximum number of entries to return.
      schema:
        type: integer
        format: int32
        default: 50
        minimum: 1
        maximum: 500
    QueryForceDelete:
      name: force
      in: query
      required: false
      description: |
        if true will force cluster instant deletion otherwise will start cluster graceful deletion process.
      example: true
      schema:
        type: boolean
        default: false
    StartRequired:
      name: start
      in: query
      description: Start date of time range to fetch data in ISO 8601 timestamp format.
      required: true
      schema:
        type: string
        format: date-time
        example: '2023-06-06T12:09:18.211Z'
    EndRequired:
      name: end
      in: query
      description: End date of time range to fetch data in ISO 8601 timestamp format.
      required: true
      schema:
        type: string
        format: date-time
        example: '2023-06-07T12:09:18.211Z'
    NumberOfSamples:
      name: numberOfSamples
      in: query
      description: The number of samples to take in the specified time range.
      required: false
      schema:
        type: integer
        example: 20
        maximum: 1000
        minimum: 0
        default: 20
    MetricsType:
      name: metricType
      in: query
      required: true
      description: specifies what data to request
      explode: false
      schema:
        type: array
        items:
          $ref: '#/components/schemas/MetricsType'
    ClusterMetricsGroupBy:
      name: groupBy
      in: query
      description: |
        Labels to group the returned metrics data by. Grouping availability depends on the selected metric type. Supported values: "category" (workload category) or "node pool".
      explode: false
      required: false
      schema:
        type: string
        enum:
          - Category
          - Nodepool
          - Project
          - Department
      example: Category
    FilterByNodepoolName:
      name: nodepoolName
      in: query
      description: Filter using the nodepool.
      required: false
      schema:
        type: string
        example: default
    SortOrder:
      name: sortOrder
      in: query
      required: false
      description: Sort results in descending or ascending order.
      schema:
        type: string
        enum:
          - asc
          - desc
        default: asc
    ClusterVersion:
      name: version
      in: query
      required: true
      description: The cluster version to install
      schema:
        type: string
        example: 2.16
    ClusterRemoteURL:
      name: remoteClusterUrl
      in: query
      required: false
      description: The remote URL of the runai cluster
      schema:
        type: string
        example: https://cluster.runai
    FilterByCluster:
      name: clusterId
      in: query
      description: Filter using the Universally Unique Identifier (UUID) of the cluster.
      required: false
      schema:
        type: string
        format: uuid
        example: d73a738f-fab3-430a-8fa3-5241493d7128
    TenantId:
      name: tenantId
      in: query
      required: false
      description: If exists will return the relevant resource for the tenant ID
      example: '1008'
      schema:
        type: string
        default: ''
    nodeName:
      $ref: '#/components/parameters/NodeName'
    queryVerbosity:
      $ref: '#/components/parameters/QueryVerbosity'
    idp:
      name: idp
      in: path
      required: true
      description: The alias of the idp
      schema:
        type: string
    usersFilterBy:
      name: filterBy
      in: query
      required: false
      description: Filter results by a parameter. Use the format field-name operator value. Operators are <= Less than or equal, >= Greater than or equal, =@ contains. Dates are in ISO 8601 timestamp format and available for operators <=, >= and ==.
      schema:
        type: array
        items:
          type: string
          pattern: ^((username|createdBy|lastLogin|creationTime|lastUpdated|isLocal)(==|<=|>=|=@)|(firstName|lastName|fullName)(=@)).+$
        example:
          - username=@test,lastLogin>=2024-09-24T00:00:00.00Z,isLocal==false
      explode: false
    usersSortBy:
      name: sortBy
      in: query
      required: false
      description: Sort results by a parameters.
      schema:
        $ref: '#/components/schemas/UsersFilterSortFields'
    limit:
      name: limit
      in: query
      required: false
      description: The maximum number of entries to return.
      schema:
        type: integer
        format: int32
        default: 500
        minimum: 1
        maximum: 500
    search:
      name: search
      in: query
      required: false
      description: Filter results by a free text search.
      schema:
        type: string
        example: test@run
    usersMinimalFilterBy:
      name: filterBy
      in: query
      required: false
      description: |
        Filter results by username. Use the format field-name operator value. Supported operators are == (exact match) and =@ (contains).
        Multiple entries (up to 25) are allowed only with the == operator.
      schema:
        type: array
        maxItems: 25
        items:
          type: string
          pattern: ^username(==|=@).+$
        example:
          - username==test@run.ai
      explode: false
    usersMinimalSearch:
      name: search
      in: query
      required: false
      description: Filter results by a free text search across username, firstName and lastName (OR logic). Minimum 2 characters.
      schema:
        type: string
        minLength: 2
        maxLength: 100
        example: john
    usersMinimalId:
      name: id
      in: query
      required: false
      description: Bulk lookup by user IDs (comma-separated). Returns the matching users in addition to any results from `search` or `filterBy`. Up to 25 IDs per request.
      schema:
        type: array
        maxItems: 25
        items:
          type: string
        example:
          - 8e3f0a4b-4d3c-4f6e-9d2a-1c5e0a8b7f6d
      explode: false
    userId:
      name: userId
      in: path
      required: true
      description: The id of the user
      schema:
        type: string
    appId:
      name: appId
      in: path
      required: true
      description: The application id to retrieve
      schema:
        type: string
    serviceAccountId:
      name: serviceAccountId
      in: path
      required: true
      description: Service account id
      schema:
        type: string
        example: 6d2894ba-f998-4039-bba1-caba57caf681
    accessKeyId:
      name: accessKeyId
      in: path
      required: true
      description: The access key ID
      schema:
        type: string
    settingsKey:
      name: key
      in: path
      required: true
      description: The settings key
      schema:
        $ref: '#/components/schemas/settingsKeyEnum'
    exchangeCode:
      name: code
      in: query
      required: true
      description: The exchange code retrieved from the idp server
      schema:
        type: string
    redirectUri:
      name: redirect_uri
      in: query
      required: true
      description: The redirect uri to redirect to after the authorization server completes the authorization flow
      schema:
        type: string
    refreshToken:
      name: refresh_token
      in: query
      required: true
      description: The refresh token retrieved from the idp server
      schema:
        type: string
    appType:
      name: appType
      in: query
      required: true
      description: The type of application
      schema:
        type: string
        enum:
          - Agent
          - MimirWriter
    code:
      $ref: '#/components/parameters/exchangeCode'
    redirect_url:
      $ref: '#/components/parameters/redirectUri'
    refresh_token:
      $ref: '#/components/parameters/refreshToken'
    app_type:
      $ref: '#/components/parameters/appType'
    is_hard_delete:
      $ref: '#/components/parameters/isHardDelete'
    AuditLogSort:
      name: sortBy
      in: query
      required: false
      description: Sort results by a parameters.
      schema:
        type: string
        enum:
          - timestamp
          - subject
          - subject_type
          - source_ip
          - action
          - http_method
          - result
          - url
          - entity_type
          - entity_name
          - entity_id
    AuditLogFilter:
      name: filterBy
      in: query
      required: false
      explode: false
      description: Filter results by a parameter. Use the format field-name operator value. Operators are == Equals, != Not equals, <= Less than or equal, >= Greater than or equal, =@ contains, !@ Does not contains, =^ Starts with and =$ Ends with. Dates are in ISO 8601 timestamp format and available for operators ==, !=, <= and >=.
      schema:
        type: array
        items:
          type: string
          pattern: ^(timestamp|subject|subject_type|source_ip|action|result|url|entity_type|entity_name|cluster_name)(==|!=|<=|>=|=@|!@|=\^|=\$).+$
        example:
          - cluster_name==my-cluster_name
          - entity_type==cluster,entity_name==test
    NumberOfSamplesFileDownload:
      name: numberOfSamples
      in: query
      description: Maximum number of records to include in the file. The hard cap is 100,000. Use the offset parameter to page through additional records.
      required: false
      schema:
        type: integer
        minimum: 0
        maximum: 100000
        default: 20
    RoleIdPath:
      name: roleIdPath
      in: path
      required: true
      description: The ID of the role
      example: 32
      schema:
        type: integer
        format: int32
        minimum: 0
    RolesSort:
      name: sortBy
      in: query
      required: false
      description: Sort results by a parameter.
      schema:
        $ref: '#/components/schemas/RolesSortFilterFields'
    RolesFilter:
      name: filterBy
      in: query
      required: false
      description: Filter results by a parameter. Use the format field-name operator value. Operators are == Equals, != Not equals, <= Less than or equal, >= Greater than or equal, =@ contains, !@ Does not contains, =^ Starts with and =$ Ends with. Dates are in ISO 8601 timestamp format and available for operators ==, !=, <= and >=.
      schema:
        type: array
        maxItems: 10
        items:
          type: string
          pattern: ^(name|createdAt|createdBy|custom|scopeType|enabled)(==|!=|<=|>=|=@|!@|=\^|=\$).+$
      example:
        - name!=some-access-rule-name
        - createdAt>=2023-01-01T00:00:00Z
      explode: false
    PermissionSetId:
      name: permissionSetId
      in: path
      required: true
      schema:
        type: string
        format: uuid
    SubjectTypeOptional:
      name: subjectType
      in: query
      required: false
      description: The type of resource we want to filter by.
      schema:
        type: string
        example: user
    SubjectIds:
      name: subjectIds
      in: query
      required: false
      description: The ids of the subjects to filter the response for.
      explode: false
      schema:
        type: array
        maxItems: 100
        items:
          type: string
          example: some.user@run.ai
    LastUpdated:
      name: lastUpdated
      in: query
      required: false
      description: Filter by last update time.
      schema:
        type: string
        example: '2021-12-14T16:04:15.099Z'
    IncludeDeleted:
      name: includeDeleted
      in: query
      required: false
      description: True to include deleted objects in the result.
      schema:
        type: boolean
        example: false
        default: false
    ScopeIdOptional:
      name: scopeId
      in: query
      required: false
      description: The scope resource id that we want to filter by.
      schema:
        type: string
        example: '2'
    AccessRulesSort:
      name: sortBy
      in: query
      required: false
      description: Sort results by a parameter.
      schema:
        $ref: '#/components/schemas/AccessRulesSortFilterFields'
    AccessRulesFilter:
      name: filterBy
      in: query
      required: false
      description: Filter results by a parameter. Use the format field-name operator value. Operators are == Equals, != Not equals, <= Less than or equal, >= Greater than or equal, =@ contains, !@ Does not contains, =^ Starts with and =$ Ends with. Dates are in ISO 8601 timestamp format and available for operators ==, !=, <= and >=.
      schema:
        type: array
        maxItems: 10
        items:
          type: string
          pattern: ^(subjectId|subjectType|roleId|scopeId|scopeType|roleName|scopeName|createdAt|deletedAt|createdBy|phase)(==|!=|<=|>=|=@|!@|=\^|=\$).+$
      example:
        - name!=some-access-rule-name
        - createdAt>=2023-01-01T00:00:00Z
      explode: false
    AccessRuleId:
      name: accessRuleId
      in: path
      required: true
      description: The id of the access rule to retrieve
      example: 32
      schema:
        type: integer
        format: int32
        minimum: 0
    AuthorizationSettingsKey:
      name: key
      in: path
      required: true
      description: The settings key
      schema:
        $ref: '#/components/schemas/AuthorizationSettingsKeyEnum'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer authentication
x-tagGroups:
  - name: Organizations
    tags:
      - Settings
      - Clusters
  - name: Authentication and Authorization
    tags:
      - Access Keys
      - Access rules
      - Permissions
      - Applications
      - Service Accounts
      - Roles
      - Tokens
      - Users
      - User Applications
      - Idps
      - Me
  - name: Audit
    tags:
      - AuditLogs
