openapi: 3.0.1
info:
  title: JIT Mapping Service
  description: The JIT Mapping Service provides APIs for upserting, deleting, and retrieving JIT (Just-In-Time) Claims Mappings for a tenant, used for JIT provisioning.
  version: '1.0'
tags:
  - name: JitMappingService
security:
  - Authorization: []
paths:
  /tenants/jit-mappings:
    get:
      summary: |-
        *
        Retrieves the JIT Mapping of a tenant.
        Permission level: read
      operationId: JitMappingService_GetJitMapping
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2GetJitMappingResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/rpcStatus'
      parameters:
        - name: tenantId
          description: 'The Tenant ID of the JIT Mapping. Default: token''s tenant.'
          in: query
          required: false
          schema:
            type: string
      tags:
        - JitMappingService
    delete:
      summary: |-
        *
        Deletes the JIT Mapping of a tenant.
        Permission level: read-write
      operationId: JitMappingService_DeleteJitMapping
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                type: object
                properties: {}
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/rpcStatus'
      parameters:
        - name: tenantId
          description: 'The Tenant ID of the JIT Mapping. Default: token''s tenant.'
          in: query
          required: false
          schema:
            type: string
      tags:
        - JitMappingService
    put:
      summary: |-
        *
        Upserts a JIT Mapping for a tenant. The Mapping is unique per tenant.
        Permission level: read-write
      operationId: JitMappingService_UpsertJitMapping
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2UpsertJitMappingResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/rpcStatus'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v2UpsertJitMappingRequest'
        required: true
      tags:
        - JitMappingService
servers:
  - url: https://prod-ui-zwseuprod01p.pp.zebra.com/api
    description: EU Server
  - url: https://prod-ui-zwsusprod01p.pp.zebra.com/api
    description: NA Server
components:
  schemas:
    protobufAny:
      type: object
      properties:
        '@type':
          type: string
      additionalProperties: {}
    rpcStatus:
      type: object
      properties:
        code:
          type: integer
          format: int32
        message:
          type: string
        details:
          type: array
          items:
            $ref: '#/components/schemas/protobufAny'
    v2GetJitMappingResponse:
      type: object
      properties:
        mapping:
          $ref: '#/components/schemas/v2JitMappingProto'
    v2JitMappingProto:
      type: object
      properties:
        tenantId:
          type: string
          description: |-
            The Tenant ID of the JIT Mapping. There can only be one JIT Mapping per tenant.
            Required: false. Default: token's tenant.
        defaultDomain:
          type: string
          description: |-
            the default domain of the template, this value is used if an oidc_claim is not mapped in the template.
            Required: false. Default: platform.
        defaultScope:
          type: string
          description: |-
            the default scope of the template, this value is used if an oidc_claim is not mapped in the template.
            Required: false. Default: core.
        attributes:
          type: array
          items:
            $ref: '#/components/schemas/v2MappingAttributeProto'
          description: List of attribute mappings from OIDC claims to User domain fields or custom attribute fields.
    v2MappingAttributeProto:
      type: object
      properties:
        oidcClaim:
          type: string
          title: The OIDC claim in the source ID Token
        userField:
          $ref: '#/components/schemas/v2UserFields'
        scope:
          type: string
          title: 'This field will only be used for assigned_roles or a custom_attribute_field_name, Default: ""'
        domain:
          type: string
          title: 'This field will only be used for assigned_roles or a custom_attribute_field_name, Default: "platform"'
    v2UpsertJitMappingRequest:
      type: object
      properties:
        mapping:
          $ref: '#/components/schemas/v2JitMappingProto'
    v2UpsertJitMappingResponse:
      type: object
      properties:
        mapping:
          $ref: '#/components/schemas/v2JitMappingProto'
    v2UserDomainFieldName:
      type: string
      enum:
        - FIRST_NAME
        - LAST_NAME
        - EMAIL
        - ASSIGNED_ROLES
        - PRIMARY_SITE
        - SELECTED_DEPARTMENTS
        - MIDDLE_NAME
        - PREFERRED_NAME
      default: FIRST_NAME
    v2UserFields:
      type: object
      properties:
        domainFieldName:
          $ref: '#/components/schemas/v2UserDomainFieldName'
        customAttributeFieldName:
          type: string
  securitySchemes:
    Authorization:
      type: apiKey
      description: Bearer token
      name: Authorization
      in: header