openapi: 3.0.1 info: title: Tenant Service description: The Tenant service provides a variety of APIs for creating, deleting, and retrieving tenants. version: '2.0' tags: - name: TenantService security: - Authorization: [] paths: /tenants: get: summary: |- Return a list of tenants. Permission Level: Read operationId: TenantService_ListTenants responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsListTenantsResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' parameters: - name: pageSize description: |- Requested size of the next page of data. If not set, the default page size is 10. Required: false. in: query required: false schema: type: integer format: int32 - name: pageNumber description: 'Requested page number. Required: false. Default: 1' in: query required: false schema: type: integer format: int32 - name: text description: |- Text for the user to search on this fields: tenant_name, friendly_name, tenant_id, primary_contact_email. If used in conjunction with partial_text_search only tenant_name and primary_contact_email will be used Required: false in: query required: false schema: type: string - name: tenantName description: 'Name of the tenant. Required: false' in: query required: false schema: type: string - name: entitlement description: 'entitlement of the tenant. Required: false' in: query required: false explode: true schema: type: array items: type: string - name: tenantFriendlyName description: 'Friendly Name of the tenant. Required: false' in: query required: false schema: type: string - name: attributeFieldName description: 'Attribute''s name. To use this filter, you also need to set attribute_value. Required: false' in: query required: false schema: type: string - name: attributeValue description: 'Attribute''s value. To use this filter, you also need to set attribute_field_name. Required: false' in: query required: false schema: type: string - name: authType description: |- Customer IDP authentication type. Possible values are None, OIDC and SAML2. Required: false. Default: None - NONE: The tenant does not support authentication of users - OIDC: The tenant uses OpenID Connect to authenticate users - SAML2: The tenant uses SAML (v2) to authenticate users - LDAP: The tenant uses LDAP to authenticate users in: query required: false schema: type: string enum: - NONE - OIDC - SAML2 - LDAP default: NONE - name: sortField description: 'Sort field. Admitted values: tenant_id, tenant_name, tenant_friendly_name, creation_time. Required: false. Default: phoenix_tenant_id' in: query required: false schema: type: string enum: - DEFAULT - TENANT_ID - TENANT_NAME - TENANT_FRIENDLY_NAME - CREATION_TIME - RELEVANCE_SCORE default: DEFAULT - name: sortType description: 'Sort Type for the results, Default: ASC, Required: false' in: query required: false schema: type: string enum: - NONE - ASC - DESC default: NONE - name: primaryContactEmail description: 'The primary contact''s email. Required: false' in: query required: false schema: type: string - name: partialTextSearch description: 'Flag to indicate whether you want exact list matches or fuzzy partial matches on tenant_name and primary_contact_email, Required: false, Default: false' in: query required: false schema: type: boolean - name: tenantIds description: 'This is a repeated list of tenant_ids that the user wishes to get back. Required: false' in: query required: false explode: true schema: type: array items: type: string tags: - TenantService post: summary: |- Create a new Tenant. Tenant Name is required. Permission Level: Read-Write operationId: TenantService_CreateTenant responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsTenantResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' requestBody: content: application/json: schema: $ref: '#/components/schemas/commonsTenantProto' required: true tags: - TenantService /tenants/api-keys:validate: post: summary: |- Validates an API key and returns the associated tenant ID. Permission Level: Read operationId: TenantService_ValidateAPIKey responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsValidateAPIKeyResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' requestBody: content: application/json: schema: $ref: '#/components/schemas/commonsValidateAPIKeyRequest' required: true tags: - TenantService /tenants/deploy: post: summary: |- Send a PubSub message to Cloud Build to kickoff a deployment process Permission Level: Read-Write operationId: TenantService_KickoffDeployment responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/v2KickoffDeploymentResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' requestBody: content: application/json: schema: $ref: '#/components/schemas/v2KickoffDeploymentRequest' required: true tags: - TenantService /tenants/match-by-email/{email}: get: summary: |- Given an email, return the tenant that matches the email's domain by the tenant's emailDomain field. If no tenant is found, the Platform Default tenant is returned. Permission Level: Read operationId: TenantService_MatchTenantByEmail responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsMatchTenantByEmailResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' parameters: - name: email description: 'An email whose domain will be matched to a tenant''s email_domain property. Required: true' in: path required: true schema: type: string tags: - TenantService /tenants/onboard-application: post: summary: |- Handle License Service call to onboard a tenant Permission Level: Read-Write operationId: TenantService_OnboardApplication responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsOnboardApplicationResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' requestBody: content: application/json: schema: $ref: '#/components/schemas/commonsOnboardApplicationRequest' required: true tags: - TenantService /tenants/onboard-customer-idp-base-setup: post: summary: |- * Customer Self-service IDP - Base Setup https://confluence.zebra.com/display/ZRPS/Customer+Self-Service+IDP+API+Design Permission Level: Admin operationId: TenantService_OnboardCustomerIdpBaseSetup responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsOnboardCustomerIdpBaseSetupResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' requestBody: content: application/json: schema: $ref: '#/components/schemas/commonsOnboardCustomerIdpBaseSetupRequest' required: true tags: - TenantService /tenants/onboard-customer-idp-finalize-setup: post: summary: |- * Customer Self-service IDP - Finalize Setup https://confluence.zebra.com/display/ZRPS/Customer+Self-Service+IDP+API+Design Permission Level: Admin operationId: TenantService_OnboardCustomerIdpFinalize responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsTenantResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' requestBody: content: application/json: schema: $ref: '#/components/schemas/commonsOnboardCustomerIdpFinalizeSetupRequest' required: true tags: - TenantService /tenants/onboard-customer-idp-metadata: post: summary: |- * Upload the Customer IDP SAML metadata as a tenant attribute Permission Level: Admin operationId: TenantService_OnboardCustomerIdpMetadata responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsOnboardCustomerIdpMetadataResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' requestBody: content: application/json: schema: $ref: '#/components/schemas/commonsOnboardCustomerIdpMetadataRequest' required: true tags: - TenantService /tenants/search: post: summary: |- Search by multiple attributes Permission Level: Read operationId: TenantService_ListTenantsWithFilters responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsListTenantsResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' requestBody: content: application/json: schema: $ref: '#/components/schemas/v2ListTenantsWithFiltersRequest' required: true tags: - TenantService /tenants/self-tenants: post: summary: |- Create a new tenant with your email as user creator and with that email as user admin. Permission Level: Read Write operationId: TenantService_CreateSelfTenant responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/v2CreateSelfTenantResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' requestBody: content: application/json: schema: $ref: '#/components/schemas/v2CreateSelfTenantRequest' required: true tags: - TenantService /tenants/tenant-admin-update-tenant: post: summary: |- * Fields needed by UI for updating Permission Level: Admin operationId: TenantService_TenantAdminUpdateTenant responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsTenantResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' requestBody: content: application/json: schema: $ref: '#/components/schemas/commonsTenantAdminUpdateTenantRequest' required: true tags: - TenantService /tenants/v1/worker-deployments: get: summary: |- Return a list of all the deployed services, retrieved from a Worker Tenant. Permission Level: Read operationId: TenantService_ListWorkerDeployments responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/v2ListDeploymentsResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' parameters: - name: clientAddress description: |- DNS address, e.g. uat.ssppcoret.zebra.engineering, of the Operating Set (internal term) to be queried. Note that this may be different from the url / location / Operating Set / etc. of the "Control Plane" or "Central" Tenant Service, and that's why one cannot directly call a stub. Required: True in: query required: false schema: type: string - name: namespace description: 'GKE namespace of the deployments to be retrieved, passed to the Worker Tenat request, Required: true' in: query required: false schema: type: string - name: tenantRequestKey description: |- Worker Tenant Service instances must communicate with the Control Plane Tenant instance, but the Workers are in different service meshes, so they can't communicate directly. This field provides the key to a Google Managed Secret that allows that inter-mesh communication in: query required: false schema: type: string tags: - TenantService /tenants/{tenantId}: get: summary: |- Return one tenant by tenant id. Permission Level: Read operationId: TenantService_GetTenant responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsTenantResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' parameters: - name: tenantId description: Default parameter to find the tenant in: path required: true schema: type: string - name: byRoutingString.routingString in: query required: false schema: type: string - name: byEntitlement.entitlementSystem in: query required: false schema: type: string - name: byEntitlement.entitlementTenantId in: query required: false schema: type: string - name: tenantRequestKey in: query required: false schema: type: string - name: identifierType description: |- The type of identifier used to query: a TENANT_ID (default), a ROUTING_STRING, or ENTITLEMENT - TENANT_ID: DEFAULT VALUE: Searches for tenant based on the tenant_id field. - ROUTING_STRING: Searches for the tenant based on the routing_string field. - ENTITLEMENT: Searches for the tenant based on the entitlement field. in: query required: false schema: type: string enum: - TENANT_ID - ROUTING_STRING - ENTITLEMENT default: TENANT_ID tags: - TenantService delete: summary: |- Delete a Tenant. Tenant Id is required. Permission Level: Read-Write operationId: TenantService_DeleteTenant responses: '200': description: A successful response. content: application/json: schema: type: object properties: {} default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' parameters: - name: tenantId in: path required: true schema: type: string tags: - TenantService put: summary: |- Update a Tenant. Tenant Id is required. Base Role Flag is defaulted to false Permission Level: Read-Write operationId: TenantService_UpdateTenant responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsTenantResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' parameters: - name: tenantId description: 'tenant_id of the tenant to be updated. Required: false' in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/TenantServiceUpdateTenantBody' required: true tags: - TenantService /tenants/{tenantId}/api-keys:generate: post: summary: |- Generates or regenerates an API key for a tenant. Permission Level: Read-Write operationId: TenantService_GenerateAPIKey responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsGenerateAPIKeyResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' parameters: - name: tenantId description: The tenant ID for which to generate an API key in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/TenantServiceGenerateAPIKeyBody' required: true tags: - TenantService /tenants/{tenantId}/microstrategy-details: get: summary: |- * Returns the MicroStrategy details for a tenant. MicroStrategy details are populated automatically during a tenant onboard, and contain the necessary information we need to use to use in the Authentication Proxy (KrakenD) to authenticate users against MicroStrategy. operationId: TenantService_GetMicroStrategyDetails responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsGetMicroStrategyDetailsResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' parameters: - name: tenantId description: 'Tenant ID. Required: true' in: path required: true schema: type: string tags: - TenantService /tenants:onboardAllTenantsToMicroStrategy: post: summary: |- * Onboards all the tenants with no MicroStrategyDetails to MicroStragey Permission Level: Admin operationId: TenantService_OnboardAllTenantsToMicrostrategy responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsOnboardAllTenantsToMicroStrategyResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' requestBody: content: application/json: schema: $ref: '#/components/schemas/commonsOnboardAllTenantsToMicroStrategyRequest' required: true tags: - TenantService /tenants:onboardToMicroStrategy: post: summary: |- * Onboard an existing tenant to MicroStrategy. If the tenant is already onboarded, the existing MicroStrategyDetails are returned Permission Level: Admin operationId: TenantService_OnboardToMicroStrategy responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/commonsOnboardToMicroStrategyResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/rpcStatus' requestBody: content: application/json: schema: $ref: '#/components/schemas/commonsOnboardToMicroStrategyRequest' required: true tags: - TenantService servers: - url: https://prod-ui-zwseuprod01p.pp.zebra.com/api description: EU Server - url: https://prod-ui-zwsusprod01p.pp.zebra.com/api description: NA Server components: schemas: GetTenantRequestIdentifierType: type: string enum: - TENANT_ID - ROUTING_STRING - ENTITLEMENT default: TENANT_ID description: |2- - TENANT_ID: DEFAULT VALUE: Searches for tenant based on the tenant_id field. - ROUTING_STRING: Searches for the tenant based on the routing_string field. - ENTITLEMENT: Searches for the tenant based on the entitlement field. KickoffDeploymentRequestPayload: type: object properties: custEnv: $ref: '#/components/schemas/PayloadCustEnv' region: $ref: '#/components/schemas/PayloadRegion' releaseVersion: type: string title: 'The git TAG. Required: true' component: type: string title: 'Component such as core, message-bus, notifications. Required: true' title: The payload that will be sent to PubSub OIDCClientInfoAuthorizationGrantType: type: string enum: - AUTHORIZATION_CODE default: AUTHORIZATION_CODE description: |- - AUTHORIZATION_CODE: Use the Authorization Code grant type We will add more if required by some IDP. title: Supported OIDC authorization grant types OIDCClientInfoClientAuthenticationMethod: type: string enum: - BASIC - POST - NONE default: BASIC description: |- - BASIC: Use Basic Auth - POST: Use POST body - NONE: No authentication is required title: Authentication method used between the OIDC client and the Customer IDP (backchannel). Usually BASIC (Basic Auth) OIDCClientInfoProviderDetails: type: object properties: authorizationUri: type: string title: 'OIDC Authorization endpoint. Required: true' tokenUri: type: string title: 'OIDC Token endpoint. Required: true' userInfoUri: type: string title: 'User info endpoint. Required: true' userNameAttributeName: type: string title: 'Name of the OIDC claim whose value will be mapped to the local username. Typically `sub`. Required: true' jwkSetUri: type: string title: 'URI of the JSON Web Key Sets. Required: true' revocationEndpoint: type: string description: |- Token revocation endpoint. Required: false If provided, a backchannel request will be made to the IDP to invalidate the current OIDC token(s): access and refresh tokens, if available. This request may not invalidate the End-User's session on the IDP side depending on the IDP's implementation. endSessionEndpoint: type: string title: |- On logout, the End-User's User Agent is redirected to this endpoint to clear the IDP session. Required: false https://openid.net/specs/openid-connect-rpinitiated-1_0.html#OPMetadata Known use cases: Okta OIDC deviceAuthorizationEndpoint: type: string title: |- The OIDC Device Authorization Endpoint. This is used to support the Device Authorization Grant flow. Required: false https://datatracker.ietf.org/doc/html/rfc8628#section-4 title: Detailed OpenID Provider information required to interact with it OnboardCustomerIdpFinalizeSetupRequestCustomerIdpType: type: string enum: - NONE - OIDC - SAML default: NONE PayloadCustEnv: type: string enum: - uat - prd default: uat title: Environment to deploy PayloadRegion: type: string enum: - US - EU default: US title: Region to deploy TenantProtoAuthType: type: string enum: - NONE - OIDC - SAML2 - LDAP default: NONE description: |- - NONE: The tenant does not support authentication of users - OIDC: The tenant uses OpenID Connect to authenticate users - SAML2: The tenant uses SAML (v2) to authenticate users - LDAP: The tenant uses LDAP to authenticate users title: Authentication protocol supported by the customer IDP to authenticate its users TenantProtoEntitlement: type: object properties: entitlementSystem: type: string title: 'Entitlement System Name, eg: reflexis' entitlementTenantId: type: string title: 'Entitlement Tenant Id, eg: walgreens' baseUrl: type: string title: 'Entitlement base url, eg: "https://walgreens.reflexis.zebra.com"' landingPageUrl: type: string title: 'Entitlement landing page url, eg: "https://walgreens.reflexis.zebra.com/landing". Required: false' licenseModel: type: string title: 'Entitlement license model, eg: "consumption", "user", ... Required: false' title: Data Model for Zebra Partner System details TenantProtoExtraAttributeType: type: string enum: - UNDEFINED - JSON - TIMESTAMP default: UNDEFINED TenantProtoExtraAttributeValue: type: object properties: json: type: string timestamp: type: string format: date-time TenantProtoLdapClientInfo: type: object properties: providerUrl: type: string title: |- LDAP URL. It should include the root DN (e.g. dc=example,dc=com) For example: ldap://localhost:10389/dc=example,dc=com Required: true userDnPattern: type: array items: type: string title: |- Sets the pattern which will be used to supply a DN for the user. The pattern should be the name relative to the root DN. The pattern argument {0} will contain the username. An example would be "cn={0},ou=people". Required: true externalRedirectUri: type: array items: type: string title: |- The URL to redirect the browser if authentication succeeds. Required: false. If not provided, the authentication completes showing a DTO (token and permissions) Can be set with a * at the end of the uri to allow for wildcard prefix matching title: Holds de LDAP provider details to authenticate users TenantProtoOIDCClientInfo: type: object properties: clientId: type: string title: 'OIDC Client ID. Required: true' clientSecret: type: string title: 'OIDC Client Secret. Required: true' clientAuthenticationMethod: $ref: '#/components/schemas/OIDCClientInfoClientAuthenticationMethod' authorizationGrantType: $ref: '#/components/schemas/OIDCClientInfoAuthorizationGrantType' scope: type: array items: type: string title: 'OIDC scopes. Required: true' discoveryUri: type: string title: |- URI at the the OpenID Provider to discover the endpoint locations. https://openid.net/specs/openid-connect-discovery-1_0.html For example: https://idp.swsplatform.zebra.engineering/realms/demo/.well-known/openid-configuration providerDetails: $ref: '#/components/schemas/OIDCClientInfoProviderDetails' externalRedirectUri: type: array items: type: string title: |- The URL to redirect the browser if the authentication succeeds. Required: false. This is usually the application URL that will capture the platform token. If not provided, the authentication completes showing a JSON DTO (token and permissions) Can be set with a * at the end of the uri to allow for wildcard prefix matching claimsEnabled: type: boolean title: |- If true, when the authentication completes, seek for the allowed list of claims defined in the tenant and persist them in the user. Default: false userNameAttributeName: type: string description: |- Name of the OIDC claim whose value will be mapped to the local username. Required: false. Default: `sub` Note: This field is only used when the `discovery_uri` field is set. The framework uses the claim `sub` as fallback. postLogoutRedirectUri: type: array items: type: string description: |- Location to redirect the End-User's User Agent after a logout has been performed. Required: false This value is only used if `provider_details.end_session_endpoint` is set. It is appened to the IDP logout request as a query string parameter, according to the standard. https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RedirectionAfterLogout This value should be previously registered at the IDP. title: Holds all the OIDC client and provider details TenantProtoSaml2ClientInfo: type: object properties: entityId: type: string title: |- This is the value of the saml2:Issuer element used to construct AuthnRequest messages. This has to match with the value set at the IDP end. Required: true idpEntityId: type: string title: 'IDP Entity ID. Required: true if idp_metadata_url is not provided' ssoServiceEndpoint: type: string title: 'Single sign-on (SSO) endpoint. Required: true if idp_metadata_url is not provided' singleLogoutServiceEndpoint: type: string title: 'Logout endpoint. Required: true if idp_metadata_url is not provided' encryptionKey: type: string title: 'The Assertion Party public key used to encrypt messages sent to the IDP. PEM format. (Use a text area). Required: true if idp_metadata_url is not provided' verificationCert: type: string title: 'The Assertion Party certificate used to verify the signed messages received from the IDP. PEM format. (Use a text area). Required: true if idp_metadata_url is not provided' idpMetadataUrl: type: string description: 'IDP SAML metadada URL. Overrides the IDP fields listed previously. Required: false.' externalRedirectUri: type: array items: type: string title: |- The URL to redirect the browser if authentication succeeds. Required: false. If not provided, the authentication completes showing a DTO (token and permissions) Can be set with a * at the end of the uri to allow for wildcard prefix matching logoutRedirectUri: type: array items: type: string title: |- The tenant's set of URIs used to redirect a user upon logout. Required: false. If not provided, base logout success will be used idpMetadata: type: string description: |- This is the contents of the IDP metada file. Required: false If set, idp_metadata_url is ignored. This should be encoded as bas64 to account for the special characters used by XML. selfHostedIdpMetadataUrl: type: string description: |- URL of the self-hosted IDP metadata URL. Required: false. Use this field if the IDP metadata was uploaded to the File Store Service (FSS) Unlike the idp_metadata_url, this URL is not public, and can only be accessed through an authenticated request. If set, idp_metadata_url is ignored. userNameAttributeName: type: string description: |- Name of the SAML assertion attribute whose value will be mapped to the local username. Required: false. If not set, the username is is retrieved from the `NameID` element of the SAML assertion. title: Holds all the SAML2 client and asserting party details TenantProtoTenantAttributeProto: type: object properties: scope: type: string title: General scoping for tenant attribute fieldName: type: string title: Name of the attribute value: type: string title: Value of the attribute domain: type: string title: Domain of the attribute extraType: $ref: '#/components/schemas/TenantProtoExtraAttributeType' extraValue: $ref: '#/components/schemas/TenantProtoExtraAttributeValue' TenantServiceGenerateAPIKeyBody: type: object TenantServiceUpdateTenantBody: type: object properties: tenant: $ref: '#/components/schemas/commonsUpdateTenantProto' commonsAdminUser: type: object properties: userId: type: string title: 'The user''s ID. Required: true' email: type: string title: 'The user''s email. Required: false' commonsGenerateAPIKeyResponse: type: object properties: apiKey: type: string title: The generated API key commonsGetMicroStrategyDetailsResponse: type: object properties: microStrategyDetails: $ref: '#/components/schemas/commonsMicroStrategyDetailsProto' commonsGetTenantByRoutingStringRequest: type: object properties: routingString: type: string commonsGetTenantEntitlementRequest: type: object properties: entitlementSystem: type: string entitlementTenantId: type: string commonsIDPState: type: string enum: - INVALID_STATE - NOT_SETUP - IN_PROGRESS - SETUP default: INVALID_STATE title: |- - INVALID_STATE: Unrecognized state - NOT_SETUP: IDP is not setup - IN_PROGRESS: IDP is setup - SETUP: IDP is setup commonsKeycloakCredentials: type: object properties: username: type: string title: Realm admin username (based on provided email) password: type: string title: Realm admin password title: Login credentials for Keycloak commonsListTenantsResponse: type: object properties: tenants: type: array items: $ref: '#/components/schemas/commonsTenantProto' title: list of Tenants for the given filter title: |- * Return a list of tenants commonsMatchTenantByEmailResponse: type: object properties: tenant: $ref: '#/components/schemas/commonsTenantProto' commonsMicroStrategyDetailsProto: type: object properties: projectId: type: string title: Project ID dashboard: type: object additionalProperties: type: string title: 'Key: Dashboard name, Value: MSTR Dashboard ID' privilegeUserGroups: type: object additionalProperties: $ref: '#/components/schemas/commonsMicroStrategyScopedUserGroup' title: MicroStrategy User Groups for privilege-based access moduleUserGroups: type: object additionalProperties: type: string title: MicroStrategy User Groups for module-based access orgUserGroups: type: object additionalProperties: type: string title: MicroStrategy User Groups for organization-based access userPrefix: type: string title: The user prefix when sending the header to MicroStrategy commonsMicroStrategyScopedUserGroup: type: object properties: userGroup: type: object additionalProperties: type: string title: 'Key: privilege level, Value: MSTR User Group ID' commonsOidcDetails: type: object properties: authorizationUri: type: string title: Provider URIs tokenUri: type: string userInfoUri: type: string jwkSetUri: type: string revocationEndpoint: type: string endSessionEndpoint: type: string redirectUri: type: string title: This is the endpoint that receives the authorization code. Added to the IDP environment deviceAuthorizationEndpoint: type: string title: Parsed OIDC details from the well-known discovery URI commonsOnboardAllTenantsToMicroStrategyRequest: type: object title: Empty for now commonsOnboardAllTenantsToMicroStrategyResponse: type: object properties: microStrategyDetails: type: array items: $ref: '#/components/schemas/commonsMicroStrategyDetailsProto' commonsOnboardApplicationRequest: type: object properties: badgeId: type: string title: 'Match tenant by badgeId. Required: true' salesforceId: type: string title: 'Match tenant by salesforceId. Required: true' primaryContactEmail: type: string title: 'Email of the tenant admin. Required: true' appDomain: type: string title: 'App domain. Required: true' region: type: string title: 'Region. Required: true' tenantFriendlyName: type: string title: 'Tenant friendly name. Required: true' skipAdminUser: type: boolean title: 'Skip admin user creation. Required: false' requireMstrSetup: type: boolean title: 'Is mstr setup required. Required: false' commonsOnboardApplicationResponse: type: object properties: tenantId: type: string title: Onboarded tenant ID adminUser: $ref: '#/components/schemas/commonsKeycloakCredentials' commonsOnboardCustomerIdpBaseSetupRequest: type: object properties: url: type: string description: 'The URL of either the SAML metadata file or the OIDC well-known endpoint. Required: false if type is provided.' type: $ref: '#/components/schemas/OnboardCustomerIdpFinalizeSetupRequestCustomerIdpType' tenantId: type: string title: 'Tenant ID. Required: false' commonsOnboardCustomerIdpBaseSetupResponse: type: object properties: oidc: $ref: '#/components/schemas/commonsOidcDetails' saml: $ref: '#/components/schemas/commonsSamlDetails' commonsOnboardCustomerIdpFinalizeSetupRequest: type: object properties: idpType: $ref: '#/components/schemas/OnboardCustomerIdpFinalizeSetupRequestCustomerIdpType' oidcIdp: $ref: '#/components/schemas/TenantProtoOIDCClientInfo' samlIdp: $ref: '#/components/schemas/TenantProtoSaml2ClientInfo' admins: type: array items: $ref: '#/components/schemas/commonsAdminUser' title: 'Admin users that will be created. Required: true' tenantId: type: string title: 'Tenant ID. Required: false' userId: type: string title: 'User ID. Required: false' commonsOnboardCustomerIdpMetadataRequest: type: object properties: idpMetadata: type: string title: |- The contents of the Customer IDP metadata file, typically in XML format according to the SAML standard. Required: true It should be encoded in base64 tenantId: type: string title: 'Tenant ID. Required: false' commonsOnboardCustomerIdpMetadataResponse: type: object properties: saml: $ref: '#/components/schemas/commonsSamlDetails' commonsOnboardToMicroStrategyRequest: type: object properties: tenantId: type: array items: type: string title: 'Tenant ID. Required: true' commonsOnboardToMicroStrategyResponse: type: object properties: onboardedMstrStatus: type: array items: $ref: '#/components/schemas/commonsTenantOnboardingResult' title: Onboarded MSTR status for all tenants (tenant_id -> status) commonsSamlDetails: type: object properties: entityId: type: string description: Service Provider (SP) entity id for this tenant. Auto-generated. Randomly generated string. idpMetadataUrl: type: string description: |- Same URL from request. The API only checked that the URL can be accessed and its contents are XML. Further validation and parsing are delegated to Spring Security at authentication time. spAcsUrl: type: string title: SP Assertion Consumer URL - Added to the IDP environment spSloUrl: type: string title: SP Single Logout URL - Added to the IDP environment spMetadataUrl: type: string title: SP Metadata URL - Contains the SP Entity ID, SP URLs, and SP certificate. Added to the IDP environment idpMetadata: type: string description: IDP metadata encoded as base 64. If set, the customer uploaded the IDP metadata instead of providing an IDP metdatada URL. commonsSortField: type: string enum: - DEFAULT - TENANT_ID - TENANT_NAME - TENANT_FRIENDLY_NAME - CREATION_TIME - RELEVANCE_SCORE default: DEFAULT commonsSortType: type: string enum: - NONE - ASC - DESC default: NONE commonsTenantAdminUpdateTenantRequest: type: object properties: tenantId: type: string title: 'Tenant ID, Required: false' idpState: $ref: '#/components/schemas/commonsIDPState' tenantFriendlyName: type: string title: 'Tenant Friendly Name, Required: false' attributes: type: array items: $ref: '#/components/schemas/TenantProtoTenantAttributeProto' title: 'Tenant attributes, Required: false' oidcIdp: $ref: '#/components/schemas/TenantProtoOIDCClientInfo' autoAssignLicenseDomains: type: array items: type: string description: |- Licensed application domains for which new users should receive a license automatically. When update_field_mask is set, this field is applied only if auto_assign_license_domains is in the mask. updateFieldMask: type: string title: |- FieldMask controlling which fields to update. When absent or empty, all fields present in the request are applied (backward compatible). Valid paths: idp_state, tenant_friendly_name, attributes, oidc_idp, auto_assign_license_domains commonsTenantOnboardingResult: type: object properties: tenantId: type: string title: Tenant ID that was processed status: type: string title: 'Status: SUCCESS, SKIPPED, FAILURE' message: type: string title: Descriptive message details: $ref: '#/components/schemas/commonsMicroStrategyDetailsProto' errorType: type: string title: Error type if failed commonsTenantProto: type: object properties: tenantId: type: string title: |- Id of the tenant. This is unique and could be created by the user or generated by the system. Can only contain lowercase alphabets, hyphen, underscore or digits. The max length is: 64. Required: true tenantName: type: string title: 'Name of the tenant. Required: true' createdTime: type: string format: date-time title: Tenant Creation time updatedTime: type: string format: date-time title: Tenant Update time lastModifiedBy: type: string title: Tenant Last Modified By createdBy: type: string title: Tenant Created By zebraContact: type: string title: Zebra Contact Information primaryContactEmail: type: string title: Email address of the tenant owner primaryContactFirstName: type: string title: First Name of the tenant owner primaryContactLastName: type: string title: Last Name of the tenant owner entitlements: type: array items: $ref: '#/components/schemas/TenantProtoEntitlement' title: Entitlement details (like ZPA, Reflexis, etc) generatedUrl: type: string title: Generated url for the tenant tenantFriendlyName: type: string title: |- Tenant Friendly Name. Must meet RFC 2396 standards for a URI (Uniform Resource Identifier) as this is used for building the custom unique URI for the tenant. Do not use reserved characters like /,?, &, or # Do not start or end with a period '.' Max Length is 256 Required: true authType: $ref: '#/components/schemas/TenantProtoAuthType' oidcClientInfo: $ref: '#/components/schemas/TenantProtoOIDCClientInfo' saml2ClientInfo: $ref: '#/components/schemas/TenantProtoSaml2ClientInfo' claims: type: array items: type: string title: 'List of claims to retrieve from customer IDP. If empty, retrieve none. Required: false' routingString: type: string title: |- A randomly generated 6-character alphanumeric string used as a short-form unique id for routing to a tenant without using the full name of the tenant zebraAccountNumber: type: string title: Zebra Account Number (Siebel/Salesforce number) attributes: type: array items: $ref: '#/components/schemas/TenantProtoTenantAttributeProto' title: List of tenant specific attributes baseRole: type: boolean title: 'Flag for toggling if a default base role will be added to all subsequent created Users in this tenant. Required: false, Default: false' emailDomain: type: string title: 'The format is .. Unique. Required: false' region: type: string description: 'Region of the tenant. Required: false. Default: US.' ldapClientInfo: $ref: '#/components/schemas/TenantProtoLdapClientInfo' autoGenerated: type: boolean title: |- tenant created via the auto-creation process of platform default login from identity service,autoGenerated flag set to "true" Required: false defaultLocale: type: string title: 'The tenant''s default locale, Required: false' primaryContactUserId: type: string title: 'The primary contact''s userId. Required: false' idpState: $ref: '#/components/schemas/commonsIDPState' usesKeycloak: type: boolean title: 'Identifies whether the tenant uses Keycloak as the IDP. Read-only. Default: false' apiKey: type: string title: Tenant's API Key autoAssignLicenseDomains: type: array items: type: string title: 'Licensed application domains for which new users should receive a license automatically. Domains not listed are not auto-licensed. Required: false' title: |- * Main Tenant data model commonsTenantResponse: type: object properties: tenant: $ref: '#/components/schemas/commonsTenantProto' commonsUpdateTenantProto: type: object properties: tenantName: type: string title: |- Name of the tenant. Cannot be updated to empty/blank, if user tries to set to empty/blank, retains the previous value. Required: false tenantFriendlyName: type: string title: |- Tenant Friendly Name. Cannot be updated to empty/blank, if user tries to set to empty/blank, retains the previous value. Required: false zebraContact: type: string title: 'Zebra Contact Information. Required: false' primaryContactEmail: type: string title: 'Email address of the tenant owner. Required: false' primaryContactFirstName: type: string title: 'First Name of the tenant owner. Required: false' primaryContactLastName: type: string title: 'Last Name of the tenant owner. Required: false' entitlements: type: array items: $ref: '#/components/schemas/TenantProtoEntitlement' title: 'Entitlement details (like ZPA, Reflexis, etc). Required: false' generatedUrl: type: string title: 'Generated url for the tenant. Required: false' authType: $ref: '#/components/schemas/TenantProtoAuthType' oidcClientInfo: $ref: '#/components/schemas/TenantProtoOIDCClientInfo' saml2ClientInfo: $ref: '#/components/schemas/TenantProtoSaml2ClientInfo' ldapClientInfo: $ref: '#/components/schemas/TenantProtoLdapClientInfo' claims: type: array items: type: string title: 'List of claims to retrieve from customer IDP. If empty, retrieve none. Required: false' zebraAccountNumber: type: string title: 'Zebra Account Number (Siebel/Salesforce number). Required: false' attributes: type: array items: $ref: '#/components/schemas/TenantProtoTenantAttributeProto' title: 'List of tenant specific attributes. Required: false' baseRole: type: boolean title: 'Flag for toggling if a default base role will be added to all subsequent created Users in this tenant. Required: false' emailDomain: type: string title: 'The format is .. Unique. Required: false' region: type: string title: 'Region of the tenant. Required: false' updateFieldMask: type: string title: |- FieldMask to control what fields are to be updated, Required: false Valid path names (tenant_name, tenant_friendly_name, zebra_contact, primary_contact_email, primary_contact_first_name, primary_contact_last_name, entitlements, generated_url, auth_type, oidc_client_info, saml2_client_info, ldap_client_info, claims, zebra_account_number, attributes, base_role, email_domain, region, default_locale, auto_assign_license_domains) defaultLocale: type: string title: 'The tenant''s default locale, Required: false' autoAssignLicenseDomains: type: array items: type: string title: 'Licensed application domains for which new users should receive a license automatically. Domains not listed are not auto-licensed. Required: false' commonsValidateAPIKeyRequest: type: object properties: apiKey: type: string title: The API key to validate commonsValidateAPIKeyResponse: type: object properties: tenantId: type: string title: The tenant ID associated with the API key protobufAny: type: object properties: '@type': type: string additionalProperties: {} protobufNullValue: type: string enum: - NULL_VALUE default: NULL_VALUE description: |- `NullValue` is a singleton enumeration to represent the null value for the `Value` type union. The JSON representation for `NullValue` is JSON `null`. - NULL_VALUE: Null value. rpcStatus: type: object properties: code: type: integer format: int32 message: type: string details: type: array items: $ref: '#/components/schemas/protobufAny' v2CreateSelfTenantRequest: type: object properties: tenantName: type: string primaryContactEmail: type: string primaryContactFirstName: type: string primaryContactLastName: type: string tenantFriendlyName: type: string primaryContactId: type: string region: type: string v2CreateSelfTenantResponse: type: object properties: tenantId: type: string v2DeploymentMessage: type: object properties: deploymentName: type: string semanticVersion: type: string availableReplicas: type: integer format: int32 unavailableReplicas: type: integer format: int32 conditions: type: array items: type: object v2KickoffDeploymentRequest: type: object properties: topicName: type: string title: The topic name used for this payload payload: $ref: '#/components/schemas/KickoffDeploymentRequestPayload' title: Request with the variables to send to Cloud Build v2KickoffDeploymentResponse: type: object properties: status: type: string title: ok if the kickoff message was sent to PubSub v2ListDeploymentsResponse: type: object properties: deploymentMessage: type: array items: $ref: '#/components/schemas/v2DeploymentMessage' cachedAtTimestamp: type: string format: date-time v2ListTenantsWithFiltersRequest: type: object properties: pageSize: type: integer format: int32 description: |- Requested size of the next page of data. If not set, the default page size is 10. Required: false. pageNumber: type: integer format: int32 title: 'Requested page number. Required: false. Default: 1' specificSearchFilter: $ref: '#/components/schemas/v2SpecificSearchFilter' sortField: $ref: '#/components/schemas/commonsSortField' sortType: $ref: '#/components/schemas/commonsSortType' v2SpecificSearchFilter: type: object properties: attributes: type: array items: $ref: '#/components/schemas/TenantProtoTenantAttributeProto' title: |- Optional - tenant-attributes of the tenant to search Used in POST API securitySchemes: Authorization: type: apiKey description: Bearer token name: Authorization in: header