openapi: 3.0.1
info:
  title: Role Service
  description: The Role Service provides APIs for CRUD'ing roles'.
  version: '2.0'
tags:
  - name: RoleService
security:
  - Authorization: []
paths:
  /users/roles:
    get:
      summary: |-
        Return a list of roles. With pagination.
        Permission Level: Read
      operationId: RoleService_ListRoles
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2ListRolesResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: tenantId
          description: 'Tenant of the Roles to fetch, Required: false'
          in: query
          required: false
          explode: true
          schema:
            type: array
            items:
              type: string
        - name: domain
          description: 'Domain of the role (example: zpa, reflexis, wfc, etc), Required: false'
          in: query
          required: false
          schema:
            type: string
        - name: scope
          description: 'Some more general scoping (like a particular app in the domain), Required: false'
          in: query
          required: false
          schema:
            type: string
        - name: pageToken
          description: 'MongoDB Field, describes the encoded page token for page traversal, Required: false'
          in: query
          required: false
          schema:
            type: string
        - name: pageSize
          description: 'Requested size of the next page of data. If not set, the default page size is 10, Required: false.'
          in: query
          required: false
          schema:
            type: integer
            format: int32
        - name: sortField
          description: 'Sort field, valid values: domain, scope, roleId, lastUpdated or displayName. Default: domain, Required: false'
          in: query
          required: false
          schema:
            type: string
        - name: sortType
          description: 'Sort Type for the results, Default: ASC, Required: false'
          in: query
          required: false
          schema:
            type: string
            enum:
              - NONE
              - ASC
              - DESC
            default: NONE
        - name: includePermissions
          description: 'if include permissions is true, it returns the roles with its permissions, Default: false, Required: false'
          in: query
          required: false
          schema:
            type: boolean
        - name: genericFilter
          description: 'Generic filter for role fields (role_id, domain, scope). Required: false'
          in: query
          required: false
          schema:
            type: string
        - name: specificFilter.domain
          in: query
          required: false
          schema:
            type: string
        - name: specificFilter.scope
          in: query
          required: false
          schema:
            type: string
        - name: specificFilter.roleId
          in: query
          required: false
          schema:
            type: string
        - name: specificFilter.systemLevel
          in: query
          required: false
          schema:
            type: string
            enum:
              - FILTER_DISABLED
              - FILTER_TRUE
              - FILTER_FALSE
            default: FILTER_DISABLED
        - name: specificFilter.displayName
          in: query
          required: false
          schema:
            type: string
        - name: startsWithSingleCharacter
          description: 'Ability to search for a single starts with character, only applicable to specific_filter: display_name, Required: false, Default: false'
          in: query
          required: false
          schema:
            type: boolean
        - name: isTemplate
          description: 'Flag to include roles which have isTemplate enabled, Default: false, Required: false'
          in: query
          required: false
          schema:
            type: boolean
        - name: excludeTenantIds
          description: 'List of tenant IDs to exclude. Required: false'
          in: query
          required: false
          explode: true
          schema:
            type: array
            items:
              type: string
        - name: enabledStatus
          description: 'The enabled status of the role in this request to search on will only work in conjunction with the scope field, Default: Both Enabled and Disabled Roles, Required: false'
          in: query
          required: false
          schema:
            type: string
            enum:
              - ROLE_SCOPE_BOTH
              - ROLE_SCOPE_ENABLED
              - ROLE_SCOPE_DISABLED
            default: ROLE_SCOPE_BOTH
        - name: fieldMask
          description: |-
            FieldMask to control what fields are to be returned, if empty assumes everything, Required: false
            Valid path names are names of each field in the RoleResponse proto
          in: query
          required: false
          schema:
            type: string
        - name: roleType
          description: |-
            Filter by Role Type, Default: All Roles, Required: false

             - ALL_ROLES: All Roles
             - USER_ONLY: User Roles only
             - ADMIN_ONLY: Admin Roles only
          in: query
          required: false
          schema:
            type: string
            enum:
              - ALL_ROLES
              - USER_ONLY
              - ADMIN_ONLY
            default: ALL_ROLES
      tags:
        - RoleService
    delete:
      summary: |-
        Deletes a list of roles of a tenant.
        This method won't delete all roles in the list, if an error happens.
      description: 'Permission Level: Read Write'
      operationId: RoleService_DeleteRoles
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                type: object
                properties: {}
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v2DeleteRolesRequest'
        required: true
      tags:
        - RoleService
    post:
      summary: |-
        Create multiple roles. rollback parameter decides whether to rollback whole transaction or create valid roles and return errors for invalid.
         Permission Level: Read-Write
      operationId: RoleService_CreateRoles
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                type: object
                properties: {}
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v2CreateRolesRequest'
        required: true
      tags:
        - RoleService
  /users/roles/availableroles:
    get:
      summary: |-
        Get the roles available to the user based on the primary site of the user.
         Permission Level: Read
      operationId: RoleService_GetAvailableRolesUser
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2GetAvailableRolesUserResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: tenantId
          description: 'Tenant of the user, Required : false'
          in: query
          required: false
          schema:
            type: string
        - name: userId
          description: 'User Id of the user, Required : true'
          in: query
          required: false
          schema:
            type: string
      tags:
        - RoleService
  /users/roles/basicroles:
    get:
      summary: |-
        Return a list of limited roles. Without pagination.
        "Return at most 500 roles" and "If over 500 the truncated flag indicates there is more data that is not returned".
        Permission Level: Read
      operationId: RoleService_ListBasicRoles
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2ListBasicRolesResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: tenantId
          description: 'Tenant of the Roles to fetch, Required: true'
          in: query
          required: false
          schema:
            type: string
      tags:
        - RoleService
  /users/roles/dynamic/activate:
    post:
      summary: |-
        Activates the dynamic role on the given user by the role_id that is passed
        Reads the user_id, and tenant_id from the token that is passed
        User's auth will be rebuilt with the dynamic role's role/permission
        This endpoint is internal only and will be used by identity service to rebuild the users auth token
      operationId: RoleService_ActivateDynamicRole
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2DynamicRoleResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      requestBody:
        $ref: '#/components/requestBodies/v2DynamicRoleRequest'
      tags:
        - RoleService
  /users/roles/dynamic/deactivate:
    post:
      summary: |-
        Deactivates the dynamic role on the given user by the role_id that is passed
        Reads the user_id, and tenant_id from the token that is passed
        User's auth will be rebuilt without the dynamic role's role/permission
        This endpoint is internal only and will be used by identity service to rebuild the users auth token
      operationId: RoleService_DeactivateDynamicRole
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2DynamicRoleResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      requestBody:
        $ref: '#/components/requestBodies/v2DynamicRoleRequest'
      tags:
        - RoleService
  /users/roles/dynamic/pickup:
    post:
      summary: |-
        Internal use only
        Use case: Identity Service
        When a user authenticates, Identity Service needs to get the permissions from any previously selected dynamic role.
        We can't call `ActivateDynamicRole` because it requires a token, which is being minted at the moment of this call and thus not
        available to the TVS. The user service would not find it.
        Therefore this endpoint does not depend of the TVS status.
        Also, no errors are produced since it would break the authentication. At most, an empty list will be returned.
      operationId: RoleService_PickUpDynamicRoles
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2PickUpDynamicRolesResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v2PickUpDynamicRolesRequest'
        required: true
      tags:
        - RoleService
  /users/roles/dynamicroles:
    post:
      summary: |-
        List Dynamic roles for an user.
         It is required a valid phoenix-token.
         Permission Level: None
      operationId: RoleService_GetDynamicRolesForUser
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2GetDynamicRolesForUserResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v2GetDynamicRolesForUserRequest'
        required: true
      tags:
        - RoleService
  /users/roles/search:
    post:
      summary: |-
        Search roles by multiple attributes and other filters
        Permission Level: Read
      operationId: RoleService_ListRolesWithFilter
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2ListRolesResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v2ListRolesWithFilterRequest'
        required: true
      tags:
        - RoleService
  /users/roles/user:
    get:
      summary: |-
        Get User Roles
         Permission Level: Read
      operationId: RoleService_GetUserRoles
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2GetUserRolesResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: tenantId
          description: 'Tenant of the user, Required : false'
          in: query
          required: false
          schema:
            type: string
        - name: userId
          description: 'User Id of the user, Required : true'
          in: query
          required: false
          schema:
            type: string
        - name: fieldMask
          description: |-
            FieldMask to control what fields are to be returned, if empty assumes everything, Required: false
            Valid path names are names of each field in the RoleResponse proto
          in: query
          required: false
          schema:
            type: string
      tags:
        - RoleService
  /users/roles/{roleId}:
    get:
      summary: |-
        Return one Role by tenant, domain and role id.
        Permission Level: Read
      operationId: RoleService_GetRole
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2RoleResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: roleId
          in: path
          required: true
          schema:
            type: string
        - name: tenantId
          in: query
          required: false
          schema:
            type: string
        - name: domain
          in: query
          required: false
          schema:
            type: string
        - name: scope
          in: query
          required: false
          schema:
            type: string
        - name: includePermissions
          description: 'if include permissions is true, it returns the role with its permissions, Default: false, Required: false'
          in: query
          required: false
          schema:
            type: boolean
        - name: fieldMask
          description: |-
            FieldMask to control what fields are to be returned, if empty assumes everything, Required: false
            Valid path names are names of each field in the RoleResponse proto
          in: query
          required: false
          schema:
            type: string
        - name: identifierType
          description: |-
            if identifier_type is ROLE_ID, then the role_id field is used as role_id for the role within a tenant and domain and scope.
            if identifier_type is GLOBAL_ID, then the role_id field is used as global_id for the role which is tenant_id + domain + scope + role_id concenated together. Required: false, Default: ROLE_ID

             - ROLE_ID: Identifier is a role_id, which is unique within a tenant and domain
             - GLOBAL_ID: Identifier is a global_id, which is tenant_id + domain + scope + role_id
          in: query
          required: false
          schema:
            type: string
            enum:
              - ROLE_ID
              - GLOBAL_ID
            default: ROLE_ID
      tags:
        - RoleService
    delete:
      summary: |-
        Delete a Role.
        Permission Level: Read-Write
      description: '[Deprecated: Please use the Bulk Delete Roles API.] Delete a Role.'
      operationId: RoleService_DeleteRole
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                type: object
                properties: {}
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: roleId
          in: path
          required: true
          schema:
            type: string
        - name: tenantId
          in: query
          required: false
          schema:
            type: string
        - name: domain
          in: query
          required: false
          schema:
            type: string
        - name: scope
          in: query
          required: false
          schema:
            type: string
      tags:
        - RoleService
      deprecated: true
    put:
      summary: |-
        Update a Role.
        Permission Level: Read-Write
      operationId: RoleService_UpdateRole
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2RoleResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: roleId
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleServiceUpdateRoleBody'
        required: true
      tags:
        - RoleService
  /users/roles/{roleId}/permissions:
    delete:
      summary: |-
        Remove permissions from a Role.
         It is required a Role and a list of permissions ids to remove.
         The process is remove the role from each permission (permission.proto for more information on permissions)
           Permission Level: Read-Write
      operationId: RoleService_DeleteRolePermissions
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                type: object
                properties: {}
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: roleId
          in: path
          required: true
          schema:
            type: string
        - name: ownerTenantId
          in: query
          required: false
          schema:
            type: string
        - name: domain
          in: query
          required: false
          schema:
            type: string
        - name: scope
          in: query
          required: false
          schema:
            type: string
        - name: permissionIds
          in: query
          required: false
          explode: true
          schema:
            type: array
            items:
              type: string
      tags:
        - RoleService
    post:
      summary: |-
        Add permissions to a Role.
         It is required a Role and a list of permissions to add.
         The process add the role in each permission (permission.proto for more information on permissions)
         Permission Level: Read-Write
      operationId: RoleService_AddRolePermissions
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                type: object
                properties: {}
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: roleId
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleServiceAddRolePermissionsBody'
        required: true
      tags:
        - RoleService
  /users/roles/{roleId}/subroles:
    delete:
      summary: |-
        Remove roles from a Role.
        It is required a Role and a list of roles to remove.
        Permission Level: Read-Write
      operationId: RoleService_DeleteSubroles
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2RoleResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: roleId
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleServiceDeleteSubrolesBody'
        required: true
      tags:
        - RoleService
    post:
      summary: |-
        Add roles to a Role.
         It is required a Role and a list of roles to add.
         Permission Level: Read-Write
      operationId: RoleService_AddSubroles
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2RoleResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: roleId
          description: 'Role ID of the role, Required: true'
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleServiceAddSubrolesBody'
        required: true
      tags:
        - RoleService
  /users/roles/{roleId}/users:
    delete:
      summary: |-
        Remove users to a Role.
        It is required a Role and a list of users to remove.
         Permission Level: Read-Write
      operationId: RoleService_DeleteRoleUsers
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2RoleResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: roleId
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleServiceDeleteRoleUsersBody'
        required: true
      tags:
        - RoleService
    post:
      summary: |-
        Add users to a Role.
        It is required a Role and a list of users to add.
         Permission Level: Read-Write
      operationId: RoleService_AddRoleUsers
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2RoleResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: roleId
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleServiceAddRoleUsersBody'
        required: true
      tags:
        - RoleService
  /users/roles/{roleId}/workspaces:
    delete:
      summary: |-
        Remove users to a Role.
         It is required a Role and a list of workspaces to remove.
         Permission Level: Read-Write
      operationId: RoleService_DeleteRoleWorkspaces
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2RoleResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: roleId
          description: 'Id of the role, Required : true'
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleServiceDeleteRoleWorkspacesBody'
        required: true
      tags:
        - RoleService
    post:
      summary: |-
        Add users to a Role.
         It is required a Role and a list of workspaces to add.
         Permission Level: Read-Write
      operationId: RoleService_AddRoleWorkspaces
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v2RoleResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googleRpcStatus'
      parameters:
        - name: roleId
          description: 'Id of the role, Required : true'
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleServiceAddRoleWorkspacesBody'
        required: true
      tags:
        - RoleService
servers:
  - url: https://prod-ui-zwseuprod01p.pp.zebra.com/api
    description: EU Server
  - url: https://prod-ui-zwsusprod01p.pp.zebra.com/api
    description: NA Server
components:
  requestBodies:
    v2DynamicRoleRequest:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/v2DynamicRoleRequest'
      required: true
  schemas:
    RoleServiceAddRolePermissionsBody:
      type: object
      properties:
        ownerTenantId:
          type: string
        domain:
          type: string
        scope:
          type: string
        permissionIds:
          type: array
          items:
            type: string
    RoleServiceAddRoleUsersBody:
      type: object
      properties:
        tenantId:
          type: string
        domain:
          type: string
        scope:
          type: string
        users:
          type: array
          items:
            $ref: '#/components/schemas/v2UniqueUserProto'
        fieldMask:
          type: string
    RoleServiceAddRoleWorkspacesBody:
      type: object
      properties:
        tenantId:
          type: string
          title: 'Tenant of the role, Required : false'
        domain:
          type: string
          title: 'Domain of the role, Required : true'
        scope:
          type: string
          title: 'Scope of the role, Required : false'
        workspaces:
          type: array
          items:
            $ref: '#/components/schemas/v2UniqueWorkspaceProto'
          title: 'List of workspaces to add to the role, Required : true'
        fieldMask:
          type: string
          title: 'FieldMask to control what fields are to be returned, if empty assumes everything, Required: false'
    RoleServiceAddSubrolesBody:
      type: object
      properties:
        tenantId:
          type: string
          title: 'The ID of the tenant. Defaults to the token''s tenant, Required: false'
        domain:
          type: string
          title: 'Domain of the role, Required: true'
        scope:
          type: string
          title: 'Scope of the role, Required : false'
        roles:
          type: array
          items:
            $ref: '#/components/schemas/v2UniqueRoleProto'
          description: 'List of subroles to add to the role. Required: true.'
        fieldMask:
          type: string
          title: 'FieldMask to control what fields are to be returned, if empty assumes everything, Required: false'
    RoleServiceDeleteRoleUsersBody:
      type: object
      properties:
        tenantId:
          type: string
        domain:
          type: string
        scope:
          type: string
        users:
          type: array
          items:
            $ref: '#/components/schemas/v2UniqueUserProto'
        fieldMask:
          type: string
    RoleServiceDeleteRoleWorkspacesBody:
      type: object
      properties:
        tenantId:
          type: string
          title: 'Tenant of the role, Required : false'
        domain:
          type: string
          title: 'Domain of the role, Required : true'
        scope:
          type: string
          title: 'Scope of the role, Required : false'
        workspaces:
          type: array
          items:
            $ref: '#/components/schemas/v2UniqueWorkspaceProto'
          title: 'List of workspaces to delete from the role, Required : true'
        fieldMask:
          type: string
          title: 'FieldMask to control what fields are to be returned, if empty assumes everything, Required: false'
    RoleServiceDeleteSubrolesBody:
      type: object
      properties:
        tenantId:
          type: string
        domain:
          type: string
        scope:
          type: string
        roles:
          type: array
          items:
            $ref: '#/components/schemas/v2UniqueRoleProto'
        fieldMask:
          type: string
    RoleServiceUpdateRoleBody:
      type: object
      properties:
        tenantId:
          type: string
        domain:
          type: string
        scope:
          type: string
        role:
          $ref: '#/components/schemas/v2UpdateRoleProto'
        deactivated:
          $ref: '#/components/schemas/v2UpdateDeactivated'
        updateFieldMask:
          type: string
          title: |-
            FieldMask to control what fields are to be updated, Required: false
            Valid path names UpdateRoleRequest
        displayName:
          type: string
          title: 'Display name of the role, Required: false'
        dynamic:
          type: boolean
          title: 'Dynamic flag of the role, Required: false'
        responseFieldMask:
          type: string
          title: 'FieldMask to control what fields are to be returned, Required: false'
    commonsSortType:
      type: string
      enum:
        - NONE
        - ASC
        - DESC
      default: NONE
    protobufAny:
      type: object
      properties:
        '@type':
          type: string
      additionalProperties: {}
    rpcStatus:
      type: object
      properties:
        code:
          type: integer
          format: int32
        message:
          type: string
        details:
          type: array
          items:
            $ref: '#/components/schemas/protobufAny'
    v2BasicRoleResponse:
      type: object
      properties:
        globalId:
          type: string
          title: Generated at time of creation -- it's tenant_id + domain + scope + role_id
        roleId:
          type: string
          title: Role id
        displayName:
          type: string
          title: Display name of the role
      title: The role basic data model, fewer fields
    v2CreateRoleProto:
      type: object
      properties:
        domain:
          type: string
          title: 'Domain of the role (example: platform, wcs, css), Required: false, Default: platform'
        scope:
          type: string
          title: 'Some more general scoping (like a particular app in the domain), Required: false'
        roleId:
          type: string
          title: 'Role Id of the role, Required: true'
        description:
          type: string
          title: 'Description of the role, Required: false'
        users:
          type: array
          items:
            $ref: '#/components/schemas/v2UniqueUserProto'
          title: 'List of users to add to the role. Required: false'
        roles:
          type: array
          items:
            $ref: '#/components/schemas/v2UniqueRoleProto'
          title: 'List of Subroles to add to the role. Required: false'
        systemLevel:
          type: boolean
          description: |-
            whether permission is a system_level permission or not, Default: false, Required: false
            Note: If role is being created by a user from tenant other than "root" then system_level will be set to false irrespective of what value is set for this boolean.
        workspaces:
          type: array
          items:
            $ref: '#/components/schemas/v2UniqueWorkspaceProto'
          title: 'List of workspaces to add to the role. Required: false'
        displayName:
          type: string
          title: 'A unique identifier/name of a role in a tenant & domain & scope, Required: false'
        dynamic:
          type: boolean
          title: 'Dynamic flag of the role, Required: false'
        isTemplate:
          type: boolean
          title: 'Flag controlling if the role is a template or not. UI team relies on this flag for creating permission_templates, Default: false'
        attributes:
          type: array
          items:
            $ref: '#/components/schemas/v2RoleAttributeProto'
          title: 'List of role specific attributes, Required: false'
        roleType:
          $ref: '#/components/schemas/v2RoleType'
    v2CreateRolesRequest:
      type: object
      properties:
        tenantId:
          type: string
          title: 'Tenant of all the roles to be created, Required: false'
        createRoles:
          type: array
          items:
            $ref: '#/components/schemas/v2CreateRoleProto'
          title: 'List of roles to add, Required: true'
        rollback:
          type: boolean
          title: 'Whether to rollback entire transaction if error in any roles, Default: false, Required: false'
    v2DeleteRoleRequestProto:
      type: object
      properties:
        domain:
          type: string
          title: 'domain of the role to fetch, Required: true'
        scope:
          type: string
          title: 'Role scope (ZPA, Reflexis, etc), Required : false'
        roleId:
          type: string
          title: 'role_id of the role to delete, Required: true'
    v2DeleteRolesRequest:
      type: object
      properties:
        tenantId:
          type: string
          title: 'tenant of the roles to delete, Required: true'
        roles:
          type: array
          items:
            $ref: '#/components/schemas/v2DeleteRoleRequestProto'
          title: 'list of roles to delete, Required: true'
    v2DynamicRoleRequest:
      type: object
      properties:
        roleId:
          type: string
          title: 'role_id associated with the role that is to be activated/deactivated, Required : true'
        scope:
          type: string
          title: 'scope associated with the role that is to be activated/deactivated, Required : false'
        domain:
          type: string
          title: 'domain associated with the role that is to be activated/deactivated, Required : false'
    v2DynamicRoleResponse:
      type: object
      properties:
        tenantId:
          type: string
        userId:
          type: string
        permissionAuth:
          type: array
          items:
            $ref: '#/components/schemas/v2PermissionAuth'
          title: Accumulated list of permissions
    v2DynamicRolesResponse:
      type: object
      properties:
        tenantId:
          type: string
        domain:
          type: string
        scope:
          type: string
        roleId:
          type: string
        displayName:
          type: string
    v2ExclusionFilterMap:
      type: object
      properties:
        fieldName:
          type: string
          description: 'the entity field name. Required: true.'
        values:
          type: array
          items:
            type: string
          description: 'the values that should be excluded. Required: true.'
    v2FilterBoolean:
      type: string
      enum:
        - FILTER_DISABLED
        - FILTER_TRUE
        - FILTER_FALSE
      default: FILTER_DISABLED
    v2GetAvailableRolesUserResponse:
      type: object
      properties:
        roles:
          type: array
          items:
            $ref: '#/components/schemas/v2UniqueRoleProto'
          title: List of available roles for the user. from multi-site model or site template
    v2GetDynamicRolesForUserRequest:
      type: object
      properties:
        token:
          type: string
          title: 'Valid phoenix token for the system, Required : true'
    v2GetDynamicRolesForUserResponse:
      type: object
      properties:
        roles:
          type: array
          items:
            $ref: '#/components/schemas/v2DynamicRolesResponse'
          title: List of roles
    v2GetUserRolesResponse:
      type: object
      properties:
        roles:
          type: array
          items:
            $ref: '#/components/schemas/v2RoleResponse'
          title: List of all the roles of user
    v2IdentifierType:
      type: string
      enum:
        - ROLE_ID
        - GLOBAL_ID
      default: ROLE_ID
      title: |-
        - ROLE_ID: Identifier is a role_id, which is unique within a tenant and domain
         - GLOBAL_ID: Identifier is a global_id, which is tenant_id + domain + scope + role_id
    v2ListBasicRolesResponse:
      type: object
      properties:
        roles:
          type: array
          items:
            $ref: '#/components/schemas/v2BasicRoleResponse'
        resultsTruncated:
          type: boolean
    v2ListRolesResponse:
      type: object
      properties:
        roles:
          type: array
          items:
            $ref: '#/components/schemas/v2RoleResponse'
        nextPageToken:
          type: string
    v2ListRolesWithFilterRequest:
      type: object
      properties:
        tenantId:
          type: array
          items:
            type: string
          title: 'Tenant of the Roles to fetch, Required: false'
        domain:
          type: string
          title: 'Domain of the role (example: zpa, reflexis, wfc, etc), Required: false'
        scope:
          type: string
          title: 'Some more general scoping (like a particular app in the domain), Required: false'
        pageToken:
          type: string
          title: 'MongoDB Field, describes the encoded page token for page traversal, Required: false'
        pageSize:
          type: integer
          format: int32
          description: 'Requested size of the next page of data. If not set, the default page size is 10, Required: false.'
        sortField:
          type: string
          title: 'Sort field, valid values: domain, scope, roleId, lastUpdated or displayName. Default: domain, Required: false'
        sortType:
          $ref: '#/components/schemas/commonsSortType'
        includePermissions:
          type: boolean
          title: 'if include permissions is true, it returns the roles with its permissions, Default: false, Required: false'
        genericFilter:
          type: string
          title: 'Generic filter for role fields (role_id, domain, scope). Required: false'
        specificFilter:
          $ref: '#/components/schemas/v2RoleSearchFilter'
        startsWithSingleCharacter:
          type: boolean
          title: 'Ability to search for a single starts with character, only applicable to specific_filter: display_name, Required: false, Default: false'
        isTemplate:
          type: boolean
          title: 'Flag to include roles which have isTemplate enabled, Default: false, Required: false'
        exclusionFilters:
          type: array
          items:
            $ref: '#/components/schemas/v2ExclusionFilterMap'
          title: |-
            Generic exclusion filter for role fields (tenantId). Required: false.
            valid field_name values: tenantId
        enabledStatus:
          $ref: '#/components/schemas/v2RoleEnabledScopeStatus'
        fieldMask:
          type: string
          title: |-
            FieldMask to control what fields are to be returned, if empty assumes everything, Required: false
            Valid path names are names of each field in the RoleResponse proto
    v2PermissionAuth:
      type: object
      properties:
        permissionId:
          type: string
        domain:
          type: string
        scope:
          type: string
        type:
          type: array
          items:
            type: string
        grants:
          type: array
          items:
            type: string
        tenants:
          type: array
          items:
            type: string
        targets:
          type: array
          items:
            $ref: '#/components/schemas/v2TargetAuth'
    v2PickUpDynamicRolesRequest:
      type: object
      properties:
        tenantId:
          type: string
          title: 'Required: true'
        userId:
          type: string
          title: 'Required: true'
        roles:
          type: array
          items:
            $ref: '#/components/schemas/v2DynamicRoleRequest'
          title: List of roles to activate
    v2PickUpDynamicRolesResponse:
      type: object
      properties:
        permissionAuth:
          type: array
          items:
            $ref: '#/components/schemas/v2PermissionAuth'
          title: List of picked-up permissions
    v2RoleAttributeProto:
      type: object
      properties:
        scope:
          type: string
          title: 'General scoping for role attribute. Required: false'
        fieldName:
          type: string
          title: 'Name of the attribute. Required: true'
        value:
          type: string
          title: 'Value of the attribute. Required: false'
        domain:
          type: string
          title: 'Domain of the attribute. Required : false'
    v2RoleEnabledScopeStatus:
      type: string
      enum:
        - ROLE_SCOPE_BOTH
        - ROLE_SCOPE_ENABLED
        - ROLE_SCOPE_DISABLED
      default: ROLE_SCOPE_BOTH
    v2RoleResponse:
      type: object
      properties:
        globalId:
          type: string
          title: Generated at time of creation -- it's tenant_id + domain + scope + role_id
        tenantId:
          type: string
          title: The id of the tenant
        domain:
          type: string
          title: 'The platform domain (example: zpa, reflexis, wfc)'
        scope:
          type: string
          description: 'Some more general scoping for the data (like a particular app in the domain). Required: false.'
        roleId:
          type: string
          title: Role id
        description:
          type: string
          description: 'Role description. Required: false.'
        users:
          type: array
          items:
            $ref: '#/components/schemas/v2UniqueUserProto'
          title: List of users that have this role
        roles:
          type: array
          items:
            $ref: '#/components/schemas/v2UniqueRoleProto'
          title: List of roles that have this role
        systemLevel:
          type: boolean
          title: Use to prevent creation or deletion of system roles
        workspaces:
          type: array
          items:
            $ref: '#/components/schemas/v2UniqueWorkspaceProto'
          title: List of workspaces that have this role
        permissionsIds:
          type: array
          items:
            type: string
          title: List of permission ids for that role
        deactivated:
          type: boolean
          title: 'Flag controlling if the role is deactivated, Default: false'
        creationTime:
          type: string
          format: date-time
          title: Time of creation of role entity
        lastUpdated:
          type: string
          format: date-time
          title: Time of most recent update to the role entity
        displayName:
          type: string
          title: Display name of the role
        dynamic:
          type: boolean
          title: 'Dynamic flag of the role, Required: false'
        attributes:
          type: array
          items:
            $ref: '#/components/schemas/v2RoleAttributeProto'
          title: Role Attributes
        roleType:
          $ref: '#/components/schemas/v2RoleType'
      title: The role data model
    v2RoleSearchFilter:
      type: object
      properties:
        domain:
          type: string
          title: Optional - domain of the role to search
        scope:
          type: string
          title: Optional - scope of the role to search
        roleId:
          type: string
          title: Optional - roleId of the role to search
        systemLevel:
          $ref: '#/components/schemas/v2FilterBoolean'
        displayName:
          type: string
          title: Optional - displayName of the role to search
        attributes:
          type: array
          items:
            $ref: '#/components/schemas/v2RoleAttributeProto'
          title: |-
            Optional - attributes of the role to search
            Used in the POST API
    v2RoleSpecificFilter:
      type: object
      properties:
        domain:
          type: string
        scope:
          type: string
        roleId:
          type: string
        systemLevel:
          $ref: '#/components/schemas/v2FilterBoolean'
        displayName:
          type: string
      title: 'This will create and AND criteria on the specific fields for any of the non-blank values. Required: false'
    v2RoleType:
      type: string
      enum:
        - UNDEFINED
        - USER
        - ADMIN
      default: UNDEFINED
    v2RoleTypeFilter:
      type: string
      enum:
        - ALL_ROLES
        - USER_ONLY
        - ADMIN_ONLY
      default: ALL_ROLES
      title: |-
        - ALL_ROLES: All Roles
         - USER_ONLY: User Roles only
         - ADMIN_ONLY: Admin Roles only
    v2TargetAuth:
      type: object
      properties:
        idType:
          type: string
        id:
          type: string
    v2UniqueRoleProto:
      type: object
      properties:
        tenantId:
          type: string
          description: 'The ID of the tenant. Required: false. Defaults to the tenant of the user making the call.'
        domain:
          type: string
          description: |-
            The platform domain. Required: true. (e.g. ZPA, Reflexis, WFC)
            Defaults to the domain in the request.
        scope:
          type: string
          description: 'Some more general scoping for the data (like a particular app in the domain). Required: false.'
        roleId:
          type: string
          description: 'The role ID. Required: true.'
        userIds:
          type: array
          items:
            type: string
          title: 'The User Ids for the Unique Role Proto, Required: false'
    v2UniqueUserProto:
      type: object
      properties:
        tenantId:
          type: string
          description: 'The ID of the tenant. Required: false. Defaults to the tenant of the user making the call.'
        userId:
          type: string
          description: 'The user ID. Required: true.'
        firstName:
          type: string
          description: 'The first name. Required: false.'
        lastName:
          type: string
          description: 'The last name. Required: false.'
    v2UniqueWorkspaceProto:
      type: object
      properties:
        tenantId:
          type: string
          description: 'The ID of the tenant. Required: false. Defaults to the tenant of the user making the call.'
        name:
          type: string
          title: 'Name of the workspace, Required: true'
        workspaceType:
          type: string
          title: 'Workspace Type of the workspace, Required: true'
        userIds:
          type: array
          items:
            type: string
          title: 'The User Ids for the Unique Workspace Proto, Required: false'
    v2UpdateDeactivated:
      type: object
      properties:
        deactivated:
          type: boolean
    v2UpdateRoleProto:
      type: object
      properties:
        description:
          type: string
        attributes:
          type: array
          items:
            $ref: '#/components/schemas/v2RoleAttributeProto'
          title: 'role specific attributes, Required: false'
    googleRpcStatus:
      type: object
      properties:
        code:
          type: integer
          format: int32
        message:
          type: string
        details:
          type: array
          items:
            $ref: '#/components/schemas/protobufAny'
  securitySchemes:
    Authorization:
      type: apiKey
      description: Bearer token
      name: Authorization
      in: header