openapi: 3.0.3
info:
  title: P0 Roles Management API
  version: 1.0.0
servers:
  - url: https://api.p0.app/o/{orgId}/settings/roles
    variables:
      orgId:
        default: demo-org
        description: The organization ID
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: API Key
  parameters:
    role:
      name: role
      in: path
      required: true
      schema:
        type: string
        enum: [viewer, iamViewer, iamOwner, manager, owner]
    email:
      name: email
      in: path
      required: true
      schema:
        type: string
        format: email
    group:
      name: group
      in: path
      required: true
      schema:
        type: string
  responses:
    UnauthorizedError:
      description: Unauthorized
    BadRequestError:
      description: Bad request
paths:
  /{role}/bindings/users/{email}:
    put:
      summary: Assign a role to a user
      parameters:
        - $ref: "#/components/parameters/role"
        - $ref: "#/components/parameters/email"
      security:
        - bearerAuth: []
      responses:
        204:
          description: Role assigned
        400:
          $ref: "#/components/responses/BadRequestError"
        401:
          $ref: "#/components/responses/UnauthorizedError"
      requestBody:
        required: false
        content:
          application/json: {}
    delete:
      summary: Remove a user's role
      parameters:
        - $ref: "#/components/parameters/role"
        - $ref: "#/components/parameters/email"
      security:
        - bearerAuth: []
      responses:
        204:
          description: Role removed
        400:
          $ref: "#/components/responses/BadRequestError"
        401:
          $ref: "#/components/responses/UnauthorizedError"
  /{role}/bindings/groups/{group}:
    put:
      summary: Assign a role to a group
      parameters:
        - $ref: "#/components/parameters/role"
        - $ref: "#/components/parameters/group"
      security:
        - bearerAuth: []
      responses:
        201:
          description: Group role unchanged
        204:
          description: Role assigned to group
        400:
          $ref: "#/components/responses/BadRequestError"
        401:
          $ref: "#/components/responses/UnauthorizedError"
    delete:
      summary: Remove a group role
      parameters:
        - $ref: "#/components/parameters/role"
        - $ref: "#/components/parameters/group"
      security:
        - bearerAuth: []
      responses:
        204:
          description: Group role removed
        400:
          $ref: "#/components/responses/BadRequestError"
        401:
          $ref: "#/components/responses/UnauthorizedError"
