openapi: 3.0.1
info:
  title: ForgeRock Identity Cloud - Identity Governance (IGA)
  description: This is the API specification for the Access Request related endpoints and data model for ForgeRock Identity Cloud - Identity Governance (IGA).
  version: "1.0.0"
servers:
  - url: '{protocol}://{host}:{port}/iga'
    variables:
      protocol:
        default: http
        description: protocol
      host:
        default: localhost
        description: host
      port:
        default: '3005'
tags:
  - name: Segregation of Duty
    description: SoD and Policy endpoints.
paths:
  /governance/policy:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Segregation of Duty
      summary: Query policies
      description: The endpoint will return policies stored within the IGA store, based on a set of query parameters.
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Policy'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    post:
      tags:
        - Segregation of Duty
      summary: Create a new policy
      description: The end point will allow for creation of a new policy object within IGA.
      parameters:
        - $ref: "#/components/parameters/allRequestsAction"
      requestBody:
        description: The contents of the new policy
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyRequest'
        required: true
      responses:
        201:
          description: Creation success, returns the saved Policy object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/policy/search:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Search policy objects
      description: Query the policy objects using a targeted search filter
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Policy'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/policy/{id}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Segregation of Duty
      summary: Get policy by ID
      description: The endpoint will return the policy with the provided ID.
      parameters:
        - name: id
          in: path
          description: Id of the policy
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    put:
      tags:
        - Segregation of Duty
      summary: Update an existing policy object
      description: The end point will allow for updating an existing policy object within IGA.
      parameters:
        - name: id
          in: path
          description: ID of the policy to update
          required: true
          schema:
            type: string
      requestBody:
        description: The contents of the updated policy
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyBody'
        required: false
      responses:
        200:
          description: Update success, returns the saved policy object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
    delete:
      tags:
        - Segregation of Duty
      summary: Delete an existing policy
      description: The end point will allow for deleting an existing policy object within IDM.
      parameters:
        - name: id
          in: path
          description: ID of the policy to delete
          required: true
          schema:
            type: string
      responses:
        200:
          description: Delete success, returns the removed policy object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/policy/{id}/scan:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Scan the given policy for violations
      description: The end point will run a scan on all of the given rules of a policy, and create violations if desired.
      parameters:
        - name: id
          in: path
          description: ID of the policy to scan
          required: true
          schema:
            type: string
        - name: simulate
          in: query
          description: Whether or not this scan is a simulation, true means no violation tasks will be created, false or not present will create violations.
          required: false
          schema:
            type: string
        - name: waitForCompletion
          in: query
          description: Whether or not to await the completion of the scan before returning, true will wait, false or not present will return after scan creation.
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
        required: false
      responses:
        201:
          description: Policy scan started
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyScan'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/policy/{id}/rules:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Segregation of Duty
      summary: Get policy rules
      description: Given Policy Id, retrieve the policy rules associated with it.
      parameters:
        - name: id
          in: path
          description: ID of the policy
          required: true
          schema:
            type: string
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyRulesResult'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/policy/rule:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Segregation of Duty
      summary: Query policy rules
      description: The endpoint will return policy rules stored within the IGA store, based on a set of query parameters.
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_queryFilter"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PolicyRule'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    post:
      tags:
        - Segregation of Duty
      summary: Create a new policy rule
      description: The end point will allow for creation of a new policy rule object within IGA.
      parameters:
        - $ref: "#/components/parameters/allRequestsAction"
      requestBody:
        description: The contents of the new policy rule
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyRuleBody'
        required: true
      responses:
        201:
          description: Creation success, returns the saved Policy Rule object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyRule'
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/policy/rule/search:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Search policy rules
      description: Query the policy rule objects using a targeted search filter
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PolicyRule'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/policy/rule/{id}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Segregation of Duty
      summary: Get policy rule by ID
      description: The endpoint will return the policy rule with the provided ID.
      parameters:
        - name: id
          in: path
          description: Id of the policy rule
          required: true
          schema:
            type: string
        - name: resolveSchemas
          in: query
          description: When 'true', enrich the remediation.schemas property with the full schema objects rather than just the IDs
          required: false
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyRule'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    post:
      tags:
        - Segregation of Duty
      summary: Duplicate the given policy rule
      description: Creates a duplicate of the selected policy rule.
      parameters:
        - $ref: "#/components/parameters/allRequestsAction"
        - name: id
          in: path
          description: Id of the policy rule
          required: true
          schema:
            type: string
      requestBody:
        description: The contents of the duplicate request (empty body)
        content:
          application/json:
            schema:
              type: object
        required: false
      responses:
        201:
          description: Returns new policy rule. Note rule will be set as inactive by default.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyRuleBody'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    put:
      tags:
        - Segregation of Duty
      summary: Update an existing policy rule object
      description: The end point will allow for updating an existing policy rule object within IGA.
      parameters:
        - name: id
          in: path
          description: ID of the policy rule to update
          required: true
          schema:
            type: string
      requestBody:
        description: The contents of the updated policy rule
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyRuleBody'
        required: false
      responses:
        200:
          description: Update success, returns the saved policy rule object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyRule'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
    delete:
      tags:
        - Segregation of Duty
      summary: Delete an existing policy rule
      description: The end point will allow for deleting an existing policy rule object within IDM.
      parameters:
        - name: id
          in: path
          description: ID of the policy rule to delete
          required: true
          schema:
            type: string
      responses:
        200:
          description: Delete success, returns the removed policy rule object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyRule'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/policy/rule/{id}/scan:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Scan the given policy for violations
      description: The end point will run a scan on the given policy rule, and create violations if desired.
      parameters:
        - name: id
          in: path
          description: ID of the policy rule to scan
          required: true
          schema:
            type: string
        - name: simulate
          in: query
          description: Whether or not this scan is a simulation, true means no violation tasks will be created, false or not present will create violations.
          required: false
          schema:
            type: string
        - name: waitForCompletion
          in: query
          description: Whether or not to await the completion of the scan before returning, true will wait, false or not present will return after scan creation.
          required: false
          schema:
            type: string
      responses:
        201:
          description: Policy rule scan started
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyScan'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/policy/user/{id}/scan:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Run a scan for violations on the given single user
      description: The end point will run a scan on the given user rule, and return potential violations
      parameters:
        - name: id
          in: path
          description: ID of the user to scan
          required: true
          schema:
            type: string
        - name: simulate
          in: query
          description: Whether or not this scan is a simulation, true means no violation tasks will be created, false or not present will create violations.
          required: false
          schema:
            type: string
      requestBody:
        description: If running a preventative scan, additional access may be provided to simulate access not yet granted to user
        content:
          application/json:
            schema:
              type: object
              properties:
                additionalAccess:
                  type: array
                  description: Additional access to mock on user
                  items:
                    type: object
                    properties:
                      type:
                        type: string
                        description: Type of access (e.g. ResourceGrant)
                      entitlementId:
                        type: string
                        description: ID of entitlement, for those types of access that include entitlements
                      accountId:
                        type: string
                        description: ID of account, for those types of access that include accounts
                policyRuleFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
        required: false
      responses:
        201:
          description: User policy scan started
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyScan'
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/policy/scan:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Segregation of Duty
      summary: Query policy scans
      description: The endpoint will return policy scans stored within the IGA store, based on a set of query parameters.
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PolicyScan'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/policy/scan/search:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Search policy scans
      description: Query the policy scan objects using a targeted search filter
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PolicyScan'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/policy/scan/{id}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Segregation of Duty
      summary: Get policy scan by ID
      description: The endpoint will return the policy scan with the provided ID.
      parameters:
        - name: id
          in: path
          description: Id of the policy scan
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyScan'
        404:
          description: 'ID not found'
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    delete:
      tags:
        - Segregation of Duty
      summary: Delete an existing policy scan
      description: The end point will allow for deleting an existing policy scan object within IGA.
      parameters:
        - name: id
          in: path
          description: ID of the policy scan to delete
          required: true
          schema:
            type: string
      responses:
        200:
          description: Delete success, returns the removed policy scan object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyScan'
        404:
          description: 'ID not found'
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/user/violation:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Segregation of Duty
      summary: Get violations the logged in user has access too.
      description: Query the logged in user's violation objects.
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Violation'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Segregation of Duty
      summary: Get violations
      description: Query the violation objects
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Violation'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    post:
      tags:
        - Segregation of Duty
      summary: Creates a violation
      description: creates a violation with the given body
      parameters:
        - $ref: "#/components/parameters/allRequestsAction"
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/Violation'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Violation'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/allow:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Bulk API to close entire violations, allowing access to remain indefinitely
      description: Once a phase (or phases) have chosen to allow, this endpoint can be used to close and complete the violations with an outcome of allow
      parameters:
        - name: waitForCompletion
          in: query
          description: Whether or not to await the completion of violations before returning, true will wait, false or not present will return after phase completion.
          required: false
          schema:
            type: string
      requestBody:
        description: Array of violations to act on and additional properties for the action.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkBaseViolationsRequest'
        required: true
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkViolationResponse'
        403:
          description: User is not authorized to allow violations
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/cancel-exception:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Bulk API to cancel exception on a group of violations.
      description: As an actor on violations, cancel existing exceptions, reverting the violations back to in-progress.
      requestBody:
        description: Array of violations to act on and additional properties for the action.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkBaseViolationsRequest'
        required: true
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkViolationResponse'
        403:
          description: User is not authorized to comment violations
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/comment:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Bulk API to allow actors to add a comment to the violations.
      description: As an actor on violations, add a comment to the violation objects.
      requestBody:
        description: Array of violations to act on and additional properties for the action.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkCommentViolationsRequest'
        required: true
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkViolationResponse'
        403:
          description: User is not authorized to comment violations
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/exception:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Bulk API to allow access to remain for a defined period of time.
      description: As an actor on violations, grant an exception to the violating access.
      requestBody:
        description: Array of violations to act on and additional properties for the action.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkExceptionViolationsRequest'
        required: true
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkViolationResponse'
        403:
          description: User is not authorized to comment violations
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/reassign:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Bulk API to edit the actors and permissions on the violations.
      description: As a violation actor, edit the list of active actors on the violation tasks.
      requestBody:
        description: Array of violations to act on and additional properties for the action.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkReassignViolationsRequest'
        required: true
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkViolationResponse'
        403:
          description: User is not authorized to comment violations
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/search:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Search violations
      description: Query the violation objects using a targeted search filter
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Violation'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/user/violation/search:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Search violations the logged in user is associated with.
      description: Query the logged in user's violation objects using a targeted search filter
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
        - name: actorStatus
          in: query
          description: Actor status to search, comma-separated for multiple, e.g. "active", "inactive", or "active,inactive"
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Violation'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Segregation of Duty
      summary: Get a violation by id
      description: Query the contents of a single violation object
      parameters:
        - name: id
          in: path
          description: Id of the violation
          required: true
          schema:
            type: string
        - name: resolveSchemas
          in: query
          description: When 'true', enrich the policyRule remediation schemas property with the full schema objects rather than just the IDs
          required: false
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        404:
          description: Violation does not exist
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    put:
      tags:
        - Segregation of Duty
      summary: Updates a given violation
      description: Updates a given violation with the given body
      parameters:
        - name: id
          in: path
          description: Id of the violation
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/Violation'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Violation'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    delete:
      tags:
        - Segregation of Duty
      summary: Deletes a Violation
      description: Deletes a violation from the given id
      parameters:
        - name: id
          in: path
          description: Id of the violation
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: string
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/allow:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Close entire violation, allowing access to remain indefinitely
      description: Once a phase (or phases) have chosen to allow, this endpoint can be used to close and complete the violation with an outcome of allow
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the violation
          schema:
            type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              type: object
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to allow violation
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/comment:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Comment on violation
      description: As an actor on a violation, add a comment to the violation object.
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the violation
          schema:
            type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              required: [ comment ]
              properties:
                comment:
                  type: string
                  description: Comment to leave on violation
        required: true
      responses:
        201:
          description: Comment added
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to comment on violation
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/remediate:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Complete a violation with an outcome of remediate
      description: Once a phase (or phases) have chosen to remediate the violation, this endpoint can be used to complete the violation with an outcome of remediate, and continue the workflow on to either the automated or manual process for fulfilling the remediation.
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the violation
          schema:
            type: string
      requestBody:
        description: Contents of the action.  Properties will be determined by the requirements of the remediation schema chosen by the id provided in the body.
        content:
          application/json:
            schema:
              type: object
              properties:
                id:
                  type: string
                  description: ID of the remediation schema user has chosen
        required: true
      responses:
        200:
          description: Remediation process begun
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to remediate violation
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/remediation/status/{status}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Update the remediationStatus of a violation that is currently being remediated
      description: For violations that have been given an outcome of 'remediate', this endpoint will allow the remediationStatus key to be updated, e.g. from in-progress to complete, and will finalize the violation when appropriate.
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the violation
          schema:
            type: string
        - name: status
          in: path
          required: true
          description: Status to update remediationStatus to
          schema:
            type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              type: object
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        404:
          description: 'Violation ID was not found'
          content:  {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{violationId}/phases:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      description: Add phase to violation
      parameters:
        - name: violationId
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                phase:
                  $ref: '#/components/schemas/TaskPhase'
                actors:
                  type: array
                  items:
                    $ref: '#/components/schemas/ViolationActor'
      responses:
        200:
          description: OK
        404:
          description: 'Violation not found'
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/allow:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Make a decision to allow access to remain
      description: As an actor on a violation, allow the user to continue to violate the defined rule in perpetuity
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the violation
          schema:
            type: string
        - name: phaseName
          in: path
          required: true
          description: Name of the phase
          schema:
            type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              type: object
              properties:
                comment:
                  type: string
                  description: Comment justifying allow
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        404:
          description: Violation not found
          content: {}
        403:
          description: User not authorized to take action
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/cancel-exception:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Cancel an exception on a violation
      description: As an actor on a violation, cancel an existing exception, reverting the violation back to in-progress.
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the violation
          schema:
            type: string
        - name: phaseName
          in: path
          required: true
          description: Name of the phase
          schema:
            type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              type: object
              properties:
                comment:
                  type: string
                  description: Comment describing the reason for exception being canceled.
      responses:
        200:
          description: Exception canceled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to take action
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/comment:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Comment on violation
      description: As an actor on a violation, add a comment to the violation object.
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the violation
          schema:
            type: string
        - name: phaseName
          in: path
          required: true
          description: Name of the phase
          schema:
            type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              required: [ comment ]
              properties:
                comment:
                  type: string
                  description: Comment to leave on violation
        required: true
      responses:
        200:
          description: Comment added
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to take action
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/exception:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Allow access to remain for a defined period of time
      description: As an actor on a violation, grant an exception to the violating access.
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the violation
          schema:
            type: string
        - name: phaseName
          in: path
          required: true
          description: Name of the phase
          schema:
            type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              required: [ exceptionExpirationDate ]
              properties:
                exceptionExpirationDate:
                  type: string
                  description: Date that exception will expire
                comment:
                  type: string
                  description: Comment to leave on exception
        required: true
      responses:
        200:
          description: Exception granted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: Violation not found
          content: {}
        401:
          description: User not authorized to make exception on violation
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/reassign:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Edit the actors and permissions on the violation
      description: As a violation actor, edit the list of active actors on a violation task
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the violation
          schema:
            type: string
        - name: phaseName
          in: path
          required: true
          description: Name of the phase
          schema:
            type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              required: [ updatedActors ]
              properties:
                updatedActors:
                  type: array
                  items:
                    $ref: '#/components/schemas/ViolationActor'
        required: true
      responses:
        200:
          description: Actors reassigned
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to take action
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/remediate:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Make a decision to remediate access
      description: As an actor on a violation, choose to remediate the access, kicking off the remediation workflow assigned to the violation.  Request body will depend on remediation schema chosen by user
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the violation
          schema:
            type: string
        - name: phaseName
          in: path
          required: true
          description: Name of the phase
          schema:
            type: string
      requestBody:
        description: Contents of the action.  Properties will be determined by the requirements of the remediation schema chosen by the id provided in the body.
        content:
          application/json:
            schema:
              type: object
              properties:
                id:
                  type: string
                  description: ID of the remediation schema user has chosen
        required: true
      responses:
        200:
          description: Remediation process begun
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to take action
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/complete:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Mark a violation provisioning task as complete
      description: As an actor on a manual provisioning task to handle violation remediation, mark the action as completed
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the violation
          schema:
            type: string
        - name: phaseName
          in: path
          required: true
          description: Name of the phase
          schema:
            type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              type: object
              properties:
                comment:
                  type: string
                  description: Comment for the complete action
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to take action
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/cancel:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Mark a violation provisioning task as canceled (a.k.a not completed)
      description: As an actor on a manual provisioning task to handle violation remediation, mark the action as canceled (not completed)
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the violation
          schema:
            type: string
        - name: phaseName
          in: path
          required: true
          description: Name of the phase
          schema:
            type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              type: object
              properties:
                comment:
                  type: string
                  description: Comment reason for cancel
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to take action
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/remediationSchema:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Segregation of Duty
      description: Get list of supported violation remediation schemas
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_queryFilter"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/RemediationSchema'
        500:
          description: Server error
          content: {}
    post:
      tags:
        - Segregation of Duty
      description: Create new violation remediation schema
      parameters:
        - $ref: "#/components/parameters/allRequestsAction"
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemediationSchema'
      responses:
        201:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemediationSchema'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/remediationSchema/search:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      description: Search remediation schema
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemediationSchema'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemediationSchema'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/remediationSchema/{violationRemediationSchemaId}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Segregation of Duty
      description: Get the violation remediation schema by ID
      parameters:
        - name: violationRemediationSchemaId
          in: path
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemediationSchema'
        404:
          description: Remediation schema not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    put:
      tags:
        - Segregation of Duty
      description: Update existing violation remediation schema
      parameters:
        - name: violationRemediationSchemaId
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemediationSchema'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemediationSchema'
        404:
          description: Remediation schema not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    delete:
      tags:
        - Segregation of Duty
      description: Delete violation remediation schema
      parameters:
        - name: violationRemediationSchemaId
          in: path
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK
        404:
          description: Remediation schema not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/scan/{scanType}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      summary: Check violation objects for certain criteria.
      description: This endpoint executes checks on active violation objects for things like reminder notifications, expiration, creation status, etc.
      parameters:
        - name: scanType
          in: path
          required: true
          description: Type of scan check to run
          schema:
            type: string
            enum: [reminder, expiration, escalation, exception]
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: object
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
components:
  parameters:
    apiVersionHeader:
      name: Accept-API-Version
      in: header
      description: API version to use for the request. If no value is provided, latest version of API is used to process the request.
      required: false
      schema:
        type: string
        example: resource=1.0
    _pageSize:
      name: _pageSize
      in: query
      description: Number of response result objects to return.
      schema:
        type: integer
        example: 10
    _pagedResultsOffset:
      name: _pagedResultsOffset
      in: query
      description: Offset number of the record from which to start the paginated results.
      schema:
        type: integer
        example: 10
    _fields:
      name: _fields
      in: query
      description: The list of fields to return for each entry in the response result. Comma-separated for multiple values.
      schema:
        type: string
        example: user.userName,application.name,id
    _sortKeys:
      name: _sortKeys
      in: query
      description: The property on which to sort the results.
      schema:
        type: string
        example: application.name
    _sortDir:
      name: _sortDir
      in: query
      description: The direction of sort, asc or desc.
      schema:
        type: string
        example: asc
        enum:
          - asc
          - desc
    _searchAfter:
      name: _searchAfter
      in: query
      description: The sort property values of the last entry to continue searching from. Comma-separated for multiple values.
      schema:
        type: string
        example: a321329c-a7e6-47ad-8349-99b6e38f9a59
    _queryFilter:
      name: _queryFilter
      in: query
      description: query filter with expression
      schema:
        type: string
    allRequestsAction:
      name: _action
      in: query
      required: true
      description: Action to be performed for requests endpoint.
      schema:
        type: string
        enum:
          - create
          - duplicate
  schemas:
    BulkBaseViolationsRequest:
      type: object
      required:
        - ids
      properties:
        ids:
          type: array
          description: An array of all violation ids to act on.
          items:
            type: string
          example: ["e9e4d260-1b55-4331-8468-5824344b8bc3",
                    "01d8ccf0-e132-49f1-9c82-c52a6fea0154"]
        comment:
          type: string
          description: Comment or justification for this action.
          example: Justification for this action.
    BulkCommentViolationsRequest:
      allOf:
        - $ref: '#/components/schemas/BulkBaseViolationsRequest'
      type: object
      required:
        - comment
    BulkExceptionViolationsRequest:
      allOf:
        - $ref: '#/components/schemas/BulkBaseViolationsRequest'
      required:
        - exceptionExpirationDate
      type: object
      properties:
        exceptionExpirationDate:
          type: string
          description: Date that exception will expire
          example: "2024-04-24T20:36:14+00:00"
    BulkReassignViolationsRequest:
      allOf:
        - $ref: '#/components/schemas/BulkBaseViolationsRequest'
      required:
        - updatedActors
      type: object
      properties:
        updatedActors:
          type: array
          items:
            $ref: '#/components/schemas/ViolationActor'
    BulkViolationRequest:
      required:
        - id
        - phaseName
      type: object
      description: Object required to perform an action over the bulk APIS
      properties:
        id:
          type: string
          description: Violation ID
          example: 468332b1-d40d-4118-8289-5b2b6bfa7367
        phaseName:
          type: string
          description: Phase name
          example: violationTask-df7f65b04ec3
    BulkViolationResponse:
      required:
        - message
        - idsNotActedOn
      type: object
      properties:
        message:
          type: string
          description: Message indicating that the action was complete.
          example: Action 'allow' complete.
        idsNotActedOn:
          type: array
          description: An array of the violations that could not be acted on.
          items:
            $ref: '#/components/schemas/BulkViolationErrorResponse'
    BulkViolationErrorResponse:
      required:
        - id
        - errorMessage
        - errorCode
      properties:
        id:
          type: string
          description: Violation ID
          example: 09e01632-b22f-407b-bacb-aa1e2cac8214
        errorMessage:
          type: string
          description: Message describing the error for the violation ID.
          example: This violation is not eligible to be allowed.
        errorCode:
          type: integer
          description: HTTP status code representing the error for the violation ID.
          example: 400
    Policy:
      required:
        - id
      allOf:
        - type: object
          properties:
            id:
              type: string
              description: Unique identifier for the policy.
            scheduleId:
              type: string
              description: ID of schedule that this policy runs on
              example: policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1
        - $ref: '#/components/schemas/PolicyBody'
    PolicyBody:
      required:
        - name
        - policyOwner
        - policyRuleIds
      type: object
      description: A policy is a set of policy rules that are grouped together for the purposes of scanning for rule violations.
      properties:
        name:
          type: string
          description: The name of the policy
        description:
          type: string
          description: A description of the policy
        policyOwner:
          type: object
          description: The policy owner object
          properties:
            id:
              type: string
              description: The id of the policy owner, should be in long format (managed/user/[id])
        policyRuleIds:
          type: array
          description: The list of policy rule IDs that this policy contains.
          items:
            type: string
    PolicyRequest:
      allOf:
        - $ref: '#/components/schemas/PolicyBody'
        - type: object
          properties:
            schedule:
              type: object
              description: The contents of the schedule on which this policy is scanned. Contents TBD
              properties:
                type:
                  type: string
                  enum: [ simple ]
                  example: simple
                scheduled:
                  type: boolean
                  example: true
                schedule:
                  type: string
                repeatInterval:
                  type: integer
                  example: 864000000
                repeatCount:
                  type: integer
                  example: -1
                startTime:
                  type: string
                  example: "2023-12-21T22:41:00.000Z"
                endTime:
                  type: string
                  example: "2024-01-01T22:41:00.000Z"
    PolicyRule:
      required:
        - id
        - ruleDefinitionTags
      allOf:
        - $ref: '#/components/schemas/PolicyRuleBody'
        - type: object
          properties:
            id:
              type: string
              description: Unique identifier for the policy rule.
            ruleDefinitionTags:
              type: array
              description: An array of string tags generated from the rule definition contents, to allow specific queries to be run against policy rules based on the access they target.
              items:
                type: string
              example: ["targetName=entitlement.displayName&targetValue=IT%20Admin",
                        "targetValue=IT%20Admin&targetName=entitlement.displayName"]
    PolicyRuleBody:
      required:
        - name
        - policyRuleOwner
        - violationOwner
        - active
        - ruleDefinition
        - userFilter
        - maxExceptionDuration
        - scanTypes
        - decisionOptions
        - remediation
        - workflow
        - violationOwnerType
      type: object
      description: A policy rule is the definition of a segregation of duty violation, including the expressions which defines the violation's queries, the users/groups who maintain the rule, and the remediation rules and actions surrounding users who violate the rule.
      properties:
        name:
          type: string
          description: The name of the policy rule
        description:
          type: string
          description: A description of the policy rule
        documentationUrl:
          type: string
          description: A URL pointing towards any supporting documentation on the policy rule
        policyRuleOwner:
          type: object
          description: The policy rule owner object
          properties:
            id:
              type: string
              description: The id of the policy rule owner, should be in long format (managed/user/[id])
        violationOwner:
          type: object
          description: The violation owner object
          properties:
            id:
              type: string
              description: The id of the violation owner, should be in long format (managed/user/[id])
        active:
          type: boolean
          description: Whether the policy rule is currently enabled.
        scanTypes:
          type: object
          description: Lists the types of scan for which this policy rule is eligible to be included in
          properties:
            preventative:
              type: boolean
              description: Is this policy rule included in pre-assignment scans
            detective:
              type: boolean
              description: Is this policy rule included in scans of existing access
        maxExceptionDuration:
          type: integer
          description: Maximum duration in days that exceptions are allowed on violations
        decisionOptions:
          type: object
          description: Decisions that are available for the remediation actors to take
          properties:
            allow:
              type: boolean
              description: Remediation actor can choose to allow this violating access to remain in perpetuity
            exception:
              type: boolean
              description: Remediation actor can choose to grant a temporary exception to the violating access for x number of days.
            remediate:
              type: boolean
              description: Remediation actor can choose to remediate the violating access, by way of choosing one of the provided remediation options.
        remediation:
          type: object
          description: The defined remediation options for this policy rule
          properties:
            type:
              type: string
              description: The type of remediation process used by this policy rule. (e.g. BPMN)
            id:
              type: string
              description: The ID of the remediation process to use for this policy rule
            schemas:
              type: array
              items:
                type: string
                description: The IDs of the remediation schema objects that define this policy rule's remediation options.
        userFilter:
          description: An additional filter expression that is applied to policy rule evaluation to allow for targeting a specific user subset
          $ref: '#/components/schemas/TargetFilterNode'
        ruleDefinition:
          type: array
          description: An array of conditions that define the policy rule's targeted combination of access
          items:
            $ref: '#/components/schemas/TargetFilterNode'
        workflow:
          type: object
          description: Drives the lifecycle of the violations that are created.
          properties:
            type:
              type: string
              description: Type of workflow
              enum: [ bpmn ]
              example: bpmn
            id:
              type: string
              description: ID of the workflow associated.
              example: BasicViolationProcess
        violationOwnerType:
          type: string
          enum: [ user, role ]
          description: Violation owner type
          example: user
    PolicyRulesResult:
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/PolicyRule'
    PolicyScan:
      type: object
      description: A policy scan is the results from a given policy or policy rule scan
      properties:
        id:
          type: string
          description: ID of the scan object
        policy:
          description: The policy object scanned, if scan was targeting a policy
          $ref: '#/components/schemas/Policy'
        policyRule:
          description: The policy rule object scanned, if scan was targeting a single policy rule
          $ref: '#/components/schemas/PolicyRule'
        isSimulation:
          type: boolean
          description: Was the policy scan a simulated scan (i.e. no violations were created from it)
        status:
          type: string
          description: Status of the scan (in-progress, complete)
        startDate:
          type: string
          description: Date/time scan began
        completionDate:
          type: string
          description: Date/time scan completed
        scanTarget:
          type: string
          description: What object did the scan target (policy or policyRule)
        results:
          type: array
          description: Contents of scan results
          items:
            type: object
    Violation:
      required:
        - id
      allOf:
        - type: object
          properties:
            id:
              type: string
              description: Unique identifier for the violation
        - $ref: '#/components/schemas/ViolationBody'
    ViolationBody:
      required:
        - name
      type: object
      description: A violation is a single object representing a segregation of duty violation between a single policy rule and a single violating entity (user).
      properties:
        user:
          type: object
          description: Information about user who caused violation
        policyRule:
          type: object
          description: The contents of the policy rule violated
        decision:
          $ref: '#/components/schemas/ViolationDecision'
    ViolationDecision:
      type: object
      description: The decision contents of the violation
      properties:
        status:
          type: string
          enum: [ pending, in-progress, complete, cancelled, expired,]
          description: The current status of the violation
        decision:
          type: string
          enum: [ exception, revoke, deactivate]
          description: The decision taken on the violation
        comments:
          type: array
          items:
            type: object
          description: List of comments added to the violation.
        events:
          type: object
          description: The events definitions for this violation
          properties:
            assignment:
              type: object
            expiration:
              type: object
            escalation:
              type: object
            reminder:
              type: object
        actors:
          type: object
          description: Actor lists of users/roles that have permissions to act on the violation
          properties:
            active:
              type: array
              items:
                type: object
            inactive:
              type: array
              items:
                type: object
        completionDate:
          type: string
          description: Date violation was completed
        completedBy:
          type: object
          description: Info of user who completed decision
    TargetFilterNode:
      type: object
      properties:
        operator:
          type: string
          example: EQUALS
        operand:
          $ref: '#/components/schemas/TargetFilterLeafNode'
    TargetFilterLeafNode:
      type: object
      properties:
        targetName:
          type: string
          example: name
        targetValue:
          type: string
    TaskPhase:
      type: object
      description: This is represent the stage that require user to make decision before the workflow can continue to next stage
      properties:
        phase:
          type: object
          required:
            - name
            - workflowTaskId
          properties:
            name:
              type: string
              description: The identitfier of the phase in the request
            workflowTaskId:
              type: string
              description: The workflow task ID of the phase.
            events:
              type: object
              description: The events that will occur on this phase
            type:
              type: string
              description: The type of phase - violation, request, provisioning (fulfillment)
        actors:
          type: array
          items:
            type: object
            required:
              - id
              - permissions
            properties:
              id:
                type: string
                description: The id that can uniquely identify the actor
                example: /managed/user/kpanduri
              permissions:
                type: object
                description: Permissions the user has on this phase
                properties:
                  approve:
                    type: boolean
                  reject:
                    type: boolean
                  comment:
                    type: boolean
    ViolationActor:
      allOf:
        - $ref: '#/components/schemas/Actor'
        - type: object
          properties:
            permissions:
              $ref: '#/components/schemas/ViolationPermissions'
    Actor:
      type: object
      properties:
        id:
          type: string
          description: ID of actor (full id e.g. managed/user/003 or managed/role/123)
        userName:
          type: string
          description: userName of actor, when actor is user
        mail:
          type: string
          description: Email address of actor, when actor is user
        givenName:
          type: string
          description: Given name of actor, when actor is user
        sn:
          type: string
          description: Surname of actor, when actor is user
        name:
          type: string
          description: Name of actor, when actor is role
    ViolationPermissions:
      type: object
      description: Permissions violation actor has assigned to them
      properties:
        allow:
          type: boolean
          description: Can user take allow action
        comment:
          type: boolean
          description: Can user take comment action
        exception:
          type: boolean
          description: Can user take grant exception action
        reassign:
          type: boolean
          description: Can user take reassign action
        remediate:
          type: boolean
          description: Can user take remediation action
    RemediationSchema:
      type: object
      properties:
        id:
          type: string
          description: The identifier of the request schema
        schema:
          type: object
          properties:
            _meta:
              type: object
              properties:
                type:
                  type: string
                  description: The properties type
                  enum: [system, internal, managed]
                properties:
                  type: object
                  description: Meta data about properties. Different objects have different meta-data.
            properties:
              type: object
              description: Different objects have different meta-data.
