---
components:
  schemas:
    restapi.Action:
      properties:
        name:
          description: "Name specifies the action."
          examples:
            - CAN_READ
          type: string
      required:
        - name
      type: object
    restapi.Context:
      properties:
        input_params:
          additionalProperties: true
          description: "InputParams map specifies the values of input parameters used within the policies.\nIf a policy uses input parameters and is used for making the decision,\nthey must be sent with the request, otherwise an error is returned."
          type: object
        policy_tags:
          description: "PolicyTags array limits the policies used to only the policies with the specified tags."
          examples:
            - - tag1
              - tag2
          items:
            maxLength: 20
            minLength: 1
            type: string
          type: array
      type: object
    restapi.DetailedError:
      properties:
        errors:
          items:
            type: string
          type: array
        message:
          type: string
      type: object
    restapi.ErrorResponse:
      properties:
        message:
          examples:
            - "Internal Server Error"
          type: string
      type: object
    restapi.EvaluationRequest:
      properties:
        action:
          "$ref": "#/components/schemas/restapi.Action"
        context:
          anyOf:
            - "$ref": "#/components/schemas/restapi.Context"
            - type: "null"
        resource:
          "$ref": "#/components/schemas/restapi.Node"
        subject:
          "$ref": "#/components/schemas/restapi.Node"
      required:
        - subject
        - resource
        - action
      type: object
    restapi.EvaluationResponse:
      properties:
        context:
          anyOf:
            - "$ref": "#/components/schemas/restapi.respContext"
            - type: "null"
        decision:
          type: boolean
      type: object
    restapi.EvaluationsRequest:
      properties:
        action:
          anyOf:
            - "$ref": "#/components/schemas/restapi.Action"
            - type: "null"
        context:
          anyOf:
            - "$ref": "#/components/schemas/restapi.Context"
            - type: "null"
        evaluations:
          items:
            "$ref": "#/components/schemas/restapi.OptionalFields"
          type: array
        resource:
          anyOf:
            - "$ref": "#/components/schemas/restapi.Node"
            - type: "null"
        subject:
          anyOf:
            - "$ref": "#/components/schemas/restapi.Node"
            - type: "null"
      required:
        - evaluations
      type: object
    restapi.EvaluationsResponse:
      properties:
        evaluations:
          items:
            "$ref": "#/components/schemas/restapi.EvaluationResponse"
          type: array
      type: object
    restapi.Node:
      properties:
        id:
          description: "ID is a node external_id."
          examples:
            - IdSpecifyingTheNode
          type: string
        type:
          description: "Type is a node label."
          examples:
            - NodeType
          type: string
      required:
        - type
        - id
      type: object
    restapi.NodeType:
      properties:
        type:
          examples:
            - NodeType
          type: string
      required:
        - type
      type: object
    restapi.OptionalFields:
      properties:
        action:
          anyOf:
            - "$ref": "#/components/schemas/restapi.Action"
            - type: "null"
        context:
          anyOf:
            - "$ref": "#/components/schemas/restapi.Context"
            - type: "null"
        resource:
          anyOf:
            - "$ref": "#/components/schemas/restapi.Node"
            - type: "null"
        subject:
          anyOf:
            - "$ref": "#/components/schemas/restapi.Node"
            - type: "null"
      type: object
    restapi.SearchActionRequest:
      properties:
        context:
          anyOf:
            - "$ref": "#/components/schemas/restapi.Context"
            - type: "null"
        resource:
          "$ref": "#/components/schemas/restapi.Node"
        subject:
          "$ref": "#/components/schemas/restapi.Node"
      required:
        - subject
        - resource
      type: object
    restapi.SearchActionResponse:
      properties:
        results:
          items:
            "$ref": "#/components/schemas/restapi.Action"
          type: array
      type: object
    restapi.SearchResourceRequest:
      properties:
        action:
          "$ref": "#/components/schemas/restapi.Action"
        context:
          anyOf:
            - "$ref": "#/components/schemas/restapi.Context"
            - type: "null"
        resource:
          "$ref": "#/components/schemas/restapi.NodeType"
        subject:
          "$ref": "#/components/schemas/restapi.Node"
      required:
        - subject
        - action
        - resource
      type: object
    restapi.SearchResourceResponse:
      properties:
        results:
          items:
            "$ref": "#/components/schemas/restapi.Node"
          type: array
      type: object
    restapi.SearchSubjectRequest:
      properties:
        action:
          "$ref": "#/components/schemas/restapi.Action"
        context:
          anyOf:
            - "$ref": "#/components/schemas/restapi.Context"
            - type: "null"
        resource:
          "$ref": "#/components/schemas/restapi.Node"
        subject:
          "$ref": "#/components/schemas/restapi.NodeType"
      required:
        - subject
        - action
        - resource
      type: object
    restapi.SearchSubjectResponse:
      properties:
        results:
          items:
            "$ref": "#/components/schemas/restapi.Node"
          type: array
      type: object
    restapi.respContext:
      properties:
        advice:
          items:
            additionalProperties:
              type: string
            type: object
          type: array
        reason:
          type: string
      type: object
  securitySchemes:
    APIKey:
      description: "The value of the App Agent credential header must be passed as is, without any prefix."
      in: header
      name: X-IK-ClientKey
      type: apiKey
    bearerAuth:
      description: "Optional third-party end-user token, introspected via the Token Introspect configuration."
      scheme: bearer
      type: http
info:
  description: "Authorization API implemented according to [AuthZEN specification](https://openid.net/wg/authzen/specifications/)."
  license:
    name: "Apache 2.0"
    url: "https://www.apache.org/licenses/LICENSE-2.0"
  title: "AuthZEN REST API"
  version: "1"
openapi: "3.2.0"
paths:
  /evaluation:
    post:
      description: "Evaluate the authorization request and return decision in response."
      operationId: Evaluation
      requestBody:
        content:
          application/json:
            schema:
              "$ref": "#/components/schemas/restapi.EvaluationRequest"
        description: "Evaluation request"
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/restapi.EvaluationResponse"
          description: OK
        "400":
          content:
            application/json:
              schema:
                properties:
                  errors:
                    items:
                      type: string
                    type: array
                  message:
                    type: string
                type: object
          description: "Bad request"
        "422":
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/restapi.DetailedError"
          description: "Unprocessable Entity"
        "500":
          content:
            application/json:
              schema:
                properties:
                  message:
                    type: string
                type: object
          description: "Internal Server Error"
      summary: "AuthZEN specified Evaluation endpoint"
      tags:
        - AuthZEN
  /evaluations:
    post:
      description: "Evaluate multiple authorization requests at once and return decisions in response."
      operationId: Evaluations
      requestBody:
        content:
          application/json:
            schema:
              "$ref": "#/components/schemas/restapi.EvaluationsRequest"
        description: "Evaluation request"
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/restapi.EvaluationsResponse"
          description: OK
        "400":
          content:
            application/json:
              schema:
                properties:
                  errors:
                    items:
                      type: string
                    type: array
                  message:
                    type: string
                type: object
          description: "Bad request"
        "422":
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/restapi.DetailedError"
          description: "Unprocessable Entity"
        "500":
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/restapi.ErrorResponse"
          description: "Internal Server Error"
      summary: "AuthZEN specified Evaluations endpoint"
      tags:
        - AuthZEN
  /search/action:
    post:
      description: "Search for actions allowed to be done by the specified subject on the specified resource."
      operationId: SearchAction
      requestBody:
        content:
          application/json:
            schema:
              "$ref": "#/components/schemas/restapi.SearchActionRequest"
        description: "Action Search request"
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/restapi.SearchActionResponse"
          description: OK
        "400":
          content:
            application/json:
              schema:
                properties:
                  errors:
                    items:
                      type: string
                    type: array
                  message:
                    type: string
                type: object
          description: "Bad request"
        "422":
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/restapi.DetailedError"
          description: "Unprocessable Entity"
        "500":
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/restapi.ErrorResponse"
          description: "Internal Server Error"
      summary: "AuthZEN specified Action Search API"
      tags:
        - AuthZEN
  /search/resource:
    post:
      description: "Search for resources that the specified subject is allowed to do the specified action on."
      operationId: SearchResource
      requestBody:
        content:
          application/json:
            schema:
              "$ref": "#/components/schemas/restapi.SearchResourceRequest"
        description: "Resource Search request"
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/restapi.SearchResourceResponse"
          description: OK
        "400":
          content:
            application/json:
              schema:
                properties:
                  errors:
                    items:
                      type: string
                    type: array
                  message:
                    type: string
                type: object
          description: "Bad request"
        "422":
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/restapi.DetailedError"
          description: "Unprocessable Entity"
        "500":
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/restapi.ErrorResponse"
          description: "Internal Server Error"
      summary: "AuthZEN specified Resource Search API"
      tags:
        - AuthZEN
  /search/subject:
    post:
      description: "Search for subjects allowed to do the specified action on the specified resource."
      operationId: SearchSubject
      requestBody:
        content:
          application/json:
            schema:
              "$ref": "#/components/schemas/restapi.SearchSubjectRequest"
        description: "Subject Search request"
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/restapi.SearchSubjectResponse"
          description: OK
        "400":
          content:
            application/json:
              schema:
                properties:
                  errors:
                    items:
                      type: string
                    type: array
                  message:
                    type: string
                type: object
          description: "Bad request"
        "422":
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/restapi.DetailedError"
          description: "Unprocessable Entity"
        "500":
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/restapi.ErrorResponse"
          description: "Internal Server Error"
      summary: "AuthZEN specified Subject Search API"
      tags:
        - AuthZEN
security:
  - APIKey: []
  - APIKey: []
    bearerAuth: []
servers:
  - url: "https://eu.api.indykite.com/access/v1"
  - url: "https://us.api.indykite.com/access/v1"
tags:
  - description: "Authorization API implemented according to [AuthZEN specification](https://openid.net/wg/authzen/specifications/)."
    name: AuthZEN