swagger.yml

consumes:
  - application/json
definitions:
  error_out:
    type: object
    description: "The standard format for an error response body."
    required:
      - reason
    properties:
      reason:
        type: string
        description: "The reason for the error."
        minLength: 1
  service_info:
    type: object
    required:
      - description
      - service
      - version
    properties:
      description:
        type: string
        description: "A brief description of the service."
        minLength: 1
      service:
        type: string
        description: "The name of the service."
        minLength: 1
      version:
        type: string
        description: "The service's version number."
        minLength: 1
  resource_type_in:
    type: object
    description: "An incoming resource type."
    required:
      - name
    properties:
      name:
        type: string
        description: "The name of the resource type."
        minLength: 1
      description:
        type: string
        description: "A brief description of the resource type."
  resource_type_out:
    type: object
    description: "An outgoing resource type."
    required:
      - id
      - name
    properties:
      id:
        type: string
        description: "The resource type identifier."
        minLength: 36
        maxLength: 36
      name:
        type: string
        description: "The name of the resource type."
        minLength: 1
      description:
        type: string
        description: "A brief description of the resource type."
  resource_types_out:
    type: object
    description: "A list of resource types."
    required:
      - resource_types
    properties:
      resource_types:
        type: array
        description: "The list of resource types."
        items:
          $ref: "#/definitions/resource_type_out"
  resource_in:
    type: object
    description: "An incoming resource."
    required:
      - name
      - resource_type
    properties:
      name:
        type: string
        description: "The resource name."
        minLength: 1
      resource_type:
        type: string
        description: "The resource type name."
        minLength: 1
  resource_update:
    type: object
    description: "A modification to a resource."
    required:
      - name
    properties:
      name:
        type: string
        description: "The new resource name."
        minLength: 1
  resource_out:
    type: object
    description: "An outgoing resource."
    required:
      - id
      - name
      - resource_type
    properties:
      id:
        type: string
        description: "The resource identifier."
        minLength: 36
        maxLength: 36
      name:
        type: string
        description: "The resource name."
        minLength: 1
      resource_type:
        type: string
        description: "The resource type name."
        minLength: 1
  resources_out:
    type: object
    description: "A list of resources."
    required:
      - resources
    properties:
      resources:
        type: array
        description: "The list of resources."
        items:
          $ref: "#/definitions/resource_out"
  internal_subject_id:
    type: string
    description: "The internal subject identifier."
    minLength: 36
    maxLength: 36
  external_subject_id:
    type: string
    description: "The external subject identifier."
    minLength: 1
    maxLength: 64
  subject_type:
    type: string
    description: "The subject type."
    enum:
      - user
      - group
  subject_source_id:
    type: string
    description: "The subject source ID."
    minLength: 1
    maxLength: 255
  subject_in:
    type: object
    description: "An incoming subject."
    required:
      - subject_id
      - subject_type
    properties:
      subject_id:
        $ref: "#/definitions/external_subject_id"
      subject_type:
        $ref: "#/definitions/subject_type"
  subjects_in:
    type: object
    description: "An incoming list of subjects."
    required:
      - subjects
    properties:
      subjects:
        type: array
        description: "The list of subjects."
        items:
          $ref: "#/definitions/subject_in"
  subject_out:
    type: object
    description: "An outgoing subject."
    required:
      - id
      - subject_id
      - subject_type
      - subject_source_id
    properties:
      id:
        $ref: "#/definitions/internal_subject_id"
      subject_id:
        $ref: "#/definitions/external_subject_id"
      subject_type:
        $ref: "#/definitions/subject_type"
      subject_source_id:
        $ref: "#/definitions/subject_source_id"
  subjects_out:
    type: object
    description: "A list of subjects."
    required:
      - subjects
    properties:
      subjects:
        type: array
        description: "The list of subjects."
        items:
          $ref: "#/definitions/subject_out"
  permission_id:
    type: string
    description: "The internal permission identifier."
    minLength: 36
    maxLength: 36
  permission_level:
    type: string
    description: "A permission level name."
    enum:
      - read
      - admin
      - write
      - own
  permission_grant_request:
    type: object
    description: "Information for granting permission to a user."
    required:
      - subject
      - resource
      - permission_level
    properties:
      subject:
        $ref: "#/definitions/subject_in"
      resource:
        $ref: "#/definitions/resource_in"
      permission_level:
        $ref: "#/definitions/permission_level"
  permission_put_request:
    type: object
    description: "Specifies the permission level to assign."
    required:
      - permission_level
    properties:
      permission_level:
        $ref: "#/definitions/permission_level"
  permission:
    type: object
    description: "Information about permissions granted to a user."
    required:
      - id
      - subject
      - resource
      - permission_level
    properties:
      id:
        $ref: "#/definitions/permission_id"
      subject:
        $ref: "#/definitions/subject_out"
      resource:
        $ref: "#/definitions/resource_out"
      permission_level:
        $ref: "#/definitions/permission_level"
  permission_list:
    type: object
    description: "A list of matching permissions."
    required:
      - permissions
    properties:
      permissions:
        type: array
        description: "The list of permissions."
        items:
          $ref: "#/definitions/permission"
  abbreviated_permission:
    type: object
    description: "Abbrevated information about permissions granted to a user."
    required:
      - id
      - resource_name
      - resource_type
      - permission_level
    properties:
      id:
        $ref: "#/definitions/permission_id"
      resource_name:
        type: string
        description: "The resource name."
        minLength: 1
      resource_type:
        type: string
        description: "The resource type name."
        minLength: 1
      permission_level:
        $ref: "#/definitions/permission_level"
  abbreviated_permission_list:
    type: object
    description: "A list of matching permissions."
    required:
      - permissions
    properties:
      permissions:
        type: array
        description: "The list of permissions."
        items:
          $ref: "#/definitions/abbreviated_permission"
info:
  description: >-
    Manages Permissions for the CyVerse Discovery Environment and related applications.
  title: "Permissions Service"
  version: "5.2.8.0"
paths:
  /:
    get:
      tags:
        - status
      summary: "Service Status Information"
      description: >-
        Displays general information about the service and can be used to determine whether or not the service is
        running.
      responses:
        200:
          description: "Success"
          schema:
            $ref: "#/definitions/service_info"
  /resource_types:
    get:
      tags:
        - resource_types
      summary: "List Resource Types"
      description: >-
        Lists resource types known to the permissions service. A resource type represents a class of resources to
        which permissions may be applied. For example, the Discovery environment has apps collectively defined as
        a single resource type in the permissions service.
      parameters:
        - name: "resource_type_name"
          type: "string"
          in: query
          description: "The resource type name to search for."
      responses:
        200:
          description: "Success"
          schema:
            $ref: "#/definitions/resource_types_out"
        500:
          $ref: "#/responses/internal_server_error"
    delete:
      tags:
        - resource_types
      summary: "Delete a Resource Type by Name"
      description: "Deletes the resource type with the given name."
      operationId: deleteResourceTypeByName
      parameters:
        - name: "resource_type_name"
          type: "string"
          in: query
          description: "The resource type name to search for."
          required: True
      responses:
        200:
          description: "Deleted"
        400:
          $ref: "#/responses/bad_request"
        404:
          $ref: "#/responses/not_found"
        500:
          $ref: "#/responses/internal_server_error"
    post:
      tags:
        - resource_types
      summary: "Add a Resource Type"
      description: >-
        Adds a resource type to the list of available resource types. The name of the resource type must be unique.
      parameters:
        - description: "The resource type to add."
          in: body
          name: "resource_type_in"
          required: True
          schema:
            $ref: "#/definitions/resource_type_in"
      responses:
        201:
          description: "Created"
          schema:
            $ref: "#/definitions/resource_type_out"
        400:
          $ref: "#/responses/bad_request"
        500:
          $ref: "#/responses/internal_server_error"
  /resource_types/{id}:
    parameters:
      - name: id
        type: string
        description: "The resource type ID."
        in: path
        required: True
    put:
      tags:
        - resource_types
      summary: "Update a Resource Type"
      description: >-
        Updates the name or description of a resource type. The new name of the resource type must be unique if one
        is provided.
      parameters:
        - description: "The new name and description of the resource type."
          in: body
          name: "resource_type_in"
          required: True
          schema:
            $ref: "#/definitions/resource_type_in"
      responses:
        200:
          description: "Updated"
          schema:
            $ref: "#/definitions/resource_type_out"
        400:
          $ref: "#/responses/bad_request"
        404:
          $ref: "#/responses/not_found"
        500:
          $ref: "#/responses/internal_server_error"
    delete:
      tags:
        - resource_types
      summary: "Delete a Resource Type"
      description: >-
        Removes a resource type from the database. A resource type may only be removed if there are no resources
        associated with it.
      responses:
        200:
          description: "Deleted"
        400:
          $ref: "#/responses/bad_request"
        404:
          $ref: "#/responses/not_found"
        500:
          $ref: "#/responses/internal_server_error"
  /resources:
    delete:
      tags:
        - resources
      summary: "Delete Resources by Name"
      description: >-
        Removes a resource from the database. A resource is a single item to which permissions may be applied. For
        example. The Discovery Environment app, Word Count, would be defined as a resource in the permissions
        service.
      operationId: deleteResourceByName
      parameters:
        - name: "resource_type_name"
          type: "string"
          in: query
          description: "The resource type name to search for."
          required: True
        - name: "resource_name"
          type: "string"
          in: query
          description: "The resource name to search for."
          required: True
      responses:
        200:
          description: "OK"
        404:
          $ref: "#/responses/not_found"
        500:
          $ref: "#/responses/internal_server_error"
    get:
      tags:
        - resources
      summary: "List Resources"
      description: >-
        Lists resources in the database. A resource is a single item to which permissions may be applied. For example
        The Discovery Environment app, Word Count, would be defined as a resource in the permissions service.
      operationId: listResources
      parameters:
        - name: "resource_type_name"
          type: "string"
          in: query
          description: "The resource type name to search for."
        - name: "resource_name"
          type: "string"
          in: query
          description: "The resource name to search for."
      responses:
        200:
          description: "OK"
          schema:
            $ref: "#/definitions/resources_out"
        500:
          $ref: "#/responses/internal_server_error"
    post:
      tags:
        - resources
      summary: "Add a Resource"
      description: >-
        Adds a resource to the database. A resource is a single item to which permissions may be applied. For example
        The Discovery Environment app, Word Count, would be defined as a resource in the permissions service.
      parameters:
        - description: "The new resource to add."
          in: body
          name: "resource_in"
          required: True
          schema:
            $ref: "#/definitions/resource_in"
      operationId: addResource
      responses:
        201:
          description: "Created"
          schema:
            $ref: "#/definitions/resource_out"
        400:
          $ref: "#/responses/bad_request"
        500:
          $ref: "#/responses/internal_server_error"
  /resources/{id}:
    parameters:
      - name: id
        type: string
        description: "The resource ID."
        in: path
        required: True
    put:
      tags:
        - resources
      summary: "Update a Resource"
      description: "Updates a resource in the database."
      parameters:
        - description: "The updated resource information."
          in: body
          name: "resource_update"
          required: True
          schema:
            $ref: "#/definitions/resource_update"
      operationId: updateResource
      responses:
        200:
          description: "OK"
          schema:
            $ref: "#/definitions/resource_out"
        400:
          $ref: "#/responses/bad_request"
        404:
          $ref: "#/responses/not_found"
        500:
          $ref: "#/responses/internal_server_error"
    delete:
      tags:
        - resources
      summary: "Delete a Resource"
      description: "Removes a resource from the database."
      operationId: deleteResource
      responses:
        200:
          description: "OK"
        404:
          $ref: "#/responses/not_found"
        500:
          $ref: "#/responses/internal_server_error"
  /subjects:
    delete:
      tags:
        - subjects
      summary: "Delete Subjects by External ID"
      description: >-
        Removes subjects (entities to which permissions may be gratned) from the database.
      operationId: deleteSubjectByExternalId
      parameters:
        - name: "subject_id"
          type: "string"
          in: query
          description: "The external subject identifier."
          required: True
        - name: "subject_type"
          type: "string"
          enum:
            - "user"
            - "group"
          in: query
          description: "The subject type."
          required: True
      responses:
        200:
          description: "OK"
        404:
          $ref: "#/responses/not_found"
        500:
          $ref: "#/responses/internal_server_error"
    get:
      tags:
        - subjects
      summary: "List Subjects"
      description: >-
        Lists subjects (entities to which permissions may be gratned) that exist in the database.
      operationId: listSubjects
      parameters:
        - name: "subject_id"
          type: "string"
          in: query
          description: "The external subject identifier."
        - name: "subject_type"
          type: "string"
          enum:
            - "user"
            - "group"
          in: query
          description: "The subject type."
      responses:
        200:
          description: "OK"
          schema:
            $ref: "#/definitions/subjects_out"
        500:
          $ref: "#/responses/internal_server_error"
    post:
      tags:
        - subjects
      summary: "Add a Subject"
      description: >-
        Adds a subject (an entity to which permissions may be granted) to the database. For full use of the
        permissions service, the subject should be present in Grouper and have the same subject ID in Grouper
        and the permissions service.
      parameters:
        - description: "The new subject to add."
          in: body
          name: "subject_in"
          required: True
          schema:
            $ref: "#/definitions/subject_in"
      operationId: addSubject
      responses:
        201:
          description: "Created"
          schema:
            $ref: "#/definitions/subject_out"
        400:
          $ref: "#/responses/bad_request"
        500:
          $ref: "#/responses/internal_server_error"
  /subjects/{id}:
    parameters:
      - name: id
        type: string
        description: "The subject ID."
        in: path
        required: True
    put:
      tags:
        - subjects
      summary: "Update a Subject"
      description: >-
        Updates a subject in the database. For full use of the permissions service, the subject should be present
        in Grouper and have the same subject ID in Grouper and the permissions service.
      parameters:
        - description: "The new subject information."
          in: body
          name: "subject_in"
          required: True
          schema:
            $ref: "#/definitions/subject_in"
      operationId: updateSubject
      responses:
        200:
          description: "OK"
          schema:
            $ref: "#/definitions/subject_out"
        400:
          $ref: "#/responses/bad_request"
        404:
          $ref: "#/responses/not_found"
        500:
          $ref: "#/responses/internal_server_error"
    delete:
      tags:
        - subjects
      summary: "Delete a Subject"
      description: "Deletes a subject from the database."
      operationId: deleteSubject
      responses:
        200:
          description: "OK"
        404:
          $ref: "#/responses/not_found"
        500:
          $ref: "#/responses/internal_server_error"
  /permissions:
    get:
      tags:
        - permissions
      summary: "List Permissions"
      description: >-
        Lists all permissions in the permission database. The total number of permissions for all resources is likely
        to be quite large, so callers should be prepared to handle the response body. If this endpoint is used more
        frequently than anticipated, limit and offset parameters will be added for paging later.
      operationId: listPermissions
      responses:
        200:
          description: "OK"
          schema:
            $ref: "#/definitions/permission_list"
        500:
          $ref: "#/responses/internal_server_error"
    post:
      tags:
        - permissions
      summary: "Grant Permission to a Resource"
      description: >-
        Grants permission to access a resource to a subject. If the subject already has permission to access the
        resource then the permission level will be updated (assuming the new permission level is different from
        the existing permission level). Neither the resource nor the subject needs to be registered in the database
        before this endpoint is called; they will be added to the database if necessary. This endpoint will return
        an error response if the subject ID is already in use and associated with a different subject type. It will
        also return an error if either the specified resource type or permission level does not exist.
      parameters:
        - description: "Information about the permission to add."
          in: body
          name: "permission_grant_request"
          required: True
          schema:
            $ref: "#/definitions/permission_grant_request"
      operationId: grantPermission
      responses:
        200:
          description: "Created"
          schema:
            $ref: "#/definitions/permission"
        400:
          $ref: "#/responses/bad_request"
        500:
          $ref: "#/responses/internal_server_error"
  /permissions/resources/{resource_type}/{resource_name}:
    parameters:
      - name: resource_type
        type: string
        description: "The resource type name."
        in: path
        required: True
      - name: resource_name
        type: string
        description: "The resource name."
        in: path
        required: True
    get:
      tags:
        - permissions
      summary: "List Resource Permissions"
      description: "Lists all of the permissions associated with a resource."
      operationId: listResourcePermissions
      responses:
        200:
          description: "OK"
          schema:
            $ref: "#/definitions/permission_list"
        500:
          $ref: "#/responses/internal_server_error"
  /permissions/resources/{resource_type}/{resource_name}/subjects/{subject_type}/{subject_id}:
    parameters:
      - name: resource_type
        type: string
        description: "The resource type name."
        in: path
        required: True
      - name: resource_name
        type: string
        description: "The resource name."
        in: path
        required: True
      - name: subject_type
        type: string
        enum:
          - user
          - group
        description: "The subject type name."
        in: path
        required: True
      - name: subject_id
        type: string
        description: "The external subject identifier."
        in: path
        required: True
    delete:
      tags:
        - permissions
      summary: "Revoke Permission to a Resource"
      description: >-
        Removes a permission entry from the database. This endpoint will return an error status if the resource type,
        resource, subject or the permission itself does not exist.
      operationId: revokePermission
      responses:
        200:
          description: "OK"
        404:
          $ref: "#/responses/not_found"
        500:
          $ref: "#/responses/internal_server_error"
    put:
      tags:
        - permissions
      summary: "Grant Permission to a Resource"
      description: >-
        Grants permission to access a resource to a subject. If the subject already has permission to access the
        resource then the permission level will be updated (assuming the new permission level is different from
        the existing permission level). Neither the resource nor the subject needs to be registered in the database
        before this endpoint is called; they will be added to the database if necessary. This endpoint will return
        an error response if the subject ID is already in use and associated with a different subject type. It will
        also return an error if either the specified resource type or permission level does not exist.
      parameters:
        - description: "The permission level to assign."
          in: body
          name: "permission"
          required: True
          schema:
            $ref: "#/definitions/permission_put_request"
      operationId: putPermission
      responses:
        200:
          description: "OK"
          schema:
            $ref: "#/definitions/permission"
        400:
          $ref: "#/responses/bad_request"
        500:
          $ref: "#/responses/internal_server_error"
  /permissions/subjects/{subject_type}/{subject_id}:
    parameters:
      - name: subject_type
        type: string
        enum:
          - user
          - group
        description: "The subject type name."
        in: path
        required: True
      - name: subject_id
        type: string
        description: "The external subject identifier."
        in: path
        required: True
      - name: lookup
        type: boolean
        description: >-
          True if a permission lookup should be performed. A permission lookup differs from standard permisison
          retrieval in two ways. First, only the most permissive permission level available to the subject is
          returned for any given resource. Second, if the subject happens to be a user then permissions granted
          to groups that the user belongs to are also included in the results. This parameter is optional and
          defaults to False.
        in: query
        default: False
      - name: min_level
        type: string
        enum:
          - read
          - admin
          - write
          - own
        description: >-
          The minimum permission level required to qualify for the result set. All permission levels qualify by
          default.
        in: query
    get:
      tags:
        - permissions
      summary: "Look Up by Subject"
      description: >-
        Looks up all permissions granted to a subject. If lookup mode is enabled and the subject is a user, the most
        lenient permissions granted to the subject or any groups the subject belongs to will be listed. If lookup mode
        is not enabled or the subject is a group then only permissions assigned directly to the subject will be listed.
        This endpoint will return an error status if the subject ID is in use and associated with a different subject
        type.
      operationId: bySubject
      responses:
        200:
          description: "OK"
          schema:
            $ref: "#/definitions/permission_list"
        400:
          $ref: "#/responses/bad_request"
        500:
          $ref: "#/responses/internal_server_error"
  /permissions/subjects/{subject_type}/{subject_id}/copy:
    parameters:
      - name: subject_type
        type: string
        enum:
          - user
          - group
        description: "The subject type name."
        in: path
        required: True
      - name: subject_id
        type: string
        description: "The external subject identifier."
        in: path
        required: True
    post:
      tags:
        - permissions
      summary: "Copy Permissions Between Subjects"
      description: >-
        Copies all permissions that have been granted to one subject to one or more other subjects. Only permissions
        that are assigned directly to the source subject are copied. Permissions that are granted to groups that the
        source subject belongs to are not copied.
      parameters:
        - description: "The destination subjects."
          in: body
          name: "destSubjects"
          required: True
          schema:
            $ref: "#/definitions/subjects_in"
      operationId: copyPermissions
      responses:
        200:
          description: "OK"
        400:
          $ref: "#/responses/bad_request"
        500:
          $ref: "#/responses/internal_server_error"
  /permissions/subjects/{subject_type}/{subject_id}/{resource_type}:
    parameters:
      - name: subject_type
        type: string
        enum:
          - user
          - group
        description: "The subject type name."
        in: path
        required: True
      - name: subject_id
        type: string
        description: "The external subject identifier."
        in: path
        required: True
      - name: resource_type
        type: string
        description: "The resource type name."
        in: path
        required: True
      - name: lookup
        type: boolean
        description: >-
          True if a permission lookup should be performed. A permission lookup differs from standard permisison
          retrieval in two ways. First, only the most permissive permission level available to the subject is
          returned for any given resource. Second, if the subject happens to be a user then permissions granted
          to groups that the user belongs to are also included in the results. This parameter is optional and
          defaults to False.
        in: query
        default: False
      - name: min_level
        type: string
        enum:
          - read
          - admin
          - write
          - own
        description: >-
          The minimum permission level required to qualify for the result set. All permission levels qualify by
          default.
        in: query
    get:
      tags:
        - permissions
      summary: "Look Up by Subject and Resource Type"
      description: >-
        Looks up all permissions granted to a subject for resources of the given type. If lookup mode is enabled and
        the subject is a user, the most lenient permissions granted to the subject or any groups the subject belongs
        to will be listed. If lookup mode is not enabled or the subject is a group then only permissions assigned
        directly to the subject will be listed. This endpoint will return an error status if the subject ID is in use
        and associated with a different subject type.
      operationId: bySubjectAndResourceType
      responses:
        200:
          description: "OK"
          schema:
            $ref: "#/definitions/permission_list"
        400:
          $ref: "#/responses/bad_request"
        500:
          $ref: "#/responses/internal_server_error"
  /permissions/subjects/{subject_type}/{subject_id}/{resource_type}/{resource_name}:
    parameters:
      - name: subject_type
        type: string
        enum:
          - user
          - group
        description: "The subject type name."
        in: path
        required: True
      - name: subject_id
        type: string
        description: "The external subject identifier."
        in: path
        required: True
      - name: resource_type
        type: string
        description: "The resource type name."
        in: path
        required: True
      - name: resource_name
        type: string
        description: "The resource name."
        in: path
        required: True
      - name: lookup
        type: boolean
        description: >-
          True if a permission lookup should be performed. A permission lookup differs from standard permisison
          retrieval in two ways. First, only the most permissive permission level available to the subject is
          returned for any given resource. Second, if the subject happens to be a user then permissions granted
          to groups that the user belongs to are also included in the results. This parameter is optional and
          defaults to False.
        in: query
        default: False
      - name: min_level
        type: string
        enum:
          - read
          - admin
          - write
          - own
        description: >-
          The minimum permission level required to qualify for the result set. All permission levels qualify by
          default.
        in: query
    get:
      tags:
        - permissions
      summary: "Look Up by Subject and Resource"
      description: >-
        Looks up  permissions granted to a subject for a resource. If lookup mode is enabled and the subject is a
        user, the most lenient permission granted to the subject or any groups the subject belongs to will be listed.
        If lookup mode is not enabled or the subject is a group then only permissions assigned directly to the subject
        will be listed. This endpoint will currently list at most one permission, but the permission list format was
        chosen in favor of returning a 404 status if a permission does not exist because this endpoint may be called
        frequently when no corresponding permissions exist. This endpoint will return an error status if the subject
        ID is in use and associated with a different subject type.
      operationId: bySubjectAndResource
      responses:
        200:
          description: "OK"
          schema:
            $ref: "#/definitions/permission_list"
        400:
          $ref: "#/responses/bad_request"
        500:
          $ref: "#/responses/internal_server_error"
  /permissions/abbreviated/subjects/{subject_type}/{subject_id}/{resource_type}:
    parameters:
      - name: subject_type
        type: string
        enum:
          - user
          - group
        description: "The subject type name."
        in: path
        required: True
      - name: subject_id
        type: string
        description: "The external subject identifier."
        in: path
        required: True
      - name: resource_type
        type: string
        description: "The resource type name."
        in: path
        required: True
      - name: lookup
        type: boolean
        description: >-
          True if a permission lookup should be performed. A permission lookup differs from standard permisison
          retrieval in two ways. First, only the most permissive permission level available to the subject is
          returned for any given resource. Second, if the subject happens to be a user then permissions granted
          to groups that the user belongs to are also included in the results. This parameter is optional and
          defaults to False.
        in: query
        default: False
      - name: min_level
        type: string
        enum:
          - read
          - admin
          - write
          - own
        description: >-
          The minimum permission level required to qualify for the result set. All permission levels qualify by
          default.
        in: query
    get:
      tags:
        - permissions
      summary: "Look Up Abbreviated Permissions by Subject and Resource Type"
      description: >-
        Looks up all permissions granted to a subject for resources of the given type. If lookup mode is enabled and
        the subject is a user, the most lenient permissions granted to the subject or any groups the subject belongs
        to will be listed. If lookup mode is not enabled or the subject is a group then only permissions assigned
        directly to the subject will be listed. This endpoint will return an error status if the subject ID is in use
        and associated with a different subject type.
      operationId: bySubjectAndResourceTypeAbbreviated
      responses:
        200:
          description: "OK"
          schema:
            $ref: "#/definitions/abbreviated_permission_list"
        400:
          $ref: "#/responses/bad_request"
        500:
          $ref: "#/responses/internal_server_error"
produces:
  - application/json
responses:
  bad_request:
    description: "Bad Request"
    schema:
      $ref: "#/definitions/error_out"
  internal_server_error:
    description: "Internal Server Error"
    schema:
      $ref: "#/definitions/error_out"
  not_found:
    description: "Not Found"
    schema:
      $ref: "#/definitions/error_out"
schemes:
  - http
swagger: "2.0"