From fe0f733aabfe737bda2a99f980e12a9e1e42b8a1 Mon Sep 17 00:00:00 2001 From: Suresh Chaudhary Date: Tue, 4 Aug 2026 16:15:30 +0530 Subject: [PATCH] docs: regenerate OpenAPI bundle and Mintlify navigation --- docs/docs.json | 984 ++- docs/openapi/openapi.json | 12342 +++++++++++++++++++++++++++++++++--- docs/openapi/openapi.yaml | 22 +- 3 files changed, 12476 insertions(+), 872 deletions(-) diff --git a/docs/docs.json b/docs/docs.json index 02d027b9c96..fbf88b183ce 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -112,6 +112,7 @@ "pages": [ "migration-guides/v2.0.0", "migration-guides/v1.5.0", + "migration-guides/governance-api-namespace", "migration-guides/litellm" ] }, @@ -701,10 +702,987 @@ ] }, { - "group": "API Reference", - "openapi": "openapi/openapi.json" + "group": "Inference", + "pages": [ + { + "group": "Models", + "expanded": false, + "pages": [ + "GET /v1/models" + ] + }, + { + "group": "Chat Completions", + "expanded": false, + "pages": [ + "POST /v1/chat/completions" + ] + }, + { + "group": "Text Completions", + "expanded": false, + "pages": [ + "POST /v1/completions" + ] + }, + { + "group": "Responses", + "expanded": false, + "pages": [ + "GET /v1/responses", + "POST /v1/responses", + "GET /v1/responses/{response_id}", + "DELETE /v1/responses/{response_id}", + "POST /v1/responses/{response_id}/cancel", + "GET /v1/responses/{response_id}/input_items" + ] + }, + { + "group": "OCR", + "expanded": false, + "pages": [ + "POST /v1/ocr" + ] + }, + { + "group": "Rerank", + "expanded": false, + "pages": [ + "POST /v1/rerank" + ] + }, + { + "group": "Embeddings", + "expanded": false, + "pages": [ + "POST /v1/embeddings" + ] + }, + { + "group": "Audio", + "expanded": false, + "pages": [ + "POST /v1/audio/speech", + "POST /v1/audio/transcriptions" + ] + }, + { + "group": "Images", + "expanded": false, + "pages": [ + "POST /v1/images/generations", + "POST /v1/images/edits", + "POST /v1/images/variations" + ] + }, + { + "group": "Videos", + "expanded": false, + "pages": [ + "GET /v1/videos", + "POST /v1/videos", + "GET /v1/videos/{video_id}", + "DELETE /v1/videos/{video_id}", + "GET /v1/videos/{video_id}/content", + "POST /v1/videos/{video_id}/remix" + ] + }, + { + "group": "Count Tokens", + "expanded": false, + "pages": [ + "POST /v1/responses/input_tokens" + ] + }, + { + "group": "Compaction", + "expanded": false, + "pages": [ + "POST /v1/responses/compact" + ] + }, + { + "group": "Batch", + "expanded": false, + "pages": [ + "GET /v1/batches", + "POST /v1/batches", + "GET /v1/batches/{batch_id}", + "POST /v1/batches/{batch_id}/cancel", + "GET /v1/batches/{batch_id}/results" + ] + }, + { + "group": "Files", + "expanded": false, + "pages": [ + "GET /v1/files", + "POST /v1/files", + "GET /v1/files/{file_id}", + "DELETE /v1/files/{file_id}", + "GET /v1/files/{file_id}/content" + ] + }, + { + "group": "Containers", + "expanded": false, + "pages": [ + "GET /v1/containers", + "POST /v1/containers", + "GET /v1/containers/{container_id}", + "DELETE /v1/containers/{container_id}", + "GET /v1/containers/{container_id}/files", + "POST /v1/containers/{container_id}/files", + "GET /v1/containers/{container_id}/files/{file_id}", + "DELETE /v1/containers/{container_id}/files/{file_id}", + "GET /v1/containers/{container_id}/files/{file_id}/content" + ] + }, + { + "group": "Async Jobs", + "expanded": false, + "pages": [ + "POST /v1/async/chat/completions", + "POST /v1/async/completions", + "POST /v1/async/responses", + "POST /v1/async/embeddings", + "POST /v1/async/audio/speech", + "POST /v1/async/audio/transcriptions", + "POST /v1/async/images/generations", + "POST /v1/async/images/edits", + "POST /v1/async/images/variations", + "GET /v1/async/chat/completions/{job_id}", + "GET /v1/async/completions/{job_id}", + "GET /v1/async/responses/{job_id}", + "GET /v1/async/embeddings/{job_id}", + "GET /v1/async/audio/speech/{job_id}", + "GET /v1/async/audio/transcriptions/{job_id}", + "GET /v1/async/images/generations/{job_id}", + "GET /v1/async/images/edits/{job_id}", + "GET /v1/async/images/variations/{job_id}", + "POST /v1/async/rerank", + "GET /v1/async/rerank/{job_id}", + "POST /v1/async/ocr", + "GET /v1/async/ocr/{job_id}" + ] + }, + { + "group": "Realtime", + "expanded": false, + "pages": [ + "GET /v1/realtime", + "POST /v1/realtime/calls", + "POST /v1/realtime/client_secrets", + "POST /v1/realtime/sessions" + ] + } + ] + }, + { + "group": "Integrations", + "pages": [ + { + "group": "OpenAI Integration", + "expanded": false, + "pages": [ + "POST /openai/v1/chat/completions", + "POST /openai/openai/deployments/{deployment-id}/chat/completions", + "POST /openai/v1/completions", + "POST /openai/openai/deployments/{deployment-id}/completions", + "GET /openai/v1/responses", + "POST /openai/v1/responses", + "POST /openai/openai/deployments/{deployment-id}/responses", + "POST /openai/v1/responses/input_tokens", + "GET /openai/v1/responses/{response_id}", + "DELETE /openai/v1/responses/{response_id}", + "POST /openai/v1/responses/{response_id}/cancel", + "GET /openai/v1/responses/{response_id}/input_items", + "POST /openai/v1/responses/compact", + "POST /openai/v1/embeddings", + "POST /openai/openai/deployments/{deployment-id}/embeddings", + "POST /openai/v1/audio/speech", + "POST /openai/openai/deployments/{deployment-id}/audio/speech", + "POST /openai/v1/audio/transcriptions", + "POST /openai/openai/deployments/{deployment-id}/audio/transcriptions", + "GET /openai/v1/models", + "GET /openai/openai/deployments/{deployment-id}/models", + "GET /openai/v1/batches", + "POST /openai/v1/batches", + "GET /openai/v1/batches/{batch_id}", + "POST /openai/v1/batches/{batch_id}/cancel", + "POST /openai/v1/images/generations", + "POST /openai/openai/deployments/{deployment-id}/images/generations", + "GET /openai/v1/files", + "POST /openai/v1/files", + "GET /openai/v1/files/{file_id}", + "DELETE /openai/v1/files/{file_id}", + "GET /openai/v1/files/{file_id}/content", + "GET /openai/v1/containers", + "POST /openai/v1/containers", + "GET /openai/v1/containers/{container_id}", + "DELETE /openai/v1/containers/{container_id}", + "GET /openai/v1/containers/{container_id}/files", + "POST /openai/v1/containers/{container_id}/files", + "GET /openai/v1/containers/{container_id}/files/{file_id}", + "DELETE /openai/v1/containers/{container_id}/files/{file_id}", + "GET /openai/v1/containers/{container_id}/files/{file_id}/content", + "GET /openai/v1/videos", + "POST /openai/v1/videos", + "GET /openai/v1/videos/{video_id}", + "DELETE /openai/v1/videos/{video_id}", + "GET /openai/v1/videos/{video_id}/content", + "POST /openai/v1/videos/{video_id}/remix", + "GET /openai/v1/realtime", + "POST /openai/v1/realtime/calls", + "POST /openai/v1/realtime/client_secrets", + "POST /openai/v1/realtime/sessions" + ] + }, + { + "group": "Anthropic Integration", + "expanded": false, + "pages": [ + "POST /anthropic/v1/messages", + "POST /anthropic/v1/messages/{path}", + "POST /anthropic/v1/complete", + "GET /anthropic/v1/models", + "POST /anthropic/v1/messages/count_tokens", + "GET /anthropic/v1/messages/batches", + "POST /anthropic/v1/messages/batches", + "GET /anthropic/v1/messages/batches/{batch_id}", + "POST /anthropic/v1/messages/batches/{batch_id}/cancel", + "GET /anthropic/v1/messages/batches/{batch_id}/results", + "GET /anthropic/v1/files", + "POST /anthropic/v1/files", + "GET /anthropic/v1/files/{file_id}/content", + "DELETE /anthropic/v1/files/{file_id}" + ] + }, + { + "group": "GenAI Integration", + "expanded": false, + "pages": [ + "POST /genai/v1beta/models/{model}:generateContent", + "POST /genai/v1beta/models/{model}:streamGenerateContent", + "POST /genai/v1beta/models/{model}:embedContent", + "POST /genai/v1beta/models/{model}:countTokens", + "POST /genai/v1beta/models/{model}:predict", + "GET /genai/v1beta/models", + "POST /genai/upload/v1beta/files", + "GET /genai/v1beta/files", + "GET /genai/v1beta/files/{file_id}", + "DELETE /genai/v1beta/files/{file_id}", + "GET /genai/v1beta/batches", + "GET /genai/v1beta/batches/{batch_id}", + "POST /genai/v1beta/batches/{batch_id}", + "DELETE /genai/v1beta/batches/{batch_id}", + "GET /genai/v1beta/cachedContents", + "POST /genai/v1beta/cachedContents", + "GET /genai/v1beta/cachedContents/{cached_id}", + "PATCH /genai/v1beta/cachedContents/{cached_id}", + "DELETE /genai/v1beta/cachedContents/{cached_id}", + "POST /genai/v1/rank", + "GET /genai/v1beta/models/{model}/operations/{operation_id}" + ] + }, + { + "group": "Bedrock Integration", + "expanded": false, + "pages": [ + "POST /bedrock/model/{modelId}/converse", + "POST /bedrock/model/{modelId}/converse-stream", + "POST /bedrock/model/{modelId}/invoke", + "POST /bedrock/model/{modelId}/invoke-with-response-stream", + "POST /bedrock/model/{modelId}/count-tokens", + "POST /bedrock/model-invocation-job", + "GET /bedrock/model-invocation-jobs", + "GET /bedrock/model-invocation-job/{job_arn}", + "POST /bedrock/model-invocation-job/{job_arn}/stop", + "GET /bedrock/files/{bucket}", + "GET /bedrock/files/{bucket}/{key}", + "PUT /bedrock/files/{bucket}/{key}", + "DELETE /bedrock/files/{bucket}/{key}", + "HEAD /bedrock/files/{bucket}/{key}" + ] + }, + { + "group": "Cohere Integration", + "expanded": false, + "pages": [ + "POST /cohere/v2/chat", + "POST /cohere/v2/embed", + "POST /cohere/v2/rerank", + "POST /cohere/v1/tokenize" + ] + }, + { + "group": "Cursor Integration", + "expanded": false, + "pages": [ + "POST /cursor/v1/chat/completions", + "GET /cursor/v1/models", + "POST /cursor/v1/complete", + "POST /cursor/v1/messages", + "POST /cursor/v1/messages/{path}", + "POST /cursor/v1/messages/count_tokens", + "GET /cursor/v1beta/models", + "POST /cursor/v1beta/models/{model}", + "GET /cursor/v1beta/models/{model}/operations/{operation_id}", + "POST /cursor/v1/rank", + "POST /cursor/model/{modelId}/converse", + "POST /cursor/model/{modelId}/converse-stream", + "POST /cursor/model/{modelId}/invoke", + "POST /cursor/model/{modelId}/invoke-with-response-stream", + "POST /cursor/rerank", + "POST /cursor/model/{modelId}/count-tokens", + "POST /cursor/v2/chat", + "POST /cursor/v2/embed", + "POST /cursor/v2/rerank", + "POST /cursor/v1/tokenize" + ] + }, + { + "group": "LiteLLM Integration", + "expanded": false, + "pages": [ + "POST /litellm/v1/completions", + "POST /litellm/v1/chat/completions", + "POST /litellm/v1/embeddings", + "GET /litellm/v1/models", + "POST /litellm/v1/responses", + "POST /litellm/v1/responses/input_tokens", + "POST /litellm/v1/audio/speech", + "POST /litellm/v1/audio/transcriptions", + "POST /litellm/anthropic/v1/messages", + "GET /litellm/genai/v1beta/models", + "POST /litellm/genai/v1beta/models/{model}:generateContent", + "POST /litellm/genai/v1beta/models/{model}:streamGenerateContent", + "POST /litellm/bedrock/model/{modelId}/converse", + "POST /litellm/bedrock/model/{modelId}/converse-stream", + "POST /litellm/cohere/v2/chat", + "POST /litellm/cohere/v2/embed", + "POST /litellm/cohere/v1/tokenize" + ] + }, + { + "group": "LangChain Integration", + "expanded": false, + "pages": [ + "POST /langchain/v1/completions", + "POST /langchain/v1/chat/completions", + "POST /langchain/v1/embeddings", + "GET /langchain/v1/models", + "POST /langchain/v1/responses", + "POST /langchain/v1/responses/input_tokens", + "POST /langchain/v1/audio/speech", + "POST /langchain/v1/audio/transcriptions", + "POST /langchain/anthropic/v1/messages", + "POST /langchain/anthropic/v1/messages/count_tokens", + "GET /langchain/genai/v1beta/models", + "POST /langchain/genai/v1beta/models/{model}:generateContent", + "POST /langchain/genai/v1beta/models/{model}:streamGenerateContent", + "POST /langchain/bedrock/model/{modelId}/converse", + "POST /langchain/bedrock/model/{modelId}/converse-stream", + "POST /langchain/cohere/v2/chat", + "POST /langchain/cohere/v2/embed", + "POST /langchain/cohere/v1/tokenize" + ] + }, + { + "group": "PydanticAI Integration", + "expanded": false, + "pages": [ + "POST /pydanticai/v1/completions", + "POST /pydanticai/v1/chat/completions", + "POST /pydanticai/v1/embeddings", + "GET /pydanticai/v1/models", + "POST /pydanticai/v1/responses", + "POST /pydanticai/v1/responses/input_tokens", + "POST /pydanticai/v1/audio/speech", + "POST /pydanticai/v1/audio/transcriptions", + "POST /pydanticai/anthropic/v1/messages", + "GET /pydanticai/genai/v1beta/models", + "POST /pydanticai/genai/v1beta/models/{model}:generateContent", + "POST /pydanticai/genai/v1beta/models/{model}:streamGenerateContent", + "POST /pydanticai/bedrock/model/{modelId}/converse", + "POST /pydanticai/bedrock/model/{modelId}/converse-stream", + "POST /pydanticai/cohere/v2/chat", + "POST /pydanticai/cohere/v2/embed", + "POST /pydanticai/cohere/v1/tokenize" + ] + } + ] + }, + { + "group": "Platform", + "pages": [ + { + "group": "Health", + "expanded": false, + "pages": [ + "GET /health" + ] + }, + { + "group": "Configuration", + "expanded": false, + "pages": [ + "GET /api/config", + "PUT /api/config", + "GET /api/version", + "GET /api/proxy-config", + "PUT /api/proxy-config", + "POST /api/pricing/force-sync" + ] + }, + { + "group": "Session", + "expanded": false, + "pages": [ + "POST /api/session/login", + "POST /api/session/logout", + "GET /api/session/is-auth-enabled", + "POST /api/session/ws-ticket" + ] + }, + { + "group": "Providers", + "expanded": false, + "pages": [ + "GET /api/providers", + "POST /api/providers", + "GET /api/providers/{provider}", + "PUT /api/providers/{provider}", + "DELETE /api/providers/{provider}", + "GET /api/providers/{provider}/keys", + "POST /api/providers/{provider}/keys", + "GET /api/providers/{provider}/keys/{key_id}", + "PUT /api/providers/{provider}/keys/{key_id}", + "DELETE /api/providers/{provider}/keys/{key_id}", + "GET /api/keys", + "GET /api/models", + "GET /api/models/details", + "GET /api/models/parameters", + "GET /api/models/base" + ] + }, + { + "group": "Plugins", + "expanded": false, + "pages": [ + "GET /api/plugins", + "POST /api/plugins", + "GET /api/plugins/builtins", + "GET /api/plugins/{name}", + "PUT /api/plugins/{name}", + "DELETE /api/plugins/{name}" + ] + }, + { + "group": "MCP", + "expanded": false, + "pages": [ + "POST /v1/mcp/tool/execute", + "GET /api/mcp/clients", + "POST /api/mcp/client", + "PUT /api/mcp/client/{id}", + "DELETE /api/mcp/client/{id}", + "POST /api/mcp/client/{id}/reconnect", + "POST /api/mcp/client/{id}/complete-oauth", + "POST /api/mcp/client/{id}/initiate-verification", + "POST /api/mcp/client/{id}/reauthorize", + "POST /api/mcp/client/{id}/verify-headers", + "POST /api/mcp/client/{id}/verify-exchange", + "GET /api/mcp/sessions", + "DELETE /api/mcp/sessions/{id}", + "POST /api/mcp/sessions/{id}/reauth", + "GET /api/mcp/per-user-headers/flows/{id}", + "PUT /api/mcp/per-user-headers/flows/{id}", + "DELETE /api/mcp/per-user-headers/credential/{id}" + ] + }, + { + "group": "MCP Tool Groups", + "expanded": false, + "pages": [ + "GET /api/mcp/tool-groups", + "POST /api/mcp/tool-groups", + "GET /api/mcp/tool-groups/{id}", + "PUT /api/mcp/tool-groups/{id}", + "DELETE /api/mcp/tool-groups/{id}" + ] + }, + { + "group": "OAuth", + "expanded": false, + "pages": [ + "GET /api/oauth/per-user/flows/{id}", + "GET /api/oauth/per-user/flows/{id}/start", + "GET /api/oauth/callback", + "GET /api/oauth/config/{id}/status", + "DELETE /api/oauth/config/{id}" + ] + }, + { + "group": "Circuit Breaker", + "expanded": false, + "pages": [ + "GET /api/circuit-breaker/policies", + "POST /api/circuit-breaker/policies", + "PUT /api/circuit-breaker/policies/{name}", + "DELETE /api/circuit-breaker/policies/{name}", + "GET /api/circuit-breaker/state" + ] + }, + { + "group": "Logging", + "expanded": false, + "pages": [ + "GET /api/logs", + "DELETE /api/logs", + "GET /api/logs/{id}", + "GET /api/logs/sessions/{session_id}", + "GET /api/logs/sessions/{session_id}/summary", + "GET /api/logs/stats", + "GET /api/logs/histogram", + "GET /api/logs/histogram/tokens", + "GET /api/logs/histogram/cost", + "GET /api/logs/histogram/models", + "GET /api/logs/histogram/latency", + "GET /api/logs/histogram/cost/by-provider", + "GET /api/logs/histogram/tokens/by-provider", + "GET /api/logs/histogram/latency/by-provider", + "GET /api/logs/histogram/cost/by-dimension", + "GET /api/logs/histogram/tokens/by-dimension", + "GET /api/logs/histogram/latency/by-dimension", + "GET /api/logs/dropped", + "GET /api/logs/filterdata", + "GET /api/logs/rankings", + "GET /api/logs/dashboard", + "POST /api/logs/recalculate-cost", + "GET /api/logs/recalculate-cost/status", + "GET /api/mcp-logs", + "DELETE /api/mcp-logs", + "GET /api/mcp-logs/{id}", + "GET /api/mcp-logs/stats", + "GET /api/mcp-logs/filterdata", + "GET /api/mcp-logs/histogram", + "GET /api/mcp-logs/histogram/cost", + "GET /api/mcp-logs/histogram/top-tools" + ] + }, + { + "group": "Prompt Repository", + "expanded": false, + "pages": [ + "GET /api/prompt-repo/folders", + "POST /api/prompt-repo/folders", + "GET /api/prompt-repo/folders/{id}", + "PUT /api/prompt-repo/folders/{id}", + "DELETE /api/prompt-repo/folders/{id}", + "GET /api/prompt-repo/prompts", + "POST /api/prompt-repo/prompts", + "GET /api/prompt-repo/prompts/{id}", + "PUT /api/prompt-repo/prompts/{id}", + "DELETE /api/prompt-repo/prompts/{id}", + "GET /api/prompt-repo/prompts/{id}/versions", + "POST /api/prompt-repo/prompts/{id}/versions", + "GET /api/prompt-repo/versions/{id}", + "DELETE /api/prompt-repo/versions/{id}", + "GET /api/prompt-repo/prompts/{id}/sessions", + "POST /api/prompt-repo/prompts/{id}/sessions", + "GET /api/prompt-repo/sessions/{id}", + "PUT /api/prompt-repo/sessions/{id}", + "DELETE /api/prompt-repo/sessions/{id}", + "PUT /api/prompt-repo/sessions/{id}/rename", + "POST /api/prompt-repo/sessions/{id}/commit" + ] + }, + { + "group": "Skills", + "expanded": false, + "pages": [ + "POST /api/skills/files/upload", + "DELETE /api/skills/files/orphans", + "GET /api/skills/all/version", + "PUT /api/skills/all/version", + "GET /api/skills", + "POST /api/skills", + "GET /api/skills/{id}", + "PUT /api/skills/{id}", + "DELETE /api/skills/{id}", + "GET /api/skills/{id}/versions", + "POST /api/skills/{id}/shift-version", + "GET /api/skills/serve/claude-code/.claude-plugin/marketplace.json", + "GET /api/skills/serve/codex/.agents/plugins/marketplace.json", + "GET /api/skills/serve/all/download.zip", + "GET /api/skills/serve/{skill-name}/download.zip", + "GET /api/skills/serve/{skill-name}/files/{filepath}" + ] + }, + { + "group": "Cache", + "expanded": false, + "pages": [ + "DELETE /api/cache/clear/{cacheId}", + "DELETE /api/cache/clear-by-key/{cacheKey}" + ] + }, + { + "group": "Vault", + "expanded": false, + "pages": [ + "POST /api/vault/flush-cache" + ] + }, + { + "group": "Infrastructure", + "expanded": false, + "pages": [ + "GET /ws", + "GET /mcp", + "POST /mcp", + "GET /metrics" + ] + }, + { + "group": "Webhooks", + "expanded": false, + "pages": [ + "GET /api/webhooks", + "POST /api/webhooks", + "GET /api/webhooks/{id}", + "PUT /api/webhooks/{id}", + "DELETE /api/webhooks/{id}", + "POST /api/webhooks/{id}/rotate-secret", + "POST /api/webhooks/{id}/test", + "GET /api/webhooks/{id}/deliveries", + "POST /api/webhooks/deliveries/{id}/redeliver" + ] + } + ] + }, + { + "group": "Governance", + "pages": [ + { + "group": "Teams", + "expanded": false, + "pages": [ + "GET /api/governance/teams", + "POST /api/governance/teams", + "GET /api/governance/teams/{team_id}", + "PUT /api/governance/teams/{team_id}", + "DELETE /api/governance/teams/{team_id}", + "GET /api/governance/teams/{team_id}/members", + "POST /api/governance/teams/{team_id}/members", + "DELETE /api/governance/teams/{team_id}/members/{user_id}", + "GET /api/governance/users/{user_id}/teams", + "PUT /api/governance/users/{user_id}/teams", + "GET /api/governance/teams/{team_id}/customers", + "POST /api/governance/teams/{team_id}/customers", + "DELETE /api/governance/teams/{team_id}/customers/{customer_id}", + "GET /api/governance/customers/{customer_id}/teams", + "GET /api/governance/business-units/{business_unit_id}/teams", + "POST /api/governance/business-units/{business_unit_id}/teams", + "DELETE /api/governance/business-units/{business_unit_id}/teams/{team_id}" + ] + }, + { + "group": "Virtual Keys", + "expanded": false, + "pages": [ + "GET /api/governance/virtual-keys", + "POST /api/governance/virtual-keys", + "GET /api/governance/virtual-keys/quota", + "GET /api/governance/virtual-keys/{vk_id}", + "PUT /api/governance/virtual-keys/{vk_id}", + "DELETE /api/governance/virtual-keys/{vk_id}", + "GET /api/governance/virtual-keys/{vk_id}/users", + "POST /api/governance/virtual-keys/{vk_id}/users", + "DELETE /api/governance/virtual-keys/{vk_id}/users/{user_id}", + "PUT /api/governance/virtual-keys/{vk_id}/budgets/{budget_id}/override", + "DELETE /api/governance/virtual-keys/{vk_id}/budgets/{budget_id}/override", + "GET /api/governance/users/{user_id}/virtual-keys", + "GET /api/governance/users/email/{email}/virtual-keys" + ] + }, + { + "group": "Customers", + "expanded": false, + "pages": [ + "GET /api/governance/customers", + "POST /api/governance/customers", + "GET /api/governance/customers/{customer_id}", + "PUT /api/governance/customers/{customer_id}", + "DELETE /api/governance/customers/{customer_id}" + ] + }, + { + "group": "Users", + "expanded": false, + "pages": [ + "GET /api/governance/users", + "POST /api/governance/users", + "GET /api/governance/users/{user_id}", + "DELETE /api/governance/users/{user_id}", + "GET /api/governance/users/email/{email}", + "GET /api/governance/users/me/permissions", + "PUT /api/governance/users/{user_id}/role", + "POST /api/governance/users/{user_id}/governance", + "PUT /api/governance/users/{user_id}/governance", + "DELETE /api/governance/users/{user_id}/governance" + ] + }, + { + "group": "Business Units", + "expanded": false, + "pages": [ + "GET /api/governance/business-units", + "POST /api/governance/business-units", + "GET /api/governance/business-units/{business_unit_id}", + "PUT /api/governance/business-units/{business_unit_id}", + "DELETE /api/governance/business-units/{business_unit_id}", + "POST /api/governance/business-units/{business_unit_id}/governance", + "PUT /api/governance/business-units/{business_unit_id}/governance", + "DELETE /api/governance/business-units/{business_unit_id}/governance", + "GET /api/governance/business-units/{business_unit_id}/customers", + "POST /api/governance/business-units/{business_unit_id}/customers", + "DELETE /api/governance/business-units/{business_unit_id}/customers/{customer_id}", + "GET /api/governance/customers/{customer_id}/business-units" + ] + }, + { + "group": "Access Profiles", + "expanded": false, + "pages": [ + "GET /api/governance/access-profiles", + "POST /api/governance/access-profiles", + "GET /api/governance/access-profiles/{profile_id}", + "PUT /api/governance/access-profiles/{profile_id}", + "DELETE /api/governance/access-profiles/{profile_id}", + "PUT /api/governance/access-profiles/{profile_id}/activate", + "PUT /api/governance/access-profiles/{profile_id}/deactivate", + "POST /api/governance/access-profiles/{profile_id}/clone", + "POST /api/governance/access-profiles/{profile_id}/propagate", + "POST /api/governance/access-profiles/{profile_id}/roles", + "DELETE /api/governance/access-profiles/{profile_id}/roles/{role_id}", + "GET /api/governance/access-profiles/{profile_id}/versions", + "GET /api/governance/access-profiles/{profile_id}/versions/{version}", + "GET /api/governance/access-profiles/{profile_id}/audit-logs", + "GET /api/governance/access-profiles/audit-logs", + "GET /api/governance/users/{user_id}/access-profiles", + "DELETE /api/governance/users/{user_id}/access-profiles/{profile_id}", + "PUT /api/governance/users/{user_id}/access-profiles/{profile_id}/budgets/{budget_id}/override", + "DELETE /api/governance/users/{user_id}/access-profiles/{profile_id}/budgets/{budget_id}/override", + "POST /api/governance/users/{user_id}/access-profiles/{profile_id}/virtual-keys", + "DELETE /api/governance/users/{user_id}/access-profiles/virtual-keys/{vk_id}" + ] + }, + { + "group": "RBAC", + "expanded": false, + "pages": [ + "GET /api/governance/rbac/roles", + "POST /api/governance/rbac/roles", + "GET /api/governance/rbac/roles/{role_id}", + "PUT /api/governance/rbac/roles/{role_id}", + "DELETE /api/governance/rbac/roles/{role_id}", + "GET /api/governance/rbac/roles/{role_id}/permissions", + "PUT /api/governance/rbac/roles/{role_id}/permissions", + "GET /api/governance/rbac/resources", + "GET /api/governance/rbac/operations", + "GET /api/governance/rbac/permissions" + ] + }, + { + "group": "Audit Logs", + "expanded": false, + "pages": [ + "GET /api/governance/audit-logs", + "GET /api/governance/audit-logs/filterdata", + "GET /api/governance/audit-logs/export", + "GET /api/governance/audit-logs/{id}", + "GET /api/governance/audit-logs/{id}/verify" + ] + }, + { + "group": "Budgets & Rate Limits", + "expanded": false, + "pages": [ + "GET /api/governance/budgets", + "GET /api/governance/rate-limits" + ] + }, + { + "group": "Routing Rules", + "expanded": false, + "pages": [ + "GET /api/governance/routing-rules", + "POST /api/governance/routing-rules", + "GET /api/governance/routing-rules/{rule_id}", + "PUT /api/governance/routing-rules/{rule_id}", + "DELETE /api/governance/routing-rules/{rule_id}" + ] + }, + { + "group": "Model Configs", + "expanded": false, + "pages": [ + "GET /api/governance/model-configs", + "POST /api/governance/model-configs", + "GET /api/governance/model-configs/{mc_id}", + "PUT /api/governance/model-configs/{mc_id}", + "DELETE /api/governance/model-configs/{mc_id}" + ] + }, + { + "group": "Provider Governance", + "expanded": false, + "pages": [ + "GET /api/governance/providers", + "PUT /api/governance/providers/{provider_name}", + "DELETE /api/governance/providers/{provider_name}" + ] + }, + { + "group": "Pricing Overrides", + "expanded": false, + "pages": [ + "GET /api/governance/pricing-overrides", + "POST /api/governance/pricing-overrides", + "PUT /api/governance/pricing-overrides/{id}", + "DELETE /api/governance/pricing-overrides/{id}" + ] + }, + { + "group": "Complexity Analyzer", + "expanded": false, + "pages": [ + "GET /api/governance/complexity-analyzer-config", + "PUT /api/governance/complexity-analyzer-config", + "POST /api/governance/complexity-analyzer-config/reset" + ] + } + ] + }, + { + "group": "Deprecated", + "pages": [ + { + "group": "Virtual Keys", + "expanded": false, + "pages": [ + "GET /api/virtual-keys/{vk_id}/users", + "POST /api/virtual-keys/{vk_id}/users", + "DELETE /api/virtual-keys/{vk_id}/users/{user_id}" + ] + }, + { + "group": "Teams", + "expanded": false, + "pages": [ + "GET /api/teams/{team_id}/customers", + "POST /api/teams/{team_id}/customers", + "DELETE /api/teams/{team_id}/customers/{customer_id}", + "GET /api/teams/{team_id}/members", + "POST /api/teams/{team_id}/members", + "DELETE /api/teams/{team_id}/members/{user_id}" + ] + }, + { + "group": "Customers", + "expanded": false, + "pages": [ + "GET /api/customers/{customer_id}/teams" + ] + }, + { + "group": "RBAC", + "expanded": false, + "pages": [ + "GET /api/roles", + "POST /api/roles", + "GET /api/roles/{role_id}", + "PUT /api/roles/{role_id}", + "DELETE /api/roles/{role_id}", + "GET /api/roles/{role_id}/permissions", + "PUT /api/roles/{role_id}/permissions", + "GET /api/resources", + "GET /api/operations", + "GET /api/permissions" + ] + }, + { + "group": "Users", + "expanded": false, + "pages": [ + "GET /api/users", + "POST /api/users", + "GET /api/users/{user_id}", + "DELETE /api/users/{user_id}", + "GET /api/users/me/permissions", + "PUT /api/users/{user_id}/role", + "GET /api/users/{user_id}/teams", + "PUT /api/users/{user_id}/teams", + "GET /api/users/email/{email}/virtual-keys", + "GET /api/users/email/{email}", + "GET /api/users/{user_id}/virtual-keys" + ] + }, + { + "group": "Governance", + "expanded": false, + "pages": [ + "GET /api/teams", + "POST /api/teams", + "GET /api/teams/{team_id}", + "PUT /api/teams/{team_id}", + "DELETE /api/teams/{team_id}" + ] + }, + { + "group": "Access Profiles", + "expanded": false, + "pages": [ + "GET /api/access-profiles", + "POST /api/access-profiles", + "GET /api/access-profiles/{profile_id}", + "PUT /api/access-profiles/{profile_id}", + "DELETE /api/access-profiles/{profile_id}", + "PUT /api/access-profiles/{profile_id}/activate", + "PUT /api/access-profiles/{profile_id}/deactivate", + "POST /api/access-profiles/{profile_id}/clone", + "POST /api/access-profiles/{profile_id}/propagate", + "POST /api/access-profiles/{profile_id}/roles", + "DELETE /api/access-profiles/{profile_id}/roles/{role_id}", + "GET /api/access-profiles/{profile_id}/versions", + "GET /api/access-profiles/{profile_id}/versions/{version}", + "GET /api/access-profiles/{profile_id}/audit-logs", + "GET /api/access-profiles/audit-logs", + "GET /api/users/{user_id}/access-profiles", + "PUT /api/users/{user_id}/access-profiles/{profile_id}/budgets/{budget_id}/override", + "DELETE /api/users/{user_id}/access-profiles/{profile_id}/budgets/{budget_id}/override", + "DELETE /api/users/{user_id}/access-profiles/{profile_id}", + "POST /api/users/{user_id}/access-profiles/{profile_id}/virtual-keys", + "DELETE /api/users/{user_id}/access-profiles/virtual-keys/{vk_id}" + ] + }, + { + "group": "Audit Logs", + "expanded": false, + "pages": [ + "GET /api/audit-logs", + "GET /api/audit-logs/filterdata", + "GET /api/audit-logs/export", + "GET /api/audit-logs/{id}", + "GET /api/audit-logs/{id}/verify" + ] + } + ] } - ] + ], + "openapi": "openapi/openapi.json" }, { "tab": "Contributing", diff --git a/docs/openapi/openapi.json b/docs/openapi/openapi.json index ace16e603f2..35c2715a845 100644 --- a/docs/openapi/openapi.json +++ b/docs/openapi/openapi.json @@ -38706,9 +38706,15 @@ } } }, - "/api/users": { + "/api/governance/users": { "get": { "operationId": "listUsers", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "List users", "description": "Returns a paginated list of users with optional search.", "tags": [ @@ -38716,13 +38722,13 @@ ], "parameters": [ { - "name": "page", + "name": "offset", "in": "query", - "description": "Page number (1-based)", + "description": "Zero-based result offset", "schema": { "type": "integer", - "minimum": 1, - "default": 1 + "minimum": 0, + "default": 0 } }, { @@ -38757,6 +38763,13 @@ "application/json": { "schema": { "type": "object", + "required": [ + "users", + "count", + "total_count", + "limit", + "offset" + ], "properties": { "users": { "type": "array", @@ -38874,25 +38887,21 @@ } } }, - "total": { + "count": { "type": "integer", - "description": "Total number of users matching the query" + "description": "Number of users in this response" }, - "page": { + "total_count": { "type": "integer", - "description": "Current page number" + "description": "Total number of users matching the query" }, "limit": { "type": "integer", - "description": "Number of users per page" + "description": "Requested page size, or the returned collection size when unpaged" }, - "total_pages": { + "offset": { "type": "integer", - "description": "Total number of pages" - }, - "has_more": { - "type": "boolean", - "description": "Whether more pages are available" + "description": "Zero-based result offset" } } } @@ -38913,6 +38922,12 @@ }, "post": { "operationId": "createUser", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Create user", "description": "Manually creates a new user in the organization.", "tags": [ @@ -39112,17 +39127,23 @@ } } }, - "/api/users/{id}": { - "delete": { - "operationId": "deleteUser", - "summary": "Delete user", - "description": "Permanently removes a user from the organization. This cascades to delete the user's governance settings (budget/rate limits), team memberships, access profiles, and OIDC sessions. Cannot delete yourself.\n", + "/api/governance/users/{user_id}": { + "get": { + "operationId": "getUser", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get user", + "description": "Returns a single Enterprise user.", "tags": [ "Users" ], "parameters": [ { - "name": "id", + "name": "user_id", "in": "path", "required": true, "description": "User ID", @@ -39138,31 +39159,131 @@ ], "responses": { "200": { - "description": "User deleted successfully", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/MessageResponse" - } - } - } - }, - "400": { - "description": "Bad request (e.g. cannot delete yourself)", + "description": "Successful response", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/ManagementErrorResponse" + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Unique user identifier" + }, + "name": { + "type": "string", + "description": "User's display name" + }, + "email": { + "type": "string", + "format": "email", + "description": "User's email address" + }, + "role_id": { + "type": "integer", + "nullable": true, + "description": "ID of the assigned RBAC role" + }, + "role": { + "type": "object", + "nullable": true, + "description": "RBAC role details", + "properties": { + "id": { + "type": "integer" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string" + }, + "is_system_role": { + "type": "boolean" + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "teams": { + "type": "array", + "description": "Teams the user belongs to.", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Team ID" + }, + "name": { + "type": "string", + "description": "Team name" + }, + "business_unit_id": { + "type": "string", + "nullable": true, + "description": "Business unit ID associated with this team (if any)" + }, + "business_unit_name": { + "type": "string", + "nullable": true, + "description": "Business unit name associated with this team (if any)" + } + } + } + }, + "access_profile": { + "type": "object", + "nullable": true, + "description": "Active or fallback user access profile, if assigned.", + "properties": { + "id": { + "type": "integer" + }, + "user_id": { + "type": "string" + }, + "parent_profile_id": { + "type": "integer", + "nullable": true + }, + "name": { + "type": "string" + }, + "is_active": { + "type": "boolean" + }, + "expires_at": { + "type": "string", + "format": "date-time", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } } } } }, "404": { - "description": "User not found", + "description": "Resource not found", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/ManagementErrorResponse" + "$ref": "#/components/schemas/BifrostError" } } } @@ -39178,16 +39299,31 @@ } } } - } - }, - "/api/users/me/permissions": { - "get": { - "operationId": "getCurrentUserPermissions", - "summary": "Get current user permissions", - "description": "Returns the RBAC permissions for the authenticated user. When SCIM is not enabled, returns full permissions for all resources. Otherwise returns the permissions associated with the user's assigned role.\n", + }, + "delete": { + "operationId": "deleteUser", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Delete user", + "description": "Permanently removes a user from the organization. This cascades to delete the user's governance settings (budget/rate limits), team memberships, access profiles, and OIDC sessions. Cannot delete yourself.\n", "tags": [ "Users" ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "description": "User ID", + "schema": { + "type": "string" + } + } + ], "security": [ { "ManagementBearerAuth": [] @@ -39195,29 +39331,17 @@ ], "responses": { "200": { - "description": "Successful response", + "description": "User deleted successfully", "content": { "application/json": { "schema": { - "type": "object", - "properties": { - "permissions": { - "type": "object", - "description": "Map of resource names to their permitted operations. When SCIM is disabled, returns full permissions for all resources.\n", - "additionalProperties": { - "type": "object", - "additionalProperties": { - "type": "boolean" - } - } - } - } + "$ref": "#/components/schemas/MessageResponse" } } } }, - "401": { - "description": "Unauthorized (user not authenticated)", + "400": { + "description": "Bad request (e.g. cannot delete yourself)", "content": { "application/json": { "schema": { @@ -39249,44 +39373,20 @@ } } }, - "/api/users/{id}/role": { - "put": { - "operationId": "assignUserRole", - "summary": "Assign role to user", - "description": "Assigns an RBAC role to a user. This also auto-assigns the default access profile for the new role and reloads the RBAC permission cache.\n", + "/api/governance/users/me/permissions": { + "get": { + "operationId": "getCurrentUserPermissions", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get current user permissions", + "description": "Returns the RBAC permissions for the authenticated user. When SCIM is not enabled, returns full permissions for all resources. Otherwise returns the permissions associated with the user's assigned role.\n", "tags": [ "Users" ], - "parameters": [ - { - "name": "id", - "in": "path", - "required": true, - "description": "User ID", - "schema": { - "type": "string" - } - } - ], - "requestBody": { - "required": true, - "content": { - "application/json": { - "schema": { - "type": "object", - "required": [ - "role_id" - ], - "properties": { - "role_id": { - "type": "integer", - "description": "ID of the RBAC role to assign" - } - } - } - } - } - }, "security": [ { "ManagementBearerAuth": [] @@ -39294,27 +39394,39 @@ ], "responses": { "200": { - "description": "Role assigned successfully", + "description": "Successful response", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/MessageResponse" + "type": "object", + "properties": { + "permissions": { + "type": "object", + "description": "Map of resource names to their permitted operations. When SCIM is disabled, returns full permissions for all resources.\n", + "additionalProperties": { + "type": "object", + "additionalProperties": { + "type": "boolean" + } + } + } + } } } } }, - "400": { - "description": "Bad request", + "401": { + "description": "Unauthorized (user not authenticated)", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/BifrostError" + "$ref": "#/components/schemas/ManagementErrorResponse" } } } }, "404": { - "description": "User or role not found", + "description": "User not found", "content": { "application/json": { "schema": { @@ -39336,9 +39448,108 @@ } } }, - "/api/users/{id}/teams": { + "/api/governance/users/{user_id}/role": { + "put": { + "operationId": "assignUserRole", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Assign role to user", + "description": "Assigns an RBAC role to a user. This also auto-assigns the default access profile for the new role and reloads the RBAC permission cache.\n", + "tags": [ + "Users" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "description": "User ID", + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "role_id" + ], + "properties": { + "role_id": { + "type": "integer", + "description": "ID of the RBAC role to assign" + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Role assigned successfully", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "User or role not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + } + } + }, + "/api/governance/users/{user_id}/teams": { "get": { "operationId": "getUserTeams", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Get user's teams", "description": "Returns the list of teams a user belongs to, including the membership source.", "tags": [ @@ -39346,7 +39557,7 @@ ], "parameters": [ { - "name": "id", + "name": "user_id", "in": "path", "required": true, "description": "User ID", @@ -39427,6 +39638,12 @@ }, "put": { "operationId": "updateUserTeams", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Update user's team assignments", "description": "Replaces the user's manual team assignments. Synced team memberships (from SCIM providers) are preserved and cannot be removed via this endpoint.\n", "tags": [ @@ -39434,7 +39651,7 @@ ], "parameters": [ { - "name": "id", + "name": "user_id", "in": "path", "required": true, "description": "User ID", @@ -39514,26 +39731,66 @@ } } }, - "/api/users/email/{email}/virtual-keys": { - "get": { - "operationId": "getUserVirtualKeysByEmail", - "summary": "Get user's virtual keys by email", - "description": "**Enterprise only.**\nReturns all virtual keys associated with a user, looked up by email address. Returns an empty `virtual_keys` array when the user exists but has no virtual keys assigned. Intended for MDM and credential-helper integrations that need to resolve a user's keys without knowing their internal ID.\n", + "/api/governance/users/{user_id}/governance": { + "post": { + "operationId": "createUserGovernance", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Create user governance", "tags": [ "Users" ], "parameters": [ { - "name": "email", + "name": "user_id", "in": "path", "required": true, - "description": "URL-encoded email address of the user", "schema": { - "type": "string", - "format": "email" + "type": "string" } } ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "User-scoped governance settings. POST creates settings and PUT partially updates them.", + "properties": { + "user_id": { + "type": "string", + "description": "Optional body copy of the path user ID. When present, it must match the path." + }, + "budget": { + "$ref": "#/components/schemas/CreateBudgetRequest" + }, + "budgets": { + "type": "array", + "items": { + "$ref": "#/components/schemas/CreateBudgetRequest" + } + }, + "rate_limit": { + "$ref": "#/components/schemas/CreateRateLimitRequest" + }, + "provider_configs": { + "type": "array", + "description": "Optional Enterprise per-provider governance overrides.", + "items": { + "type": "object", + "additionalProperties": true + } + } + } + } + } + } + }, "security": [ { "ManagementBearerAuth": [] @@ -39541,43 +39798,121 @@ ], "responses": { "200": { - "description": "Successful response", + "description": "Governance created", "content": { "application/json": { "schema": { "type": "object", "properties": { - "user_id": { - "type": "string", - "description": "Internal ID of the resolved user" - }, - "email": { - "type": "string", - "format": "email", - "description": "Email address of the resolved user" - }, - "virtual_keys": { - "type": "array", - "description": "Virtual keys assigned to this user", - "items": { - "type": "object", - "properties": { - "id": { - "type": "string", - "description": "Virtual key ID" - }, - "name": { - "type": "string", - "description": "Virtual key display name" - }, - "value": { - "type": "string", - "description": "Virtual key token value" - }, - "is_active": { - "type": "boolean", - "nullable": true, - "description": "Whether the virtual key is currently active" + "user": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Unique user identifier" + }, + "name": { + "type": "string", + "description": "User's display name" + }, + "email": { + "type": "string", + "format": "email", + "description": "User's email address" + }, + "role_id": { + "type": "integer", + "nullable": true, + "description": "ID of the assigned RBAC role" + }, + "role": { + "type": "object", + "nullable": true, + "description": "RBAC role details", + "properties": { + "id": { + "type": "integer" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string" + }, + "is_system_role": { + "type": "boolean" + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "teams": { + "type": "array", + "description": "Teams the user belongs to.", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Team ID" + }, + "name": { + "type": "string", + "description": "Team name" + }, + "business_unit_id": { + "type": "string", + "nullable": true, + "description": "Business unit ID associated with this team (if any)" + }, + "business_unit_name": { + "type": "string", + "nullable": true, + "description": "Business unit name associated with this team (if any)" + } + } + } + }, + "access_profile": { + "type": "object", + "nullable": true, + "description": "Active or fallback user access profile, if assigned.", + "properties": { + "id": { + "type": "integer" + }, + "user_id": { + "type": "string" + }, + "parent_profile_id": { + "type": "integer", + "nullable": true + }, + "name": { + "type": "string" + }, + "is_active": { + "type": "boolean" + }, + "expires_at": { + "type": "string", + "format": "date-time", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } } } } @@ -39598,17 +39933,7 @@ } }, "404": { - "description": "User not found", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/ManagementErrorResponse" - } - } - } - }, - "500": { - "description": "Internal server error", + "description": "Resource not found", "content": { "application/json": { "schema": { @@ -39616,112 +39941,13 @@ } } } - } - } - } - }, - "/api/teams": { - "get": { - "operationId": "listTeams", - "summary": "List teams", - "description": "Returns a paginated list of teams with optional search.", - "tags": [ - "Teams" - ], - "parameters": [ - { - "name": "page", - "in": "query", - "description": "Page number (1-based)", - "schema": { - "type": "integer", - "minimum": 1, - "default": 1 - } }, - { - "name": "limit", - "in": "query", - "description": "Number of teams per page (max 100)", - "schema": { - "type": "integer", - "minimum": 1, - "maximum": 100, - "default": 20 - } - }, - { - "name": "search", - "in": "query", - "description": "Search by team name", - "schema": { - "type": "string" - } - } - ], - "security": [ - { - "ManagementBearerAuth": [] - } - ], - "responses": { - "200": { - "description": "Successful response", + "409": { + "description": "User governance already exists", "content": { "application/json": { "schema": { - "type": "object", - "properties": { - "teams": { - "type": "array", - "items": { - "type": "object", - "properties": { - "id": { - "type": "string", - "description": "Team ID (derived from name)" - }, - "name": { - "type": "string", - "description": "Team name" - }, - "member_count": { - "type": "integer", - "description": "Number of members in the team" - }, - "virtual_key_count": { - "type": "integer", - "description": "Number of virtual keys assigned to the team" - }, - "created_at": { - "type": "string", - "format": "date-time" - }, - "updated_at": { - "type": "string", - "format": "date-time" - } - } - } - }, - "total": { - "type": "integer" - }, - "page": { - "type": "integer" - }, - "limit": { - "type": "integer" - }, - "total_pages": { - "type": "integer", - "description": "Total number of pages" - }, - "has_more": { - "type": "boolean", - "description": "Whether more pages are available" - } - } + "$ref": "#/components/schemas/ManagementErrorResponse" } } } @@ -39738,12 +39964,27 @@ } } }, - "post": { - "operationId": "createTeam", - "summary": "Create team", - "description": "Creates a new team. The team ID is derived from the name.", + "put": { + "operationId": "updateUserGovernance", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Update user governance", "tags": [ - "Teams" + "Users" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } ], "requestBody": { "required": true, @@ -39751,95 +39992,37 @@ "application/json": { "schema": { "type": "object", - "required": [ - "name" - ], + "description": "User-scoped governance settings. POST creates settings and PUT partially updates them.", "properties": { - "name": { + "user_id": { "type": "string", - "description": "Team name (must be unique)" - } - } - } - } - } - }, - "security": [ - { - "ManagementBearerAuth": [] - } - ], - "responses": { - "200": { - "description": "Team created successfully", - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "id": { - "type": "string" - }, - "name": { - "type": "string" + "description": "Optional body copy of the path user ID. When present, it must match the path." + }, + "budget": { + "$ref": "#/components/schemas/CreateBudgetRequest" + }, + "budgets": { + "type": "array", + "items": { + "$ref": "#/components/schemas/CreateBudgetRequest" + } + }, + "rate_limit": { + "$ref": "#/components/schemas/CreateRateLimitRequest" + }, + "provider_configs": { + "type": "array", + "description": "Optional Enterprise per-provider governance overrides.", + "items": { + "type": "object", + "additionalProperties": true } } } } } - }, - "400": { - "description": "Bad request", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/BifrostError" - } - } - } - }, - "409": { - "description": "Team with this name already exists", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/ManagementErrorResponse" - } - } - } - }, - "500": { - "description": "Internal server error", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/BifrostError" - } - } - } - } - } - } - }, - "/api/teams/{id}": { - "get": { - "operationId": "getTeam", - "summary": "Get team", - "description": "Returns details of a specific team including member count.", - "tags": [ - "Teams" - ], - "parameters": [ - { - "name": "id", - "in": "path", - "required": true, - "description": "Team ID", - "schema": { - "type": "string" - } } - ], + }, "security": [ { "ManagementBearerAuth": [] @@ -39847,47 +40030,146 @@ ], "responses": { "200": { - "description": "Successful response", + "description": "Governance updated", "content": { "application/json": { "schema": { "type": "object", "properties": { - "id": { - "type": "string", - "description": "Team ID (derived from name)" - }, - "name": { - "type": "string", - "description": "Team name" - }, - "member_count": { - "type": "integer", - "description": "Number of members in the team" - }, - "virtual_key_count": { - "type": "integer", - "description": "Number of virtual keys assigned to the team" - }, - "created_at": { - "type": "string", - "format": "date-time" - }, - "updated_at": { - "type": "string", - "format": "date-time" + "user": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Unique user identifier" + }, + "name": { + "type": "string", + "description": "User's display name" + }, + "email": { + "type": "string", + "format": "email", + "description": "User's email address" + }, + "role_id": { + "type": "integer", + "nullable": true, + "description": "ID of the assigned RBAC role" + }, + "role": { + "type": "object", + "nullable": true, + "description": "RBAC role details", + "properties": { + "id": { + "type": "integer" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string" + }, + "is_system_role": { + "type": "boolean" + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "teams": { + "type": "array", + "description": "Teams the user belongs to.", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Team ID" + }, + "name": { + "type": "string", + "description": "Team name" + }, + "business_unit_id": { + "type": "string", + "nullable": true, + "description": "Business unit ID associated with this team (if any)" + }, + "business_unit_name": { + "type": "string", + "nullable": true, + "description": "Business unit name associated with this team (if any)" + } + } + } + }, + "access_profile": { + "type": "object", + "nullable": true, + "description": "Active or fallback user access profile, if assigned.", + "properties": { + "id": { + "type": "integer" + }, + "user_id": { + "type": "string" + }, + "parent_profile_id": { + "type": "integer", + "nullable": true + }, + "name": { + "type": "string" + }, + "is_active": { + "type": "boolean" + }, + "expires_at": { + "type": "string", + "format": "date-time", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } } } } } } }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, "404": { - "description": "Team not found", + "description": "Resource not found", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/ManagementErrorResponse" + "$ref": "#/components/schemas/BifrostError" } } } @@ -39904,51 +40186,145 @@ } } }, - "put": { - "operationId": "updateTeam", - "summary": "Update team", - "description": "Updates a team. Note that renaming teams is not allowed.\nAccepts customer_id / customer_ids to attach customers to the team via the team <-> customer many-to-many association, the same association exposed by POST /api/teams/{id}/customers. Attachment is additive and does not detach existing customers.", + "delete": { + "operationId": "deleteUserGovernance", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Delete user governance", "tags": [ - "Teams" + "Users" ], "parameters": [ { - "name": "id", + "name": "user_id", "in": "path", "required": true, - "description": "Team ID", "schema": { "type": "string" } } ], - "requestBody": { - "required": true, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "name": { - "type": "string", - "description": "Team name. Renaming is not allowed - sending a value different from the team's current name returns 400." - }, - "customer_id": { - "type": "string", - "description": "Customer to attach to this team. Additive: the customer is attached and any customers already attached are left in place. Re-sending an already-attached customer is a no-op. To detach, use DELETE /api/teams/{id}/customers/{customerId}.\nThis is the team <-> customer many-to-many association that drives governance and DAC customer derivation. It is distinct from the customer_id on PUT /api/governance/teams/{team_id}, which sets the team's budget-hierarchy parent and is not modified by this endpoint." - }, - "customer_ids": { - "type": "array", - "description": "Customers to attach to this team, same semantics as customer_id. May be combined with customer_id; the two sets are merged.", - "items": { - "type": "string" + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Governance deleted", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + }, + "404": { + "description": "Resource not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + } + } + }, + "/api/governance/users/{user_id}/virtual-keys": { + "get": { + "operationId": "listUserVirtualKeys", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List virtual keys available to a user", + "tags": [ + "Users", + "Virtual Keys" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "User virtual keys", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "virtual_keys": { + "type": "array", + "items": { + "type": "object", + "additionalProperties": true + } } } } } } } + } + } + }, + "/api/governance/users/email/{email}/virtual-keys": { + "get": { + "operationId": "getUserVirtualKeysByEmail", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" }, + "summary": "Get user's virtual keys by email", + "description": "**Enterprise only.**\nReturns all virtual keys associated with a user, looked up by email address. Returns an empty `virtual_keys` array when the user exists but has no virtual keys assigned. Intended for MDM and credential-helper integrations that need to resolve a user's keys without knowing their internal ID.\n", + "tags": [ + "Users" + ], + "parameters": [ + { + "name": "email", + "in": "path", + "required": true, + "description": "URL-encoded email address of the user", + "schema": { + "type": "string", + "format": "email" + } + } + ], "security": [ { "ManagementBearerAuth": [] @@ -39956,28 +40332,46 @@ ], "responses": { "200": { - "description": "Team updated successfully", + "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { - "id": { - "type": "string" + "user_id": { + "type": "string", + "description": "Internal ID of the resolved user" }, - "name": { - "type": "string" + "email": { + "type": "string", + "format": "email", + "description": "Email address of the resolved user" }, - "attached_customer_ids": { + "virtual_keys": { "type": "array", - "description": "Customers attached by this request. Omitted when the request carried no customer_id or customer_ids.", + "description": "Virtual keys assigned to this user", "items": { - "type": "string" + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Virtual key ID" + }, + "name": { + "type": "string", + "description": "Virtual key display name" + }, + "value": { + "type": "string", + "description": "Virtual key token value" + }, + "is_active": { + "type": "boolean", + "nullable": true, + "description": "Whether the virtual key is currently active" + } + } } - }, - "warning": { - "type": "string", - "description": "Present only when the attachment was persisted but refreshing the cached team scope failed. The association is durable; the derived customer scope may lag until the next reload." } } } @@ -39985,17 +40379,17 @@ } }, "400": { - "description": "Bad request (e.g. renaming not allowed)", + "description": "Bad request", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/ManagementErrorResponse" + "$ref": "#/components/schemas/BifrostError" } } } }, "404": { - "description": "Team or customer not found", + "description": "User not found", "content": { "application/json": { "schema": { @@ -40015,22 +40409,30 @@ } } } - }, - "delete": { - "operationId": "deleteTeam", - "summary": "Delete team", - "description": "Permanently removes a team.", + } + }, + "/api/governance/users/email/{email}": { + "get": { + "operationId": "getUserByEmail", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get user by email", + "description": "Returns a single Enterprise user resolved by URL-encoded email address.", "tags": [ - "Teams" + "Users" ], "parameters": [ { - "name": "id", + "name": "email", "in": "path", "required": true, - "description": "Team ID", "schema": { - "type": "string" + "type": "string", + "format": "email" } } ], @@ -40041,21 +40443,131 @@ ], "responses": { "200": { - "description": "Team deleted successfully", + "description": "Successful response", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/MessageResponse" + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Unique user identifier" + }, + "name": { + "type": "string", + "description": "User's display name" + }, + "email": { + "type": "string", + "format": "email", + "description": "User's email address" + }, + "role_id": { + "type": "integer", + "nullable": true, + "description": "ID of the assigned RBAC role" + }, + "role": { + "type": "object", + "nullable": true, + "description": "RBAC role details", + "properties": { + "id": { + "type": "integer" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string" + }, + "is_system_role": { + "type": "boolean" + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "teams": { + "type": "array", + "description": "Teams the user belongs to.", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Team ID" + }, + "name": { + "type": "string", + "description": "Team name" + }, + "business_unit_id": { + "type": "string", + "nullable": true, + "description": "Business unit ID associated with this team (if any)" + }, + "business_unit_name": { + "type": "string", + "nullable": true, + "description": "Business unit name associated with this team (if any)" + } + } + } + }, + "access_profile": { + "type": "object", + "nullable": true, + "description": "Active or fallback user access profile, if assigned.", + "properties": { + "id": { + "type": "integer" + }, + "user_id": { + "type": "string" + }, + "parent_profile_id": { + "type": "integer", + "nullable": true + }, + "name": { + "type": "string" + }, + "is_active": { + "type": "boolean" + }, + "expires_at": { + "type": "string", + "format": "date-time", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } } } } }, "404": { - "description": "Team not found", + "description": "Resource not found", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/ManagementErrorResponse" + "$ref": "#/components/schemas/BifrostError" } } } @@ -40073,9 +40585,15 @@ } } }, - "/api/teams/{id}/members": { + "/api/governance/teams/{team_id}/members": { "get": { "operationId": "getTeamMembers", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "List team members", "description": "Returns all members of a team with their user details and membership source.", "tags": [ @@ -40083,7 +40601,7 @@ ], "parameters": [ { - "name": "id", + "name": "team_id", "in": "path", "required": true, "description": "Team ID", @@ -40165,6 +40683,12 @@ }, "post": { "operationId": "addTeamMember", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Add team member", "description": "Adds a user to a team. Both the team and user must exist.", "tags": [ @@ -40172,7 +40696,7 @@ ], "parameters": [ { - "name": "id", + "name": "team_id", "in": "path", "required": true, "description": "Team ID", @@ -40249,9 +40773,15 @@ } } }, - "/api/teams/{id}/members/{userId}": { + "/api/governance/teams/{team_id}/members/{user_id}": { "delete": { "operationId": "removeTeamMember", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Remove team member", "description": "Removes a user from a team.", "tags": [ @@ -40259,7 +40789,7 @@ ], "parameters": [ { - "name": "id", + "name": "team_id", "in": "path", "required": true, "description": "Team ID", @@ -40268,7 +40798,7 @@ } }, { - "name": "userId", + "name": "user_id", "in": "path", "required": true, "description": "User ID to remove", @@ -45841,6 +46371,291 @@ } } }, + "/api/governance/virtual-keys/{vk_id}/users": { + "get": { + "operationId": "listVirtualKeyUsers", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List users attached to a virtual key", + "tags": [ + "Virtual Keys", + "Users" + ], + "parameters": [ + { + "name": "vk_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Attached users", + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "users", + "count" + ], + "properties": { + "users": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Unique user identifier" + }, + "name": { + "type": "string", + "description": "User's display name" + }, + "email": { + "type": "string", + "format": "email", + "description": "User's email address" + }, + "role_id": { + "type": "integer", + "nullable": true, + "description": "ID of the assigned RBAC role" + }, + "role": { + "type": "object", + "nullable": true, + "description": "RBAC role details", + "properties": { + "id": { + "type": "integer" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string" + }, + "is_system_role": { + "type": "boolean" + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "teams": { + "type": "array", + "description": "Teams the user belongs to.", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Team ID" + }, + "name": { + "type": "string", + "description": "Team name" + }, + "business_unit_id": { + "type": "string", + "nullable": true, + "description": "Business unit ID associated with this team (if any)" + }, + "business_unit_name": { + "type": "string", + "nullable": true, + "description": "Business unit name associated with this team (if any)" + } + } + } + }, + "access_profile": { + "type": "object", + "nullable": true, + "description": "Active or fallback user access profile, if assigned.", + "properties": { + "id": { + "type": "integer" + }, + "user_id": { + "type": "string" + }, + "parent_profile_id": { + "type": "integer", + "nullable": true + }, + "name": { + "type": "string" + }, + "is_active": { + "type": "boolean" + }, + "expires_at": { + "type": "string", + "format": "date-time", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + }, + "count": { + "type": "integer" + } + } + } + } + } + } + } + }, + "post": { + "operationId": "attachVirtualKeyUsers", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Attach users to a virtual key", + "tags": [ + "Virtual Keys", + "Users" + ], + "parameters": [ + { + "name": "vk_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "user_ids" + ], + "properties": { + "user_ids": { + "type": "array", + "items": { + "type": "string" + } + }, + "preserve_usage": { + "type": "boolean", + "default": false + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Users attached", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + } + } + } + }, + "/api/governance/virtual-keys/{vk_id}/users/{user_id}": { + "delete": { + "operationId": "detachVirtualKeyUser", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Detach a user from a virtual key", + "tags": [ + "Virtual Keys", + "Users" + ], + "parameters": [ + { + "name": "vk_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "user_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "User detached", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + } + } + } + }, "/api/governance/teams": { "get": { "operationId": "listTeams", @@ -46156,6 +46971,175 @@ } } }, + "/api/governance/teams/{team_id}/customers": { + "get": { + "operationId": "listTeamCustomers", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List customers attached to a team", + "tags": [ + "Teams", + "Customers" + ], + "parameters": [ + { + "name": "team_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Attached customers", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "customers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + } + } + } + } + } + } + } + } + } + } + }, + "post": { + "operationId": "attachTeamCustomer", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Attach a customer to a team", + "tags": [ + "Teams", + "Customers" + ], + "parameters": [ + { + "name": "team_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "customer_id" + ], + "properties": { + "customer_id": { + "type": "string" + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Customer attached", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + } + } + } + }, + "/api/governance/teams/{team_id}/customers/{customer_id}": { + "delete": { + "operationId": "detachTeamCustomer", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Detach a customer from a team", + "tags": [ + "Teams", + "Customers" + ], + "parameters": [ + { + "name": "team_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "customer_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Customer detached", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + } + } + } + }, "/api/governance/customers": { "get": { "operationId": "listCustomers", @@ -46463,40 +47447,25 @@ } } }, - "/api/governance/business-units": { + "/api/governance/customers/{customer_id}/teams": { "get": { - "operationId": "listBusinessUnits", - "summary": "List business units", - "description": "Returns a paginated list of business units, each with its team count.", + "operationId": "listCustomerTeams", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List teams attached to a customer", "tags": [ - "Governance" + "Customers", + "Teams" ], "parameters": [ { - "name": "page", - "in": "query", - "description": "Page number (1-based)", - "schema": { - "type": "integer", - "minimum": 1, - "default": 1 - } - }, - { - "name": "limit", - "in": "query", - "description": "Maximum number of business units to return (max 100)", - "schema": { - "type": "integer", - "minimum": 1, - "maximum": 100, - "default": 20 - } - }, - { - "name": "search", - "in": "query", - "description": "Case-insensitive search by business unit name", + "name": "customer_id", + "in": "path", + "required": true, "schema": { "type": "string" } @@ -46509,97 +47478,58 @@ ], "responses": { "200": { - "description": "Successful response", + "description": "Attached teams", "content": { "application/json": { "schema": { "type": "object", - "description": "Paginated list of business units", - "required": [ - "business_units", - "total", - "page", - "limit" - ], "properties": { - "business_units": { + "teams": { "type": "array", "items": { "type": "object", - "description": "Business unit summary as returned in list responses", "properties": { "id": { "type": "string" }, "name": { "type": "string" - }, - "team_count": { - "type": "integer" - }, - "created_at": { - "type": "string", - "format": "date-time" - }, - "updated_at": { - "type": "string", - "format": "date-time" } } } - }, - "total": { - "type": "integer" - }, - "page": { - "type": "integer" - }, - "limit": { - "type": "integer" } } } } } - }, - "500": { - "description": "Internal server error", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/BifrostError" - } - } - } } } - }, - "post": { - "operationId": "createBusinessUnit", - "summary": "Create business unit", - "description": "Creates a new business unit. Names must be unique.", + } + }, + "/api/governance/customers/{customer_id}/business-units": { + "get": { + "operationId": "listCustomerBusinessUnits", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List business units attached to a customer", "tags": [ - "Governance" + "Customers", + "Business Units" ], - "requestBody": { - "required": true, - "content": { - "application/json": { - "schema": { - "type": "object", - "description": "Create business unit request", - "required": [ - "name" - ], - "properties": { - "name": { - "type": "string" - } - } - } + "parameters": [ + { + "name": "customer_id", + "in": "path", + "required": true, + "schema": { + "type": "string" } } - }, + ], "security": [ { "ManagementBearerAuth": [] @@ -46607,7 +47537,198 @@ ], "responses": { "200": { - "description": "Business unit created successfully", + "description": "Attached business units", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "business_units": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + } + } + } + } + } + } + } + } + } + } + } + }, + "/api/governance/business-units": { + "get": { + "operationId": "listBusinessUnits", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List business units", + "description": "Returns a paginated list of business units, each with its team count.", + "tags": [ + "Governance" + ], + "parameters": [ + { + "name": "offset", + "in": "query", + "description": "Zero-based result offset", + "schema": { + "type": "integer", + "minimum": 0, + "default": 0 + } + }, + { + "name": "limit", + "in": "query", + "description": "Maximum number of business units to return (max 100)", + "schema": { + "type": "integer", + "minimum": 1, + "maximum": 100, + "default": 20 + } + }, + { + "name": "search", + "in": "query", + "description": "Case-insensitive search by business unit name", + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Paginated list of business units", + "required": [ + "business_units", + "count", + "total_count", + "limit", + "offset" + ], + "properties": { + "business_units": { + "type": "array", + "items": { + "type": "object", + "description": "Business unit summary as returned in list responses", + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "team_count": { + "type": "integer" + }, + "customer_count": { + "type": "integer" + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + }, + "count": { + "type": "integer" + }, + "total_count": { + "type": "integer" + }, + "limit": { + "type": "integer" + }, + "offset": { + "type": "integer" + } + } + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + } + }, + "post": { + "operationId": "createBusinessUnit", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Create business unit", + "description": "Creates a new business unit. Names must be unique.", + "tags": [ + "Governance" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Create business unit request", + "required": [ + "name" + ], + "properties": { + "name": { + "type": "string" + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Business unit created successfully", "content": { "application/json": { "schema": { @@ -46658,9 +47779,15 @@ } } }, - "/api/governance/business-units/{id}": { + "/api/governance/business-units/{business_unit_id}": { "get": { "operationId": "getBusinessUnit", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Get business unit", "description": "Returns a specific business unit by ID, including governance and team count.", "tags": [ @@ -46668,7 +47795,7 @@ ], "parameters": [ { - "name": "id", + "name": "business_unit_id", "in": "path", "required": true, "description": "Business unit ID", @@ -46741,8 +47868,124 @@ } } }, + "put": { + "operationId": "updateBusinessUnit", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Update business unit", + "description": "Updates the business unit name.", + "tags": [ + "Governance" + ], + "parameters": [ + { + "name": "business_unit_id", + "in": "path", + "required": true, + "description": "Business unit ID", + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Create business unit request", + "required": [ + "name" + ], + "properties": { + "name": { + "type": "string" + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Business unit updated successfully", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Response for business unit create/update operations", + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + } + } + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "Resource not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "409": { + "description": "A business unit with this name already exists", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + } + }, "delete": { "operationId": "deleteBusinessUnit", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Delete business unit", "description": "Deletes a business unit. Any teams assigned to it are atomically unassigned\nas part of the deletion.\n", "tags": [ @@ -46750,7 +47993,7 @@ ], "parameters": [ { - "name": "id", + "name": "business_unit_id", "in": "path", "required": true, "description": "Business unit ID", @@ -46798,9 +48041,15 @@ } } }, - "/api/governance/business-units/{id}/teams": { + "/api/governance/business-units/{business_unit_id}/teams": { "get": { "operationId": "listBusinessUnitTeams", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "List business unit teams", "description": "Returns a paginated list of teams assigned to the business unit.", "tags": [ @@ -46808,7 +48057,7 @@ ], "parameters": [ { - "name": "id", + "name": "business_unit_id", "in": "path", "required": true, "description": "Business unit ID", @@ -46817,13 +48066,13 @@ } }, { - "name": "page", + "name": "offset", "in": "query", - "description": "Page number (1-based)", + "description": "Zero-based result offset", "schema": { "type": "integer", - "minimum": 1, - "default": 1 + "minimum": 0, + "default": 0 } }, { @@ -46861,9 +48110,10 @@ "description": "Paginated list of teams assigned to a business unit", "required": [ "teams", - "total", - "page", - "limit" + "count", + "total_count", + "limit", + "offset" ], "properties": { "teams": { @@ -46880,14 +48130,17 @@ } } }, - "total": { + "count": { "type": "integer" }, - "page": { + "total_count": { "type": "integer" }, "limit": { "type": "integer" + }, + "offset": { + "type": "integer" } } } @@ -46918,6 +48171,12 @@ }, "post": { "operationId": "assignTeamToBusinessUnit", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Assign team to business unit", "description": "Assigns an existing team to the business unit. Returns 409 if the team is\nalready assigned to a different business unit.\n", "tags": [ @@ -46925,7 +48184,7 @@ ], "parameters": [ { - "name": "id", + "name": "business_unit_id", "in": "path", "required": true, "description": "Business unit ID", @@ -47012,9 +48271,15 @@ } } }, - "/api/governance/business-units/{id}/teams/{team_id}": { + "/api/governance/business-units/{business_unit_id}/teams/{team_id}": { "delete": { "operationId": "removeTeamFromBusinessUnit", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Remove team from business unit", "description": "Unassigns a team from the business unit.", "tags": [ @@ -47022,7 +48287,7 @@ ], "parameters": [ { - "name": "id", + "name": "business_unit_id", "in": "path", "required": true, "description": "Business unit ID", @@ -47089,9 +48354,15 @@ } } }, - "/api/governance/business-units/{id}/governance": { + "/api/governance/business-units/{business_unit_id}/governance": { "post": { "operationId": "createBusinessUnitGovernance", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Create business unit governance", "description": "Configures budget and/or rate limit governance for a business unit. At least\none of `budget` or `rate_limit` is required. Returns 409 if the business unit\nalready has governance configured (use PUT to update).\n", "tags": [ @@ -47099,7 +48370,7 @@ ], "parameters": [ { - "name": "id", + "name": "business_unit_id", "in": "path", "required": true, "description": "Business unit ID", @@ -47262,6 +48533,12 @@ }, "put": { "operationId": "updateBusinessUnitGovernance", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Update business unit governance", "description": "Updates budget and/or rate limit governance for a business unit. Passing an\nempty `budget` or `rate_limit` object removes that governance component.\n", "tags": [ @@ -47269,7 +48546,7 @@ ], "parameters": [ { - "name": "id", + "name": "business_unit_id", "in": "path", "required": true, "description": "Business unit ID", @@ -47410,6 +48687,12 @@ }, "delete": { "operationId": "deleteBusinessUnitGovernance", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Delete business unit governance", "description": "Removes all budget and rate limit governance from a business unit.", "tags": [ @@ -47417,7 +48700,7 @@ ], "parameters": [ { - "name": "id", + "name": "business_unit_id", "in": "path", "required": true, "description": "Business unit ID", @@ -47465,6 +48748,208 @@ } } }, + "/api/governance/business-units/{business_unit_id}/customers": { + "get": { + "operationId": "listBusinessUnitCustomers", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List customers attached to a business unit", + "tags": [ + "Business Units", + "Customers" + ], + "parameters": [ + { + "name": "business_unit_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "limit", + "in": "query", + "schema": { + "type": "integer", + "minimum": 1, + "maximum": 100 + } + }, + { + "name": "offset", + "in": "query", + "schema": { + "type": "integer", + "minimum": 0, + "default": 0 + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Attached customers", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "customers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + } + } + } + }, + "count": { + "type": "integer" + }, + "total_count": { + "type": "integer" + }, + "limit": { + "type": "integer" + }, + "offset": { + "type": "integer" + } + } + } + } + } + } + } + }, + "post": { + "operationId": "attachBusinessUnitCustomer", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Attach customers to a business unit", + "tags": [ + "Business Units", + "Customers" + ], + "parameters": [ + { + "name": "business_unit_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "customer_id": { + "type": "string" + }, + "customer_ids": { + "type": "array", + "items": { + "type": "string" + } + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Customers attached", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + } + } + } + }, + "/api/governance/business-units/{business_unit_id}/customers/{customer_id}": { + "delete": { + "operationId": "detachBusinessUnitCustomer", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Detach a customer from a business unit", + "tags": [ + "Business Units", + "Customers" + ], + "parameters": [ + { + "name": "business_unit_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "customer_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Customer detached", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + } + } + } + }, "/api/governance/budgets": { "get": { "operationId": "listBudgets", @@ -48666,9 +50151,15 @@ } } }, - "/api/roles": { + "/api/governance/rbac/roles": { "get": { "operationId": "listRoles", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "List roles", "description": "Returns all roles visible to the caller, scoped by data access control.", "tags": [ @@ -48751,6 +50242,12 @@ }, "post": { "operationId": "createRole", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Create role", "description": "Creates a custom role with the specified data access control scope.\nIf `dac` is omitted, defaults to `all-data`.\n", "tags": [ @@ -48871,16 +50368,22 @@ } } }, - "/api/roles/{id}": { + "/api/governance/rbac/roles/{role_id}": { "get": { "operationId": "getRole", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Get role by ID", "tags": [ "RBAC" ], "parameters": [ { - "name": "id", + "name": "role_id", "in": "path", "required": true, "schema": { @@ -48965,6 +50468,12 @@ }, "put": { "operationId": "updateRole", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Update role", "description": "Partial update. Omitted fields preserve the current value.\nNotable: omitting `dac` preserves the current scope (does not default to `all-data`).\n", "tags": [ @@ -48972,7 +50481,7 @@ ], "parameters": [ { - "name": "id", + "name": "role_id", "in": "path", "required": true, "schema": { @@ -49098,6 +50607,12 @@ }, "delete": { "operationId": "deleteRole", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Delete role", "description": "Deletes a custom role. Built-in system roles cannot be deleted and return 403.\n", "tags": [ @@ -49105,7 +50620,7 @@ ], "parameters": [ { - "name": "id", + "name": "role_id", "in": "path", "required": true, "schema": { @@ -49166,16 +50681,22 @@ } } }, - "/api/roles/{id}/permissions": { + "/api/governance/rbac/roles/{role_id}/permissions": { "get": { "operationId": "getRolePermissions", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "List permissions assigned to a role", "tags": [ "RBAC" ], "parameters": [ { - "name": "id", + "name": "role_id", "in": "path", "required": true, "schema": { @@ -49236,6 +50757,12 @@ }, "put": { "operationId": "updateRolePermissions", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Replace the permission set on a role", "description": "Replaces the permission set assigned to the role.\nSend the complete list of permission IDs that should be active for the role.\n", "tags": [ @@ -49243,7 +50770,7 @@ ], "parameters": [ { - "name": "id", + "name": "role_id", "in": "path", "required": true, "schema": { @@ -49320,9 +50847,15 @@ } } }, - "/api/resources": { + "/api/governance/rbac/resources": { "get": { "operationId": "listResources", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "List RBAC resources", "description": "Returns the set of resource names that permissions can target.", "tags": [ @@ -49374,9 +50907,15 @@ } } }, - "/api/operations": { + "/api/governance/rbac/operations": { "get": { "operationId": "listOperations", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "List RBAC operations", "description": "Returns the set of operation names that permissions can grant.", "tags": [ @@ -49428,9 +50967,15 @@ } } }, - "/api/permissions": { + "/api/governance/rbac/permissions": { "get": { "operationId": "listPermissions", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "List all RBAC permissions", "description": "Returns every (resource, operation) pair that can be granted to a role.", "tags": [ @@ -49485,9 +51030,15 @@ } } }, - "/api/access-profiles": { + "/api/governance/access-profiles": { "get": { "operationId": "listAccessProfiles", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "List access profiles", "description": "Returns access profiles visible to the caller.", "tags": [ @@ -49913,6 +51464,12 @@ }, "post": { "operationId": "createAccessProfile", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Create access profile", "description": "Creates a new access profile template. The profile is inactive until attached to a role.\nNo size limits are enforced on create; the limits apply on update.\n", "tags": [ @@ -50624,9 +52181,15 @@ } } }, - "/api/access-profiles/{id}": { + "/api/governance/access-profiles/{profile_id}": { "get": { "operationId": "getAccessProfile", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Get access profile by ID", "description": "Returns the profile plus its role attachments and the count of users holding a copy.", "tags": [ @@ -50634,7 +52197,7 @@ ], "parameters": [ { - "name": "id", + "name": "profile_id", "in": "path", "required": true, "schema": { @@ -51042,6 +52605,12 @@ }, "put": { "operationId": "updateAccessProfile", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Update access profile", "description": "Partial update. Omitted fields preserve the current value.\n`rate_limit: null` explicitly clears the existing rate limit.\nSize limits enforced: max 100 provider_configs, max 100 budgets, max 50 tags.\n", "tags": [ @@ -51049,7 +52618,7 @@ ], "parameters": [ { - "name": "id", + "name": "profile_id", "in": "path", "required": true, "schema": { @@ -51773,6 +53342,12 @@ }, "delete": { "operationId": "deleteAccessProfile", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Delete access profile", "description": "Blocked with 409 if any users still hold copies. Detach role attachments or remove user assignments first.", "tags": [ @@ -51780,7 +53355,7 @@ ], "parameters": [ { - "name": "id", + "name": "profile_id", "in": "path", "required": true, "schema": { @@ -51828,9 +53403,15 @@ } } }, - "/api/access-profiles/{id}/activate": { + "/api/governance/access-profiles/{profile_id}/activate": { "put": { "operationId": "activateAccessProfile", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Activate access profile", "description": "Sets the profile active. Idempotent.", "tags": [ @@ -51838,7 +53419,7 @@ ], "parameters": [ { - "name": "id", + "name": "profile_id", "in": "path", "required": true, "schema": { @@ -52215,9 +53796,15 @@ } } }, - "/api/access-profiles/{id}/deactivate": { + "/api/governance/access-profiles/{profile_id}/deactivate": { "put": { "operationId": "deactivateAccessProfile", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Deactivate access profile", "description": "Sets the profile inactive. Idempotent. User copies are preserved; the profile is hidden from selection menus.", "tags": [ @@ -52225,7 +53812,7 @@ ], "parameters": [ { - "name": "id", + "name": "profile_id", "in": "path", "required": true, "schema": { @@ -52602,9 +54189,15 @@ } } }, - "/api/access-profiles/{id}/clone": { + "/api/governance/access-profiles/{profile_id}/clone": { "post": { "operationId": "cloneAccessProfile", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Clone an access profile", "description": "Creates a fresh copy of the profile under a new name. The clone has no role attachments or user copies.", "tags": [ @@ -52612,7 +54205,7 @@ ], "parameters": [ { - "name": "id", + "name": "profile_id", "in": "path", "required": true, "schema": { @@ -53023,9 +54616,15 @@ } } }, - "/api/access-profiles/{id}/propagate": { + "/api/governance/access-profiles/{profile_id}/propagate": { "post": { "operationId": "propagateAccessProfile", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Propagate template changes to user copies", "description": "Pushes selected fields from the template to every user that holds a copy.\nUse `dry_run: true` to preview the impact. By default, accumulated usage is preserved.\n", "tags": [ @@ -53033,7 +54632,7 @@ ], "parameters": [ { - "name": "id", + "name": "profile_id", "in": "path", "required": true, "schema": { @@ -53167,9 +54766,15 @@ } } }, - "/api/access-profiles/{id}/roles": { + "/api/governance/access-profiles/{profile_id}/roles": { "post": { "operationId": "attachRolesToAccessProfile", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Attach roles to access profile", "description": "Attaches one or more roles. Setting `is_default: true` makes the profile the role's default\nfor new users. `apply_to_existing: true` provisions the profile to users already in the role.\n", "tags": [ @@ -53177,7 +54782,7 @@ ], "parameters": [ { - "name": "id", + "name": "profile_id", "in": "path", "required": true, "schema": { @@ -53264,16 +54869,22 @@ } } }, - "/api/access-profiles/{id}/roles/{role_id}": { + "/api/governance/access-profiles/{profile_id}/roles/{role_id}": { "delete": { "operationId": "detachRoleFromAccessProfile", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Detach role from access profile", "tags": [ "Access Profiles" ], "parameters": [ { - "name": "id", + "name": "profile_id", "in": "path", "required": true, "schema": { @@ -53326,16 +54937,22 @@ } } }, - "/api/access-profiles/{id}/versions": { + "/api/governance/access-profiles/{profile_id}/versions": { "get": { "operationId": "listAccessProfileVersions", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "List version snapshots for an access profile", "tags": [ "Access Profiles" ], "parameters": [ { - "name": "id", + "name": "profile_id", "in": "path", "required": true, "schema": { @@ -53409,16 +55026,22 @@ } } }, - "/api/access-profiles/{id}/versions/{version}": { + "/api/governance/access-profiles/{profile_id}/versions/{version}": { "get": { "operationId": "getAccessProfileVersion", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Get a single version snapshot", "tags": [ "Access Profiles" ], "parameters": [ { - "name": "id", + "name": "profile_id", "in": "path", "required": true, "schema": { @@ -53500,16 +55123,22 @@ } } }, - "/api/access-profiles/{id}/audit-logs": { + "/api/governance/access-profiles/{profile_id}/audit-logs": { "get": { "operationId": "listAccessProfileAuditLogsById", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "List audit log entries for a single profile", "tags": [ "Access Profiles" ], "parameters": [ { - "name": "id", + "name": "profile_id", "in": "path", "required": true, "schema": { @@ -53621,9 +55250,15 @@ } } }, - "/api/access-profiles/audit-logs": { + "/api/governance/access-profiles/audit-logs": { "get": { "operationId": "listAccessProfileAuditLogs", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "List workspace-wide audit log entries", "tags": [ "Access Profiles" @@ -53720,33 +55355,8982 @@ } } }, - "500": { - "description": "Internal server error", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/BifrostError" - } - } + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + } + } + }, + "/api/governance/users/{user_id}/access-profiles": { + "get": { + "operationId": "listUserAccessProfiles", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List access profiles held by a user", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "access_profiles": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "integer" + }, + "user_id": { + "type": "string" + }, + "parent_profile_id": { + "type": "integer", + "nullable": true + }, + "name": { + "type": "string" + }, + "is_active": { + "type": "boolean" + }, + "expires_at": { + "type": "string", + "format": "date-time", + "nullable": true + }, + "virtual_key_ids": { + "type": "array", + "items": { + "type": "string" + } + }, + "virtual_key_values": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "description": "Map of virtual key ID to masked secret value." + } + } + } + } + } + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + } + } + }, + "/api/governance/users/{user_id}/access-profiles/{profile_id}": { + "delete": { + "operationId": "detachUserAccessProfile", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Detach a user's access profile", + "description": "Removes the profile from the user and deletes every virtual key it produced. Fails closed if a virtual key cannot be deleted.", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Profile detached.", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "deleted_vk_names": { + "type": "array", + "items": { + "type": "string" + } + }, + "deleted_vk_count": { + "type": "integer" + } + } + } + } + } + }, + "404": { + "description": "User access profile not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + } + } + }, + "/api/governance/users/{user_id}/access-profiles/{profile_id}/budgets/{budget_id}/override": { + "put": { + "operationId": "updateUserAccessProfileBudgetOverride", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Set a user's access-profile budget override", + "description": "Sets or replaces the spending override on one budget of a single user's copy of an access profile.\nThe override is additive — while it is active the budget is enforced against\n`max_limit + override_amount` — and it leaves the budget's base limit, current usage, and reset\nschedule untouched. Only this user is affected; the access profile template and every other user\nassigned to it keep their original limits.\n\nUse `mode: cycles` with a `cycles` count to grant extra spend for a finite number of reset windows\n(the current window counts as the first), or `mode: forever` to keep the override until it is deleted.\nA finite grant is anchored to the profile's reset window — calendar-aligned profiles anchor at the\ncalendar period start — so every node in a cluster derives the same number of remaining cycles.\nThe change is propagated cluster-wide and survives access-profile cloning and propagation.\n\nRequires the `AccessProfiles.Update` permission. `budget_id` must be a budget on the user's own copy\nof the profile, not on the shared template.\n", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "description": "ID of the user whose access-profile budget is being overridden", + "schema": { + "type": "string" + } + }, + { + "name": "profile_id", + "in": "path", + "required": true, + "description": "ID of the access profile assigned to the user", + "schema": { + "type": "integer" + } + }, + { + "name": "budget_id", + "in": "path", + "required": true, + "description": "ID of a budget on the user's copy of the access profile", + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BudgetOverrideRequest" + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Budget override applied successfully", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BudgetOverrideResponse" + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "User access profile or budget not found, or the profile is outside the caller's access scope" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + } + }, + "delete": { + "operationId": "deleteUserAccessProfileBudgetOverride", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Remove a user's access-profile budget override", + "description": "Removes any active override from the user's budget, so it is enforced against its base `max_limit`\nagain. The budget's current usage and reset schedule are unchanged, and the removal is permanent — a\ncleared grant cannot be re-derived. Safe to call on a budget that has no override.\n\nRequires the `AccessProfiles.Update` permission.\n", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "description": "ID of the user whose access-profile budget override is being removed", + "schema": { + "type": "string" + } + }, + { + "name": "profile_id", + "in": "path", + "required": true, + "description": "ID of the access profile assigned to the user", + "schema": { + "type": "integer" + } + }, + { + "name": "budget_id", + "in": "path", + "required": true, + "description": "ID of a budget on the user's copy of the access profile", + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Budget override removed successfully", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BudgetOverrideResponse" + } + } + } + }, + "404": { + "description": "User access profile or budget not found, or the profile is outside the caller's access scope" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + } + } + }, + "/api/governance/users/{user_id}/access-profiles/{profile_id}/virtual-keys": { + "post": { + "operationId": "addUserAccessProfileVirtualKey", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Add an extra virtual key under a user's access profile", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "description": { + "type": "string" + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Virtual key created.", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "virtual_key": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "value": { + "type": "string", + "description": "The generated virtual key secret. Shown only once on creation." + } + } + } + } + } + } + } + }, + "404": { + "description": "User access profile not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + } + } + }, + "/api/governance/users/{user_id}/access-profiles/virtual-keys/{vk_id}": { + "delete": { + "operationId": "deleteUserAccessProfileVirtualKey", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Delete a virtual key from a user's access profile", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "vk_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Virtual key deleted.", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "message": { + "type": "string" + } + } + } + } + } + }, + "404": { + "description": "Virtual key not found for this user" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + } + } + }, + "/api/virtual-keys/{vk_id}/users": { + "get": { + "operationId": "listVirtualKeyUsersLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/virtual-keys/{vk_id}/users` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List users attached to a virtual key (deprecated path)", + "tags": [ + "Virtual Keys", + "Users" + ], + "parameters": [ + { + "name": "vk_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Attached users", + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "users", + "count" + ], + "properties": { + "users": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Unique user identifier" + }, + "name": { + "type": "string", + "description": "User's display name" + }, + "email": { + "type": "string", + "format": "email", + "description": "User's email address" + }, + "role_id": { + "type": "integer", + "nullable": true, + "description": "ID of the assigned RBAC role" + }, + "role": { + "type": "object", + "nullable": true, + "description": "RBAC role details", + "properties": { + "id": { + "type": "integer" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string" + }, + "is_system_role": { + "type": "boolean" + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "teams": { + "type": "array", + "description": "Teams the user belongs to.", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Team ID" + }, + "name": { + "type": "string", + "description": "Team name" + }, + "business_unit_id": { + "type": "string", + "nullable": true, + "description": "Business unit ID associated with this team (if any)" + }, + "business_unit_name": { + "type": "string", + "nullable": true, + "description": "Business unit name associated with this team (if any)" + } + } + } + }, + "access_profile": { + "type": "object", + "nullable": true, + "description": "Active or fallback user access profile, if assigned.", + "properties": { + "id": { + "type": "integer" + }, + "user_id": { + "type": "string" + }, + "parent_profile_id": { + "type": "integer", + "nullable": true + }, + "name": { + "type": "string" + }, + "is_active": { + "type": "boolean" + }, + "expires_at": { + "type": "string", + "format": "date-time", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + }, + "count": { + "type": "integer" + } + } + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/virtual-keys/{vk_id}/users", + "x-bifrost-removal": "following-major-release", + "deprecated": true + }, + "post": { + "operationId": "attachVirtualKeyUsersLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/virtual-keys/{vk_id}/users` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Attach users to a virtual key (deprecated path)", + "tags": [ + "Virtual Keys", + "Users" + ], + "parameters": [ + { + "name": "vk_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "user_ids" + ], + "properties": { + "user_ids": { + "type": "array", + "items": { + "type": "string" + } + }, + "preserve_usage": { + "type": "boolean", + "default": false + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Users attached", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/virtual-keys/{vk_id}/users", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/virtual-keys/{vk_id}/users/{user_id}": { + "delete": { + "operationId": "detachVirtualKeyUserLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/virtual-keys/{vk_id}/users/{user_id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Detach a user from a virtual key (deprecated path)", + "tags": [ + "Virtual Keys", + "Users" + ], + "parameters": [ + { + "name": "vk_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "user_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "User detached", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/virtual-keys/{vk_id}/users/{user_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/teams/{team_id}/customers": { + "get": { + "operationId": "listTeamCustomersLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/teams/{team_id}/customers` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List customers attached to a team (deprecated path)", + "tags": [ + "Teams", + "Customers" + ], + "parameters": [ + { + "name": "team_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Attached customers", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "customers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + } + } + } + } + } + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/teams/{team_id}/customers", + "x-bifrost-removal": "following-major-release", + "deprecated": true + }, + "post": { + "operationId": "attachTeamCustomerLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/teams/{team_id}/customers` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Attach a customer to a team (deprecated path)", + "tags": [ + "Teams", + "Customers" + ], + "parameters": [ + { + "name": "team_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "customer_id" + ], + "properties": { + "customer_id": { + "type": "string" + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Customer attached", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/teams/{team_id}/customers", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/teams/{team_id}/customers/{customer_id}": { + "delete": { + "operationId": "detachTeamCustomerLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/teams/{team_id}/customers/{customer_id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Detach a customer from a team (deprecated path)", + "tags": [ + "Teams", + "Customers" + ], + "parameters": [ + { + "name": "team_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "customer_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Customer detached", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/teams/{team_id}/customers/{customer_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/customers/{customer_id}/teams": { + "get": { + "operationId": "listCustomerTeamsLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/customers/{customer_id}/teams` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List teams attached to a customer (deprecated path)", + "tags": [ + "Customers", + "Teams" + ], + "parameters": [ + { + "name": "customer_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Attached teams", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "teams": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + } + } + } + } + } + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/customers/{customer_id}/teams", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/roles": { + "get": { + "operationId": "listRolesLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/rbac/roles` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List roles (deprecated path)", + "description": "Returns all roles visible to the caller, scoped by data access control.", + "tags": [ + "RBAC" + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "roles": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "name": { + "type": "string", + "description": "Lowercase letters, digits, `_`, `.`. Must start with a letter. Unique.", + "maxLength": 255 + }, + "description": { + "type": "string" + }, + "is_system_role": { + "type": "boolean", + "description": "True for built-in roles. System roles cannot be deleted." + }, + "dac": { + "type": "string", + "enum": [ + "own-data", + "team-data", + "all-data" + ], + "description": "Data access scope. Determines which rows members of the role can see.\n- `own-data` - Only rows the member personally owns.\n- `team-data` - Own rows plus rows owned by any team they belong to.\n- `all-data` - No row filtering.\n" + }, + "created_by_user_id": { + "type": "string", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/rbac/roles", + "x-bifrost-removal": "following-major-release", + "deprecated": true + }, + "post": { + "operationId": "createRoleLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/rbac/roles` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Create role (deprecated path)", + "description": "Creates a custom role with the specified data access control scope.\nIf `dac` is omitted, defaults to `all-data`.\n", + "tags": [ + "RBAC" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "name" + ], + "properties": { + "name": { + "type": "string", + "description": "Must match `^[a-z][a-z0-9_.]*$`. Max 255 characters. Unique.\n", + "maxLength": 255 + }, + "description": { + "type": "string" + }, + "dac": { + "type": "string", + "enum": [ + "own-data", + "team-data", + "all-data" + ], + "description": "Defaults to `all-data` when omitted." + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Role created", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "role": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "name": { + "type": "string", + "description": "Lowercase letters, digits, `_`, `.`. Must start with a letter. Unique.", + "maxLength": 255 + }, + "description": { + "type": "string" + }, + "is_system_role": { + "type": "boolean", + "description": "True for built-in roles. System roles cannot be deleted." + }, + "dac": { + "type": "string", + "enum": [ + "own-data", + "team-data", + "all-data" + ], + "description": "Data access scope. Determines which rows members of the role can see.\n- `own-data` - Only rows the member personally owns.\n- `team-data` - Own rows plus rows owned by any team they belong to.\n- `all-data` - No row filtering.\n" + }, + "created_by_user_id": { + "type": "string", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/rbac/roles", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/roles/{role_id}": { + "get": { + "operationId": "getRoleLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/rbac/roles/{role_id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get role by ID (deprecated path)", + "tags": [ + "RBAC" + ], + "parameters": [ + { + "name": "role_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "role": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "name": { + "type": "string", + "description": "Lowercase letters, digits, `_`, `.`. Must start with a letter. Unique.", + "maxLength": 255 + }, + "description": { + "type": "string" + }, + "is_system_role": { + "type": "boolean", + "description": "True for built-in roles. System roles cannot be deleted." + }, + "dac": { + "type": "string", + "enum": [ + "own-data", + "team-data", + "all-data" + ], + "description": "Data access scope. Determines which rows members of the role can see.\n- `own-data` - Only rows the member personally owns.\n- `team-data` - Own rows plus rows owned by any team they belong to.\n- `all-data` - No row filtering.\n" + }, + "created_by_user_id": { + "type": "string", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + } + } + }, + "404": { + "description": "Role not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/rbac/roles/{role_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + }, + "put": { + "operationId": "updateRoleLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/rbac/roles/{role_id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Update role (deprecated path)", + "description": "Partial update. Omitted fields preserve the current value.\nNotable: omitting `dac` preserves the current scope (does not default to `all-data`).\n", + "tags": [ + "RBAC" + ], + "parameters": [ + { + "name": "role_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Partial update. Omitted fields preserve the current value.\n- `description` is a nullable string: omitting it preserves the existing description; sending an empty string clears it.\n- `dac` defaults to the existing value when omitted, preventing accidental scope escalation.\n", + "properties": { + "name": { + "type": "string", + "description": "If supplied (and different from current), must match the role-name regex.", + "maxLength": 255 + }, + "description": { + "type": "string", + "nullable": true + }, + "dac": { + "type": "string", + "enum": [ + "own-data", + "team-data", + "all-data" + ], + "description": "Data access scope. Determines which rows members of the role can see.\n- `own-data` - Only rows the member personally owns.\n- `team-data` - Own rows plus rows owned by any team they belong to.\n- `all-data` - No row filtering.\n" + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Role updated", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "role": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "name": { + "type": "string", + "description": "Lowercase letters, digits, `_`, `.`. Must start with a letter. Unique.", + "maxLength": 255 + }, + "description": { + "type": "string" + }, + "is_system_role": { + "type": "boolean", + "description": "True for built-in roles. System roles cannot be deleted." + }, + "dac": { + "type": "string", + "enum": [ + "own-data", + "team-data", + "all-data" + ], + "description": "Data access scope. Determines which rows members of the role can see.\n- `own-data` - Only rows the member personally owns.\n- `team-data` - Own rows plus rows owned by any team they belong to.\n- `all-data` - No row filtering.\n" + }, + "created_by_user_id": { + "type": "string", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "Role not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/rbac/roles/{role_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + }, + "delete": { + "operationId": "deleteRoleLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/rbac/roles/{role_id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Delete role (deprecated path)", + "description": "Deletes a custom role. Built-in system roles cannot be deleted and return 403.\n", + "tags": [ + "RBAC" + ], + "parameters": [ + { + "name": "role_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Role deleted", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "message": { + "type": "string" + } + } + } + } + } + }, + "403": { + "description": "Cannot delete system role", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "error": { + "type": "string", + "example": "cannot delete system role" + } + } + } + } + } + }, + "404": { + "description": "Role not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/rbac/roles/{role_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/roles/{role_id}/permissions": { + "get": { + "operationId": "getRolePermissionsLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/rbac/roles/{role_id}/permissions` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List permissions assigned to a role (deprecated path)", + "tags": [ + "RBAC" + ], + "parameters": [ + { + "name": "role_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "permissions": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "resource": { + "type": "string" + }, + "operation": { + "type": "string" + } + } + } + } + } + } + } + } + }, + "404": { + "description": "Role not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/rbac/roles/{role_id}/permissions", + "x-bifrost-removal": "following-major-release", + "deprecated": true + }, + "put": { + "operationId": "updateRolePermissionsLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/rbac/roles/{role_id}/permissions` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Replace the permission set on a role (deprecated path)", + "description": "Replaces the permission set assigned to the role.\nSend the complete list of permission IDs that should be active for the role.\n", + "tags": [ + "RBAC" + ], + "parameters": [ + { + "name": "role_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "permission_ids" + ], + "properties": { + "permission_ids": { + "type": "array", + "items": { + "type": "integer", + "format": "uint" + } + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Permissions updated", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "message": { + "type": "string" + } + } + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "Role not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/rbac/roles/{role_id}/permissions", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/resources": { + "get": { + "operationId": "listResourcesLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/rbac/resources` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List RBAC resources (deprecated path)", + "description": "Returns the set of resource names that permissions can target.", + "tags": [ + "RBAC" + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "resources": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "name": { + "type": "string" + } + } + } + } + } + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/rbac/resources", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/operations": { + "get": { + "operationId": "listOperationsLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/rbac/operations` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List RBAC operations (deprecated path)", + "description": "Returns the set of operation names that permissions can grant.", + "tags": [ + "RBAC" + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "operations": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "name": { + "type": "string" + } + } + } + } + } + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/rbac/operations", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/permissions": { + "get": { + "operationId": "listPermissionsLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/rbac/permissions` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List all RBAC permissions (deprecated path)", + "description": "Returns every (resource, operation) pair that can be granted to a role.", + "tags": [ + "RBAC" + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "permissions": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "resource": { + "type": "string" + }, + "operation": { + "type": "string" + } + } + } + } + } + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/rbac/permissions", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/users": { + "get": { + "operationId": "listUsersLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List users (deprecated path)", + "description": "Returns a paginated list of users with optional search.", + "tags": [ + "Users" + ], + "parameters": [ + { + "name": "page", + "in": "query", + "description": "Legacy 1-based page number", + "schema": { + "type": "integer", + "minimum": 1, + "default": 1 + } + }, + { + "name": "limit", + "in": "query", + "description": "Number of users per page (max 100)", + "schema": { + "type": "integer", + "minimum": 1, + "maximum": 100, + "default": 20 + } + }, + { + "name": "search", + "in": "query", + "description": "Search by name or email", + "schema": { + "type": "string" + } + }, + { + "name": "team_id", + "in": "query", + "description": "Filter by team ID", + "schema": { + "type": "string" + } + }, + { + "name": "business_unit_id", + "in": "query", + "description": "Filter by business unit ID", + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Legacy paginated response", + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "users", + "total", + "page", + "limit", + "total_pages", + "has_more" + ], + "properties": { + "users": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Unique user identifier" + }, + "name": { + "type": "string", + "description": "User's display name" + }, + "email": { + "type": "string", + "format": "email", + "description": "User's email address" + }, + "role_id": { + "type": "integer", + "nullable": true, + "description": "ID of the assigned RBAC role" + }, + "role": { + "type": "object", + "nullable": true, + "description": "RBAC role details", + "properties": { + "id": { + "type": "integer" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string" + }, + "is_system_role": { + "type": "boolean" + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "teams": { + "type": "array", + "description": "Teams the user belongs to.", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Team ID" + }, + "name": { + "type": "string", + "description": "Team name" + }, + "business_unit_id": { + "type": "string", + "nullable": true, + "description": "Business unit ID associated with this team (if any)" + }, + "business_unit_name": { + "type": "string", + "nullable": true, + "description": "Business unit name associated with this team (if any)" + } + } + } + }, + "access_profile": { + "type": "object", + "nullable": true, + "description": "Active or fallback user access profile, if assigned.", + "properties": { + "id": { + "type": "integer" + }, + "user_id": { + "type": "string" + }, + "parent_profile_id": { + "type": "integer", + "nullable": true + }, + "name": { + "type": "string" + }, + "is_active": { + "type": "boolean" + }, + "expires_at": { + "type": "string", + "format": "date-time", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + }, + "total": { + "type": "integer" + }, + "page": { + "type": "integer" + }, + "limit": { + "type": "integer" + }, + "total_pages": { + "type": "integer" + }, + "has_more": { + "type": "boolean" + } + } + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users", + "x-bifrost-removal": "following-major-release", + "deprecated": true + }, + "post": { + "operationId": "createUserLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Create user (deprecated path)", + "description": "Manually creates a new user in the organization.", + "tags": [ + "Users" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "name", + "email" + ], + "properties": { + "name": { + "type": "string", + "description": "User's display name" + }, + "email": { + "type": "string", + "format": "email", + "pattern": "^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$", + "description": "User's email address (must be unique)" + }, + "role_id": { + "type": "integer", + "description": "Optional RBAC role ID to assign" + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "User created successfully", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "user": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Unique user identifier" + }, + "name": { + "type": "string", + "description": "User's display name" + }, + "email": { + "type": "string", + "format": "email", + "description": "User's email address" + }, + "role_id": { + "type": "integer", + "nullable": true, + "description": "ID of the assigned RBAC role" + }, + "role": { + "type": "object", + "nullable": true, + "description": "RBAC role details", + "properties": { + "id": { + "type": "integer" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string" + }, + "is_system_role": { + "type": "boolean" + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "teams": { + "type": "array", + "description": "Teams the user belongs to.", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Team ID" + }, + "name": { + "type": "string", + "description": "Team name" + }, + "business_unit_id": { + "type": "string", + "nullable": true, + "description": "Business unit ID associated with this team (if any)" + }, + "business_unit_name": { + "type": "string", + "nullable": true, + "description": "Business unit name associated with this team (if any)" + } + } + } + }, + "access_profile": { + "type": "object", + "nullable": true, + "description": "Active or fallback user access profile, if assigned.", + "properties": { + "id": { + "type": "integer" + }, + "user_id": { + "type": "string" + }, + "parent_profile_id": { + "type": "integer", + "nullable": true + }, + "name": { + "type": "string" + }, + "is_active": { + "type": "boolean" + }, + "expires_at": { + "type": "string", + "format": "date-time", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + } + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "409": { + "description": "User with this email already exists", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/users/{user_id}": { + "get": { + "operationId": "getUserLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/{user_id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get user (deprecated path)", + "description": "Returns a single Enterprise user.", + "tags": [ + "Users" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "description": "User ID", + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Unique user identifier" + }, + "name": { + "type": "string", + "description": "User's display name" + }, + "email": { + "type": "string", + "format": "email", + "description": "User's email address" + }, + "role_id": { + "type": "integer", + "nullable": true, + "description": "ID of the assigned RBAC role" + }, + "role": { + "type": "object", + "nullable": true, + "description": "RBAC role details", + "properties": { + "id": { + "type": "integer" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string" + }, + "is_system_role": { + "type": "boolean" + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "teams": { + "type": "array", + "description": "Teams the user belongs to.", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Team ID" + }, + "name": { + "type": "string", + "description": "Team name" + }, + "business_unit_id": { + "type": "string", + "nullable": true, + "description": "Business unit ID associated with this team (if any)" + }, + "business_unit_name": { + "type": "string", + "nullable": true, + "description": "Business unit name associated with this team (if any)" + } + } + } + }, + "access_profile": { + "type": "object", + "nullable": true, + "description": "Active or fallback user access profile, if assigned.", + "properties": { + "id": { + "type": "integer" + }, + "user_id": { + "type": "string" + }, + "parent_profile_id": { + "type": "integer", + "nullable": true + }, + "name": { + "type": "string" + }, + "is_active": { + "type": "boolean" + }, + "expires_at": { + "type": "string", + "format": "date-time", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + } + } + }, + "404": { + "description": "Resource not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/{user_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + }, + "delete": { + "operationId": "deleteUserLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/{user_id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Delete user (deprecated path)", + "description": "Permanently removes a user from the organization. This cascades to delete the user's governance settings (budget/rate limits), team memberships, access profiles, and OIDC sessions. Cannot delete yourself.\n", + "tags": [ + "Users" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "description": "User ID", + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "User deleted successfully", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + }, + "400": { + "description": "Bad request (e.g. cannot delete yourself)", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "404": { + "description": "User not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/{user_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/users/me/permissions": { + "get": { + "operationId": "getCurrentUserPermissionsLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/me/permissions` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get current user permissions (deprecated path)", + "description": "Returns the RBAC permissions for the authenticated user. When SCIM is not enabled, returns full permissions for all resources. Otherwise returns the permissions associated with the user's assigned role.\n", + "tags": [ + "Users" + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "permissions": { + "type": "object", + "description": "Map of resource names to their permitted operations. When SCIM is disabled, returns full permissions for all resources.\n", + "additionalProperties": { + "type": "object", + "additionalProperties": { + "type": "boolean" + } + } + } + } + } + } + } + }, + "401": { + "description": "Unauthorized (user not authenticated)", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "404": { + "description": "User not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/me/permissions", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/users/{user_id}/role": { + "put": { + "operationId": "assignUserRoleLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/{user_id}/role` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Assign role to user (deprecated path)", + "description": "Assigns an RBAC role to a user. This also auto-assigns the default access profile for the new role and reloads the RBAC permission cache.\n", + "tags": [ + "Users" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "description": "User ID", + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "role_id" + ], + "properties": { + "role_id": { + "type": "integer", + "description": "ID of the RBAC role to assign" + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Role assigned successfully", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "User or role not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/{user_id}/role", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/users/{user_id}/teams": { + "get": { + "operationId": "getUserTeamsLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/{user_id}/teams` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get user's teams (deprecated path)", + "description": "Returns the list of teams a user belongs to, including the membership source.", + "tags": [ + "Users" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "description": "User ID", + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "teams": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Team ID" + }, + "name": { + "type": "string", + "description": "Team name" + }, + "source": { + "type": "string", + "description": "How the user was added to this team (e.g. \"manual\", \"scim_sync\")" + } + } + } + } + } + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "User not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/{user_id}/teams", + "x-bifrost-removal": "following-major-release", + "deprecated": true + }, + "put": { + "operationId": "updateUserTeamsLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/{user_id}/teams` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Update user's team assignments (deprecated path)", + "description": "Replaces the user's manual team assignments. Synced team memberships (from SCIM providers) are preserved and cannot be removed via this endpoint.\n", + "tags": [ + "Users" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "description": "User ID", + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "team_ids" + ], + "properties": { + "team_ids": { + "type": "array", + "items": { + "type": "string" + }, + "description": "List of team IDs to assign (replaces existing manual assignments; synced memberships are preserved)" + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Teams updated successfully", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + }, + "400": { + "description": "Bad request (e.g. team not found)", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "404": { + "description": "User not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/{user_id}/teams", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/users/email/{email}/virtual-keys": { + "get": { + "operationId": "getUserVirtualKeysByEmailLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/email/{email}/virtual-keys` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get user's virtual keys by email (deprecated path)", + "description": "**Enterprise only.**\nReturns all virtual keys associated with a user, looked up by email address. Returns an empty `virtual_keys` array when the user exists but has no virtual keys assigned. Intended for MDM and credential-helper integrations that need to resolve a user's keys without knowing their internal ID.\n", + "tags": [ + "Users" + ], + "parameters": [ + { + "name": "email", + "in": "path", + "required": true, + "description": "URL-encoded email address of the user", + "schema": { + "type": "string", + "format": "email" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "user_id": { + "type": "string", + "description": "Internal ID of the resolved user" + }, + "email": { + "type": "string", + "format": "email", + "description": "Email address of the resolved user" + }, + "virtual_keys": { + "type": "array", + "description": "Virtual keys assigned to this user", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Virtual key ID" + }, + "name": { + "type": "string", + "description": "Virtual key display name" + }, + "value": { + "type": "string", + "description": "Virtual key token value" + }, + "is_active": { + "type": "boolean", + "nullable": true, + "description": "Whether the virtual key is currently active" + } + } + } + } + } + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "User not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/email/{email}/virtual-keys", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/users/email/{email}": { + "get": { + "operationId": "getUserByEmailLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/email/{email}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get user by email (deprecated path)", + "description": "Returns a single Enterprise user resolved by URL-encoded email address.", + "tags": [ + "Users" + ], + "parameters": [ + { + "name": "email", + "in": "path", + "required": true, + "schema": { + "type": "string", + "format": "email" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Unique user identifier" + }, + "name": { + "type": "string", + "description": "User's display name" + }, + "email": { + "type": "string", + "format": "email", + "description": "User's email address" + }, + "role_id": { + "type": "integer", + "nullable": true, + "description": "ID of the assigned RBAC role" + }, + "role": { + "type": "object", + "nullable": true, + "description": "RBAC role details", + "properties": { + "id": { + "type": "integer" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string" + }, + "is_system_role": { + "type": "boolean" + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + }, + "teams": { + "type": "array", + "description": "Teams the user belongs to.", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "Team ID" + }, + "name": { + "type": "string", + "description": "Team name" + }, + "business_unit_id": { + "type": "string", + "nullable": true, + "description": "Business unit ID associated with this team (if any)" + }, + "business_unit_name": { + "type": "string", + "nullable": true, + "description": "Business unit name associated with this team (if any)" + } + } + } + }, + "access_profile": { + "type": "object", + "nullable": true, + "description": "Active or fallback user access profile, if assigned.", + "properties": { + "id": { + "type": "integer" + }, + "user_id": { + "type": "string" + }, + "parent_profile_id": { + "type": "integer", + "nullable": true + }, + "name": { + "type": "string" + }, + "is_active": { + "type": "boolean" + }, + "expires_at": { + "type": "string", + "format": "date-time", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + } + } + }, + "404": { + "description": "Resource not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/email/{email}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/teams": { + "get": { + "operationId": "listTeamsLegacy", + "summary": "List teams (deprecated path)", + "description": "Returns a list of all teams.", + "tags": [ + "Governance" + ], + "parameters": [ + { + "name": "page", + "in": "query", + "description": "Legacy 1-based page number", + "schema": { + "type": "integer", + "minimum": 1, + "default": 1 + } + }, + { + "name": "limit", + "in": "query", + "description": "Number of teams per page (max 100)", + "schema": { + "type": "integer", + "minimum": 1, + "maximum": 100, + "default": 20 + } + }, + { + "name": "search", + "in": "query", + "description": "Search by team name", + "schema": { + "type": "string" + } + }, + { + "name": "include", + "in": "query", + "description": "Set to `business_unit` to include business-unit associations", + "schema": { + "type": "string", + "enum": [ + "business_unit" + ] + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Legacy paginated response", + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "teams", + "total", + "page", + "limit" + ], + "properties": { + "teams": { + "type": "array", + "items": { + "$ref": "#/components/schemas/Team" + } + }, + "total": { + "type": "integer" + }, + "page": { + "type": "integer" + }, + "limit": { + "type": "integer" + } + } + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/teams", + "x-bifrost-removal": "following-major-release", + "deprecated": true, + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/teams` instead.\n\n" + } + }, + "post": { + "operationId": "createTeamLegacy", + "summary": "Create team (deprecated path)", + "description": "Creates a new team.", + "tags": [ + "Governance" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/CreateTeamRequest" + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Team created successfully", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/TeamResponse" + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/teams", + "x-bifrost-removal": "following-major-release", + "deprecated": true, + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/teams` instead.\n\n" + } + } + }, + "/api/teams/{team_id}": { + "get": { + "operationId": "getTeamLegacy", + "summary": "Get team (deprecated path)", + "description": "Returns a specific team by ID.", + "tags": [ + "Governance" + ], + "parameters": [ + { + "name": "team_id", + "in": "path", + "required": true, + "description": "Team ID", + "schema": { + "type": "string" + } + }, + { + "name": "from_memory", + "in": "query", + "description": "If true, returns team from in-memory cache instead of database", + "schema": { + "type": "boolean", + "default": false + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "team": { + "$ref": "#/components/schemas/Team" + } + } + } + } + } + }, + "404": { + "description": "Team not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/teams/{team_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true, + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/teams/{team_id}` instead.\n\n" + } + }, + "put": { + "operationId": "updateTeamLegacy", + "summary": "Update team (deprecated path)", + "description": "Updates an existing team.", + "tags": [ + "Governance" + ], + "parameters": [ + { + "name": "team_id", + "in": "path", + "required": true, + "description": "Team ID", + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/UpdateTeamRequest" + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Team updated successfully", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/TeamResponse" + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "Team not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/teams/{team_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true, + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/teams/{team_id}` instead.\n\n" + } + }, + "delete": { + "operationId": "deleteTeamLegacy", + "summary": "Delete team (deprecated path)", + "description": "Deletes a team.", + "tags": [ + "Governance" + ], + "parameters": [ + { + "name": "team_id", + "in": "path", + "required": true, + "description": "Team ID", + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Team deleted successfully", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + }, + "404": { + "description": "Team not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/teams/{team_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true, + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/teams/{team_id}` instead.\n\n" + } + } + }, + "/api/teams/{team_id}/members": { + "get": { + "operationId": "getTeamMembersLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/teams/{team_id}/members` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List team members (deprecated path)", + "description": "Returns all members of a team with their user details and membership source.", + "tags": [ + "Teams" + ], + "parameters": [ + { + "name": "team_id", + "in": "path", + "required": true, + "description": "Team ID", + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "members": { + "type": "array", + "items": { + "type": "object", + "properties": { + "user_id": { + "type": "string" + }, + "user_name": { + "type": "string" + }, + "user_email": { + "type": "string" + }, + "source": { + "type": "string", + "description": "How the member was added (e.g. \"manual\", \"scim_sync\")" + } + } + } + } + } + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "Team not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/teams/{team_id}/members", + "x-bifrost-removal": "following-major-release", + "deprecated": true + }, + "post": { + "operationId": "addTeamMemberLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/teams/{team_id}/members` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Add team member (deprecated path)", + "description": "Adds a user to a team. Both the team and user must exist.", + "tags": [ + "Teams" + ], + "parameters": [ + { + "name": "team_id", + "in": "path", + "required": true, + "description": "Team ID", + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "user_id" + ], + "properties": { + "user_id": { + "type": "string", + "description": "ID of the user to add to the team" + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Member added successfully", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + }, + "404": { + "description": "Team or user not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "409": { + "description": "User is already a member of this team", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/teams/{team_id}/members", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/teams/{team_id}/members/{user_id}": { + "delete": { + "operationId": "removeTeamMemberLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/teams/{team_id}/members/{user_id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Remove team member (deprecated path)", + "description": "Removes a user from a team.", + "tags": [ + "Teams" + ], + "parameters": [ + { + "name": "team_id", + "in": "path", + "required": true, + "description": "Team ID", + "schema": { + "type": "string" + } + }, + { + "name": "user_id", + "in": "path", + "required": true, + "description": "User ID to remove", + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Member removed successfully", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/MessageResponse" + } + } + } + }, + "404": { + "description": "Membership not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ManagementErrorResponse" + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/teams/{team_id}/members/{user_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/access-profiles": { + "get": { + "operationId": "listAccessProfilesLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List access profiles (deprecated path)", + "description": "Returns access profiles visible to the caller.", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "limit", + "in": "query", + "schema": { + "type": "integer" + } + }, + { + "name": "offset", + "in": "query", + "schema": { + "type": "integer" + } + }, + { + "name": "search", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "tags", + "in": "query", + "description": "Comma-separated list of tags to filter on.", + "schema": { + "type": "string" + } + }, + { + "name": "is_active", + "in": "query", + "schema": { + "type": "boolean" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "access_profiles": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string", + "nullable": true + }, + "is_active": { + "type": "boolean" + }, + "version": { + "type": "integer" + }, + "tags": { + "type": "array", + "items": { + "type": "string" + } + }, + "provider_configs": { + "type": "array", + "items": { + "type": "object", + "required": [ + "provider_name" + ], + "properties": { + "id": { + "type": "integer", + "format": "uint", + "readOnly": true + }, + "provider_name": { + "type": "string", + "description": "Provider identifier (`anthropic`, `openai`, `bedrock`, ...)." + }, + "all_models_allowed": { + "type": "boolean", + "description": "If true, every model from this provider is allowed." + }, + "allowed_models": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Explicit model list. Empty array denies all models from the provider." + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + } + } + } + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + }, + "calendar_aligned": { + "type": "boolean" + }, + "mcp_tool_groups": { + "type": "array", + "items": { + "type": "object", + "required": [ + "tool_group_id" + ], + "properties": { + "tool_group_id": { + "type": "integer", + "format": "uint" + } + } + } + }, + "mcp_servers": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_server_id" + ], + "properties": { + "mcp_server_id": { + "type": "string" + } + } + } + }, + "mcp_tool_overrides": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_client_id", + "tool_name", + "action" + ], + "properties": { + "mcp_client_id": { + "type": "string" + }, + "tool_name": { + "type": "string" + }, + "action": { + "type": "string", + "enum": [ + "include", + "exclude" + ] + } + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + }, + "count": { + "type": "integer" + }, + "total_count": { + "type": "integer" + }, + "limit": { + "type": "integer" + }, + "offset": { + "type": "integer" + } + } + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles", + "x-bifrost-removal": "following-major-release", + "deprecated": true + }, + "post": { + "operationId": "createAccessProfileLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Create access profile (deprecated path)", + "description": "Creates a new access profile template. The profile is inactive until attached to a role.\nNo size limits are enforced on create; the limits apply on update.\n", + "tags": [ + "Access Profiles" + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "name" + ], + "properties": { + "name": { + "type": "string", + "maxLength": 255 + }, + "description": { + "type": "string" + }, + "tags": { + "type": "array", + "items": { + "type": "string" + } + }, + "provider_configs": { + "type": "array", + "items": { + "type": "object", + "required": [ + "provider_name" + ], + "properties": { + "id": { + "type": "integer", + "format": "uint", + "readOnly": true + }, + "provider_name": { + "type": "string", + "description": "Provider identifier (`anthropic`, `openai`, `bedrock`, ...)." + }, + "all_models_allowed": { + "type": "boolean", + "description": "If true, every model from this provider is allowed." + }, + "allowed_models": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Explicit model list. Empty array denies all models from the provider." + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + } + } + } + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + }, + "calendar_aligned": { + "type": "boolean" + }, + "mcp_tool_groups": { + "type": "array", + "items": { + "type": "object", + "required": [ + "tool_group_id" + ], + "properties": { + "tool_group_id": { + "type": "integer", + "format": "uint" + } + } + } + }, + "mcp_servers": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_server_id" + ], + "properties": { + "mcp_server_id": { + "type": "string" + } + } + } + }, + "mcp_tool_overrides": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_client_id", + "tool_name", + "action" + ], + "properties": { + "mcp_client_id": { + "type": "string" + }, + "tool_name": { + "type": "string" + }, + "action": { + "type": "string", + "enum": [ + "include", + "exclude" + ] + } + } + } + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "201": { + "description": "Profile created", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "access_profile": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string", + "nullable": true + }, + "is_active": { + "type": "boolean" + }, + "version": { + "type": "integer" + }, + "tags": { + "type": "array", + "items": { + "type": "string" + } + }, + "provider_configs": { + "type": "array", + "items": { + "type": "object", + "required": [ + "provider_name" + ], + "properties": { + "id": { + "type": "integer", + "format": "uint", + "readOnly": true + }, + "provider_name": { + "type": "string", + "description": "Provider identifier (`anthropic`, `openai`, `bedrock`, ...)." + }, + "all_models_allowed": { + "type": "boolean", + "description": "If true, every model from this provider is allowed." + }, + "allowed_models": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Explicit model list. Empty array denies all models from the provider." + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + } + } + } + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + }, + "calendar_aligned": { + "type": "boolean" + }, + "mcp_tool_groups": { + "type": "array", + "items": { + "type": "object", + "required": [ + "tool_group_id" + ], + "properties": { + "tool_group_id": { + "type": "integer", + "format": "uint" + } + } + } + }, + "mcp_servers": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_server_id" + ], + "properties": { + "mcp_server_id": { + "type": "string" + } + } + } + }, + "mcp_tool_overrides": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_client_id", + "tool_name", + "action" + ], + "properties": { + "mcp_client_id": { + "type": "string" + }, + "tool_name": { + "type": "string" + }, + "action": { + "type": "string", + "enum": [ + "include", + "exclude" + ] + } + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "409": { + "description": "A profile with the same name already exists." + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/access-profiles/{profile_id}": { + "get": { + "operationId": "getAccessProfileLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles/{profile_id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get access profile by ID (deprecated path)", + "description": "Returns the profile plus its role attachments and the count of users holding a copy.", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Returned by GET /api/access-profiles/{id}. Includes role attachments and the count of users holding a copy.", + "properties": { + "access_profile": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string", + "nullable": true + }, + "is_active": { + "type": "boolean" + }, + "version": { + "type": "integer" + }, + "tags": { + "type": "array", + "items": { + "type": "string" + } + }, + "provider_configs": { + "type": "array", + "items": { + "type": "object", + "required": [ + "provider_name" + ], + "properties": { + "id": { + "type": "integer", + "format": "uint", + "readOnly": true + }, + "provider_name": { + "type": "string", + "description": "Provider identifier (`anthropic`, `openai`, `bedrock`, ...)." + }, + "all_models_allowed": { + "type": "boolean", + "description": "If true, every model from this provider is allowed." + }, + "allowed_models": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Explicit model list. Empty array denies all models from the provider." + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + } + } + } + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + }, + "calendar_aligned": { + "type": "boolean" + }, + "mcp_tool_groups": { + "type": "array", + "items": { + "type": "object", + "required": [ + "tool_group_id" + ], + "properties": { + "tool_group_id": { + "type": "integer", + "format": "uint" + } + } + } + }, + "mcp_servers": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_server_id" + ], + "properties": { + "mcp_server_id": { + "type": "string" + } + } + } + }, + "mcp_tool_overrides": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_client_id", + "tool_name", + "action" + ], + "properties": { + "mcp_client_id": { + "type": "string" + }, + "tool_name": { + "type": "string" + }, + "action": { + "type": "string", + "enum": [ + "include", + "exclude" + ] + } + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + }, + "roles": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "access_profile_id": { + "type": "integer", + "format": "uint" + }, + "role_id": { + "type": "integer", + "format": "uint" + }, + "role_name": { + "type": "string" + }, + "is_default": { + "type": "boolean" + } + } + } + }, + "user_count": { + "type": "integer" + } + } + } + } + } + }, + "404": { + "description": "Profile not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles/{profile_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + }, + "put": { + "operationId": "updateAccessProfileLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles/{profile_id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Update access profile (deprecated path)", + "description": "Partial update. Omitted fields preserve the current value.\n`rate_limit: null` explicitly clears the existing rate limit.\nSize limits enforced: max 100 provider_configs, max 100 budgets, max 50 tags.\n", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "description": "Partial update. Omitted fields preserve the current value.\n`rate_limit: null` explicitly clears the existing rate limit; omitting the field preserves it.\nUpdate enforces size limits not enforced on create: max 100 provider_configs, max 100 budgets, max 50 tags.\n", + "properties": { + "name": { + "type": "string", + "maxLength": 255 + }, + "description": { + "type": "string", + "nullable": true + }, + "tags": { + "type": "array", + "items": { + "type": "string" + } + }, + "provider_configs": { + "type": "array", + "items": { + "type": "object", + "required": [ + "provider_name" + ], + "properties": { + "id": { + "type": "integer", + "format": "uint", + "readOnly": true + }, + "provider_name": { + "type": "string", + "description": "Provider identifier (`anthropic`, `openai`, `bedrock`, ...)." + }, + "all_models_allowed": { + "type": "boolean", + "description": "If true, every model from this provider is allowed." + }, + "allowed_models": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Explicit model list. Empty array denies all models from the provider." + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + } + } + } + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "nullable": true, + "allOf": [ + { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + } + ] + }, + "calendar_aligned": { + "type": "boolean", + "nullable": true + }, + "mcp_tool_groups": { + "type": "array", + "items": { + "type": "object", + "required": [ + "tool_group_id" + ], + "properties": { + "tool_group_id": { + "type": "integer", + "format": "uint" + } + } + } + }, + "mcp_servers": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_server_id" + ], + "properties": { + "mcp_server_id": { + "type": "string" + } + } + } + }, + "mcp_tool_overrides": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_client_id", + "tool_name", + "action" + ], + "properties": { + "mcp_client_id": { + "type": "string" + }, + "tool_name": { + "type": "string" + }, + "action": { + "type": "string", + "enum": [ + "include", + "exclude" + ] + } + } + } + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Profile updated", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "access_profile": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string", + "nullable": true + }, + "is_active": { + "type": "boolean" + }, + "version": { + "type": "integer" + }, + "tags": { + "type": "array", + "items": { + "type": "string" + } + }, + "provider_configs": { + "type": "array", + "items": { + "type": "object", + "required": [ + "provider_name" + ], + "properties": { + "id": { + "type": "integer", + "format": "uint", + "readOnly": true + }, + "provider_name": { + "type": "string", + "description": "Provider identifier (`anthropic`, `openai`, `bedrock`, ...)." + }, + "all_models_allowed": { + "type": "boolean", + "description": "If true, every model from this provider is allowed." + }, + "allowed_models": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Explicit model list. Empty array denies all models from the provider." + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + } + } + } + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + }, + "calendar_aligned": { + "type": "boolean" + }, + "mcp_tool_groups": { + "type": "array", + "items": { + "type": "object", + "required": [ + "tool_group_id" + ], + "properties": { + "tool_group_id": { + "type": "integer", + "format": "uint" + } + } + } + }, + "mcp_servers": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_server_id" + ], + "properties": { + "mcp_server_id": { + "type": "string" + } + } + } + }, + "mcp_tool_overrides": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_client_id", + "tool_name", + "action" + ], + "properties": { + "mcp_client_id": { + "type": "string" + }, + "tool_name": { + "type": "string" + }, + "action": { + "type": "string", + "enum": [ + "include", + "exclude" + ] + } + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "Profile not found" + }, + "409": { + "description": "A profile with the same name already exists." + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles/{profile_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + }, + "delete": { + "operationId": "deleteAccessProfileLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles/{profile_id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Delete access profile (deprecated path)", + "description": "Blocked with 409 if any users still hold copies. Detach role attachments or remove user assignments first.", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Profile deleted", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "message": { + "type": "string" + } + } + } + } + } + }, + "404": { + "description": "Profile not found" + }, + "409": { + "description": "Profile has active user copies; detach users first." + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles/{profile_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/access-profiles/{profile_id}/activate": { + "put": { + "operationId": "activateAccessProfileLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles/{profile_id}/activate` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Activate access profile (deprecated path)", + "description": "Sets the profile active. Idempotent.", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Profile is active.", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "access_profile": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string", + "nullable": true + }, + "is_active": { + "type": "boolean" + }, + "version": { + "type": "integer" + }, + "tags": { + "type": "array", + "items": { + "type": "string" + } + }, + "provider_configs": { + "type": "array", + "items": { + "type": "object", + "required": [ + "provider_name" + ], + "properties": { + "id": { + "type": "integer", + "format": "uint", + "readOnly": true + }, + "provider_name": { + "type": "string", + "description": "Provider identifier (`anthropic`, `openai`, `bedrock`, ...)." + }, + "all_models_allowed": { + "type": "boolean", + "description": "If true, every model from this provider is allowed." + }, + "allowed_models": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Explicit model list. Empty array denies all models from the provider." + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + } + } + } + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + }, + "calendar_aligned": { + "type": "boolean" + }, + "mcp_tool_groups": { + "type": "array", + "items": { + "type": "object", + "required": [ + "tool_group_id" + ], + "properties": { + "tool_group_id": { + "type": "integer", + "format": "uint" + } + } + } + }, + "mcp_servers": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_server_id" + ], + "properties": { + "mcp_server_id": { + "type": "string" + } + } + } + }, + "mcp_tool_overrides": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_client_id", + "tool_name", + "action" + ], + "properties": { + "mcp_client_id": { + "type": "string" + }, + "tool_name": { + "type": "string" + }, + "action": { + "type": "string", + "enum": [ + "include", + "exclude" + ] + } + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + } + } + }, + "404": { + "description": "Profile not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles/{profile_id}/activate", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/access-profiles/{profile_id}/deactivate": { + "put": { + "operationId": "deactivateAccessProfileLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles/{profile_id}/deactivate` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Deactivate access profile (deprecated path)", + "description": "Sets the profile inactive. Idempotent. User copies are preserved; the profile is hidden from selection menus.", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Profile is inactive.", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "access_profile": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string", + "nullable": true + }, + "is_active": { + "type": "boolean" + }, + "version": { + "type": "integer" + }, + "tags": { + "type": "array", + "items": { + "type": "string" + } + }, + "provider_configs": { + "type": "array", + "items": { + "type": "object", + "required": [ + "provider_name" + ], + "properties": { + "id": { + "type": "integer", + "format": "uint", + "readOnly": true + }, + "provider_name": { + "type": "string", + "description": "Provider identifier (`anthropic`, `openai`, `bedrock`, ...)." + }, + "all_models_allowed": { + "type": "boolean", + "description": "If true, every model from this provider is allowed." + }, + "allowed_models": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Explicit model list. Empty array denies all models from the provider." + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + } + } + } + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + }, + "calendar_aligned": { + "type": "boolean" + }, + "mcp_tool_groups": { + "type": "array", + "items": { + "type": "object", + "required": [ + "tool_group_id" + ], + "properties": { + "tool_group_id": { + "type": "integer", + "format": "uint" + } + } + } + }, + "mcp_servers": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_server_id" + ], + "properties": { + "mcp_server_id": { + "type": "string" + } + } + } + }, + "mcp_tool_overrides": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_client_id", + "tool_name", + "action" + ], + "properties": { + "mcp_client_id": { + "type": "string" + }, + "tool_name": { + "type": "string" + }, + "action": { + "type": "string", + "enum": [ + "include", + "exclude" + ] + } + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + } + } + }, + "404": { + "description": "Profile not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles/{profile_id}/deactivate", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/access-profiles/{profile_id}/clone": { + "post": { + "operationId": "cloneAccessProfileLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles/{profile_id}/clone` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Clone an access profile (deprecated path)", + "description": "Creates a fresh copy of the profile under a new name. The clone has no role attachments or user copies.", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "name" + ], + "properties": { + "name": { + "type": "string" + }, + "description": { + "type": "string" + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "201": { + "description": "Cloned profile created.", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "access_profile": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "uint" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string", + "nullable": true + }, + "is_active": { + "type": "boolean" + }, + "version": { + "type": "integer" + }, + "tags": { + "type": "array", + "items": { + "type": "string" + } + }, + "provider_configs": { + "type": "array", + "items": { + "type": "object", + "required": [ + "provider_name" + ], + "properties": { + "id": { + "type": "integer", + "format": "uint", + "readOnly": true + }, + "provider_name": { + "type": "string", + "description": "Provider identifier (`anthropic`, `openai`, `bedrock`, ...)." + }, + "all_models_allowed": { + "type": "boolean", + "description": "If true, every model from this provider is allowed." + }, + "allowed_models": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Explicit model list. Empty array denies all models from the provider." + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + } + } + } + }, + "budgets": { + "type": "array", + "items": { + "type": "object", + "required": [ + "max_limit", + "reset_duration" + ], + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "max_limit": { + "type": "number", + "description": "Cap in dollars (or tokens, depending on configured pricing)." + }, + "reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "scope": { + "type": "string", + "description": "Set server-side. `total` for global budgets, `provider:` for per-provider budgets." + }, + "current_usage": { + "type": "number", + "readOnly": true + }, + "last_reset": { + "type": "string", + "format": "date-time", + "readOnly": true + } + } + } + }, + "rate_limit": { + "type": "object", + "properties": { + "id": { + "type": "string", + "readOnly": true + }, + "token_max_limit": { + "type": "number", + "nullable": true + }, + "token_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "request_max_limit": { + "type": "number", + "nullable": true + }, + "request_reset_duration": { + "type": "string", + "enum": [ + "1h", + "1d", + "1w", + "1M", + "1Y" + ], + "description": "Reset duration for a budget or rate limit." + }, + "token_current_usage": { + "type": "number", + "readOnly": true + }, + "request_current_usage": { + "type": "number", + "readOnly": true + } + } + }, + "calendar_aligned": { + "type": "boolean" + }, + "mcp_tool_groups": { + "type": "array", + "items": { + "type": "object", + "required": [ + "tool_group_id" + ], + "properties": { + "tool_group_id": { + "type": "integer", + "format": "uint" + } + } + } + }, + "mcp_servers": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_server_id" + ], + "properties": { + "mcp_server_id": { + "type": "string" + } + } + } + }, + "mcp_tool_overrides": { + "type": "array", + "items": { + "type": "object", + "required": [ + "mcp_client_id", + "tool_name", + "action" + ], + "properties": { + "mcp_client_id": { + "type": "string" + }, + "tool_name": { + "type": "string" + }, + "action": { + "type": "string", + "enum": [ + "include", + "exclude" + ] + } + } + } + }, + "created_at": { + "type": "string", + "format": "date-time" + }, + "updated_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "Source profile not found" + }, + "409": { + "description": "A profile with the same name already exists." + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles/{profile_id}/clone", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/access-profiles/{profile_id}/propagate": { + "post": { + "operationId": "propagateAccessProfileLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles/{profile_id}/propagate` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Propagate template changes to user copies (deprecated path)", + "description": "Pushes selected fields from the template to every user that holds a copy.\nUse `dry_run: true` to preview the impact. By default, accumulated usage is preserved.\n", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "fields" + ], + "properties": { + "dry_run": { + "type": "boolean" + }, + "fields": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "provider_configs", + "budgets", + "rate_limit", + "mcp_tool_groups", + "mcp_servers", + "mcp_tool_overrides" + ] + }, + "minItems": 1 + }, + "user_ids": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Empty or omitted = all users with a copy of this profile." + }, + "group_ids": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Filter by SCIM group or team IDs." + }, + "reset_usage": { + "type": "boolean", + "description": "If true, zero out budget and rate-limit usage on cloned rows. Default false (preserves usage)." + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Propagation result.", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "affected_users": { + "type": "integer" + }, + "failed_users": { + "type": "integer" + }, + "skipped_users": { + "type": "integer" + }, + "user_ids": { + "type": "array", + "items": { + "type": "string" + } + }, + "fields": { + "type": "array", + "items": { + "type": "string" + } + }, + "applied": { + "type": "boolean", + "description": "False on dry run, true when changes were persisted." + }, + "vk_sync_errors": { + "type": "array", + "items": { + "type": "string" + } + } + } + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "Profile not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles/{profile_id}/propagate", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/access-profiles/{profile_id}/roles": { + "post": { + "operationId": "attachAccessProfileRolesLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles/{profile_id}/roles` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Attach roles to access profile (deprecated path)", + "description": "Attaches one or more roles. Setting `is_default: true` makes the profile the role's default\nfor new users. `apply_to_existing: true` provisions the profile to users already in the role.\n", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "type": "object", + "required": [ + "role_ids" + ], + "properties": { + "role_ids": { + "type": "array", + "items": { + "type": "integer", + "format": "uint" + }, + "minItems": 1 + }, + "is_default": { + "type": "boolean" + }, + "apply_to_existing": { + "type": "boolean" + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Roles attached.", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "users_applied": { + "type": "integer" + } + } + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "Profile not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles/{profile_id}/roles", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/access-profiles/{profile_id}/roles/{role_id}": { + "delete": { + "operationId": "detachAccessProfileRoleLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles/{profile_id}/roles/{role_id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Detach role from access profile (deprecated path)", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + }, + { + "name": "role_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Role detached.", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "message": { + "type": "string" + } + } + } + } + } + }, + "404": { + "description": "Role attachment not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles/{profile_id}/roles/{role_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/access-profiles/{profile_id}/versions": { + "get": { + "operationId": "listAccessProfileVersionsLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles/{profile_id}/versions` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List version snapshots for an access profile (deprecated path)", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "versions": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "integer" + }, + "access_profile_id": { + "type": "integer" + }, + "version": { + "type": "integer" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string", + "nullable": true + }, + "snapshot": { + "type": "string", + "description": "JSON snapshot of the profile at this version." + }, + "changed_by": { + "type": "string" + }, + "created_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles/{profile_id}/versions", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/access-profiles/{profile_id}/versions/{version}": { + "get": { + "operationId": "getAccessProfileVersionLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles/{profile_id}/versions/{version}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get a single version snapshot (deprecated path)", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + }, + { + "name": "version", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "version": { + "type": "object", + "properties": { + "id": { + "type": "integer" + }, + "access_profile_id": { + "type": "integer" + }, + "version": { + "type": "integer" + }, + "name": { + "type": "string" + }, + "description": { + "type": "string", + "nullable": true + }, + "snapshot": { + "type": "string", + "description": "JSON snapshot of the profile at this version." + }, + "changed_by": { + "type": "string" + }, + "created_at": { + "type": "string", + "format": "date-time" + } + } + } + } + } + } + } + }, + "404": { + "description": "Version not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles/{profile_id}/versions/{version}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/access-profiles/{profile_id}/audit-logs": { + "get": { + "operationId": "getAccessProfileAuditLogsLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles/{profile_id}/audit-logs` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List audit log entries for a single profile (deprecated path)", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + }, + { + "name": "limit", + "in": "query", + "schema": { + "type": "integer" + } + }, + { + "name": "offset", + "in": "query", + "schema": { + "type": "integer" + } + }, + { + "name": "action", + "in": "query", + "description": "One of create, update, delete, propagate, attach_role, detach_role, clone, activate, deactivate.", + "schema": { + "type": "string" + } + }, + { + "name": "user_id", + "in": "query", + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "audit_logs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "integer" + }, + "access_profile_id": { + "type": "integer", + "nullable": true + }, + "user_id": { + "type": "string", + "nullable": true + }, + "actor": { + "type": "string" + }, + "action": { + "type": "string" + }, + "previous_values": { + "type": "string", + "nullable": true + }, + "new_values": { + "type": "string", + "nullable": true + }, + "metadata": { + "type": "string", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + } + } + } + }, + "total_count": { + "type": "integer" + } + } + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles/{profile_id}/audit-logs", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/access-profiles/audit-logs": { + "get": { + "operationId": "getAllAccessProfileAuditLogsLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/access-profiles/audit-logs` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List workspace-wide audit log entries (deprecated path)", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "limit", + "in": "query", + "schema": { + "type": "integer" + } + }, + { + "name": "offset", + "in": "query", + "schema": { + "type": "integer" + } + }, + { + "name": "action", + "in": "query", + "schema": { + "type": "string" + } + }, + { + "name": "user_id", + "in": "query", + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "audit_logs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "integer" + }, + "access_profile_id": { + "type": "integer", + "nullable": true + }, + "user_id": { + "type": "string", + "nullable": true + }, + "actor": { + "type": "string" + }, + "action": { + "type": "string" + }, + "previous_values": { + "type": "string", + "nullable": true + }, + "new_values": { + "type": "string", + "nullable": true + }, + "metadata": { + "type": "string", + "nullable": true + }, + "created_at": { + "type": "string", + "format": "date-time" + } + } + } + }, + "total_count": { + "type": "integer" + } + } + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/access-profiles/audit-logs", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/users/{user_id}/access-profiles": { + "get": { + "operationId": "getUserAccessProfilesLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/{user_id}/access-profiles` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List access profiles held by a user (deprecated path)", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Successful response", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "access_profiles": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "integer" + }, + "user_id": { + "type": "string" + }, + "parent_profile_id": { + "type": "integer", + "nullable": true + }, + "name": { + "type": "string" + }, + "is_active": { + "type": "boolean" + }, + "expires_at": { + "type": "string", + "format": "date-time", + "nullable": true + }, + "virtual_key_ids": { + "type": "array", + "items": { + "type": "string" + } + }, + "virtual_key_values": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "description": "Map of virtual key ID to masked secret value." + } + } + } + } + } + } + } + } + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/{user_id}/access-profiles", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/users/{user_id}/virtual-keys": { + "get": { + "operationId": "listUserVirtualKeysLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/{user_id}/virtual-keys` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List virtual keys available to a user (deprecated path)", + "tags": [ + "Users", + "Virtual Keys" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "User virtual keys", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "virtual_keys": { + "type": "array", + "items": { + "type": "object", + "additionalProperties": true + } + } + } + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/{user_id}/virtual-keys", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/users/{user_id}/access-profiles/{profile_id}/budgets/{budget_id}/override": { + "put": { + "operationId": "updateUserAccessProfileBudgetOverrideLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/{user_id}/access-profiles/{profile_id}/budgets/{budget_id}/override` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Set a user's access-profile budget override (deprecated path)", + "description": "Sets or replaces the spending override on one budget of a single user's copy of an access profile.\nThe override is additive — while it is active the budget is enforced against\n`max_limit + override_amount` — and it leaves the budget's base limit, current usage, and reset\nschedule untouched. Only this user is affected; the access profile template and every other user\nassigned to it keep their original limits.\n\nUse `mode: cycles` with a `cycles` count to grant extra spend for a finite number of reset windows\n(the current window counts as the first), or `mode: forever` to keep the override until it is deleted.\nA finite grant is anchored to the profile's reset window — calendar-aligned profiles anchor at the\ncalendar period start — so every node in a cluster derives the same number of remaining cycles.\nThe change is propagated cluster-wide and survives access-profile cloning and propagation.\n\nRequires the `AccessProfiles.Update` permission. `budget_id` must be a budget on the user's own copy\nof the profile, not on the shared template.\n", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "description": "ID of the user whose access-profile budget is being overridden", + "schema": { + "type": "string" + } + }, + { + "name": "profile_id", + "in": "path", + "required": true, + "description": "ID of the access profile assigned to the user", + "schema": { + "type": "integer" + } + }, + { + "name": "budget_id", + "in": "path", + "required": true, + "description": "ID of a budget on the user's copy of the access profile", + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BudgetOverrideRequest" + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Budget override applied successfully", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BudgetOverrideResponse" + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + }, + "404": { + "description": "User access profile or budget not found, or the profile is outside the caller's access scope" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/{user_id}/access-profiles/{profile_id}/budgets/{budget_id}/override", + "x-bifrost-removal": "following-major-release", + "deprecated": true + }, + "delete": { + "operationId": "deleteUserAccessProfileBudgetOverrideLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/{user_id}/access-profiles/{profile_id}/budgets/{budget_id}/override` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Remove a user's access-profile budget override (deprecated path)", + "description": "Removes any active override from the user's budget, so it is enforced against its base `max_limit`\nagain. The budget's current usage and reset schedule are unchanged, and the removal is permanent — a\ncleared grant cannot be re-derived. Safe to call on a budget that has no override.\n\nRequires the `AccessProfiles.Update` permission.\n", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "description": "ID of the user whose access-profile budget override is being removed", + "schema": { + "type": "string" + } + }, + { + "name": "profile_id", + "in": "path", + "required": true, + "description": "ID of the access profile assigned to the user", + "schema": { + "type": "integer" + } + }, + { + "name": "budget_id", + "in": "path", + "required": true, + "description": "ID of a budget on the user's copy of the access profile", + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Budget override removed successfully", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BudgetOverrideResponse" + } + } + } + }, + "404": { + "description": "User access profile or budget not found, or the profile is outside the caller's access scope" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/{user_id}/access-profiles/{profile_id}/budgets/{budget_id}/override", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/users/{user_id}/access-profiles/{profile_id}": { + "delete": { + "operationId": "detachUserAccessProfileLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/{user_id}/access-profiles/{profile_id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Detach a user's access profile (deprecated path)", + "description": "Removes the profile from the user and deletes every virtual key it produced. Fails closed if a virtual key cannot be deleted.", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Profile detached.", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "message": { + "type": "string" + }, + "deleted_vk_names": { + "type": "array", + "items": { + "type": "string" + } + }, + "deleted_vk_count": { + "type": "integer" + } + } + } + } + } + }, + "404": { + "description": "User access profile not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/{user_id}/access-profiles/{profile_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/users/{user_id}/access-profiles/{profile_id}/virtual-keys": { + "post": { + "operationId": "addUserAccessProfileVirtualKeyLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/{user_id}/access-profiles/{profile_id}/virtual-keys` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Add an extra virtual key under a user's access profile (deprecated path)", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "profile_id", + "in": "path", + "required": true, + "schema": { + "type": "integer" + } + } + ], + "requestBody": { + "required": false, + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "description": { + "type": "string" + } + } + } + } + } + }, + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Virtual key created.", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "virtual_key": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "value": { + "type": "string", + "description": "The generated virtual key secret. Shown only once on creation." + } + } + } + } + } + } + } + }, + "404": { + "description": "User access profile not found" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/{user_id}/access-profiles/{profile_id}/virtual-keys", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/users/{user_id}/access-profiles/virtual-keys/{vk_id}": { + "delete": { + "operationId": "deleteUserAccessProfileVirtualKeyLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/users/{user_id}/access-profiles/virtual-keys/{vk_id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Delete a virtual key from a user's access profile (deprecated path)", + "tags": [ + "Access Profiles" + ], + "parameters": [ + { + "name": "user_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "vk_id", + "in": "path", + "required": true, + "schema": { + "type": "string" + } + } + ], + "security": [ + { + "ManagementBearerAuth": [] + } + ], + "responses": { + "200": { + "description": "Virtual key deleted.", + "content": { + "application/json": { + "schema": { + "type": "object", + "properties": { + "message": { + "type": "string" + } + } + } + } + } + }, + "404": { + "description": "Virtual key not found for this user" + }, + "500": { + "description": "Internal server error", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } + } + }, + "x-bifrost-successor": "/api/governance/users/{user_id}/access-profiles/virtual-keys/{vk_id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true + } + }, + "/api/governance/audit-logs": { + "get": { + "operationId": "getAuditLogs", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List audit logs", + "description": "Retrieves CADF-compliant audit log events with filtering, search, and\npagination via query parameters. Most filter dimensions accept either a\nsingle value (singular parameter, e.g. `action`) or a JSON-encoded array\nof values (plural parameter, e.g. `actions`); when both are supplied the\nplural array takes precedence.\n", + "tags": [ + "Audit Logs" + ], + "parameters": [ + { + "name": "page", + "in": "query", + "description": "Page number for offset-based pagination (default 1).", + "schema": { + "type": "integer", + "default": 1, + "minimum": 1 + } + }, + { + "name": "limit", + "in": "query", + "description": "Number of events to return per page (default 100, max 1000).", + "schema": { + "type": "integer", + "default": 100, + "maximum": 1000 + } + }, + { + "name": "cursor", + "in": "query", + "description": "Opaque cursor for cursor-based pagination (from `next_cursor`).", + "schema": { + "type": "string" + } + }, + { + "name": "search", + "in": "query", + "description": "Free-text search across audit event fields.", + "schema": { + "type": "string" + } + }, + { + "name": "action", + "in": "query", + "description": "Filter by a single CADF action.", + "schema": { + "$ref": "#/components/schemas/AuditAction" + } + }, + { + "name": "actions", + "in": "query", + "description": "JSON array of CADF actions to filter by (OR match).", + "schema": { + "type": "string" + }, + "example": "[\"create\",\"update\"]" + }, + { + "name": "outcome", + "in": "query", + "description": "Filter by a single outcome.", + "schema": { + "$ref": "#/components/schemas/AuditOutcome" + } + }, + { + "name": "outcomes", + "in": "query", + "description": "JSON array of outcomes to filter by (OR match).", + "schema": { + "type": "string" + }, + "example": "[\"success\",\"failure\"]" + }, + { + "name": "event_type", + "in": "query", + "description": "Filter by a single event type.", + "schema": { + "$ref": "#/components/schemas/AuditEventType" + } + }, + { + "name": "event_types", + "in": "query", + "description": "JSON array of event types to filter by (OR match).", + "schema": { + "type": "string" + }, + "example": "[\"activity\",\"control\"]" + }, + { + "name": "initiator_id", + "in": "query", + "description": "Filter by a single initiator ID.", + "schema": { + "type": "string" + } + }, + { + "name": "initiator_ids", + "in": "query", + "description": "JSON array of initiator IDs to filter by (OR match).", + "schema": { + "type": "string" + } + }, + { + "name": "initiator_type", + "in": "query", + "description": "Filter by a single initiator resource type.", + "schema": { + "$ref": "#/components/schemas/AuditResourceType" + } + }, + { + "name": "initiator_types", + "in": "query", + "description": "JSON array of initiator resource types to filter by (OR match).", + "schema": { + "type": "string" + } + }, + { + "name": "target_id", + "in": "query", + "description": "Filter by a single target ID.", + "schema": { + "type": "string" + } + }, + { + "name": "target_ids", + "in": "query", + "description": "JSON array of target IDs to filter by (OR match).", + "schema": { + "type": "string" + } + }, + { + "name": "target_type", + "in": "query", + "description": "Filter by a single target resource type.", + "schema": { + "$ref": "#/components/schemas/AuditResourceType" + } + }, + { + "name": "target_types", + "in": "query", + "description": "JSON array of target resource types to filter by (OR match).", + "schema": { + "type": "string" + } + }, + { + "name": "start_date", + "in": "query", + "description": "Filter events at or after this time (RFC3339 or `YYYY-MM-DD`).", + "schema": { + "type": "string" + } + }, + { + "name": "end_date", + "in": "query", + "description": "Filter events at or before this time (RFC3339 or `YYYY-MM-DD`; a date is treated as end-of-day).", + "schema": { + "type": "string" + } + }, + { + "name": "period", + "in": "query", + "description": "Relative time window that overrides `start_date`/`end_date` when set (e.g. `24h`, `7d`).", + "schema": { + "type": "string" + } + }, + { + "name": "request_method", + "in": "query", + "description": "Filter by a single HTTP request method.", + "schema": { + "type": "string" + } + }, + { + "name": "request_methods", + "in": "query", + "description": "JSON array of HTTP request methods to filter by (OR match).", + "schema": { + "type": "string" + } + }, + { + "name": "request_path", + "in": "query", + "description": "Filter by a single request path prefix.", + "schema": { + "type": "string" + } + }, + { + "name": "request_paths", + "in": "query", + "description": "JSON array of request path prefixes to filter by (OR match).", + "schema": { + "type": "string" + } + }, + { + "name": "request_ip", + "in": "query", + "description": "Filter by a single client IP address.", + "schema": { + "type": "string" + } + }, + { + "name": "request_ips", + "in": "query", + "description": "JSON array of client IP addresses to filter by (OR match).", + "schema": { + "type": "string" } - } - } - } - }, - "/api/users/{target_user_id}/access-profiles": { - "get": { - "operationId": "listUserAccessProfiles", - "summary": "List access profiles held by a user", - "tags": [ - "Access Profiles" - ], - "parameters": [ + }, { - "name": "target_user_id", - "in": "path", - "required": true, + "name": "tags", + "in": "query", + "description": "JSON array of tags to filter by (any match).", "schema": { "type": "string" + }, + "example": "[\"security\",\"auth\"]" + }, + { + "name": "sort_by", + "in": "query", + "description": "Field to sort by (default `event_time`).", + "schema": { + "type": "string", + "default": "event_time" + } + }, + { + "name": "sort_order", + "in": "query", + "description": "Sort direction.", + "schema": { + "type": "string", + "enum": [ + "asc", + "desc" + ], + "default": "desc" } } ], @@ -53761,51 +64345,17 @@ "content": { "application/json": { "schema": { - "type": "object", - "properties": { - "access_profiles": { - "type": "array", - "items": { - "type": "object", - "properties": { - "id": { - "type": "integer" - }, - "user_id": { - "type": "string" - }, - "parent_profile_id": { - "type": "integer", - "nullable": true - }, - "name": { - "type": "string" - }, - "is_active": { - "type": "boolean" - }, - "expires_at": { - "type": "string", - "format": "date-time", - "nullable": true - }, - "virtual_key_ids": { - "type": "array", - "items": { - "type": "string" - } - }, - "virtual_key_values": { - "type": "object", - "additionalProperties": { - "type": "string" - }, - "description": "Map of virtual key ID to masked secret value." - } - } - } - } - } + "$ref": "#/components/schemas/AuditLogsResult" + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" } } } @@ -53823,29 +64373,36 @@ } } }, - "/api/users/{target_user_id}/access-profiles/{profile_id}": { - "delete": { - "operationId": "detachUserAccessProfile", - "summary": "Detach a user's access profile", - "description": "Removes the profile from the user and deletes every virtual key it produced. Fails closed if a virtual key cannot be deleted.", + "/api/governance/audit-logs/filterdata": { + "get": { + "operationId": "getAuditLogsFilterData", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get audit log filter data", + "description": "Returns the distinct values available for each audit log filter dimension,\nused to populate filter dropdowns in the dashboard.\n", "tags": [ - "Access Profiles" + "Audit Logs" ], "parameters": [ { - "name": "target_user_id", - "in": "path", - "required": true, + "name": "dimensions", + "in": "query", + "description": "Comma-separated list of dimensions to return. When omitted, all\ndimensions are returned. Unknown dimensions are ignored.\n", "schema": { - "type": "string" + "type": "string", + "example": "actions,outcomes,initiators" } }, { - "name": "profile_id", - "in": "path", - "required": true, + "name": "q", + "in": "query", + "description": "Optional case-insensitive substring filter applied to dimension values.", "schema": { - "type": "integer" + "type": "string" } } ], @@ -53856,32 +64413,15 @@ ], "responses": { "200": { - "description": "Profile detached.", + "description": "Successful response", "content": { "application/json": { "schema": { - "type": "object", - "properties": { - "message": { - "type": "string" - }, - "deleted_vk_names": { - "type": "array", - "items": { - "type": "string" - } - }, - "deleted_vk_count": { - "type": "integer" - } - } + "$ref": "#/components/schemas/AuditFilterDataResponse" } } } }, - "404": { - "description": "User access profile not found" - }, "500": { "description": "Internal server error", "content": { @@ -53895,53 +64435,92 @@ } } }, - "/api/users/{target_user_id}/access-profiles/{profile_id}/budgets/{budget_id}/override": { - "put": { - "operationId": "updateUserAccessProfileBudgetOverride", - "summary": "Set a user's access-profile budget override", - "description": "Sets or replaces the spending override on one budget of a single user's copy of an access profile.\nThe override is additive — while it is active the budget is enforced against\n`max_limit + override_amount` — and it leaves the budget's base limit, current usage, and reset\nschedule untouched. Only this user is affected; the access profile template and every other user\nassigned to it keep their original limits.\n\nUse `mode: cycles` with a `cycles` count to grant extra spend for a finite number of reset windows\n(the current window counts as the first), or `mode: forever` to keep the override until it is deleted.\nA finite grant is anchored to the profile's reset window — calendar-aligned profiles anchor at the\ncalendar period start — so every node in a cluster derives the same number of remaining cycles.\nThe change is propagated cluster-wide and survives access-profile cloning and propagation.\n\nRequires the `AccessProfiles.Update` permission. `budget_id` must be a budget on the user's own copy\nof the profile, not on the shared template.\n", + "/api/governance/audit-logs/export": { + "get": { + "operationId": "exportAuditLogs", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Export audit logs", + "description": "Streams audit log events matching the supplied filters as a downloadable\nfile. Accepts the same filter query parameters as `GET /api/audit-logs`.\nThe response is returned as an attachment with a generated filename.\n", "tags": [ - "Access Profiles" + "Audit Logs" ], "parameters": [ { - "name": "target_user_id", - "in": "path", - "required": true, - "description": "ID of the user whose access-profile budget is being overridden", + "name": "format", + "in": "query", + "description": "Export format. Defaults to `json` when omitted or unrecognized.\n- `json`: a JSON array of events\n- `jsonl`: JSON Lines, one event per line\n- `syslog`: RFC 5424 syslog format\n", + "schema": { + "type": "string", + "enum": [ + "json", + "jsonl", + "syslog" + ], + "default": "json" + } + }, + { + "name": "search", + "in": "query", + "description": "Free-text search across audit event fields.", "schema": { "type": "string" } }, { - "name": "profile_id", - "in": "path", - "required": true, - "description": "ID of the access profile assigned to the user", + "name": "actions", + "in": "query", + "description": "JSON array of CADF actions to filter by (OR match).", "schema": { - "type": "integer" + "type": "string" } }, { - "name": "budget_id", - "in": "path", - "required": true, - "description": "ID of a budget on the user's copy of the access profile", + "name": "outcomes", + "in": "query", + "description": "JSON array of outcomes to filter by (OR match).", "schema": { "type": "string" } - } - ], - "requestBody": { - "required": true, - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/BudgetOverrideRequest" - } + }, + { + "name": "event_types", + "in": "query", + "description": "JSON array of event types to filter by (OR match).", + "schema": { + "type": "string" + } + }, + { + "name": "start_date", + "in": "query", + "description": "Filter events at or after this time (RFC3339 or `YYYY-MM-DD`).", + "schema": { + "type": "string" + } + }, + { + "name": "end_date", + "in": "query", + "description": "Filter events at or before this time (RFC3339 or `YYYY-MM-DD`).", + "schema": { + "type": "string" + } + }, + { + "name": "period", + "in": "query", + "description": "Relative time window that overrides `start_date`/`end_date` when set (e.g. `24h`, `7d`).", + "schema": { + "type": "string" } } - }, + ], "security": [ { "ManagementBearerAuth": [] @@ -53949,11 +64528,21 @@ ], "responses": { "200": { - "description": "Budget override applied successfully", + "description": "A streamed export of the matching audit logs.", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/BudgetOverrideResponse" + "type": "string" + } + }, + "application/x-ndjson": { + "schema": { + "type": "string" + } + }, + "text/plain": { + "schema": { + "type": "string" } } } @@ -53968,9 +64557,6 @@ } } }, - "404": { - "description": "User access profile or budget not found, or the profile is outside the caller's access scope" - }, "500": { "description": "Internal server error", "content": { @@ -53982,38 +64568,28 @@ } } } - }, - "delete": { - "operationId": "deleteUserAccessProfileBudgetOverride", - "summary": "Remove a user's access-profile budget override", - "description": "Removes any active override from the user's budget, so it is enforced against its base `max_limit`\nagain. The budget's current usage and reset schedule are unchanged, and the removal is permanent — a\ncleared grant cannot be re-derived. Safe to call on a budget that has no override.\n\nRequires the `AccessProfiles.Update` permission.\n", + } + }, + "/api/governance/audit-logs/{id}": { + "get": { + "operationId": "getAuditLogById", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get audit log by ID", + "description": "Retrieves a single audit log event by its unique ID.", "tags": [ - "Access Profiles" + "Audit Logs" ], "parameters": [ { - "name": "target_user_id", - "in": "path", - "required": true, - "description": "ID of the user whose access-profile budget override is being removed", - "schema": { - "type": "string" - } - }, - { - "name": "profile_id", - "in": "path", - "required": true, - "description": "ID of the access profile assigned to the user", - "schema": { - "type": "integer" - } - }, - { - "name": "budget_id", + "name": "id", "in": "path", "required": true, - "description": "ID of a budget on the user's copy of the access profile", + "description": "The unique identifier of the audit log event.", "schema": { "type": "string" } @@ -54026,20 +64602,17 @@ ], "responses": { "200": { - "description": "Budget override removed successfully", + "description": "Successful response", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/BudgetOverrideResponse" + "$ref": "#/components/schemas/AuditLogResponse" } } } }, - "404": { - "description": "User access profile or budget not found, or the profile is outside the caller's access scope" - }, - "500": { - "description": "Internal server error", + "400": { + "description": "Bad request", "content": { "application/json": { "schema": { @@ -54047,89 +64620,17 @@ } } } - } - } - } - }, - "/api/users/{target_user_id}/access-profiles/{profile_id}/virtual-keys": { - "post": { - "operationId": "addUserAccessProfileVirtualKey", - "summary": "Add an extra virtual key under a user's access profile", - "tags": [ - "Access Profiles" - ], - "parameters": [ - { - "name": "target_user_id", - "in": "path", - "required": true, - "schema": { - "type": "string" - } }, - { - "name": "profile_id", - "in": "path", - "required": true, - "schema": { - "type": "integer" - } - } - ], - "requestBody": { - "required": false, - "content": { - "application/json": { - "schema": { - "type": "object", - "properties": { - "name": { - "type": "string" - }, - "description": { - "type": "string" - } - } - } - } - } - }, - "security": [ - { - "ManagementBearerAuth": [] - } - ], - "responses": { - "200": { - "description": "Virtual key created.", + "404": { + "description": "Resource not found", "content": { "application/json": { "schema": { - "type": "object", - "properties": { - "virtual_key": { - "type": "object", - "properties": { - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "value": { - "type": "string", - "description": "The generated virtual key secret. Shown only once on creation." - } - } - } - } + "$ref": "#/components/schemas/BifrostError" } } } }, - "404": { - "description": "User access profile not found" - }, "500": { "description": "Internal server error", "content": { @@ -54143,26 +64644,26 @@ } } }, - "/api/users/{target_user_id}/access-profiles/virtual-keys/{vk_id}": { - "delete": { - "operationId": "deleteUserAccessProfileVirtualKey", - "summary": "Delete a virtual key from a user's access profile", + "/api/governance/audit-logs/{id}/verify": { + "get": { + "operationId": "verifyAuditLogSignature", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Verify audit log signature", + "description": "Recomputes the HMAC-SHA256 signature for a single audit log event and\ncompares it (in constant time) against the stored signature to detect\ntampering.\n", "tags": [ - "Access Profiles" + "Audit Logs" ], "parameters": [ { - "name": "target_user_id", - "in": "path", - "required": true, - "schema": { - "type": "string" - } - }, - { - "name": "vk_id", + "name": "id", "in": "path", "required": true, + "description": "The unique identifier of the audit log event to verify.", "schema": { "type": "string" } @@ -54175,22 +64676,34 @@ ], "responses": { "200": { - "description": "Virtual key deleted.", + "description": "Successful response", "content": { "application/json": { "schema": { - "type": "object", - "properties": { - "message": { - "type": "string" - } - } + "$ref": "#/components/schemas/AuditVerifyResult" + } + } + } + }, + "400": { + "description": "Bad request", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" } } } }, "404": { - "description": "Virtual key not found for this user" + "description": "Resource not found", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/BifrostError" + } + } + } }, "500": { "description": "Internal server error", @@ -54207,8 +64720,14 @@ }, "/api/audit-logs": { "get": { - "operationId": "getAuditLogs", - "summary": "List audit logs", + "operationId": "getAuditLogsLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/audit-logs` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "List audit logs (deprecated path)", "description": "Retrieves CADF-compliant audit log events with filtering, search, and\npagination via query parameters. Most filter dimensions accept either a\nsingle value (singular parameter, e.g. `action`) or a JSON-encoded array\nof values (plural parameter, e.g. `actions`); when both are supplied the\nplural array takes precedence.\n", "tags": [ "Audit Logs" @@ -54505,13 +65024,22 @@ } } } - } + }, + "x-bifrost-successor": "/api/governance/audit-logs", + "x-bifrost-removal": "following-major-release", + "deprecated": true } }, "/api/audit-logs/filterdata": { "get": { - "operationId": "getAuditLogsFilterData", - "summary": "Get audit log filter data", + "operationId": "getAuditLogsFilterDataLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/audit-logs/filterdata` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get audit log filter data (deprecated path)", "description": "Returns the distinct values available for each audit log filter dimension,\nused to populate filter dropdowns in the dashboard.\n", "tags": [ "Audit Logs" @@ -54561,13 +65089,22 @@ } } } - } + }, + "x-bifrost-successor": "/api/governance/audit-logs/filterdata", + "x-bifrost-removal": "following-major-release", + "deprecated": true } }, "/api/audit-logs/export": { "get": { - "operationId": "exportAuditLogs", - "summary": "Export audit logs", + "operationId": "exportAuditLogsLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/audit-logs/export` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Export audit logs (deprecated path)", "description": "Streams audit log events matching the supplied filters as a downloadable\nfile. Accepts the same filter query parameters as `GET /api/audit-logs`.\nThe response is returned as an attachment with a generated filename.\n", "tags": [ "Audit Logs" @@ -54690,13 +65227,22 @@ } } } - } + }, + "x-bifrost-successor": "/api/governance/audit-logs/export", + "x-bifrost-removal": "following-major-release", + "deprecated": true } }, "/api/audit-logs/{id}": { "get": { - "operationId": "getAuditLogById", - "summary": "Get audit log by ID", + "operationId": "getAuditLogByIdLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/audit-logs/{id}` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Get audit log by ID (deprecated path)", "description": "Retrieves a single audit log event by its unique ID.", "tags": [ "Audit Logs" @@ -54758,13 +65304,22 @@ } } } - } + }, + "x-bifrost-successor": "/api/governance/audit-logs/{id}", + "x-bifrost-removal": "following-major-release", + "deprecated": true } }, "/api/audit-logs/{id}/verify": { "get": { - "operationId": "verifyAuditLogSignature", - "summary": "Verify audit log signature", + "operationId": "verifyAuditLogSignatureLegacy", + "x-mint": { + "metadata": { + "tag": "Removing soon" + }, + "content": "\n This path is deprecated and will be removed in the following major release.\n Use `/api/governance/audit-logs/{id}/verify` instead.\n\n\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, + "summary": "Verify audit log signature (deprecated path)", "description": "Recomputes the HMAC-SHA256 signature for a single audit log event and\ncompares it (in constant time) against the stored signature to detect\ntampering.\n", "tags": [ "Audit Logs" @@ -54826,12 +65381,21 @@ } } } - } + }, + "x-bifrost-successor": "/api/governance/audit-logs/{id}/verify", + "x-bifrost-removal": "following-major-release", + "deprecated": true } }, "/api/mcp/tool-groups": { "get": { "operationId": "listMCPToolGroups", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "List MCP Tool Groups", "description": "Returns tool groups visible to the caller. When all of `limit`, `offset`, and `search` are omitted, every group is returned in one response.\n", "tags": [ @@ -54995,6 +65559,12 @@ }, "post": { "operationId": "createMCPToolGroup", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Create MCP Tool Group", "description": "Creates a new tool group along with its attachments in a single transaction.\nValidates that every `mcp_client_id` points to a deployed MCP client and that every named\ntool exists on its server.\n", "tags": [ @@ -55210,6 +65780,12 @@ "/api/mcp/tool-groups/{id}": { "get": { "operationId": "getMCPToolGroup", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Get MCP Tool Group by ID", "tags": [ "MCP Tool Groups" @@ -55346,6 +65922,12 @@ }, "put": { "operationId": "updateMCPToolGroup", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Update MCP Tool Group", "description": "Partial update. Scalar fields preserve the current value when omitted.\nArray fields are replace-on-send: an empty array clears all attachments in that dimension.\n", "tags": [ @@ -55570,6 +66152,12 @@ }, "delete": { "operationId": "deleteMCPToolGroup", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Delete MCP Tool Group", "description": "Deletes the group; attachments are removed automatically.", "tags": [ @@ -55625,6 +66213,12 @@ "/api/circuit-breaker/policies": { "get": { "operationId": "listCircuitBreakerPolicies", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "List circuit breaker policies", "description": "Returns all circuit breaker policies defined in this workspace.", "tags": [ @@ -55783,6 +66377,12 @@ }, "post": { "operationId": "createCircuitBreakerPolicy", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Create circuit breaker policy", "description": "Creates a new circuit breaker policy and immediately activates it in the running gateway.\nReturns 409 if a policy with the same name already exists.\n", "tags": [ @@ -56065,6 +66665,12 @@ "/api/circuit-breaker/policies/{name}": { "put": { "operationId": "updateCircuitBreakerPolicy", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Update circuit breaker policy", "description": "Replaces a circuit breaker policy by name. The `name` field in the request body must match the URL parameter or be omitted.\nChanges take effect immediately in the running gateway.\n", "tags": [ @@ -56356,6 +66962,12 @@ }, "delete": { "operationId": "deleteCircuitBreakerPolicy", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Delete circuit breaker policy", "description": "Deletes a circuit breaker policy by name and removes it from the running gateway.\nAny open circuits for this policy are discarded immediately.\n", "tags": [ @@ -56412,6 +67024,12 @@ "/api/circuit-breaker/state": { "get": { "operationId": "getCircuitBreakerState", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Get circuit breaker state", "description": "Returns a snapshot of all currently-open circuits.\nMain circuits are keyed by policy name. Per-key sub-circuits are keyed by `\"\\x00\"`.\nCircuits not present in the map are closed.\n", "tags": [ @@ -67441,6 +78059,12 @@ "/api/vault/flush-cache": { "post": { "operationId": "flushVaultCache", + "x-mint": { + "metadata": { + "tag": "Enterprise" + }, + "content": "\n This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.\n\n" + }, "summary": "Flush vault secret cache", "description": "Clears the in-memory vault secret cache so the next resolution of every\n`vault.` reference re-fetches from the configured backend (AWS Secrets\nManager, GCP Secret Manager, or HashiCorp Vault).\n\nUse this after rotating a secret when you cannot wait for the hourly\nbackground refresh. In a clustered deployment the flush is broadcast to all\npeer nodes automatically — you only need to call this on one node.\n\nReturns `400` if vault integration is not enabled.\n", "tags": [ diff --git a/docs/openapi/openapi.yaml b/docs/openapi/openapi.yaml index 8cbe432ef3a..75c507b66e0 100644 --- a/docs/openapi/openapi.yaml +++ b/docs/openapi/openapi.yaml @@ -1043,16 +1043,6 @@ paths: $ref: "./paths/management/governancelegacy.yaml#/legacy-users-access-profile-virtual-keys" /api/users/{user_id}/access-profiles/virtual-keys/{vk_id}: $ref: "./paths/management/governancelegacy.yaml#/legacy-users-access-profile-virtual-key-by-id" - /api/audit-logs: - $ref: "./paths/management/governancelegacy.yaml#/legacy-audit-logs" - /api/audit-logs/filterdata: - $ref: "./paths/management/governancelegacy.yaml#/legacy-audit-logs-filterdata" - /api/audit-logs/export: - $ref: "./paths/management/governancelegacy.yaml#/legacy-audit-logs-export" - /api/audit-logs/{id}: - $ref: "./paths/management/governancelegacy.yaml#/legacy-audit-logs-by-id" - /api/audit-logs/{id}/verify: - $ref: "./paths/management/governancelegacy.yaml#/legacy-audit-logs-verify" # Audit Logs /api/governance/audit-logs: $ref: "./paths/management/auditlogs.yaml#/audit-logs" @@ -1065,6 +1055,18 @@ paths: /api/governance/audit-logs/{id}/verify: $ref: "./paths/management/auditlogs.yaml#/audit-logs-verify" + # Audit Logs (legacy aliases) + /api/audit-logs: + $ref: "./paths/management/governancelegacy.yaml#/legacy-audit-logs" + /api/audit-logs/filterdata: + $ref: "./paths/management/governancelegacy.yaml#/legacy-audit-logs-filterdata" + /api/audit-logs/export: + $ref: "./paths/management/governancelegacy.yaml#/legacy-audit-logs-export" + /api/audit-logs/{id}: + $ref: "./paths/management/governancelegacy.yaml#/legacy-audit-logs-by-id" + /api/audit-logs/{id}/verify: + $ref: "./paths/management/governancelegacy.yaml#/legacy-audit-logs-verify" + # MCP Tool Groups /api/mcp/tool-groups: $ref: "./paths/management/mcptoolgroups.yaml#/mcp-tool-groups"