{"openapi":"3.0.3","info":{"title":"Authorizer API","description":"A hierarchical permissions and authorization service","license":{"name":""},"version":"1.0.0"},"paths":{"/api/management/corporations":{"get":{"tags":["crate::api::corporations"],"operationId":"list_corporations","responses":{"200":{"description":"List corporations successfully","content":{"application/json":{"schema":{}}}}}},"post":{"tags":["crate::api::corporations"],"operationId":"create_corporation","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCorporationRequest"}}},"required":true},"responses":{"201":{"description":"Corporation created successfully","content":{"application/json":{"schema":{}}}}}}},"/api/management/groups":{"get":{"tags":["crate::api::perms_group"],"operationId":"list_groups","responses":{"200":{"description":"List permission groups successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListGroupsResponse"}}}}}},"post":{"tags":["crate::api::perms_group"],"operationId":"create_group","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreatePermsGroupRequest"}}},"required":true},"responses":{"201":{"description":"Permission group created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateGroupResponse"}}}}}}},"/api/management/groups/{group_id}":{"delete":{"tags":["crate::api::perms_group"],"summary":"DELETE /api/management/groups/{group_id}","description":"Delete a permission group and all its relationships","operationId":"delete_group","parameters":[{"name":"group_id","in":"path","description":"Group ID to delete","required":true,"schema":{"type":"integer","format":"int64"}}],"responses":{"200":{"description":"Permission group deleted successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteGroupResponse"}}}}}}},"/api/management/groups/{group_id}/hierarchy":{"get":{"tags":["crate::api::perms_group"],"summary":"GET /api/management/groups/{group_id}/hierarchy","description":"Get group's parent and child relationships","operationId":"get_group_hierarchy","parameters":[{"name":"group_id","in":"path","description":"Group ID","required":true,"schema":{"type":"integer","format":"int64"}}],"responses":{"200":{"description":"Group hierarchy retrieved successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupHierarchyResponse"}}}}}}},"/api/management/groups/{group_id}/parents":{"put":{"tags":["crate::api::perms_group"],"operationId":"set_group_parents","parameters":[{"name":"group_id","in":"path","description":"Group ID","required":true,"schema":{"type":"integer","format":"int64"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateGroupPermsRequest"}}},"required":true},"responses":{"200":{"description":"Group parents updated successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetGroupParentsResponse"}}}},"400":{"description":"Invalid hierarchy configuration"},"404":{"description":"Group not found"}}}},"/api/management/groups/{group_id}/permissions":{"get":{"tags":["crate::api::perms_group"],"summary":"GET /api/management/groups/{group_id}/permissions","description":"Get all permissions directly assigned to a group","operationId":"get_group_permissions","parameters":[{"name":"group_id","in":"path","description":"Group ID","required":true,"schema":{"type":"integer","format":"int64"}}],"responses":{"200":{"description":"Group permissions retrieved successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupPermissionsResponse"}}}},"404":{"description":"Group not found"}}},"post":{"tags":["crate::api::perms_group"],"summary":"POST /api/management/groups/{group_id}/permissions","description":"Add a permission to a permission group","operationId":"add_group_permission","parameters":[{"name":"group_id","in":"path","description":"Group ID","required":true,"schema":{"type":"integer","format":"int64"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AddPermissionRequest"}}},"required":true},"responses":{"200":{"description":"Permission added successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AddPermissionResponse"}}}},"400":{"description":"Invalid permission scope"},"404":{"description":"Group not found"}}}},"/api/management/groups/{group_id}/permissions/{action}":{"delete":{"tags":["crate::api::perms_group"],"operationId":"delete_group_permission","parameters":[{"name":"group_id","in":"path","description":"Group ID","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"action","in":"path","description":"Action name to remove","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeletePermissionRequest"}}},"required":true},"responses":{"200":{"description":"Permission removed successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeletePermissionResponse"}}}},"400":{"description":"Invalid request"},"404":{"description":"Permission not found"}}}},"/api/management/locations":{"get":{"tags":["crate::api::locations"],"operationId":"list_locations","responses":{"200":{"description":"List locations successfully","content":{"application/json":{"schema":{}}}}}},"post":{"tags":["crate::api::locations"],"operationId":"create_location","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateLocationRequest"}}},"required":true},"responses":{"201":{"description":"Location created successfully","content":{"application/json":{"schema":{}}}}}}},"/api/management/users":{"get":{"tags":["crate::api::users"],"operationId":"list_users","responses":{"200":{"description":"List users successfully","content":{"application/json":{"schema":{}}}}}},"post":{"tags":["crate::api::users"],"operationId":"create_user","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateUserRequest"}}},"required":true},"responses":{"201":{"description":"User created successfully","content":{"application/json":{"schema":{}}}}}}},"/api/management/users/{user_id}/groups":{"get":{"tags":["crate::api::users"],"summary":"GET /api/management/users/{user_id}/groups","description":"Get all groups assigned to a user","operationId":"get_user_groups","parameters":[{"name":"user_id","in":"path","description":"User ID","required":true,"schema":{"type":"integer","format":"int64"}}],"responses":{"200":{"description":"User groups retrieved successfully","content":{"application/json":{"schema":{}}}}}},"put":{"tags":["crate::api::users"],"summary":"PUT /api/management/users/{user_id}/groups","description":"Set the groups assigned to a user (replaces all existing assignments)","operationId":"set_user_groups","parameters":[{"name":"user_id","in":"path","description":"User ID","required":true,"schema":{"type":"integer","format":"int64"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetUserGroupsRequest"}}},"required":true},"responses":{"200":{"description":"User groups updated successfully","content":{"application/json":{"schema":{}}}}}}},"/api/management/users/{user_id}/permissions":{"get":{"tags":["crate::api::users"],"summary":"GET /api/management/users/{user_id}/permissions","description":"Get all effective permissions for a user (flattened, resolved)","operationId":"get_user_permissions","parameters":[{"name":"user_id","in":"path","description":"User ID","required":true,"schema":{"type":"integer","format":"int64"}}],"responses":{"200":{"description":"User permissions retrieved successfully","content":{"application/json":{"schema":{}}}}}}},"/health":{"get":{"tags":["crate::api::health_check"],"operationId":"health_check","responses":{"200":{"description":"Health check successful","content":{"application/json":{"schema":{}}}}}}},"/v1/authorize":{"post":{"tags":["crate::api::authorize"],"summary":"Authorize endpoint - evaluates permission queries for users","operationId":"authorize","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthorizeRequest"}}},"required":true},"responses":{"200":{"description":"Authorization successful","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthorizeResponseWrapper"}}}},"400":{"description":"Invalid query format"},"500":{"description":"Internal server error"}}}}},"components":{"schemas":{"AddPermissionRequest":{"type":"object","required":["action","permission_state"],"properties":{"action":{"type":"string","description":"The action name (e.g., \"create_issue\", \"manage:assets:delete\")"},"grant_cascade_mode":{"allOf":[{"$ref":"#/components/schemas/GrantCascadeMode"}],"nullable":true},"permission_state":{"$ref":"#/components/schemas/PermissionState"},"scope_corporation_id":{"type":"integer","format":"int64","description":"Required for corporation-level groups, ignored for location/global groups","nullable":true}}},"AddPermissionResponse":{"type":"object","required":["message"],"properties":{"message":{"type":"string","description":"Success message"}}},"AuthorizationResponse":{"oneOf":[{"type":"object","required":["result"],"properties":{"result":{"type":"string","enum":["allow"]},"values":{"allOf":[{"$ref":"#/components/schemas/ScopeCollection"}],"nullable":true}}},{"type":"object","required":["result"],"properties":{"result":{"type":"string","enum":["deny"]}}}],"discriminator":{"propertyName":"result"}},"AuthorizeRequest":{"type":"object","required":["user_id","query"],"properties":{"query":{"type":"string","description":"The permission query in format \"action.scope\" (e.g., \"create_issue.global\", \"delete_asset.location:123\")"},"user_id":{"type":"integer","format":"int64","description":"The ID of the user to authorize"}}},"AuthorizeResponseWrapper":{"allOf":[{"$ref":"#/components/schemas/AuthorizationResponse"},{"type":"object"}]},"CreateCorporationRequest":{"type":"object","required":["name"],"properties":{"name":{"type":"string"}}},"CreateGroupResponse":{"type":"object","required":["id","message"],"properties":{"id":{"type":"integer","format":"int64","description":"The created group ID"},"message":{"type":"string","description":"Success message"}}},"CreateLocationRequest":{"type":"object","required":["name","corporation_id"],"properties":{"corporation_id":{"type":"integer","format":"int64"},"name":{"type":"string"}}},"CreatePermsGroupRequest":{"type":"object","required":["name"],"properties":{"corporation_id":{"type":"integer","format":"int64","description":"null if loc-owned or global","nullable":true},"location_id":{"type":"integer","format":"int64","description":"null if corp-owned or global","nullable":true},"name":{"type":"string"}}},"CreateUserRequest":{"type":"object","required":["email","name"],"properties":{"email":{"type":"string"},"name":{"type":"string"}}},"DeleteGroupResponse":{"type":"object","required":["message"],"properties":{"message":{"type":"string","description":"Success message"}}},"DeletePermissionRequest":{"type":"object","properties":{"scope_corporation_id":{"type":"integer","format":"int64","description":"Required for corporation permissions to specify which scope to delete","nullable":true}}},"DeletePermissionResponse":{"type":"object","required":["message"],"properties":{"message":{"type":"string","description":"Success message"}}},"GrantCascadeMode":{"type":"string","enum":["At","Within","AtAndWithin"]},"GroupHierarchyItem":{"type":"object","required":["id","name","priority"],"properties":{"corporation_id":{"type":"integer","format":"int64","description":"Corporation ID (null if not a corporation-level group)","nullable":true},"corporation_name":{"type":"string","description":"Corporation name (null if not associated with a corporation)","nullable":true},"id":{"type":"integer","format":"int64","description":"Group ID"},"location_id":{"type":"integer","format":"int64","description":"Location ID (null if not a location-level group)","nullable":true},"location_name":{"type":"string","description":"Location name (null if not associated with a location)","nullable":true},"name":{"type":"string","description":"Group name"},"priority":{"type":"integer","format":"int32","description":"Priority in the hierarchy"}}},"GroupHierarchyResponse":{"type":"object","required":["group_id","parents","children"],"properties":{"children":{"type":"array","items":{"$ref":"#/components/schemas/GroupHierarchyItem"},"description":"Child groups (groups that inherit from this group)"},"group_id":{"type":"integer","format":"int64","description":"The group ID"},"parents":{"type":"array","items":{"$ref":"#/components/schemas/GroupHierarchyItem"},"description":"Parent groups (groups this group inherits from)"}}},"GroupPermission":{"type":"object","required":["action","permission_state","scope"],"properties":{"action":{"type":"string","description":"The action name (e.g., \"create_issue\", \"manage:assets:delete\")"},"grant_cascade_mode":{"allOf":[{"$ref":"#/components/schemas/GrantCascadeMode"}],"nullable":true},"permission_state":{"$ref":"#/components/schemas/PermissionState"},"scope":{"type":"string","description":"The scope type (\"global\", \"location\", \"corporation\")"},"scope_id":{"type":"integer","format":"int64","description":"The scope ID (null for global permissions)","nullable":true}}},"GroupPermissionsResponse":{"type":"object","required":["group_id","group_name","permissions"],"properties":{"group_id":{"type":"integer","format":"int64","description":"The group ID"},"group_name":{"type":"string","description":"The group name"},"permissions":{"type":"array","items":{"$ref":"#/components/schemas/GroupPermission"},"description":"List of permissions assigned to this group"}}},"ListGroupsResponse":{"type":"object","required":["groups"],"properties":{"groups":{"type":"array","items":{"$ref":"#/components/schemas/PermissionGroup"},"description":"List of permission groups"}}},"PermissionGroup":{"type":"object","required":["id","name"],"properties":{"corporation_id":{"type":"integer","format":"int64","description":"Corporation ID (null if not a corporation-level group)","nullable":true},"corporation_name":{"type":"string","description":"Corporation name (null if not associated with a corporation)","nullable":true},"id":{"type":"integer","format":"int64","description":"The group ID"},"location_id":{"type":"integer","format":"int64","description":"Location ID (null if not a location-level group)","nullable":true},"location_name":{"type":"string","description":"Location name (null if not associated with a location)","nullable":true},"name":{"type":"string","description":"The group name"}}},"PermissionState":{"type":"string","enum":["Allow","Deny","Passthrough"]},"QueryType":{"oneOf":[{"type":"object","required":["YesNo"],"properties":{"YesNo":{"type":"object","description":"no scope means Global","required":["action"],"properties":{"action":{"type":"string"},"scope":{"allOf":[{"$ref":"#/components/schemas/Scope"}],"nullable":true}}}}},{"type":"object","required":["AllowedLocations"],"properties":{"AllowedLocations":{"type":"object","description":"Returns the scopes as they are defined for the user's roles\nReturns the scopes, flattened down to the location level, meaning\nfor each corporation permissions, all locations under that corporation\nare included. (and, naturally, all the explicitly granted Location\npermissions are included)","required":["action"],"properties":{"action":{"type":"string"}}}}}]},"Scope":{"type":"object","required":["typ","id"],"properties":{"id":{"type":"integer","format":"int64","description":"The ID of the scoped entity"},"typ":{"$ref":"#/components/schemas/ScopeType"}}},"ScopeCollection":{"type":"object"},"ScopeType":{"type":"string","enum":["Location","Corporation"]},"SetGroupParentsResponse":{"type":"object","required":["message"],"properties":{"message":{"type":"string","description":"Success message"}}},"SetUserGroupsRequest":{"type":"object","required":["group_ids"],"properties":{"group_ids":{"type":"array","items":{"type":"integer","format":"int64"}}}},"UpdateGroupPermsRequest":{"type":"object","required":["extends_group_ids"],"properties":{"extends_group_ids":{"type":"array","items":{"type":"integer","format":"int64"},"description":"List of group IDs that this group should inherit from"}}}}}}