Doc 2708 api add api s to edit fin ops user permissions for accounts and policies

api/services/beci/authorization/paths/cbiV1AccessPolicy.yaml

@@ -0,0 +1,41 @@
+get:
+  tags:
+    - Organizations
+  summary: Get FinOps Authorization Policies
+  description: Get all available FinOps authorization policies.
+  parameters:
+    - name: targetOrganizationId
+      in: query
+      schema:
+        type: string
+    - name: paginationSize
+      in: query
+      description: number of items to include in the response
+      schema:
+        type: integer
+    - name: paginationKey
+      in: query
+      description: key used to fetch the next page of items
+      schema:
+        type: string
+  responses:
+    '200':
+      $ref: ../responses/get200cbiV1AccessPolicy.yaml
+    '400':
+      description: Invalid request error response. Adjust the request before retrying.
+      content:
+        application/json:
+          schema:
+            $ref: ../../../../commons/schemas/errorResponse.yaml
+    '500':
+      description: Internal error response. Please try again later.
+      content:
+        application/json:
+          schema:
+            $ref: ../../../../commons/schemas/errorResponse.yaml
+    '403':
+      description: Forbidden error response. Not permitted to call this API.
+      content:
+        application/json:
+          schema:
+            $ref: ../../../../commons/schemas/errorResponse.yaml

api/services/beci/authorization/paths/cbiV1AccessUserId.yaml

@@ -0,0 +1,97 @@
+get:
+  tags:
+    - Organizations
+  summary: Get FinOps Authorization For User
+  description: Get the user-level FinOps authorization configuration for the specified user.
+  parameters:
+    - name: userId
+      in: path
+      description: The userId to retrieve.
+      required: true
+      schema:
+        type: string
+    - name: includeChildOrgs
+      in: query
+      description: Include the configurations for child organizations.
+      schema:
+        type: boolean
+        default: false
+  responses:
+    '200':
+      $ref: ../responses/get200cbiV1AccessUserId.yaml
+    '404':
+      description: Not found error response. The requested resource does not exist.
+      content:
+        application/json:
+          schema:
+            $ref: ../../../../commons/schemas/errorResponse.yaml
+    '400':
+      description: Invalid request error response. Adjust the request before retrying.
+      content:
+        application/json:
+          schema:
+            $ref: ../../../../commons/schemas/errorResponse.yaml
+    '500':
+      description: Internal error response. Please try again later.
+      content:
+        application/json:
+          schema:
+            $ref: ../../../../commons/schemas/errorResponse.yaml
+    '403':
+      description: Forbidden error response. Not permitted to call this API.
+      content:
+        application/json:
+          schema:
+            $ref: ../../../../commons/schemas/errorResponse.yaml
+post:
+  tags:
+    - Organizations
+  summary: Update FinOps Authorization For User
+  description: Update the FinOps authorization configuration for a user.
+  parameters:
+    - name: userId
+      in: path
+      required: true
+      schema:
+        type: string
+  requestBody:
+    content:
+      application/json-patch+json:
+        schema:
+          $ref: ../schemas/userAuthConfigUpdateRequestModel.yaml
+      application/json:
+        schema:
+          $ref: ../schemas/userAuthConfigUpdateRequestModel.yaml
+      text/json:
+        schema:
+          $ref: ../schemas/userAuthConfigUpdateRequestModel.yaml
+      application/*+json:
+        schema:
+          $ref: ../schemas/userAuthConfigUpdateRequestModel.yaml
+  responses:
+    '200':
+      $ref: ../responses/post200cbiV1AccessUserId.yaml
+    '404':
+      description: Not found error response. The requested resource does not exist.
+      content:
+        application/json:
+          schema:
+            $ref: ../../../../commons/schemas/errorResponse.yaml
+    '400':
+      description: Invalid request error response. Adjust the request before retrying.
+      content:
+        application/json:
+          schema:
+            $ref: ../../../../commons/schemas/errorResponse.yaml
+    '500':
+      description: Internal error response. Please try again later.
+      content:
+        application/json:
+          schema:
+            $ref: ../../../../commons/schemas/errorResponse.yaml
+    '403':
+      description: Forbidden error response. Not permitted to call this API.
+      content:
+        application/json:
+          schema:
+            $ref: ../../../../commons/schemas/errorResponse.yaml

api/services/beci/authorization/responses/get200cbiV1AccessPolicy.yaml

@@ -0,0 +1,24 @@
+description: Successful response
+content:
+  application/json:
+    schema:
+      allOf:
+        - $ref: ../../../../commons/schemas/paginatedResponseItemWrapper.yaml
+        - type: object
+          properties:
+            request:
+              type: object
+              properties:
+                url:
+                  example: /cbi/v1/access/policy
+                method:
+                  example: GET
+            response:
+              type: object
+              properties:
+                items:
+                  type: array
+                  items:
+                    $ref: ../schemas/authPolicyResponseModel.yaml
+                kind:
+                  example: spotinst:cbi:authorization:policy

api/services/beci/authorization/responses/get200cbiV1AccessUserId.yaml

@@ -0,0 +1,24 @@
+description: Successful response
+content:
+  application/json:
+    schema:
+      allOf:
+        - $ref: ../../../../commons/schemas/responseItemWrapper.yaml
+        - type: object
+          properties:
+            request:
+              type: object
+              properties:
+                url:
+                  example: /cbi/v1/access/user/{userId}
+                method:
+                  example: GET
+            response:
+              type: object
+              properties:
+                items:
+                  type: array
+                  items:
+                    $ref: ../schemas/userAuthConfigResponseModel.yaml
+                kind:
+                  example: spotinst:cbi:authorization:user

api/services/beci/authorization/responses/post200cbiV1AccessUserId.yaml

@@ -0,0 +1,24 @@
+description: Successful response
+content:
+  application/json:
+    schema:
+      allOf:
+        - $ref: ../../../../commons/schemas/responseItemWrapper.yaml
+        - type: object
+          properties:
+            request:
+              type: object
+              properties:
+                url:
+                  example: /cbi/v1/access/user/{userId}
+                method:
+                  example: POST
+            response:
+              type: object
+              properties:
+                items:
+                  type: array
+                  items:
+                    $ref: ../schemas/userAuthConfigUpdateResponseModel.yaml
+                kind:
+                  example: spotinst:cbi:authorization:user

api/services/beci/authorization/schemas/authConfigAccount.yaml

@@ -0,0 +1,14 @@
+type: object
+properties:
+  id:
+    type: string
+    description: Provider account ID. This is the unique ID from the service provider, such as AWS, Azure.
+    nullable: true
+    example: aws~11111111111111
+  name:
+    type: string
+    description: Provider account's Name.
+    nullable: true
+    example: Test
+additionalProperties: false
+description: A cloud provider account ID.

api/services/beci/authorization/schemas/authConfigCostType.yaml

@@ -0,0 +1,14 @@
+type: object
+properties:
+  id:
+    type: string
+    description: Cost type's unique ID.
+    nullable: true
+    example: Effective
+  name:
+    type: string
+    description: Cost type's name.
+    nullable: true
+    example: Effective Cost
+additionalProperties: false
+description: A FinOps cost type.

api/services/beci/authorization/schemas/authConfigPolicy.yaml

@@ -0,0 +1,14 @@
+type: object
+properties:
+  id:
+    type: string
+    description: Policy's unique ID.
+    nullable: true
+    example: BE-ViewAllOnly
+  name:
+    type: string
+    description: Policy's name.
+    nullable: true
+    example: Billing Engine View All Only
+additionalProperties: false
+description: A FinOps authorization policy.

api/services/beci/authorization/schemas/authPolicyResponseModel.yaml

@@ -0,0 +1,23 @@
+type: object
+properties:
+  policyId:
+    type: string
+    description: Policy's unique ID.
+    nullable: true
+    example: BE-ViewAllOnly
+  policyName:
+    type: string
+    description: Policy's name.
+    nullable: true
+    example: Billing Engine View All Only
+  policyDescription:
+    type: string
+    description: Policy's description.
+    nullable: true
+    example: Grants authorization to view all features in Billing Engine. This policy requires and will automatically grant access to all accounts within Billing Engine.
+  requiresAccessToAllAccounts:
+    type: boolean
+    description: True if the policy requires the caller to have access to all accounts.
+    example: true
+additionalProperties: false
+description: The authorization policy response model. [kind/spotinst:cbi:authorization:policy]

api/services/beci/authorization/schemas/basicRequestListModification.yaml

@@ -0,0 +1,10 @@
+type: object
+properties:
+  id:
+    type: string
+    description: The entity's ID.
+    nullable: true
+  action:
+    $ref: listAction.yaml
+additionalProperties: false
+description: Represents the basic information for a list modification.

api/services/beci/authorization/schemas/costType.yaml

@@ -0,0 +1,7 @@
+enum:
+  - None
+  - Provider
+  - List
+  - Billed
+  - Effective
+type: string

api/services/beci/authorization/schemas/costTypeRequestListModification.yaml

@@ -0,0 +1,8 @@
+type: object
+properties:
+  id:
+    $ref: costType.yaml
+  action:
+    $ref: listAction.yaml
+additionalProperties: false
+description: The information for a cost type list modification.

api/services/beci/authorization/schemas/listAction.yaml

@@ -0,0 +1,5 @@
+enum:
+  - Add
+  - Remove
+type: string
+description: An action for managing items in a list.

api/services/beci/authorization/schemas/userAuthConfigChanges.yaml

@@ -0,0 +1,35 @@
+type: object
+properties:
+  resetCostTypes:
+    type: boolean
+    description: If true, the existing list of cost types is emptied prior to performing the changes requested.
+  costTypeChanges:
+    type: array
+    items:
+      $ref: costTypeRequestListModification.yaml
+    description: "List of cost types to add/remove.\r\nCost type applies to all accounts assigned to the user (regardless of how the user has access to the account).\r\nIf the user already has an existing list of cost types, the requested actions are applied to this existing\r\nlist unless resetCostTypes is true (which will clear all existing cost types first)."
+    nullable: true
+  organizationId:
+    type: string
+    description: "ID of the target Spot organization where the authorization configuration should be applied.\r\nOptional: Defaults to the caller's current Spot organization.\r\nIf specified, the ID must be one of these:\r\n- The caller's current Spot organization\r\n- A child Spot organization of the caller's current Spot organization"
+    nullable: true
+  resetAccounts:
+    type: boolean
+    description: "If true, the existing list of accounts is emptied prior to performing the \r\nchanges requested."
+  accountChanges:
+    type: array
+    items:
+      $ref: basicRequestListModification.yaml
+    description: "List of accounts to add/remove.\r\nIf user or group already has an existing list of accounts, the requested actions will be applied to this existing \r\nlist unless resetAccounts is true (which will clear all existing accounts first)."
+    nullable: true
+  resetPolicies:
+    type: boolean
+    description: If true, the existing list of policies is emptied prior to performing the changes requested.
+  policyChanges:
+    type: array
+    items:
+      $ref: basicRequestListModification.yaml
+    description: "List of policies to add/remove.\r\nIf user or group already has an existing list of policies, the requested actions will be applied to this existing \r\nlist unless resetPolicies is true (which will clear all existing policies first)."
+    nullable: true
+additionalProperties: false
+description: The FinOps authorization changes for a user.

api/services/beci/authorization/schemas/userAuthConfigResponseModel.yaml

@@ -0,0 +1,38 @@
+type: object
+properties:
+  organizationId:
+    type: string
+    description: User's Spot organization ID.
+    nullable: true
+    example: '11111111111111'
+  userId:
+    type: string
+    description: User's unique ID.
+    nullable: true
+    example: u-12345678
+  costTypes:
+    type: array
+    items:
+      $ref: authConfigCostType.yaml
+    description: Cost types assigned to this user.
+    nullable: true
+  accounts:
+    type: array
+    items:
+      $ref: authConfigAccount.yaml
+    description: Provider account IDs assigned to this user.
+    nullable: true
+    example:
+      - id: aws~11111111111111
+        name: Test
+  policies:
+    type: array
+    items:
+      $ref: authConfigPolicy.yaml
+    description: Authorization policies assigned to this user.
+    nullable: true
+    example:
+      - id: BE-ViewAllOnly
+        name: Billing Engine View All Only
+additionalProperties: false
+description: The user's FinOps authorization configuration response model. [kind/spotinst:cbi:authorization:user]

api/services/beci/authorization/schemas/userAuthConfigUpdateRequestModel.yaml

@@ -0,0 +1,6 @@
+type: object
+properties:
+  authChanges:
+    $ref: userAuthConfigChanges.yaml
+additionalProperties: false
+description: Request to update the FinOps authorization configuration for a specific user.