openapi: 3.0.3
info:
  description: Manages authorization rules and makes authorization decisions. <details> <summary><b>Overview:</b></summary> <p>The Authorization API encapsulates all activities that affect access to system functions and resources.</p> <p>This is a summary of the functional scope of this API:</p> <ul> <li>This API enables authorized users to define access by creating and managing authorization rules and shares.</li> <li>This API enables any principal that has the Secure permission for a particular object to create and manage authorization rules that directly target that object.</li> <li>This API enables any principal that has the Secure permission for a particular object to share that object. If re-sharing is enabled, each share recipient can extend the access that they receive to other users and groups.</li> <li>This API enforces authorization rules by making authorization decisions. Each decision is evaluated for a specific authorization context. The decision process is transparent to end users.</li> <li>This API enables authorized principals to define capabilities that create a role based authorization model.</li> <li>This API explains its authorization decisions by listing all of the rules and shares that contribute to each decision.</li> <li>This API does not manage access to CAS data (caslibs and tables) or CAS actions.</li> </ul> </details> <br> <details> <summary><b>Security</b></summary> <p>The Authorization API automatically protects any endpoints of any API that includes dependencies on it. This dependency intercepts calls to the endpoints and builds an authorization context, which is then sent to the Authorization API for evaluation. If the context is granted permission to perform the request action on that endpoint, it returns an HTTP status code of 200 and allows the request to proceed. If the context is prohibited, it returns an HTTP status code of 403 and the request does not continue further. This access is controlled by authorization rules that can be created through bootstrapping, by an administrative user, or by other methods.</p> </details> <br> <details> <summary><b>Terminology:</b></summary> <ul> <li><b>authorization:</b> the process by which a set of principals is evaluated against defined rules and a requested action to determine whether the user can perform the action.</li> <li><b>authorization context:</b> information about an authorization request (for example, a target URI, the HTTP headers and verb, the requestor's group memberships, or the time of the request).</li> <li><b>condition:</b> a logical Spring Expression Language (SpEL) expression that evaluates to either true or false. A rule that includes a condition applies only when the condition is true. For example, you can use a condition to make a rule applicable to only to the creator of an object.</li> <li><b>container:</b> an object that logically contains the URI of one or more member objects. In parent-child relationship between objects, a container represents a parent.</li> <li><b>decision:</b> a yes or no answer to an authorization request to perform a particular action. Each authorization decision is based on a specific authorization context.</li> <li><b>permission:</b> a specific action that a rule affects (for example read, update, delete, create, secure, add, or remove).</li> <li><b>principal:</b> an entity that represents an individual user or a group.</li> <li><b>rule:</b> an action or set of actions that is either permitted or prohibited for a given principal or set of principals. A rule can include a condition that limits the circumstances under which the rule applies.</li> <li><b>share:</b> a simplified abstraction of an authorization rule. Each share identifies a target object (resource), a recipient (principal), and a level of access (type). Each share is backed by a corresponding authorization rule. Shares can help users easily make resources available to each other.</li> <li><b>capability:</b> an association between a principal and a collection of authorization rules, providing the ability to grant role based access control (RBAC) for various actions.</li> </ul> </details> <br> <details> <summary><b>API Version</b></summary> <p>This is version 8 of the Authorization API.</p> <p> <b>Changes since version 7</b> <ul> <li>Added product to capability media types</li> </ul> </p> <p> <b>Changes since version 6</b> <ul> <li>Added parameterizedLinks for bulk decisions</li> </ul> </p> <p> <b>Changes since version 5</b> <ul> <li>Added capabilities endpoints</li> </ul> </p> <p> <b>Changes since version 4</b> <ul> <li>Added the 'enabled' flag to the share media type</li> </ul> </p> <p> <b>Changes since version 3</b> <ul> <li>Added sharing endpoints</li> <li>Added media type matching flags for explanation endpoints</li> <li>Added includeShares flag for explanation endpoints</li> </ul> </p> </details> <br> <details> <summary><b>Error Codes</b></summary> <p> <table> <tr> <th>HTTP Status Code</th> <th>Error Code</th> <th>Description</th> </tr> <tr> <td>400</td> <td>12600</td> <td>The patch 'test' operation failed.</td> </tr> <tr> <td>400</td> <td>12601</td> <td>Attempt to parse expression failed.</td> </tr> <tr> <td>400</td> <td>12700</td> <td>Request cannot be satisfied because sharing is disabled. </td> </tr> <tr> <td>500</td> <td>12800</td> <td>Cannot retrieve group membership info for group. </td> </tr> <tr> <td>500</td> <td>12801</td> <td>Cannot retrieve group membership info for user. </td> </tr> <tr> <td>404</td> <td>12802</td> <td>Capability could not be found.</td> </tr> <tr> <td>400</td> <td>12803</td> <td>Cannot assign principal to capability because principal is not a group.</td> </tr> <tr> <td>400</td> <td>12804</td> <td>Request has mismatched capability name.</td> </tr> <tr> <td>400</td> <td>12805</td> <td>Request includes an unsupported principal type.</td> </tr> <tr> <td>500</td> <td>12806</td> <td>Unable to convert authorization rule to capability.</td> </tr> <tr> <td>404</td> <td>12807</td> <td>Request to remove non-existent authorization rule.</td> </tr> <tr> <td>400</td> <td>12808</td> <td>Request to remove non-existent group.</td> </tr> <tr> <td>500</td> <td>12809</td> <td>Request from an unrecognized user ID.</td> </tr> <tr> <td>403</td> <td>12810</td> <td>Illegal attempt to elevate own permissions.</td> </tr> <tr> <td>415</td> <td>12811</td> <td>The Accept Item header sprecified an unsupported media type.</td> </tr> <tr> <td>428</td> <td>12812</td> <td>The request is missing the If-Match header.</td> </tr> <tr> <td>428</td> <td>12813</td> <td>The ETag is out-of-date.</td> </tr> </table> </p> </details>
  title: Authorization
  version: "8"
  termsOfService: https://www.sas.com/en_us/legal/copyright.html
  contact:
    name: SAS Developers
    url: https://developer.sas.com
    email: devex@sas.com
tags:
  - name: Rules
    description: Contains operations that create and manage authorization rules.
  - name: Decisions
    description: Contains operations that make and explain authorization decisions.
  - name: Shares
    description: Contains operations that concern shares.
  - name: Capabilities
    description: Contains operations that create and manager authorization capabilities.
  - name: Metadata
    description: Contains operations that provide information about this API.
paths:
  /:
    get:
      operationId: root
      responses:
        "200":
          description: The request succeeded.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
          content:
            application/vnd.sas.api+json:
              schema:
                $ref: "#/components/schemas/api"
              examples:
                api:
                  $ref: "#/components/examples/api"
            application/json:
              schema:
                $ref: "#/components/schemas/api"
              examples:
                api:
                  $ref: "#/components/examples/api"
      summary: Get list of links that this API supports
      description: Clients should use this top-level endpoint and the appropriate link relationship to find the specific endpoint of interest.
      tags:
        - Metadata
  /decisions:
    post:
      summary: Obtain an authorization decision
      description: Determines whether a specified principal is authorized to perform a specified action in a specified context. The response is either true (the action is authorized) or false (the action is not authorized).
      tags:
        - Decisions
      operationId: createAuthorizationDecision
      requestBody:
        content:
          application/vnd.sas.authorization.context+json:
            schema:
              $ref: "#/components/schemas/authorizationContextPerm"
            examples:
              createDecision:
                $ref: "#/components/examples/createDecision"
          application/json:
            schema:
              $ref: "#/components/schemas/authorizationContextPerm"
            examples:
              createDecision:
                $ref: "#/components/examples/createDecision"
        description: The requested action and contextual details.
        required: true
      responses:
        "200":
          description: Always returned if the request is successful and the request's Accept header is application/vnd.sas.authorization.direct.decision+json. However, if the Accept header is application/json or application/vnd.sas.authorization.direct.decision+json, 200 is returned only if the request is successful and the decision is `true`.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Location:
              description: Relative URI of the rule's path.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.decision+json:
              examples:
                decisionResponse:
                  $ref: "#/components/examples/decisionResponse"
              schema:
                type: boolean
            application/vnd.sas.authorization.direct.decision+json:
              examples:
                decisionResponse:
                  $ref: "#/components/examples/decisionResponse"
              schema:
                type: boolean
            application/json:
              examples:
                decisionResponse:
                  $ref: "#/components/examples/decisionResponse"
              schema:
                type: boolean
            text/plain:
              examples:
                decisionResponse:
                  $ref: "#/components/examples/decisionResponse"
              schema:
                type: boolean
        "201":
          description: Always returned if the request is successful and the request's Accept header is text/plain
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Location:
              description: Relative URI of the rule's path.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.decision+json:
              examples:
                decisionResponse:
                  $ref: "#/components/examples/decisionResponse"
              schema:
                type: boolean
            application/vnd.sas.authorization.direct.decision+json:
              examples:
                decisionResponse:
                  $ref: "#/components/examples/decisionResponse"
              schema:
                type: boolean
            application/json:
              examples:
                decisionResponse:
                  $ref: "#/components/examples/decisionResponse"
              schema:
                type: boolean
            text/plain:
              examples:
                decisionResponse:
                  $ref: "#/components/examples/decisionResponse"
              schema:
                type: boolean
        "400":
          description: The request was invalid. Returned if the authorization context is invalid.
        "403":
          description: Returned if the request's Accept header is application/vnd.sas.authorization.decision+json or application/json and the request was completed successfully but the authorization decision is `false`.
          content:
            application/vnd.sas.authorization.decision+json:
              examples:
                decisionResponseFail:
                  $ref: "#/components/examples/decisionResponseFail"
              schema:
                type: boolean
            application/vnd.sas.authorization.direct.decision+json:
              examples:
                decisionResponseFail:
                  $ref: "#/components/examples/decisionResponseFail"
              schema:
                type: boolean
            application/json:
              examples:
                decisionResponseFail:
                  $ref: "#/components/examples/decisionResponseFail"
              schema:
                type: boolean
            text/plain:
              examples:
                decisionResponseFail:
                  $ref: "#/components/examples/decisionResponseFail"
              schema:
                type: boolean
  /decisions#explanation:
    post:
      summary: Obtain authorization decisions with explanations
      description: Provides authorization information for specified principals in a specified context. Each explanation identifies the rules that are relevant to a particular authorization decision and includes details (such as parent containment) if applicable. By default, explanations are provided for only principals to whom relevant authorization rules are directly assigned.
      tags:
        - Decisions
      operationId: createExplanation
      parameters:
        - description: The ID of an additional user to include. You can specify this parameter multiple times.
          in: query
          name: additionalUser
          required: false
          explode: true
          schema:
            type: array
            items:
              type: string
        - description: The ID of an additional group to include. You can specify this parameter multiple times.
          in: query
          name: additionalGroup
          required: false
          explode: true
          schema:
            type: array
            items:
              type: string
        - description: Whether to provide explanations for system accounts (such as sasapp and sas.ops-agentsrv).
          in: query
          name: includeSystemAccounts
          required: false
          schema:
            type: boolean
            default: false
        - description: String to match rules' contentType against.
          in: query
          name: contentType
          required: false
          schema:
            type: string
        - description: String to match rules' acceptType against.
          in: query
          name: acceptType
          required: false
          schema:
            type: string
        - description: String to match rules' acceptItemType against.
          in: query
          name: acceptItemType
          required: false
          schema:
            type: string
        - description: Whether to include explanations for shares.
          in: query
          name: includeShares
          required: false
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          application/vnd.sas.selection+json:
            schema:
              $ref: "#/components/schemas/selection"
            examples:
              selection:
                summary: Select specific URIs
                value:
                  type: uri
                  resources:
                    - /types/types
                  version: 1
        description: The resources for which explanations are requested. Only 'uri' type selections (relative object URIs) are supported.
        required: true
      responses:
        "200":
          description: The request succeeded.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Location:
              description: Relative URI of the rule's path.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.explanations+json:
              examples:
                explanationResponse:
                  $ref: "#/components/examples/explanationResponse"
              schema:
                $ref: "#/components/schemas/explanations"
        "400":
          description: The request was invalid. Returned if the format of the request does not match the schema for the media type used.
  /decisions#hypotheticalExplanation:
    post:
      summary: Obtain predictive authorization decisions
      description: Provides decisions and explanations that incorporate unsaved changes to authorization rules. A client enters an array of PATCH input that describes unsaved changes to authorization rules. The returned information is hypothetical in the sense that it reflects the effects of unsaved changes.
      tags:
        - Decisions
      operationId: createHypotheticalExplanation
      parameters:
        - description: The ID of an additional user to include. You can specify this parameter multiple times.
          in: query
          name: additionalUser
          required: false
          explode: true
          schema:
            type: array
            items:
              type: string
        - description: The ID of an additional group to include. You can specify this parameter multiple times.
          in: query
          name: additionalGroup
          required: false
          explode: true
          schema:
            type: array
            items:
              type: string
        - description: Whether to provide hypothetical explanations for system accounts (such as sasapp and sas.ops-agentsrv).
          in: query
          name: includeSystemAccounts
          required: false
          schema:
            type: boolean
            default: false
        - description: String to match rules' contentType against.
          in: query
          name: contentType
          required: false
          schema:
            type: string
        - description: String to match rules' acceptType against.
          in: query
          name: acceptType
          required: false
          schema:
            type: string
        - description: String to match rules' acceptItemType against.
          in: query
          name: acceptItemType
          required: false
          schema:
            type: string
        - description: Whether to include explanations for shares.
          in: query
          name: includeShares
          required: false
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          application/vnd.sas.authorization.explanation.hypothetical+json:
            schema:
              $ref: "#/components/schemas/hypothetical"
            examples:
              simple:
                summary: Impact of removing a rule
                value:
                  patch:
                    - op: test
                      path: /authorization/rules/00d038a0-e19c-44cf-8fd4-d35a8e112124
                      value:
                        type: grant
                        permissions:
                          - create
                          - update
                        objectUri: /workflow/definitions
                        principalType: group
                        principal: group1
                    - op: remove
                      path: /authorization/rules/00d038a0-e19c-44cf-8fd4-d35a8e112124
                  uris:
                    - /workflow/definitions
        description: A hypothetical object that consists of one or more URIs and one or more new rules.
        required: true
      responses:
        "200":
          description: The request succeeded.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Location:
              description: Relative URI of the rule's path.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.explanations+json:
              examples:
                explanationResponse:
                  $ref: "#/components/examples/explanationResponse"
              schema:
                $ref: "#/components/schemas/explanations"
        "400":
          description: The request was invalid. Returned if the format of the request does not match the schema for the media type used.
  /decisions#bulk:
    post:
      summary: Obtain multiple authorization decisions
      description: Determines which actions a specified principal is authorized to perform in a specified context. Each requested action is evaluated against its associated permission. Granted and prohibited actions are returned in separate lists.
      tags:
        - Decisions
      operationId: createAuthorizationDecisions
      requestBody:
        content:
          application/vnd.sas.authorization.bulk.context+json:
            schema:
              $ref: "#/components/schemas/bulkAuthorizationContext"
            examples:
              createBulkDecisionBody:
                $ref: "#/components/examples/createBulkDecisionBody"
              createBulkParameterizedLinkDecisionBody:
                $ref: "#/components/examples/createBulkParameterizedLinkDecisionBody"
        description: >-
          The requested actions and contextual details. Bulk information must be included as a  map of permissions to arrays of links.  These maps must be provided in the bulkLinks or parameterizedLinks members as appropriate for the request.  Use of bulkLinks and parameterizedLinks in a single request is supported.

          <p><b>Note:</b>  Each of the links provided in the request must identify the resource by populating the uri member of the link. The href member is not used. </p>
        required: true
      responses:
        "200":
          description: The request succeeded.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Location:
              description: Relative URI of the rule's path.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.authorized.links+json:
              schema:
                $ref: "#/components/schemas/authorizedLinks"
              examples:
                createBulkDecisionResponse:
                  $ref: "#/components/examples/createBulkDecisionResponse"
                createBulkParameterizedLinkDecisionResponse:
                  $ref: "#/components/examples/createBulkParameterizedLinkDecisionResponse"
        "400":
          description: The request was invalid. Returned if no URIs are provided in the context to authorize.
  /rules:
    get:
      summary: Get authorization rules
      description: Retrieves some or all authorization rules, with or without paging.
      tags:
        - Rules
      operationId: getRules
      parameters:
        - description: "The index number for the first rule in a page. default: 0"
          in: query
          name: start
          schema:
            type: integer
            default: 0
        - description: The maximum number of rules to return per page.
          in: query
          name: limit
          schema:
            type: integer
            default: 50
        - description: "Constraints on which rules to retrieve.  Here are the supported filters and criteria: <ul> <li>principal (eq, ne, startsWith, endsWith, contains)</li> <li>type (eq, ne)</li> <li>principalType (eq, ne)</li> <li>permissions (in)</li> <li>objectUri (eq, ne, startsWith, endsWith, contains)</li> <li>containerUri (eq, ne, startsWith, endsWith, contains)</li> <li>mediaType (eq, ne, startsWith, endsWith, contains)</li> <li>enabled (eq, ne)</li></ul>"
          in: query
          name: filter
          schema:
            type: string
            format: filter-criteria
        - description: Instructions for sorting the retrieved rules.  You can sort by name or description in ascending or descending order.
          in: query
          name: sortBy
          schema:
            type: string
            format: sort-criteria
        - name: Accept-Item
          in: header
          required: false
          description: If provided, returns the items in the requested format. Supported media types are:<br> <ul> <li>application/vnd.sas.authorization.rule+json;version=1</li> <li>application/vnd.sas.authorization.rule+json;version=2</li> <li>application/vnd.sas.authorization.rule+json;version=3</li> <li>application/vnd.sas.authorization.rule+json;version=4</li> <li>application/vnd.sas.authorization.rule+json;version=5</li> <li>application/vnd.sas.authorization.rule+json;version=6</li> <li>application/vnd.sas.authorization.rule+json;version=7</li> <li>application/vnd.sas.authorization.rule+json;version=8</li> <li>application/vnd.sas.authorization.rule+json;version=9</li> <li>application/vnd.sas.authorization.rule+json;version=10</li> </ul>
          schema:
            type: string
      responses:
        "200":
          description: The request succeeded.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
          content:
            application/vnd.sas.collection+json:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRuleCollection"
              examples:
                getRule:
                  $ref: "#/components/examples/getRule"
            application/json:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRuleCollection"
              examples:
                getRule:
                  $ref: "#/components/examples/getRule"
        "400":
          description: The request was invalid. Returned if any query criteria (sortBy, filter, limit, start) are invalid.
    post:
      summary: Create a new authorization rule
      description: Creates a new authorization rule that has a system-generated ID.
      tags:
        - Rules
      operationId: createRule
      parameters:
        - name: Content-Type
          in: header
          required: false
          description: Specifies the format of the incoming rule. Supported media types are:<br> <ul> <li>application/vnd.sas.authorization.rule+json;version=1</li> <li>application/vnd.sas.authorization.rule+json;version=2</li> <li>application/vnd.sas.authorization.rule+json;version=3</li> <li>application/vnd.sas.authorization.rule+json;version=4</li> <li>application/vnd.sas.authorization.rule+json;version=5</li> <li>application/vnd.sas.authorization.rule+json;version=6</li> <li>application/vnd.sas.authorization.rule+json;version=7</li> <li>application/vnd.sas.authorization.rule+json;version=8</li> <li>application/vnd.sas.authorization.rule+json;version=9</li> <li>application/vnd.sas.authorization.rule+json;version=10</li> </ul>
          schema:
            type: string
        - name: Accept
          in: header
          required: false
          description: Specifies the desired format of the returned rule. Supported media types are:<br> <ul> <li>application/vnd.sas.authorization.rule+json;version=1</li> <li>application/vnd.sas.authorization.rule+json;version=2</li> <li>application/vnd.sas.authorization.rule+json;version=3</li> <li>application/vnd.sas.authorization.rule+json;version=4</li> <li>application/vnd.sas.authorization.rule+json;version=5</li> <li>application/vnd.sas.authorization.rule+json;version=6</li> <li>application/vnd.sas.authorization.rule+json;version=7</li> <li>application/vnd.sas.authorization.rule+json;version=8</li> <li>application/vnd.sas.authorization.rule+json;version=9</li> <li>application/vnd.sas.authorization.rule+json;version=10</li> </ul>
          schema:
            type: string
      requestBody:
        content:
          application/vnd.sas.authorization.rule+json:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: Simple rule
                value:
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 10
          application/vnd.sas.authorization.rule+json;version=1:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: Simple rule
                value:
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 1
          application/vnd.sas.authorization.rule+json;version=2:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: Simple rule
                value:
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 2
          application/vnd.sas.authorization.rule+json;version=3:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: Simple rule
                value:
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 3
          application/vnd.sas.authorization.rule+json;version=4:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: Simple rule
                value:
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 4
          application/vnd.sas.authorization.rule+json;version=5:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: Simple rule
                value:
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 5
          application/vnd.sas.authorization.rule+json;version=6:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: Simple rule
                value:
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 6
          application/vnd.sas.authorization.rule+json;version=7:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: Simple rule
                value:
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 7
          application/vnd.sas.authorization.rule+json;version=8:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: Simple rule
                value:
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 8
          application/vnd.sas.authorization.rule+json;version=9:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: Simple rule
                value:
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 9
          application/vnd.sas.authorization.rule+json;version=10:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: Simple rule
                value:
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 10
          application/json:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: Simple rule
                value:
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 10
        description: The properties of the new rule.
        required: true
      responses:
        "201":
          description: A new authorization rule was created.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
            Location:
              description: Relative URI of the rule's path.
              schema:
                type: string
            ETag:
              description: The entity tag for the rule.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.rule+json:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                createRule:
                  $ref: "#/components/examples/createRule"
            application/vnd.sas.authorization.rule+json;version=1:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                createRule:
                  $ref: "#/components/examples/createRule"
            application/vnd.sas.authorization.rule+json;version=2:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                createRule:
                  $ref: "#/components/examples/createRule"
            application/vnd.sas.authorization.rule+json;version=3:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                createRule:
                  $ref: "#/components/examples/createRule"
            application/vnd.sas.authorization.rule+json;version=4:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                createRule:
                  $ref: "#/components/examples/createRule"
            application/vnd.sas.authorization.rule+json;version=5:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                createRule:
                  $ref: "#/components/examples/createRule"
            application/vnd.sas.authorization.rule+json;version=6:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                createRule:
                  $ref: "#/components/examples/createRule"
            application/vnd.sas.authorization.rule+json;version=7:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                createRule:
                  $ref: "#/components/examples/createRule"
            application/vnd.sas.authorization.rule+json;version=8:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                createRule:
                  $ref: "#/components/examples/createRule"
            application/vnd.sas.authorization.rule+json;version=9:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                createRule:
                  $ref: "#/components/examples/createRule"
            application/vnd.sas.authorization.rule+json;version=10:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                createRule:
                  $ref: "#/components/examples/createRule"
            application/vnd.sas.error:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                createRule:
                  $ref: "#/components/examples/createRule"
            application/json:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                createRule:
                  $ref: "#/components/examples/createRule"
        "400":
          description: The request was invalid. Returned if the specified authorization rule is invalid.
    patch:
      summary: Patch authorization rules
      description: >-
        Performs a set of rule management actions as specified in a JSON patch. The actions are performed synchronously and transactionally. A resource collection of all created and revised rules is returned. If the patch is not successfully applied, changes are rolled back.

          For every action, the patch must specify an operation (add, replace, remove,
        test, or copy) and a target URI (for example, /authorization/rules/{ruleId} or, to create a new rule, /authorization/rules). Each add and replace operation requires a valid rule representation. Each copy operation requires a 'from' URI that identifies the original rule.

          You cannot save duplicate rules, so a patch that includes a copy operation
        must also include an operation that modifies or deletes either the original rule or the new rule.

          You can combine operations to migrate existing rules. For example, you might
        copy a rule, then update the new rule (using the 'replace' operation), and then delete the original rule.

          New rules that do not yet have known rule IDs are added to a zero-indexed
        ordered list. To reference such rules, use the substitution token @CREATED#@ (where '#' is the index of the target rule).
      tags:
        - Rules
      operationId: patchRules
      requestBody:
        content:
          application/json-patch:
            schema:
              description: Array of patch operations to apply to the existing rules.
              items:
                $ref: "#/components/schemas/rulePatchOperation"
              type: array
            examples:
              patch:
                summary: Simple patch
                value:
                  - op: test
                    path: /authorization/rules/00d038a0-e19c-44cf-8fd4-d35a8e112124
                    value:
                      type: grant
                      permissions:
                        - create
                        - update
                      objectUri: /workflow/definitions
                      principalType: group
                      principal: group1
                  - op: remove
                    path: /authorization/rules/00d038a0-e19c-44cf-8fd4-d35a8e112124
          application/json:
            schema:
              description: Array of patch operations to apply to the existing rules.
              items:
                $ref: "#/components/schemas/rulePatchOperation"
              type: array
            examples:
              patch:
                summary: Simple patch
                value:
                  - op: test
                    path: /authorization/rules/00d038a0-e19c-44cf-8fd4-d35a8e112124
                    value:
                      type: grant
                      permissions:
                        - create
                        - update
                      objectUri: /workflow/definitions
                      principalType: group
                      principal: group1
                  - op: remove
                    path: /authorization/rules/00d038a0-e19c-44cf-8fd4-d35a8e112124
        description: JSON patch describing operations to perform and identifying the target rules.
        required: true
      responses:
        "200":
          description: The request succeeded. Returned if the patch was applied successfully.
          content:
            application/vnd.sas.collection+json:
              schema:
                $ref: "#/components/schemas/ruleJob"
              examples:
                patchRules:
                  $ref: "#/components/examples/patchRules"
                migrateRule:
                  $ref: "#/components/examples/migrateRule"
            application/json:
              schema:
                $ref: "#/components/schemas/ruleJob"
              examples:
                patchRules:
                  $ref: "#/components/examples/patchRules"
                migrateRule:
                  $ref: "#/components/examples/migrateRule"
        "400":
          description: The request was invalid. Returned if the specified rule patch is invalid.
          content:
            application/vnd.sas.collection+json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "412":
          description: Precondition failed
          content:
            application/vnd.sas.collection+json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "422":
          description: Returned if the patch request is syntactically valid but would result in a resource state that is inconsistent or invalid.
          content:
            application/vnd.sas.collection+json:
              examples:
                errorResponse422:
                  $ref: "#/components/examples/errorResponse422"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse422:
                  $ref: "#/components/examples/errorResponse422"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "428":
          description: Precondition required
          content:
            application/vnd.sas.collection+json:
              examples:
                errorResponse428:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse428:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
  "/rules/{ruleId}":
    delete:
      summary: Delete an authorization rule
      description: Deletes a specified authorization rule.
      tags:
        - Rules
      operationId: deleteRule
      parameters:
        - description: The ID of the rule to delete.
          in: path
          name: ruleId
          required: true
          schema:
            type: string
      responses:
        "204":
          description: The authorization rule was deleted.
        "404":
          description: No authorization rule with the specified ID was found.
          content:
            application/vnd.sas.authorization.rule+json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
    get:
      summary: Get an authorization rule
      description: Retrieves a specified authorization rule.
      tags:
        - Rules
      operationId: getRule
      parameters:
        - description: The ID of the rule to retrieve.
          in: path
          name: ruleId
          required: true
          schema:
            type: string
      responses:
        "200":
          description: The request succeeded.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
            Location:
              description: Relative URI of the rule's path.
              schema:
                type: string
            ETag:
              description: The entity tag for the rule.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.rule+json:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                getRule:
                  $ref: "#/components/examples/getRule"
            application/json:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                getRule:
                  $ref: "#/components/examples/getRule"
        "404":
          description: No authorization rule with the specified ID was found.
          content:
            application/vnd.sas.authorization.rule+json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
    put:
      summary: Update or create an authorization rule
      description: Updates an authorization rule by completely replacing it with specified values. Or, if there is no rule that has the specified ID, creates a new rule using that ID.
      tags:
        - Rules
      operationId: updateRule
      parameters:
        - description: The ID of the rule to update or create.
          in: path
          name: ruleId
          required: true
          schema:
            type: string
        - description: The entity tag obtained from the most recent `ETag` response header. Must match the current entity tag for the rule.
          in: header
          name: If-Match
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.sas.authorization.rule+json:
            schema:
              $ref: "#/components/schemas/identifiableAuthorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 10
          application/json:
            schema:
              $ref: "#/components/schemas/identifiableAuthorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 10
        description: The properties of the rule.
        required: true
      responses:
        "200":
          description: The object was updated.
          headers:
            ETag:
              description: The entity tag for the rule.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.rule+json:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                getRule:
                  $ref: "#/components/examples/getRule"
            application/json:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                getRule:
                  $ref: "#/components/examples/getRule"
        "201":
          description: A new authorization rule was created.
          headers:
            Location:
              description: Relative URI of the rule's path.
              schema:
                type: string
            ETag:
              description: The entity tag for the rule.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.rule+json:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                getRule:
                  $ref: "#/components/examples/getRule"
            application/json:
              schema:
                $ref: "#/components/schemas/savedAuthorizationRule"
              examples:
                getRule:
                  $ref: "#/components/examples/getRule"
        "400":
          description: The request was invalid. Returned if the format of the request does not match the schema for the media type used. Also can be returned if the ID passed in the request payload does not match the ID in the URI.
        "412":
          description: Precondition failed
          content:
            application/vnd.sas.error+json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/vnd.sas.collection+json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "428":
          description: Precondition required
          content:
            application/vnd.sas.error+json:
              examples:
                errorResponse428:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/vnd.sas.collection+json:
              examples:
                errorResponse428:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse428:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
  /rules/jobs:
    post:
      summary: Create a rule job
      description: Creates an asynchronous job that performs one or more rule management actions (such as creating, updating, and deleting authorization rules. Each update and delete action must specify the rule ID for an existing rule. All actions are performed in a single request. The request returns a vnd.sas.authorization.rule.job that contains a 'self' and 'ruleJobState' links that can be used to retrieve the entire job or to check the current state of the running job.
      tags:
        - Rules
      operationId: createRuleJob
      parameters:
        - name: Accept
          in: header
          required: false
          description: "Specifies the desired format of the returned rule job. Supported media types are: <ul> <li>application/json</li> <li>application/vnd.sas.authorization.rule.job+json</li> <li>application/vnd.sas.authorization.rule.job+json;version=1</li> <li>application/vnd.sas.authorization.rule.job+json;version=2</li> </ul>"
          schema:
            type: string
        - name: Content-Type
          in: header
          required: false
          description: "Specifies the format of the incoming rule job. Supported media types are: <ul> <li>application/json</li> <li>application/vnd.sas.authorization.rule.job+json</li> <li>application/vnd.sas.authorization.rule.job+json;version=1</li> <li>application/vnd.sas.authorization.rule.job+json;version=2</li> </ul>"
          schema:
            type: string
      requestBody:
        content:
          application/vnd.sas.authorization.rule.job+json:
            schema:
              $ref: "#/components/schemas/ruleJob"
            examples:
              createMonitorRuleJobBody:
                $ref: "#/components/examples/createMonitorRuleJobBody"
          application/vnd.sas.authorization.rule.job+json;version=1:
            schema:
              $ref: "#/components/schemas/ruleJob"
            examples:
              createMonitorRuleJobBody:
                $ref: "#/components/examples/createMonitorRuleJobBody"
          application/vnd.sas.authorization.rule.job+json;version=2:
            schema:
              $ref: "#/components/schemas/ruleJob"
            examples:
              createMonitorRuleJobBody:
                $ref: "#/components/examples/createMonitorRuleJobBody"
          application/json:
            schema:
              $ref: "#/components/schemas/ruleJob"
            examples:
              createMonitorRuleJobBody:
                $ref: "#/components/examples/createMonitorRuleJobBody"
        description: Instructions to create, update, and delete specified rules.
        required: true
      responses:
        "202":
          description: Accepted. Returned if the rule job is created.
          headers:
            Location:
              description: Relative URI of the rule job's path.
              schema:
                type: string
            Content-Type:
              description: Content type of the returned object.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.rule.job+json:
              schema:
                $ref: "#/components/schemas/ruleJob"
              examples:
                createMonitorRuleJobResponse:
                  $ref: "#/components/examples/createMonitorRuleJobResponse"
            application/vnd.sas.authorization.rule.job+json;version=1:
              schema:
                $ref: "#/components/schemas/ruleJob"
              examples:
                createMonitorRuleJobResponse:
                  $ref: "#/components/examples/createMonitorRuleJobResponse"
            application/vnd.sas.authorization.rule.job+json;version=2:
              schema:
                $ref: "#/components/schemas/ruleJob"
              examples:
                createMonitorRuleJobResponse:
                  $ref: "#/components/examples/createMonitorRuleJobResponse"
            application/json:
              schema:
                $ref: "#/components/schemas/ruleJob"
              examples:
                createMonitorRuleJobResponse:
                  $ref: "#/components/examples/createMonitorRuleJobResponse"
        "400":
          description: The request was invalid. Returned if the specified rule job is invalid.
          content:
            application/vnd.sas.authorization.rule.job+json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/vnd.sas.authorization.rule.job+json;version=1:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/vnd.sas.authorization.rule.job+json;version=2:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
  "/rules/jobs/{jobId}":
    get:
      summary: Get information about a rule job
      description: Retrieves descriptive information about a specified rule job.
      tags:
        - Rules
      operationId: getRuleJob
      parameters:
        - description: The ID of the rule job.
          in: path
          name: jobId
          required: true
          schema:
            type: string
      responses:
        "200":
          description: The specified rule job exists.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.rule.job+json:
              examples:
                createMonitorRuleJobResponse:
                  $ref: "#/components/examples/createMonitorRuleJobResponse"
              schema:
                $ref: "#/components/schemas/ruleJob"
            application/json:
              examples:
                createMonitorRuleJobResponse:
                  $ref: "#/components/examples/createMonitorRuleJobResponse"
              schema:
                $ref: "#/components/schemas/ruleJob"
        "404":
          description: No rule job with the specified ID was found.
          content:
            application/vnd.sas.authorization.rule.job+json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
    delete:
      summary: Delete a rule job
      description: Deletes a specified rule job.
      tags:
        - Rules
      operationId: deleteRuleJob
      parameters:
        - description: The ID of the rule job to delete.
          in: path
          name: jobId
          required: true
          schema:
            type: string
      responses:
        "204":
          description: The rule job was deleted.
        "404":
          description: No rule job with the specified ID was found.
          content:
            application/vnd.sas.authorization.rule.job+json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
  "/rules/jobs/{jobId}/state":
    get:
      summary: Get the state of a rule job
      description: Retrieves status information for a specified rule job.
      tags:
        - Rules
      operationId: getRuleJobState
      parameters:
        - description: The ID of the rule job.
          in: path
          name: jobId
          required: true
          schema:
            type: string
      responses:
        "200":
          description: "The rule job with the specified ID exists. The value of the response is the state of the overall job: pending, running, completed, completedWithErrors, or failed."
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
          content:
            text/plain:
              schema:
                type: string
                description: Defines the current state of an action.
                enum:
                  - pending
                  - running
                  - completed
                  - completedWithErrors
                  - failed
              examples:
                response:
                  summary: Pending status
                  value: pending
        "404":
          description: No rule job with the specified ID was found.
          content:
            application/vnd.sas.authorization.rule.job+json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
  /localizations/types:
    get:
      operationId: getLocalizedRuleTypes
      parameters:
        - name: Accept-Language
          in: header
          description: Enumerates the language(s) the client prefers the response in.  This can be used to provide localized data where available.
          schema:
            type: string
      responses:
        "200":
          description: The request succeeded.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
          content:
            application/vnd.sas.collection+json:
              examples:
                localizationResponse:
                  $ref: "#/components/examples/localizationResponse"
              schema:
                $ref: "#/components/schemas/localizedValueCollection"
            application/json:
              examples:
                localizationResponse:
                  $ref: "#/components/examples/localizationResponse"
              schema:
                $ref: "#/components/schemas/localizedValueCollection"
      summary: Get a localized list of rule types
      description: Provides localized versions of type enums for use as display labels in a graphical user interface. The names are localized to the accept-language of the header.
      tags:
        - Metadata
  /localizations/principalTypes:
    get:
      operationId: getLocalizedPrincipalTypes
      parameters:
        - name: Accept-Language
          in: header
          description: Enumerates the language(s) the client prefers the response in.  This can be used to provide localized data where available.
          schema:
            type: string
      responses:
        "200":
          description: The request succeeded.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
          content:
            application/vnd.sas.collection+json:
              examples:
                localizationResponse:
                  $ref: "#/components/examples/localizationResponse"
              schema:
                $ref: "#/components/schemas/localizedValueCollection"
            application/json:
              examples:
                localizationResponse:
                  $ref: "#/components/examples/localizationResponse"
              schema:
                $ref: "#/components/schemas/localizedValueCollection"
      summary: Get a localized list of principal types
      description: Provides localized versions of principal type enums for use as display labels in a graphical user interface. The names are localized to the accept-language of the header.
      tags:
        - Metadata
  /localizations/permissions:
    get:
      operationId: getLocalizedPermissions
      parameters:
        - name: Accept-Language
          in: header
          description: Enumerates the language(s) the client prefers the response in.  This can be used to provide localized data where available.
          schema:
            type: string
      responses:
        "200":
          description: The request succeeded.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
          content:
            application/vnd.sas.collection+json:
              examples:
                localizationResponse:
                  $ref: "#/components/examples/localizationResponse"
              schema:
                $ref: "#/components/schemas/localizedValueCollection"
            application/json:
              examples:
                localizationResponse:
                  $ref: "#/components/examples/localizationResponse"
              schema:
                $ref: "#/components/schemas/localizedValueCollection"
      summary: Get a localized list of permission names
      description: Provides localized versions of permission enums for use as display labels in a graphical user interface. The names are localized to the accept-language of the header.
      tags:
        - Metadata
  /commons/validations/conditions:
    post:
      summary: Validate the syntax of a specified rule condition
      description: Determines whether a client-supplied string is a properly formatted Spring Expression Language (SpEL) expression.
      tags:
        - Rules
      operationId: validateCondition
      externalDocs:
        description: Spring Expression Language Documentation.
        url: https://docs.spring.io/spring/docs/current/spring-framework-reference/html/expressions.html
      requestBody:
        content:
          text/plain:
            schema:
              type: string
            examples:
              condition:
                $ref: "#/components/examples/validateSpelCondition"
          application/json:
            schema:
              type: string
            examples:
              condition:
                $ref: "#/components/examples/validateSpelCondition"
        description: The string that constitutes a rule condition.
        required: true
      responses:
        "200":
          description: The request succeeded.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Location:
              description: Relative URI of the rule's path.
              schema:
                type: string
          content:
            application/vnd.sas.validation+json:
              examples:
                getValidation:
                  $ref: "#/components/examples/getValidation"
              schema:
                $ref: "#/components/schemas/validation"
        "400":
          description: The request was invalid.
  /commons/validations/rules:
    post:
      summary: Validate a new rule
      description: Determines whether a new authorization rule meets completeness and uniqueness requirements.
      tags:
        - Rules
      operationId: validateNewRule
      requestBody:
        content:
          application/vnd.sas.authorization.rule+json:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 10
          application/vnd.sas.authorization.rule+json;version=1:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 1
          application/vnd.sas.authorization.rule+json;version=2:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 2
          application/vnd.sas.authorization.rule+json;version=3:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 3
          application/vnd.sas.authorization.rule+json;version=4:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 4
          application/vnd.sas.authorization.rule+json;version=5:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 5
          application/vnd.sas.authorization.rule+json;version=6:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 6
          application/vnd.sas.authorization.rule+json;version=7:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 7
          application/vnd.sas.authorization.rule+json;version=8:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 8
          application/vnd.sas.authorization.rule+json;version=9:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 9
          application/vnd.sas.authorization.rule+json;version=10:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 10
          application/json:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 10
        description: The properties of the rule.
        required: true
      responses:
        "200":
          description: The request succeeded.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Location:
              description: Relative URI of the rule's path.
              schema:
                type: string
          content:
            application/vnd.sas.validation+json:
              examples:
                getValidation:
                  $ref: "#/components/examples/getValidation"
              schema:
                $ref: "#/components/schemas/validation"
        "400":
          description: The request was invalid.
  "/commons/validations/rules/{ruleId}":
    put:
      summary: Validate an updated rule
      description: Determines whether an updated authorization rule meets completeness and uniqueness requirements.
      tags:
        - Rules
      operationId: validateUpdateRule
      parameters:
        - description: The ID of the updated rule.
          in: path
          name: ruleId
          required: true
          schema:
            type: string
        - description: The entity tag obtained from the most recent `ETag` response header. Must match the current entity tag for the rule.
          in: header
          name: If-Match
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.sas.authorization.rule+json:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 10
          application/json:
            schema:
              $ref: "#/components/schemas/authorizationRule"
            examples:
              rule:
                summary: An authorization rule
                value:
                  id: 92d77691-0b05-4468-a3b6-e35fe6fd36f1
                  type: grant
                  permissions:
                    - read
                  principal: MyGroup
                  principalType: group
                  objectUri: /types/types
                  version: 10
        description: The properties of the updated rule.
        required: true
      responses:
        "200":
          description: The request succeeded.
          headers:
            ETag:
              description: The entity tag for the share.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when share was last modified.
              schema:
                type: string
          content:
            application/vnd.sas.validation+json:
              examples:
                getValidation:
                  $ref: "#/components/examples/getValidation"
              schema:
                $ref: "#/components/schemas/validation"
        "400":
          description: The request was invalid.
        "412":
          content:
            application/json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/vnd.sas.collection+json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/vnd.sas.error+json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
          description: Precondition Failed
        "428":
          description: Precondition Required
          content:
            application/json:
              examples:
                errorResponse428:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/vnd.sas.collection+json:
              examples:
                errorResponse428:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/vnd.sas.error+json:
              examples:
                errorResponse428:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
    delete:
      summary: Verify that a specified rule exists
      description: Determines whether a specified authorization rule exists.
      tags:
        - Rules
      operationId: validateDeleteRule
      parameters:
        - description: The ID of the rule.
          in: path
          name: ruleId
          required: true
          schema:
            type: string
      responses:
        "200":
          description: The request succeeded.
          content:
            application/vnd.sas.validation+json:
              examples:
                getValidation:
                  $ref: "#/components/examples/getValidation"
              schema:
                $ref: "#/components/schemas/validation"
        "400":
          description: The request was invalid.
  /shares:
    get:
      summary: Get shares
      description: Retrieves some or all shares, with or without paging.
      tags:
        - Shares
      operationId: getShares
      parameters:
        - description: The index number for the first share in a page.
          in: query
          name: start
          schema:
            type: integer
            default: 0
        - description: The maximum number of shares to return per page.
          in: query
          name: limit
          schema:
            type: integer
            default: 50
        - description: "Constraints on which shares to retrieve.  Here are the supported filters and criteria: <ul> <li>sharedBy (eq, ne, startsWith, endsWith, contains)</li> <li>sharedWith (eq, ne, startsWith, endsWith, contains)</li> <li>resourceUri (eq, ne, startsWith, endsWith, contains)</li> <li>name (eq, ne, startsWith, endsWith, contains)</li> <li>type (eq, ne)</li></ul>"
          in: query
          name: filter
          schema:
            type: string
            format: filter-criteria
        - description: Instructions for sorting the retrieved shares.  You can sort by name or description in ascending or descending order.
          in: query
          name: sortBy
          schema:
            type: string
            format: sort-criteria
      responses:
        "200":
          description: The request succeeded.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
          content:
            application/vnd.sas.collection+json:
              examples:
                shareCollectionResponse:
                  $ref: "#/components/examples/shareCollectionResponse"
              schema:
                $ref: "#/components/schemas/savedShareCollection"
            application/json:
              examples:
                shareCollectionResponse:
                  $ref: "#/components/examples/shareCollectionResponse"
              schema:
                $ref: "#/components/schemas/savedShareCollection"
        "400":
          description: The request was invalid. Returned if any query criteria (sortBy, filter, limit, start) are invalid.
          content:
            application/vnd.sas.collection+json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
    post:
      summary: Create a new share
      description: Creates a new share that has a system-generated ID.
      tags:
        - Shares
      operationId: createShare
      parameters:
        - name: Content-Type
          in: header
          required: false
          description: "Specifies the format of the incoming share. Supported media types are: <ul> <li>application/json</li> <li>application/vnd.sas.authorization.share+json</li> </ul>"
          schema:
            type: string
        - name: Accept
          in: header
          required: false
          description: "Specifies the desired format of the returned share. Supported media types are: <ul> <li>application/json</li> <li>application/vnd.sas.authorization.share+json</li> </ul>"
          schema:
            type: string
      requestBody:
        content:
          application/vnd.sas.authorization.share+json:
            schema:
              $ref: "#/components/schemas/share"
            examples:
              shareResourceBody:
                $ref: "#/components/examples/shareResourceBody"
          application/json:
            schema:
              $ref: "#/components/schemas/share"
            examples:
              shareResourceBody:
                $ref: "#/components/examples/shareResourceBody"
        description: The properties of the new share.
        required: true
      responses:
        "201":
          description: A new share was created.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when share was last modified.
              schema:
                type: string
            Location:
              description: Relative URI of the share's path.
              schema:
                type: string
            ETag:
              description: The entity tag for the share.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.share+json:
              schema:
                $ref: "#/components/schemas/savedShare"
              examples:
                shareResourceResponse:
                  $ref: "#/components/examples/shareResourceResponse"
            application/json:
              schema:
                $ref: "#/components/schemas/savedShare"
              examples:
                shareResourceResponse:
                  $ref: "#/components/examples/shareResourceResponse"
        "400":
          description: The request was invalid. Returned if the specified share is invalid.
    patch:
      summary: Patch shares
      description: >-
        Performs a set of share management actions as specified in a JSON patch. The actions are performed synchronously and transactionally. A resource collection of all created and revised shares is returned. If the patch is not successfully applied, changes are rolled back.

          For every action, the patch must specify an operation (add, replace, remove,
        test, or copy) and a target URI (for example, /authorization/shares/{shareId} or, to create a new share, /authorization/shares). Each add and replace operation requires a valid share representation.
      tags:
        - Shares
      operationId: patchShares
      requestBody:
        content:
          application/json-patch+json:
            schema:
              description: Array of patch operations to apply to the existing shares.
              items:
                $ref: "#/components/schemas/sharePatchOperation"
              type: array
            examples:
              patch:
                summary: Remove a share
                value:
                  - op: remove
                    path: /authorization/shares/dc47a5c3-df46-4cc2-80ac-02e88540e746
          application/json:
            schema:
              description: Array of patch operations to apply to the existing shares.
              items:
                $ref: "#/components/schemas/sharePatchOperation"
              type: array
            examples:
              patch:
                summary: Remove a share
                value:
                  - op: remove
                    path: /authorization/shares/dc47a5c3-df46-4cc2-80ac-02e88540e746
        description: JSON patch describing operations to perform and identifying the target shares.
        required: true
      responses:
        "200":
          description: The request succeeded. Returned if the patch was applied successfully.
          content:
            application/vnd.sas.collection+json:
              examples:
                shareCollectionResponse:
                  $ref: "#/components/examples/shareCollectionResponse"
              schema:
                $ref: "#/components/schemas/savedShareCollection"
            application/json:
              examples:
                shareCollectionResponse:
                  $ref: "#/components/examples/shareCollectionResponse"
              schema:
                $ref: "#/components/schemas/savedShareCollection"
        "400":
          description: The request was invalid. Returned if the specified share patch is invalid.
          content:
            application/vnd.sas.collection+json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "412":
          description: Precondition failed
          content:
            application/vnd.sas.error+json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/vnd.sas.collection+json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "422":
          description: Unprocessable Entity. Returned if the patch request is syntactically valid but would result in a resource state that is inconsistent or invalid.
          content:
            application/vnd.sas.collection+json:
              examples:
                errorResponse422:
                  $ref: "#/components/examples/errorResponse422"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse422:
                  $ref: "#/components/examples/errorResponse422"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "428":
          description: Precondition required
          content:
            application/vnd.sas.error+json:
              examples:
                errorResponse428:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/vnd.sas.collection+json:
              examples:
                errorResponse428:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse428:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
  "/shares/{shareId}":
    delete:
      summary: Delete a share
      description: Deletes a specified share.
      tags:
        - Shares
      operationId: deleteShare
      parameters:
        - description: The ID of the share to delete.
          in: path
          name: shareId
          required: true
          schema:
            type: string
      responses:
        "204":
          description: The share was deleted.
        "404":
          description: No share with the specified ID was found.
          content:
            application/vnd.sas.authorization.share+json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
    get:
      summary: Get a share
      description: Retrieves a specified share.
      tags:
        - Shares
      operationId: getShare
      parameters:
        - description: The ID of the share to retrieve.
          in: path
          name: shareId
          required: true
          schema:
            type: string
      responses:
        "200":
          description: The request succeeded.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when share was last modified.
              schema:
                type: string
            Location:
              description: Relative URI of the share's path.
              schema:
                type: string
            ETag:
              description: The entity tag for the share.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.share+json:
              examples:
                shareResourceResponse:
                  $ref: "#/components/examples/shareResourceResponse"
              schema:
                $ref: "#/components/schemas/savedShare"
            application/json:
              examples:
                shareResourceResponse:
                  $ref: "#/components/examples/shareResourceResponse"
              schema:
                $ref: "#/components/schemas/savedShare"
        "404":
          description: No share with the specified ID was found.
          content:
            application/vnd.sas.authorization.share+json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
    put:
      summary: Update a share
      description: Updates a share by completely replacing it with specified values.
      tags:
        - Shares
      operationId: updateShare
      parameters:
        - description: The ID of the share to update.
          in: path
          name: shareId
          required: true
          schema:
            type: string
        - description: The entity tag obtained from the most recent `ETag` response header. Must match the current entity tag for the share.
          in: header
          name: If-Match
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.sas.authorization.share+json:
            schema:
              $ref: "#/components/schemas/share"
            examples:
              shareResourceResponse:
                summary: Share resource
                value:
                  type: read
                  sharedWith: testUser
                  sharedWithType: user
                  sharedBy: currentUser
                  resourceUri: /files/files/4288b305-981f-4b8d-b440-0911eabe3faf
                  name: test file
                  version: 3
                  links:
                    - method: GET
                      rel: self
                      href: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                      uri: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                      type: application/vnd.sas.authorization.share
                    - method: PUT
                      rel: update
                      href: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                      uri: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                      type: application/vnd.sas.authorization.share
                      responseType: application/vnd.sas.authorization.share
                    - method: DELETE
                      rel: delete
                      href: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                      uri: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                  id: 3288b305-981f-4b8d-b440-0911eabc3fac
                  modifiedTimestamp: 2016-08-27T04:09:42.150Z
                  createdTimestamp: 2016-08-27T04:09:42.150Z
                  createdBy: currentUser
                  modifiedBy: currentUser
          application/json:
            schema:
              $ref: "#/components/schemas/share"
            examples:
              shareResourceResponse:
                summary: Share resource
                value:
                  type: read
                  sharedWith: testUser
                  sharedWithType: user
                  sharedBy: currentUser
                  resourceUri: /files/files/4288b305-981f-4b8d-b440-0911eabe3faf
                  name: test file
                  version: 3
                  links:
                    - method: GET
                      rel: self
                      href: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                      uri: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                      type: application/vnd.sas.authorization.share
                    - method: PUT
                      rel: update
                      href: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                      uri: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                      type: application/vnd.sas.authorization.share
                      responseType: application/vnd.sas.authorization.share
                    - method: DELETE
                      rel: delete
                      href: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                      uri: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                  id: 3288b305-981f-4b8d-b440-0911eabc3fac
                  modifiedTimestamp: 2016-08-27T04:09:42.150Z
                  createdTimestamp: 2016-08-27T04:09:42.150Z
                  createdBy: currentUser
                  modifiedBy: currentUser
        description: The properties of the share.
        required: true
      responses:
        "200":
          description: The request succeeded. Returned if the object was updated.
          headers:
            ETag:
              description: The entity tag for the share.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when share was last modified.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.share+json:
              examples:
                shareResourceResponse:
                  $ref: "#/components/examples/shareResourceResponse"
              schema:
                $ref: "#/components/schemas/savedShare"
            application/json:
              examples:
                shareResourceResponse:
                  $ref: "#/components/examples/shareResourceResponse"
              schema:
                $ref: "#/components/schemas/savedShare"
        "400":
          description: The request was invalid. Returned if the format of the request does not match the schema for the media type used or there is no existing object with the given ID. Also can be returned if the ID passed in the request payload does not match the ID in the URI.
          content:
            application/vnd.sas.authorization.share+json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "412":
          description: Precondition failed
          content:
            application/vnd.sas.error+json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/vnd.sas.collection+json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "428":
          description: Precondition required
          content:
            application/vnd.sas.error+json:
              examples:
                errorResponse428:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/vnd.sas.collection+json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
  /shares/configuration:
    get:
      summary: Get sharing configuration
      description: "Gets property values that specify how sharing is configured. Currently, there are two properties that configure sharing: sas.authorization.share.enabled and sas.authorization.share.reshare.enabled. The first determines whether sharing is enabled at all in the system while the second determines whether users are allowed to grant reshare permission on objects. There can be additional properties in the future."
      tags:
        - Shares
      operationId: getShareConfiguration
      responses:
        "200":
          description: The request succeeded.
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
          content:
            application/vnd.sas.properties+json:
              examples:
                sharePropResponse:
                  $ref: "#/components/examples/sharePropResponse"
              schema:
                $ref: "#/components/schemas/shareProperties"
            application/json:
              examples:
                sharePropResponse:
                  $ref: "#/components/examples/sharePropResponse"
              schema:
                $ref: "#/components/schemas/shareProperties"
  /capabilities:
    get:
      summary: Get a summary list of capabilities
      description: Returns a summary list of capabilities defined in the system. Note that paging is not supported when the group parameter is used.
      tags:
        - Capabilities
      operationId: getCapabilities
      parameters:
        - name: group
          in: query
          required: false
          description: >
            Only capabilities that have been assigned directly to the specified group will be included. Starting the group name with ! will invert the query so that only capabilities that have not been assigned directly to the specified group will be included.
          schema:
            type: string
        - name: sortBy
          in: query
          required: false
          description: Set the sort order for the list. Supports ascending and descending on the name and description fields.
          schema:
            type: string
        - name: filter
          in: query
          required: false
          description: Instructions for filtering the retrieved capabilities. Supports filtering on the name and description fields.
          schema:
            type: string
            format: filter-criteria
        - name: start
          in: query
          required: false
          description: Set the start position for paging.
          schema:
            type: integer
        - name: limit
          in: query
          required: false
          description: Set the limit for paging.
          schema:
            type: integer
        - name: user
          in: query
          required: false
          description: >
            Only capabilities that are authorized for the specified user will be included in the response. The value "user=@currentUser" may be used to return only the current user's capabilites (current user will be pulled from the request's authorization token).
          schema:
            type: string
            enum:
              - "@currentUser"
        - name: Accept-Item
          in: header
          description: The respresentation to use for the returned capabilities.
          schema:
            type: string
            enum:
              - application/vnd.sas.authorization.capability
              - application/vnd.sas.authorization.capability;version=1
              - application/vnd.sas.authorization.capability;version=2
              - application/vnd.sas.authorization.capability.summary
              - application/vnd.sas.authorization.capability.summary;version=1
              - application/vnd.sas.authorization.capability.summary;version=2
            default: application/vnd.sas.authorization.capability.summary;version=2
      responses:
        "200":
          description: OK
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
          content:
            application/vnd.sas.collection+json:
              examples:
                getCapabilitySummaryCollection:
                  $ref: "#/components/examples/getCapabilitySummaryCollection"
              schema:
                $ref: "#/components/schemas/capabilitySummaryCollection"
            application/json:
              examples:
                getCapabilitySummaryCollection:
                  $ref: "#/components/examples/getCapabilitySummaryCollection"
              schema:
                $ref: "#/components/schemas/capabilitySummaryCollection"
        "400":
          description: Bad request.
          content:
            application/vnd.sas.collection+json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "404":
          description: Service is not available
          content:
            application/vnd.sas.collection+json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
    post:
      summary: Define a new capability
      description: >
        Creates a new capability. If a Capability with the same name already exists then 201 status is returned and the Location header contains the

        URI for the existing Capability.
      tags:
        - Capabilities
      requestBody:
        content:
          application/vnd.sas.authorization.capability.summary+json;version=2:
            examples:
              postCapabilitySummary:
                $ref: "#/components/examples/capabilitySummaryV2"
            schema:
              $ref: "#/components/schemas/capabilitySummary"
          application/vnd.sas.authorization.capability.summary+json;version=1:
            examples:
              getCapabilitySummaryCollection:
                $ref: "#/components/examples/capabilitySummaryV1"
            schema:
              $ref: "#/components/schemas/capabilitySummary"
          application/vnd.sas.authorization.capability.summary+json:
            examples:
              getCapabilitySummaryCollection:
                $ref: "#/components/examples/capabilitySummaryV2"
            schema:
              $ref: "#/components/schemas/capabilitySummary"
          application/json:
            examples:
              getCapabilitySummaryCollection:
                $ref: "#/components/examples/capabilitySummaryV2"
            schema:
              $ref: "#/components/schemas/capabilitySummary"
        description: The group to assign the capability to
      operationId: createCapability
      responses:
        "201":
          description: Capability has been created
          headers:
            Location:
              description: The URL of the created capability.
              schema:
                type: string
          content:
            application/vnd.sas.authorization.capability+json;version=2:
              examples:
                getCapability:
                  $ref: "#/components/examples/getCapabilityV2"
              schema:
                $ref: "#/components/schemas/capability"
            application/vnd.sas.authorization.capability+json;version=1:
              examples:
                getCapability:
                  $ref: "#/components/examples/getCapabilityV1"
              schema:
                $ref: "#/components/schemas/capability"
            application/vnd.sas.authorization.capability+json:
              examples:
                getCapability:
                  $ref: "#/components/examples/getCapabilityV2"
              schema:
                $ref: "#/components/schemas/capability"
            application/json:
              examples:
                getCapability:
                  $ref: "#/components/examples/getCapabilityV2"
              schema:
                $ref: "#/components/schemas/capability"
        "400":
          description: Bad request.
          content:
            application/vnd.sas.authorization.capability+json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "403":
          description: Forbidden. The user does not have the required sas.capability.create capability.
          content:
            application/vnd.sas.authorization.capability+json:
              examples:
                errorResponse403:
                  $ref: "#/components/examples/errorResponse403"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse403:
                  $ref: "#/components/examples/errorResponse403"
              schema:
                $ref: "#/components/schemas/errorResponse"
    delete:
      summary: Delete all capabilities assigned to a group
      description: Deletes all the capabilities assigned to a group.
      tags:
        - Capabilities
      operationId: deleteGroupCapabilities
      parameters:
        - name: group
          in: query
          required: true
          description: The name of the group
          schema:
            type: string
      responses:
        "204":
          description: No content
        "400":
          description: No group with the specified name has been found
  "/capabilities/{capabilityName}":
    get:
      summary: Retrieve the details for a capability
      description: Retrieve the full details for a capability defined in the system, including list of groups assigned to that capability.
      tags:
        - Capabilities
      operationId: getCapability
      parameters:
        - name: capabilityName
          in: path
          required: true
          description: Name of capability to fetch
          schema:
            type: string
        - name: Accept
          in: header
          description: The respresentation to use for the returned capabilities.
          schema:
            type: string
            enum:
              - application/vnd.sas.authorization.capability
              - application/vnd.sas.authorization.capability;version=1
              - application/vnd.sas.authorization.capability;version=2
            default: application/vnd.sas.authorization.capability;version=2
      responses:
        "200":
          headers:
            ETag:
              description: The ETag header for future requests.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
          description: OK
          content:
            application/vnd.sas.authorization.capability+json;version=2:
              schema:
                $ref: "#/components/schemas/capability"
              examples:
                getCapability:
                  $ref: "#/components/examples/getCapabilityV2"
            application/vnd.sas.authorization.capability+json;version=1:
              schema:
                $ref: "#/components/schemas/capability"
              examples:
                getCapability:
                  $ref: "#/components/examples/getCapabilityV1"
            application/vnd.sas.authorization.capability+json:
              schema:
                $ref: "#/components/schemas/capability"
              examples:
                getCapability:
                  $ref: "#/components/examples/getCapabilityV2"
            application/json:
              schema:
                $ref: "#/components/schemas/capability"
              examples:
                getCapability:
                  $ref: "#/components/examples/getCapabilityV2"
        "404":
          description: No capability with the specified name has been found
          content:
            application/vnd.sas.authorization.capability+json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
    patch:
      summary: Update an existing capability
      description: Patches the specified capability based on the representation in the request body.
      tags:
        - Capabilities
      operationId: patchCapability
      parameters:
        - name: capabilityName
          in: path
          required: true
          description: Name of the capability to update
          schema:
            type: string
        - name: If-Match
          in: header
          description: ETag header. If the ETag does not match, the update will fail.
          schema:
            type: string
        - name: Accept
          in: header
          description: The respresentation to use for the returned capabilities.
          schema:
            type: string
            enum:
              - application/vnd.sas.authorization.capability.summary
              - application/vnd.sas.authorization.capability.summary;version=1
              - application/vnd.sas.authorization.capability.summary;version=2
            default: application/vnd.sas.authorization.capability.summary;version=2
      requestBody:
        content:
          application/vnd.sas.authorization.capability.summary+json;version=2:
            examples:
              patchCapability:
                $ref: "#/components/examples/capabilitySummaryV2"
            schema:
              $ref: "#/components/schemas/capabilitySummary"
          application/vnd.sas.authorization.capability.summary+json;version=1:
            examples:
              patchCapability:
                $ref: "#/components/examples/capabilitySummaryV1"
            schema:
              $ref: "#/components/schemas/capabilitySummary"
          application/vnd.sas.authorization.capability.summary+json:
            examples:
              patchCapability:
                $ref: "#/components/examples/capabilitySummaryV2"
            schema:
              $ref: "#/components/schemas/capabilitySummary"
          application/json:
            examples:
              patchCapability:
                $ref: "#/components/examples/capabilitySummaryV1"
            schema:
              $ref: "#/components/schemas/capabilitySummary"
        description: The partial representation of a capability.
      responses:
        "200":
          headers:
            ETag:
              description: The ETag header for future requests.
              schema:
                type: string
          description: OK
          content:
            application/vnd.sas.authorization.capability.summary+json;version=2:
              examples:
                patchCapability:
                  $ref: "#/components/examples/getCapabilityV2"
              schema:
                $ref: "#/components/schemas/capabilitySummary"
            application/vnd.sas.authorization.capability.summary+json;version=1:
              examples:
                patchCapability:
                  $ref: "#/components/examples/getCapabilityV1"
              schema:
                $ref: "#/components/schemas/capabilitySummary"
            application/vnd.sas.authorization.capability.summary+json:
              examples:
                patchCapability:
                  $ref: "#/components/examples/getCapabilityV2"
              schema:
                $ref: "#/components/schemas/capabilitySummary"
            application/json:
              examples:
                patchCapability:
                  $ref: "#/components/examples/getCapabilityV2"
              schema:
                $ref: "#/components/schemas/capabilitySummary"
        "400":
          description: The request was invalid.
          content:
            application/vnd.sas.authorization.capability.summary+json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "403":
          description: Forbidden. The user does not have the required sas.capability.create capability.
          content:
            application/vnd.sas.authorization.capability.summary+json:
              examples:
                errorResponse403:
                  $ref: "#/components/examples/errorResponse403"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse403:
                  $ref: "#/components/examples/errorResponse403"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "412":
          description: Precondition failed
          content:
            application/vnd.sas.collection+json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse412:
                  $ref: "#/components/examples/errorResponse412"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "422":
          description: The specified capability representation cannot be processed.
          content:
            application/vnd.sas.authorization.capability.summary+json:
              examples:
                errorResponse422:
                  $ref: "#/components/examples/errorResponse422"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse422:
                  $ref: "#/components/examples/errorResponse422"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "428":
          description: Precondition required
          content:
            application/vnd.sas.collection+json:
              examples:
                errorResponse428:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse428:
                  $ref: "#/components/examples/errorResponse428"
              schema:
                $ref: "#/components/schemas/errorResponse"
  "/capabilities/{capabilityName}/groups":
    get:
      summary: Get the collection of groups this capability is assigned to
      description: Get the collection of groups this capability is assigned to where each group is represented as a Principal object
      tags:
        - Capabilities
      operationId: getGroupsForCapability
      parameters:
        - description: Constraints on which groups to retrieve
          in: query
          name: filter
          schema:
            format: filter-criteria
            type: string
        - name: limit
          description: The maximum number of results to return in the response.
          in: query
          required: false
          schema:
            type: integer
        - name: start
          description: The index in the results to begin from
          in: query
          required: false
          schema:
            type: integer
        - name: capabilityName
          description: The name of the cpapbility to find groups for
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          headers:
            Content-Type:
              description: Type of returned content.
              schema:
                type: string
            Last-Modified:
              description: Timestamp of when rule was last modified.
              schema:
                type: string
          content:
            application/vnd.sas.collection+json:
              examples:
                getPrincipalCollection:
                  $ref: "#/components/examples/getPrincipalCollection"
              schema:
                $ref: "#/components/schemas/principalCollection"
            application/json:
              examples:
                getPrincipalCollection:
                  $ref: "#/components/examples/getPrincipalCollection"
              schema:
                $ref: "#/components/schemas/principalCollection"
        "404":
          description: No capability with the specified name has been found
          content:
            application/vnd.sas.authorization.capability+json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
    post:
      summary: Assign a capability to a group
      description: Assign the specified capability to a group principal
      tags:
        - Capabilities
      operationId: addCapabilityToGroup
      parameters:
        - name: capabilityName
          in: path
          required: true
          description: The name of the capability
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/principal"
            examples:
              principal:
                summary: Simple group principal
                value:
                  name: exampleGroup
                  type: group
                  version: 1
        description: The group to assign the capability to
      responses:
        "201":
          description: Created
          headers:
            Location:
              description: The URL of the created capability.
              schema:
                type: string
        "400":
          description: The principal represenation in the request body is invalid
          content:
            application/json:
              examples:
                errorResponse400:
                  $ref: "#/components/examples/errorResponse400"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "403":
          description: Forbidden. The user does not have the required sas.capability.assign.group capability.
          content:
            application/json:
              examples:
                errorResponse403:
                  $ref: "#/components/examples/errorResponse403"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "404":
          description: No capability with the specified name has been found
          content:
            application/vnd.sas.authorization.capability+json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
  "/capabilities/{capabilityName}/groups/{groupId}":
    delete:
      summary: Unassign the capability from a group
      description: Remove the group from the list of groups authorized to access this capability.
      tags:
        - Capabilities
      operationId: deleteCapabilityFromGroup
      parameters:
        - name: capabilityName
          in: path
          required: true
          description: The name of the capability
          schema:
            type: string
        - name: groupId
          in: path
          required: true
          description: The ID of the group
          schema:
            type: string
      responses:
        "204":
          description: Capability succesfully unassigned, no content returned
        "403":
          description: Forbidden. The user does not have the required sas.capability.assign.group capability.
          content:
            application/vnd.sas.authorization.capability+json:
              examples:
                errorResponse403:
                  $ref: "#/components/examples/errorResponse403"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse403:
                  $ref: "#/components/examples/errorResponse403"
              schema:
                $ref: "#/components/schemas/errorResponse"
        "404":
          description: No capability with the specified name has been found
          content:
            application/vnd.sas.authorization.capability+json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
            application/json:
              examples:
                errorResponse404:
                  $ref: "#/components/examples/errorResponse404"
              schema:
                $ref: "#/components/schemas/errorResponse"
servers:
  - url: http://example.com/authorization
    description: This is an example base URL.
components:
  schemas:
    errorResponse:
      type: object
      title: Error
      description: The representation of an error.
      required:
        - httpStatusCode
        - version
      properties:
        message:
          type: string
          description: The error message.
        id:
          type: string
          description: The string ID for the error.
        errorCode:
          type: integer
          description: The numeric ID for the error.
        httpStatusCode:
          type: integer
          description: The HTTP status code for the error.
        details:
          type: array
          description: Messages that provide additional details about the cause of the error.
          items:
            type: string
        remediation:
          type: string
          description: A message that describes how to resolve the error.
        errors:
          type: array
          description: Any additional errors that occurred
          items:
            $ref: "#/components/schemas/errorResponse"
        links:
          type: array
          description: The links that apply to the error.
          items:
            $ref: "#/components/schemas/link"
        version:
          type: integer
          description: The version number of the error representation. This representation is version 2.
    baseCollection:
      description: This is a base schema used to define paginated collections of resources. This base schema is extended by other schemas in APIs by adding an 'items' array property. These extensions define the application/vnd.sas.collection media type (version 2)
      properties:
        name:
          type: string
          description: The name of the collection.
        start:
          type: integer
          description: The zero-based index of the first item in the collection.
        limit:
          type: integer
          description: The number of items that were requested for the collection.
        count:
          type: integer
          description: If populated indicates the number of items in the collection.
          format: int64
        accept:
          type: string
          description: A space-delimited list of media types from which an `Accept` header may be constructed.
        links:
          type: array
          description: The links that apply to the collection.
          items:
            $ref: "#/components/schemas/link"
        version:
          type: integer
          description: The version number of the collection representation. This representation is version 2.
    link:
      title: Link
      description: A link to a related operation or resource.
      required:
        - rel
      properties:
        method:
          type: string
          description: The HTTP method to invoke this endpoint.
        rel:
          type: string
          description: The relationship of this URL to the object.
        uri:
          type: string
          description: The relative URI of the REST endpoint.
        href:
          type: string
          description: The full URL of the REST endpoint.
        title:
          type: string
          description: The title for the link.
        type:
          type: string
          description: The media type consumed/produced.
        itemType:
          type: string
          description: If this is a link to a container, `itemType` is the media type or link type for the items in the container.
        responseType:
          type: string
          description: The media type or link type of the response body for a `PUT`, `POST`, or `PATCH` operation.
        responseItemType:
          type: string
          description: The media type or link type of the items in the response body for a `PUT`, `POST`, or `PATCH` operation.
    parameterizedLink:
      title: ParameterizedLink
      description: A link to a related operation or resource with a map of parameter names to values for use in authorization evaluations.
      required:
        - rel
      properties:
        method:
          type: string
          description: The HTTP method to invoke this endpoint.
        rel:
          type: string
          description: The relationship of this URL to the object.
        uri:
          type: string
          description: The relative URI of the REST endpoint.
        href:
          type: string
          description: The full URL of the REST endpoint.
        title:
          type: string
          description: The title for the link.
        type:
          type: string
          description: The media type consumed/produced.
        itemType:
          type: string
          description: If this is a link to a container, `itemType` is the media type or link type for the items in the container.
        responseType:
          type: string
          description: The media type or link type of the response body for a `PUT`, `POST`, or `PATCH` operation.
        responseItemType:
          type: string
          description: The media type or link type of the items in the response body for a `PUT`, `POST`, or `PATCH` operation.
        parameters:
          type: object
          description: Map of parameter names to values.
    api:
      description: Representation of the API
      required:
        - version
        - links
      properties:
        version:
          type: integer
          description: The version number of the API representation. This is version 1.
        links:
          type: array
          description: The API's top-level links.
          items:
            $ref: "#/components/schemas/link"
    selection:
      title: Selection
      description: Identifies a set of resources.
      required:
        - version
        - resources
      properties:
        version:
          description: The schema version number of this media type. This representation is version 1.
          type: integer
        template:
          description: A URI template in which the {id} parameter can be replaced with a value from the \"resources\" array in order to yield the URI of the identified resource.
          type: string
          format: uri
        type:
          description: Specifies whether the resources array contains IDs, URIs, or both. \n<dl>\n<dt>\"id\"</dt><dd>the array contains resource identifiers only. This is the default if \"type\" is omitted.</dd>\n<dt>\"uri\"</dt><dd>the array contains resource URIs</dd>\n<dt>\"mixed\"</dt><dd>the array contains a mixture of identifiers and URIs.</dd>\n</dl>
          type: string
          enum:
            - id
            - uri
            - mixed
        resources:
          description: An array of resource IDs or URIs
          type: array
          items:
            type: string
        links:
          type: array
          description: An array of links to related resources and actions.
          items:
            $ref: "#/components/schemas/link"
    validation:
      title: Validation Response
      description: The response from a pre-flight validation request. For APIs which support validation, the client can run operations (typically on resources in the `/commons/validation`) with `application/vnd.sas.validation+json` as the requested response type (via the `Accept:` request header). The service will validate the request but not execute the request, and return this response to indicate if the request was valid at the time it was made.
      required:
        - version
        - valid
      properties:
        version:
          description: This media type's schema version number. This representation is version 1.
          type: integer
        valid:
          description: true if and only if the validation was successful.
          type: boolean
        error:
          $ref: "#/components/schemas/errorResponse"
        links:
          type: array
          description: An array of links to related resources and actions.
          items:
            $ref: "#/components/schemas/link"
    shareProperties:
      title: Share Properties
      description: property values that specify how sharing is configured. sas.authorization.share.enabled determines whether sharing is enabled at all in the system while sas.authorization.share.reshare.enabled determines whether users are allowed to grant reshare permission on objects.
      properties:
        sas.authorization.share.enabled:
          description: Whether sharing is enabled at all in the system
          type: boolean
        sas.authorization.share.reshare.enabled:
          description: Whether users are allowed to grant reshare permission on objects
          type: boolean
    authorizationRule:
      title: Authorization Rule
      type: object
      description: An authorization rule that does not have a known ID. The rule has not been saved or the ID is unavailable for some other reason. Compare with SavedAuthorizationRule.
      properties:
        condition:
          description: A Spring Expression Language (SpEL) expression that limits the applicability of the rule. The rule applies only in authorization contexts in which the expression evaluates to 'true'.
          type: string
        containerUri:
          description: A relative URI that represents the container aspect of a container object, such as a folder. Rules that target a container URI affect access that the container conveys to its child members.
          type: string
        expirationTimeStamp:
          description: The date and time at which the rule expires. Expired rules should be disregarded and deleted.
          format: date-time
          type: string
        filter:
          description: Filter criteria for the rule's target object (or objects). This property is not currently in use.
          type: string
        contentType:
          description: Media type of the object that is handled by an endpoint. If set, rules will only apply to endpoints that consume resources of this type. Most rules do not specify a content type.
          type: string
        acceptType:
          description: Media type of the object returned by an endpoint. If set, rules will only apply to endpoints that produce resources of this type. Most rules do not specify an accept type.
          type: string
        acceptItemType:
          description: Media type of object in a resource collection that is returned by an endpoint. If set, rules will only apply to endpoints that produce a resource collection containing resources of this type. Most rules do not specify an accept item type.
          type: string
        objectUri:
          description: A relative URI or ANT-path pattern that represents a resource or set of resources. Most rules target an object URI.
          type: string
        permissions:
          description: "The specific actions that the rule affects (for example: read, update, delete, create, secure, add, or remove)."
          items:
            description: A type of access.
            enum:
              - add
              - create
              - delete
              - read
              - remove
              - secure
              - update
            type: string
          type: array
        principal:
          description: Specifies the ID of a user or group to which the rule applies. Use this property in conjunction with the principalType property.
          type: string
        principalType:
          description: The type of principal or construct to which the rule applies.
          enum:
            - user
            - group
            - authenticatedUsers
            - everyone
            - guest
          type: string
        reason:
          description: Information that a client can display to end users for diagnostic purposes. For example, a prohibit rule’s reason could be displayed to an end user as part of an 'access denied' message.
          type: string
        type:
          description: Indicates whether the rule blocks (prohibit) or attempts to provide (grant) access to the specified principal.
          enum:
            - grant
            - prohibit
          type: string
        version:
          description: The version of the rule representation. The current representation version is 8.
          format: int32
          type: integer
        description:
          description: Information that documents the rule for administrative purposes.
          type: string
        enabled:
          description: Indicates whether the rule is enabled.
          type: boolean
          default: true
        matchParams:
          description: Indicates whether the rule applies to only those requests whose query parameters exactly match the rule target.
          type: boolean
          default: false
        links:
          $ref: "#/components/schemas/links"
      required:
        - objectUri
        - permissions
        - principal
        - principalType
        - type
    identifiableAuthorizationRule:
      allOf:
        - $ref: "#/components/schemas/authorizationRule"
        - properties:
            ruleId:
              description: The unique identifier for the rule.
              type: string
      title: Identifiable Authorization Rule
      description: Any authorization rule that can be referenced by a unique identifier. This can be a savedAuthorizationRule or an unsaved authorization rule that has a client-specified identifier.
    savedAuthorizationRule:
      allOf:
        - $ref: "#/components/schemas/identifiableAuthorizationRule"
        - properties:
            createdBy:
              type: string
              description: The ID of the user who created the rule.
            creationTimeStamp:
              format: date-time
              type: string
              description: The date and time at which the rule was created.
            modifiedBy:
              type: string
              description: The ID of the last user to modify the rule.
            modifiedTimeStamp:
              format: date-time
              type: string
              description: The date and time at which the rule was last modified.
      title: Saved Authorization Rule
      description: An authorization rule that has a known rule ID and has been persisted.
    savedAuthorizationRuleCollection:
      title: Resource Collection of Authorization Rules
      description: A collection of saved authorization rules.
      allOf:
        - $ref: "#/components/schemas/baseCollection"
        - type: object
          properties:
            items:
              type: array
              items:
                $ref: "#/components/schemas/savedAuthorizationRule"
          description: The array of application/vnd.sas.authorization.rule+json representations.
    principal:
      title: Principal
      description: A specific user or group.
      type: object
      properties:
        name:
          description: The ID of the user or group. If the principalType refers to a construct, no value is specified for t his property.
          type: string
        type:
          description: The type of the principal, or a construct.
          enum:
            - user
            - group
          type: string
        version:
          format: int32
          type: integer
          description: The principal media type version. The version described here is version 1.
    principalCollection:
      title: Resource Collection of Principals
      description: A collection of principals (users and/or groups).
      allOf:
        - $ref: "#/components/schemas/baseCollection"
        - type: object
          properties:
            items:
              type: array
              items:
                $ref: "#/components/schemas/principal"
          description: The array of principal representations.
    authorizationContext:
      title: Authorization Context
      description: Contextual information about an action that a principal is attempting. Represented by media type application/vnd.sas.authorization.context+json.
      properties:
        request:
          $ref: "#/components/schemas/authorizationContextRequest"
        principals:
          description: The set of principals representing the actor performing the action.
          type: array
          items:
            $ref: "#/components/schemas/principal"
        permission:
          description: A type of access.
          enum:
            - add
            - create
            - delete
            - read
            - remove
            - secure
            - update
          type: string
        parameters:
          description: A map of keys to objects that represent the parameters and return object of a method being invoked. This can be null or empty.
          type: object
        matchParams:
          description: Whether the authorization service should strictly match query parameters in this context against a rule.
          type: boolean
          default: false
        eachNamed:
          description: "Map of parameter names to a new name that should be used in rule condition evaluation for collections. For example, if a parameter being used for evaluation is a collection named 'items', then eachNamed can map 'items' to 'item' so that item in the collection can be evaluated independently against a rule that references the '#item' variable. "
          type: object
        version:
          format: int32
          type: integer
          description: The authorization context's media type version. The version described here is version 1.
    authorizationContextPerm:
      title: Authorization Context Permission Required
      description: An authorization context where the permission field is required
      required:
        - permission
      allOf:
        - $ref: "#/components/schemas/authorizationContext"
    bulkAuthorizationContext:
      title: Bulk Authorization Context
      description: >-
        Contextual information about an action that a principal is attempting, including one or more links that should be authorized against a supplied permission. Represented by media type application/vnd.sas.authorization.bulk.context+json.

        <p><b>Note:</b>  Use of either bulkLinks or parameterizedLinks is required. Use of both is allowed. </p>
      properties:
        bulkLinks:
          $ref: "#/components/schemas/permissionsToLinks"
        parameterizedLinks:
          $ref: "#/components/schemas/parameterizedLinks"
      allOf:
        - $ref: "#/components/schemas/authorizationContext"
    permissionsToLinks:
      title: Permissions to Links
      description: A map of permissions to link arrays. The keys of this map are the permissions that the link values are authorized for.
      type: object
      properties:
        add:
          description: An array of links that should be authorized against the add permission.
          type: array
          items:
            $ref: "#/components/schemas/link"
        create:
          description: An array of links that should be authorized against the create permission.
          type: array
          items:
            $ref: "#/components/schemas/link"
        delete:
          description: An array of links that should be authorized against the delete permission.
          type: array
          items:
            $ref: "#/components/schemas/link"
        read:
          description: An array of links that should be authorized against the read permission.
          type: array
          items:
            $ref: "#/components/schemas/link"
        remove:
          description: An array of links that should be authorized against the remove permission.
          type: array
          items:
            $ref: "#/components/schemas/link"
        secure:
          description: An array of links that should be authorized against the secure permission.
          type: array
          items:
            $ref: "#/components/schemas/link"
        update:
          description: An array of links that should be authorized against the update permission.
          type: array
          items:
            $ref: "#/components/schemas/link"
    parameterizedLinks:
      title: Permissions to Parameterized Links
      description: A map of permissions to parameterized link arrays. The keys of this map are the permissions that the link values are authorized for.  During authorization of the link the parameters will be added to the list of parameters supplied on the context.  The parameters are used in authorization conditional expressions.  If there is a conflict the parameters specified for the link will override.
      type: object
      properties:
        add:
          description: An array of links that should be authorized against the add permission.
          type: array
          items:
            $ref: "#/components/schemas/parameterizedLink"
        create:
          description: An array of links that should be authorized against the create permission.
          type: array
          items:
            $ref: "#/components/schemas/parameterizedLink"
        delete:
          description: An array of links that should be authorized against the delete permission.
          type: array
          items:
            $ref: "#/components/schemas/parameterizedLink"
        read:
          description: An array of links that should be authorized against the read permission.
          type: array
          items:
            $ref: "#/components/schemas/parameterizedLink"
        remove:
          description: An array of links that should be authorized against the remove permission.
          type: array
          items:
            $ref: "#/components/schemas/parameterizedLink"
        secure:
          description: An array of links that should be authorized against the secure permission.
          type: array
          items:
            $ref: "#/components/schemas/parameterizedLink"
        update:
          description: An array of links that should be authorized against the update permission.
          type: array
          items:
            $ref: "#/components/schemas/parameterizedLink"
    authorizationContextRequest:
      title: Authorization Context Request
      description: A description of the HTTP request that is associated with an authorization request.
      type: object
      properties:
        uri:
          description: The relative URI of the request, excluding any query parameters.
          type: string
        method:
          description: The HTTP method that is used by the caller.
          type: string
        queryString:
          description: The query string portion of the caller request, if any.
          type: string
        parameters:
          description: The request parameters map.
          type: object
        locale:
          description: The preferred locale that the client accepts content in.
          type: string
        headers:
          description: A map of HTTP header names to their values.
          type: object
        contentLength:
          description: The length, in bytes, of the request body.
          format: int32
          type: integer
        contentType:
          description: The MIME type of the body of the request.
          type: string
        protocol:
          description: The protocol of the request.
          type: string
        serverName:
          description: The name of the server to which the request was sent.
          type: string
        serverPort:
          description: The port number of the server to which the request was sent.
          format: int32
          type: integer
        serverIp:
          description: The IP address of the server to which the request was sent.
          type: string
        remoteHost:
          description: The fully qualified name of the client (or the last proxy) that sent the request.
          type: string
        remoteIp:
          description: The IP address of the client (or the last proxy) that sent the request.
          type: string
        requestDate:
          description: The date on which the request was sent, represented as the number of milliseconds since January 1, 1970 GMT.
          format: int32
          type: integer
        timeStamp:
          description: The date on which the request was sent, represented as a W3C/ISO 8601 compliant timestamp string using yyyy-MM-dd'T'HH:mm:ss.SSSZ format.
          type: string
    explanations:
      title: Explanations
      description: A map of relative URI keys to an array of Explanation values. Each explanation in each array explains authorization decisions for one principal.
      type: object
      properties:
        version:
          description: The version of the explanation representation. The current representation version is 1.
          format: int32
          type: integer
        explanations:
          type: array
          items:
            $ref: "#/components/schemas/explanation"
    explanation:
      title: Explanation
      description: An explanation of access for one principal.
      example: "{'principal': {'name': 'test-user', 'type': 'user'}, 'read': {... read explanation ...}, 'update': {... update explanation ...}, 'so on, for each permission...':{...}}"
      properties:
        principal:
          $ref: "#/components/schemas/principal"
        add:
          $ref: "#/components/schemas/permissionExplanation"
        create:
          $ref: "#/components/schemas/permissionExplanation"
        delete:
          $ref: "#/components/schemas/permissionExplanation"
        read:
          $ref: "#/components/schemas/permissionExplanation"
        remove:
          $ref: "#/components/schemas/permissionExplanation"
        secure:
          $ref: "#/components/schemas/permissionExplanation"
        update:
          $ref: "#/components/schemas/permissionExplanation"
    individualExplanation:
      title: Individual Explanation
      description: An explanation of access for one principal and permission.
      properties:
        result:
          description: The ultimate access result for the defined principal and permission. A result of 'conditional' means that access might be either granted or denied, depending on the impact of request-time circumstances on evaluation of relevant conditions.
          type: string
          enum:
            - grant
            - prohibit
            - conditional
        grantFactor:
          $ref: "#/components/schemas/factor"
        prohibitFactor:
          $ref: "#/components/schemas/factor"
    permissionExplanation:
      title: Permission Explanation
      description: An explanation of access for one principal and permission. Includes explanations for permissions conveyed by containing objects.
      type: object
      allOf:
        - $ref: "#/components/schemas/individualExplanation"
        - properties:
            conveyedExplanation:
              $ref: "#/components/schemas/individualExplanation"
    factor:
      title: Factor
      description: Information about the source or cause of the result. Includes a list of applicable rules, indication of whether any of those rules has a condition, and whether the result is direct (a rule directly targets the defined object and is directly assigned to the defined principal).
      type: object
      properties:
        direct:
          type: boolean
          description: Indicates whether the result comes from a rule that targets the defined object directly (via objectUri) and is directly assigned to the defined principal. If false, the result comes from another source, such as inheritance a parent object), membership (a parent group), or the absence of applicable rules.
        condition:
          type: string
          description: The condition that affects access, if any.
        contributingRules:
          description: An array of links that indicate which rules contributed to this factor. If empty or null, then no explicit rules contributed and the result comes from the inherit semantics of the system (for example, prohibit is implicit if there is no relevant grant rule).
          type: array
          items:
            $ref: "#/components/schemas/link"
    ruleJob:
      title: Rule Job
      description: Instructions for a set of actions to be performed asynchronously. Consists of a state that describes how the overall asynchronous job is performing and a set of actions to perform on defined rules.
      properties:
        state:
          description: Defines the current state of an action.
          enum:
            - pending
            - running
            - completed
            - completedWithErrors
            - failed
          type: string
        actions:
          description: A set of actions to be performed on defined rules. These can be create, update, or delete actions. Actions are performed in their arrayed order.
          type: array
          items:
            $ref: "#/components/schemas/ruleAction"
        links:
          $ref: "#/components/schemas/links"
    ruleAction:
      title: Rule Action
      description: Describes an action to be performed asynchronously on a rule.
      required:
        - rule
        - type
      properties:
        rule:
          $ref: "#/components/schemas/authorizationRule"
        type:
          description: The type of action to be performed on a rule
          enum:
            - create
            - update
            - delete
          type: string
        status:
          description: Defines the current state of an action.
          enum:
            - pending
            - running
            - completed
            - completedWithErrors
            - failed
          type: string
    rulePatchOperation:
      title: Rule Patch Operation
      description: An operation to be performed on the defined rule.
      required:
        - op
        - path
      properties:
        value:
          $ref: "#/components/schemas/authorizationRule"
        op:
          description: The type of operation to perform on the defined rule.
          enum:
            - add
            - replace
            - remove
            - test
            - copy
          type: string
        path:
          description: The URI of the rule.
          type: string
    links:
      type: array
      items:
        $ref: "#/components/schemas/link"
      title: Links
      description: Zero or more links that are to related resources and actions.
    localizedValueCollection:
      title: Resource Collection of Localized Values
      description: A collection of localized values.
      allOf:
        - $ref: "#/components/schemas/baseCollection"
        - type: object
          properties:
            items:
              type: array
              items:
                $ref: "#/components/schemas/localizedValue"
          description: The array of localizedValue representations.
    localizedValue:
      title: Localized Value
      description: "A name-value pair of the form (value: localizedValue)."
      properties:
        value:
          type: string
          description: The original, unlocalized value.
        localizedValue:
          type: string
          description: The corresponding localized value.
    authorizedLinks:
      title: Authorized Links
      description: The result of a bulk authorization request. For each type of link in the request (bulkLinks, parameterizedLinks) two arrays containing the granted and prohibited links will be returned.
      properties:
        grantedLinks:
          description: An array of link objects that are granted based on the permission requested.
          items:
            $ref: "#/components/schemas/link"
          type: array
        prohibitedLinks:
          description: An array of link objects that are prohibited based on the permission requested.
          items:
            $ref: "#/components/schemas/link"
          type: array
        grantedParameterizedLinks:
          description: An array of parameterizedLink objects that are granted based on the permission requested.
          items:
            $ref: "#/components/schemas/parameterizedLink"
          type: array
        prohibitedParameterizedLinks:
          description: An array of parameterizedLink objects that are prohibited based on the permission requested.
          items:
            $ref: "#/components/schemas/parameterizedLink"
          type: array
        version:
          description: The version of the authorized links format that is being referenced.
          format: int32
          type: integer
    hypothetical:
      title: Hypothetical
      description: An authorization explanation, using new additional rules that aren't yet persisted in the service
      properties:
        version:
          description: The version of the resource selection format that is being referenced.
          format: int32
          type: integer
        patch:
          description: An array of patch operations to apply to the existing rules.
          items:
            $ref: "#/components/schemas/rulePatchOperation"
          type: array
        uris:
          description: The URIs for which to create the explanations.
          items:
            description: A string that represents an object URI.
            type: string
          type: array
    share:
      title: Share
      description: A share that does not have a known ID or sharedBy value. The share has not been saved or the ID is unavailable for some other reason. Compare with SavedShare.
      type: object
      properties:
        sharedWith:
          description: The principal name of the share recipient.
          type: string
        resourceUri:
          description: A relative URI that represents a resource. All shares must target a resource URI.
          type: string
        name:
          description: The user-friendly name of the shared resource.
          type: string
        sharedWithType:
          description: The type of principal to which the share applies.
          enum:
            - user
            - group
            - authenticatedUsers
            - everyone
            - guest
          type: string
        type:
          description: The level of access that the share provides.
          enum:
            - read
            - readEdit
            - readShare
            - readEditShare
          type: string
        enabled:
          description: Flag indicating whether the current share is in effect or not.
          type: boolean
          default: true
        version:
          description: The version of the share representation. The current representation version is 2.
          format: int32
          type: integer
        links:
          $ref: "#/components/schemas/links"
      required:
        - type
        - sharedWith
        - sharedWithType
        - resourceUri
    savedShare:
      allOf:
        - $ref: "#/components/schemas/share"
        - properties:
            id:
              description: The unique identifier for the share.
              type: string
            createdBy:
              type: string
              description: The ID of the user who created the share.
            creationTimeStamp:
              format: date-time
              type: string
              description: The date and time at which the share was created.
            modifiedBy:
              type: string
              description: The ID of the last user to modify the share.
            modifiedTimeStamp:
              format: date-time
              type: string
              description: The date and time at which the share was last modified.
      title: Saved Share
      description: Any share that can be referenced by a unique identifier and has been persisted.
    savedShareCollection:
      title: Resource Collection of Shares
      description: A collection of saved shares.
      allOf:
        - $ref: "#/components/schemas/baseCollection"
        - type: object
          properties:
            items:
              type: array
              items:
                $ref: "#/components/schemas/savedShare"
              description: The array of application/vnd.sas.authorization.rule+json representations.
    sharePatchOperation:
      title: Share Patch Operation
      description: An operation to be performed on the defined share.
      required:
        - op
        - path
      properties:
        value:
          $ref: "#/components/schemas/share"
        op:
          description: The type of operation to perform on the defined share.
          enum:
            - add
            - replace
            - remove
          type: string
        path:
          description: The URI of the share.
          type: string
    capabilitySummaryCollection:
      title: Capability summary collection
      description: A collection of capability summaries
      allOf:
        - $ref: "#/components/schemas/baseCollection"
        - type: object
          properties:
            items:
              type: array
              items:
                $ref: "#/components/schemas/capabilitySummary"
              description: Array containing capability summaries.
    capability:
      title: Capability
      description: Capabilties provide an abstraction layer on top of authorization rules, providing the ability to associate users and groups with specific application capabilities, and perform license checks to ensure users are authorized to access various areas of the software
      x-sas-type: Capability
      x-sas-media-type:
        name: application/vnd.sas.authorization.capability
        version: 1
      required:
        - name
        - description
      properties:
        id:
          type: string
          description: The system-assigned unique ID for this capability.
        name:
          type: string
          description: The full stop separated name for this capability e.g. sas.document.edit
        description:
          type: string
          description: The description of the capability
        product:
          type: string
          description: The product associated with the capability
        principals:
          type: array
          description: List of groups that have been granted the capability
          items:
            $ref: "#/components/schemas/principal"
        version:
          type: integer
          description: The schema version for the capability.
          format: int32
        links:
          type: array
          description: Zero or more link objects relevant to the capability.
          items:
            $ref: "#/components/schemas/link"
    capabilitySummary:
      title: Capability Summary
      description: A summary object of the capability
      x-sas-type: Capability
      x-sas-media-type:
        name: application/vnd.sas.authorization.capability.summary
        version: 1
      required:
        - name
        - description
      properties:
        id:
          type: string
          description: The system-assigned unique ID for this capability.
        name:
          type: string
          description: The full stop separated name for this capability e.g. sas.document.edit
        description:
          type: string
          description: The description of the capability
        product:
          type: string
          description: The product associated with the capability.
        version:
          type: integer
          description: The schema version for the capability.
          format: int32
        links:
          type: array
          description: Zero or more link objects relevant to the capability.
          items:
            $ref: "#/components/schemas/link"
  examples:
    api:
      summary: A summary of the list of links that this API supports
      description: A summary of top-level endpoint and the appropriate link relationship to find the specific endpoint of interest
      value:
        version: 1
        links:
          - method: POST
            rel: authorize
            href: /authorization/decisions
            uri: /authorization/decisions
            type: application/vnd.sas.authorization.context
            responseType: application/vnd.sas.authorization.decision
          - method: POST
            rel: createDirectAuthorizationDecision
            href: /authorization/decisions
            uri: /authorization/decisions
            type: application/vnd.sas.authorization.context
            responseType: application/vnd.sas.authorization.direct.decision+json
          - method: POST
            rel: createTextAuthorizationDecision
            href: /authorization/decisions
            uri: /authorization/decisions
            type: application/vnd.sas.authorization.context
            responseType: text/plain
          - method: GET
            rel: rules
            href: /authorization/rules
            uri: /authorization/rules
            type: application/vnd.sas.collection
            itemType: application/vnd.sas.authorization.rule
          - method: POST
            rel: createRule
            href: /authorization/rules
            uri: /authorization/rules
            type: application/vnd.sas.authorization.rule
            responseType: application/vnd.sas.authorization.rule
          - method: GET
            rel: rule
            href: /authorization/rules/{ruleId}
            uri: /authorization/rules/{ruleId}
            type: application/vnd.sas.authorization.rule
          - method: PUT
            rel: createOrUpdateRule
            href: /authorization/rules/{ruleId}
            uri: /authorization/rules/{ruleId}
            type: application/vnd.sas.authorization.rule
            responseType: application/vnd.sas.authorization.rule
          - method: DELETE
            rel: deleteRule
            href: /authorization/rules/{ruleId}
            uri: /authorization/rules/{ruleId}
          - method: PATCH
            rel: patchRules
            href: /authorization/rules
            uri: /authorization/rules
            type: application/json-patch+json
            responseType: application/vnd.sas.collection
            responseItemType: application/vnd.sas.authorization.rule
          - method: POST
            rel: createDecisionExplanation
            href: /authorization/decisions
            uri: /authorization/decisions
            type: application/vnd.sas.uriarray; version=1
            responseType: application/vnd.sas.authorization.explanations;version=1
          - method: POST
            rel: authorizeLinks
            href: /authorization/decisions
            uri: /authorization/decisions
            type: application/vnd.sas.authorization.bulk.context
            responseType: application/vnd.sas.authorization.authorized.links
          - method: POST
            rel: createBulkDecision
            href: /authorization/bulkDecision
            uri: /authorization/bulkDecision
            type: application/vnd.sas.authorization.context
            responseType: application/vnd.sas.authorization.links
          - method: GET
            rel: localizedTypes
            href: /authorization/localizations/types
            uri: /authorization/localizations/types
            responseType: application/vnd.sas.collection
          - method: GET
            rel: localizedPermissions
            href: /authorization/localizations/permissions
            uri: /authorization/localizations/permissions
            responseType: application/vnd.sas.collection
          - method: GET
            rel: localizedPrincipalTypes
            href: /authorization/localizations/principalTypes
            uri: /authorization/localizations/principalTypes
            responseType: application/vnd.sas.collection
          - method: POST
            rel: conditionValidation
            href: /authorization/conditionValidation
            uri: /authorization/conditionValidation
            responseType: application/vnd.sas.validation
          - method: POST
            rel: validateCondition
            href: /authorization/commons/validations/conditions
            uri: /authorization/commons/validations/conditions
            responseType: application/vnd.sas.error
          - method: POST
            rel: validate
            href: /authorization/commons/validations/rules
            uri: /authorization/commons/validations/rules
            responseType: application/vnd.sas.error
          - method: PUT
            rel: validateUpdate
            href: /authorization/commons/validations/rules/{ruleId}
            uri: /authorization/commons/validations/rules/{ruleId}
            responseType: application/vnd.sas.error
          - method: DELETE
            rel: validateDelete
            href: /authorization/commons/validations/rules/{ruleId}
            uri: /authorization/commons/validations/rules/{ruleId}
            responseType: application/vnd.sas.error
          - method: POST
            rel: createRuleJob
            href: /authorization/rules/jobs
            uri: /authorization/rules/jobs
            responseType: application/vnd.sas.authorization.rule.job
          - method: GET
            rel: ruleJobs
            href: /authorization/rules/jobs/{jobId}
            uri: /authorization/rules/jobs/{jobId}
            type: application/vnd.sas.authorization.rule.job
          - method: GET
            rel: ruleJobState
            href: /authorization/rules/jobs/{jobId}/state
            uri: /authorization/rules/jobs/{jobId}/state
            type: application/vnd.sas.authorization.rule.job
          - method: GET
            rel: shares
            href: /authorization/shares/
            uri: /authorization/shares/
            responseType: application/vnd.sas.collection
            responseItemType: application/vnd.sas.authorization.share
          - method: GET
            rel: share
            href: /authorization/shares/{shareId}
            uri: /authorization/shares/{shareId}
            responseType: application/vnd.sas.authorization.share
          - method: POST
            rel: createShare
            href: /authorization/shares
            uri: /authorization/shares
            type: application/vnd.sas.authorization.share
            responseType: application/vnd.sas.authorization.share
          - method: PUT
            rel: updateShare
            href: /authorization/shares/{shareId}
            uri: /authorization/shares/{shareId}
            type: application/vnd.sas.authorization.share
            responseType: application/vnd.sas.authorization.share
          - method: DELETE
            rel: deleteShare
            href: /authorization/shares/{shareId}
            uri: /authorization/shares/{shareId}
          - method: PATCH
            rel: patchShares
            href: /authorization/shares
            uri: /authorization/shares
            type: application/json-patch+json
            responseType: application/vnd.sas.collection
            responseItemType: application/vnd.sas.authorization.share
          - method: GET
            rel: shareConfiguration
            href: /authorization/shares/configuration
            uri: /authorization/shares/configuration
            responseType: application/vnd.sas.properties+json
          - method: GET
            rel: getCapabilities
            href: /authorization/capabilities
            uri: /authorization/capabilities
            type: application/vnd.sas.authorization.capability
            responseType: application/vnd.sas.collection
            responseItemType: application/vnd.sas.authorization.capability
          - method: GET
            rel: getCapabilities
            href: /authorization/capabilities
            uri: /authorization/capabilities
            type: application/vnd.sas.authorization.capability.summary
            responseType: application/vnd.sas.collection
            responseItemType: application/vnd.sas.authorization.capability.summary
          - method: POST
            rel: createCapability
            href: /authorization/capabilities
            uri: /authorization/capabilities
            responseType: application/vnd.sas.authorization.capability
          - method: DELETE
            rel: deleteGroupCapabilities
            href: /authorization/capabilities
            uri: /authorization/capabilities
          - method: GET
            rel: getCapability
            href: /authorization/capabilities/{capabilityName}
            uri: /authorization/capabilities/{capabilityName}
            type: application/vnd.sas.authorization.capability.summary
            responseType: application/vnd.sas.authorization.capability.summary
          - method: PATCH
            rel: patchCapability
            href: /authorization/capabilities/{capabilityName}
            uri: /authorization/capabilities/{capabilityName}
            type: application/vnd.sas.authorization.capability
            responseType: application/vnd.sas.authorization.capability
          - method: GET
            rel: getGroupsForCapability
            href: /authorization/capabilities/{capabilityName}/groups
            uri: /authorization/capabilities/{capabilityName}/groups
            type: application/vnd.sas.authorization.capability
            responseType: application/vnd.sas.collection
          - method: POST
            rel: addCapabilityToGroup
            href: /authorization/capabilities/{capabilityName}/groups
            uri: /authorization/capabilities/{capabilityName}/groups
          - method: DELETE
            rel: deleteCapabilityFromGroup
            href: /authorization/capabilities/{capabilityName}/groups/{groupId}
            uri: /authorization/capabilities/{capabilityName}/groups/{groupId}
    createRule:
      summary: Create an Authorization Rule
      description: An example of creating an authorization rule
      value:
        type: grant
        permissions:
          - read
        principalType: authenticatedUsers
        objectUri: /preferences/
        description: Allow access to a service root.
        matchParams: false
        enabled: true
        principal: testprincipal
    getRule:
      summary: Get an Authorization Rule by ID
      description: "<p>An example of using a known ID to obtain individual authorization rules.</p> <p>To add pagination to the request, modify the request like this: <ul><li>GET /authorization/rules?start=0&limit=20</li></ul></p>"
      value:
        type: grant
        permissions:
          - read
        principal: testprincipal
        principalType: authenticatedUsers
        objectUri: /preferences/
        description: Allow access to a service root.
        matchParams: false
        version: 10
        links:
          - method: GET
            rel: self
            href: /authorization/rules/3288b305-981f-4b8d-b440-0911eabc3fac
            uri: /authorization/rules/3288b305-981f-4b8d-b440-0911eabc3fac
            type: application/vnd.sas.authorization.rule
          - method: PUT
            rel: update
            href: /authorization/rules/3288b305-981f-4b8d-b440-0911eabc3fac
            uri: /authorization/rules/3288b305-981f-4b8d-b440-0911eabc3fac
            type: application/vnd.sas.authorization.rule
            responseType: application/vnd.sas.authorization.rule
          - method: DELETE
            rel: delete
            href: /authorization/rules/3288b305-981f-4b8d-b440-0911eabc3fac
            uri: /authorization/rules/3288b305-981f-4b8d-b440-0911eabc3fac
        id: 3288b305-981f-4b8d-b440-0911eabc3fac
        modifiedTimestamp: 2016-08-27T04:09:42.150Z
        createdTimestamp: 2016-08-27T04:09:42.150Z
        createdBy: sas.preferences
        modifiedBy: sas.preferences
        enabled: true
    updateRule:
      summary: Update an Authorization Rule
      description: An example of using a known ID to update individual authorization rules.
      value:
        type: prohibit
        permissions:
          - read
        principalType: authenticatedUsers
        objectUri: /preferences/
        description: Allow access to a service root.
        matchParams: false
        version: 10
        links:
          - method: GET
            rel: self
            href: /authorization/rules/3288b305-981f-4b8d-b440-0911eabc3fac
            uri: /authorization/rules/3288b305-981f-4b8d-b440-0911eabc3fac
            type: application/vnd.sas.authorization.rule
          - method: PUT
            rel: update
            href: /authorization/rules/3288b305-981f-4b8d-b440-0911eabc3fac
            uri: /authorization/rules/3288b305-981f-4b8d-b440-0911eabc3fac
            type: application/vnd.sas.authorization.rule
            responseType: application/vnd.sas.authorization.rule
          - method: DELETE
            rel: delete
            href: /authorization/rules/3288b305-981f-4b8d-b440-0911eabc3fac
            uri: /authorization/rules/3288b305-981f-4b8d-b440-0911eabc3fac
        id: 3288b305-981f-4b8d-b440-0911eabc3fac
        modifiedTimestamp: 2016-08-27T04:09:42.150Z
        createdTimestamp: 2016-08-27T04:09:42.150Z
        createdBy: sas.preferences
        modifiedBy: sas.preferences
        enabled: true
    patchRules:
      summary: Patch a Collection of Rules Using a Condition
      description: <p>An example of using a condition to set permissions and the objectUri for a defined rule.</p> <p>The key data in this example are the following</p> <ul> <li>The condition is named 'test'.</li> <li>The condition indicates the existing rule must have type=grant, permissions=[read,update], objectUri=/identities/**, and principalType=authenticated-users.</li> </ul> <p>If all of these values match, the patch is applied and the following is set:</p> <ul> <li>The permissions are set to Read, Update, Delete, and Secure.</li> <li>The objectUri is set to '/identities/*'.</li> </ul> <p>If any of these values do not match, the patch is not applied.</p>
      value:
        - - op: test
            path: /authorization/rules/e7ae0810-a47d-11e7-abc4-cec278b6b50a
            value:
              type: grant
              permissions:
                - read
                - update
              objectUri: /identities/**
              principalType: authenticated-users
          - op: add
            path: /authorization/rules/e7ae0810-a47d-11e7-abc4-cec278b6b50a
            value:
              permissions:
                - read
                - update, delete, secure
              objectUri: /identities/*
    migrateRule:
      summary: Migrate Existing Rules with a PATCH Request
      description: "<p>An example of using a combination of defined JSON patch operations to migrate existing rules.</p> <ul> <li>The `copy` operation copies the existing rule and any changes that might have been applied to it.</li> <li>The `add` or `replace` operation updates the target rule.</li> <li>The `remove` operation must delete either the original rule or the new rule.</li> <ul> <p>To target a rule that does not have a known ID, use the simple token substitution system that this API provides. In a single patch, each new rule that is created by an `add` or `copy` operation is added to a zero-indexed, ordered list.</p> <p>Note: An `add` operation can be either a create or an update, depending on whether a rule with the given ID already exists. A rule that is updated is not added to the list of created rules.</p> <p>If you know the order in which rules are created within a patch, you can reference any such rule by its index. Use the token @CREATED#@, where '#' is the index of the rule that you are targeting.</p> <p>This example assumes that a rule already exists with ID = 'sourceId' and modifies the rule before removing the source rule.</p>"
      value:
        - - op: copy
            from: /authorization/rules/sourceId
            path: /authorization/rules/
          - op: replace
            path: /authorization/rules/@CREATED0@
            value:
              type: grant
              permissions:
                - read
                - update
              objectUri: /identities/**
              principalType: authenticated-users
              reason: Authenticated Users can read identities, groups, users, members, memberships.
          - op: remove
            path: /authorization/rules/sourceId
    createMonitorRuleJobBody:
      summary: Create and Monitor a Rule Job
      description: <p>An example of creating a rule job that will create two rules and modify an existing rule. To check the current state of the job use:<ul><li>GET /authorization/rules/jobs/cc2cb37c-24e6-4398-b7c8-4b6603bc4608/state</li></ul></p>
      value:
        status: notStarted
        version: 2
        state: pending
        actions:
          - rule:
              type: grant
              permissions:
                - add
                - create
                - delete
                - read
                - remove
                - secure
                - update
              principal: testprincipal
              principalType: user
              objectUri: /test/**
              mediaType: application/vnd.sas.test
              reason: Because I'm testing
              matchParams: false
              version: 9
              enabled: true
            type: create
            status: pending
            state: pending
            priority: 1
          - rule:
              type: grant
              permissions:
                - read
              principal: testprincipal
              principalType: authenticatedUsers
              objectUri: /test/**
              mediaType: application/vnd.sas.test
              reason: Because I'm testing
              matchParams: false
              version: 9
              enabled: true
            type: create
            status: pending
            state: pending
            priority: 1
          - rule:
              type: prohibit
              permissions:
                - add
                - create
                - delete
                - read
                - remove
                - secure
                - update
              principal: testprincipal
              principalType: user
              objectUri: /foo/bar
              mediaType: application/vnd.sas.test
              reason: Because I'm testing
              matchParams: false
              version: 9
              id: 0ee67d20-7b22-4d0f-af3e-fe29ef5b72ed
              enabled: true
            type: update
            status: pending
            state: pending
            priority: 1
    createMonitorRuleJobResponse:
      summary: Create and Monitor a Rule Job
      description: <p>An example of creating a rule job that will create two rules and modify an existing rule. To check the current state of the job use:<ul><li>GET /authorization/rules/jobs/cc2cb37c-24e6-4398-b7c8-4b6603bc4608/state</li></ul></p>
      value:
        id: cc2cb37c-24e6-4398-b7c8-4b6603bc4608
        createdBy: user
        status: notStarted
        version: 2
        state: pending
        links:
          - method: GET
            rel: self
            href: /authorization/rules/jobs/cc2cb37c-24e6-4398-b7c8-4b6603bc4608
            uri: /authorization/rules/jobs/cc2cb37c-24e6-4398-b7c8-4b6603bc4608
            type: application/vnd.sas.authorization.rule.job
          - method: GET
            rel: ruleJobState
            href: /authorization/rules/jobs/cc2cb37c-24e6-4398-b7c8-4b6603bc4608/state
            uri: /authorization/rules/jobs/cc2cb37c-24e6-4398-b7c8-4b6603bc4608/state
            type: text/plain
        actions:
          - id: 29e69b13-7a0f-4939-a7e9-b4400f71f7d8
            rule:
              type: prohibit
              permissions:
                - add
                - create
                - delete
                - read
                - remove
                - secure
                - update
              principal: testprincipal
              principalType: user
              objectUri: /foo/bar
              mediaType: application/vnd.sas.test
              reason: Because I'm testing
              matchParams: false
              version: 9
              id: 0ee67d20-7b22-4d0f-af3e-fe29ef5b72ed
              enabled: true
            type: create
            status: pending
            state: pending
            priority: 1
          - id: 80379599-5ca6-4c80-8487-4d7e4fe62e7b
            rule:
              type: prohibit
              permissions:
                - add
                - create
                - delete
                - read
                - remove
                - secure
                - update
              principal: testprincipal
              principalType: user
              objectUri: /foo/bar
              mediaType: application/vnd.sas.test
              reason: Because I'm testing
              matchParams: false
              version: 9
              id: 0ee67d20-7b22-4d0f-af3e-fe29ef5b72ed
              enabled: true
            type: create
            status: pending
            state: pending
            priority: 1
          - id: e479a954-4832-4e8c-a18e-b10ab3bf2950
            rule:
              type: prohibit
              permissions:
                - add
                - create
                - delete
                - read
                - remove
                - secure
                - update
              principal: testprincipal
              principalType: user
              objectUri: /foo/bar
              mediaType: application/vnd.sas.test
              reason: Because I'm testing
              matchParams: false
              version: 9
              id: 0ee67d20-7b22-4d0f-af3e-fe29ef5b72ed
              enabled: true
            type: update
            status: pending
            state: pending
            priority: 1
    shareResourceBody:
      summary: Share a resource
      description: An example of creating a share that enables another user to read a file that they do not already have access to.
      value:
        type: read
        sharedWith: testUser
        sharedWithType: user
        resourceUri: /files/files/4288b305-981f-4b8d-b440-0911eabe3faf
        name: test file
    shareCollectionResponse:
      summary: A collection of share resources
      description: An example of creating multiple shares that enables another user to read a file that they do not already have access to.
      value:
        value:
          - type: read
            sharedWith: testUser
            sharedWithType: user
            sharedBy: currentUser
            resourceUri: /files/files/4288b305-981f-4b8d-b440-0911eabe3faf
            name: test file
            enabled: true
            version: 3
            links:
              - method: GET
                rel: self
                href: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                uri: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                type: application/vnd.sas.authorization.share
              - method: PUT
                rel: update
                href: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                uri: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                type: application/vnd.sas.authorization.share
                responseType: application/vnd.sas.authorization.share
              - method: DELETE
                rel: delete
                href: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
                uri: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
            id: 3288b305-981f-4b8d-b440-0911eabc3fac
            modifiedTimestamp: 2016-08-27T04:09:42.150Z
            createdTimestamp: 2016-08-27T04:09:42.150Z
            createdBy: currentUser
            modifiedBy: currentUser
          - type: read
            sharedWith: testUser
            sharedWithType: user
            sharedBy: currentUser
            resourceUri: /files/files/file2
            name: test file
            enabled: true
            version: 3
            links:
              - method: GET
                rel: self
                href: /authorization/shares/file2
                uri: /authorization/shares/file2
                type: application/vnd.sas.authorization.share
              - method: PUT
                rel: update
                href: /authorization/shares/file2
                uri: /authorization/shares/file2
                type: application/vnd.sas.authorization.share
                responseType: application/vnd.sas.authorization.share
              - method: DELETE
                rel: delete
                href: /authorization/shares/file2
                uri: /authorization/shares/file2
            id: 3288b305-981f-4b8d-b440-0911eabc3fac
            modifiedTimestamp: 2016-08-27T04:09:42.150Z
            createdTimestamp: 2016-08-27T04:09:42.150Z
            createdBy: currentUser
            modifiedBy: currentUser
    shareResourceResponse:
      summary: Share a resource
      description: An example of creating a share that enables another user to read a file that they do not already have access to.
      value:
        type: read
        sharedWith: testUser
        sharedWithType: user
        sharedBy: currentUser
        resourceUri: /files/files/4288b305-981f-4b8d-b440-0911eabe3faf
        name: test file
        enabled: true
        version: 3
        links:
          - method: GET
            rel: self
            href: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
            uri: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
            type: application/vnd.sas.authorization.share
          - method: PUT
            rel: update
            href: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
            uri: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
            type: application/vnd.sas.authorization.share
            responseType: application/vnd.sas.authorization.share
          - method: DELETE
            rel: delete
            href: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
            uri: /authorization/shares/3288b305-981f-4b8d-b440-0911eabc3fac
        id: 3288b305-981f-4b8d-b440-0911eabc3fac
        modifiedTimestamp: 2016-08-27T04:09:42.150Z
        createdTimestamp: 2016-08-27T04:09:42.150Z
        createdBy: currentUser
        modifiedBy: currentUser
    createDecision:
      summary: Create an Authorization Decision
      description: An example of using relevant authorization context to create an authorization decision..
      value:
        request:
          uri: /test/123
        principals:
          - version: 1
            name: testuser
            type: user
        permission: read
        parameters: {}
        properties: {}
        links: {}
        bulkLinks: {}
        matchParams: false
        eachNamed: {}
        returnObjectName: null
    createBulkDecisionBody:
      summary: Create a Bulk Authorization Decision
      description: An example of using relevant authorization context, as well as a map of permissions to an array of links, to create a bulk authorization decision.
      value:
        request: {}
        principals:
          - version: 1
            name: testprincipal
            type: user
        permission: read
        parameters: {}
        properties: {}
        links: {}
        bulkLinks:
          read:
            - method: GET
              rel: fakeRel
              href: /test/123
              uri: /test/123
            - method: GET
              rel: fakeRel
              href: /something
              uri: /something
            - method: GET
              rel: fakeRel
              href: /test123/123456
              uri: /test123/123456
            - method: GET
              rel: fakeRel
              href: /xyz/abc/something
              uri: /xyz/abc/something
        matchParams: false
        eachNamed: {}
        returnObjectName: null
    createBulkDecisionResponse:
      summary: Create a Bulk Authorization Decision
      description: An example of using relevant authorization context, as well as a map of permissions to an array of links, to create a bulk authorization decision.
      value:
        version: 2
        grantedLinks:
          - method: GET
            rel: fakeRel
            href: /something
            uri: /something
          - method: GET
            rel: fakeRel
            href: /test123/123456
            uri: /test123/123456
          - method: GET
            rel: fakeRel
            href: /test/123
            uri: /test/123
          - method: GET
            rel: fakeRel
            href: /xyz/abc/something
            uri: /xyz/abc/something
        prohibitedLinks: []
    createBulkParameterizedLinkDecisionBody:
      summary: Create a Bulk Authorization Decision using parameterized links
      description: An example of using relevant authorization context, as well as a map of permissions to an array of parameterized links, to create a bulk authorization decision.
      value:
        request: {}
        principals:
          - version: 1
            name: testprincipal
            type: user
        permission: read
        parameters: {}
        properties: {}
        links: {}
        parameterizedLinks:
          read:
            - method: GET
              rel: fakeRel
              href: /test/123
              uri: /test/123
              parameters:
                createdBy: User1
            - method: GET
              rel: fakeRel
              href: /something
              uri: /something
              parameters:
                createdBy: User2
            - method: GET
              rel: fakeRel
              href: /test123/123456
              uri: /test123/123456
              parameters:
                createdBy: User1
            - method: GET
              rel: fakeRel
              href: /xyz/abc/something
              uri: /xyz/abc/something
              parameters:
                createdBy: User3
        matchParams: false
        eachNamed: {}
        returnObjectName: null
    createBulkParameterizedLinkDecisionResponse:
      summary: Create a Bulk Authorization Decision using parameterized links
      description: An example of using relevant authorization context, as well as a map of permissions to an array of parameterized links, to create a bulk authorization decision.
      value:
        version: 2
        grantedLinks: []
        grantedParameterizedLinks:
          - method: GET
            rel: fakeRel
            href: /something
            uri: /something
            parameters:
              createdBy: User2
          - method: GET
            rel: fakeRel
            href: /test123/123456
            uri: /test123/123456
            parameters:
              createdBy: User1
          - method: GET
            rel: fakeRel
            href: /test/123
            uri: /test/123
            parameters:
              createdBy: User1
          - method: GET
            rel: fakeRel
            href: /xyz/abc/something
            uri: /xyz/abc/something
            parameters:
              createdBy: User3
        prohibitedLinks: []
        prohibitedParameterizedLinks: []
    getCapabilityV1:
      summary: Get Authorization Capability
      description: An example of using a known capability name to obtain the capability.
      value:
        id: 4d80eebd-db26-4ee9-beff-a1ce51c24d9f
        name: sas.audit.report
        uri: /capability/sas/audit/report
        description: Grants access to run audit reports.
        version: 1
        links:
          - method: GET
            rel: self
            href: /autorization/capabilities/sas.audit.report
            uri: /autorization/capabilities/sas.audit.report
            responseType: application/vnd.sas.authorization.capability
        principals:
          - version: 1
            name: sviadms
            type: group
    getCapabilityV2:
      summary: Get Authorization Capability
      description: An example of using a known capability name to obtain the capability.
      value:
        id: 4d80eebd-db26-4ee9-beff-a1ce51c24d9f
        name: sas.audit.report
        uri: /capability/sas/audit/report
        description: Grants access to run audit reports.
        product: va
        version: 1
        links:
          - method: GET
            rel: self
            href: /autorization/capabilities/sas.audit.report
            uri: /autorization/capabilities/sas.audit.report
            responseType: application/vnd.sas.authorization.capability
        principals:
          - version: 2
            name: sviadms
            type: group
    capabilitySummaryV2:
      summary: A capability summary
      description: An example of a capability summary.
      value:
        id: 4d80eebd-db26-4ee9-beff-a1ce51c24d9f
        name: sas.audit.report
        uri: /capability/sas/audit/report
        description: Grants access to run audit reports.
        product: va
        version: 2
    capabilitySummaryV1:
      summary: A capability summary
      description: An example of a capability summary.
      value:
        id: 4d80eebd-db26-4ee9-beff-a1ce51c24d9f
        name: sas.audit.report
        uri: /capability/sas/audit/report
        description: Grants access to run audit reports.
        version: 1
    getCapabilitySummaryCollection:
      summary: An example capability summary collection response
      description: An example capability summary collection response
      value:
        description: A collection of capability summaries
        links:
          - method: GET
            rel: collection
            href: /authorization/capabilities
            uri: /authorization/capabilities
            type: application/vnd.sas.collection
          - method: GET
            rel: self
            href: /authorization/capabilities?sortBy=name:ascending&user=gclooney&start=0&limit=100
            uri: /authorization/capabilities?sortBy=name:ascending&user=gclooney&start=0&limit=100
            type: application/vnd.sas.collection
        name: items
        accept: application/vnd.sas.authorization.capability+json
        start: 0
        count: 2
        items:
          - creationTimeStamp: null
            modifiedTimeStamp: null
            createdBy: null
            modifiedBy: null
            id: capability001
            name: sas.folders.create
            uri: /capability/sas/folders/create
            description: grant ability to create a folder
            product: va
            version: 2
            links: []
            principals: []
          - creationTimeStamp: null
            modifiedTimeStamp: null
            createdBy: null
            modifiedBy: null
            id: capability003
            name: sas.folders.delete
            uri: /capability/sas/folders/delete
            description: grant ability to delete a folder
            product: va
            version: 2
            links: []
            principals: []
        limit: 100
        version: 2
    getPrincipalCollection:
      summary: A collection of principal representations.
      description: A collection of specific users or groups.
      value:
        values:
          - principal:
              version: 1
              name: SASAdministrators
              type: group
          - principal:
              version: 1
              type: authenticated-users
    getValidation:
      summary: Determine whether the passed value is valid
      description: Validate the request but do not execute the request, and return this response to indicate if the request was valid at the time it was made
      value:
        links: []
        valid: true
        version: 1
    decisionResponseFail:
      summary: Whether an action is authorized for a user
      description: A true or false on whether an action is authorized for a user
      value: false
    decisionResponse:
      summary: Whether an action is authorized for a user
      description: A true or false on whether an action is authorized for a user
      value: true
    explanationResponse:
      summary: Returns the reason why an authorization decision was reached
      description: Provides authorization information for specified principals in a specified context. Each explanation identifies the rules that are relevant to a particular authorization decision and includes details (such as parent containment) if applicable.
      value:
        version: 1
        explanations:
          - /reports/reports/5f74a445-7b99-42db-ab45-2c71e893feb1:
              - principal:
                  version: 1
                  name: SASAdministrators
                  type: group
                read:
                  result: grant
                  grantFactor:
                    direct: true
                    contributingRules:
                      - method: GET
                        rel: directContributingRule
                        href: /authorization/rules/febcfcde-00ab-41ea-af4d-dff4d51e9e04
                        uri: /authorization/rules/febcfcde-00ab-41ea-af4d-dff4d51e9e04
              - principal:
                  version: 1
                  type: authenticated-users
                read:
                  result: prohibit
          - /folders/folders/123-456-789:
              - principal:
                  version: 1
                  name: SASAdministrators
                  type: group
                read:
                  result: grant
                  grantFactor:
                    direct: true
                    contributingRules:
                      - method: GET
                        rel: directContributingRule
                        href: /authorization/rules/febcfcde-00ab-41ea-af4d-dff4d51e9e04
                        uri: /authorization/rules/febcfcde-00ab-41ea-af4d-dff4d51e9e04
                  conveyedExplanation:
                    result: grant
                    grantFactor:
                      direct: true
                      contributingRules:
                        - method: GET
                          rel: directContributingRule
                          href: /authorization/rules/febcfcde-00ab-41ea-af4d-dff4d51e9e04
                          uri: /authorization/rules/febcfcde-00ab-41ea-af4d-dff4d51e9e04
    localizationResponse:
      description: For every rule with enumerated endpoints, there is a localization endpoint that will output a JSON object containing localized versions of each enumerated value
      summary: Localized json response
      value:
        version: 5
        values:
          - value: user
            localizedValue: user
          - value: group
            localizedValue: group
          - value: authenticated-users
            localizedValue: authenticated-users
          - value: everyone
            localizedValue: everyone
    sharePropResponse:
      summary: Sharing configuration properties
      description: Gets property values that specify how sharing is configured. sas.authorization.share.enabled determines whether sharing is enabled at all in the system while sas.authorization.share.reshare.enabled determines whether users are allowed to grant reshare permission on objects.
      value:
        sas.authorization.share.reshare.enabled: false
        sas.authorization.share.enabled: false
    validateSpelCondition:
      summary: Validate a SPEL condition
      description: An example of a valid SPEL condition
      value: "currentUser() == #resource?.createdBy"
    errorResponse404:
      description: An example of a standard error response
      summary: Return an error
      value:
        errorCode: 404
        message: Not Found
        details:
          - path: /authorization/rules/fakeId
        links: []
        version: 2
        httpStatusCode: 404
    errorResponse400:
      description: An example of a standard error response
      summary: Return an error
      value:
        errorCode: 400
        message: Bad Request
        links: []
        version: 2
        httpStatusCode: 400
    errorResponse403:
      description: An example of a standard error response
      summary: Return an 403 error
      value:
        errorCode: 403
        message: Forbidden
        links: []
        version: 2
        httpStatusCode: 403
    errorResponse412:
      description: An example of a standard error response
      summary: Return an 412 error
      value:
        errorCode: 412
        message: Precondition failed
        links: []
        version: 2
        httpStatusCode: 412
    errorResponse428:
      description: An example of a standard error response
      summary: Return an 428 error
      value:
        errorCode: 428
        message: Precondition required
        links: []
        version: 2
        httpStatusCode: 428
    errorResponse422:
      description: An example of a standard error response
      summary: Return an 422 error
      value:
        errorCode: 422
        message: Unprocessable Entity
        links: []
        version: 2
        httpStatusCode: 422
