@@ -165,6 +165,38 @@ components:
165165 - STANDARD_ACTION_UNSPECIFIED
166166 - STANDARD_ACTION_DECRYPT
167167 - STANDARD_ACTION_TRANSMIT
168+ policy.Algorithm :
169+ type : string
170+ title : Algorithm
171+ enum :
172+ - ALGORITHM_UNSPECIFIED
173+ - ALGORITHM_RSA_2048
174+ - ALGORITHM_RSA_4096
175+ - ALGORITHM_EC_P256
176+ - ALGORITHM_EC_P384
177+ - ALGORITHM_EC_P521
178+ description : Supported key algorithms.
179+ policy.KasPublicKeyAlgEnum :
180+ type : string
181+ title : KasPublicKeyAlgEnum
182+ enum :
183+ - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED
184+ - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048
185+ - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096
186+ - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1
187+ - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1
188+ - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1
189+ policy.SourceType :
190+ type : string
191+ title : SourceType
192+ enum :
193+ - SOURCE_TYPE_UNSPECIFIED
194+ - SOURCE_TYPE_INTERNAL
195+ - SOURCE_TYPE_EXTERNAL
196+ description : |-
197+ Describes whether this kas is managed by the organization or if they imported
198+ the kas information from an external party. These two modes are necessary in order
199+ to encrypt a tdf dek with an external parties kas public key.
168200 authorization.v2.EntityEntitlements :
169201 type : object
170202 properties :
@@ -772,12 +804,198 @@ components:
772804 name :
773805 type : string
774806 title : name
807+ namespace :
808+ title : namespace
809+ description : Namespace context for this action
810+ $ref : ' #/components/schemas/policy.Namespace'
775811 metadata :
776812 title : metadata
777813 $ref : ' #/components/schemas/common.Metadata'
778814 title : Action
779815 additionalProperties : false
780816 description : An action an entity can take
817+ policy.KasPublicKey :
818+ type : object
819+ properties :
820+ pem :
821+ type : string
822+ title : pem
823+ maxLength : 8192
824+ minLength : 1
825+ description : x509 ASN.1 content in PEM envelope, usually
826+ kid :
827+ type : string
828+ title : kid
829+ maxLength : 32
830+ minLength : 1
831+ description : A unique string identifier for this key
832+ alg :
833+ not :
834+ enum :
835+ - 0
836+ title : alg
837+ description : |-
838+ A known algorithm type with any additional parameters encoded.
839+ To start, these may be `rsa:2048` for RSA-based wrapping and
840+ `ec:secp256r1` for EC-based wrapping, but more formats may be added as needed.
841+ $ref : ' #/components/schemas/policy.KasPublicKeyAlgEnum'
842+ title : KasPublicKey
843+ additionalProperties : false
844+ description : |-
845+ Deprecated
846+ A KAS public key and some associated metadata for further identifcation
847+ policy.KasPublicKeySet :
848+ type : object
849+ properties :
850+ keys :
851+ type : array
852+ items :
853+ $ref : ' #/components/schemas/policy.KasPublicKey'
854+ title : keys
855+ title : KasPublicKeySet
856+ additionalProperties : false
857+ description : |-
858+ Deprecated
859+ A list of known KAS public keys
860+ policy.KeyAccessServer :
861+ type : object
862+ properties :
863+ id :
864+ type : string
865+ title : id
866+ uri :
867+ type : string
868+ title : uri
869+ description : |+
870+ Address of a KAS instance
871+ URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.:
872+ ```
873+ this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$')
874+ ```
875+
876+ publicKey :
877+ title : public_key
878+ description : ' Deprecated: KAS can have multiple key pairs'
879+ $ref : ' #/components/schemas/policy.PublicKey'
880+ sourceType :
881+ title : source_type
882+ description : ' The source of the KAS: (INTERNAL, EXTERNAL)'
883+ $ref : ' #/components/schemas/policy.SourceType'
884+ kasKeys :
885+ type : array
886+ items :
887+ $ref : ' #/components/schemas/policy.SimpleKasKey'
888+ title : kas_keys
889+ description : Kas keys associated with this KAS
890+ name :
891+ type : string
892+ title : name
893+ description : |-
894+ Optional
895+ Unique name of the KAS instance
896+ metadata :
897+ title : metadata
898+ description : Common metadata
899+ $ref : ' #/components/schemas/common.Metadata'
900+ title : KeyAccessServer
901+ additionalProperties : false
902+ description : Key Access Server Registry
903+ policy.Namespace :
904+ type : object
905+ properties :
906+ id :
907+ type : string
908+ title : id
909+ description : generated uuid in database
910+ name :
911+ type : string
912+ title : name
913+ description : |-
914+ used to partition Attribute Definitions, support by namespace AuthN and
915+ enable federation
916+ fqn :
917+ type : string
918+ title : fqn
919+ active :
920+ title : active
921+ description : active by default until explicitly deactivated
922+ $ref : ' #/components/schemas/google.protobuf.BoolValue'
923+ metadata :
924+ title : metadata
925+ $ref : ' #/components/schemas/common.Metadata'
926+ grants :
927+ type : array
928+ items :
929+ $ref : ' #/components/schemas/policy.KeyAccessServer'
930+ title : grants
931+ description : Deprecated KAS grants for the namespace. Use kas_keys instead.
932+ kasKeys :
933+ type : array
934+ items :
935+ $ref : ' #/components/schemas/policy.SimpleKasKey'
936+ title : kas_keys
937+ description : Keys for the namespace
938+ title : Namespace
939+ additionalProperties : false
940+ policy.PublicKey :
941+ type : object
942+ oneOf :
943+ - properties :
944+ cached :
945+ title : cached
946+ description : public key with additional information. Current preferred version
947+ $ref : ' #/components/schemas/policy.KasPublicKeySet'
948+ title : cached
949+ required :
950+ - cached
951+ - properties :
952+ remote :
953+ type : string
954+ title : remote
955+ description : |+
956+ kas public key url - optional since can also be retrieved via public key
957+ URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.:
958+ ```
959+ this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$')
960+ ```
961+
962+ title : remote
963+ required :
964+ - remote
965+ title : PublicKey
966+ additionalProperties : false
967+ description : Deprecated
968+ policy.SimpleKasKey :
969+ type : object
970+ properties :
971+ kasUri :
972+ type : string
973+ title : kas_uri
974+ description : The URL of the Key Access Server
975+ publicKey :
976+ title : public_key
977+ description : The public key of the Key that belongs to the KAS
978+ $ref : ' #/components/schemas/policy.SimpleKasPublicKey'
979+ kasId :
980+ type : string
981+ title : kas_id
982+ description : The ID of the Key Access Server
983+ title : SimpleKasKey
984+ additionalProperties : false
985+ policy.SimpleKasPublicKey :
986+ type : object
987+ properties :
988+ algorithm :
989+ title : algorithm
990+ $ref : ' #/components/schemas/policy.Algorithm'
991+ kid :
992+ type : string
993+ title : kid
994+ pem :
995+ type : string
996+ title : pem
997+ title : SimpleKasPublicKey
998+ additionalProperties : false
781999 connect-protocol-version :
7821000 type : number
7831001 title : Connect-Protocol-Version
0 commit comments