602cc57c07
In some tables [1], link parameter's type is wrong. This patch change these parameters from 'string' to 'object'. [1] http://developer.openstack.org/api-ref/identity/v3/#list-users http://developer.openstack.org/api-ref/identity/v3/#list-groups http://developer.openstack.org/api-ref/identity/v3/#list-projects Change-Id: I32916b4f3703b1411ddb1e643dd5f2b27fa6af99
1699 lines
43 KiB
YAML
1699 lines
43 KiB
YAML
# variables in header
|
|
X-Auth-Token:
|
|
description: |
|
|
A valid authentication token for an
|
|
administrative user.
|
|
in: header
|
|
required: true
|
|
type: string
|
|
X-Subject-Token:
|
|
description: |
|
|
The authentication token. An authentication
|
|
response returns the token ID in this header rather than in the
|
|
response body.
|
|
in: header
|
|
required: true
|
|
type: string
|
|
X-Subject-Token_1:
|
|
description: |
|
|
The authentication token for which you want to
|
|
perform the operation.
|
|
in: header
|
|
required: true
|
|
type: string
|
|
|
|
# variables in path
|
|
access_token_id:
|
|
description: |
|
|
The ID of the access token.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
credential_id_path:
|
|
description: |
|
|
The UUID for the credential.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
domain_group_template:
|
|
description: |
|
|
The group name, which is ``ldap`` or
|
|
``identity``.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
domain_id_path:
|
|
description: |
|
|
The domain ID.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
endpoint_id_path:
|
|
description: |
|
|
The endpoint ID.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
group_id:
|
|
description: |
|
|
The group ID.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
group_id_path:
|
|
description: |
|
|
The group ID.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
implies_role_id:
|
|
description: |
|
|
Role ID for an implied role.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
option:
|
|
description: |
|
|
The option name. For the ``ldap`` group, a valid
|
|
value is ``url`` or ``user_tree_dn``. For the ``identity`` group,
|
|
a valid value is ``driver``.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
policy_id_path:
|
|
description: |
|
|
The policy ID.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
prior_role_id:
|
|
description: |
|
|
Role ID for a prior role.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
project_id_path:
|
|
description: |
|
|
The project ID.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
region_id_path:
|
|
description: |
|
|
The region ID.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
role_id:
|
|
description: |
|
|
The role ID.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
role_id_path:
|
|
description: |
|
|
The role ID.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
service_id_path:
|
|
description: |
|
|
The service ID.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
user_id_path:
|
|
description: |
|
|
The user ID.
|
|
in: path
|
|
required: true
|
|
type: string
|
|
|
|
# variables in query
|
|
domain_enabled_query:
|
|
description: |
|
|
If set to true, then only domains that are enabled will be returned, if set
|
|
to false only that are disabled will be returned. Any value other than
|
|
``0``, including no value, will be interpreted as true.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
domain_id_query:
|
|
description: |
|
|
Filters the response by a domain ID.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
domain_name_query:
|
|
description: |
|
|
Filters the response by a domain name.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
effective_query:
|
|
description: |
|
|
Returns the effective assignments, including any assignments gained by
|
|
virtue of group membership.
|
|
in: query
|
|
required: false
|
|
type: key-only (no value required)
|
|
enabled_6:
|
|
description: |
|
|
Filters the response by either enabled (``true``)
|
|
or disabled (``false``) domains. Users can authorize against an
|
|
enabled domain and any of its projects. Users that are owned by an
|
|
enabled domain can authenticate and receive additional
|
|
authorization. Users cannot authorize against a disabled domain
|
|
or any of its projects. Users that are owned by a disabled domain
|
|
cannot authenticate or receive additional authorization. All
|
|
tokens that are authorized for a disabled domain or its projects
|
|
become no longer valid. If you reenable the domain, these tokens
|
|
are not re- enabled.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
enabled_9:
|
|
description: |
|
|
Filters the response by either enabled (``true``)
|
|
or disabled (``false``) projects.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
enabled_user_query:
|
|
description: |
|
|
Filters the response by either enabled (``true``)
|
|
or disabled (``false``) users.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
group_id_query:
|
|
description: |
|
|
Filters the response by a group ID.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
group_name_query:
|
|
description: |
|
|
Filters the response by a group name.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
include_names_query:
|
|
description: |
|
|
If set to true, then the names of any entities returned will be include as
|
|
well as their IDs. Any value other than ``0`` (including no value) will be
|
|
interpreted as true.
|
|
in: query
|
|
required: false
|
|
type: boolean
|
|
min_version: 3.6
|
|
include_subtree_query:
|
|
description: |
|
|
If set to true, then relevant assignments in the project hierarchy below
|
|
the project specified in the ``scope.project_id`` query parameter are also
|
|
included in the response. Any value other than ``0`` (including no value)
|
|
for ``include_subtree`` will be interpreted as true.
|
|
in: query
|
|
required: false
|
|
type: boolean
|
|
min_version: 3.6
|
|
interface_query:
|
|
description: |
|
|
Filters the response by an interface.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
is_domain_query:
|
|
description: |
|
|
If this is specified as true, then only projects acting as a domain are
|
|
included. Otherwise, only projects that are not acting as a domain are
|
|
included.
|
|
in: query
|
|
required: false
|
|
type: boolen
|
|
min_version: 3.6
|
|
name_user_query:
|
|
description: |
|
|
Filters the response by a user name.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
nocatalog:
|
|
description: |
|
|
(Since v3.1) The authentication response excludes
|
|
the service catalog. By default, the response includes the service
|
|
catalog.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
parent_id_query:
|
|
description: |
|
|
Filters the response by a parent ID.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
min_version: 3.4
|
|
parent_region_id_query:
|
|
description: |
|
|
Filters the response by a parent region, by ID.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
parents_as_ids:
|
|
description: |
|
|
The entire parent hierarchy will be included as
|
|
nested dictionaries in the response. It will contain
|
|
all projects ids found by traversing up the hierarchy
|
|
to the top-level project.
|
|
in: query
|
|
required: false
|
|
type: key-only, no value expected
|
|
min_version: 3.4
|
|
parents_as_list:
|
|
description: |
|
|
The parent hierarchy will be included as a list in the response.
|
|
This list will contain the projects found by traversing up the
|
|
hierarchy to the top-level project.
|
|
in: query
|
|
required: false
|
|
type: key-only, no value expected
|
|
min_version: 3.4
|
|
policy_type_query:
|
|
description: |
|
|
Filters the response by a MIME media type for the
|
|
serialized policy blob. For example, ``application/json``.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
project_enabled_query:
|
|
description: |
|
|
If set to true, then only enabled projects will be returned. Any value
|
|
other than ``0`` (including no value) will be interpreted as true.
|
|
in: query
|
|
required: false
|
|
type: boolen
|
|
project_name_query:
|
|
description: |
|
|
Filters the response by a project name.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
role_id_query:
|
|
description: |
|
|
Filters the response by a role ID.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
role_name_query:
|
|
description: |
|
|
Filters the response by a role name.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
scope_domain_id_query:
|
|
description: |
|
|
Filters the response by a domain ID.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
scope_os_inherit_inherited_to:
|
|
description: |
|
|
Filters based on role assignments that are inherited.
|
|
The only value of ``inherited_to`` that is currently
|
|
supported is ``projects``.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
scope_project_id_query:
|
|
description: |
|
|
Filters the response by a project ID.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
service_id_query:
|
|
description: |
|
|
Filters the response by a service ID.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
service_type_query:
|
|
description: |
|
|
Filters the response by a service type. A valid
|
|
value is ``compute``, ``ec2``, ``identity``, ``image``,
|
|
``network``, or ``volume``.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
subtree_as_ids:
|
|
description: |
|
|
The entire child hierarchy will be included as nested dictionaries
|
|
in the response. It will contain all the projects ids found by
|
|
traversing down the hierarchy.
|
|
in: query
|
|
required: false
|
|
type: key-only, no value expected
|
|
min_version: 3.4
|
|
subtree_as_list:
|
|
description: |
|
|
The child hierarchy will be included as a list in the response.
|
|
This list will contain the projects found by traversing down
|
|
the hierarchy.
|
|
in: query
|
|
required: false
|
|
type: key-only, no value expected
|
|
min_version: 3.4
|
|
user_id_query:
|
|
description: |
|
|
Filters the response by a user ID.
|
|
in: query
|
|
required: false
|
|
type: string
|
|
|
|
# variables in body
|
|
audit_ids:
|
|
description: |
|
|
A list of one or two audit IDs. An audit ID is a
|
|
unique, randomly generated, URL-safe string that you can use to
|
|
track a token. The first audit ID is the current audit ID for the
|
|
token. The second audit ID is present for only re-scoped tokens
|
|
and is the audit ID from the token before it was re-scoped. A re-
|
|
scoped token is one that was exchanged for another token of the
|
|
same or different scope. You can use these audit IDs to track the
|
|
use of a token or chain of tokens across multiple requests and
|
|
endpoints without exposing the token ID to non-privileged users.
|
|
in: body
|
|
required: true
|
|
type: array
|
|
auth:
|
|
description: |
|
|
An ``auth`` object.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
auth_domain:
|
|
description: |
|
|
Specify either ``id`` or ``name`` to uniquely
|
|
identify the domain.
|
|
in: body
|
|
required: false
|
|
type: object
|
|
auth_domain_id:
|
|
description: |
|
|
The ID of the domain. If you specify a user
|
|
name, you must specify either a domain ID or domain name.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
auth_methods:
|
|
description: |
|
|
The authentication method, which is ``password``,
|
|
``token``, or both methods. Indicates the accumulated set of
|
|
authentication methods that were used to obtain the token. For
|
|
example, if the token was obtained by password authentication, it
|
|
contains ``password``. Later, if the token is exchanged by using
|
|
the token authentication method one or more times, the
|
|
subsequently created tokens contain both ``password`` and
|
|
``token`` in their ``methods`` attribute. Unlike multi-factor
|
|
authentication, the ``methods`` attribute merely indicates the
|
|
methods that were used to authenticate the user in exchange for a
|
|
token. The client is responsible for determining the total number
|
|
of authentication factors.
|
|
in: body
|
|
required: true
|
|
type: array
|
|
auth_methods_passwd:
|
|
description: |
|
|
The authentication method. For password
|
|
authentication, specify ``password``.
|
|
in: body
|
|
required: true
|
|
type: array
|
|
auth_methods_token:
|
|
description: |
|
|
The authentication method. For token
|
|
authentication, specify ``token``.
|
|
in: body
|
|
required: true
|
|
type: array
|
|
auth_token:
|
|
description: |
|
|
A ``token`` object. The token authentication
|
|
method is used. This method is typically used in combination with
|
|
a request to change authorization scope.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
auth_token_id:
|
|
description: |
|
|
A token ID.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
catalog:
|
|
description: |
|
|
A ``catalog`` object.
|
|
in: body
|
|
required: true
|
|
type: array
|
|
credential:
|
|
description: |
|
|
A ``credential`` object.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
credential_blob:
|
|
description: |
|
|
The credential itself, as a serialized blob.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
credential_blob_notRequired:
|
|
description: |
|
|
The credential itself, as a serialized blob.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
credential_id:
|
|
description: |
|
|
The UUID for the credential.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
credential_links:
|
|
description: |
|
|
The links for the ``credential`` resource.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
credential_type:
|
|
description: |
|
|
The credential type, such as ``ec2`` or ``cert``.
|
|
The implementation determines the list of supported types.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
credential_type_notRequired:
|
|
description: |
|
|
The credential type, such as ``ec2`` or ``cert``.
|
|
The implementation determines the list of supported types.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
credential_user_id:
|
|
description: |
|
|
The ID of the user who owns the credential.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
credential_user_id_notRequired:
|
|
description: |
|
|
The ID of the user who owns the credential.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
credentials:
|
|
description: |
|
|
A list of ``credential`` objects.
|
|
in: body
|
|
required: true
|
|
type: array
|
|
credentials_links:
|
|
description: |
|
|
The links for the ``credentials`` resource.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
default_project_id_request_body:
|
|
description: |
|
|
The ID of the default project for the user.
|
|
Setting this attribute does not grant any actual authorization on
|
|
the project, and is merely provided for convenience. Therefore,
|
|
the referenced project does not need to exist within the user
|
|
domain. (Since v3.1) If the user does not have authorization to
|
|
their default project, the default project is ignored at token
|
|
creation. (Since v3.1) Additionally, if your default project is
|
|
not valid, a token is issued without an explicit scope of
|
|
authorization.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
default_project_id_response_body:
|
|
description: |
|
|
The ID of the default project for the user.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
default_project_id_update_body:
|
|
description: |
|
|
The new ID of the default project for the user.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
description_region_request_body:
|
|
description: |
|
|
The region description.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
description_region_response_body:
|
|
description: |
|
|
The region description.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
domain:
|
|
description: |
|
|
A ``domain`` object, containing:
|
|
in: body
|
|
required: true
|
|
type: object
|
|
domain_config:
|
|
description: |
|
|
A ``config`` object.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
domain_description_request_body:
|
|
description: |
|
|
The description of the domain.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
domain_description_response_body:
|
|
description: |
|
|
The description of the domain.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
domain_description_update_request_body:
|
|
description: |
|
|
The new description of the domain.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
domain_driver:
|
|
description: |
|
|
The Identity backend driver.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
domain_driver_notRequired:
|
|
description: |
|
|
The Identity backend driver.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
domain_enabled_request_body:
|
|
description: |
|
|
If set to ``true``, domain is created enabled. If set to
|
|
``false``, domain is created disabled. The default is ``true``.
|
|
|
|
Users can only authorize against an enabled domain (and any of its
|
|
projects). In addition, users can only authenticate if the domain that owns
|
|
them is also enabled. Disabling a domain prevents both of these things.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
domain_enabled_response_body:
|
|
description: |
|
|
If set to ``true``, domain is enabled. If set to
|
|
``false``, domain is disabled.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
domain_enabled_update_request_body:
|
|
description: |
|
|
If set to ``true``, domain is enabled. If set to
|
|
``false``, domain is disabled. The default is ``true``.
|
|
|
|
Users can only authorize against an enabled domain (and any of its
|
|
projects). In addition, users can only authenticate if the domain that owns
|
|
them is also enabled. Disabling a domain prevents both of these things.
|
|
When you disable a domain, all tokens that are authorized for that domain
|
|
become no longer valid. If you reenable the domain, these tokens
|
|
are not re-enabled.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
domain_group_identity:
|
|
description: |
|
|
An ``identity`` object. Required to set the
|
|
identity group configuration options.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
domain_id_response_body:
|
|
description: |
|
|
The ID of the domain.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
domain_ldap:
|
|
description: |
|
|
An ``ldap`` object. Required to set the LDAP
|
|
group configuration options.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
domain_link_response_body:
|
|
description: |
|
|
The links to the ``domain`` resource.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
domain_name_request_body:
|
|
description: |
|
|
The name of the domain.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
domain_name_response_body:
|
|
description: |
|
|
The name of the domain.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
domain_name_update_request_body:
|
|
description: |
|
|
The new name of the domain.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
domain_url:
|
|
description: |
|
|
The LDAP URL.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
domain_url_notRequired:
|
|
description: |
|
|
The LDAP URL.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
domain_user_tree_dn:
|
|
description: |
|
|
The base distinguished name (DN) of LDAP, from
|
|
where all users can be reached. For example,
|
|
``ou=Users,dc=root,dc=org``.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
domain_user_tree_dn_notRequired:
|
|
description: |
|
|
The base distinguished name (DN) of LDAP, from
|
|
where all users can be reached. For example,
|
|
``ou=Users,dc=root,dc=org``.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
domains:
|
|
description: |
|
|
A list of ``domain`` objects, each containing:
|
|
in: body
|
|
required: true
|
|
type: array
|
|
domains_links:
|
|
description: |
|
|
The links for the ``domains`` resource.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
email:
|
|
description: |
|
|
The email address for the user.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
email_notRequired:
|
|
description: |
|
|
The email address for the user.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
enabled:
|
|
description: |
|
|
Enables or disables the domain. Users can
|
|
authorize against an enabled domain and any of its projects. Users
|
|
that are owned by an enabled domain can authenticate and receive
|
|
additional authorization. Users cannot authorize against a
|
|
disabled domain or any of its projects. Users that are owned by a
|
|
disabled domain cannot authenticate or receive additional
|
|
authorization. All tokens that are authorized for a disabled
|
|
domain or its projects become no longer valid. If you reenable the
|
|
domain, these tokens are not re- enabled. To enable the domain,
|
|
set to ``true``. To disable the domain, set to ``false``. Default
|
|
is ``true``.
|
|
in: body
|
|
required: false
|
|
type: boolean
|
|
enabled_2:
|
|
description: |
|
|
Enables or disables the project. Users can
|
|
authorize against an enabled project. Users cannot authorize
|
|
against a disabled project. All tokens that are authorized for a
|
|
disabled project become no longer valid. If you reenable the
|
|
project, these tokens are not re-enabled. To enable the project,
|
|
set to ``true``. To disable the project, set to ``false``. Default
|
|
is ``true``.
|
|
in: body
|
|
required: false
|
|
type: boolean
|
|
enabled_user_request_body:
|
|
description: |
|
|
If the user is enabled, this value is ``true``.
|
|
If the user is disabled, this value is ``false``.
|
|
in: body
|
|
required: false
|
|
type: boolean
|
|
enabled_user_response_body:
|
|
description: |
|
|
If the user is enabled, this value is ``true``.
|
|
If the user is disabled, this value is ``false``.
|
|
in: body
|
|
required: true
|
|
type: boolean
|
|
enabled_user_update_body:
|
|
description: |
|
|
Enables or disables the user. An enabled user
|
|
can authenticate and receive authorization. A disabled user
|
|
cannot authenticate or receive authorization. Additionally, all
|
|
tokens that the user holds become no longer valid. If you reenable
|
|
this user, pre-existing tokens do not become valid. To enable the
|
|
user, set to ``true``. To disable the user, set to ``false``.
|
|
Default is ``true``.
|
|
in: body
|
|
required: false
|
|
type: boolean
|
|
endpoint:
|
|
description: |
|
|
An ``endpoint`` object.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
endpoint_enabled:
|
|
description: |
|
|
Indicates whether the endpoint appears in the
|
|
service catalog: - ``false``. The endpoint does not appear in the
|
|
service catalog. - ``true``. The endpoint appears in the service
|
|
catalog.
|
|
in: body
|
|
required: true
|
|
type: boolean
|
|
endpoint_enabled_notRequired:
|
|
description: |
|
|
Defines whether the endpoint appears in the
|
|
service catalog: - ``false``. The endpoint does not appear in the
|
|
service catalog. - ``true``. The endpoint appears in the service
|
|
catalog. Default is ``true``.
|
|
in: body
|
|
required: false
|
|
type: boolean
|
|
endpoint_id:
|
|
description: |
|
|
The endpoint ID.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
endpoint_interface:
|
|
description: |
|
|
The interface type, which describes the
|
|
visibility of the endpoint. Value is: - ``public``. Visible by
|
|
end users on a publicly available network interface. -
|
|
``internal``. Visible by end users on an unmetered internal
|
|
network interface. - ``admin``. Visible by administrative users
|
|
on a secure network interface.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
endpoint_links:
|
|
description: |
|
|
The links for the ``endpoint`` resource.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
endpoint_name:
|
|
description: |
|
|
The endpoint name.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
endpoint_region:
|
|
description: |
|
|
(Deprecated in v3.2) The geographic location of
|
|
the service endpoint.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
endpoint_region_notRequired:
|
|
description: |
|
|
(Deprecated in v3.2) The geographic location of
|
|
the service endpoint. Use the ``region_id`` parameter instead.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
endpoint_type:
|
|
description: |
|
|
The endpoint type.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
endpoint_url:
|
|
description: |
|
|
The endpoint URL.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
endpoints:
|
|
description: |
|
|
A list of ``endpoint`` objects.
|
|
in: body
|
|
required: true
|
|
type: array
|
|
endpoints_links:
|
|
description: |
|
|
The links for the ``endpoints`` resource.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
expires_at:
|
|
description: |
|
|
The date and time when the token expires.
|
|
|
|
The date and time stamp format is `ISO 8601
|
|
<https://en.wikipedia.org/wiki/ISO_8601>`_:
|
|
|
|
::
|
|
|
|
CCYY-MM-DDThh:mm:ss±hh:mm
|
|
|
|
For example, ``2015-08-27T09:49:58-05:00``.
|
|
|
|
The ``±hh:mm`` value, if included, is the time zone as an offset
|
|
from UTC. In the previous example, the offset value is ``-05:00``.
|
|
|
|
A ``null`` value indicates that the token never expires.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
extras:
|
|
description: |
|
|
A set of metadata key and value pairs, if any.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
group:
|
|
description: |
|
|
A ``group`` object, containing:
|
|
in: body
|
|
required: true
|
|
type: object
|
|
group_description_request_body:
|
|
description: |
|
|
The description of the group.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
group_description_response_body:
|
|
description: |
|
|
The description of the group.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
group_description_update_request_body:
|
|
description: |
|
|
The new description of the group.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
group_domain_id:
|
|
description: |
|
|
The ID of the domain that owns the group. If you
|
|
omit the domain ID, defaults to the domain to which the client
|
|
token is scoped.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
group_domain_id_request_body:
|
|
description: |
|
|
The ID of the domain of the group.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
group_domain_id_response_body:
|
|
description: |
|
|
The ID of the domain of the group.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
group_domain_id_update_request_body:
|
|
description: |
|
|
The ID of the new domain for the group. The ability to change the domain
|
|
of a group is now deprecated, and will be removed in subsequent release.
|
|
It is already disabled by default in most Identity service implementations.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
group_id_response_body:
|
|
description: |
|
|
The ID of the group.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
group_links:
|
|
description: |
|
|
The links for the ``group`` resource.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
group_name_request_body:
|
|
description: |
|
|
The name of the group.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
group_name_response_body:
|
|
description: |
|
|
The name of the group.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
group_name_update_request_body:
|
|
description: |
|
|
The new name of the group.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
groups:
|
|
description: |
|
|
A list of ``group`` objects, each containing:
|
|
in: body
|
|
required: true
|
|
type: array
|
|
id_region_response_body:
|
|
description: |
|
|
The ID for the region.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
id_region_resquest_body:
|
|
description: |
|
|
The ID for the region.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
id_user_body:
|
|
description: |
|
|
The user ID.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
identity:
|
|
description: |
|
|
An ``identity`` object.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
implies_role_array_body:
|
|
description: |
|
|
An array of implied role objects.
|
|
in: body
|
|
required: true
|
|
type: array
|
|
implies_role_object_body:
|
|
description: |
|
|
An implied role object.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
is_domain_request_body:
|
|
description: |
|
|
Indicates whether the project also acts as a domain. If set to ``true``,
|
|
this project acts as both a project and domain. As a domain, the project
|
|
provides a name space in which you can create users, groups, and other
|
|
projects. If set to ``false``, this project behaves as a regular project
|
|
that contains only resources. Default is ``false``. You cannot update
|
|
this parameter after you create the project.
|
|
in: body
|
|
required: false
|
|
type: boolean
|
|
min_version: 3.6
|
|
is_domain_response_body:
|
|
description: |
|
|
Indicates whether the project also acts as a domain. If set to ``true``,
|
|
this project acts as both a project and domain. As a domain, the project
|
|
provides a name space in which you can create users, groups, and other
|
|
projects. If set to ``false``, this project behaves as a regular project
|
|
that contains only resources.
|
|
in: body
|
|
required: true
|
|
type: boolean
|
|
min_version: 3.6
|
|
issued_at:
|
|
description: |
|
|
The date and time when the token was issued.
|
|
|
|
The date and time stamp format is `ISO 8601
|
|
<https://en.wikipedia.org/wiki/ISO_8601>`_:
|
|
|
|
::
|
|
|
|
CCYY-MM-DDThh:mm:ss±hh:mm
|
|
|
|
For example, ``2015-08-27T09:49:58-05:00``.
|
|
|
|
The ``±hh:mm`` value, if included, is the time zone as an offset
|
|
from UTC. In the previous example, the offset value is ``-05:00``.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
link_collection:
|
|
description: |
|
|
The link to the collection of resources.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
link_response_body:
|
|
description: |
|
|
The link to the resources in question.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
links_project:
|
|
description: |
|
|
The links for the ``project`` resource.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
links_region:
|
|
description: |
|
|
The links for the ``region`` resource.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
links_user:
|
|
description: |
|
|
The links for the ``user`` resource.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
original_password:
|
|
description: |
|
|
The original password for the user.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
parent_id:
|
|
description: |
|
|
(Since v3.4) The ID of the parent project. If
|
|
you omit the parent project ID, the project is a top-level
|
|
project.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
parent_id_1:
|
|
description: |
|
|
(Since v3.4) The ID of the parent project. If
|
|
``null``, the project is a top-level project.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
parent_region_id_2:
|
|
description: |
|
|
If the region is a child of another region, the
|
|
ID for the parent region. Otherwise, this value is ``null``.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
parent_region_id_request_body:
|
|
description: |
|
|
To make this region a child of another region,
|
|
set this parameter to the ID of the parent region.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
parent_region_id_response_body:
|
|
description: |
|
|
To make this region a child of another region,
|
|
set this parameter to the ID of the parent region.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
password:
|
|
description: |
|
|
The ``password`` object, contains the authentication information.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
password_auth_domain:
|
|
description: |
|
|
A ``domain`` object. Required if you specify a
|
|
user name.
|
|
in: body
|
|
required: false
|
|
type: object
|
|
password_auth_domain_name:
|
|
description: |
|
|
The name of the domain. If you specify a user
|
|
name, you must specify either a domain ID or domain name.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
password_expires_at:
|
|
description: |
|
|
The date and time when the password expires. The time zone
|
|
is UTC.
|
|
|
|
This is a response object attribute; not valid for requests.
|
|
A ``null`` value indicates that the password never expires.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
min_version: 3.7
|
|
password_request_body:
|
|
description: |
|
|
The password for the user.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
policies:
|
|
description: |
|
|
A ``policies`` object.
|
|
in: body
|
|
required: true
|
|
type: array
|
|
policy:
|
|
description: |
|
|
A ``policy`` object.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
policy_blob_obj:
|
|
description: |
|
|
The policy rule itself, as a serialized blob.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
policy_blob_str:
|
|
description: |
|
|
The policy rule set itself, as a serialized blob.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
policy_id:
|
|
description: |
|
|
The policy ID.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
policy_links:
|
|
description: |
|
|
The links for the ``policy`` resource.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
policy_type:
|
|
description: |
|
|
The MIME media type of the serialized policy
|
|
blob.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
policy_user_id:
|
|
description: |
|
|
The ID of the user who owns the policy.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
policy_user_id_notRequired:
|
|
description: |
|
|
The ID of the user who owns the policy.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
prior_role_body:
|
|
description: |
|
|
A prior role object.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
project:
|
|
description: |
|
|
A ``project`` object, containing:
|
|
in: body
|
|
required: true
|
|
type: object
|
|
project_description_request_body:
|
|
description: |
|
|
The description of the project.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
project_description_response_body:
|
|
description: |
|
|
The description of the project.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
project_domain_id:
|
|
description: |
|
|
The ID of the domain for the project. If you
|
|
omit the domain ID, default is the domain to which your token is
|
|
scoped.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
project_domain_id_request_body:
|
|
description: |
|
|
The ID of the domain for the project.
|
|
|
|
For projects acting as a domain, the ``domain_id`` must not be specified,
|
|
it will be generated by the Identity service implementation.
|
|
|
|
For regular projects (i.e. those not acing as a domain), if ``domain_id``
|
|
is not specified, but ``parent_id`` is specified, then the domain ID of the
|
|
parent will be used. If neither ``domain_id`` or ``parent_id`` is
|
|
specified, the Identity service implementation will default to the domain
|
|
to which the client's token is scoped. If both ``domain_id`` and
|
|
``parent_id`` are specified, and they do not indicate the same domain, an
|
|
``Bad Request (400)`` will be returned.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
project_domain_id_response_body:
|
|
description: |
|
|
The ID of the domain for the project.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
project_domain_id_update_request_body:
|
|
description: |
|
|
The ID of the new domain for the project. The ability to change the domain
|
|
of a project is now deprecated, and will be removed in subequent release.
|
|
It is already disabled by default in most Identity service implementations.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
project_enabled_cascade_request_body:
|
|
description: |
|
|
Enables or disables the project and its subtree.
|
|
Users can authorize against an enabled project, but not against a disabled
|
|
project. All tokens that are authorized for all projects in the affected
|
|
hierarchy become no longer valid. If you reenable the projects, these tokens
|
|
are not re-enabled. To enable the project and its subtree, set to ``true``.
|
|
To disable the project and its subtree, set to ``false``.
|
|
in: body
|
|
required: true
|
|
type: boolean
|
|
project_enabled_request_body:
|
|
description: |
|
|
If set to ``true``, project is enabled. If set to
|
|
``false``, project is disabled. The default is ``true``.
|
|
in: body
|
|
required: false
|
|
type: boolean
|
|
project_enabled_response_body:
|
|
description: |
|
|
If set to ``true``, project is enabled. If set to
|
|
``false``, project is disabled.
|
|
in: body
|
|
required: true
|
|
type: boolean
|
|
project_enabled_update_request_body:
|
|
description: |
|
|
If set to ``true``, project is enabled. If set to
|
|
``false``, project is disabled.
|
|
in: body
|
|
required: false
|
|
type: boolean
|
|
project_id:
|
|
description: |
|
|
The ID for the project.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
project_name_request_body:
|
|
description: |
|
|
The name of the project, which must be unique within the
|
|
owning domain. A project can have the same name as its domain.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
project_name_response_body:
|
|
description: |
|
|
The name of the project.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
project_name_update_request_body:
|
|
description: |
|
|
The name of the project, which must be unique within the
|
|
owning domain. A project can have the same name as its domain.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
project_parent_id_request_body:
|
|
description: |
|
|
The ID of the parent of the project.
|
|
|
|
If specified on project creation, this places the project within a
|
|
hierarchy and implicitly defines the owning domain, which will be the
|
|
same domain as the parent specified. If ``parent_id`` is
|
|
not specified and ``is_domain`` is ``false``, then the project will use its
|
|
owning domain as its parent. If ``is_domain`` is ``true`` (i.e. the project
|
|
is acting as a domain), then ``parent_id`` must not specified (or if it is,
|
|
it must be ``null``) since domains have no parents.
|
|
|
|
``parent_id`` is immutable, and can't be updated after the project is
|
|
created - hence a project cannot be moved within the hierarchy.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
min_version: 3.4
|
|
project_parent_id_response_body:
|
|
description: |
|
|
The ID of the parent for the project.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
min_version: 3.4
|
|
projects:
|
|
description: |
|
|
A list of ``project`` objects, each containing:
|
|
in: body
|
|
required: true
|
|
type: array
|
|
region_id:
|
|
description: |
|
|
(Since v3.2) The ID of the region that contains
|
|
the service endpoint.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
region_id_1:
|
|
description: |
|
|
(Since v3.2) The ID of the region that contains
|
|
the service endpoint.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
region_id_notRequired:
|
|
description: |
|
|
A user-defined region ID. If you include
|
|
characters in the region ID that are not allowed in a URI, you
|
|
must URL-encode the ID. If you omit an ID, the API assigns an ID
|
|
to the region.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
region_object:
|
|
description: |
|
|
A ``region`` object, containing the following:
|
|
in: body
|
|
required: true
|
|
type: object
|
|
regions_object:
|
|
description: |
|
|
A list of ``region`` object, each containing the following:
|
|
in: body
|
|
required: true
|
|
type: array
|
|
role:
|
|
description: |
|
|
A ``role`` object, containing:
|
|
in: body
|
|
required: true
|
|
type: object
|
|
role_assignments:
|
|
description: |
|
|
A list of ``role_assignment`` objects.
|
|
in: body
|
|
required: true
|
|
type: array
|
|
role_id_response_body:
|
|
description: |
|
|
The role ID.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
role_inference_array_body:
|
|
description: |
|
|
An array of ``role_inference`` object.
|
|
in: body
|
|
required: true
|
|
type: array
|
|
role_inference_body:
|
|
description: |
|
|
Role inference object that contains ``prior_role`` object
|
|
and ``implies`` object.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
role_links:
|
|
description: |
|
|
The links for the ``role`` resource.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
role_name_create_body:
|
|
description: |
|
|
The role name.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
role_name_response_body:
|
|
description: |
|
|
The role name.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
role_name_update_body:
|
|
description: |
|
|
The new role name.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
roles:
|
|
description: |
|
|
A list of ``role`` objects, each containing:
|
|
in: body
|
|
required: true
|
|
type: array
|
|
roles_links:
|
|
description: |
|
|
The links for the ``roles`` resource.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
scope:
|
|
description: |
|
|
The authorization scope. (Since v3.4) Specify
|
|
``unscoped`` to make an explicit unscoped token request, which
|
|
returns an unscoped response without any authorization. This
|
|
request behaves the same as a token request with no scope where
|
|
the user has no default project defined. If you do not make an
|
|
explicit ``unscoped`` token request and your role has a default
|
|
project, the response might return a project- scoped token. If a
|
|
default project is not defined, a token is issued without an
|
|
explicit scope of authorization, which is the same as asking for
|
|
an explicit unscoped token.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
scope_1:
|
|
description: |
|
|
The authorization scope. - Specify ``project``
|
|
to scope to a project, by ID or name. If you specify the project
|
|
by name, you must also specify the project domain to uniquely
|
|
identify the project. Because a project can have the same name
|
|
as its owning domain, the scope is determined, as follows: -
|
|
If the project name is truly unique, the token is scoped to the
|
|
project. - If a name clash exists between a project acting as a
|
|
domain and a regular project within that domain, the token is
|
|
scoped to the regular project. - In a name-clash situation,
|
|
if the user wants the token scoped to the project acting as
|
|
the domain, you must either specify use the project ID to
|
|
specify the scope or rename either the project acting as a
|
|
domain or the regular project. Alternatively, you can use a
|
|
domain name to uniquely identify the project. - Specify
|
|
``domain`` to scope to a domain, by ID or name with equivalent
|
|
results to project scoping. The catalog returned from a domain-
|
|
scoped request contains all endpoints of a project- scoped
|
|
catalog, excluding ones that require a project ID as part of
|
|
their URL. You cannot simultaneously scope a token to a project
|
|
and domain.
|
|
in: body
|
|
required: false
|
|
type: object
|
|
service:
|
|
description: |
|
|
A ``service`` object.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
service_description:
|
|
description: |
|
|
The service description.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
service_description_notRequired:
|
|
description: |
|
|
The service description.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
service_enabled:
|
|
description: |
|
|
Defines whether the service and its endpoints
|
|
appear in the service catalog: - ``false``. The service and its
|
|
endpoints do not appear in the service catalog. - ``true``. The
|
|
service and its endpoints appear in the service catalog.
|
|
in: body
|
|
required: true
|
|
type: boolean
|
|
service_enabled_notRequired:
|
|
description: |
|
|
Defines whether the service and its endpoints
|
|
appear in the service catalog: - ``false``. The service and its
|
|
endpoints do not appear in the service catalog. - ``true``. The
|
|
service and its endpoints appear in the service catalog.
|
|
Default is ``true``.
|
|
in: body
|
|
required: false
|
|
type: boolean
|
|
service_id:
|
|
description: |
|
|
The UUID of the service to which the endpoint
|
|
belongs.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
service_links:
|
|
description: |
|
|
The links for the ``service`` resource.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
service_name:
|
|
description: |
|
|
The service name.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
service_type:
|
|
description: |
|
|
The service type, which describes the API
|
|
implemented by the service. Value is ``compute``, ``ec2``,
|
|
``identity``, ``image``, ``network``, or ``volume``.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
services:
|
|
description: |
|
|
A list of ``service`` object.
|
|
in: body
|
|
required: true
|
|
type: array
|
|
token:
|
|
description: |
|
|
A ``token`` object.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
user:
|
|
description: |
|
|
A ``user`` object.
|
|
in: body
|
|
required: true
|
|
type: object
|
|
user_description:
|
|
description: |
|
|
The user description.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
user_domain_id:
|
|
description: |
|
|
The ID of the domain for the user.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
user_domain_id_request_body:
|
|
description: |
|
|
The ID of the domain for the user.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
user_domain_id_update_body:
|
|
description: |
|
|
The ID of the new domain for the user. The ability to change the domain
|
|
of a user is now deprecated, and will be removed in subequent release.
|
|
It is already disabled by default in most Identity service implementations.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
user_id:
|
|
description: |
|
|
The ID of the user. Required if you do not
|
|
specify the user name.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
user_name:
|
|
description: |
|
|
The user name. Required if you do not specify
|
|
the ID of the user. If you specify the user name, you must also
|
|
specify the domain, by ID or name.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
user_name_create_request_body:
|
|
description: |
|
|
The user name. Must be unique within the owning domain.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
user_name_response_body:
|
|
description: |
|
|
The user name. Must be unique within the owning domain.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
user_name_update_body:
|
|
description: |
|
|
The new name for the user. Must be unique within the owning domain.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
user_object:
|
|
description: |
|
|
A ``user`` object, containing:
|
|
in: body
|
|
required: true
|
|
type: object
|
|
user_password_update_body:
|
|
description: |
|
|
The new password for the user.
|
|
in: body
|
|
required: true
|
|
type: string
|
|
user_update_password_body:
|
|
description: |
|
|
The new password for the user.
|
|
in: body
|
|
required: false
|
|
type: string
|
|
users:
|
|
description: |
|
|
A ``users`` object.
|
|
in: body
|
|
required: true
|
|
type: array
|
|
users_object:
|
|
description: |
|
|
A list of ``user`` object, each containing:
|
|
in: body
|
|
required: true
|
|
type: array
|