diff --git a/content/chainguard/administration/cloudevents/events-reference.md b/content/chainguard/administration/cloudevents/events-reference.md index 1c215f5498..4104f00b8b 100644 --- a/content/chainguard/administration/cloudevents/events-reference.md +++ b/content/chainguard/administration/cloudevents/events-reference.md @@ -4,7 +4,7 @@ lead: "" description: "Chainguard Events" type: "article" date: 2022-11-15T12:05:04 -lastmod: 2026-06-03T13:15:26 +lastmod: 2026-06-05T18:37:49 draft: false tags: ["Platform", "Reference", "Product"] images: [] @@ -82,7 +82,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: cgr.dev Ce-Specversion: 1.0 Ce-Subject: The identifier of the repository being pulled from -Ce-Time: 2026-06-03T13:15:26.739016229Z +Ce-Time: 2026-06-05T18:37:49.853044225Z Ce-Type: dev.chainguard.registry.pull.v1 Content-Length: 777 Content-Type: application/json @@ -112,7 +112,7 @@ User-Agent: Chainguard Enforce "tag": "The tag of the image being pulled", "type": "Type determines whether the object being pulled is a manifest or blob", "user_agent": "The user-agent of the client who pulled", - "when": "2026-06-03T13:15:26.737953" + "when": "2026-06-05T18:37:49.852026" } } ``` @@ -132,7 +132,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: cgr.dev Ce-Specversion: 1.0 Ce-Subject: The identifier of the repository being pushed to -Ce-Time: 2026-06-03T13:15:26.738149867Z +Ce-Time: 2026-06-05T18:37:49.852223669Z Ce-Type: dev.chainguard.registry.push.v1 Content-Length: 707 Content-Type: application/json @@ -161,7 +161,7 @@ User-Agent: Chainguard Enforce "tag": "The tag of the image being pushed", "type": "Type determines whether the object being pushed is a manifest or blob", "user_agent": "The user-agent of the client who pushed", - "when": "2026-06-03T13:15:26.737926" + "when": "2026-06-05T18:37:49.851997" } } ``` @@ -181,7 +181,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/auth/v1/register Ce-Specversion: 1.0 Ce-Subject: Chainguard UIDP -Ce-Time: 2026-06-03T13:15:26.748624512Z +Ce-Time: 2026-06-05T18:37:49.86399067Z Ce-Type: dev.chainguard.api.auth.registered.v1 Content-Length: 154 Content-Type: application/json @@ -218,7 +218,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/events/v1/subscriptions Ce-Specversion: 1.0 Ce-Subject: UIDP identifier of the subscription -Ce-Time: 2026-06-03T13:15:26.746801833Z +Ce-Time: 2026-06-05T18:37:49.858138787Z Ce-Type: dev.chainguard.api.events.subscription.created.v1 Content-Length: 152 Content-Type: application/json @@ -254,7 +254,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/events/v1/subscriptions Ce-Specversion: 1.0 Ce-Subject: UIDP identifier of the subscription to delete -Ce-Time: 2026-06-03T13:15:26.747130269Z +Ce-Time: 2026-06-05T18:37:49.858312649Z Ce-Type: dev.chainguard.api.events.subscription.deleted.v1 Content-Length: 119 Content-Type: application/json @@ -274,6 +274,81 @@ User-Agent: Chainguard Enforce } } ``` +## Service: iam - ExternalGroupRoleMappings +### Method: Create + +#### Example HTTP Headers + +``` +POST / HTTP/1.1 +Host: console-api.enforce.dev +Accept-Encoding: gzip +Authorization: Bearer oidctoken +Ce-Audience: customer +Ce-Group: UID of parent group +Ce-Id: cloudevent generated UUID +Ce-Source: https://console-api.enforce.dev/iam/v1/externalGroupRoleMappings +Ce-Specversion: 1.0 +Ce-Subject: UIDP of the mapping +Ce-Time: 2026-06-05T18:37:49.856843316Z +Ce-Type: dev.chainguard.api.iam.external_group_role_mappings.created.v1 +Content-Length: 290 +Content-Type: application/json +User-Agent: Chainguard Enforce + +``` + +#### Example HTTP Body + +```json +{ + "actor": { + "subject": "identity that triggered the event" + }, + "body": { + "external_group_id": "The IdP group identifier", + "id": "UIDP of the mapping", + "identity_provider_uidp": "UIDP of the identity provider", + "role_uidp": "UIDP of the Chainguard role", + "scope": "UIDP of the group where the role applies" + } +} +``` +### Method: Delete + +#### Example HTTP Headers + +``` +POST / HTTP/1.1 +Host: console-api.enforce.dev +Accept-Encoding: gzip +Authorization: Bearer oidctoken +Ce-Audience: customer +Ce-Group: UID of parent group +Ce-Id: cloudevent generated UUID +Ce-Source: https://console-api.enforce.dev/iam/v1/externalGroupRoleMappings +Ce-Specversion: 1.0 +Ce-Subject: UIDP of the mapping +Ce-Time: 2026-06-05T18:37:49.857108095Z +Ce-Type: dev.chainguard.api.iam.external_group_role_mappings.deleted.v1 +Content-Length: 93 +Content-Type: application/json +User-Agent: Chainguard Enforce + +``` + +#### Example HTTP Body + +```json +{ + "actor": { + "subject": "identity that triggered the event" + }, + "body": { + "id": "UIDP of the mapping" + } +} +``` ## Service: iam - GroupAccountAssociations ### Method: Create @@ -290,7 +365,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/account_associations Ce-Specversion: 1.0 Ce-Subject: UIDP with which this account information is associated -Ce-Time: 2026-06-03T13:15:26.748972665Z +Ce-Time: 2026-06-05T18:37:49.857414486Z Ce-Type: dev.chainguard.api.iam.account_associations.created.v1 Content-Length: 385 Content-Type: application/json @@ -334,7 +409,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/account_associations Ce-Specversion: 1.0 Ce-Subject: UIDP with which this account information is associated -Ce-Time: 2026-06-03T13:15:26.749341988Z +Ce-Time: 2026-06-05T18:37:49.857719175Z Ce-Type: dev.chainguard.api.iam.account_associations.updated.v1 Content-Length: 336 Content-Type: application/json @@ -378,7 +453,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/account_associations Ce-Specversion: 1.0 Ce-Subject: UIDP of the group whose associations will be deleted -Ce-Time: 2026-06-03T13:15:26.749653422Z +Ce-Time: 2026-06-05T18:37:49.857919407Z Ce-Type: dev.chainguard.api.iam.account_associations.deleted.v1 Content-Length: 129 Content-Type: application/json @@ -414,7 +489,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/group_invites Ce-Specversion: 1.0 Ce-Subject: group UIDP under which this invite resides -Ce-Time: 2026-06-03T13:15:26.751029383Z +Ce-Time: 2026-06-05T18:37:49.861913772Z Ce-Type: dev.chainguard.api.iam.group_invite.created.v1 Content-Length: 145 Content-Type: application/json @@ -452,7 +527,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/group_invites Ce-Specversion: 1.0 Ce-Subject: UIDP of the record -Ce-Time: 2026-06-03T13:15:26.751324296Z +Ce-Time: 2026-06-05T18:37:49.86208506Z Ce-Type: dev.chainguard.api.iam.group_invite.deleted.v1 Content-Length: 92 Content-Type: application/json @@ -488,7 +563,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/groups Ce-Specversion: 1.0 Ce-Subject: group UIDP under which this group resides -Ce-Time: 2026-06-03T13:15:26.746072926Z +Ce-Time: 2026-06-05T18:37:49.85422956Z Ce-Type: dev.chainguard.api.iam.group.created.v1 Content-Length: 169 Content-Type: application/json @@ -525,7 +600,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/groups Ce-Specversion: 1.0 Ce-Subject: group UIDP under which this group resides -Ce-Time: 2026-06-03T13:15:26.746269615Z +Ce-Time: 2026-06-05T18:37:49.854978958Z Ce-Type: dev.chainguard.api.iam.group.updated.v1 Content-Length: 169 Content-Type: application/json @@ -562,7 +637,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/groups Ce-Specversion: 1.0 Ce-Subject: UIDP of the record -Ce-Time: 2026-06-03T13:15:26.746486542Z +Ce-Time: 2026-06-05T18:37:49.855218139Z Ce-Type: dev.chainguard.api.iam.group.deleted.v1 Content-Length: 92 Content-Type: application/json @@ -598,7 +673,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identities Ce-Specversion: 1.0 Ce-Subject: UIDP of identity -Ce-Time: 2026-06-03T13:15:26.739788728Z +Ce-Time: 2026-06-05T18:37:49.85972798Z Ce-Type: dev.chainguard.api.iam.identity.created.v1 Content-Length: 329 Content-Type: application/json @@ -639,7 +714,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identities Ce-Specversion: 1.0 Ce-Subject: The unique identifier of this specific identity -Ce-Time: 2026-06-03T13:15:26.740151559Z +Ce-Time: 2026-06-05T18:37:49.859954842Z Ce-Type: dev.chainguard.api.iam.identity.updated.v1 Content-Length: 245 Content-Type: application/json @@ -677,7 +752,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identities Ce-Specversion: 1.0 Ce-Subject: UIDP of the record -Ce-Time: 2026-06-03T13:15:26.741562425Z +Ce-Time: 2026-06-05T18:37:49.860134312Z Ce-Type: dev.chainguard.api.iam.identity.deleted.v1 Content-Length: 92 Content-Type: application/json @@ -713,7 +788,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identityProviders Ce-Specversion: 1.0 Ce-Subject: UIDP of identity provider -Ce-Time: 2026-06-03T13:15:26.747676163Z +Ce-Time: 2026-06-05T18:37:49.863174531Z Ce-Type: dev.chainguard.api.iam.identity_providers.created.v1 Content-Length: 378 Content-Type: application/json @@ -754,7 +829,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identityProviders Ce-Specversion: 1.0 Ce-Subject: The UIDP of the IAM group to nest this identity provider under -Ce-Time: 2026-06-03T13:15:26.748038202Z +Ce-Time: 2026-06-05T18:37:49.863450496Z Ce-Type: dev.chainguard.api.iam.identity_providers.updated.v1 Content-Length: 279 Content-Type: application/json @@ -792,7 +867,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/identityProviders Ce-Specversion: 1.0 Ce-Subject: UIDP of the IdP -Ce-Time: 2026-06-03T13:15:26.748272171Z +Ce-Time: 2026-06-05T18:37:49.863675926Z Ce-Type: dev.chainguard.api.iam.identity_providers.deleted.v1 Content-Length: 89 Content-Type: application/json @@ -828,7 +903,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/rolebindings Ce-Specversion: 1.0 Ce-Subject: UIDP of the Role to bind -Ce-Time: 2026-06-03T13:15:26.751628006Z +Ce-Time: 2026-06-05T18:37:49.855513263Z Ce-Type: dev.chainguard.api.iam.rolebindings.created.v1 Content-Length: 261 Content-Type: application/json @@ -868,7 +943,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/rolebindings/batch Ce-Specversion: 1.0 Ce-Subject: UID of this role binding, under a parent group UIDP -Ce-Time: 2026-06-03T13:15:26.751975748Z +Ce-Time: 2026-06-05T18:37:49.855747225Z Ce-Type: dev.chainguard.api.iam.rolebindings.created.batch.v1 Content-Length: 220 Content-Type: application/json @@ -909,7 +984,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/rolebindings Ce-Specversion: 1.0 Ce-Subject: UID of this role binding -Ce-Time: 2026-06-03T13:15:26.752263618Z +Ce-Time: 2026-06-05T18:37:49.855959776Z Ce-Type: dev.chainguard.api.iam.rolebindings.updated.v1 Content-Length: 173 Content-Type: application/json @@ -946,7 +1021,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/iam/v1/rolebindings Ce-Specversion: 1.0 Ce-Subject: UID of the record -Ce-Time: 2026-06-03T13:15:26.752560435Z +Ce-Time: 2026-06-05T18:37:49.856158885Z Ce-Type: dev.chainguard.api.iam.rolebindings.deleted.v1 Content-Length: 91 Content-Type: application/json @@ -982,7 +1057,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v1/repos Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific repository -Ce-Time: 2026-06-03T13:15:26.744269623Z +Ce-Time: 2026-06-05T18:37:49.860572222Z Ce-Type: dev.chainguard.api.platform.registry.repo.created.v1 Content-Length: 243 Content-Type: application/json @@ -1022,7 +1097,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v1/repos Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific repository -Ce-Time: 2026-06-03T13:15:26.744688419Z +Ce-Time: 2026-06-05T18:37:49.860886645Z Ce-Type: dev.chainguard.api.platform.registry.repo.updated.v1 Content-Length: 243 Content-Type: application/json @@ -1062,7 +1137,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v1/repos Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific repository -Ce-Time: 2026-06-03T13:15:26.744931144Z +Ce-Time: 2026-06-05T18:37:49.861044182Z Ce-Type: dev.chainguard.api.platform.registry.repo.deleted.v1 Content-Length: 116 Content-Type: application/json @@ -1097,7 +1172,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v1/tags Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific tag -Ce-Time: 2026-06-03T13:15:26.74527543Z +Ce-Time: 2026-06-05T18:37:49.861171875Z Ce-Type: dev.chainguard.api.platform.registry.tag.created.v1 Content-Length: 197 Content-Type: application/json @@ -1134,7 +1209,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v1/tags Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific tag -Ce-Time: 2026-06-03T13:15:26.745523325Z +Ce-Time: 2026-06-05T18:37:49.861336412Z Ce-Type: dev.chainguard.api.platform.registry.tag.updated.v1 Content-Length: 197 Content-Type: application/json @@ -1171,7 +1246,7 @@ Ce-Id: cloudevent generated UUID Ce-Source: https://console-api.enforce.dev/registry/v1/tags Ce-Specversion: 1.0 Ce-Subject: The identifier of this specific tag -Ce-Time: 2026-06-03T13:15:26.745672986Z +Ce-Time: 2026-06-05T18:37:49.861483193Z Ce-Type: dev.chainguard.api.platform.registry.tag.deleted.v1 Content-Length: 109 Content-Type: application/json @@ -1204,11 +1279,11 @@ Authorization: Bearer oidctoken Ce-Audience: customer Ce-Group: UID of parent group Ce-Id: cloudevent generated UUID -Ce-Source: https://console-api.enforce.dev/policygates/v1/bindings +Ce-Source: https://console-api.enforce.dev/policies/v1/bindings Ce-Specversion: 1.0 Ce-Subject: UIDP of the binding -Ce-Time: 2026-06-03T13:15:26.749994813Z -Ce-Type: dev.chainguard.api.policygates.bindings.created.v1 +Ce-Time: 2026-06-05T18:37:49.862336358Z +Ce-Type: dev.chainguard.api.policies.bindings.created.v1 Content-Length: 245 Content-Type: application/json User-Agent: Chainguard Enforce @@ -1246,11 +1321,11 @@ Authorization: Bearer oidctoken Ce-Audience: customer Ce-Group: UID of parent group Ce-Id: cloudevent generated UUID -Ce-Source: https://console-api.enforce.dev/policygates/v1/bindings +Ce-Source: https://console-api.enforce.dev/policies/v1/bindings Ce-Specversion: 1.0 Ce-Subject: UIDP of the binding -Ce-Time: 2026-06-03T13:15:26.750336924Z -Ce-Type: dev.chainguard.api.policygates.bindings.updated.v1 +Ce-Time: 2026-06-05T18:37:49.862654117Z +Ce-Type: dev.chainguard.api.policies.bindings.updated.v1 Content-Length: 245 Content-Type: application/json User-Agent: Chainguard Enforce @@ -1288,11 +1363,11 @@ Authorization: Bearer oidctoken Ce-Audience: customer Ce-Group: UID of parent group Ce-Id: cloudevent generated UUID -Ce-Source: https://console-api.enforce.dev/policygates/v1/bindings +Ce-Source: https://console-api.enforce.dev/policies/v1/bindings Ce-Specversion: 1.0 Ce-Subject: UIDP of the binding -Ce-Time: 2026-06-03T13:15:26.750627199Z -Ce-Type: dev.chainguard.api.policygates.bindings.deleted.v1 +Ce-Time: 2026-06-05T18:37:49.862885545Z +Ce-Type: dev.chainguard.api.policies.bindings.deleted.v1 Content-Length: 93 Content-Type: application/json User-Agent: Chainguard Enforce diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl.md b/content/chainguard/chainctl/chainctl-docs/chainctl.md index ddfff54e5a..a3133069df 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl" slug: chainctl url: /chainguard/chainctl/chainctl-docs/chainctl/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_actions.md b/content/chainguard/chainctl/chainctl-docs/chainctl_actions.md index cd78e5c3c7..623e62dceb 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_actions.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_actions.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl actions" slug: chainctl_actions url: /chainguard/chainctl/chainctl-docs/chainctl_actions/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_actions_discover.md b/content/chainguard/chainctl/chainctl-docs/chainctl_actions_discover.md index b229355392..86d3064f4c 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_actions_discover.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_actions_discover.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl actions discover" slug: chainctl_actions_discover url: /chainguard/chainctl/chainctl-docs/chainctl_actions_discover/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements.md b/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements.md index 53bfd78593..727c08f4dc 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl actions entitlements" slug: chainctl_actions_entitlements url: /chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_create.md b/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_create.md index 4a33c2fd08..3556125094 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_create.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_create.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl actions entitlements create" slug: chainctl_actions_entitlements_create url: /chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_create/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_delete.md b/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_delete.md index fc1e77d7e0..9a44e6869f 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_delete.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl actions entitlements delete" slug: chainctl_actions_entitlements_delete url: /chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_delete/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_list.md index 0170913468..03b79d99fc 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl actions entitlements list" slug: chainctl_actions_entitlements_list url: /chainguard/chainctl/chainctl-docs/chainctl_actions_entitlements_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_agent.md b/content/chainguard/chainctl/chainctl-docs/chainctl_agent.md index 762081603a..c9e9e651d4 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_agent.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_agent.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl agent" slug: chainctl_agent url: /chainguard/chainctl/chainctl-docs/chainctl_agent/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_agent_accept-terms.md b/content/chainguard/chainctl/chainctl-docs/chainctl_agent_accept-terms.md index 2790a70713..c3ce52b933 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_agent_accept-terms.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_agent_accept-terms.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl agent accept-terms" slug: chainctl_agent_accept-terms url: /chainguard/chainctl/chainctl-docs/chainctl_agent_accept-terms/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_auth.md b/content/chainguard/chainctl/chainctl-docs/chainctl_auth.md index 1081049613..ec3e510e4f 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_auth.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_auth.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl auth" slug: chainctl_auth url: /chainguard/chainctl/chainctl-docs/chainctl_auth/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_configure-docker.md b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_configure-docker.md index 963e95963d..87be8f0ac6 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_configure-docker.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_configure-docker.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl auth configure-docker" slug: chainctl_auth_configure-docker url: /chainguard/chainctl/chainctl-docs/chainctl_auth_configure-docker/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_configure-npm.md b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_configure-npm.md index 4941b66e9f..4884ff542d 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_configure-npm.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_configure-npm.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl auth configure-npm" slug: chainctl_auth_configure-npm url: /chainguard/chainctl/chainctl-docs/chainctl_auth_configure-npm/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_delete-account.md b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_delete-account.md index f0d73f1780..683b10223d 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_delete-account.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_delete-account.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl auth delete-account" slug: chainctl_auth_delete-account url: /chainguard/chainctl/chainctl-docs/chainctl_auth_delete-account/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_login.md b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_login.md index 08ad93ff63..9d2e347723 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_login.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_login.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl auth login" slug: chainctl_auth_login url: /chainguard/chainctl/chainctl-docs/chainctl_auth_login/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_logout.md b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_logout.md index 20ccc89453..3ab11c7c9c 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_logout.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_logout.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl auth logout" slug: chainctl_auth_logout url: /chainguard/chainctl/chainctl-docs/chainctl_auth_logout/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token.md b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token.md index 2d4c77e16f..711ccbf7c5 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl auth pull-token" slug: chainctl_auth_pull-token url: /chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token_create.md b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token_create.md index 987864da0b..5eb1707419 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token_create.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token_create.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl auth pull-token create" slug: chainctl_auth_pull-token_create url: /chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token_create/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token_list.md index fd54951c4e..81727572cf 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl auth pull-token list" slug: chainctl_auth_pull-token_list url: /chainguard/chainctl/chainctl-docs/chainctl_auth_pull-token_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_status.md b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_status.md index 8afa4a7e63..b5b13617e8 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_status.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_status.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl auth status" slug: chainctl_auth_status url: /chainguard/chainctl/chainctl-docs/chainctl_auth_status/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_token.md b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_token.md index 09121a242d..80d6881211 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_token.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_token.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl auth token" slug: chainctl_auth_token url: /chainguard/chainctl/chainctl-docs/chainctl_auth_token/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_token_capabilities.md b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_token_capabilities.md index 4dc881b0f7..a652d6da29 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_auth_token_capabilities.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_auth_token_capabilities.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl auth token capabilities" slug: chainctl_auth_token_capabilities url: /chainguard/chainctl/chainctl-docs/chainctl_auth_token_capabilities/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_config.md b/content/chainguard/chainctl/chainctl-docs/chainctl_config.md index 17f8aea68d..e80c1a59c2 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_config.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_config.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl config" slug: chainctl_config url: /chainguard/chainctl/chainctl-docs/chainctl_config/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_config_edit.md b/content/chainguard/chainctl/chainctl-docs/chainctl_config_edit.md index 4a4362d722..4f2ce22db9 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_config_edit.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_config_edit.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl config edit" slug: chainctl_config_edit url: /chainguard/chainctl/chainctl-docs/chainctl_config_edit/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_config_reset.md b/content/chainguard/chainctl/chainctl-docs/chainctl_config_reset.md index cb8e265c4f..856d4613c5 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_config_reset.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_config_reset.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl config reset" slug: chainctl_config_reset url: /chainguard/chainctl/chainctl-docs/chainctl_config_reset/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_config_save.md b/content/chainguard/chainctl/chainctl-docs/chainctl_config_save.md index eb923b176c..03e1d7f0aa 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_config_save.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_config_save.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl config save" slug: chainctl_config_save url: /chainguard/chainctl/chainctl-docs/chainctl_config_save/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_config_set.md b/content/chainguard/chainctl/chainctl-docs/chainctl_config_set.md index 7df16f0a17..6c2f49f2a3 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_config_set.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_config_set.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl config set" slug: chainctl_config_set url: /chainguard/chainctl/chainctl-docs/chainctl_config_set/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_config_unset.md b/content/chainguard/chainctl/chainctl-docs/chainctl_config_unset.md index ea3e708709..3b253a43a4 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_config_unset.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_config_unset.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl config unset" slug: chainctl_config_unset url: /chainguard/chainctl/chainctl-docs/chainctl_config_unset/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_config_validate.md b/content/chainguard/chainctl/chainctl-docs/chainctl_config_validate.md index 84708ee7da..10cd93f06b 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_config_validate.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_config_validate.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl config validate" slug: chainctl_config_validate url: /chainguard/chainctl/chainctl-docs/chainctl_config_validate/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_config_view.md b/content/chainguard/chainctl/chainctl-docs/chainctl_config_view.md index f23495a0c6..67149e1ce5 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_config_view.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_config_view.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl config view" slug: chainctl_config_view url: /chainguard/chainctl/chainctl-docs/chainctl_config_view/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_events.md b/content/chainguard/chainctl/chainctl-docs/chainctl_events.md index eefda8db62..3b1c183761 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_events.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_events.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl events" slug: chainctl_events url: /chainguard/chainctl/chainctl-docs/chainctl_events/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions.md b/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions.md index b9309bee15..eca5347ded 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl events subscriptions" slug: chainctl_events_subscriptions url: /chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_create.md b/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_create.md index eedb8045bb..ac98dff69e 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_create.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_create.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl events subscriptions create" slug: chainctl_events_subscriptions_create url: /chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_create/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_delete.md b/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_delete.md index ca6e6e3619..0a572afbba 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_delete.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl events subscriptions delete" slug: chainctl_events_subscriptions_delete url: /chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_delete/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_list.md index 8cb1afa5ea..0a5ea2d1e0 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl events subscriptions list" slug: chainctl_events_subscriptions_list url: /chainguard/chainctl/chainctl-docs/chainctl_events_subscriptions_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam.md index 6bc1104f52..e3e4b30de4 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam" slug: chainctl_iam url: /chainguard/chainctl/chainctl-docs/chainctl_iam/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations.md index a4227afb94..e2c255654a 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam account-associations" slug: chainctl_iam_account-associations url: /chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check.md index 69e88e9412..0d46ce9ffe 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam account-associations check" slug: chainctl_iam_account-associations_check url: /chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_aws.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_aws.md index 0e1952d7ac..f1f5d9ccde 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_aws.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_aws.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam account-associations check aws" slug: chainctl_iam_account-associations_check_aws url: /chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_aws/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_azure.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_azure.md index c347df7b8f..4a56e6a450 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_azure.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_azure.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam account-associations check azure" slug: chainctl_iam_account-associations_check_azure url: /chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_azure/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_gcp.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_gcp.md index c99a6b0b13..f799afaa3f 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_gcp.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_gcp.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam account-associations check gcp" slug: chainctl_iam_account-associations_check_gcp url: /chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_check_gcp/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_describe.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_describe.md index 975dc05165..3164fff4ec 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_describe.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_describe.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam account-associations describe" slug: chainctl_iam_account-associations_describe url: /chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_describe/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set.md index 636efdf8da..b6f541b57c 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam account-associations set" slug: chainctl_iam_account-associations_set url: /chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_aws.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_aws.md index be031cbf5e..2d637ffe2c 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_aws.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_aws.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam account-associations set aws" slug: chainctl_iam_account-associations_set_aws url: /chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_aws/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_azure.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_azure.md index d94697c78d..0c3b032cd7 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_azure.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_azure.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam account-associations set azure" slug: chainctl_iam_account-associations_set_azure url: /chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_azure/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_gcp.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_gcp.md index 8066042a87..daa779a116 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_gcp.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_gcp.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam account-associations set gcp" slug: chainctl_iam_account-associations_set_gcp url: /chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_set_gcp/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset.md index 63027b6bb1..4ab6c03265 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam account-associations unset" slug: chainctl_iam_account-associations_unset url: /chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_aws.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_aws.md index d6ed720945..89f349379c 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_aws.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_aws.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam account-associations unset aws" slug: chainctl_iam_account-associations_unset_aws url: /chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_aws/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_azure.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_azure.md index 0110f8f6ed..de64da5b03 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_azure.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_azure.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam account-associations unset azure" slug: chainctl_iam_account-associations_unset_azure url: /chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_azure/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_gcp.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_gcp.md index ecc681bfdb..93742ae277 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_gcp.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_gcp.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam account-associations unset gcp" slug: chainctl_iam_account-associations_unset_gcp url: /chainguard/chainctl/chainctl-docs/chainctl_iam_account-associations_unset_gcp/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders.md index c1c5ff1214..73726aec8f 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam folders" slug: chainctl_iam_folders url: /chainguard/chainctl/chainctl-docs/chainctl_iam_folders/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_delete.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_delete.md index 3059610720..1f5571eba7 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_delete.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam folders delete" slug: chainctl_iam_folders_delete url: /chainguard/chainctl/chainctl-docs/chainctl_iam_folders_delete/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_describe.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_describe.md index 6b3de1cfff..d3ec18be4f 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_describe.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_describe.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam folders describe" slug: chainctl_iam_folders_describe url: /chainguard/chainctl/chainctl-docs/chainctl_iam_folders_describe/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_list.md index eb802f3566..c9a8b20fc6 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam folders list" slug: chainctl_iam_folders_list url: /chainguard/chainctl/chainctl-docs/chainctl_iam_folders_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_update.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_update.md index 5211571d8a..9ddb2284ab 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_update.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_folders_update.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam folders update" slug: chainctl_iam_folders_update url: /chainguard/chainctl/chainctl-docs/chainctl_iam_folders_update/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities.md index cf791cce50..b7f8c9e3ab 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identities" slug: chainctl_iam_identities url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identities/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create.md index c9b4a42aa0..c644feb97d 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identities create" slug: chainctl_iam_identities_create url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws.md index 00adbfe553..1248a81de6 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identities create aws" slug: chainctl_iam_identities_create_aws url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_role.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_role.md index d0fafbd7ac..297e8e0d0f 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_role.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_role.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identities create aws role" slug: chainctl_iam_identities_create_aws_role url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_role/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_user.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_user.md index dc05e728c8..37fbf5a955 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_user.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_user.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identities create aws user" slug: chainctl_iam_identities_create_aws_user url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_aws_user/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_github.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_github.md index a9d78614ac..0b217ae706 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_github.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_github.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identities create github" slug: chainctl_iam_identities_create_github url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_github/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_gitlab.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_gitlab.md index 942be5a1dd..9da7dd1dec 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_gitlab.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_gitlab.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identities create gitlab" slug: chainctl_iam_identities_create_gitlab url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identities_create_gitlab/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_delete.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_delete.md index 96fb74bd7b..5360f568d8 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_delete.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identities delete" slug: chainctl_iam_identities_delete url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identities_delete/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_describe.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_describe.md index 1283bc36a1..878758beb8 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_describe.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_describe.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identities describe" slug: chainctl_iam_identities_describe url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identities_describe/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_list.md index 3870cdaa5a..6b4b2054b3 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identities list" slug: chainctl_iam_identities_list url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identities_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_update.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_update.md index c62e8b5dcc..48576f881a 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_update.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identities_update.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identities update" slug: chainctl_iam_identities_update url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identities_update/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers.md index e2e9d0db4f..01e82c8c2e 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identity-providers" slug: chainctl_iam_identity-providers url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_create.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_create.md index fb458899c6..49c834ade0 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_create.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_create.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identity-providers create" slug: chainctl_iam_identity-providers_create url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_create/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_delete.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_delete.md index c47a71c63a..b8b06e5ad2 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_delete.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identity-providers delete" slug: chainctl_iam_identity-providers_delete url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_delete/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_list.md index 01ea4e43ce..88fd06d96c 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identity-providers list" slug: chainctl_iam_identity-providers_list url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_update.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_update.md index 4ceedb3d30..d887c83ba6 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_update.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_update.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam identity-providers update" slug: chainctl_iam_identity-providers_update url: /chainguard/chainctl/chainctl-docs/chainctl_iam_identity-providers_update/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites.md index b5c70a3c51..6234913a2c 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam invites" slug: chainctl_iam_invites url: /chainguard/chainctl/chainctl-docs/chainctl_iam_invites/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites_create.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites_create.md index bb1e15d1a6..6b4b67d9a0 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites_create.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites_create.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam invites create" slug: chainctl_iam_invites_create url: /chainguard/chainctl/chainctl-docs/chainctl_iam_invites_create/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites_delete.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites_delete.md index bb9d6dc34d..56e642203f 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites_delete.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam invites delete" slug: chainctl_iam_invites_delete url: /chainguard/chainctl/chainctl-docs/chainctl_iam_invites_delete/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites_list.md index 6ca7d6deb4..820f60c71f 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_invites_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam invites list" slug: chainctl_iam_invites_list url: /chainguard/chainctl/chainctl-docs/chainctl_iam_invites_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations.md index 8c80fd9b22..f8f29d8d41 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam organizations" slug: chainctl_iam_organizations url: /chainguard/chainctl/chainctl-docs/chainctl_iam_organizations/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_delete.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_delete.md index 133011aab6..e86ce34ca2 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_delete.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam organizations delete" slug: chainctl_iam_organizations_delete url: /chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_delete/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_describe.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_describe.md index 89bb4bea74..ee98323dcc 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_describe.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_describe.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam organizations describe" slug: chainctl_iam_organizations_describe url: /chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_describe/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_list.md index 79ee60aa2a..09566a9c90 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam organizations list" slug: chainctl_iam_organizations_list url: /chainguard/chainctl/chainctl-docs/chainctl_iam_organizations_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings.md index afae22c1d9..9a8716a52b 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam role-bindings" slug: chainctl_iam_role-bindings url: /chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_create.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_create.md index 4baa878b6d..2ad18a5949 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_create.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_create.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam role-bindings create" slug: chainctl_iam_role-bindings_create url: /chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_create/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_delete.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_delete.md index 29bb5eaaf7..293dd1b634 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_delete.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam role-bindings delete" slug: chainctl_iam_role-bindings_delete url: /chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_delete/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_list.md index e7714b63c8..ada8b445d7 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam role-bindings list" slug: chainctl_iam_role-bindings_list url: /chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_update.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_update.md index 242ff0eb27..9c60b5ca41 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_update.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_update.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam role-bindings update" slug: chainctl_iam_role-bindings_update url: /chainguard/chainctl/chainctl-docs/chainctl_iam_role-bindings_update/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles.md index 21452307b6..f8924d71e0 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam roles" slug: chainctl_iam_roles url: /chainguard/chainctl/chainctl-docs/chainctl_iam_roles/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_capabilities.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_capabilities.md index fe4f1e56a9..55db21a7ef 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_capabilities.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_capabilities.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam roles capabilities" slug: chainctl_iam_roles_capabilities url: /chainguard/chainctl/chainctl-docs/chainctl_iam_roles_capabilities/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_capabilities_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_capabilities_list.md index 0990eda6b4..0c961e26c1 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_capabilities_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_capabilities_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam roles capabilities list" slug: chainctl_iam_roles_capabilities_list url: /chainguard/chainctl/chainctl-docs/chainctl_iam_roles_capabilities_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_create.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_create.md index 34d90383d6..76964e7e8e 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_create.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_create.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam roles create" slug: chainctl_iam_roles_create url: /chainguard/chainctl/chainctl-docs/chainctl_iam_roles_create/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_delete.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_delete.md index 93184c150f..6b7463f3dd 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_delete.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam roles delete" slug: chainctl_iam_roles_delete url: /chainguard/chainctl/chainctl-docs/chainctl_iam_roles_delete/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_list.md index 1b8ea14f64..8d58125964 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam roles list" slug: chainctl_iam_roles_list url: /chainguard/chainctl/chainctl-docs/chainctl_iam_roles_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_update.md b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_update.md index c831487efd..bb6c871e72 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_update.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_iam_roles_update.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl iam roles update" slug: chainctl_iam_roles_update url: /chainguard/chainctl/chainctl-docs/chainctl_iam_roles_update/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images.md index 286acd282f..d20e993ca8 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images" slug: chainctl_images url: /chainguard/chainctl/chainctl-docs/chainctl_images/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_advisories.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_advisories.md index b2f6ce2902..bcb4943cb3 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_advisories.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_advisories.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images advisories" slug: chainctl_images_advisories url: /chainguard/chainctl/chainctl-docs/chainctl_images_advisories/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_advisories_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_advisories_list.md index 6c01552af3..e68b0a06f7 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_advisories_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_advisories_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images advisories list" slug: chainctl_images_advisories_list url: /chainguard/chainctl/chainctl-docs/chainctl_images_advisories_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_changelog.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_changelog.md index 84eea93a9e..c41a372f65 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_changelog.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_changelog.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images changelog" slug: chainctl_images_changelog url: /chainguard/chainctl/chainctl-docs/chainctl_images_changelog/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_diff.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_diff.md index ab3ce12a1d..8f7d5fff70 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_diff.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_diff.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images diff" slug: chainctl_images_diff url: /chainguard/chainctl/chainctl-docs/chainctl_images_diff/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_entitlements.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_entitlements.md index 13c2c0f5b4..b7eb1b0b04 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_entitlements.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_entitlements.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images entitlements" slug: chainctl_images_entitlements url: /chainguard/chainctl/chainctl-docs/chainctl_images_entitlements/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_entitlements_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_entitlements_list.md index adc28ec771..7bb3a90190 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_entitlements_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_entitlements_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images entitlements list" slug: chainctl_images_entitlements_list url: /chainguard/chainctl/chainctl-docs/chainctl_images_entitlements_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_helm.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_helm.md index 11e901ae0f..90b85874c5 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_helm.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_helm.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images helm" slug: chainctl_images_helm url: /chainguard/chainctl/chainctl-docs/chainctl_images_helm/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_helm_values.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_helm_values.md index 63990dddf6..0f764dfb6f 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_helm_values.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_helm_values.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images helm values" slug: chainctl_images_helm_values url: /chainguard/chainctl/chainctl-docs/chainctl_images_helm_values/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_history.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_history.md index 079aa8a8f9..c2ad8aa7e6 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_history.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_history.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images history" slug: chainctl_images_history url: /chainguard/chainctl/chainctl-docs/chainctl_images_history/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_list.md index de8c839368..7b9f53a6cf 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images list" slug: chainctl_images_list url: /chainguard/chainctl/chainctl-docs/chainctl_images_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos.md index acb451554d..91d92b31ca 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images repos" slug: chainctl_images_repos url: /chainguard/chainctl/chainctl-docs/chainctl_images_repos/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build.md index c6110788a4..f4ebc4c5a4 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images repos build" slug: chainctl_images_repos_build url: /chainguard/chainctl/chainctl-docs/chainctl_images_repos_build/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_apply.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_apply.md index 28735fa145..9f94dbd14d 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_apply.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_apply.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images repos build apply" slug: chainctl_images_repos_build_apply url: /chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_apply/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_edit.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_edit.md index 2484721504..af16c849e7 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_edit.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_edit.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images repos build edit" slug: chainctl_images_repos_build_edit url: /chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_edit/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_list.md index 2da75c46a1..57525439b8 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images repos build list" slug: chainctl_images_repos_build_list url: /chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_logs.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_logs.md index 8a02d618fb..012fc8b284 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_logs.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_logs.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images repos build logs" slug: chainctl_images_repos_build_logs url: /chainguard/chainctl/chainctl-docs/chainctl_images_repos_build_logs/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_create.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_create.md index 4f743c52ff..339e9b2757 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_create.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_create.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images repos create" slug: chainctl_images_repos_create url: /chainguard/chainctl/chainctl-docs/chainctl_images_repos_create/ @@ -14,7 +14,7 @@ toc: true Create an image repository. ``` -chainctl images repos create {REPO_NAME} --parent ORGANIZATION_NAME | ORGANIZATION_ID | FOLDER_NAME | FOLDER_ID --tier=DEVTOOLS|COMMERCIAL|APPLICATION|BASE|FIPS|AI +chainctl images repos create {REPO_NAME} --parent ORGANIZATION_NAME | ORGANIZATION_ID | FOLDER_NAME | FOLDER_ID --tier=FIPS|AI|DEVTOOLS|COMMERCIAL|APPLICATION|BASE ``` ### Options diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_delete.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_delete.md index 99fe80cb8f..7a3ec15ac1 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_delete.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images repos delete" slug: chainctl_images_repos_delete url: /chainguard/chainctl/chainctl-docs/chainctl_images_repos_delete/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_list.md index a0054264a0..14670bdfb9 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images repos list" slug: chainctl_images_repos_list url: /chainguard/chainctl/chainctl-docs/chainctl_images_repos_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_update.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_update.md index 7769f6d608..b61013ba4f 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_update.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_repos_update.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images repos update" slug: chainctl_images_repos_update url: /chainguard/chainctl/chainctl-docs/chainctl_images_repos_update/ @@ -25,7 +25,7 @@ chainctl images repos update {REPO_NAME|REPO_ID} --parent ORGANIZATION_NAME | OR --expiration time Sync expiration time (e.g., 1970-01-01). --name string Updated name for the repo. --parent string The name or id of the parent location of the repo to update. - --tier string Catalog tier. One of: [APPLICATION,BASE,FIPS,AI,DEVTOOLS,COMMERCIAL] + --tier string Catalog tier. One of: [BASE,FIPS,AI,DEVTOOLS,COMMERCIAL,APPLICATION] ``` ### Options inherited from parent commands diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_tags.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_tags.md index 99983f9d99..c9e335f598 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_tags.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_tags.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images tags" slug: chainctl_images_tags url: /chainguard/chainctl/chainctl-docs/chainctl_images_tags/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_tags_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_tags_list.md index a0b2734e9b..6a6d18c7fb 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_tags_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_tags_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images tags list" slug: chainctl_images_tags_list url: /chainguard/chainctl/chainctl-docs/chainctl_images_tags_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_images_tags_resolve.md b/content/chainguard/chainctl/chainctl-docs/chainctl_images_tags_resolve.md index 37ae48307a..edc5426701 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_images_tags_resolve.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_images_tags_resolve.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl images tags resolve" slug: chainctl_images_tags_resolve url: /chainguard/chainctl/chainctl-docs/chainctl_images_tags_resolve/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_libraries.md b/content/chainguard/chainctl/chainctl-docs/chainctl_libraries.md index c57cc11a84..4166fe979e 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_libraries.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_libraries.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl libraries" slug: chainctl_libraries url: /chainguard/chainctl/chainctl-docs/chainctl_libraries/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements.md b/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements.md index a4002f36b3..aa8e67a2a7 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl libraries entitlements" slug: chainctl_libraries_entitlements url: /chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_create.md b/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_create.md index 53badd540e..5fcc6db32c 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_create.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_create.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl libraries entitlements create" slug: chainctl_libraries_entitlements_create url: /chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_create/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_delete.md b/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_delete.md index b7ec2ca54c..c5410997bb 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_delete.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl libraries entitlements delete" slug: chainctl_libraries_entitlements_delete url: /chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_delete/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_list.md index 546ff40974..dae169fafb 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl libraries entitlements list" slug: chainctl_libraries_entitlements_list url: /chainguard/chainctl/chainctl-docs/chainctl_libraries_entitlements_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_update-hashes.md b/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_update-hashes.md index 9b54519a41..97e82f26bd 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_update-hashes.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_update-hashes.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl libraries update-hashes" slug: chainctl_libraries_update-hashes url: /chainguard/chainctl/chainctl-docs/chainctl_libraries_update-hashes/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_verify.md b/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_verify.md index b0dc13f89b..b0e917bf33 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_verify.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_libraries_verify.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl libraries verify" slug: chainctl_libraries_verify url: /chainguard/chainctl/chainctl-docs/chainctl_libraries_verify/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_packages.md b/content/chainguard/chainctl/chainctl-docs/chainctl_packages.md index 10e5a0a6df..aa025ae9f3 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_packages.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_packages.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl packages" slug: chainctl_packages url: /chainguard/chainctl/chainctl-docs/chainctl_packages/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_packages_versions.md b/content/chainguard/chainctl/chainctl-docs/chainctl_packages_versions.md index 0ee73cf9b2..1f4a1915ec 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_packages_versions.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_packages_versions.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl packages versions" slug: chainctl_packages_versions url: /chainguard/chainctl/chainctl-docs/chainctl_packages_versions/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_packages_versions_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_packages_versions_list.md index 5a2e8fa5e1..9b00c792ff 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_packages_versions_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_packages_versions_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl packages versions list" slug: chainctl_packages_versions_list url: /chainguard/chainctl/chainctl-docs/chainctl_packages_versions_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_policies.md b/content/chainguard/chainctl/chainctl-docs/chainctl_policies.md index 0b9ae33541..c7a620c2c9 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_policies.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_policies.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl policies" slug: chainctl_policies url: /chainguard/chainctl/chainctl-docs/chainctl_policies/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding.md b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding.md index be7605e09e..2cdba63fa7 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl policies binding" slug: chainctl_policies_binding url: /chainguard/chainctl/chainctl-docs/chainctl_policies_binding/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding_create.md b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding_create.md index 6137feb71c..a2b328d60d 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding_create.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding_create.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl policies binding create" slug: chainctl_policies_binding_create url: /chainguard/chainctl/chainctl-docs/chainctl_policies_binding_create/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding_delete.md b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding_delete.md index 140970e497..cce506d74e 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding_delete.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl policies binding delete" slug: chainctl_policies_binding_delete url: /chainguard/chainctl/chainctl-docs/chainctl_policies_binding_delete/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding_list.md index 545c2bfa28..698efa5d9b 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_binding_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl policies binding list" slug: chainctl_policies_binding_list url: /chainguard/chainctl/chainctl-docs/chainctl_policies_binding_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_check.md b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_check.md index e8f58e4037..e5bf9a8750 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_check.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_check.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl policies check" slug: chainctl_policies_check url: /chainguard/chainctl/chainctl-docs/chainctl_policies_check/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_describe.md b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_describe.md index 6b60a96aa0..d54fbdb01f 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_describe.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_describe.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl policies describe" slug: chainctl_policies_describe url: /chainguard/chainctl/chainctl-docs/chainctl_policies_describe/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_disable.md b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_disable.md index 36d2284876..feaa6ad31b 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_disable.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_disable.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl policies disable" slug: chainctl_policies_disable url: /chainguard/chainctl/chainctl-docs/chainctl_policies_disable/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_enable.md b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_enable.md index 3330e4303a..a33aed771b 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_enable.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_enable.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl policies enable" slug: chainctl_policies_enable url: /chainguard/chainctl/chainctl-docs/chainctl_policies_enable/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_list.md index 0a6951aefc..46b15c7361 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_policies_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_policies_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl policies list" slug: chainctl_policies_list url: /chainguard/chainctl/chainctl-docs/chainctl_policies_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills.md index 192113797f..3835928416 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills" slug: chainctl_skills url: /chainguard/chainctl/chainctl-docs/chainctl_skills/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_accept-terms.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_accept-terms.md index 9f81f313b6..a28cbcbcdd 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_accept-terms.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_accept-terms.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills accept-terms" slug: chainctl_skills_accept-terms url: /chainguard/chainctl/chainctl-docs/chainctl_skills_accept-terms/ @@ -21,6 +21,10 @@ An org owner must run this once per org before any 'chainctl skills push' will succeed. Re-running after acceptance is a no-op. --group accepts either the org name (e.g. "acme.com") or its UIDP; omit it for an interactive picker. +For CI use cases where an interactive TUI isn't available, pass --yes. By +using --yes you confirm you have read and agreed to the legal documents +referenced in https://www.chainguard.dev/legal/agent-skills-disclosure. + ``` chainctl skills accept-terms [flags] ``` @@ -29,6 +33,7 @@ chainctl skills accept-terms [flags] ``` --group string Name or UIDP of the org to accept terms for + --yes Accept legal terms non-interactively. By using this flag you confirm you have read and agreed to the documents referenced in https://www.chainguard.dev/legal/agent-skills-disclosure. ``` ### Options inherited from parent commands diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_delete.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_delete.md index 1556601b0d..7644701ce6 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_delete.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills delete" slug: chainctl_skills_delete url: /chainguard/chainctl/chainctl-docs/chainctl_skills_delete/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_describe.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_describe.md index 3e87834387..3a5edbc577 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_describe.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_describe.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills describe" slug: chainctl_skills_describe url: /chainguard/chainctl/chainctl-docs/chainctl_skills_describe/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements.md index ab0829d2bd..38b06402fe 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills entitlements" slug: chainctl_skills_entitlements url: /chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_create.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_create.md index f4f087f6f5..e0af41b35f 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_create.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_create.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills entitlements create" slug: chainctl_skills_entitlements_create url: /chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_create/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_delete.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_delete.md index 3ca0c5da3e..f023da0d0f 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_delete.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_delete.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills entitlements delete" slug: chainctl_skills_entitlements_delete url: /chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_delete/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_list.md index 7e48f211ba..93d4cd211b 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills entitlements list" slug: chainctl_skills_entitlements_list url: /chainguard/chainctl/chainctl-docs/chainctl_skills_entitlements_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_install.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_install.md index 9f87898f78..28e44a5188 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_install.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_install.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills install" slug: chainctl_skills_install url: /chainguard/chainctl/chainctl-docs/chainctl_skills_install/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_list.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_list.md index 1f8c6d34e8..0a7b4193bf 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_list.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_list.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills list" slug: chainctl_skills_list url: /chainguard/chainctl/chainctl-docs/chainctl_skills_list/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_pull.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_pull.md index 7fa7b03c23..11b58f8017 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_pull.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_pull.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills pull" slug: chainctl_skills_pull url: /chainguard/chainctl/chainctl-docs/chainctl_skills_pull/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_push.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_push.md index d08adc1c1b..d7eabfc940 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_push.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_push.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills push" slug: chainctl_skills_push url: /chainguard/chainctl/chainctl-docs/chainctl_skills_push/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_uninstall.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_uninstall.md index 1a8904643e..bd32879e01 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_uninstall.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_uninstall.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills uninstall" slug: chainctl_skills_uninstall url: /chainguard/chainctl/chainctl-docs/chainctl_skills_uninstall/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_validate.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_validate.md index 775cf61bfe..e7a3ea5366 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_validate.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_validate.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills validate" slug: chainctl_skills_validate url: /chainguard/chainctl/chainctl-docs/chainctl_skills_validate/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_versions.md b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_versions.md index b0f08d6719..e2e9feadad 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_skills_versions.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_skills_versions.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl skills versions" slug: chainctl_skills_versions url: /chainguard/chainctl/chainctl-docs/chainctl_skills_versions/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_starter.md b/content/chainguard/chainctl/chainctl-docs/chainctl_starter.md index ef09334e2e..c71d0b0b47 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_starter.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_starter.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl starter" slug: chainctl_starter url: /chainguard/chainctl/chainctl-docs/chainctl_starter/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_starter_add-images.md b/content/chainguard/chainctl/chainctl-docs/chainctl_starter_add-images.md index 367040bf75..854e37ea86 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_starter_add-images.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_starter_add-images.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl starter add-images" slug: chainctl_starter_add-images url: /chainguard/chainctl/chainctl-docs/chainctl_starter_add-images/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_starter_init.md b/content/chainguard/chainctl/chainctl-docs/chainctl_starter_init.md index 309e94eaab..3c4aa6331e 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_starter_init.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_starter_init.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl starter init" slug: chainctl_starter_init url: /chainguard/chainctl/chainctl-docs/chainctl_starter_init/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_starter_request-access.md b/content/chainguard/chainctl/chainctl-docs/chainctl_starter_request-access.md index 768f2f8c4f..e3396fb26e 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_starter_request-access.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_starter_request-access.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl starter request-access" slug: chainctl_starter_request-access url: /chainguard/chainctl/chainctl-docs/chainctl_starter_request-access/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_starter_status.md b/content/chainguard/chainctl/chainctl-docs/chainctl_starter_status.md index 6aac042d8d..43b282419e 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_starter_status.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_starter_status.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl starter status" slug: chainctl_starter_status url: /chainguard/chainctl/chainctl-docs/chainctl_starter_status/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_update.md b/content/chainguard/chainctl/chainctl-docs/chainctl_update.md index b27514a9cb..29ef7b4b88 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_update.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_update.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl update" slug: chainctl_update url: /chainguard/chainctl/chainctl-docs/chainctl_update/ diff --git a/content/chainguard/chainctl/chainctl-docs/chainctl_version.md b/content/chainguard/chainctl/chainctl-docs/chainctl_version.md index 07ffb8a32d..2bd66f0dd1 100644 --- a/content/chainguard/chainctl/chainctl-docs/chainctl_version.md +++ b/content/chainguard/chainctl/chainctl-docs/chainctl_version.md @@ -1,5 +1,5 @@ --- -date: 2026-06-03T13:15:20Z +date: 2026-06-05T18:37:43Z title: "chainctl version" slug: chainctl_version url: /chainguard/chainctl/chainctl-docs/chainctl_version/ diff --git a/static/api-v1.json b/static/api-v1.json index 697f0bd1f8..27554cc585 100644 --- a/static/api-v1.json +++ b/static/api-v1.json @@ -644,9 +644,45 @@ }, "type": "object" }, + "chainguard.platform.argos.Affected": { + "properties": { + "databaseSpecific": { + "format": "byte", + "type": "string" + }, + "ecosystemSpecific": { + "format": "byte", + "type": "string" + }, + "package": { + "$ref": "#/components/schemas/chainguard.platform.argos.Package" + }, + "ranges": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.Range" + }, + "type": "array" + }, + "versions": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, "chainguard.platform.argos.ArgosDocument": { "description": "ArgosDocument is an organization-scoped record describing a\nclient-side-encrypted document. The actual ciphertext (the upload\nenvelope: client-AES-encrypted plaintext + RSA-wrapped AES key) lives in\nGCS; ArgosDocument tracks only the metadata.", "properties": { + "cgpIds": { + "description": "cgp_ids are the Chainguard vulnerability identifiers (CGP-...) this\nsubmission resolved to, populated once processing completes.", + "items": { + "type": "string" + }, + "readOnly": true, + "type": "array" + }, "createdAt": { "description": "When the document record was created.", "format": "date-time", @@ -678,12 +714,13 @@ }, "chainguard.platform.argos.ArgosDocument.Status": { "default": "STATUS_UNSPECIFIED", - "description": " - STATUS_PENDING: Payload received; pending downstream processing.\n - STATUS_READY: Document is fully usable.\n - STATUS_FAILED: Document processing failed; the document is unusable.", + "description": " - STATUS_PENDING: Payload received; pending downstream processing.\n - STATUS_READY: Document is fully usable.\n - STATUS_FAILED: Document processing failed; the document is unusable.\n - STATUS_FALSE_POSITIVE: Processing determined the finding is not a true positive.", "enum": [ "STATUS_UNSPECIFIED", "STATUS_PENDING", "STATUS_READY", - "STATUS_FAILED" + "STATUS_FAILED", + "STATUS_FALSE_POSITIVE" ], "type": "string" }, @@ -743,6 +780,204 @@ }, "type": "object" }, + "chainguard.platform.argos.Event": { + "properties": { + "fixed": { + "type": "string" + }, + "introduced": { + "type": "string" + }, + "lastAffected": { + "type": "string" + }, + "limit": { + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.argos.MinimalOSVRecord": { + "description": "MinimalOSVRecord is the abbreviated vuln entry returned by QueryBatch,\nmatching the OSV spec's batch response (id + modified only); callers\nfollow up with GetVuln for full detail.", + "properties": { + "id": { + "type": "string" + }, + "modified": { + "format": "date-time", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.argos.OSVQueryBatchRequest": { + "properties": { + "queries": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.OSVQueryRequest" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.argos.OSVQueryBatchResponse": { + "properties": { + "results": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.OSVQueryBatchResult" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.argos.OSVQueryBatchResult": { + "properties": { + "nextPageToken": { + "description": "next_page_token paginates this query's results (OSV batch spec).", + "type": "string" + }, + "vulns": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.MinimalOSVRecord" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.argos.OSVQueryRequest": { + "properties": { + "package": { + "$ref": "#/components/schemas/chainguard.platform.argos.Package" + }, + "pageToken": { + "title": "page_token is the opaque cursor from a previous response's next_page_token.\nEmpty starts at the first page. (OSV spec: query supports page_token.)", + "type": "string" + }, + "version": { + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.argos.OSVQueryResponse": { + "properties": { + "nextPageToken": { + "description": "next_page_token is the cursor for the next page; empty when last page.", + "type": "string" + }, + "vulns": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.OSVRecord" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.argos.OSVRecord": { + "properties": { + "affected": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.Affected" + }, + "type": "array" + }, + "aliases": { + "items": { + "type": "string" + }, + "type": "array" + }, + "details": { + "type": "string" + }, + "id": { + "type": "string" + }, + "modified": { + "format": "date-time", + "type": "string" + }, + "published": { + "format": "date-time", + "type": "string" + }, + "related": { + "items": { + "type": "string" + }, + "type": "array" + }, + "schemaVersion": { + "type": "string" + }, + "severity": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.Severity" + }, + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.argos.Package": { + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + }, + "purl": { + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.argos.Range": { + "properties": { + "events": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.Event" + }, + "type": "array" + }, + "repo": { + "type": "string" + }, + "type": { + "$ref": "#/components/schemas/chainguard.platform.argos.Range.RangeType" + } + }, + "type": "object" + }, + "chainguard.platform.argos.Range.RangeType": { + "default": "RANGE_TYPE_UNSPECIFIED", + "enum": [ + "RANGE_TYPE_UNSPECIFIED", + "RANGE_TYPE_SEMVER", + "RANGE_TYPE_ECOSYSTEM", + "RANGE_TYPE_GIT" + ], + "type": "string" + }, + "chainguard.platform.argos.Severity": { + "properties": { + "score": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "type": "object" + }, "chainguard.platform.auth.HeadlessSession": { "properties": { "ecdhPublicKey": { @@ -758,6 +993,28 @@ }, "type": "object" }, + "chainguard.platform.auth.Profile": { + "description": "Profile carries upstream OIDC profile claims for a single identity.\nReturned on WhoAmI for the caller's own identity; not exposed via any\nother API surface.", + "properties": { + "familyName": { + "description": "family_name is the upstream `family_name` claim.", + "type": "string" + }, + "givenName": { + "description": "given_name is the upstream `given_name` claim.", + "type": "string" + }, + "name": { + "description": "name is the upstream `name` claim — typically the user's full display name.", + "type": "string" + }, + "picture": { + "description": "picture is the upstream `picture` claim — a URL to the user's avatar.", + "type": "string" + } + }, + "type": "object" + }, "chainguard.platform.auth.RegistrationRequest": { "properties": { "code": { @@ -818,6 +1075,14 @@ "description": "Issuer is the issuer of the token.", "type": "string" }, + "profile": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.auth.Profile" + } + ], + "description": "The upstream profile claims (name, picture, etc.) for the caller's\nidentity, sourced from the most recent authentication. Unset for\nidentities with no stored profile (e.g. assumable identities, or\nhuman identities that haven't authenticated since the feature shipped)." + }, "subject": { "description": "The subject of the token.", "type": "string" @@ -875,6 +1140,9 @@ "companyName": { "type": "string" }, + "hubspotUtk": { + "type": "string" + }, "jobTitle": { "type": "string" }, @@ -894,6 +1162,10 @@ }, "type": "array" }, + "selfServe": { + "description": "Product fields.", + "type": "boolean" + }, "utmCampaign": { "title": "UTM fields\nSee https://en.wikipedia.org/wiki/UTM_parameters", "type": "string" @@ -1126,6 +1398,47 @@ }, "type": "object" }, + "chainguard.platform.iam.ExternalGroupRoleMapping": { + "properties": { + "createdAt": { + "description": "When this mapping was created.", + "format": "date-time", + "type": "string" + }, + "externalGroupId": { + "description": "external_group_id is the IdP's identifier for the group.", + "type": "string" + }, + "id": { + "description": "id is the UIDP of this mapping. It is rooted under the owning\nIdentityProvider's UIDP ({org}/{idp}/{mapping}).", + "type": "string" + }, + "identityProviderUidp": { + "description": "identity_provider_uidp is the UIDP of the IdentityProvider this mapping belongs to.", + "type": "string" + }, + "roleUidp": { + "description": "role_uidp is the UIDP of the Chainguard Role to grant.", + "type": "string" + }, + "scope": { + "description": "scope is the UIDP of the Chainguard Group where the role applies.\nToday it must equal the organization root UIDP; it is modeled as a group\nUIDP (rather than an org_id) so role mappings can later be scoped to a\nsub-org or folder without a schema change.", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.iam.ExternalGroupRoleMappingList": { + "properties": { + "items": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.iam.ExternalGroupRoleMapping" + }, + "type": "array" + } + }, + "type": "object" + }, "chainguard.platform.iam.Group": { "properties": { "description": { @@ -1652,6 +1965,10 @@ "clientSecret": { "type": "string" }, + "groupsClaim": { + "description": "groups_claim is the name of the OIDC token claim containing group memberships.\nRequired for IdP group-based role mapping.", + "type": "string" + }, "issuer": { "title": "Issuer URL (e.g https://accounts.google.com)", "type": "string" @@ -2196,1339 +2513,1352 @@ }, "type": "object" }, - "chainguard.platform.libraries.NpmPackage": { - "description": "NpmPackage contains metadata about an npm package available in\nChainguard Libraries. The package name can be used to retrieve\nversion-level details via ListVersions.", + "chainguard.platform.libraries.LibraryAllowListEntry": { + "description": "AllowListEntry bypasses specific automatic gates for a trusted package (PURL).", "properties": { - "description": { - "description": "A short description of the package.", - "type": "string" + "bypassCooldown": { + "description": "Bypass the cooldown gate for matching versions.", + "type": "boolean" }, - "latestVersion": { - "description": "The most recent version of this package available.", - "type": "string" + "bypassMalware": { + "description": "Bypass the malware gate for matching versions. Requires justification.", + "type": "boolean" }, - "license": { - "description": "The SPDX license identifier for this package.", + "justification": { + "description": "Required when bypass_malware is true.", "type": "string" }, - "packageName": { - "description": "The npm package name (e.g. \"react\" or \"@types/node\").", + "purl": { + "description": "The PURL. Normalized on input. An empty component is a wildcard.", "type": "string" - }, - "versionCount": { - "description": "The number of versions available for this package.", - "format": "int64", + } + }, + "type": "object" + }, + "chainguard.platform.libraries.LibraryBlockListEntry": { + "description": "BlockListEntry explicitly withholds a package (PURL) regardless of any other\ngate. Block-list entries always take precedence over allow-list entries.", + "properties": { + "purl": { + "description": "The PURL. Normalized on input. An empty component is a wildcard.", "type": "string" } }, "type": "object" }, - "chainguard.platform.libraries.NpmPackageList": { - "description": "A collection of NpmPackages as returned by calls to List.\nContains pagination fields to allow callers to request additional\npages of results if the set exceeds the requested page size.", + "chainguard.platform.libraries.LibraryPolicies.UpdatePolicyBody": { + "description": "LibraryPolicy configures Libraries gates via structured block/allow lists and\na cooldown window.", "properties": { - "items": { - "description": "The list of npm packages matching the request.", + "allowList": { + "description": "PURL-keyed entries that bypass specific automatic gates.", "items": { - "$ref": "#/components/schemas/chainguard.platform.libraries.NpmPackage" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryAllowListEntry" }, "type": "array" }, - "nextPageToken": { - "description": "A token that can be reused on subsequent requests to retrieve\nthe next page of results. Other filter fields must match\nthe call that provided this token.", + "blockList": { + "description": "PURL-keyed entries that withhold a package regardless of other gates.", + "items": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryBlockListEntry" + }, + "type": "array" + }, + "cooldownDays": { + "description": "The cooldown window in days. Unset = inherit default (7); 0 = disabled;\n1-30 = explicit. Values above 30 are rejected.", + "format": "int32", + "type": "integer" + }, + "createdAt": { + "format": "date-time", + "readOnly": true, "type": "string" }, - "totalCount": { - "description": "The total number of packages matching the query.", - "format": "int64", + "description": { + "description": "Human-readable description. May be up to 1024 characters.", + "type": "string" + }, + "expression": { + "description": "Raw Rego. OUTPUT_ONLY: populated for SYSTEM policies, empty for CUSTOM.\nSetting it on create/update of a custom policy is rejected (INVALID_ARGUMENT) in v1.", + "readOnly": true, + "type": "string" + }, + "name": { + "description": "Human-readable name. May be up to 128 characters.", + "type": "string" + }, + "policyType": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyType" + } + ], + "description": "SYSTEM or CUSTOM. System policies may not be modified.", + "readOnly": true + }, + "updatedAt": { + "format": "date-time", + "readOnly": true, "type": "string" } }, "type": "object" }, - "chainguard.platform.libraries.NpmPackageVersion": { - "description": "NpmPackageVersion contains metadata about a specific version of an\nnpm package available in Chainguard Libraries.", + "chainguard.platform.libraries.LibraryPolicy": { + "description": "LibraryPolicy configures Libraries gates via structured block/allow lists and\na cooldown window.", "properties": { + "allowList": { + "description": "PURL-keyed entries that bypass specific automatic gates.", + "items": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryAllowListEntry" + }, + "type": "array" + }, + "blockList": { + "description": "PURL-keyed entries that withhold a package regardless of other gates.", + "items": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryBlockListEntry" + }, + "type": "array" + }, + "cooldownDays": { + "description": "The cooldown window in days. Unset = inherit default (7); 0 = disabled;\n1-30 = explicit. Values above 30 are rejected.", + "format": "int32", + "type": "integer" + }, "createdAt": { - "description": "When this version was first published.", "format": "date-time", + "readOnly": true, "type": "string" }, - "fileCount": { - "description": "The number of files contained in the package.", - "format": "int64", + "description": { + "description": "Human-readable description. May be up to 1024 characters.", "type": "string" }, - "fileSize": { - "description": "The size of the package in bytes.", - "format": "int64", + "expression": { + "description": "Raw Rego. OUTPUT_ONLY: populated for SYSTEM policies, empty for CUSTOM.\nSetting it on create/update of a custom policy is rejected (INVALID_ARGUMENT) in v1.", + "readOnly": true, "type": "string" }, - "license": { - "description": "The SPDX license identifier for this version.", + "id": { "type": "string" }, - "packageName": { - "description": "The npm package name (e.g. \"react\" or \"@scope/lib\").", + "name": { + "description": "Human-readable name. May be up to 128 characters.", "type": "string" }, - "sourceType": { + "policyType": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.libraries.NpmSourceType" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyType" } ], - "description": "The origin of this package version." + "description": "SYSTEM or CUSTOM. System policies may not be modified.", + "readOnly": true }, - "version": { - "description": "The version string of this package version.", + "updatedAt": { + "format": "date-time", + "readOnly": true, "type": "string" } }, "type": "object" }, - "chainguard.platform.libraries.NpmPackageVersionList": { - "description": "A collection of NpmPackageVersions as returned by calls to ListVersions.\nContains pagination fields to allow callers to request additional\npages of results if the set exceeds the requested page size.", + "chainguard.platform.libraries.LibraryPolicyBinding": { + "description": "LibraryPolicyBinding activates a policy for an (org, ecosystem) pair.", + "properties": { + "createdAt": { + "format": "date-time", + "readOnly": true, + "type": "string" + }, + "ecosystem": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.libraries.Ecosystem" + } + ], + "description": "The ecosystem this binding applies to (JAVASCRIPT or PYTHON; JAVA rejected)." + }, + "id": { + "type": "string" + }, + "mode": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBindingMode" + } + ], + "description": "ENFORCED or LOG." + }, + "policy": { + "description": "The UIDP of the policy to apply.", + "type": "string" + }, + "updatedAt": { + "format": "date-time", + "readOnly": true, + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.libraries.LibraryPolicyBindingList": { "properties": { "items": { - "description": "The list of package versions matching the request.", "items": { - "$ref": "#/components/schemas/chainguard.platform.libraries.NpmPackageVersion" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBinding" }, "type": "array" }, "nextPageToken": { - "description": "A token that can be reused on subsequent requests to retrieve\nthe next page of results.", "type": "string" }, + "skipped": { + "format": "int32", + "type": "integer" + }, "totalCount": { - "description": "The total number of versions available for the package.", "format": "int64", "type": "string" } }, "type": "object" }, - "chainguard.platform.libraries.NpmSourceType": { - "default": "NPM_SOURCE_TYPE_UNKNOWN", - "description": "NpmSourceType indicates the origin of a package version.", - "enum": [ - "NPM_SOURCE_TYPE_UNKNOWN", - "NPM_SOURCE_TYPE_INTERNAL", - "NPM_SOURCE_TYPE_INTERNAL_REMEDIATED", - "NPM_SOURCE_TYPE_UPSTREAM_REGISTRY" - ], - "type": "string" - }, - "chainguard.platform.libraries.Policy": { - "default": "POLICY_UNKNOWN", - "description": "Policy controls which package sources are available for an entitlement.\n\n - POLICY_UNKNOWN: defaults to CHAINGUARD behavior\n - POLICY_CHAINGUARD: internal packages only\n - POLICY_CHAINGUARD_AND_UPSTREAM: internal + upstream (with cooldown)", - "enum": [ - "POLICY_UNKNOWN", - "POLICY_CHAINGUARD", - "POLICY_CHAINGUARD_AND_UPSTREAM" - ], - "type": "string" - }, - "chainguard.platform.libraries.Source": { - "default": "SOURCE_UNKNOWN", - "description": "Source indicates how an entitlement was created.\n\n - SOURCE_UNKNOWN: default; treat as SOURCE_TRIAL for backwards compatibility\n - SOURCE_TRIAL: self-service trial entitlement\n - SOURCE_SFDC: created or managed via Salesforce", + "chainguard.platform.libraries.LibraryPolicyBindingMode": { + "default": "LIBRARY_POLICY_BINDING_MODE_UNSPECIFIED", + "description": "BindingMode controls whether a binding enforces (blocks pulls) or only logs\nshadow violations.\n\n - LIBRARY_POLICY_BINDING_MODE_ENFORCED: Withhold packages that fail the policy.\n - LIBRARY_POLICY_BINDING_MODE_LOG: Evaluate and record violations without blocking.", "enum": [ - "SOURCE_UNKNOWN", - "SOURCE_TRIAL", - "SOURCE_SFDC" + "LIBRARY_POLICY_BINDING_MODE_UNSPECIFIED", + "LIBRARY_POLICY_BINDING_MODE_ENFORCED", + "LIBRARY_POLICY_BINDING_MODE_LOG" ], "type": "string" }, - "chainguard.platform.matcher.ImageMatch": { + "chainguard.platform.libraries.LibraryPolicyBindings.UpdateBindingBody": { + "description": "LibraryPolicyBinding activates a policy for an (org, ecosystem) pair.", "properties": { - "coverage": { - "format": "double", - "title": "coverage is the percentage of required packages in the image (0.0 to 1.0)", - "type": "number" - }, - "digest": { - "title": "digest is the image digest", + "createdAt": { + "format": "date-time", + "readOnly": true, "type": "string" }, - "extraPackages": { - "format": "int32", - "title": "extra_packages is the count of packages in the image not required", - "type": "integer" - }, - "extraPackagesWithScore": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.matcher.PackageWithScore" - }, - "title": "extra_packages_with_score are the extra packages with their weights", - "type": "array" + "ecosystem": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.libraries.Ecosystem" + } + ], + "description": "The ecosystem this binding applies to (JAVASCRIPT or PYTHON; JAVA rejected)." }, - "extraScore": { - "format": "double", - "title": "extra_score is the weighted score for extra packages", - "type": "number" + "mode": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBindingMode" + } + ], + "description": "ENFORCED or LOG." }, - "imageRef": { - "title": "image_ref is the image reference (e.g., \"cgr.dev/chainguard/python:latest\")", + "policy": { + "description": "The UIDP of the policy to apply.", "type": "string" }, - "missingPackages": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.matcher.PackageWithScore" - }, - "title": "missing_packages are the required packages not in the image", - "type": "array" - }, - "missingScore": { - "format": "double", - "title": "missing_score is the weighted score for missing packages", - "type": "number" - }, - "overallScore": { - "format": "double", - "title": "overall_score is the overall weighted score", - "type": "number" - }, - "probabilityScore": { - "format": "double", - "title": "probability_score is the probability score (0-100) indicating match accuracy", - "type": "number" - }, - "satisfiedCount": { - "format": "int32", - "title": "satisfied_count is the number of required packages found", - "type": "integer" - }, - "satisfiedPackages": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.matcher.PackageWithScore" - }, - "title": "satisfied_packages are the required packages found in the image", - "type": "array" - }, - "satisfiedScore": { - "format": "double", - "title": "satisfied_score is the weighted score for satisfied packages", - "type": "number" - }, - "totalRequired": { - "format": "int32", - "title": "total_required is the total number of packages needed", - "type": "integer" + "updatedAt": { + "format": "date-time", + "readOnly": true, + "type": "string" } }, "type": "object" }, - "chainguard.platform.matcher.MatchImageRequest": { + "chainguard.platform.libraries.LibraryPolicyBlockEvent": { + "description": "LibraryPolicyBlockEvent records that a package version was withheld.", "properties": { - "arch": { - "title": "arch is the architecture (\"x86_64\")", - "type": "string" + "attemptCount": { + "format": "int32", + "type": "integer" }, - "count": { + "cooldownDays": { + "description": "Cooldown days snapshotted at first block.", "format": "int32", - "title": "count is the maximum number of recommendations to return (default: 10)", "type": "integer" }, - "distName": { - "title": "dist_name is the distribution name (\"debian\", \"ubuntu\", \"alpine\", \"redhat\", \"suse\", \"amazon-linux\")", + "ecosystem": { + "description": "The ecosystem string (e.g. \"JAVASCRIPT\").", "type": "string" }, - "distVersion": { - "title": "dist_version is the distribution version (e.g., \"13\", \"24.04\", \"3.22\", \"10\", \"16.0\", \"2023\")", + "firstBlockedAt": { + "format": "date-time", "type": "string" }, - "parentId": { - "title": "parent_id is the group id of the caller making the request", + "id": { "type": "string" }, - "sbom": { + "lastBlockedAt": { + "format": "date-time", + "type": "string" + }, + "mode": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.matcher.SBOM" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBindingMode" } ], - "title": "sbom is the SBOM components" + "description": "ENFORCED or LOG." }, - "threshold": { - "format": "double", - "title": "threshold is the minimum probability score (0-100) to report images (default: 50.0)", - "type": "number" - } - }, - "type": "object" - }, - "chainguard.platform.matcher.MatchImageResponse": { - "properties": { - "images": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.matcher.ImageMatch" - }, - "title": "matching chainguard images ordered by descending score", - "type": "array" + "policy": { + "description": "The policy UIDP active when the block occurred.", + "type": "string" }, - "requiredApks": { - "items": { - "type": "string" - }, - "title": "required_apks is the list of required APK package names", - "type": "array" + "publishDate": { + "description": "Upstream publish date; set when reason = cooldown.", + "format": "date-time", + "type": "string" }, - "totalExternalPackages": { - "format": "int32", - "title": "total_external_packages is the total number of external packages in the SBOM", - "type": "integer" + "purl": { + "description": "Full PURL of the attempted pull.", + "type": "string" }, - "unmatchedExternalPkgs": { - "items": { - "type": "string" - }, - "title": "unmatched_external_pkgs is the list of external packages that couldn't be matched", - "type": "array" + "reason": { + "description": "cooldown, malware, or policy.", + "type": "string" + }, + "unblocksAt": { + "description": "publish_date + cooldown_days; nil when reason != cooldown.", + "format": "date-time", + "type": "string" } }, "type": "object" }, - "chainguard.platform.matcher.PackageWithScore": { + "chainguard.platform.libraries.LibraryPolicyBlockEventList": { "properties": { - "externalPackageNames": { + "items": { "items": { - "type": "string" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBlockEvent" }, "type": "array" }, - "name": { - "title": "PackageWithScore represents a package name with its associated weight/score", + "nextPageToken": { "type": "string" }, - "score": { - "format": "double", - "type": "number" + "skipped": { + "format": "int32", + "type": "integer" + }, + "totalCount": { + "format": "int64", + "type": "string" } }, "type": "object" }, - "chainguard.platform.matcher.SBOM": { + "chainguard.platform.libraries.LibraryPolicyList": { "properties": { - "sbomComponents": { + "items": { "items": { - "$ref": "#/components/schemas/chainguard.platform.matcher.SBOMComponent" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicy" }, - "title": "individaul sbom components", "type": "array" - } - }, - "type": "object" - }, - "chainguard.platform.matcher.SBOMComponent": { - "properties": { - "bomref": { - "type": "string" }, - "cpe": { - "type": "string" - }, - "name": { - "type": "string" - }, - "purl": { + "nextPageToken": { + "description": "Token for retrieving the next page of results. Empty if no more results.", "type": "string" }, - "type": { - "title": "single item within the package", - "type": "string" + "skipped": { + "format": "int32", + "type": "integer" }, - "version": { + "totalCount": { + "format": "int64", "type": "string" } }, "type": "object" }, - "chainguard.platform.oidc.RawToken": { + "chainguard.platform.libraries.LibraryPolicyType": { + "default": "LIBRARY_POLICY_TYPE_UNSPECIFIED", + "description": "PolicyType distinguishes Chainguard-authored system policies from\ncustomer-managed custom policies.\n\n - LIBRARY_POLICY_TYPE_SYSTEM: Created and managed by Chainguard; readable but not modifiable.\n - LIBRARY_POLICY_TYPE_CUSTOM: Created and managed by your organization.", + "enum": [ + "LIBRARY_POLICY_TYPE_UNSPECIFIED", + "LIBRARY_POLICY_TYPE_SYSTEM", + "LIBRARY_POLICY_TYPE_CUSTOM" + ], + "type": "string" + }, + "chainguard.platform.libraries.NpmPackage": { + "description": "NpmPackage contains metadata about an npm package available in\nChainguard Libraries. The package name can be used to retrieve\nversion-level details via ListVersions.", "properties": { - "expiry": { - "description": "(optional) Expiry time of the token.", - "format": "date-time", + "description": { + "description": "A short description of the package.", "type": "string" }, - "refreshToken": { + "latestVersion": { + "description": "The most recent version of this package available.", "type": "string" }, - "token": { + "license": { + "description": "The SPDX license identifier for this package.", "type": "string" - } - }, - "type": "object" - }, - "chainguard.platform.oidc.TokenPair": { - "description": "ExchangeRefreshToken returns a pair of token, in order to allow\nrefresh token to also be rotated.", - "properties": { - "refreshToken": { - "$ref": "#/components/schemas/chainguard.platform.oidc.RawToken" }, - "token": { - "$ref": "#/components/schemas/chainguard.platform.oidc.RawToken" - } - }, - "type": "object" - }, - "chainguard.platform.packages.PackageEntitlement": { - "description": "PackageEntitlement maps an org to a package tier they are entitled to.", - "properties": { - "id": { - "description": "id is the uidp of the entitlement, a child of a group.", + "packageName": { + "description": "The npm package name (e.g. \"react\" or \"@types/node\").", "type": "string" }, - "tier": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.packages.PackageTier" - } - ], - "description": "tier is the package tier this entitlement grants access to." + "versionCount": { + "description": "The number of versions available for this package.", + "format": "int64", + "type": "string" } }, "type": "object" }, - "chainguard.platform.packages.PackageEntitlementList": { + "chainguard.platform.libraries.NpmPackageList": { + "description": "A collection of NpmPackages as returned by calls to List.\nContains pagination fields to allow callers to request additional\npages of results if the set exceeds the requested page size.", "properties": { "items": { + "description": "The list of npm packages matching the request.", "items": { - "$ref": "#/components/schemas/chainguard.platform.packages.PackageEntitlement" + "$ref": "#/components/schemas/chainguard.platform.libraries.NpmPackage" }, "type": "array" - } - }, - "type": "object" - }, - "chainguard.platform.packages.PackageTier": { - "default": "PACKAGE_TIER_UNSPECIFIED", - "description": "PackageTier represents the package tier an org can be entitled to.", - "enum": [ - "PACKAGE_TIER_UNSPECIFIED", - "PACKAGE_TIER_BASE", - "PACKAGE_TIER_FIPS" - ], - "type": "string" - }, - "chainguard.platform.ping.Response": { - "properties": { - "response": { + }, + "nextPageToken": { + "description": "A token that can be reused on subsequent requests to retrieve\nthe next page of results. Other filter fields must match\nthe call that provided this token.", + "type": "string" + }, + "totalCount": { + "description": "The total number of packages matching the query.", + "format": "int64", "type": "string" } }, "type": "object" }, - "chainguard.platform.policygates.v1.Binding": { - "description": "Binding associates a Policy with a resource in the hierarchy.\nThe binding is a child of the resource it applies to, and its policy\nis applied to all descendants of that resource.", + "chainguard.platform.libraries.NpmPackageVersion": { + "description": "NpmPackageVersion contains metadata about a specific version of an\nnpm package available in Chainguard Libraries.", "properties": { "createdAt": { - "description": "When the binding was created.", + "description": "created_at is when the record was created in the database.", "format": "date-time", - "readOnly": true, "type": "string" }, - "id": { - "description": "The id of the Binding. The policy is bound to its parent,\nand applies to all of the parent's descendants.", + "fileCount": { + "description": "file_count is the number of files inside the tarball.", + "format": "int64", "type": "string" }, - "mode": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.PolicyMode" - } - ], - "description": "PolicyMode defines how the policy is enforced." + "fileSize": { + "description": "file_size is the size of the tarball in bytes.", + "format": "int64", + "type": "string" }, - "parameters": { - "additionalProperties": {}, - "description": "The parameter values supplied for this binding, keyed by parameter name.\nThe set of valid keys and value types is declared by the referenced\npolicy's parameter_schemas. Server-side validation rejects unknown keys\nand values that violate the schema.", - "type": "object" + "integrity": { + "description": "integrity is the SRI string (optional).", + "type": "string" }, - "policy": { - "title": "The policy to apply", + "license": { + "description": "license is the SPDX license identifier for this version (e.g., \"MIT\", \"Apache-2.0\").", "type": "string" }, - "resourceTypes": { + "malwareMalicious": { + "description": "malware_malicious indicates whether this version was flagged as malicious.", + "type": "boolean" + }, + "malwareScanned": { + "description": "malware_scanned indicates whether this version has been scanned for malware.", + "type": "boolean" + }, + "malwareScannedAt": { + "description": "malware_scanned_at is when the malware scan was performed.", + "format": "date-time", + "type": "string" + }, + "packageName": { + "title": "package_name is the full package name including scope.\ne.g., \"@scope/lib\" or \"react\"", + "type": "string" + }, + "provenancePredicateType": { + "title": "provenance_predicate_type is the SLSA predicate type URI if provenance was\nprovided at publish time. Empty string if no provenance was provided.\ne.g., \"https://slsa.dev/provenance/v1\" or \"https://slsa.dev/provenance/v0.2\"", + "type": "string" + }, + "putumentRef": { + "description": "putument_ref is the R2 storage path to the raw putument JSON blob.", + "type": "string" + }, + "sbomFormats": { + "description": "sbom_formats are the supported sbom formats for this package.", "items": { "type": "string" }, - "title": "The resource types this binding applies to.\nEach value is a Chainguard API resource type\n(e.g. \"registry.chainguard.dev/Repo\").\nSupported resource types:\n - registry.chainguard.dev/Repo", "type": "array" }, + "sha512": { + "description": "sha512 is the SHA-512 checksum of the tarball (required).", + "type": "string" + }, + "sourceType": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.libraries.NpmSourceType" + } + ], + "description": "source_type indicates the origin of this version." + }, "updatedAt": { - "description": "When the binding was last updated.", + "description": "updated_at is when the record was last updated.", "format": "date-time", - "readOnly": true, + "type": "string" + }, + "upstreamPublishedDate": { + "description": "upstream_published_date is when the package was published upstream (optional).", + "format": "date-time", + "type": "string" + }, + "version": { + "title": "version is the semver string.\ne.g., \"18.2.0\"", + "type": "string" + }, + "versionMetadata": { + "description": "version_metadata is a JSON blob of the version object from the putument,\nused to serve rich packument responses without fetching from R2.", "type": "string" } }, "type": "object" }, - "chainguard.platform.policygates.v1.BindingList": { + "chainguard.platform.libraries.NpmPackageVersionList": { + "description": "A collection of NpmPackageVersions as returned by calls to ListVersions.\nContains pagination fields to allow callers to request additional\npages of results if the set exceeds the requested page size.", "properties": { "items": { - "description": "The requested bindings.", + "description": "The list of package versions matching the request.", "items": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Binding" + "$ref": "#/components/schemas/chainguard.platform.libraries.NpmPackageVersion" }, "type": "array" }, "nextPageToken": { - "description": "Token for retrieving the next page of results.\nEmpty if there are no more results.", + "description": "A token that can be reused on subsequent requests to retrieve\nthe next page of results.", "type": "string" }, - "skipped": { - "description": "Number of results that were skipped.\nAccumulates across paginated requests.", - "format": "int32", - "type": "integer" - }, "totalCount": { - "description": "Total number of results matching the filter.\nOptional, provided for UI pagination.", + "description": "The total number of versions available for the package.", "format": "int64", "type": "string" } }, "type": "object" }, - "chainguard.platform.policygates.v1.Bindings.UpdateBindingBody": { - "description": "Binding associates a Policy with a resource in the hierarchy.\nThe binding is a child of the resource it applies to, and its policy\nis applied to all descendants of that resource.", + "chainguard.platform.libraries.NpmSourceType": { + "default": "NPM_SOURCE_TYPE_UNKNOWN", + "description": "NpmSourceType indicates the origin of a package version.", + "enum": [ + "NPM_SOURCE_TYPE_UNKNOWN", + "NPM_SOURCE_TYPE_INTERNAL", + "NPM_SOURCE_TYPE_INTERNAL_REMEDIATED", + "NPM_SOURCE_TYPE_UPSTREAM_REGISTRY" + ], + "type": "string" + }, + "chainguard.platform.libraries.Policy": { + "default": "POLICY_UNKNOWN", + "description": "Policy controls which package sources are available for an entitlement.\n\n - POLICY_UNKNOWN: defaults to CHAINGUARD behavior\n - POLICY_CHAINGUARD: internal packages only\n - POLICY_CHAINGUARD_AND_UPSTREAM: internal + upstream (with cooldown)", + "enum": [ + "POLICY_UNKNOWN", + "POLICY_CHAINGUARD", + "POLICY_CHAINGUARD_AND_UPSTREAM" + ], + "type": "string" + }, + "chainguard.platform.libraries.Source": { + "default": "SOURCE_UNKNOWN", + "description": "Source indicates how an entitlement was created.\n\n - SOURCE_UNKNOWN: default; treat as SOURCE_TRIAL for backwards compatibility\n - SOURCE_TRIAL: self-service trial entitlement\n - SOURCE_SFDC: created or managed via Salesforce", + "enum": [ + "SOURCE_UNKNOWN", + "SOURCE_TRIAL", + "SOURCE_SFDC" + ], + "type": "string" + }, + "chainguard.platform.matcher.ImageMatch": { "properties": { - "createdAt": { - "description": "When the binding was created.", - "format": "date-time", - "readOnly": true, + "coverage": { + "format": "double", + "title": "coverage is the percentage of required packages in the image (0.0 to 1.0)", + "type": "number" + }, + "digest": { + "title": "digest is the image digest", "type": "string" }, - "mode": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.PolicyMode" - } - ], - "description": "PolicyMode defines how the policy is enforced." + "extraPackages": { + "format": "int32", + "title": "extra_packages is the count of packages in the image not required", + "type": "integer" }, - "parameters": { - "additionalProperties": {}, - "description": "The parameter values supplied for this binding, keyed by parameter name.\nThe set of valid keys and value types is declared by the referenced\npolicy's parameter_schemas. Server-side validation rejects unknown keys\nand values that violate the schema.", - "type": "object" + "extraPackagesWithScore": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.matcher.PackageWithScore" + }, + "title": "extra_packages_with_score are the extra packages with their weights", + "type": "array" }, - "policy": { - "title": "The policy to apply", + "extraScore": { + "format": "double", + "title": "extra_score is the weighted score for extra packages", + "type": "number" + }, + "imageRef": { + "title": "image_ref is the image reference (e.g., \"cgr.dev/chainguard/python:latest\")", "type": "string" }, - "resourceTypes": { + "missingPackages": { "items": { - "type": "string" + "$ref": "#/components/schemas/chainguard.platform.matcher.PackageWithScore" }, - "title": "The resource types this binding applies to.\nEach value is a Chainguard API resource type\n(e.g. \"registry.chainguard.dev/Repo\").\nSupported resource types:\n - registry.chainguard.dev/Repo", + "title": "missing_packages are the required packages not in the image", "type": "array" }, - "updatedAt": { - "description": "When the binding was last updated.", - "format": "date-time", - "readOnly": true, - "type": "string" + "missingScore": { + "format": "double", + "title": "missing_score is the weighted score for missing packages", + "type": "number" + }, + "overallScore": { + "format": "double", + "title": "overall_score is the overall weighted score", + "type": "number" + }, + "probabilityScore": { + "format": "double", + "title": "probability_score is the probability score (0-100) indicating match accuracy", + "type": "number" + }, + "satisfiedCount": { + "format": "int32", + "title": "satisfied_count is the number of required packages found", + "type": "integer" + }, + "satisfiedPackages": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.matcher.PackageWithScore" + }, + "title": "satisfied_packages are the required packages found in the image", + "type": "array" + }, + "satisfiedScore": { + "format": "double", + "title": "satisfied_score is the weighted score for satisfied packages", + "type": "number" + }, + "totalRequired": { + "format": "int32", + "title": "total_required is the total number of packages needed", + "type": "integer" } }, "type": "object" }, - "chainguard.platform.policygates.v1.ParameterSchema": { - "description": "ParameterSchema declares a single configurable parameter on a Policy.\nBindings supply values for these parameters at activation time.", + "chainguard.platform.matcher.MatchImageRequest": { "properties": { - "allowedValues": { - "items": {}, - "title": "The set of allowed values (PARAMETER_TYPE_STRING, PARAMETER_TYPE_INTEGER).\nExact-match allowlist", - "type": "array" - }, - "default": { - "description": "The default value applied when a Binding omits this parameter." - }, - "deprecated": { - "description": "Whether the parameter is deprecated. Customers should migrate off\ndeprecated parameters; new Bindings should not set them.", - "type": "boolean" - }, - "description": { - "description": "A human-readable description of what this parameter controls.", + "arch": { + "title": "arch is the architecture (\"x86_64\")", "type": "string" }, - "maximum": { - "description": "The inclusive upper bound for numeric parameters (PARAMETER_TYPE_INTEGER)." + "count": { + "format": "int32", + "title": "count is the maximum number of recommendations to return (default: 10)", + "type": "integer" }, - "minimum": { - "description": "The inclusive lower bound for numeric parameters (PARAMETER_TYPE_INTEGER)." + "distName": { + "title": "dist_name is the distribution name (\"debian\", \"ubuntu\", \"alpine\", \"redhat\", \"suse\", \"amazon-linux\")", + "type": "string" }, - "name": { - "description": "The parameter name. Must be non-empty and unique within a Policy.", + "distVersion": { + "title": "dist_version is the distribution version (e.g., \"13\", \"24.04\", \"3.22\", \"10\", \"16.0\", \"2023\")", "type": "string" }, - "required": { - "description": "Whether the parameter must be supplied by the Binding.", - "type": "boolean" + "parentId": { + "title": "parent_id is the group id of the caller making the request", + "type": "string" }, - "type": { + "sbom": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.ParameterType" + "$ref": "#/components/schemas/chainguard.platform.matcher.SBOM" } ], - "description": "The data type of the parameter value." + "title": "sbom is the SBOM components" + }, + "threshold": { + "format": "double", + "title": "threshold is the minimum probability score (0-100) to report images (default: 50.0)", + "type": "number" } }, "type": "object" }, - "chainguard.platform.policygates.v1.ParameterType": { - "default": "PARAMETER_TYPE_UNSPECIFIED", - "description": "The data type of a configurable parameter on a Policy.\n\n - PARAMETER_TYPE_STRING: A UTF-8 string value.\n - PARAMETER_TYPE_INTEGER: A signed 64-bit integer value.\n - PARAMETER_TYPE_STRING_LIST: A list of UTF-8 string values.", - "enum": [ - "PARAMETER_TYPE_UNSPECIFIED", - "PARAMETER_TYPE_STRING", - "PARAMETER_TYPE_INTEGER", - "PARAMETER_TYPE_STRING_LIST" - ], - "type": "string" - }, - "chainguard.platform.policygates.v1.Policies.UpdatePolicyBody": { - "description": "Policy defines a rule that can be evaluated on an image\nin a repository, giving an \"allowed\" or \"disallowed\" decision.", + "chainguard.platform.matcher.MatchImageResponse": { "properties": { - "createdAt": { - "description": "When the policy was created.", - "format": "date-time", - "readOnly": true, - "type": "string" - }, - "description": { - "description": "Human-readable description of the policy.", - "type": "string" - }, - "expression": { - "description": "The policy expression.", - "type": "string" - }, - "name": { - "title": "Human-readable name of the policy.\nName may be up to 128 characters in length, can consist\nof characters [a-zA-Z0-9._-], but may not start with '.' or '-'", - "type": "string" + "images": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.matcher.ImageMatch" + }, + "title": "matching chainguard images ordered by descending score", + "type": "array" }, - "parameterSchemas": { - "description": "The configurable parameter schemas declared by this policy. System\npolicies declare these; customers configure values on the bindings that\nactivate the policy.", + "requiredApks": { "items": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.ParameterSchema" + "type": "string" }, - "readOnly": true, + "title": "required_apks is the list of required APK package names", "type": "array" }, - "policyType": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.PolicyType" - } - ], - "description": "The type of policy (system or custom).\nSystem policies are created automatically by the system and may not be modified.\nCustom policies may be created and modified by users with the relevant IAM permissions.", - "readOnly": true + "totalExternalPackages": { + "format": "int32", + "title": "total_external_packages is the total number of external packages in the SBOM", + "type": "integer" }, - "supportedResourceTypes": { + "unmatchedExternalPkgs": { "items": { "type": "string" }, - "title": "The resource types this policy supports.\nEach value is a Chainguard API resource type with a version suffix\n(e.g. \"registry.chainguard.dev/Repo@v1\"). The version determines\nwhich PolicyInput schema is used when evaluating the policy expression.\nSupported resource types:\n - registry.chainguard.dev/Repo@v1", + "title": "unmatched_external_pkgs is the list of external packages that couldn't be matched", "type": "array" - }, - "updatedAt": { - "description": "When the policy was last updated.", - "format": "date-time", - "readOnly": true, - "type": "string" } }, "type": "object" }, - "chainguard.platform.policygates.v1.Policy": { - "description": "Policy defines a rule that can be evaluated on an image\nin a repository, giving an \"allowed\" or \"disallowed\" decision.", + "chainguard.platform.matcher.PackageWithScore": { "properties": { - "createdAt": { - "description": "When the policy was created.", - "format": "date-time", - "readOnly": true, - "type": "string" - }, - "description": { - "description": "Human-readable description of the policy.", - "type": "string" - }, - "expression": { - "description": "The policy expression.", - "type": "string" - }, - "id": { - "type": "string" - }, - "name": { - "title": "Human-readable name of the policy.\nName may be up to 128 characters in length, can consist\nof characters [a-zA-Z0-9._-], but may not start with '.' or '-'", - "type": "string" - }, - "parameterSchemas": { - "description": "The configurable parameter schemas declared by this policy. System\npolicies declare these; customers configure values on the bindings that\nactivate the policy.", + "externalPackageNames": { "items": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.ParameterSchema" + "type": "string" }, - "readOnly": true, "type": "array" }, - "policyType": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.PolicyType" - } - ], - "description": "The type of policy (system or custom).\nSystem policies are created automatically by the system and may not be modified.\nCustom policies may be created and modified by users with the relevant IAM permissions.", - "readOnly": true - }, - "supportedResourceTypes": { - "items": { - "type": "string" - }, - "title": "The resource types this policy supports.\nEach value is a Chainguard API resource type with a version suffix\n(e.g. \"registry.chainguard.dev/Repo@v1\"). The version determines\nwhich PolicyInput schema is used when evaluating the policy expression.\nSupported resource types:\n - registry.chainguard.dev/Repo@v1", - "type": "array" - }, - "updatedAt": { - "description": "When the policy was last updated.", - "format": "date-time", - "readOnly": true, + "name": { + "title": "PackageWithScore represents a package name with its associated weight/score", "type": "string" + }, + "score": { + "format": "double", + "type": "number" } }, "type": "object" }, - "chainguard.platform.policygates.v1.PolicyList": { + "chainguard.platform.matcher.SBOM": { "properties": { - "items": { - "description": "The Policy items requested.", + "sbomComponents": { "items": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Policy" + "$ref": "#/components/schemas/chainguard.platform.matcher.SBOMComponent" }, + "title": "individaul sbom components", "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.matcher.SBOMComponent": { + "properties": { + "bomref": { + "type": "string" }, - "nextPageToken": { - "description": "Token for retrieving the next page of results.\nEmpty if there are no more results.", + "cpe": { "type": "string" }, - "skipped": { - "description": "Number of results that were skipped.\nAccumulates across paginated requests.", - "format": "int32", - "type": "integer" + "name": { + "type": "string" }, - "totalCount": { - "description": "Total number of results matching the filter.\nOptional, provided for UI pagination.", - "format": "int64", + "purl": { + "type": "string" + }, + "type": { + "title": "single item within the package", + "type": "string" + }, + "version": { "type": "string" } }, "type": "object" }, - "chainguard.platform.policygates.v1.PolicyMode": { - "default": "POLICY_MODE_UNSPECIFIED", - "description": "The mode to use when evaluating the policy.\n\n - POLICY_MODE_ENFORCED: Disallow access to the artifact when it doesn't satisfy the applied policy.\n - POLICY_MODE_DRY_RUN: Allow access to the artifact when it doesn't satisfy the applied policy, but log the outcome.", - "enum": [ - "POLICY_MODE_UNSPECIFIED", - "POLICY_MODE_ENFORCED", - "POLICY_MODE_DRY_RUN" - ], - "type": "string" - }, - "chainguard.platform.policygates.v1.PolicyType": { - "default": "POLICY_TYPE_UNSPECIFIED", - "description": "The type of policy.\n\n - POLICY_TYPE_SYSTEM: The policy was created and managed by the system.\n - POLICY_TYPE_CUSTOM: The policy was created and managed by your organization.", - "enum": [ - "POLICY_TYPE_UNSPECIFIED", - "POLICY_TYPE_SYSTEM", - "POLICY_TYPE_CUSTOM" - ], - "type": "string" - }, - "chainguard.platform.registry.AddEntitlementImagesResponse": { + "chainguard.platform.oidc.RawToken": { "properties": { - "images": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.EntitledImage" - }, - "title": "The images that were added. Excludes requested images that were\nfound on", - "type": "array" + "expiry": { + "description": "(optional) Expiry time of the token.", + "format": "date-time", + "type": "string" }, - "parent": { - "description": "The customer org UIDP that received the images. Set by the backend\nto the resolved parent of the target entitlement, regardless of\nwhether the request selected by parent or by entitlement id. Used\nas the CloudEvents subject for downstream subscribers.", - "readOnly": true, + "refreshToken": { + "type": "string" + }, + "token": { "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.Apko.BuildImageBody": { + "chainguard.platform.oidc.TokenPair": { + "description": "ExchangeRefreshToken returns a pair of token, in order to allow\nrefresh token to also be rotated.", "properties": { - "config": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig" - } - ], - "description": "Config to build. It must be resolved before it can be built." + "refreshToken": { + "$ref": "#/components/schemas/chainguard.platform.oidc.RawToken" }, - "mediaType": { - "description": "The media type of the layer to build.", - "type": "string" + "token": { + "$ref": "#/components/schemas/chainguard.platform.oidc.RawToken" } }, "type": "object" }, - "chainguard.platform.registry.Apko.ResolveConfigBody": { + "chainguard.platform.packages.PackageEntitlement": { + "description": "PackageEntitlement maps an org to a package tier they are entitled to.", "properties": { - "config": { - "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig" + "id": { + "description": "id is the uidp of the entitlement, a child of a group.", + "type": "string" + }, + "tier": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.packages.PackageTier" + } + ], + "description": "tier is the package tier this entitlement grants access to." } }, "type": "object" }, - "chainguard.platform.registry.ApkoConfig": { + "chainguard.platform.packages.PackageEntitlementList": { "properties": { - "accounts": { - "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Accounts" - }, - "annotations": { - "additionalProperties": { - "type": "string" - }, - "type": "object" - }, - "archs": { + "items": { "items": { - "type": "string" + "$ref": "#/components/schemas/chainguard.platform.packages.PackageEntitlement" }, "type": "array" - }, - "certificates": { - "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Certificates" - }, - "cmd": { + } + }, + "type": "object" + }, + "chainguard.platform.packages.PackageTier": { + "default": "PACKAGE_TIER_UNSPECIFIED", + "description": "PackageTier represents the package tier an org can be entitled to.", + "enum": [ + "PACKAGE_TIER_UNSPECIFIED", + "PACKAGE_TIER_BASE", + "PACKAGE_TIER_FIPS" + ], + "type": "string" + }, + "chainguard.platform.ping.Response": { + "properties": { + "response": { "type": "string" - }, - "contents": { - "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Contents" - }, - "entrypoint": { - "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Entrypoint" - }, - "environment": { - "additionalProperties": { - "type": "string" - }, - "type": "object" - }, - "include": { + } + }, + "type": "object" + }, + "chainguard.platform.policies.v1.Binding": { + "description": "Binding associates a Policy with a resource in the hierarchy.\nThe binding is a child of the resource it applies to, and its policy\nis applied to all descendants of that resource.", + "properties": { + "createdAt": { + "description": "When the binding was created.", + "format": "date-time", + "readOnly": true, "type": "string" }, - "layering": { - "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Layering" + "id": { + "description": "The id of the Binding. The policy is bound to its parent,\nand applies to all of the parent's descendants.", + "type": "string" }, - "paths": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.PathMutation" - }, - "type": "array" + "mode": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.policies.v1.PolicyMode" + } + ], + "description": "PolicyMode defines how the policy is enforced." }, - "stopSignal": { - "type": "string" + "parameters": { + "additionalProperties": {}, + "description": "The parameter values supplied for this binding, keyed by parameter name.\nThe set of valid keys and value types is declared by the referenced\npolicy's parameter_schemas. Server-side validation rejects unknown keys\nand values that violate the schema.", + "type": "object" }, - "vcsUrl": { + "policy": { + "title": "The policy to apply", "type": "string" }, - "volumes": { - "description": "These are unused, and only provided for compatibility with\nImageConfiguration.", + "resourceTypes": { "items": { "type": "string" }, + "title": "The resource types this binding applies to.\nEach value is a Chainguard API resource type\n(e.g. \"registry.chainguard.dev/Repo\").\nSupported resource types:\n - registry.chainguard.dev/Repo", "type": "array" }, - "workDir": { + "updatedAt": { + "description": "When the binding was last updated.", + "format": "date-time", + "readOnly": true, "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.ApkoConfig.Accounts": { + "chainguard.platform.policies.v1.BindingList": { "properties": { - "groups": { + "items": { + "description": "The requested bindings.", "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Accounts.Group" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Binding" }, "type": "array" }, - "runAs": { + "nextPageToken": { + "description": "Token for retrieving the next page of results.\nEmpty if there are no more results.", "type": "string" }, - "users": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Accounts.User" - }, - "type": "array" + "skipped": { + "description": "Number of results that were skipped.\nAccumulates across paginated requests.", + "format": "int32", + "type": "integer" + }, + "totalCount": { + "description": "Total number of results matching the filter.\nOptional, provided for UI pagination.", + "format": "int64", + "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.ApkoConfig.Accounts.Group": { + "chainguard.platform.policies.v1.Bindings.UpdateBindingBody": { + "description": "Binding associates a Policy with a resource in the hierarchy.\nThe binding is a child of the resource it applies to, and its policy\nis applied to all descendants of that resource.", "properties": { - "gid": { - "format": "int64", - "type": "integer" + "createdAt": { + "description": "When the binding was created.", + "format": "date-time", + "readOnly": true, + "type": "string" }, - "groupName": { + "mode": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.policies.v1.PolicyMode" + } + ], + "description": "PolicyMode defines how the policy is enforced." + }, + "parameters": { + "additionalProperties": {}, + "description": "The parameter values supplied for this binding, keyed by parameter name.\nThe set of valid keys and value types is declared by the referenced\npolicy's parameter_schemas. Server-side validation rejects unknown keys\nand values that violate the schema.", + "type": "object" + }, + "policy": { + "title": "The policy to apply", "type": "string" }, - "members": { + "resourceTypes": { "items": { "type": "string" }, + "title": "The resource types this binding applies to.\nEach value is a Chainguard API resource type\n(e.g. \"registry.chainguard.dev/Repo\").\nSupported resource types:\n - registry.chainguard.dev/Repo", "type": "array" + }, + "updatedAt": { + "description": "When the binding was last updated.", + "format": "date-time", + "readOnly": true, + "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.ApkoConfig.Accounts.User": { + "chainguard.platform.policies.v1.ParameterSchema": { + "description": "ParameterSchema declares a single configurable parameter on a Policy.\nBindings supply values for these parameters at activation time.", "properties": { - "gid": { - "format": "int64", - "type": "integer" + "allowedValues": { + "items": {}, + "title": "The set of allowed values (PARAMETER_TYPE_STRING, PARAMETER_TYPE_INTEGER).\nExact-match allowlist", + "type": "array" }, - "groupName": { - "type": "string" + "default": { + "description": "The default value applied when a Binding omits this parameter." }, - "homeDir": { - "type": "string" + "deprecated": { + "description": "Whether the parameter is deprecated. Customers should migrate off\ndeprecated parameters; new Bindings should not set them.", + "type": "boolean" }, - "shell": { + "description": { + "description": "A human-readable description of what this parameter controls.", "type": "string" }, - "uid": { - "format": "int64", - "type": "integer" + "maximum": { + "description": "The inclusive upper bound for numeric parameters (PARAMETER_TYPE_INTEGER)." }, - "userName": { + "minimum": { + "description": "The inclusive lower bound for numeric parameters (PARAMETER_TYPE_INTEGER)." + }, + "name": { + "description": "The parameter name. Must be non-empty and unique within a Policy.", "type": "string" - } - }, - "type": "object" - }, - "chainguard.platform.registry.ApkoConfig.Certificates": { - "properties": { - "additional": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Certificates.AdditionalEntry" - }, - "type": "array" }, - "providers": { - "items": { - "type": "string" - }, - "type": "array" + "required": { + "description": "Whether the parameter must be supplied by the Binding.", + "type": "boolean" + }, + "type": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.policies.v1.ParameterType" + } + ], + "description": "The data type of the parameter value." } }, "type": "object" }, - "chainguard.platform.registry.ApkoConfig.Certificates.AdditionalEntry": { + "chainguard.platform.policies.v1.ParameterType": { + "default": "PARAMETER_TYPE_UNSPECIFIED", + "description": "The data type of a configurable parameter on a Policy.\n\n - PARAMETER_TYPE_STRING: A UTF-8 string value.\n - PARAMETER_TYPE_INTEGER: A signed 64-bit integer value.\n - PARAMETER_TYPE_STRING_LIST: A list of UTF-8 string values.\n - PARAMETER_TYPE_BOOLEAN: A boolean value.", + "enum": [ + "PARAMETER_TYPE_UNSPECIFIED", + "PARAMETER_TYPE_STRING", + "PARAMETER_TYPE_INTEGER", + "PARAMETER_TYPE_STRING_LIST", + "PARAMETER_TYPE_BOOLEAN" + ], + "type": "string" + }, + "chainguard.platform.policies.v1.Policies.UpdatePolicyBody": { + "description": "Policy defines a rule that can be evaluated on an image\nin a repository, giving an \"allowed\" or \"disallowed\" decision.", "properties": { - "content": { + "createdAt": { + "description": "When the policy was created.", + "format": "date-time", + "readOnly": true, + "type": "string" + }, + "description": { + "description": "Human-readable description of the policy.", + "type": "string" + }, + "expression": { + "description": "The policy expression.", "type": "string" }, "name": { + "title": "Human-readable name of the policy.\nName may be up to 128 characters in length, can consist\nof characters [a-zA-Z0-9._-], but may not start with '.' or '-'", "type": "string" - } - }, - "type": "object" - }, - "chainguard.platform.registry.ApkoConfig.Contents": { - "properties": { - "buildRepositories": { - "items": { - "type": "string" - }, - "type": "array" }, - "keyring": { + "parameterSchemas": { + "description": "The configurable parameter schemas declared by this policy. System\npolicies declare these; customers configure values on the bindings that\nactivate the policy.", "items": { - "type": "string" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.ParameterSchema" }, + "readOnly": true, "type": "array" }, - "packages": { - "items": { - "type": "string" - }, - "type": "array" + "policyType": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.policies.v1.PolicyType" + } + ], + "description": "The type of policy (system or custom).\nSystem policies are created automatically by the system and may not be modified.\nCustom policies may be created and modified by users with the relevant IAM permissions.", + "readOnly": true }, - "repositories": { + "supportedResourceTypes": { "items": { "type": "string" }, + "title": "The resource types this policy supports.\nEach value is a Chainguard API resource type with a version suffix\n(e.g. \"registry.chainguard.dev/Repo@v1\"). The version determines\nwhich PolicyInput schema is used when evaluating the policy expression.\nSupported resource types:\n - registry.chainguard.dev/Repo@v1", "type": "array" }, - "runtimeRepositories": { - "items": { - "type": "string" - }, - "type": "array" + "updatedAt": { + "description": "When the policy was last updated.", + "format": "date-time", + "readOnly": true, + "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.ApkoConfig.Entrypoint": { + "chainguard.platform.policies.v1.Policy": { + "description": "Policy defines a rule that can be evaluated on an image\nin a repository, giving an \"allowed\" or \"disallowed\" decision.", "properties": { - "command": { + "createdAt": { + "description": "When the policy was created.", + "format": "date-time", + "readOnly": true, "type": "string" }, - "services": { - "additionalProperties": { - "type": "string" - }, - "type": "object" - }, - "shellFragment": { + "description": { + "description": "Human-readable description of the policy.", "type": "string" }, - "type": { - "type": "string" - } - }, - "type": "object" - }, - "chainguard.platform.registry.ApkoConfig.Layering": { - "properties": { - "budget": { - "format": "int64", + "expression": { + "description": "The policy expression.", "type": "string" }, - "strategy": { + "id": { "type": "string" - } - }, - "type": "object" - }, - "chainguard.platform.registry.ApkoConfig.PathMutation": { - "properties": { - "gid": { - "format": "int64", - "type": "integer" }, - "path": { + "name": { + "title": "Human-readable name of the policy.\nName may be up to 128 characters in length, can consist\nof characters [a-zA-Z0-9._-], but may not start with '.' or '-'", "type": "string" }, - "permissions": { - "format": "int64", - "type": "integer" + "parameterSchemas": { + "description": "The configurable parameter schemas declared by this policy. System\npolicies declare these; customers configure values on the bindings that\nactivate the policy.", + "items": { + "$ref": "#/components/schemas/chainguard.platform.policies.v1.ParameterSchema" + }, + "readOnly": true, + "type": "array" }, - "recursive": { - "type": "boolean" + "policyType": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.policies.v1.PolicyType" + } + ], + "description": "The type of policy (system or custom).\nSystem policies are created automatically by the system and may not be modified.\nCustom policies may be created and modified by users with the relevant IAM permissions.", + "readOnly": true }, - "source": { - "type": "string" + "supportedResourceTypes": { + "items": { + "type": "string" + }, + "title": "The resource types this policy supports.\nEach value is a Chainguard API resource type with a version suffix\n(e.g. \"registry.chainguard.dev/Repo@v1\"). The version determines\nwhich PolicyInput schema is used when evaluating the policy expression.\nSupported resource types:\n - registry.chainguard.dev/Repo@v1", + "type": "array" }, - "type": { + "updatedAt": { + "description": "When the policy was last updated.", + "format": "date-time", + "readOnly": true, "type": "string" - }, - "uid": { - "format": "int64", - "type": "integer" } }, "type": "object" }, - "chainguard.platform.registry.Archs": { + "chainguard.platform.policies.v1.PolicyList": { "properties": { - "archs": { - "description": "Architectures belonging to the requested digest's manifests.", + "items": { + "description": "The Policy items requested.", "items": { - "type": "string" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Policy" }, "type": "array" - } - }, - "type": "object" - }, - "chainguard.platform.registry.BuildImageResponse": { - "properties": { - "buildDateEpoch": { - "description": "The \"build date epoch\" of the produced image.", - "format": "date-time", - "type": "string" }, - "buildReportId": { - "description": "The ID of the Build Report.", + "nextPageToken": { + "description": "Token for retrieving the next page of results.\nEmpty if there are no more results.", "type": "string" }, - "digest": { - "description": "Digest of the built image.", - "type": "string" + "skipped": { + "description": "Number of results that were skipped.\nAccumulates across paginated requests.", + "format": "int32", + "type": "integer" }, - "userError": { - "description": "The user error message, if any.\nThis is to distinguish between an error in the build process\nand an error in the user's configuration (like accessing a\nnon-existent package).", + "totalCount": { + "description": "Total number of results matching the filter.\nOptional, provided for UI pagination.", + "format": "int64", "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.BuildReport": { - "description": "BuildReport is a record of a build, including the configuration used, the result, and the log.\n\nThese are created by the build system, the clients should not create/update these themselves,\nbut can read them to see the build information as well as build results.", - "properties": { - "apkoVersion": { - "description": "The version of the APKO used to build the image.", - "type": "string" - }, - "completedAt": { - "description": "The end time of the build. Must be after the started_at time.", - "format": "date-time", - "type": "string" - }, - "config": { - "description": "The configuration used to build the image, in APKO build config JSON.", - "type": "string" - }, - "digest": { - "description": "The digest of the image built, in case of success.", - "type": "string" - }, - "id": { - "description": "id, identifier of this BuildReport, a UIDP under a Repo.", - "type": "string" - }, - "lockedConfig": { - "description": "The version-locked configuration used to build the image, in APKO build config JSON.", - "type": "string" - }, - "log": { - "description": "The build log. For the moment, this is the build log's content.\nThis could later change to an URI if the build log gets large enough.", - "type": "string" - }, - "mediaType": { - "description": "The media type of the layer being built.", - "type": "string" - }, - "result": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.BuildReport.Result" - } - ], - "description": "The result of the build." - }, - "startedAt": { - "description": "The start time of the build. It is set by the server automatically,\nanything written by the client will be ignored.", - "format": "date-time", - "type": "string" - }, - "warnings": { - "description": "The warnings generated during the build.", - "items": { - "type": "string" - }, - "type": "array" - } - }, - "type": "object" + "chainguard.platform.policies.v1.PolicyMode": { + "default": "POLICY_MODE_UNSPECIFIED", + "description": "The mode to use when evaluating the policy.\n\n - POLICY_MODE_ENFORCED: Disallow access to the artifact when it doesn't satisfy the applied policy.\n - POLICY_MODE_DRY_RUN: Allow access to the artifact when it doesn't satisfy the applied policy, but log the outcome.", + "enum": [ + "POLICY_MODE_UNSPECIFIED", + "POLICY_MODE_ENFORCED", + "POLICY_MODE_DRY_RUN" + ], + "type": "string" }, - "chainguard.platform.registry.BuildReport.Result": { - "default": "Unknown", + "chainguard.platform.policies.v1.PolicyType": { + "default": "POLICY_TYPE_UNSPECIFIED", + "description": "The type of policy.\n\n - POLICY_TYPE_SYSTEM: The policy was created and managed by the system.\n - POLICY_TYPE_CUSTOM: The policy was created and managed by your organization.", "enum": [ - "Unknown", - "Success", - "Failure" + "POLICY_TYPE_UNSPECIFIED", + "POLICY_TYPE_SYSTEM", + "POLICY_TYPE_CUSTOM" ], "type": "string" }, - "chainguard.platform.registry.BuildReportList": { - "description": "BuildReportList is a list of BuildReports.", + "chainguard.platform.registry.AddEntitlementImagesResponse": { "properties": { - "reports": { + "images": { "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.BuildReport" + "$ref": "#/components/schemas/chainguard.platform.registry.EntitledImage" }, + "title": "The images that were added. Excludes requested images that were\nfound on", "type": "array" + }, + "parent": { + "description": "The customer org UIDP that received the images. Set by the backend\nto the resolved parent of the target entitlement, regardless of\nwhether the request selected by parent or by entitlement id. Used\nas the CloudEvents subject for downstream subscribers.", + "readOnly": true, + "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.BuildStatus": { - "description": "BuildStatus is an overview of build results for a given org.", + "chainguard.platform.registry.Apko.BuildImageBody": { "properties": { - "failures": { - "description": "The list of all repos with failures.", - "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.BuildStatus.Failures" - }, - "type": "array" + "config": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig" + } + ], + "description": "Config to build. It must be resolved before it can be built." + }, + "mediaType": { + "description": "The media type of the layer to build.", + "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.BuildStatus.Failures": { + "chainguard.platform.registry.Apko.ResolveConfigBody": { "properties": { - "repoId": { - "description": "The ID of a repo.", - "type": "string" - }, - "total": { - "description": "The total number of failures for this repo.", - "format": "int32", - "type": "integer" + "config": { + "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig" } }, "type": "object" }, - "chainguard.platform.registry.CatalogTier": { - "default": "UNKNOWN", - "enum": [ - "UNKNOWN", - "APPLICATION", - "BASE", - "FIPS", - "AI", - "DEVTOOLS", - "COMMERCIAL" - ], - "type": "string" - }, - "chainguard.platform.registry.Chart": { - "description": "Chart contains metadata parsed from a Helm chart's Chart.yaml.", + "chainguard.platform.registry.ApkoConfig": { "properties": { + "accounts": { + "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Accounts" + }, "annotations": { "additionalProperties": { "type": "string" }, - "description": "Annotations from Chart.yaml.", "type": "object" }, - "appVersion": { - "description": "The version of the app contained in the chart.", - "type": "string" - }, - "dependencies": { - "description": "The chart's dependencies.", + "archs": { "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.ChartDependency" + "type": "string" }, "type": "array" }, - "description": { - "description": "A description of the chart.", + "certificates": { + "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Certificates" + }, + "cmd": { "type": "string" }, - "images": { - "description": "Images used by the chart, parsed from annotations[\"images\"].", + "contents": { + "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Contents" + }, + "entrypoint": { + "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Entrypoint" + }, + "environment": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "include": { + "type": "string" + }, + "layering": { + "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Layering" + }, + "paths": { "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.ChartImage" + "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.PathMutation" }, "type": "array" }, - "name": { - "description": "The name of the chart.", + "stopSignal": { "type": "string" }, - "raw": { - "description": "Raw Chart.yaml content.", + "vcsUrl": { "type": "string" }, - "values": { - "description": "Raw values.yaml content (default values).", - "type": "string" + "volumes": { + "description": "These are unused, and only provided for compatibility with\nImageConfiguration.", + "items": { + "type": "string" + }, + "type": "array" }, - "version": { - "description": "The version of the chart.", + "workDir": { "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.ChartDependency": { - "description": "ChartDependency represents a dependency of a Helm chart.", + "chainguard.platform.registry.ApkoConfig.Accounts": { "properties": { - "name": { - "description": "The name of the dependency chart.", - "type": "string" + "groups": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Accounts.Group" + }, + "type": "array" }, - "repository": { - "description": "The repository URL of the dependency chart.", + "runAs": { "type": "string" }, - "version": { - "description": "The version of the dependency chart.", - "type": "string" + "users": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Accounts.User" + }, + "type": "array" } }, "type": "object" }, - "chainguard.platform.registry.ChartImage": { - "description": "ChartImage represents an image used by a Helm chart.\nThis is loosely based off of\nhttps://github.com/helm/community/blob/main/hips/hip-0015.md, but changed\nto be a simpler schema adopted by more of the community.", + "chainguard.platform.registry.ApkoConfig.Accounts.Group": { "properties": { - "image": { - "description": "The image reference.", - "type": "string" + "gid": { + "format": "int64", + "type": "integer" }, - "name": { - "description": "The name/alias of the image.", + "groupName": { "type": "string" - } - }, - "type": "object" - }, - "chainguard.platform.registry.CheckPoliciesResponse": { - "properties": { - "results": { - "description": "One result per applicable policy.", + }, + "members": { "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.PolicyResult" + "type": "string" }, "type": "array" } }, "type": "object" }, - "chainguard.platform.registry.CustomOverlay": { + "chainguard.platform.registry.ApkoConfig.Accounts.User": { "properties": { - "accounts": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Accounts" - } - ], - "description": "Additional account customizations applied during rebuilds." + "gid": { + "format": "int64", + "type": "integer" }, - "annotations": { - "additionalProperties": { - "type": "string" - }, - "type": "object" + "groupName": { + "type": "string" }, - "certificates": { - "$ref": "#/components/schemas/chainguard.platform.registry.CustomOverlay.Certificates" + "homeDir": { + "type": "string" }, - "contents": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.ImageContents" - } - ], - "description": "Mirrors apko configuration for image contents." + "shell": { + "type": "string" }, - "environment": { - "additionalProperties": { - "type": "string" - }, - "type": "object" + "uid": { + "format": "int64", + "type": "integer" + }, + "userName": { + "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.CustomOverlay.Certificates": { + "chainguard.platform.registry.ApkoConfig.Certificates": { "properties": { "additional": { "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.CustomOverlay.Certificates.AdditionalEntry" + "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Certificates.AdditionalEntry" }, "type": "array" }, @@ -3541,7 +3871,7 @@ }, "type": "object" }, - "chainguard.platform.registry.CustomOverlay.Certificates.AdditionalEntry": { + "chainguard.platform.registry.ApkoConfig.Certificates.AdditionalEntry": { "properties": { "content": { "type": "string" @@ -3552,431 +3882,396 @@ }, "type": "object" }, - "chainguard.platform.registry.Deployment": { + "chainguard.platform.registry.ApkoConfig.Contents": { "properties": { - "charts": { - "description": "Helm chart configurations for this deployment.", + "buildRepositories": { "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.HelmChart" + "type": "string" }, "type": "array" }, - "id": { - "description": "id is the identifier of this deployment, same as parent Repo UIDP.", - "type": "string" - } - }, - "title": "Deployment configuration for a repository", - "type": "object" - }, - "chainguard.platform.registry.EntitledImage": { - "description": "EntitledImage is an image that an organization is currently entitled to access.", - "properties": { - "catalogTier": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.CatalogTier" - } - ], - "description": "The catalog tier of the image." - }, - "expirationTime": { - "description": "When access to this image expires. Unset means no expiration.", - "format": "date-time", - "type": "string" + "keyring": { + "items": { + "type": "string" + }, + "type": "array" }, - "id": { - "description": "The catalog image repository UIDP.", - "type": "string" + "packages": { + "items": { + "type": "string" + }, + "type": "array" }, - "name": { - "description": "Human-readable image name.", - "readOnly": true, - "type": "string" + "repositories": { + "items": { + "type": "string" + }, + "type": "array" }, - "type": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.Entitlement.Type" - } - ], - "description": "The entitlement type that granted access to this image." + "runtimeRepositories": { + "items": { + "type": "string" + }, + "type": "array" } }, "type": "object" }, - "chainguard.platform.registry.Entitlement": { - "description": "Entitlement contains information about what an organization is entitled to.", + "chainguard.platform.registry.ApkoConfig.Entrypoint": { "properties": { - "createTime": { - "format": "date-time", - "type": "string" - }, - "expirationTime": { - "format": "date-time", - "type": "string" - }, - "externalId": { - "type": "string" - }, - "id": { + "command": { "type": "string" }, - "quota": { + "services": { "additionalProperties": { - "$ref": "#/components/schemas/chainguard.platform.registry.ImageQuota" + "type": "string" }, - "description": "Keys can't be enum types, but string should match CatalogTier.", "type": "object" }, - "tiers": { - "description": "List of catalog tiers (e.g., [\"APPLICATION\", \"BASE\"]) that have unlimited access.\nThis field is used for AYCE (All You Can Eat) entitlements.", - "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.CatalogTier" - }, - "type": "array" + "shellFragment": { + "type": "string" }, "type": { - "$ref": "#/components/schemas/chainguard.platform.registry.Entitlement.Type" - }, - "updateTime": { - "format": "date-time", "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.Entitlement.Type": { - "default": "UNKNOWN", - "enum": [ - "UNKNOWN", - "TRIAL", - "PRODUCTION", - "EXTRA", - "STARTER" - ], - "type": "string" - }, - "chainguard.platform.registry.EntitlementImage": { + "chainguard.platform.registry.ApkoConfig.Layering": { "properties": { - "id": { - "description": "The image repository UID.", + "budget": { + "format": "int64", "type": "string" }, - "name": { - "description": "Human-readable image name corresponding to id.", - "readOnly": true, + "strategy": { "type": "string" - }, - "tier": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.CatalogTier" - } - ], - "description": "The image repository catalog tier the image is associated with." } }, "type": "object" }, - "chainguard.platform.registry.EntitlementImagesList": { + "chainguard.platform.registry.ApkoConfig.PathMutation": { "properties": { - "images": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.EntitlementImage" - }, - "type": "array" + "gid": { + "format": "int64", + "type": "integer" + }, + "path": { + "type": "string" + }, + "permissions": { + "format": "int64", + "type": "integer" + }, + "recursive": { + "type": "boolean" + }, + "source": { + "type": "string" + }, + "type": { + "type": "string" + }, + "uid": { + "format": "int64", + "type": "integer" } }, "type": "object" }, - "chainguard.platform.registry.EntitlementList": { + "chainguard.platform.registry.Archs": { "properties": { - "items": { + "archs": { + "description": "Architectures belonging to the requested digest's manifests.", "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.Entitlement" + "type": "string" }, "type": "array" } }, "type": "object" }, - "chainguard.platform.registry.EntitlementSummaryResponse": { + "chainguard.platform.registry.BuildImageResponse": { "properties": { - "lastUpdatedTime": { + "buildDateEpoch": { + "description": "The \"build date epoch\" of the produced image.", "format": "date-time", - "title": "last updated time", "type": "string" }, - "quota": { - "additionalProperties": { - "$ref": "#/components/schemas/chainguard.platform.registry.ImageQuota" - }, - "description": "Keys can't be enum types, but string should match CatalogTier.", - "type": "object" - } - }, - "type": "object" - }, - "chainguard.platform.registry.Entitlements.AddEntitlementImagesBody": { - "properties": { - "id": { - "description": "The exact id of the entitlement to add images to.", + "buildReportId": { + "description": "The ID of the Build Report.", "type": "string" }, - "imageNames": { - "description": "Catalog image names to add (e.g., \"nginx\", \"redis\").\nResolved against the catalog by exact name match.", - "items": { - "type": "string" - }, - "type": "array" + "digest": { + "description": "Digest of the built image.", + "type": "string" + }, + "userError": { + "description": "The user error message, if any.\nThis is to distinguish between an error in the build process\nand an error in the user's configuration (like accessing a\nnon-existent package).", + "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.EolGracePeriodStatus": { - "default": "GRACE_NOT_ELIGIBLE", - "enum": [ - "GRACE_NOT_ELIGIBLE", - "GRACE_ELIGIBLE", - "GRACE_ACTIVE", - "GRACE_BROKEN", - "GRACE_EXPIRED" - ], - "type": "string" - }, - "chainguard.platform.registry.EolTag": { + "chainguard.platform.registry.BuildReport": { + "description": "BuildReport is a record of a build, including the configuration used, the result, and the log.\n\nThese are created by the build system, the clients should not create/update these themselves,\nbut can read them to see the build information as well as build results.", "properties": { - "gracePeriodExpiryDate": { + "apkoVersion": { + "description": "The version of the APKO used to build the image.", + "type": "string" + }, + "completedAt": { + "description": "The end time of the build. Must be after the started_at time.", "format": "date-time", - "title": "the date the grace period expires", "type": "string" }, - "graceStatus": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.EolGracePeriodStatus" - } - ], - "title": "eol grace period status" + "config": { + "description": "The configuration used to build the image, in APKO build config JSON.", + "type": "string" + }, + "digest": { + "description": "The digest of the image built, in case of success.", + "type": "string" }, "id": { - "description": "id, identifier of this Tag, a UIDP under a Repo.", + "description": "id, identifier of this BuildReport, a UIDP under a Repo.", "type": "string" }, - "mainPackageName": { - "title": "name of the main package", + "lockedConfig": { + "description": "The version-locked configuration used to build the image, in APKO build config JSON.", "type": "string" }, - "mainPackageVersion": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.PackageVersion" - } - ], - "title": "version of the main package" + "log": { + "description": "The build log. For the moment, this is the build log's content.\nThis could later change to an URI if the build log gets large enough.", + "type": "string" }, - "name": { - "description": "name, the unique name of the Tag.", + "mediaType": { + "description": "The media type of the layer being built.", "type": "string" }, - "tagStatus": { + "result": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.registry.EolTagStatus" + "$ref": "#/components/schemas/chainguard.platform.registry.BuildReport.Result" } ], - "title": "status of the tag" - } - }, - "type": "object" - }, - "chainguard.platform.registry.EolTagList": { - "properties": { - "items": { + "description": "The result of the build." + }, + "startedAt": { + "description": "The start time of the build. It is set by the server automatically,\nanything written by the client will be ignored.", + "format": "date-time", + "type": "string" + }, + "warnings": { + "description": "The warnings generated during the build.", "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.EolTag" + "type": "string" }, "type": "array" - }, - "nextPageToken": { - "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.EolTagStatus": { - "default": "TAG_ACTIVE", + "chainguard.platform.registry.BuildReport.Result": { + "default": "Unknown", "enum": [ - "TAG_ACTIVE", - "TAG_IN_GRACE", - "TAG_INACTIVE" + "Unknown", + "Success", + "Failure" ], "type": "string" }, - "chainguard.platform.registry.GetEffectiveEntitlementsResponse": { + "chainguard.platform.registry.BuildReportList": { + "description": "BuildReportList is a list of BuildReports.", "properties": { - "activeImages": { - "description": "Images the organization is currently entitled to, deduplicated\nacross entitlements with the latest expiration retained.", + "reports": { "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.EntitledImage" + "$ref": "#/components/schemas/chainguard.platform.registry.BuildReport" }, "type": "array" - }, - "activeTiers": { - "description": "Catalog tiers with unlimited (AYCE) access.", + } + }, + "type": "object" + }, + "chainguard.platform.registry.BuildStatus": { + "description": "BuildStatus is an overview of build results for a given org.", + "properties": { + "failures": { + "description": "The list of all repos with failures.", "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.CatalogTier" + "$ref": "#/components/schemas/chainguard.platform.registry.BuildStatus.Failures" }, "type": "array" - }, - "maxTotalImages": { - "description": "Maximum number of images that can be entitled to this organization.\nA value of -1 means this organization has no maximum quota enforced.", - "format": "int32", - "type": "integer" - }, - "plan": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.Plan" - } - ], - "description": "The resolved entitlement plan for the organization." - }, - "quota": { - "additionalProperties": { - "$ref": "#/components/schemas/chainguard.platform.registry.ImageQuota" - }, - "description": "Aggregated quota usage per tier. Keys are CatalogTier string names.", - "type": "object" } }, "type": "object" }, - "chainguard.platform.registry.GetFeaturesResponse": { + "chainguard.platform.registry.BuildStatus.Failures": { "properties": { - "customAssembly": { - "type": "boolean" + "repoId": { + "description": "The ID of a repo.", + "type": "string" }, - "uniqueTags": { - "type": "boolean" + "total": { + "description": "The total number of failures for this repo.", + "format": "int32", + "type": "integer" } }, "type": "object" }, - "chainguard.platform.registry.Helm": { - "description": "Helm contains the chart and values fields from the helm-values predicate.", + "chainguard.platform.registry.CatalogTier": { + "default": "UNKNOWN", + "enum": [ + "UNKNOWN", + "APPLICATION", + "BASE", + "FIPS", + "AI", + "DEVTOOLS", + "COMMERCIAL" + ], + "type": "string" + }, + "chainguard.platform.registry.Chart": { + "description": "Chart contains metadata parsed from a Helm chart's Chart.yaml.", "properties": { - "chartDigest": { - "description": "Chart digest.", + "annotations": { + "additionalProperties": { + "type": "string" + }, + "description": "Annotations from Chart.yaml.", + "type": "object" + }, + "appVersion": { + "description": "The version of the app contained in the chart.", "type": "string" }, - "chartName": { - "description": "Chart name.", + "dependencies": { + "description": "The chart's dependencies.", + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.ChartDependency" + }, + "type": "array" + }, + "description": { + "description": "A description of the chart.", "type": "string" }, - "chartRepository": { - "description": "Chart repository.", + "images": { + "description": "Images used by the chart, parsed from annotations[\"images\"].", + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.ChartImage" + }, + "type": "array" + }, + "name": { + "description": "The name of the chart.", "type": "string" }, - "chartVersion": { - "description": "Chart version.", + "raw": { + "description": "Raw Chart.yaml content.", "type": "string" }, "values": { - "description": "Additional values.", + "description": "Raw values.yaml content (default values).", + "type": "string" + }, + "version": { + "description": "The version of the chart.", "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.HelmChart": { + "chainguard.platform.registry.ChartDependency": { + "description": "ChartDependency represents a dependency of a Helm chart.", "properties": { - "chart": { - "description": "chart is the specific chart that is used from a repo.", + "name": { + "description": "The name of the dependency chart.", "type": "string" }, - "repo": { - "description": "repo is the Helm chart repository URL.", + "repository": { + "description": "The repository URL of the dependency chart.", "type": "string" }, - "source": { - "description": "source is an optional link to the source code (e.g., GitHub repository URL).", + "version": { + "description": "The version of the dependency chart.", "type": "string" } }, - "title": "Helm chart configuration", "type": "object" }, - "chainguard.platform.registry.ImageConfig": { + "chainguard.platform.registry.ChartImage": { + "description": "ChartImage represents an image used by a Helm chart.\nThis is loosely based off of\nhttps://github.com/helm/community/blob/main/hips/hip-0015.md, but changed\nto be a simpler schema adopted by more of the community.", "properties": { - "cmd": { - "description": "Cmd defines the default arguments to the entrypoint of the container.", - "items": { - "type": "string" - }, - "type": "array" - }, - "entrypoint": { - "description": "Entrypoint defines a list of arguments to use as the command to execute when the container starts.", - "items": { - "type": "string" - }, - "type": "array" + "image": { + "description": "The image reference.", + "type": "string" }, - "env": { - "description": "Env is a list of environment variables to be used in a container.", + "name": { + "description": "The name/alias of the image.", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.registry.CheckPoliciesResponse": { + "properties": { + "results": { + "description": "One result per applicable policy.", "items": { - "type": "string" + "$ref": "#/components/schemas/chainguard.platform.registry.PolicyResult" }, "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.registry.CustomOverlay": { + "properties": { + "accounts": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig.Accounts" + } + ], + "description": "Additional account customizations applied during rebuilds." }, - "exposedPorts": { + "annotations": { "additionalProperties": { - "$ref": "#/components/schemas/chainguard.platform.registry.ImageConfig.ExposedPort" + "type": "string" }, "type": "object" }, - "labels": { - "additionalProperties": { - "type": "string" - }, - "description": "Labels contains arbitrary metadata for the container.", - "type": "object" - }, - "stopSignal": { - "description": "StopSignal contains the system call signal that will be sent to the container to exit.", - "type": "string" + "certificates": { + "$ref": "#/components/schemas/chainguard.platform.registry.CustomOverlay.Certificates" }, - "user": { - "description": "User defines the username or UID which the process in the container should run as.", - "type": "string" + "contents": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.ImageContents" + } + ], + "description": "Mirrors apko configuration for image contents." }, - "volumes": { + "environment": { "additionalProperties": { - "$ref": "#/components/schemas/chainguard.platform.registry.ImageConfig.Volume" + "type": "string" }, - "description": "Volumes is a set of directories describing where the process is likely write data specific to a container instance.", "type": "object" - }, - "workingDir": { - "description": "WorkingDir sets the current working directory of the entrypoint process in the container.", - "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.ImageConfig.ExposedPort": { - "description": "ExposedPorts a set of ports to expose from a container running this image.", - "type": "object" - }, - "chainguard.platform.registry.ImageConfig.Volume": { - "type": "object" - }, - "chainguard.platform.registry.ImageContents": { + "chainguard.platform.registry.CustomOverlay.Certificates": { "properties": { - "packages": { - "description": "Packages to append to the image config.", + "additional": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.CustomOverlay.Certificates.AdditionalEntry" + }, + "type": "array" + }, + "providers": { "items": { "type": "string" }, @@ -3985,1654 +4280,1874 @@ }, "type": "object" }, - "chainguard.platform.registry.ImageQuota": { + "chainguard.platform.registry.CustomOverlay.Certificates.AdditionalEntry": { "properties": { - "current": { - "format": "int32", - "type": "integer" + "content": { + "type": "string" }, - "max": { - "format": "int32", - "type": "integer" - } - }, - "type": "object" - }, - "chainguard.platform.registry.ManifestDigestCount": { - "properties": { - "count": { - "format": "int64", + "name": { "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.ManifestMetadata": { + "chainguard.platform.registry.Deployment": { "properties": { - "digest": { - "description": "Digest of image that packages are associated with.", - "type": "string" - }, - "pkgMetadata": { - "description": "List of packages that are part of image.", + "charts": { + "description": "Helm chart configurations for this deployment.", "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.PkgMetadata" + "$ref": "#/components/schemas/chainguard.platform.registry.HelmChart" }, "type": "array" + }, + "id": { + "description": "id is the identifier of this deployment, same as parent Repo UIDP.", + "type": "string" } }, + "title": "Deployment configuration for a repository", "type": "object" }, - "chainguard.platform.registry.ManifestMetadataList": { + "chainguard.platform.registry.EntitledImage": { + "description": "EntitledImage is an image that an organization is currently entitled to access.", "properties": { - "items": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.ManifestMetadata" - }, - "type": "array" + "catalogTier": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.CatalogTier" + } + ], + "description": "The catalog tier of the image." + }, + "expirationTime": { + "description": "When access to this image expires. Unset means no expiration.", + "format": "date-time", + "type": "string" + }, + "id": { + "description": "The catalog image repository UIDP.", + "type": "string" + }, + "name": { + "description": "Human-readable image name.", + "readOnly": true, + "type": "string" + }, + "type": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.Entitlement.Type" + } + ], + "description": "The entitlement type that granted access to this image." } }, "type": "object" }, - "chainguard.platform.registry.PackageVersion": { + "chainguard.platform.registry.Entitlement": { + "description": "Entitlement contains information about what an organization is entitled to.", "properties": { - "eolBroken": { - "title": "whether or not an EOL version cannot longer be supported due to incompatibilities or no longer available dependencies", - "type": "boolean" - }, - "eolDate": { - "title": "the date when this version goes eol", + "createTime": { + "format": "date-time", "type": "string" }, - "exists": { - "title": "whether or not the package exists in an apk repo", - "type": "boolean" - }, - "fips": { - "title": "whether or not a FIPS-enabled version of the package exists in an apk repo", - "type": "boolean" + "expirationTime": { + "format": "date-time", + "type": "string" }, - "latestVersion": { - "title": "the latest version of this specific version stream", + "externalId": { "type": "string" }, - "legacyLts": { - "description": "May be set to a date or true if the software is marked as lts.\nClients should treat this field as a boolean based on whether or not it is set.\nThis field will be removed. Prefer using the `lts` field instead.", + "id": { "type": "string" }, - "lts": { - "description": "whether or not this version is considered \"long-term support\" version by upstream.\nThis is set best effort based on the upstream's definition of LTS, and may not be consistent\nacross packages in meaning or duration.", - "type": "boolean" + "quota": { + "additionalProperties": { + "$ref": "#/components/schemas/chainguard.platform.registry.ImageQuota" + }, + "description": "Keys can't be enum types, but string should match CatalogTier.", + "type": "object" }, - "releaseDate": { - "title": "the date this version was release", - "type": "string" + "tiers": { + "description": "List of catalog tiers (e.g., [\"APPLICATION\", \"BASE\"]) that have unlimited access.\nThis field is used for AYCE (All You Can Eat) entitlements.", + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.CatalogTier" + }, + "type": "array" }, - "version": { - "title": "the version stream identifier", - "type": "string" + "type": { + "$ref": "#/components/schemas/chainguard.platform.registry.Entitlement.Type" }, - "versionSource": { - "$ref": "#/components/schemas/chainguard.platform.registry.PackageVersion.VersionSource" + "updateTime": { + "format": "date-time", + "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.PackageVersion.VersionSource": { + "chainguard.platform.registry.Entitlement.Type": { + "default": "UNKNOWN", + "enum": [ + "UNKNOWN", + "TRIAL", + "PRODUCTION", + "EXTRA", + "STARTER" + ], + "type": "string" + }, + "chainguard.platform.registry.EntitlementImage": { "properties": { - "ref": { + "id": { + "description": "The image repository UID.", "type": "string" }, - "sha": { + "name": { + "description": "Human-readable image name corresponding to id.", + "readOnly": true, "type": "string" + }, + "tier": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.CatalogTier" + } + ], + "description": "The image repository catalog tier the image is associated with." } }, "type": "object" }, - "chainguard.platform.registry.PackageVersionMetadata": { + "chainguard.platform.registry.EntitlementImagesList": { "properties": { - "eolVersions": { + "images": { "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.PackageVersion" + "$ref": "#/components/schemas/chainguard.platform.registry.EntitlementImage" }, - "title": "list of versions which are now eol", "type": "array" - }, - "gracePeriodMonths": { - "format": "int32", - "title": "the grace period to extend the EOL of the package", - "type": "integer" - }, - "lastUpdatedTimestamp": { - "title": "the last time this data was updated", - "type": "string" - }, - "latestVersion": { - "title": "the latest version of the software", - "type": "string" - }, - "versions": { + } + }, + "type": "object" + }, + "chainguard.platform.registry.EntitlementList": { + "properties": { + "items": { "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.PackageVersion" + "$ref": "#/components/schemas/chainguard.platform.registry.Entitlement" }, - "title": "list of versions which are active", "type": "array" } }, - "title": "This type mimics the \"status\" section from the original\nYAML files located at https://github.com/chainguard-dev/package-version-metadata", "type": "object" }, - "chainguard.platform.registry.PkgMetadata": { + "chainguard.platform.registry.EntitlementSummaryResponse": { "properties": { - "buildTimestamp": { - "format": "date-time", - "title": "timestamp when package was built, date 0-0-0 when build timestamp not available", - "type": "string" - }, - "eolDate": { + "lastUpdatedTime": { "format": "date-time", - "title": "date when EOL, date 0-0-0 when not eol", - "type": "string" - }, - "license": { - "title": "license of package, empty if unknown", - "type": "string" - }, - "originPurl": { - "title": "if differ from purl, it means it is a subpackage", + "title": "last updated time", "type": "string" }, - "purl": { - "title": "purl of package or subpackage; spec https://github.com/package-url/purl-spec", - "type": "string" + "quota": { + "additionalProperties": { + "$ref": "#/components/schemas/chainguard.platform.registry.ImageQuota" + }, + "description": "Keys can't be enum types, but string should match CatalogTier.", + "type": "object" } }, "type": "object" }, - "chainguard.platform.registry.Plan": { - "default": "PLAN_UNSPECIFIED", - "description": "Plan describes the entitlement plan for an organization.", - "enum": [ - "PLAN_UNSPECIFIED", - "PER_IMAGE", - "CATALOG", - "STARTER" - ], - "type": "string" - }, - "chainguard.platform.registry.Policies.CheckPoliciesBody": { + "chainguard.platform.registry.Entitlements.AddEntitlementImagesBody": { "properties": { - "digest": { - "description": "The digest of the image manifest (e.g. \"sha256:abc123...\").", + "id": { + "description": "The exact id of the entitlement to add images to.", "type": "string" + }, + "imageNames": { + "description": "Catalog image names to add (e.g., \"nginx\", \"redis\").\nResolved against the catalog by exact name match.", + "items": { + "type": "string" + }, + "type": "array" } }, "type": "object" }, - "chainguard.platform.registry.PolicyCheckResult": { - "default": "POLICY_CHECK_RESULT_UNSPECIFIED", - "description": "PolicyCheckResult is the outcome of evaluating a single policy.\n\n - ALLOWED: The image satisfies the policy.\n - DENIED: The image violates the policy.\n - ERROR: The policy definition itself produced an error during evaluation (e.g. a\nsyntax error in the policy expression). The API call succeeded, but the\npolicy could not be evaluated to an allow/deny outcome.", - "enum": [ - "POLICY_CHECK_RESULT_UNSPECIFIED", - "ALLOWED", - "DENIED", - "ERROR" - ], - "type": "string" - }, - "chainguard.platform.registry.PolicyMode": { - "default": "POLICY_MODE_UNSPECIFIED", - "description": "PolicyMode indicates how the caller should treat a policy violation.\n\n - ENFORCED: The violation should be treated as blocking by the caller.\n - DRY_RUN: The violation should be logged but not treated as blocking.", + "chainguard.platform.registry.EolGracePeriodStatus": { + "default": "GRACE_NOT_ELIGIBLE", "enum": [ - "POLICY_MODE_UNSPECIFIED", - "ENFORCED", - "DRY_RUN" + "GRACE_NOT_ELIGIBLE", + "GRACE_ELIGIBLE", + "GRACE_ACTIVE", + "GRACE_BROKEN", + "GRACE_EXPIRED" ], "type": "string" }, - "chainguard.platform.registry.PolicyResult": { - "description": "PolicyResult is the outcome of evaluating a single policy against an image.", + "chainguard.platform.registry.EolTag": { "properties": { - "bindingId": { - "description": "The UIDP of the binding that associated this policy.", + "gracePeriodExpiryDate": { + "format": "date-time", + "title": "the date the grace period expires", "type": "string" }, - "mode": { + "graceStatus": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.registry.PolicyMode" + "$ref": "#/components/schemas/chainguard.platform.registry.EolGracePeriodStatus" } ], - "description": "The mode the policy was operating in." + "title": "eol grace period status" }, - "policyId": { - "description": "The UIDP of the policy that was evaluated.", + "id": { + "description": "id, identifier of this Tag, a UIDP under a Repo.", "type": "string" }, - "policyName": { - "description": "The name of the policy.", + "mainPackageName": { + "title": "name of the main package", "type": "string" }, - "result": { + "mainPackageVersion": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.registry.PolicyCheckResult" + "$ref": "#/components/schemas/chainguard.platform.registry.PackageVersion" } ], - "description": "The result of the evaluation." + "title": "version of the main package" + }, + "name": { + "description": "name, the unique name of the Tag.", + "type": "string" + }, + "tagStatus": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.EolTagStatus" + } + ], + "title": "status of the tag" } }, "type": "object" }, - "chainguard.platform.registry.RawSbom": { - "description": "The service for this request is deprecated.", + "chainguard.platform.registry.EolTagList": { "properties": { - "rawSbom": { + "items": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.EolTag" + }, + "type": "array" + }, + "nextPageToken": { "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.RawVulnReport": { + "chainguard.platform.registry.EolTagStatus": { + "default": "TAG_ACTIVE", + "enum": [ + "TAG_ACTIVE", + "TAG_IN_GRACE", + "TAG_INACTIVE" + ], + "type": "string" + }, + "chainguard.platform.registry.GetEffectiveEntitlementsResponse": { "properties": { - "createdAt": { - "description": "created_at is the time the report was generated.", - "format": "date-time", - "type": "string" - }, - "digest": { - "description": "digest is the exact digest of the scanned image.", - "type": "string" + "activeImages": { + "description": "Images the organization is currently entitled to, deduplicated\nacross entitlements with the latest expiration retained.", + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.EntitledImage" + }, + "type": "array" }, - "rawReport": { - "description": "raw_report is a JSON string of the raw report output from the scanner.\nThis is only populated for reports with size less than the maximum allowed.", - "type": "string" + "activeTiers": { + "description": "Catalog tiers with unlimited (AYCE) access.", + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.CatalogTier" + }, + "type": "array" }, - "rawReportUrl": { - "description": "raw_report_url is an expiring URL for a direct download of the\nraw scan report.", - "type": "string" + "maxTotalImages": { + "description": "Maximum number of images that can be entitled to this organization.\nA value of -1 means this organization has no maximum quota enforced.", + "format": "int32", + "type": "integer" }, - "scanner": { + "plan": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.registry.Scanner" + "$ref": "#/components/schemas/chainguard.platform.registry.Plan" } ], - "description": "scanner is the details of the scanner that generated this report." + "description": "The resolved entitlement plan for the organization." + }, + "quota": { + "additionalProperties": { + "$ref": "#/components/schemas/chainguard.platform.registry.ImageQuota" + }, + "description": "Aggregated quota usage per tier. Keys are CatalogTier string names.", + "type": "object" } }, "type": "object" }, - "chainguard.platform.registry.Registry.CreateDeploymentBody": { + "chainguard.platform.registry.GetFeaturesResponse": { "properties": { - "charts": { - "description": "Helm chart configurations for this deployment.", - "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.HelmChart" - }, - "type": "array" + "customAssembly": { + "type": "boolean" + }, + "uniqueTags": { + "type": "boolean" } }, "type": "object" }, - "chainguard.platform.registry.Registry.UpdateDeploymentBody": { + "chainguard.platform.registry.Helm": { + "description": "Helm contains the chart and values fields from the helm-values predicate.", "properties": { - "charts": { - "description": "Helm chart configurations for this deployment.", - "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.HelmChart" - }, - "type": "array" + "chartDigest": { + "description": "Chart digest.", + "type": "string" + }, + "chartName": { + "description": "Chart name.", + "type": "string" + }, + "chartRepository": { + "description": "Chart repository.", + "type": "string" + }, + "chartVersion": { + "description": "Chart version.", + "type": "string" + }, + "values": { + "description": "Additional values.", + "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.Registry.UpdateRegistrySettingsBody": { + "chainguard.platform.registry.HelmChart": { "properties": { - "eolGracePeriod": { - "description": "eol_grace_period controls whether to support EOL grace period by default for repos in this registry.\nWhen enabled, EOL-tagged images are shipped to users during their grace period.", - "type": "boolean" + "chart": { + "description": "chart is the specific chart that is used from a repo.", + "type": "string" }, - "uniqueTags": { - "description": "unique_tags controls whether exported tags will be uniquely labeled by default.", - "type": "boolean" + "repo": { + "description": "repo is the Helm chart repository URL.", + "type": "string" + }, + "source": { + "description": "source is an optional link to the source code (e.g., GitHub repository URL).", + "type": "string" } }, + "title": "Helm chart configuration", "type": "object" }, - "chainguard.platform.registry.Registry.UpdateRepoBody": { + "chainguard.platform.registry.ImageConfig": { "properties": { - "activeTags": { - "description": "(optional) actively maintained tags in this repository.", + "cmd": { + "description": "Cmd defines the default arguments to the entrypoint of the container.", "items": { "type": "string" }, "type": "array" }, - "aliases": { - "description": "aliases is a list of equivalent images.", + "entrypoint": { + "description": "Entrypoint defines a list of arguments to use as the command to execute when the container starts.", "items": { "type": "string" }, "type": "array" }, - "bundles": { - "description": "bundles is a list of tags/labels that allow us to group repositories to each other for sales purposes.", + "env": { + "description": "Env is a list of environment variables to be used in a container.", "items": { "type": "string" }, "type": "array" }, - "catalogTier": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.CatalogTier" - } - ], - "description": "catalog_tier is the catalog tier this repository belongs to." + "exposedPorts": { + "additionalProperties": { + "$ref": "#/components/schemas/chainguard.platform.registry.ImageConfig.ExposedPort" + }, + "type": "object" }, - "createTime": { - "format": "date-time", + "labels": { + "additionalProperties": { + "type": "string" + }, + "description": "Labels contains arbitrary metadata for the container.", + "type": "object" + }, + "stopSignal": { + "description": "StopSignal contains the system call signal that will be sent to the container to exit.", "type": "string" }, - "customOverlay": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.CustomOverlay" - } - ], - "description": "(optional) custom apko image configuration that gets applied to images in this repo." - }, - "description": { - "description": "(optional) human-readable description of the repository.", + "user": { + "description": "User defines the username or UID which the process in the container should run as.", "type": "string" }, - "name": { - "description": "name is the human-readable name of the repository.", - "type": "string" + "volumes": { + "additionalProperties": { + "$ref": "#/components/schemas/chainguard.platform.registry.ImageConfig.Volume" + }, + "description": "Volumes is a set of directories describing where the process is likely write data specific to a container instance.", + "type": "object" }, - "readme": { - "description": "readme is raw Markdown file contents describing the repo.", + "workingDir": { + "description": "WorkingDir sets the current working directory of the entrypoint process in the container.", "type": "string" - }, - "sync_config": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.SyncConfig" - } - ], - "title": "(optional) Repository sync configuration. If enabled, images are synced from the source to this repo.\nNOTE: This property can only be set by Chainguard.\nNote: the json_name defaults to \"syncConfig\" which causes our eventing\nsystem to not work properly (since the protobuf name is \"sync_config\")" } }, "type": "object" }, - "chainguard.platform.registry.Registry.UpdateTagBody": { + "chainguard.platform.registry.ImageConfig.ExposedPort": { + "description": "ExposedPorts a set of ports to expose from a container running this image.", + "type": "object" + }, + "chainguard.platform.registry.ImageConfig.Volume": { + "type": "object" + }, + "chainguard.platform.registry.ImageContents": { "properties": { - "bundles": { - "description": "bundles is a list of tags/labels for sales purposes.", + "packages": { + "description": "Packages to append to the image config.", "items": { "type": "string" }, "type": "array" - }, - "deprecated": { - "description": "deprecated, true if the tag is deprecated.", - "type": "boolean" - }, - "digest": { - "description": "digest, the digest of the manifest with this tag.", - "type": "string" - }, - "lastUpdated": { - "description": "last time this tag was updated.", - "format": "date-time", - "type": "string" - }, - "name": { - "description": "name, the unique name of the Tag.", - "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.RegistrySettings": { + "chainguard.platform.registry.ImageQuota": { "properties": { - "eolGracePeriod": { - "description": "eol_grace_period controls whether to support EOL grace period by default for repos in this registry.\nWhen enabled, EOL-tagged images are shipped to users during their grace period.", - "type": "boolean" + "current": { + "format": "int32", + "type": "integer" }, - "registryId": { - "description": "registry_id is the UIDP of the root group (e.g., cgr.dev/\u003cuidp\u003e/...).", + "max": { + "format": "int32", + "type": "integer" + } + }, + "type": "object" + }, + "chainguard.platform.registry.ManifestDigestCount": { + "properties": { + "count": { + "format": "int64", "type": "string" - }, - "uniqueTags": { - "description": "unique_tags controls whether exported tags will be uniquely labeled by default.", - "type": "boolean" } }, "type": "object" }, - "chainguard.platform.registry.Repo": { + "chainguard.platform.registry.ManifestMetadata": { "properties": { - "activeTags": { - "description": "(optional) actively maintained tags in this repository.", - "items": { - "type": "string" - }, - "type": "array" + "digest": { + "description": "Digest of image that packages are associated with.", + "type": "string" }, - "aliases": { - "description": "aliases is a list of equivalent images.", + "pkgMetadata": { + "description": "List of packages that are part of image.", "items": { - "type": "string" + "$ref": "#/components/schemas/chainguard.platform.registry.PkgMetadata" }, "type": "array" - }, - "bundles": { - "description": "bundles is a list of tags/labels that allow us to group repositories to each other for sales purposes.", + } + }, + "type": "object" + }, + "chainguard.platform.registry.ManifestMetadataList": { + "properties": { + "items": { "items": { - "type": "string" + "$ref": "#/components/schemas/chainguard.platform.registry.ManifestMetadata" }, "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.registry.PackageVersion": { + "properties": { + "eolBroken": { + "title": "whether or not an EOL version cannot longer be supported due to incompatibilities or no longer available dependencies", + "type": "boolean" }, - "catalogTier": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.CatalogTier" - } - ], - "description": "catalog_tier is the catalog tier this repository belongs to." - }, - "createTime": { - "format": "date-time", + "eolDate": { + "title": "the date when this version goes eol", "type": "string" }, - "customOverlay": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.CustomOverlay" - } - ], - "description": "(optional) custom apko image configuration that gets applied to images in this repo." + "exists": { + "title": "whether or not the package exists in an apk repo", + "type": "boolean" }, - "description": { - "description": "(optional) human-readable description of the repository.", + "fips": { + "title": "whether or not a FIPS-enabled version of the package exists in an apk repo", + "type": "boolean" + }, + "latestVersion": { + "title": "the latest version of this specific version stream", "type": "string" }, - "id": { - "description": "id is the identifier of this specific repository.", + "legacyLts": { + "description": "May be set to a date or true if the software is marked as lts.\nClients should treat this field as a boolean based on whether or not it is set.\nThis field will be removed. Prefer using the `lts` field instead.", "type": "string" }, - "name": { - "description": "name is the human-readable name of the repository.", + "lts": { + "description": "whether or not this version is considered \"long-term support\" version by upstream.\nThis is set best effort based on the upstream's definition of LTS, and may not be consistent\nacross packages in meaning or duration.", + "type": "boolean" + }, + "releaseDate": { + "title": "the date this version was release", "type": "string" }, - "readme": { - "description": "readme is raw Markdown file contents describing the repo.", + "version": { + "title": "the version stream identifier", "type": "string" }, - "sync_config": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.SyncConfig" - } - ], - "title": "(optional) Repository sync configuration. If enabled, images are synced from the source to this repo.\nNOTE: This property can only be set by Chainguard.\nNote: the json_name defaults to \"syncConfig\" which causes our eventing\nsystem to not work properly (since the protobuf name is \"sync_config\")" + "versionSource": { + "$ref": "#/components/schemas/chainguard.platform.registry.PackageVersion.VersionSource" } }, "type": "object" }, - "chainguard.platform.registry.RepoCount": { + "chainguard.platform.registry.PackageVersion.VersionSource": { "properties": { - "count": { - "format": "int64", + "ref": { + "type": "string" + }, + "sha": { "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.RepoList": { + "chainguard.platform.registry.PackageVersionMetadata": { "properties": { - "items": { + "eolVersions": { "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.Repo" + "$ref": "#/components/schemas/chainguard.platform.registry.PackageVersion" }, + "title": "list of versions which are now eol", "type": "array" - } - }, - "type": "object" - }, - "chainguard.platform.registry.RepoSyncStatus": { - "description": "RepoSyncStatus is repo_id correlated with the repo's sync status.", - "properties": { - "repoId": { + }, + "gracePeriodMonths": { + "format": "int32", + "title": "the grace period to extend the EOL of the package", + "type": "integer" + }, + "lastUpdatedTimestamp": { + "title": "the last time this data was updated", "type": "string" }, - "repoStatus": { - "$ref": "#/components/schemas/chainguard.platform.registry.SyncStatus" + "latestVersion": { + "title": "the latest version of the software", + "type": "string" + }, + "versions": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.PackageVersion" + }, + "title": "list of versions which are active", + "type": "array" } }, + "title": "This type mimics the \"status\" section from the original\nYAML files located at https://github.com/chainguard-dev/package-version-metadata", "type": "object" }, - "chainguard.platform.registry.Scanner": { + "chainguard.platform.registry.PkgMetadata": { "properties": { - "dbBuildTime": { - "description": "db_build_time is the time the vulnerability database was built that was used\nto generate the report.", + "buildTimestamp": { "format": "date-time", + "title": "timestamp when package was built, date 0-0-0 when build timestamp not available", "type": "string" }, - "name": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.Scanner.Name" - } - ], - "description": "name is the name of the scanner." + "eolDate": { + "format": "date-time", + "title": "date when EOL, date 0-0-0 when not eol", + "type": "string" }, - "version": { - "description": "scanner_version is the version of the scanner used to generate the report.", + "license": { + "title": "license of package, empty if unknown", + "type": "string" + }, + "originPurl": { + "title": "if differ from purl, it means it is a subpackage", + "type": "string" + }, + "purl": { + "title": "purl of package or subpackage; spec https://github.com/package-url/purl-spec", "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.Scanner.Name": { - "default": "UNKNOWN", + "chainguard.platform.registry.Plan": { + "default": "PLAN_UNSPECIFIED", + "description": "Plan describes the entitlement plan for an organization.", "enum": [ - "UNKNOWN", - "GRYPE", - "TRIVY" + "PLAN_UNSPECIFIED", + "PER_IMAGE", + "CATALOG", + "STARTER" ], "type": "string" }, - "chainguard.platform.registry.Size": { + "chainguard.platform.registry.Policies.CheckPoliciesBody": { "properties": { - "arch": { - "description": "Architecture.", - "type": "string" - }, - "size": { - "description": "Size per manifest digest, by architecture.", - "format": "int64", + "digest": { + "description": "The digest of the image manifest (e.g. \"sha256:abc123...\").", "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.SyncConfig": { + "chainguard.platform.registry.PolicyCheckResult": { + "default": "POLICY_CHECK_RESULT_UNSPECIFIED", + "description": "PolicyCheckResult is the outcome of evaluating a single policy.\n\n - ALLOWED: The image satisfies the policy.\n - DENIED: The image violates the policy.\n - ERROR: The policy definition itself produced an error during evaluation (e.g. a\nsyntax error in the policy expression). The API call succeeded, but the\npolicy could not be evaluated to an allow/deny outcome.", + "enum": [ + "POLICY_CHECK_RESULT_UNSPECIFIED", + "ALLOWED", + "DENIED", + "ERROR" + ], + "type": "string" + }, + "chainguard.platform.registry.PolicyMode": { + "default": "POLICY_MODE_UNSPECIFIED", + "description": "PolicyMode indicates how the caller should treat a policy violation.\n\n - ENFORCED: The violation should be treated as blocking by the caller.\n - DRY_RUN: The violation should be logged but not treated as blocking.", + "enum": [ + "POLICY_MODE_UNSPECIFIED", + "ENFORCED", + "DRY_RUN" + ], + "type": "string" + }, + "chainguard.platform.registry.PolicyResult": { + "description": "PolicyResult is the outcome of evaluating a single policy against an image.", "properties": { - "amazon": { - "description": "AWS ECR repo to sync to.", - "type": "string" - }, - "apkoOverlay": { - "description": "An apko configuration overlay to rebuild images with when syncing them.", - "type": "string" - }, - "azure": { - "description": "Azure ACR repo to sync to.", - "type": "string" - }, - "expiration": { - "description": "When the catalog syncer should stop syncing from the source repository.", - "format": "date-time", + "bindingId": { + "description": "The UIDP of the binding that associated this policy.", "type": "string" }, - "google": { - "description": "GCP Artifact Registry repo to sync to.", - "type": "string" + "mode": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.PolicyMode" + } + ], + "description": "The mode the policy was operating in." }, - "gracePeriod": { - "description": "Controls whether the image grace period functionality is enabled or not.", - "type": "boolean" + "parameters": { + "additionalProperties": {}, + "description": "The parameter values the binding supplied for this evaluation, keyed by\nparameter name. Surfaces what the allow/deny outcome was configured with.", + "type": "object" }, - "source": { - "description": "Repo ID to sync from.", + "policyId": { + "description": "The UIDP of the policy that was evaluated.", "type": "string" }, - "syncApks": { - "description": "Controls whether to synchronize APKs for the images in this repository\nto the enclosing Chainguard group.", - "type": "boolean" - }, - "uniqueTags": { - "description": "Controls whether exported tags will be uniquely labeled.", - "type": "boolean" - } - }, - "type": "object" - }, - "chainguard.platform.registry.SyncStatus": { - "description": "SyncStatus is the sync status of a repo in the workqueue.", - "properties": { - "createTime": { - "description": "The time when the task was created in the workqueue.", - "format": "date-time", + "policyName": { + "description": "The name of the policy.", "type": "string" }, - "status": { + "result": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.registry.SyncStatus.Status" + "$ref": "#/components/schemas/chainguard.platform.registry.PolicyCheckResult" } ], - "description": "The current status of the repo in the workqueue." + "description": "The result of the evaluation." } }, "type": "object" }, - "chainguard.platform.registry.SyncStatus.Status": { - "default": "UNKNOWN", - "enum": [ - "UNKNOWN", - "QUEUED", - "IN_PROGRESS", - "FAILED" - ], - "type": "string" - }, - "chainguard.platform.registry.SyncStatusList": { - "description": "SyncStatusList is the sync status of all repos for a given registry_id.", + "chainguard.platform.registry.RawSbom": { + "description": "The service for this request is deprecated.", "properties": { - "items": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.RepoSyncStatus" - }, - "type": "array" + "rawSbom": { + "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.Tag": { + "chainguard.platform.registry.RawVulnReport": { "properties": { - "bundles": { - "description": "bundles is a list of tags/labels for sales purposes.", - "items": { - "type": "string" - }, - "type": "array" - }, - "deprecated": { - "description": "deprecated, true if the tag is deprecated.", - "type": "boolean" - }, - "digest": { - "description": "digest, the digest of the manifest with this tag.", + "createdAt": { + "description": "created_at is the time the report was generated.", + "format": "date-time", "type": "string" }, - "id": { - "description": "id, identifier of this Tag, a UIDP under a Repo.", + "digest": { + "description": "digest is the exact digest of the scanned image.", "type": "string" }, - "lastUpdated": { - "description": "last time this tag was updated.", - "format": "date-time", + "rawReport": { + "description": "raw_report is a JSON string of the raw report output from the scanner.\nThis is only populated for reports with size less than the maximum allowed.", "type": "string" }, - "name": { - "description": "name, the unique name of the Tag.", - "type": "string" - } - }, - "type": "object" - }, - "chainguard.platform.registry.TagHistory": { - "properties": { - "digest": { + "rawReportUrl": { + "description": "raw_report_url is an expiring URL for a direct download of the\nraw scan report.", "type": "string" }, - "updateTimestamp": { - "format": "date-time", - "type": "string" + "scanner": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.Scanner" + } + ], + "description": "scanner is the details of the scanner that generated this report." } }, "type": "object" }, - "chainguard.platform.registry.TagHistoryList": { + "chainguard.platform.registry.Registry.CreateDeploymentBody": { "properties": { - "items": { + "charts": { + "description": "Helm chart configurations for this deployment.", "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.TagHistory" + "$ref": "#/components/schemas/chainguard.platform.registry.HelmChart" }, "type": "array" } }, "type": "object" }, - "chainguard.platform.registry.TagList": { + "chainguard.platform.registry.Registry.UpdateDeploymentBody": { "properties": { - "items": { + "charts": { + "description": "Helm chart configurations for this deployment.", "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.Tag" + "$ref": "#/components/schemas/chainguard.platform.registry.HelmChart" }, "type": "array" } }, "type": "object" }, - "chainguard.platform.registry.UpdateStatus": { - "description": "UpdateStatus is the update status of a repo.", + "chainguard.platform.registry.Registry.UpdateRegistrySettingsBody": { "properties": { - "recentlyUpdated": { - "description": "Whether or not the repo has had a recent update.", + "eolGracePeriod": { + "description": "eol_grace_period controls whether to support EOL grace period by default for repos in this registry.\nWhen enabled, EOL-tagged images are shipped to users during their grace period.", "type": "boolean" - } - }, - "type": "object" - }, - "chainguard.platform.registry.VulnCount": { - "properties": { - "count": { - "description": "count is the number of CVEs at this severity detected.", - "format": "int32", - "type": "integer" }, - "severity": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.Vulnerability.Severity" - } - ], - "title": "severity is the CVE severity being enumerated" + "uniqueTags": { + "description": "unique_tags controls whether exported tags will be uniquely labeled by default.", + "type": "boolean" } }, "type": "object" }, - "chainguard.platform.registry.VulnCountReport": { + "chainguard.platform.registry.Registry.UpdateRepoBody": { "properties": { - "critCveIds": { - "description": "crit_cve_ids is a list of cumulative CVE IDs found in the image with a critical severity.", + "activeTags": { + "description": "(optional) actively maintained tags in this repository.", "items": { "type": "string" }, "type": "array" }, - "cveIds": { - "description": "cve_ids is a list of cumulative CVE IDs found in the image.", + "aliases": { + "description": "aliases is a list of equivalent images.", "items": { "type": "string" }, "type": "array" }, - "date": { - "description": "date is when the image was scanned.", - "format": "date-time", - "type": "string" - }, - "highCveIds": { - "description": "high_cve_ids is a list of cumulative CVE IDs found in the image with a high severity.", + "bundles": { + "description": "bundles is a list of tags/labels that allow us to group repositories to each other for sales purposes.", "items": { "type": "string" }, "type": "array" }, - "lowCveIds": { - "description": "low_cve_ids is a list of cumulative CVE IDs found in the image with a low severity.", - "items": { - "type": "string" - }, - "type": "array" + "catalogTier": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.CatalogTier" + } + ], + "description": "catalog_tier is the catalog tier this repository belongs to." }, - "medCveIds": { - "description": "med_cve_ids is a list of cumulative CVE IDs found in the image with a medium severity.", - "items": { - "type": "string" - }, - "type": "array" + "createTime": { + "format": "date-time", + "type": "string" }, - "negligibleCveIds": { - "description": "negligible_cve_ids is a list of cumulative CVE IDs found in the image with a negligible severity.", - "items": { - "type": "string" - }, - "type": "array" + "customOverlay": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.CustomOverlay" + } + ], + "description": "(optional) custom apko image configuration that gets applied to images in this repo." }, - "repo": { - "description": "repo is the name of the image scanned.", + "description": { + "description": "(optional) human-readable description of the repository.", "type": "string" }, - "sizeBytes": { - "description": "size_bytes is the size in bytes of the image at scan time.", - "format": "int64", + "name": { + "description": "name is the human-readable name of the repository.", "type": "string" }, - "tag": { - "description": "tag is the version of the image scanned.", + "readme": { + "description": "readme is raw Markdown file contents describing the repo.", "type": "string" }, - "unknownCveIds": { - "description": "unknown_cve_ids is a list of cumulative CVE IDs found in the image with an unknown severity.", - "items": { - "type": "string" - }, - "type": "array" - }, - "vulnCounts": { - "description": "vuln_counts enumerate the number of each CVE per severity found.", - "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.VulnCount" - }, - "type": "array" + "sync_config": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.SyncConfig" + } + ], + "title": "(optional) Repository sync configuration. If enabled, images are synced from the source to this repo.\nNOTE: This property can only be set by Chainguard.\nNote: the json_name defaults to \"syncConfig\" which causes our eventing\nsystem to not work properly (since the protobuf name is \"sync_config\")" } }, "type": "object" }, - "chainguard.platform.registry.VulnCountReportList": { + "chainguard.platform.registry.Registry.UpdateTagBody": { "properties": { - "items": { + "bundles": { + "description": "bundles is a list of tags/labels for sales purposes.", "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.VulnCountReport" + "type": "string" }, "type": "array" + }, + "deprecated": { + "description": "deprecated, true if the tag is deprecated.", + "type": "boolean" + }, + "digest": { + "description": "digest, the digest of the manifest with this tag.", + "type": "string" + }, + "lastUpdated": { + "description": "last time this tag was updated.", + "format": "date-time", + "type": "string" + }, + "name": { + "description": "name, the unique name of the Tag.", + "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.VulnReport": { + "chainguard.platform.registry.RegistrySettings": { "properties": { - "createdAt": { - "description": "created_at is the time the report was generated.", - "format": "date-time", - "type": "string" + "eolGracePeriod": { + "description": "eol_grace_period controls whether to support EOL grace period by default for repos in this registry.\nWhen enabled, EOL-tagged images are shipped to users during their grace period.", + "type": "boolean" }, - "digest": { - "description": "digest is the exact digest of the scanned image.", + "registryId": { + "description": "registry_id is the UIDP of the root group (e.g., cgr.dev/\u003cuidp\u003e/...).", "type": "string" }, - "scanner": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.registry.Scanner" - } - ], - "description": "scanner is the details of the scanner used to generate the report." - }, - "vulnerabilities": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.Vulnerability" - }, - "title": "vulnerabilities are the found vulns in the scanned image.\nFor Create", - "type": "array" + "uniqueTags": { + "description": "unique_tags controls whether exported tags will be uniquely labeled by default.", + "type": "boolean" } }, "type": "object" }, - "chainguard.platform.registry.VulnReportList": { + "chainguard.platform.registry.Repo": { "properties": { - "items": { + "activeTags": { + "description": "(optional) actively maintained tags in this repository.", "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.VulnReport" + "type": "string" }, "type": "array" - } - }, - "type": "object" - }, - "chainguard.platform.registry.Vulnerability": { - "properties": { + }, "aliases": { - "description": "aliases are other identifiers for this vulnerability.", + "description": "aliases is a list of equivalent images.", "items": { "type": "string" }, "type": "array" }, - "cvss": { - "description": "List of CVSS information about the exploitability of the vulnerability.", + "bundles": { + "description": "bundles is a list of tags/labels that allow us to group repositories to each other for sales purposes.", "items": { - "$ref": "#/components/schemas/chainguard.platform.registry.Vulnerability.CVSS" + "type": "string" }, "type": "array" }, - "description": { - "description": "description is a short description of the vulnerability.", - "type": "string" + "catalogTier": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.CatalogTier" + } + ], + "description": "catalog_tier is the catalog tier this repository belongs to." }, - "details": { - "description": "details give additional textual details about the vulnerability.", + "createTime": { + "format": "date-time", "type": "string" }, - "fix": { + "customOverlay": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.registry.Vulnerability.Fix" + "$ref": "#/components/schemas/chainguard.platform.registry.CustomOverlay" } ], - "description": "fix is the version and state of a potential fix for this vulnerability." + "description": "(optional) custom apko image configuration that gets applied to images in this repo." }, - "id": { - "title": "The unique identifier for the vulnerability.\ne.g. CVE-2024-12345", + "description": { + "description": "(optional) human-readable description of the repository.", "type": "string" }, - "locations": { - "description": "locations are paths affected by the vulnerability.", - "items": { - "type": "string" - }, - "type": "array" + "id": { + "description": "id is the identifier of this specific repository.", + "type": "string" }, - "purls": { - "description": "purls are the package URLs of the affected packages.", - "items": { - "type": "string" - }, - "type": "array" + "name": { + "description": "name is the human-readable name of the repository.", + "type": "string" }, - "relatedUrls": { - "description": "URLs related to this vulnerability.", - "items": { - "type": "string" - }, - "type": "array" + "readme": { + "description": "readme is raw Markdown file contents describing the repo.", + "type": "string" }, - "severity": { + "sync_config": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.registry.Vulnerability.Severity" + "$ref": "#/components/schemas/chainguard.platform.registry.SyncConfig" } ], - "description": "severity is the value representing the severity of the vulnerability." + "title": "(optional) Repository sync configuration. If enabled, images are synced from the source to this repo.\nNOTE: This property can only be set by Chainguard.\nNote: the json_name defaults to \"syncConfig\" which causes our eventing\nsystem to not work properly (since the protobuf name is \"sync_config\")" } }, "type": "object" }, - "chainguard.platform.registry.Vulnerability.CVSS": { + "chainguard.platform.registry.RepoCount": { "properties": { - "score": { - "description": "score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.", + "count": { + "format": "int64", "type": "string" - }, - "version": { - "description": "version used to populate score and severity.", + } + }, + "type": "object" + }, + "chainguard.platform.registry.RepoList": { + "properties": { + "items": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.Repo" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.registry.RepoSyncStatus": { + "description": "RepoSyncStatus is repo_id correlated with the repo's sync status.", + "properties": { + "repoId": { "type": "string" + }, + "repoStatus": { + "$ref": "#/components/schemas/chainguard.platform.registry.SyncStatus" } }, "type": "object" }, - "chainguard.platform.registry.Vulnerability.Fix": { + "chainguard.platform.registry.Scanner": { "properties": { - "state": { + "dbBuildTime": { + "description": "db_build_time is the time the vulnerability database was built that was used\nto generate the report.", + "format": "date-time", + "type": "string" + }, + "name": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.registry.Vulnerability.Fix.State" + "$ref": "#/components/schemas/chainguard.platform.registry.Scanner.Name" } ], - "description": "state reflects the state of the fix, e.g. fixed, unknown, not-fixed, won't-fix." + "description": "name is the name of the scanner." }, - "versions": { - "description": "List of in versions of the package on which the vulnerability has been solved.", - "items": { - "type": "string" - }, - "type": "array" + "version": { + "description": "scanner_version is the version of the scanner used to generate the report.", + "type": "string" } }, "type": "object" }, - "chainguard.platform.registry.Vulnerability.Fix.State": { - "default": "UNKNOWN", - "enum": [ - "UNKNOWN", - "FIXED", - "NOT_FIXED", - "WONT_FIX" - ], - "type": "string" - }, - "chainguard.platform.registry.Vulnerability.Severity": { + "chainguard.platform.registry.Scanner.Name": { "default": "UNKNOWN", "enum": [ "UNKNOWN", - "LOW", - "MEDIUM", - "HIGH", - "CRITICAL", - "NEGLIGIBLE" + "GRYPE", + "TRIVY" ], "type": "string" }, - "chainguard.platform.skills.Entitlements.CreateBody": { - "type": "object" - }, - "chainguard.platform.skills.SkillEntitlement": { - "description": "SkillEntitlement records that an org is entitled to publish and pull\nskill artifacts via skills.cgr.dev.", + "chainguard.platform.registry.Size": { "properties": { - "id": { - "description": "id is the uidp of the entitlement, a child of the org group.", + "arch": { + "description": "Architecture.", "type": "string" - } - }, - "type": "object" - }, - "chainguard.platform.skills.SkillEntitlementList": { - "properties": { - "items": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.skills.SkillEntitlement" - }, - "type": "array" - } - }, - "type": "object" - }, - "chainguard.platform.tenant.ComponentGraph": { - "properties": { - "edges": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.tenant.ComponentGraph.Edge" - }, - "type": "array" }, - "nodes": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.tenant.ComponentGraph.Node" - }, - "type": "array" + "size": { + "description": "Size per manifest digest, by architecture.", + "format": "int64", + "type": "string" } }, "type": "object" }, - "chainguard.platform.tenant.ComponentGraph.Edge": { + "chainguard.platform.registry.SyncConfig": { "properties": { - "predicateId": { + "amazon": { + "description": "AWS ECR repo to sync to.", "type": "string" }, - "subjectId": { + "apkoOverlay": { + "description": "An apko configuration overlay to rebuild images with when syncing them.", "type": "string" }, - "type": { - "$ref": "#/components/schemas/chainguard.platform.tenant.ComponentGraph.Edge.Type" - } - }, - "type": "object" - }, - "chainguard.platform.tenant.ComponentGraph.Edge.Type": { - "default": "UNKNOWN", - "description": "- GENERATED_FROM: and so on...; for inspiration, see https://spdx.github.io/spdx-spec/v2.3/relationships-between-SPDX-elements/", - "enum": [ - "UNKNOWN", - "DESCRIBES", - "CONTAINS", - "DEPENDS_ON", - "GENERATED_FROM" - ], - "type": "string" - }, - "chainguard.platform.tenant.ComponentGraph.Node": { - "properties": { - "file": { - "$ref": "#/components/schemas/chainguard.platform.tenant.File2" + "azure": { + "description": "Azure ACR repo to sync to.", + "type": "string" }, - "package": { - "$ref": "#/components/schemas/chainguard.platform.tenant.Package2" - } - }, - "type": "object" - }, - "chainguard.platform.tenant.File2": { - "properties": { - "id": { + "expiration": { + "description": "When the catalog syncer should stop syncing from the source repository.", + "format": "date-time", "type": "string" }, - "name": { + "google": { + "description": "GCP Artifact Registry repo to sync to.", "type": "string" }, - "types": { - "items": { - "type": "string" - }, - "type": "array" + "gracePeriod": { + "description": "Controls whether the image grace period functionality is enabled or not.", + "type": "boolean" + }, + "source": { + "description": "Repo ID to sync from.", + "type": "string" + }, + "syncApks": { + "description": "Controls whether to synchronize APKs for the images in this repository\nto the enclosing Chainguard group.", + "type": "boolean" + }, + "uniqueTags": { + "description": "Controls whether exported tags will be uniquely labeled.", + "type": "boolean" } }, "type": "object" }, - "chainguard.platform.tenant.Fix": { + "chainguard.platform.registry.SyncStatus": { + "description": "SyncStatus is the sync status of a repo in the workqueue.", "properties": { - "state": { + "createTime": { + "description": "The time when the task was created in the workqueue.", + "format": "date-time", + "type": "string" + }, + "status": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.tenant.Fix.State" + "$ref": "#/components/schemas/chainguard.platform.registry.SyncStatus.Status" } ], - "description": "state reflects the state of the fix, e.g. fixed, unknown, not-fixed, won't-fix." - }, - "versions": { - "description": "List of in versions of the package on which the vulnerability has been solved.", - "items": { - "type": "string" - }, - "type": "array" + "description": "The current status of the repo in the workqueue." } }, "type": "object" }, - "chainguard.platform.tenant.Fix.State": { + "chainguard.platform.registry.SyncStatus.Status": { "default": "UNKNOWN", "enum": [ "UNKNOWN", - "FIXED", - "NOT_FIXED", - "WONT_FIX" + "QUEUED", + "IN_PROGRESS", + "FAILED" ], "type": "string" }, - "chainguard.platform.tenant.Package2": { + "chainguard.platform.registry.SyncStatusList": { + "description": "SyncStatusList is the sync status of all repos for a given registry_id.", "properties": { - "description": { - "type": "string" - }, - "id": { - "type": "string" - }, - "license": { - "type": "string" - }, - "name": { - "type": "string" - }, - "purl": { - "type": "string" - }, - "version": { - "type": "string" + "items": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.RepoSyncStatus" + }, + "type": "array" } }, "type": "object" }, - "chainguard.platform.tenant.Sbom2": { - "description": "Sbom represents a normalized SBOM that we have ingested into our datastore.\nThey are linked to Signatures via ID, as in they are 'children' of Signatures\nThere can be multiple of these that we keep.", + "chainguard.platform.registry.Tag": { "properties": { - "authors": { - "description": "authors is zero or more authors concatenated.", - "type": "string" + "bundles": { + "description": "bundles is a list of tags/labels for sales purposes.", + "items": { + "type": "string" + }, + "type": "array" }, - "description": { - "title": "Short description of the Sbom", - "type": "string" + "deprecated": { + "description": "deprecated, true if the tag is deprecated.", + "type": "boolean" }, "digest": { - "title": "digest of the SBOM when ingested", - "type": "string" - }, - "format": { - "description": "format holds whether the SBOM is SPDX, CycloneDX, or other.", - "type": "string" - }, - "generatedAt": { - "description": "generated_at holds when the SBOM was generated.", - "format": "date-time", + "description": "digest, the digest of the manifest with this tag.", "type": "string" }, - "graph": { - "$ref": "#/components/schemas/chainguard.platform.tenant.ComponentGraph" - }, "id": { - "description": "id, The Sbom UIDP at which this Sbom resides in the hierarchy.", + "description": "id, identifier of this Tag, a UIDP under a Repo.", "type": "string" }, - "lastSeen": { + "lastUpdated": { + "description": "last time this tag was updated.", "format": "date-time", - "title": "last_seen tracks the timestamp at which this sbom was last seen.\nTODO(vaikas): Does this really make any sense?", "type": "string" }, "name": { - "description": "Name of the Sbom.", - "type": "string" - }, - "rawSbom": { - "description": "raw_sbom may or may not be useful in the long term, but for now to make\nprogress on this, we'll just yolo and serialize it here.", - "format": "byte", - "type": "string" - }, - "source": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.tenant.Sbom2.Source" - } - ], - "description": "source is where the SBOM came from. For example, we want to know if sbom\nwas generated by us, or ingested." - }, - "tool": { - "description": "tool holds the name of the tool that produced the SBOM.", + "description": "name, the unique name of the Tag.", "type": "string" } }, "type": "object" }, - "chainguard.platform.tenant.Sbom2.Source": { - "default": "UNKNOWN", - "description": "Type", - "enum": [ - "UNKNOWN", - "INGESTED", - "GENERATED" - ], - "type": "string" - }, - "chainguard.platform.tenant.Scanner": { + "chainguard.platform.registry.TagHistory": { "properties": { - "name": { - "description": "name contains the vendor name of the scanner.", + "digest": { "type": "string" }, - "version": { - "description": "version holds the version of the used scanner to generate the report.", + "updateTimestamp": { + "format": "date-time", "type": "string" } }, "type": "object" }, - "chainguard.platform.tenant.VulnReport": { + "chainguard.platform.registry.TagHistoryList": { "properties": { - "id": { - "description": "id, The VulnReport UIDP at which this VulnReport resides.", - "type": "string" - }, - "lastSeen": { - "description": "last_seen tracks the timestamp at which this vuln report was last seen.", - "format": "date-time", - "type": "string" - }, - "rawVulnReport": { - "description": "raw_vuln_report may or may not be useful in the long term, but for now to make\nprogress on this, we'll just yolo and serialize it here.", - "format": "byte", - "type": "string" - }, - "reportGeneration": { - "description": "report_generation tracks the timestamp at which this report was generated.", - "format": "date-time", - "type": "string" + "items": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.TagHistory" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.registry.TagList": { + "properties": { + "items": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.Tag" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.registry.UpdateStatus": { + "description": "UpdateStatus is the update status of a repo.", + "properties": { + "recentlyUpdated": { + "description": "Whether or not the repo has had a recent update.", + "type": "boolean" + } + }, + "type": "object" + }, + "chainguard.platform.registry.VulnCount": { + "properties": { + "count": { + "description": "count is the number of CVEs at this severity detected.", + "format": "int32", + "type": "integer" }, - "scanner": { + "severity": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.tenant.Scanner" + "$ref": "#/components/schemas/chainguard.platform.registry.Vulnerability.Severity" } ], - "description": "scanner contains some information about the scanner used to generate the report." + "title": "severity is the CVE severity being enumerated" + } + }, + "type": "object" + }, + "chainguard.platform.registry.VulnCountReport": { + "properties": { + "critCveIds": { + "description": "crit_cve_ids is a list of cumulative CVE IDs found in the image with a critical severity.", + "items": { + "type": "string" + }, + "type": "array" }, - "vulnerabilityDbLastBuildTime": { - "description": "vulnerability_db_last_build_time holds the time when the vulnerability database was built last time.", + "cveIds": { + "description": "cve_ids is a list of cumulative CVE IDs found in the image.", + "items": { + "type": "string" + }, + "type": "array" + }, + "date": { + "description": "date is when the image was scanned.", "format": "date-time", "type": "string" }, - "vulnerabilityMatches": { - "description": "Report's list of vulnerability matches(s).", + "highCveIds": { + "description": "high_cve_ids is a list of cumulative CVE IDs found in the image with a high severity.", "items": { - "$ref": "#/components/schemas/chainguard.platform.tenant.VulnerabilityMatch" + "type": "string" + }, + "type": "array" + }, + "lowCveIds": { + "description": "low_cve_ids is a list of cumulative CVE IDs found in the image with a low severity.", + "items": { + "type": "string" + }, + "type": "array" + }, + "medCveIds": { + "description": "med_cve_ids is a list of cumulative CVE IDs found in the image with a medium severity.", + "items": { + "type": "string" + }, + "type": "array" + }, + "negligibleCveIds": { + "description": "negligible_cve_ids is a list of cumulative CVE IDs found in the image with a negligible severity.", + "items": { + "type": "string" + }, + "type": "array" + }, + "repo": { + "description": "repo is the name of the image scanned.", + "type": "string" + }, + "sizeBytes": { + "description": "size_bytes is the size in bytes of the image at scan time.", + "format": "int64", + "type": "string" + }, + "tag": { + "description": "tag is the version of the image scanned.", + "type": "string" + }, + "unknownCveIds": { + "description": "unknown_cve_ids is a list of cumulative CVE IDs found in the image with an unknown severity.", + "items": { + "type": "string" + }, + "type": "array" + }, + "vulnCounts": { + "description": "vuln_counts enumerate the number of each CVE per severity found.", + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.VulnCount" }, "type": "array" } }, "type": "object" }, - "chainguard.platform.tenant.VulnerabilityMatch": { + "chainguard.platform.registry.VulnCountReportList": { "properties": { - "fix": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.tenant.Fix" - } - ], - "description": "Fix related data about this vulnerability." + "items": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.VulnCountReport" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.registry.VulnReport": { + "properties": { + "createdAt": { + "description": "created_at is the time the report was generated.", + "format": "date-time", + "type": "string" }, - "pkg": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.tenant.Package2" - } - ], - "description": "Package affected by this vulnerability." + "digest": { + "description": "digest is the exact digest of the scanned image.", + "type": "string" }, - "vulnerability": { + "scanner": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.tenant.VulnerabilityRecord" + "$ref": "#/components/schemas/chainguard.platform.registry.Scanner" } ], - "description": "Vulnerability holds information about the found vulnerability." + "description": "scanner is the details of the scanner used to generate the report." + }, + "vulnerabilities": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.Vulnerability" + }, + "title": "vulnerabilities are the found vulns in the scanned image.\nFor Create", + "type": "array" } }, "type": "object" }, - "chainguard.platform.tenant.VulnerabilityRecord": { + "chainguard.platform.registry.VulnReportList": { "properties": { - "advisories": { - "additionalProperties": { - "type": "string" + "items": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.registry.VulnReport" }, - "description": "advisories related to this vulnerability.", - "type": "object" - }, - "cpeUri": { - "description": "List of cpe_uri on which the vulnerability was found.", + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.registry.Vulnerability": { + "properties": { + "aliases": { + "description": "aliases are other identifiers for this vulnerability.", "items": { "type": "string" }, "type": "array" }, "cvss": { - "description": "List of cvss information about the exploitability of the vulnerability.", + "description": "List of CVSS information about the exploitability of the vulnerability.", "items": { - "$ref": "#/components/schemas/chainguard.platform.tenant.VulnerabilityRecord.Cvss" + "$ref": "#/components/schemas/chainguard.platform.registry.Vulnerability.CVSS" }, "type": "array" }, "description": { - "description": "a short description of this vulnerability.", + "description": "description is a short description of the vulnerability.", "type": "string" }, - "displayId": { - "description": "display_id is the normalized value of the vulnerability ID often defined by a CVE-ID.", + "details": { + "description": "details give additional textual details about the vulnerability.", "type": "string" }, + "fix": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.Vulnerability.Fix" + } + ], + "description": "fix is the version and state of a potential fix for this vulnerability." + }, "id": { - "description": "id of the vulnerability e.g. CVE_1231-12.", + "title": "The unique identifier for the vulnerability.\ne.g. CVE-2024-12345", "type": "string" }, - "relatedUrls": { - "description": "URLs related to this vulnerability.", + "locations": { + "description": "locations are paths affected by the vulnerability.", "items": { "type": "string" }, "type": "array" }, - "relatedVulnerabilities": { - "description": "related vulnerabilities to the main vulnerability reported here.", + "purls": { + "description": "purls are the package URLs of the affected packages.", "items": { - "$ref": "#/components/schemas/chainguard.platform.tenant.VulnerabilityRecord.RelatedVulnerability" + "type": "string" + }, + "type": "array" + }, + "relatedUrls": { + "description": "URLs related to this vulnerability.", + "items": { + "type": "string" }, "type": "array" }, "severity": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.tenant.VulnerabilityRecord.Severity" + "$ref": "#/components/schemas/chainguard.platform.registry.Vulnerability.Severity" } ], - "title": "severity is the value representing the severity of the vulnerability" - }, - "source": { - "description": "source from where the vulnerability information was obtained, e.g. nvd, github, osv.", - "type": "string" + "description": "severity is the value representing the severity of the vulnerability." } }, "type": "object" }, - "chainguard.platform.tenant.VulnerabilityRecord.Cvss": { + "chainguard.platform.registry.Vulnerability.CVSS": { "properties": { "score": { - "description": "CVSS score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.", + "description": "score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.", "type": "string" }, "version": { - "description": "CVSS version used to populate score and severity.", + "description": "version used to populate score and severity.", "type": "string" } }, "type": "object" }, - "chainguard.platform.tenant.VulnerabilityRecord.RelatedVulnerability": { + "chainguard.platform.registry.Vulnerability.Fix": { "properties": { - "id": { - "description": "ID of the vulnerability.", - "type": "string" + "state": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.registry.Vulnerability.Fix.State" + } + ], + "description": "state reflects the state of the fix, e.g. fixed, unknown, not-fixed, won't-fix." }, - "source": { - "description": "Source from where the vulnerability information was obtained, e.g. nvd, github, osv.", - "type": "string" - } + "versions": { + "description": "List of in versions of the package on which the vulnerability has been solved.", + "items": { + "type": "string" + }, + "type": "array" + } }, "type": "object" }, - "chainguard.platform.tenant.VulnerabilityRecord.Severity": { + "chainguard.platform.registry.Vulnerability.Fix.State": { + "default": "UNKNOWN", + "enum": [ + "UNKNOWN", + "FIXED", + "NOT_FIXED", + "WONT_FIX" + ], + "type": "string" + }, + "chainguard.platform.registry.Vulnerability.Severity": { "default": "UNKNOWN", "enum": [ "UNKNOWN", "LOW", "MEDIUM", "HIGH", - "CRITICAL" + "CRITICAL", + "NEGLIGIBLE" ], "type": "string" }, - "chainguard.platform.vulnerabilities.v1.Advisories.CreateAdvisoryEventBody": { + "chainguard.platform.skills.Entitlements.CreateBody": { + "type": "object" + }, + "chainguard.platform.skills.SkillEntitlement": { + "description": "SkillEntitlement records that an org is entitled to publish and pull\nskill artifacts via skills.cgr.dev.", "properties": { - "advisoryEvent": { - "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent" + "id": { + "description": "id is the uidp of the entitlement, a child of the org group.", + "type": "string" } }, "type": "object" }, - "chainguard.platform.vulnerabilities.v1.Advisories.UpdateAdvisoryEventBody": { + "chainguard.platform.skills.SkillEntitlementList": { "properties": { - "analysisNotPlanned": { - "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.AnalysisNotPlanned" + "items": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.skills.SkillEntitlement" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.tenant.ComponentGraph": { + "properties": { + "edges": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.tenant.ComponentGraph.Edge" + }, + "type": "array" }, - "author": { - "title": "author is the person who created this event", + "nodes": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.tenant.ComponentGraph.Node" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.tenant.ComponentGraph.Edge": { + "properties": { + "predicateId": { "type": "string" }, - "componentLocationChanged": { - "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.ComponentLocationChanged" - }, - "detection": { - "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.Detection" - }, - "falsePositiveDetermination": { - "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.FalsePositiveDetermination" - }, - "findings": { - "format": "byte", - "title": "findings is the JSON-encoded struct containing vulnerability findings", + "subjectId": { "type": "string" }, - "fixNotPlanned": { - "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.FixNotPlanned" - }, - "fixed": { - "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.Fixed" + "type": { + "$ref": "#/components/schemas/chainguard.platform.tenant.ComponentGraph.Edge.Type" + } + }, + "type": "object" + }, + "chainguard.platform.tenant.ComponentGraph.Edge.Type": { + "default": "UNKNOWN", + "description": "- GENERATED_FROM: and so on...; for inspiration, see https://spdx.github.io/spdx-spec/v2.3/relationships-between-SPDX-elements/", + "enum": [ + "UNKNOWN", + "DESCRIBES", + "CONTAINS", + "DEPENDS_ON", + "GENERATED_FROM" + ], + "type": "string" + }, + "chainguard.platform.tenant.ComponentGraph.Node": { + "properties": { + "file": { + "$ref": "#/components/schemas/chainguard.platform.tenant.File2" }, - "issue": { - "title": "issue is the original CVE Dashboard issue", + "package": { + "$ref": "#/components/schemas/chainguard.platform.tenant.Package2" + } + }, + "type": "object" + }, + "chainguard.platform.tenant.File2": { + "properties": { + "id": { "type": "string" }, - "patched": { - "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.Patched" - }, - "pendingUpstreamFix": { - "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.PendingUpstreamFix" - }, - "reviewer": { - "title": "reviewer is the person who reviewed this event", + "name": { "type": "string" }, - "status": { + "types": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.tenant.Fix": { + "properties": { + "state": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.ReviewStatus" + "$ref": "#/components/schemas/chainguard.platform.tenant.Fix.State" } ], - "title": "status is the status of the review" - }, - "timestamp": { - "format": "date-time", - "type": "string" + "description": "state reflects the state of the fix, e.g. fixed, unknown, not-fixed, won't-fix." }, - "truePositiveDetermination": { - "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.TruePositiveDetermination" + "versions": { + "description": "List of in versions of the package on which the vulnerability has been solved.", + "items": { + "type": "string" + }, + "type": "array" } }, "type": "object" }, - "chainguard.platform.vulnerabilities.v1.Advisories.UpdateBody": { + "chainguard.platform.tenant.Fix.State": { + "default": "UNKNOWN", + "enum": [ + "UNKNOWN", + "FIXED", + "NOT_FIXED", + "WONT_FIX" + ], + "type": "string" + }, + "chainguard.platform.tenant.Package2": { "properties": { - "advisoryId": { - "title": "advisory_id is the CGA identifier for the advisory", + "description": { "type": "string" }, - "aliases": { - "items": { - "type": "string" - }, - "title": "aliases are other vulnerability identifiers this advisory applies to", - "type": "array" + "id": { + "type": "string" }, - "artifactArchitecture": { - "title": "artifact_architecture is the architecture of the artifact", + "license": { "type": "string" }, - "artifactName": { - "title": "artifact_name is the artifact name (e.g., wheel, jar name)", + "name": { "type": "string" }, - "artifactType": { - "title": "artifact_type is the artifact type (e.g., apk, image, library)", + "purl": { "type": "string" }, - "author": { - "title": "For review process\nauthor is the person who created this event", + "version": { + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.tenant.Sbom2": { + "description": "Sbom represents a normalized SBOM that we have ingested into our datastore.\nThey are linked to Signatures via ID, as in they are 'children' of Signatures\nThere can be multiple of these that we keep.", + "properties": { + "authors": { + "description": "authors is zero or more authors concatenated.", "type": "string" }, - "componentLocation": { - "title": "component_location is the filesystem location of the component", + "description": { + "title": "Short description of the Sbom", "type": "string" }, - "componentName": { - "title": "component_name is the component within the subpackage", + "digest": { + "title": "digest of the SBOM when ingested", "type": "string" }, - "componentType": { - "title": "component_type is the language ecosystem (go-module, python, etc)", + "format": { + "description": "format holds whether the SBOM is SPDX, CycloneDX, or other.", "type": "string" }, - "createdAt": { + "generatedAt": { + "description": "generated_at holds when the SBOM was generated.", "format": "date-time", - "title": "created_at is when the advisory was created", "type": "string" }, - "deletedAt": { + "graph": { + "$ref": "#/components/schemas/chainguard.platform.tenant.ComponentGraph" + }, + "id": { + "description": "id, The Sbom UIDP at which this Sbom resides in the hierarchy.", + "type": "string" + }, + "lastSeen": { "format": "date-time", - "title": "deleted_at is when the advisory was deleted (if applicable)", + "title": "last_seen tracks the timestamp at which this sbom was last seen.\nTODO(vaikas): Does this really make any sense?", "type": "string" }, - "events": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent" - }, - "title": "events are advisory events associated with this advisory", - "type": "array" + "name": { + "description": "Name of the Sbom.", + "type": "string" }, - "legacyAdvisoryID": { - "title": "legacyAdvisoryID stores the advisory ID from the Github advisories repositories", + "rawSbom": { + "description": "raw_sbom may or may not be useful in the long term, but for now to make\nprogress on this, we'll just yolo and serialize it here.", + "format": "byte", "type": "string" }, - "updatedAt": { - "format": "date-time", - "title": "updated_at is when the advisory was last updated", + "source": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.tenant.Sbom2.Source" + } + ], + "description": "source is where the SBOM came from. For example, we want to know if sbom\nwas generated by us, or ingested." + }, + "tool": { + "description": "tool holds the name of the tool that produced the SBOM.", "type": "string" } }, "type": "object" }, - "chainguard.platform.vulnerabilities.v1.AdvisoriesList": { + "chainguard.platform.tenant.Sbom2.Source": { + "default": "UNKNOWN", + "description": "Type", + "enum": [ + "UNKNOWN", + "INGESTED", + "GENERATED" + ], + "type": "string" + }, + "chainguard.platform.tenant.Scanner": { + "properties": { + "name": { + "description": "name contains the vendor name of the scanner.", + "type": "string" + }, + "version": { + "description": "version holds the version of the used scanner to generate the report.", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.tenant.VulnReport": { "properties": { "id": { - "description": "ID of the group the advisories belong to, parent UIDP.", + "description": "id, The VulnReport UIDP at which this VulnReport resides.", "type": "string" }, - "items": { + "lastSeen": { + "description": "last_seen tracks the timestamp at which this vuln report was last seen.", + "format": "date-time", + "type": "string" + }, + "rawVulnReport": { + "description": "raw_vuln_report may or may not be useful in the long term, but for now to make\nprogress on this, we'll just yolo and serialize it here.", + "format": "byte", + "type": "string" + }, + "reportGeneration": { + "description": "report_generation tracks the timestamp at which this report was generated.", + "format": "date-time", + "type": "string" + }, + "scanner": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.tenant.Scanner" + } + ], + "description": "scanner contains some information about the scanner used to generate the report." + }, + "vulnerabilityDbLastBuildTime": { + "description": "vulnerability_db_last_build_time holds the time when the vulnerability database was built last time.", + "format": "date-time", + "type": "string" + }, + "vulnerabilityMatches": { + "description": "Report's list of vulnerability matches(s).", "items": { - "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.Advisory" + "$ref": "#/components/schemas/chainguard.platform.tenant.VulnerabilityMatch" }, "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.tenant.VulnerabilityMatch": { + "properties": { + "fix": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.tenant.Fix" + } + ], + "description": "Fix related data about this vulnerability." }, - "nextPageToken": { - "title": "next_page_token is the token to use for the next page of results", - "type": "string" + "pkg": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.tenant.Package2" + } + ], + "description": "Package affected by this vulnerability." }, - "totalCount": { - "format": "int64", - "title": "total_count is the total number of advisories matching the filter (optional)", - "type": "string" + "vulnerability": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.tenant.VulnerabilityRecord" + } + ], + "description": "Vulnerability holds information about the found vulnerability." } }, "type": "object" }, - "chainguard.platform.vulnerabilities.v1.Advisory": { + "chainguard.platform.tenant.VulnerabilityRecord": { "properties": { - "advisoryId": { - "title": "advisory_id is the CGA identifier for the advisory", - "type": "string" + "advisories": { + "additionalProperties": { + "type": "string" + }, + "description": "advisories related to this vulnerability.", + "type": "object" }, - "aliases": { + "cpeUri": { + "description": "List of cpe_uri on which the vulnerability was found.", "items": { "type": "string" }, - "title": "aliases are other vulnerability identifiers this advisory applies to", "type": "array" }, - "artifactArchitecture": { - "title": "artifact_architecture is the architecture of the artifact", - "type": "string" - }, - "artifactName": { - "title": "artifact_name is the artifact name (e.g., wheel, jar name)", - "type": "string" - }, - "artifactType": { - "title": "artifact_type is the artifact type (e.g., apk, image, library)", - "type": "string" - }, - "author": { - "title": "For review process\nauthor is the person who created this event", - "type": "string" - }, - "componentLocation": { - "title": "component_location is the filesystem location of the component", - "type": "string" + "cvss": { + "description": "List of cvss information about the exploitability of the vulnerability.", + "items": { + "$ref": "#/components/schemas/chainguard.platform.tenant.VulnerabilityRecord.Cvss" + }, + "type": "array" }, - "componentName": { - "title": "component_name is the component within the subpackage", + "description": { + "description": "a short description of this vulnerability.", "type": "string" }, - "componentType": { - "title": "component_type is the language ecosystem (go-module, python, etc)", + "displayId": { + "description": "display_id is the normalized value of the vulnerability ID often defined by a CVE-ID.", "type": "string" }, - "createdAt": { - "format": "date-time", - "title": "created_at is when the advisory was created", + "id": { + "description": "id of the vulnerability e.g. CVE_1231-12.", "type": "string" }, - "deletedAt": { - "format": "date-time", - "title": "deleted_at is when the advisory was deleted (if applicable)", - "type": "string" + "relatedUrls": { + "description": "URLs related to this vulnerability.", + "items": { + "type": "string" + }, + "type": "array" }, - "events": { + "relatedVulnerabilities": { + "description": "related vulnerabilities to the main vulnerability reported here.", "items": { - "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent" + "$ref": "#/components/schemas/chainguard.platform.tenant.VulnerabilityRecord.RelatedVulnerability" }, - "title": "events are advisory events associated with this advisory", "type": "array" }, - "id": { - "description": "id is the UIDP for the Advisory.", + "severity": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.tenant.VulnerabilityRecord.Severity" + } + ], + "title": "severity is the value representing the severity of the vulnerability" + }, + "source": { + "description": "source from where the vulnerability information was obtained, e.g. nvd, github, osv.", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.tenant.VulnerabilityRecord.Cvss": { + "properties": { + "score": { + "description": "CVSS score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.", "type": "string" }, - "legacyAdvisoryID": { - "title": "legacyAdvisoryID stores the advisory ID from the Github advisories repositories", + "version": { + "description": "CVSS version used to populate score and severity.", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.tenant.VulnerabilityRecord.RelatedVulnerability": { + "properties": { + "id": { + "description": "ID of the vulnerability.", "type": "string" }, - "updatedAt": { - "format": "date-time", - "title": "updated_at is when the advisory was last updated", + "source": { + "description": "Source from where the vulnerability information was obtained, e.g. nvd, github, osv.", "type": "string" } }, "type": "object" }, - "chainguard.platform.vulnerabilities.v1.AdvisoryEvent": { + "chainguard.platform.tenant.VulnerabilityRecord.Severity": { + "default": "UNKNOWN", + "enum": [ + "UNKNOWN", + "LOW", + "MEDIUM", + "HIGH", + "CRITICAL" + ], + "type": "string" + }, + "chainguard.platform.vulnerabilities.v1.Advisories.CreateAdvisoryEventBody": { + "properties": { + "advisoryEvent": { + "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent" + } + }, + "type": "object" + }, + "chainguard.platform.vulnerabilities.v1.Advisories.UpdateAdvisoryEventBody": { "properties": { "analysisNotPlanned": { "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.AnalysisNotPlanned" @@ -5661,10 +6176,6 @@ "fixed": { "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.Fixed" }, - "id": { - "description": "id is the UIDP of this event, child of Advisory UIDP it belongs to.", - "type": "string" - }, "issue": { "title": "issue is the original CVE Dashboard issue", "type": "string" @@ -5697,26 +6208,259 @@ }, "type": "object" }, - "chainguard.platform.vulnerabilities.v1.AdvisoryEvent.AnalysisNotPlanned": { + "chainguard.platform.vulnerabilities.v1.Advisories.UpdateBody": { "properties": { - "note": { + "advisoryId": { + "title": "advisory_id is the CGA identifier for the advisory", "type": "string" - } - }, - "type": "object" - }, - "chainguard.platform.vulnerabilities.v1.AdvisoryEvent.ComponentLocationChanged": { - "properties": { - "newLocation": { + }, + "aliases": { + "items": { + "type": "string" + }, + "title": "aliases are other vulnerability identifiers this advisory applies to", + "type": "array" + }, + "artifactArchitecture": { + "title": "artifact_architecture is the architecture of the artifact", "type": "string" }, - "note": { + "artifactName": { + "title": "artifact_name is the artifact name (e.g., wheel, jar name)", "type": "string" }, - "previousLocation": { + "artifactType": { + "title": "artifact_type is the artifact type (e.g., apk, image, library)", "type": "string" - } - }, + }, + "author": { + "title": "For review process\nauthor is the person who created this event", + "type": "string" + }, + "componentLocation": { + "title": "component_location is the filesystem location of the component", + "type": "string" + }, + "componentName": { + "title": "component_name is the component within the subpackage", + "type": "string" + }, + "componentType": { + "title": "component_type is the language ecosystem (go-module, python, etc)", + "type": "string" + }, + "createdAt": { + "format": "date-time", + "title": "created_at is when the advisory was created", + "type": "string" + }, + "deletedAt": { + "format": "date-time", + "title": "deleted_at is when the advisory was deleted (if applicable)", + "type": "string" + }, + "events": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent" + }, + "title": "events are advisory events associated with this advisory", + "type": "array" + }, + "legacyAdvisoryID": { + "title": "legacyAdvisoryID stores the advisory ID from the Github advisories repositories", + "type": "string" + }, + "updatedAt": { + "format": "date-time", + "title": "updated_at is when the advisory was last updated", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.vulnerabilities.v1.AdvisoriesList": { + "properties": { + "id": { + "description": "ID of the group the advisories belong to, parent UIDP.", + "type": "string" + }, + "items": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.Advisory" + }, + "type": "array" + }, + "nextPageToken": { + "title": "next_page_token is the token to use for the next page of results", + "type": "string" + }, + "totalCount": { + "format": "int64", + "title": "total_count is the total number of advisories matching the filter (optional)", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.vulnerabilities.v1.Advisory": { + "properties": { + "advisoryId": { + "title": "advisory_id is the CGA identifier for the advisory", + "type": "string" + }, + "aliases": { + "items": { + "type": "string" + }, + "title": "aliases are other vulnerability identifiers this advisory applies to", + "type": "array" + }, + "artifactArchitecture": { + "title": "artifact_architecture is the architecture of the artifact", + "type": "string" + }, + "artifactName": { + "title": "artifact_name is the artifact name (e.g., wheel, jar name)", + "type": "string" + }, + "artifactType": { + "title": "artifact_type is the artifact type (e.g., apk, image, library)", + "type": "string" + }, + "author": { + "title": "For review process\nauthor is the person who created this event", + "type": "string" + }, + "componentLocation": { + "title": "component_location is the filesystem location of the component", + "type": "string" + }, + "componentName": { + "title": "component_name is the component within the subpackage", + "type": "string" + }, + "componentType": { + "title": "component_type is the language ecosystem (go-module, python, etc)", + "type": "string" + }, + "createdAt": { + "format": "date-time", + "title": "created_at is when the advisory was created", + "type": "string" + }, + "deletedAt": { + "format": "date-time", + "title": "deleted_at is when the advisory was deleted (if applicable)", + "type": "string" + }, + "events": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent" + }, + "title": "events are advisory events associated with this advisory", + "type": "array" + }, + "id": { + "description": "id is the UIDP for the Advisory.", + "type": "string" + }, + "legacyAdvisoryID": { + "title": "legacyAdvisoryID stores the advisory ID from the Github advisories repositories", + "type": "string" + }, + "updatedAt": { + "format": "date-time", + "title": "updated_at is when the advisory was last updated", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.vulnerabilities.v1.AdvisoryEvent": { + "properties": { + "analysisNotPlanned": { + "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.AnalysisNotPlanned" + }, + "author": { + "title": "author is the person who created this event", + "type": "string" + }, + "componentLocationChanged": { + "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.ComponentLocationChanged" + }, + "detection": { + "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.Detection" + }, + "falsePositiveDetermination": { + "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.FalsePositiveDetermination" + }, + "findings": { + "format": "byte", + "title": "findings is the JSON-encoded struct containing vulnerability findings", + "type": "string" + }, + "fixNotPlanned": { + "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.FixNotPlanned" + }, + "fixed": { + "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.Fixed" + }, + "id": { + "description": "id is the UIDP of this event, child of Advisory UIDP it belongs to.", + "type": "string" + }, + "issue": { + "title": "issue is the original CVE Dashboard issue", + "type": "string" + }, + "patched": { + "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.Patched" + }, + "pendingUpstreamFix": { + "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.PendingUpstreamFix" + }, + "reviewer": { + "title": "reviewer is the person who reviewed this event", + "type": "string" + }, + "status": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.ReviewStatus" + } + ], + "title": "status is the status of the review" + }, + "timestamp": { + "format": "date-time", + "type": "string" + }, + "truePositiveDetermination": { + "$ref": "#/components/schemas/chainguard.platform.vulnerabilities.v1.AdvisoryEvent.TruePositiveDetermination" + } + }, + "type": "object" + }, + "chainguard.platform.vulnerabilities.v1.AdvisoryEvent.AnalysisNotPlanned": { + "properties": { + "note": { + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.vulnerabilities.v1.AdvisoryEvent.ComponentLocationChanged": { + "properties": { + "newLocation": { + "type": "string" + }, + "note": { + "type": "string" + }, + "previousLocation": { + "type": "string" + } + }, "type": "object" }, "chainguard.platform.vulnerabilities.v1.AdvisoryEvent.Detection": { @@ -5925,29 +6669,1056 @@ "type": "string" } }, - "type": "object" + "type": "object" + } + } + }, + "info": { + "title": "Chainguard API v1", + "version": "v1" + }, + "openapi": "3.0.3", + "paths": { + "/actions/v1/authorize/oidc": { + "post": { + "description": "AuthorizeWithOIDC verifies a GitHub Actions OIDC ID token. The\ntoken is read from the `Authorization: Bearer \u003cjwt\u003e` gRPC\nmetadata header (or the equivalent HTTP header on the gateway\npath). The request body never carries the token.", + "operationId": "ActionsAuthorization_AuthorizeWithOIDC", + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.actions.AuthorizeWithOIDCRequest" + } + } + }, + "description": "AuthorizeWithOIDCRequest carries no token. The OIDC ID token is\nread from the `Authorization: Bearer \u003cjwt\u003e` gRPC metadata header.\nThe set of accepted audiences is fixed by the server; the caller\ncannot influence it.", + "required": true, + "x-originalParamName": "body" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.actions.AuthorizationResponse" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Authorize With OIDC", + "tags": [ + "ActionsAuthorization" + ] + } + }, + "/actions/v1/ca": { + "get": { + "description": "GetCACert returns the active signer's CA cert as PEM. External\nverifiers consume this to validate attestation leaf certs\noffline. For verification across a key-rotation overlap, prefer\nGetTrustedKeys — GetCACert reflects only the *current* signing\nkey.", + "operationId": "ActionsAuthorization_GetCACert", + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.actions.CACertResponse" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Get CA Cert", + "tags": [ + "ActionsAuthorization" + ] + } + }, + "/actions/v1/challenge/issue": { + "post": { + "description": "IssueChallenge mints a short-lived X.509 leaf cert bound to a\nspecific GitHub Actions run. The server validates the run exists\nand is in progress by querying the GitHub API. The workflow is\nexpected to upload the returned cert as a GitHub Actions artifact\nwhose name starts with `chainguard-actions-client`, so a later\nVerifyChallenge call can fetch and confirm origin. The server\nkeeps no state between Issue and Verify — the cert is\nself-contained.", + "operationId": "ActionsAuthorization_IssueChallenge", + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.actions.IssueChallengeRequest" + } + } + }, + "description": "IssueChallengeRequest names the GitHub Actions run for which a\nchallenge cert is being requested. The server treats these as\nclaims to bind into the leaf cert's URI SAN; trust does not arrive\nuntil the subsequent VerifyChallenge call confirms the cert\nappeared as an artifact in that run's actual artifact listing.", + "required": true, + "x-originalParamName": "body" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.actions.IssueChallengeResponse" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Issue Challenge", + "tags": [ + "ActionsAuthorization" + ] + } + }, + "/actions/v1/challenge/verify": { + "post": { + "description": "VerifyChallenge lists the named run's artifacts via the GitHub\nAPI, downloads any whose name starts with\n`chainguard-actions-client`, and accepts the first whose cert is\nsigned by a currently-trusted KMS key, is unexpired, and is bound\nto the requested (repository, run_id, run_attempt). The request\ndoes NOT carry the cert — only run identity. Replay across runs\nis prevented because artifacts are scoped to the run they were\nuploaded from.", + "operationId": "ActionsAuthorization_VerifyChallenge", + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.actions.VerifyChallengeRequest" + } + } + }, + "description": "VerifyChallengeRequest names the run to verify. The server lists\nthe run's GitHub Actions artifacts, downloads any whose name starts\nwith `chainguard-actions-client`, and looks for one whose\ncertificate is signed by the server's CA and whose URI SAN matches\nthis run identity. The client cannot influence which artifact is\nchecked.", + "required": true, + "x-originalParamName": "body" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.actions.AuthorizationResponse" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Verify Challenge", + "tags": [ + "ActionsAuthorization" + ] + } + }, + "/actions/v1/record": { + "post": { + "description": "Behavior depends on the `Authorization: Bearer \u003cjwt\u003e` header:\n - Header absent (or non-Bearer scheme): the request body's\n `repository` field is REQUIRED and taken as-is; the event is\n recorded as unverified. Lets forked-PR workflows (which\n cannot mint an OIDC token) still self-identify.\n - Header present and verifies: the request body's `repository`\n field is IGNORED and the repository is taken from the\n verified token's claim instead; the event is recorded as\n verified with the token's claims attached.\n - Header present but fails to verify: rejected with\n codes.PermissionDenied. The caller claimed an identity and\n we won't silently downgrade that to unverified.\n\nRepeated calls with the same token are allowed (no replay check)\nso a long-running workflow can record multiple events.", + "operationId": "Actions_Record", + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.actions.RecordRequest" + } + } + }, + "description": "- Verified call (valid bearer presented): the `repository` field\n is IGNORED. The server takes the repository slug from the\n verified token's `repository` claim instead — that value is\n authoritative, and accepting a request-supplied one would just\n create a way to lie.\n - Unverified call (no bearer): the `repository` field is REQUIRED\n and is taken as-is. The recorded event is marked unverified.\n\nThere are no other caller-supplied fields — no metrics, no\nattributes, no free-form text. The recording is internal: the\nserver keeps a usage record per repository (today via structured\nlogging), and the response is empty.", + "required": true, + "x-originalParamName": "body" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.actions.RecordResponse" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Record", + "tags": [ + "Actions" + ] + } + }, + "/actions/v1/trusted-keys": { + "get": { + "description": "GetTrustedKeys returns every public key the server currently\ntrusts for verification, as a list of PEM-encoded PKIX\n`PUBLIC KEY` blocks. Includes the active signing key plus any\nadditional rotation-overlap keys configured at deploy time.", + "operationId": "ActionsAuthorization_GetTrustedKeys", + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.actions.TrustedKeysResponse" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Get Trusted Keys", + "tags": [ + "ActionsAuthorization" + ] + } + }, + "/advisory/v1/documents": { + "get": { + "operationId": "SecurityAdvisory_ListDocuments", + "parameters": [ + { + "description": "id is the id of a package.", + "in": "query", + "name": "id", + "schema": { + "type": "string" + } + }, + { + "in": "query", + "name": "cves", + "schema": { + "items": { + "type": "string" + }, + "type": "array" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.advisory.DocumentList" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "List Documents", + "tags": [ + "SecurityAdvisory" + ] + } + }, + "/advisory/v1/images/resolved_vulns": { + "get": { + "operationId": "SecurityAdvisory_ListResolvedVulnsReports", + "parameters": [ + { + "description": "from defines the beginning of the date range of advisory events, inclusive.", + "in": "query", + "name": "from", + "schema": { + "format": "date-time", + "type": "string" + } + }, + { + "description": "end defines the end of the date range of advisory events, inclusive.", + "in": "query", + "name": "to", + "schema": { + "format": "date-time", + "type": "string" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.advisory.ResolvedVulnsReportList" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "List Resolved Vulns Reports", + "tags": [ + "SecurityAdvisory" + ] + } + }, + "/advisory/v1/metadata": { + "get": { + "operationId": "SecurityAdvisory_ListVulnerabilityMetadata", + "parameters": [ + { + "description": "The exact id of a vuln (eg. CVE-1234).", + "in": "query", + "name": "id", + "schema": { + "type": "string" + } + }, + { + "description": "A list of exact ids of vulns to fetch metadata for.\nThis is restricted to 1000 unique ids per request.", + "in": "query", + "name": "ids", + "schema": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + { + "description": "Maximum number of results to return per page.\nDefault: 50, Maximum: 200.", + "in": "query", + "name": "pageSize", + "schema": { + "format": "int32", + "type": "integer" + } + }, + { + "description": "Page token from a previous List response for pagination.\nOpaque token with 3-day expiration.", + "in": "query", + "name": "pageToken", + "schema": { + "type": "string" + } + }, + { + "description": "Order results by field. Format: \"field [asc|desc]\"\nDefault: \"id asc\"\nNote: Changing order_by between pages invalidates the page token.", + "in": "query", + "name": "orderBy", + "schema": { + "type": "string" + } + }, + { + "description": "Number of results to skip before returning.\nUsed for random-access pagination (jumping to arbitrary pages).\nCan be combined with page_token to skip from cursor position.\nMust be non-negative.", + "in": "query", + "name": "skip", + "schema": { + "format": "int32", + "type": "integer" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.advisory.VulnerabilityMetadataList" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "List Vulnerability Metadata", + "tags": [ + "SecurityAdvisory" + ] + } + }, + "/apk/v1/package-summaries": { + "get": { + "description": "ListAPKSummaries returns one summary entry per package name (latest version,\nall architectures aggregated). Supports prefix-match search via the query field.", + "operationId": "APK_ListAPKSummaries", + "parameters": [ + { + "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", + "in": "query", + "name": "uidp.ancestorsOf", + "schema": { + "type": "string" + } + }, + { + "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", + "in": "query", + "name": "uidp.descendantsOf", + "schema": { + "type": "string" + } + }, + { + "description": "children_of are groups reachable by directly proceeding from parent to children.", + "in": "query", + "name": "uidp.childrenOf", + "schema": { + "type": "string" + } + }, + { + "description": "in_root resticts responses to root level resources (organizations, user identities)", + "in": "query", + "name": "uidp.inRoot", + "schema": { + "type": "boolean" + } + }, + { + "description": "ids are a list of exact UIDPs of records.", + "in": "query", + "name": "uidp.ids", + "schema": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + { + "description": "query is a prefix match on package_name (e.g. \"bash\" matches \"bash\",\n\"bash-completion\", etc.). When empty, all packages are returned.", + "in": "query", + "name": "query", + "schema": { + "type": "string" + } + }, + { + "description": "architecture optionally restricts results to a specific architecture.", + "in": "query", + "name": "architecture", + "schema": { + "type": "string" + } + }, + { + "description": "origin optionally restricts results to packages with the given origin.", + "in": "query", + "name": "origin", + "schema": { + "type": "string" + } + }, + { + "description": "page_size is the maximum number of summaries to return per page.\nDefault: 50, Maximum: 200.", + "in": "query", + "name": "pageSize", + "schema": { + "format": "int32", + "type": "integer" + } + }, + { + "description": "page_token is the opaque token returned by a previous ListAPKSummaries\ncall. Provide it to retrieve the next page of results.", + "in": "query", + "name": "pageToken", + "schema": { + "type": "string" + } + }, + { + "description": "order_by controls the sort order. Format: \"field [asc|desc]\".\nSupported fields: \"package_name\", \"build_time\".\nDefault: \"package_name asc\".", + "in": "query", + "name": "orderBy", + "schema": { + "type": "string" + } + }, + { + "description": "Number of results to skip (for random-access pagination).\nApplied after cursor positioning.", + "in": "query", + "name": "skip", + "schema": { + "format": "int32", + "type": "integer" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.apk.APKPackageSummaryList" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "List APK Summaries", + "tags": [ + "APK" + ] + } + }, + "/apk/v1/packages": { + "get": { + "description": "ListAPKs lists all APKs that match the filter.", + "operationId": "APK_ListAPKs", + "parameters": [ + { + "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", + "in": "query", + "name": "uidp.ancestorsOf", + "schema": { + "type": "string" + } + }, + { + "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", + "in": "query", + "name": "uidp.descendantsOf", + "schema": { + "type": "string" + } + }, + { + "description": "children_of are groups reachable by directly proceeding from parent to children.", + "in": "query", + "name": "uidp.childrenOf", + "schema": { + "type": "string" + } + }, + { + "description": "in_root resticts responses to root level resources (organizations, user identities)", + "in": "query", + "name": "uidp.inRoot", + "schema": { + "type": "boolean" + } + }, + { + "description": "ids are a list of exact UIDPs of records.", + "in": "query", + "name": "uidp.ids", + "schema": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + { + "description": "A name to filter by.", + "in": "query", + "name": "packageName", + "schema": { + "type": "string" + } + }, + { + "description": "An architecture to filter by (e.g., x86_64 or aarch64).", + "in": "query", + "name": "architecture", + "schema": { + "type": "string" + } + }, + { + "description": "Only return the most recently updated version of each package/architecture.", + "in": "query", + "name": "mostRecentlyUpdated", + "schema": { + "type": "boolean" + } + }, + { + "description": "Filter by origin package. Returns all packages (including subpackages)\nthat have this origin. For origin packages, origin equals package_name.", + "in": "query", + "name": "origin", + "schema": { + "type": "string" + } + }, + { + "description": "Pagination: Maximum number of results to return per page.\nWhen set to 0 and page_token is empty, all results are returned (backward compatible).\nDefault: 50, Maximum: 200", + "in": "query", + "name": "pageSize", + "schema": { + "format": "int32", + "type": "integer" + } + }, + { + "description": "Pagination: Opaque token for retrieving the next page of results.\nUse the value from next_page_token in the previous response.", + "in": "query", + "name": "pageToken", + "schema": { + "type": "string" + } + }, + { + "description": "Order results by field. Format: \"field [asc|desc]\"\nSupported fields: \"uid\", \"package_name\", \"build_time\"\nExamples: \"package_name asc\", \"build_time desc\"\nDefault: sorted by uid", + "in": "query", + "name": "orderBy", + "schema": { + "type": "string" + } + }, + { + "description": "Number of results to skip (for random-access pagination).\nApplied after cursor positioning.", + "in": "query", + "name": "skip", + "schema": { + "format": "int32", + "type": "integer" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.apk.APKList" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "List APKs", + "tags": [ + "APK" + ] + } + }, + "/apko/v1/build/{repoUidp}": { + "post": { + "operationId": "Apko_BuildImage", + "parameters": [ + { + "description": "Repo UIDP to push to.", + "in": "path", + "name": "repoUidp", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.registry.Apko.BuildImageBody" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.registry.BuildImageResponse" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Build Image", + "tags": [ + "Apko" + ] + } + }, + "/apko/v1/resolve/{repoUidp}": { + "post": { + "operationId": "Apko_ResolveConfig", + "parameters": [ + { + "description": "The repository context in which to perform the resolution.\nThis is relevant for how we authenticate for APK access.", + "in": "path", + "name": "repoUidp", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.registry.Apko.ResolveConfigBody" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Resolve Config", + "tags": [ + "Apko" + ] + } + }, + "/argos/v1/documents": { + "get": { + "operationId": "ArgosDocuments_List", + "parameters": [ + { + "description": "Exact match on document UIDP.", + "in": "query", + "name": "id", + "schema": { + "type": "string" + } + }, + { + "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", + "in": "query", + "name": "uidp.ancestorsOf", + "schema": { + "type": "string" + } + }, + { + "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", + "in": "query", + "name": "uidp.descendantsOf", + "schema": { + "type": "string" + } + }, + { + "description": "children_of are groups reachable by directly proceeding from parent to children.", + "in": "query", + "name": "uidp.childrenOf", + "schema": { + "type": "string" + } + }, + { + "description": "in_root resticts responses to root level resources (organizations, user identities)", + "in": "query", + "name": "uidp.inRoot", + "schema": { + "type": "boolean" + } + }, + { + "description": "ids are a list of exact UIDPs of records.", + "in": "query", + "name": "uidp.ids", + "schema": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + { + "description": "Filter to documents in a specific lifecycle state.\nSTATUS_UNSPECIFIED (the default) returns documents in any state.\n\n - STATUS_PENDING: Payload received; pending downstream processing.\n - STATUS_READY: Document is fully usable.\n - STATUS_FAILED: Document processing failed; the document is unusable.\n - STATUS_FALSE_POSITIVE: Processing determined the finding is not a true positive.", + "in": "query", + "name": "status", + "schema": { + "default": "STATUS_UNSPECIFIED", + "enum": [ + "STATUS_UNSPECIFIED", + "STATUS_PENDING", + "STATUS_READY", + "STATUS_FAILED", + "STATUS_FALSE_POSITIVE" + ], + "type": "string" + } + }, + { + "description": "created_since returns documents created at or after the given time.", + "in": "query", + "name": "createdSince", + "schema": { + "format": "date-time", + "type": "string" + } + }, + { + "description": "created_before returns documents created at or before the given time.", + "in": "query", + "name": "createdBefore", + "schema": { + "format": "date-time", + "type": "string" + } + }, + { + "description": "Maximum number of results to return per page.\nDefault: 50, Maximum: 200.", + "in": "query", + "name": "pageSize", + "schema": { + "format": "int32", + "type": "integer" + } + }, + { + "description": "Page token from a previous List response for pagination.\nOpaque token; treat as a black box.", + "in": "query", + "name": "pageToken", + "schema": { + "type": "string" + } + }, + { + "description": "Order results by field. Format: \"field [asc|desc]\"\nDefault: \"uid_p asc\"\nNote: changing order_by between pages invalidates the page token.", + "in": "query", + "name": "orderBy", + "schema": { + "type": "string" + } + }, + { + "description": "Number of results to skip before returning. Used for random-access\npagination (jumping to arbitrary pages). Can be combined with\npage_token to skip from cursor position. Must be non-negative.", + "in": "query", + "name": "skip", + "schema": { + "format": "int32", + "type": "integer" + } + }, + { + "description": "Exact match on the document filename.", + "in": "query", + "name": "filename", + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.argos.ArgosDocumentList" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "List", + "tags": [ + "ArgosDocuments" + ] + } + }, + "/argos/v1/documents/{id}": { + "delete": { + "operationId": "ArgosDocuments_Delete", + "parameters": [ + { + "description": "id is the exact UIDP of the document to delete.", + "in": "path", + "name": "id", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "type": "object" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Delete", + "tags": [ + "ArgosDocuments" + ] } - } - }, - "info": { - "title": "Chainguard API v1", - "version": "v1" - }, - "openapi": "3.0.3", - "paths": { - "/actions/v1/authorize/oidc": { + }, + "/argos/v1/documents/{parentId}": { "post": { - "description": "AuthorizeWithOIDC verifies a GitHub Actions OIDC ID token. The\ntoken is read from the `Authorization: Bearer \u003cjwt\u003e` gRPC\nmetadata header (or the equivalent HTTP header on the gateway\npath). The request body never carries the token.", - "operationId": "ActionsAuthorization_AuthorizeWithOIDC", + "operationId": "ArgosDocuments_Create", + "parameters": [ + { + "description": "parent_id is the exact UIDP of the organization (root group) to nest this\ndocument under.", + "in": "path", + "name": "parentId", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], "requestBody": { "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.actions.AuthorizeWithOIDCRequest" + "$ref": "#/components/schemas/chainguard.platform.argos.ArgosDocuments.CreateBody" } } }, - "description": "AuthorizeWithOIDCRequest carries no token. The OIDC ID token is\nread from the `Authorization: Bearer \u003cjwt\u003e` gRPC metadata header.\nThe set of accepted audiences is fixed by the server; the caller\ncannot influence it.", "required": true, "x-originalParamName": "body" }, @@ -5956,7 +7727,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.actions.AuthorizationResponse" + "$ref": "#/components/schemas/chainguard.platform.argos.ArgosDocument" } } }, @@ -5973,22 +7744,34 @@ "description": "An unexpected error response." } }, - "summary": "Authorize With OIDC", + "summary": "Create", "tags": [ - "ActionsAuthorization" + "ArgosDocuments" ] } }, - "/actions/v1/ca": { + "/argos/v1/orgs/{parentId}/publicKey": { "get": { - "description": "GetCACert returns the active signer's CA cert as PEM. External\nverifiers consume this to validate attestation leaf certs\noffline. For verification across a key-rotation overlap, prefer\nGetTrustedKeys — GetCACert reflects only the *current* signing\nkey.", - "operationId": "ActionsAuthorization_GetCACert", + "description": "GetOrgPublicKey returns the PEM-encoded RSA-OAEP public key for the\ngiven organization. Clients fetch this once per upload destination and\nuse it to wrap a fresh per-document AES key client-side. The\ncorresponding private key never leaves Cloud KMS.", + "operationId": "ArgosDocuments_GetOrgPublicKey", + "parameters": [ + { + "description": "parent_id is the UIDP of the organization whose public key is requested.", + "in": "path", + "name": "parentId", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.actions.CACertResponse" + "$ref": "#/components/schemas/chainguard.platform.argos.ArgosOrgPublicKey" } } }, @@ -6005,25 +7788,23 @@ "description": "An unexpected error response." } }, - "summary": "Get CA Cert", + "summary": "Get Org Public Key", "tags": [ - "ActionsAuthorization" + "ArgosDocuments" ] } }, - "/actions/v1/challenge/issue": { + "/argos/v1/osv/query": { "post": { - "description": "IssueChallenge mints a short-lived X.509 leaf cert bound to a\nspecific GitHub Actions run. The server validates the run exists\nand is in progress by querying the GitHub API. The workflow is\nexpected to upload the returned cert as a GitHub Actions artifact\nwhose name starts with `chainguard-actions-client`, so a later\nVerifyChallenge call can fetch and confirm origin. The server\nkeeps no state between Issue and Verify — the cert is\nself-contained.", - "operationId": "ActionsAuthorization_IssueChallenge", + "operationId": "ArgosOSV_Query", "requestBody": { "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.actions.IssueChallengeRequest" + "$ref": "#/components/schemas/chainguard.platform.argos.OSVQueryRequest" } } }, - "description": "IssueChallengeRequest names the GitHub Actions run for which a\nchallenge cert is being requested. The server treats these as\nclaims to bind into the leaf cert's URI SAN; trust does not arrive\nuntil the subsequent VerifyChallenge call confirms the cert\nappeared as an artifact in that run's actual artifact listing.", "required": true, "x-originalParamName": "body" }, @@ -6032,7 +7813,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.actions.IssueChallengeResponse" + "$ref": "#/components/schemas/chainguard.platform.argos.OSVQueryResponse" } } }, @@ -6049,25 +7830,23 @@ "description": "An unexpected error response." } }, - "summary": "Issue Challenge", + "summary": "Query", "tags": [ - "ActionsAuthorization" + "ArgosOSV" ] } }, - "/actions/v1/challenge/verify": { + "/argos/v1/osv/querybatch": { "post": { - "description": "VerifyChallenge lists the named run's artifacts via the GitHub\nAPI, downloads any whose name starts with\n`chainguard-actions-client`, and accepts the first whose cert is\nsigned by a currently-trusted KMS key, is unexpired, and is bound\nto the requested (repository, run_id, run_attempt). The request\ndoes NOT carry the cert — only run identity. Replay across runs\nis prevented because artifacts are scoped to the run they were\nuploaded from.", - "operationId": "ActionsAuthorization_VerifyChallenge", + "operationId": "ArgosOSV_QueryBatch", "requestBody": { "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.actions.VerifyChallengeRequest" + "$ref": "#/components/schemas/chainguard.platform.argos.OSVQueryBatchRequest" } } }, - "description": "VerifyChallengeRequest names the run to verify. The server lists\nthe run's GitHub Actions artifacts, downloads any whose name starts\nwith `chainguard-actions-client`, and looks for one whose\ncertificate is signed by the server's CA and whose URI SAN matches\nthis run identity. The client cannot influence which artifact is\nchecked.", "required": true, "x-originalParamName": "body" }, @@ -6076,7 +7855,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.actions.AuthorizationResponse" + "$ref": "#/components/schemas/chainguard.platform.argos.OSVQueryBatchResponse" } } }, @@ -6093,25 +7872,139 @@ "description": "An unexpected error response." } }, - "summary": "Verify Challenge", + "summary": "Query Batch", "tags": [ - "ActionsAuthorization" + "ArgosOSV" ] } }, - "/actions/v1/record": { + "/argos/v1/osv/vulns/{id}": { + "get": { + "operationId": "ArgosOSV_GetVuln", + "parameters": [ + { + "in": "path", + "name": "id", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.argos.OSVRecord" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Get Vuln", + "tags": [ + "ArgosOSV" + ] + } + }, + "/auth/v1/delete/{id}": { + "delete": { + "operationId": "Auth_Delete", + "parameters": [ + { + "description": "id is the exact UID of the identity to be deleted from the platform.\nIt must be a root identity, and the UID must match the subject\nof the token.", + "in": "path", + "name": "id", + "required": true, + "schema": { + "pattern": "[^/]+", + "type": "string" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "type": "object" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Delete", + "tags": [ + "Auth" + ] + } + }, + "/auth/v1/ok": { + "get": { + "operationId": "Auth_Validate", + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.auth.WhoAmI" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Validate", + "tags": [ + "Auth" + ] + } + }, + "/auth/v1/register": { "post": { - "description": "Behavior depends on the `Authorization: Bearer \u003cjwt\u003e` header:\n - Header absent (or non-Bearer scheme): the request body's\n `repository` field is REQUIRED and taken as-is; the event is\n recorded as unverified. Lets forked-PR workflows (which\n cannot mint an OIDC token) still self-identify.\n - Header present and verifies: the request body's `repository`\n field is IGNORED and the repository is taken from the\n verified token's claim instead; the event is recorded as\n verified with the token's claims attached.\n - Header present but fails to verify: rejected with\n codes.PermissionDenied. The caller claimed an identity and\n we won't silently downgrade that to unverified.\n\nRepeated calls with the same token are allowed (no replay check)\nso a long-running workflow can record multiple events.", - "operationId": "Actions_Record", + "operationId": "Auth_Register", "requestBody": { "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.actions.RecordRequest" + "$ref": "#/components/schemas/chainguard.platform.auth.RegistrationRequest" } } }, - "description": "- Verified call (valid bearer presented): the `repository` field\n is IGNORED. The server takes the repository slug from the\n verified token's `repository` claim instead — that value is\n authoritative, and accepting a request-supplied one would just\n create a way to lie.\n - Unverified call (no bearer): the `repository` field is REQUIRED\n and is taken as-is. The recorded event is marked unverified.\n\nThere are no other caller-supplied fields — no metrics, no\nattributes, no free-form text. The recording is internal: the\nserver keeps a usage record per repository (today via structured\nlogging), and the response is empty.", "required": true, "x-originalParamName": "body" }, @@ -6120,7 +8013,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.actions.RecordResponse" + "$ref": "#/components/schemas/chainguard.platform.auth.Session" } } }, @@ -6136,23 +8029,75 @@ }, "description": "An unexpected error response." } - }, - "summary": "Record", - "tags": [ - "Actions" - ] - } - }, - "/actions/v1/trusted-keys": { - "get": { - "description": "GetTrustedKeys returns every public key the server currently\ntrusts for verification, as a list of PEM-encoded PKIX\n`PUBLIC KEY` blocks. Includes the active signing key plus any\nadditional rotation-overlap keys configured at deploy time.", - "operationId": "ActionsAuthorization_GetTrustedKeys", + }, + "summary": "Register", + "tags": [ + "Auth" + ] + } + }, + "/events/v1/subscriptions": { + "get": { + "operationId": "Subscriptions_List", + "parameters": [ + { + "description": "id is the exact UIDP of the record.", + "in": "query", + "name": "id", + "schema": { + "type": "string" + } + }, + { + "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", + "in": "query", + "name": "uidp.ancestorsOf", + "schema": { + "type": "string" + } + }, + { + "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", + "in": "query", + "name": "uidp.descendantsOf", + "schema": { + "type": "string" + } + }, + { + "description": "children_of are groups reachable by directly proceeding from parent to children.", + "in": "query", + "name": "uidp.childrenOf", + "schema": { + "type": "string" + } + }, + { + "description": "in_root resticts responses to root level resources (organizations, user identities)", + "in": "query", + "name": "uidp.inRoot", + "schema": { + "type": "boolean" + } + }, + { + "description": "ids are a list of exact UIDPs of records.", + "in": "query", + "name": "uidp.ids", + "schema": { + "items": { + "type": "string" + }, + "type": "array" + } + } + ], "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.actions.TrustedKeysResponse" + "$ref": "#/components/schemas/chainguard.platform.events.SubscriptionList" } } }, @@ -6169,33 +8114,25 @@ "description": "An unexpected error response." } }, - "summary": "Get Trusted Keys", + "summary": "List", "tags": [ - "ActionsAuthorization" + "Subscriptions" ] } }, - "/advisory/v1/documents": { - "get": { - "operationId": "SecurityAdvisory_ListDocuments", + "/events/v1/subscriptions/{id}": { + "delete": { + "operationId": "Subscriptions_Delete", "parameters": [ { - "description": "id is the id of a package.", - "in": "query", + "description": "id is the exact UIDP of the record.", + "in": "path", "name": "id", + "required": true, "schema": { + "pattern": ".+", "type": "string" } - }, - { - "in": "query", - "name": "cves", - "schema": { - "items": { - "type": "string" - }, - "type": "array" - } } ], "responses": { @@ -6203,7 +8140,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.advisory.DocumentList" + "type": "object" } } }, @@ -6220,41 +8157,45 @@ "description": "An unexpected error response." } }, - "summary": "List Documents", + "summary": "Delete", "tags": [ - "SecurityAdvisory" + "Subscriptions" ] } }, - "/advisory/v1/images/resolved_vulns": { - "get": { - "operationId": "SecurityAdvisory_ListResolvedVulnsReports", + "/events/v1/subscriptions/{parentId}": { + "post": { + "operationId": "Subscriptions_Create", "parameters": [ { - "description": "from defines the beginning of the date range of advisory events, inclusive.", - "in": "query", - "name": "from", - "schema": { - "format": "date-time", - "type": "string" - } - }, - { - "description": "end defines the end of the date range of advisory events, inclusive.", - "in": "query", - "name": "to", + "description": "parent_id, The Group UIDP path under which the new subscription is associated.", + "in": "path", + "name": "parentId", + "required": true, "schema": { - "format": "date-time", + "pattern": ".+", "type": "string" } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.events.Subscription" + } + } + }, + "description": "Subscription is the subscription to create;", + "required": true, + "x-originalParamName": "subscription" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.advisory.ResolvedVulnsReportList" + "$ref": "#/components/schemas/chainguard.platform.events.Subscription" } } }, @@ -6271,68 +8212,31 @@ "description": "An unexpected error response." } }, - "summary": "List Resolved Vulns Reports", + "summary": "Create", "tags": [ - "SecurityAdvisory" + "Subscriptions" ] } }, - "/advisory/v1/metadata": { + "/iam/v1/account_associations": { "get": { - "operationId": "SecurityAdvisory_ListVulnerabilityMetadata", + "operationId": "GroupAccountAssociations_List", "parameters": [ { - "description": "The exact id of a vuln (eg. CVE-1234).", - "in": "query", - "name": "id", - "schema": { - "type": "string" - } - }, - { - "description": "A list of exact ids of vulns to fetch metadata for.\nThis is restricted to 1000 unique ids per request.", - "in": "query", - "name": "ids", - "schema": { - "items": { - "type": "string" - }, - "type": "array" - } - }, - { - "description": "Maximum number of results to return per page.\nDefault: 50, Maximum: 200.", - "in": "query", - "name": "pageSize", - "schema": { - "format": "int32", - "type": "integer" - } - }, - { - "description": "Page token from a previous List response for pagination.\nOpaque token with 3-day expiration.", + "description": "group is the exact UIDP of the group whose associations we want to list.", "in": "query", - "name": "pageToken", + "name": "group", "schema": { "type": "string" } }, { - "description": "Order results by field. Format: \"field [asc|desc]\"\nDefault: \"id asc\"\nNote: Changing order_by between pages invalidates the page token.", + "description": "name is the exact name of the association.", "in": "query", - "name": "orderBy", + "name": "name", "schema": { "type": "string" } - }, - { - "description": "Number of results to skip before returning.\nUsed for random-access pagination (jumping to arbitrary pages).\nCan be combined with page_token to skip from cursor position.\nMust be non-negative.", - "in": "query", - "name": "skip", - "schema": { - "format": "int32", - "type": "integer" - } } ], "responses": { @@ -6340,7 +8244,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.advisory.VulnerabilityMetadataList" + "$ref": "#/components/schemas/chainguard.platform.iam.AccountAssociationsList" } } }, @@ -6357,116 +8261,24 @@ "description": "An unexpected error response." } }, - "summary": "List Vulnerability Metadata", + "summary": "List", "tags": [ - "SecurityAdvisory" + "GroupAccountAssociations" ] } }, - "/apk/v1/package-summaries": { - "get": { - "description": "ListAPKSummaries returns one summary entry per package name (latest version,\nall architectures aggregated). Supports prefix-match search via the query field.", - "operationId": "APK_ListAPKSummaries", + "/iam/v1/account_associations/{group}": { + "delete": { + "operationId": "GroupAccountAssociations_Delete", "parameters": [ { - "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", - "in": "query", - "name": "uidp.ancestorsOf", - "schema": { - "type": "string" - } - }, - { - "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", - "in": "query", - "name": "uidp.descendantsOf", - "schema": { - "type": "string" - } - }, - { - "description": "children_of are groups reachable by directly proceeding from parent to children.", - "in": "query", - "name": "uidp.childrenOf", - "schema": { - "type": "string" - } - }, - { - "description": "in_root resticts responses to root level resources (organizations, user identities)", - "in": "query", - "name": "uidp.inRoot", - "schema": { - "type": "boolean" - } - }, - { - "description": "ids are a list of exact UIDPs of records.", - "in": "query", - "name": "uidp.ids", - "schema": { - "items": { - "type": "string" - }, - "type": "array" - } - }, - { - "description": "query is a prefix match on package_name (e.g. \"bash\" matches \"bash\",\n\"bash-completion\", etc.). When empty, all packages are returned.", - "in": "query", - "name": "query", - "schema": { - "type": "string" - } - }, - { - "description": "architecture optionally restricts results to a specific architecture.", - "in": "query", - "name": "architecture", - "schema": { - "type": "string" - } - }, - { - "description": "origin optionally restricts results to packages with the given origin.", - "in": "query", - "name": "origin", - "schema": { - "type": "string" - } - }, - { - "description": "page_size is the maximum number of summaries to return per page.\nDefault: 50, Maximum: 200.", - "in": "query", - "name": "pageSize", - "schema": { - "format": "int32", - "type": "integer" - } - }, - { - "description": "page_token is the opaque token returned by a previous ListAPKSummaries\ncall. Provide it to retrieve the next page of results.", - "in": "query", - "name": "pageToken", - "schema": { - "type": "string" - } - }, - { - "description": "order_by controls the sort order. Format: \"field [asc|desc]\".\nSupported fields: \"package_name\", \"build_time\".\nDefault: \"package_name asc\".", - "in": "query", - "name": "orderBy", - "schema": { - "type": "string" - } - }, - { - "description": "Number of results to skip (for random-access pagination).\nApplied after cursor positioning.", - "in": "query", - "name": "skip", + "description": "group is the exact UIDP of the group whose associations we want to delete.", + "in": "path", + "name": "group", + "required": true, "schema": { - "format": "int32", - "type": "integer" + "pattern": ".+", + "type": "string" } } ], @@ -6475,7 +8287,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.apk.APKPackageSummaryList" + "type": "object" } } }, @@ -6492,133 +8304,42 @@ "description": "An unexpected error response." } }, - "summary": "List APK Summaries", + "summary": "Delete", "tags": [ - "APK" + "GroupAccountAssociations" ] - } - }, - "/apk/v1/packages": { - "get": { - "description": "ListAPKs lists all APKs that match the filter.", - "operationId": "APK_ListAPKs", + }, + "post": { + "operationId": "GroupAccountAssociations_Create", "parameters": [ { - "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", - "in": "query", - "name": "uidp.ancestorsOf", - "schema": { - "type": "string" - } - }, - { - "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", - "in": "query", - "name": "uidp.descendantsOf", - "schema": { - "type": "string" - } - }, - { - "description": "children_of are groups reachable by directly proceeding from parent to children.", - "in": "query", - "name": "uidp.childrenOf", - "schema": { - "type": "string" - } - }, - { - "description": "in_root resticts responses to root level resources (organizations, user identities)", - "in": "query", - "name": "uidp.inRoot", - "schema": { - "type": "boolean" - } - }, - { - "description": "ids are a list of exact UIDPs of records.", - "in": "query", - "name": "uidp.ids", - "schema": { - "items": { - "type": "string" - }, - "type": "array" - } - }, - { - "description": "A name to filter by.", - "in": "query", - "name": "packageName", - "schema": { - "type": "string" - } - }, - { - "description": "An architecture to filter by (e.g., x86_64 or aarch64).", - "in": "query", - "name": "architecture", - "schema": { - "type": "string" - } - }, - { - "description": "Only return the most recently updated version of each package/architecture.", - "in": "query", - "name": "mostRecentlyUpdated", - "schema": { - "type": "boolean" - } - }, - { - "description": "Filter by origin package. Returns all packages (including subpackages)\nthat have this origin. For origin packages, origin equals package_name.", - "in": "query", - "name": "origin", - "schema": { - "type": "string" - } - }, - { - "description": "Pagination: Maximum number of results to return per page.\nWhen set to 0 and page_token is empty, all results are returned (backward compatible).\nDefault: 50, Maximum: 200", - "in": "query", - "name": "pageSize", - "schema": { - "format": "int32", - "type": "integer" - } - }, - { - "description": "Pagination: Opaque token for retrieving the next page of results.\nUse the value from next_page_token in the previous response.", - "in": "query", - "name": "pageToken", - "schema": { - "type": "string" - } - }, - { - "description": "Order results by field. Format: \"field [asc|desc]\"\nSupported fields: \"uid\", \"package_name\", \"build_time\"\nExamples: \"package_name asc\", \"build_time desc\"\nDefault: sorted by uid", - "in": "query", - "name": "orderBy", + "description": "group is the group with which this account information is associated.", + "in": "path", + "name": "group", + "required": true, "schema": { + "pattern": ".+", "type": "string" } - }, - { - "description": "Number of results to skip (for random-access pagination).\nApplied after cursor positioning.", - "in": "query", - "name": "skip", - "schema": { - "format": "int32", - "type": "integer" - } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.GroupAccountAssociations.CreateBody" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.apk.APKList" + "$ref": "#/components/schemas/chainguard.platform.iam.AccountAssociations" } } }, @@ -6635,20 +8356,18 @@ "description": "An unexpected error response." } }, - "summary": "List APKs", + "summary": "Create", "tags": [ - "APK" + "GroupAccountAssociations" ] - } - }, - "/apko/v1/build/{repoUidp}": { - "post": { - "operationId": "Apko_BuildImage", + }, + "put": { + "operationId": "GroupAccountAssociations_Update", "parameters": [ { - "description": "Repo UIDP to push to.", + "description": "group is the group with which this account information is associated.", "in": "path", - "name": "repoUidp", + "name": "group", "required": true, "schema": { "pattern": ".+", @@ -6660,7 +8379,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.registry.Apko.BuildImageBody" + "$ref": "#/components/schemas/chainguard.platform.iam.GroupAccountAssociations.UpdateBody" } } }, @@ -6672,7 +8391,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.registry.BuildImageResponse" + "$ref": "#/components/schemas/chainguard.platform.iam.AccountAssociations" } } }, @@ -6689,20 +8408,20 @@ "description": "An unexpected error response." } }, - "summary": "Build Image", + "summary": "Update", "tags": [ - "Apko" + "GroupAccountAssociations" ] } }, - "/apko/v1/resolve/{repoUidp}": { + "/iam/v1/account_associations/{group}:check": { "post": { - "operationId": "Apko_ResolveConfig", + "operationId": "GroupAccountAssociations_Check", "parameters": [ { - "description": "The repository context in which to perform the resolution.\nThis is relevant for how we authenticate for APK access.", + "description": "group is the exact UIDP of the group whose associations we want to check", "in": "path", - "name": "repoUidp", + "name": "group", "required": true, "schema": { "pattern": ".+", @@ -6714,7 +8433,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.registry.Apko.ResolveConfigBody" + "$ref": "#/components/schemas/chainguard.platform.iam.GroupAccountAssociations.CheckBody" } } }, @@ -6726,7 +8445,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.registry.ApkoConfig" + "$ref": "#/components/schemas/chainguard.platform.iam.AccountAssociationsStatus" } } }, @@ -6743,138 +8462,63 @@ "description": "An unexpected error response." } }, - "summary": "Resolve Config", + "summary": "Check", "tags": [ - "Apko" - ] - } - }, - "/argos/v1/documents": { - "get": { - "operationId": "ArgosDocuments_List", - "parameters": [ - { - "description": "Exact match on document UIDP.", - "in": "query", - "name": "id", - "schema": { - "type": "string" - } - }, - { - "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", - "in": "query", - "name": "uidp.ancestorsOf", - "schema": { - "type": "string" - } - }, - { - "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", - "in": "query", - "name": "uidp.descendantsOf", - "schema": { - "type": "string" - } - }, - { - "description": "children_of are groups reachable by directly proceeding from parent to children.", - "in": "query", - "name": "uidp.childrenOf", - "schema": { - "type": "string" - } - }, - { - "description": "in_root resticts responses to root level resources (organizations, user identities)", - "in": "query", - "name": "uidp.inRoot", - "schema": { - "type": "boolean" - } - }, - { - "description": "ids are a list of exact UIDPs of records.", - "in": "query", - "name": "uidp.ids", - "schema": { - "items": { - "type": "string" - }, - "type": "array" - } - }, - { - "description": "Filter to documents in a specific lifecycle state.\nSTATUS_UNSPECIFIED (the default) returns documents in any state.\n\n - STATUS_PENDING: Payload received; pending downstream processing.\n - STATUS_READY: Document is fully usable.\n - STATUS_FAILED: Document processing failed; the document is unusable.", - "in": "query", - "name": "status", - "schema": { - "default": "STATUS_UNSPECIFIED", - "enum": [ - "STATUS_UNSPECIFIED", - "STATUS_PENDING", - "STATUS_READY", - "STATUS_FAILED" - ], - "type": "string" - } - }, + "GroupAccountAssociations" + ] + } + }, + "/iam/v1/externalGroupRoleMappings": { + "get": { + "operationId": "ExternalGroupRoleMappings_List", + "parameters": [ { - "description": "created_since returns documents created at or after the given time.", + "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", "in": "query", - "name": "createdSince", + "name": "uidp.ancestorsOf", "schema": { - "format": "date-time", "type": "string" } }, { - "description": "created_before returns documents created at or before the given time.", + "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", "in": "query", - "name": "createdBefore", + "name": "uidp.descendantsOf", "schema": { - "format": "date-time", "type": "string" } }, { - "description": "Maximum number of results to return per page.\nDefault: 50, Maximum: 200.", - "in": "query", - "name": "pageSize", - "schema": { - "format": "int32", - "type": "integer" - } - }, - { - "description": "Page token from a previous List response for pagination.\nOpaque token; treat as a black box.", + "description": "children_of are groups reachable by directly proceeding from parent to children.", "in": "query", - "name": "pageToken", + "name": "uidp.childrenOf", "schema": { "type": "string" } }, { - "description": "Order results by field. Format: \"field [asc|desc]\"\nDefault: \"uid_p asc\"\nNote: changing order_by between pages invalidates the page token.", + "description": "in_root resticts responses to root level resources (organizations, user identities)", "in": "query", - "name": "orderBy", + "name": "uidp.inRoot", "schema": { - "type": "string" + "type": "boolean" } }, { - "description": "Number of results to skip before returning. Used for random-access\npagination (jumping to arbitrary pages). Can be combined with\npage_token to skip from cursor position. Must be non-negative.", + "description": "ids are a list of exact UIDPs of records.", "in": "query", - "name": "skip", + "name": "uidp.ids", "schema": { - "format": "int32", - "type": "integer" + "items": { + "type": "string" + }, + "type": "array" } }, { - "description": "Exact match on the document filename.", + "description": "identity_provider_uidp filters to a specific IdentityProvider.", "in": "query", - "name": "filename", + "name": "identityProviderUidp", "schema": { "type": "string" } @@ -6885,7 +8529,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.argos.ArgosDocumentList" + "$ref": "#/components/schemas/chainguard.platform.iam.ExternalGroupRoleMappingList" } } }, @@ -6904,16 +8548,15 @@ }, "summary": "List", "tags": [ - "ArgosDocuments" + "ExternalGroupRoleMappings" ] } }, - "/argos/v1/documents/{id}": { + "/iam/v1/externalGroupRoleMappings/{id}": { "delete": { - "operationId": "ArgosDocuments_Delete", + "operationId": "ExternalGroupRoleMappings_Delete", "parameters": [ { - "description": "id is the exact UIDP of the document to delete.", "in": "path", "name": "id", "required": true, @@ -6947,16 +8590,15 @@ }, "summary": "Delete", "tags": [ - "ArgosDocuments" + "ExternalGroupRoleMappings" ] } }, - "/argos/v1/documents/{parentId}": { + "/iam/v1/externalGroupRoleMappings/{parentId}": { "post": { - "operationId": "ArgosDocuments_Create", + "operationId": "ExternalGroupRoleMappings_Create", "parameters": [ { - "description": "parent_id is the exact UIDP of the organization (root group) to nest this\ndocument under.", "in": "path", "name": "parentId", "required": true, @@ -6970,19 +8612,19 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.argos.ArgosDocuments.CreateBody" + "$ref": "#/components/schemas/chainguard.platform.iam.ExternalGroupRoleMapping" } } }, "required": true, - "x-originalParamName": "body" + "x-originalParamName": "mapping" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.argos.ArgosDocument" + "$ref": "#/components/schemas/chainguard.platform.iam.ExternalGroupRoleMapping" } } }, @@ -7001,19 +8643,17 @@ }, "summary": "Create", "tags": [ - "ArgosDocuments" + "ExternalGroupRoleMappings" ] } }, - "/argos/v1/orgs/{parentId}/publicKey": { + "/iam/v1/externalGroupRoleMappings/{uid}": { "get": { - "description": "GetOrgPublicKey returns the PEM-encoded RSA-OAEP public key for the\ngiven organization. Clients fetch this once per upload destination and\nuse it to wrap a fresh per-document AES key client-side. The\ncorresponding private key never leaves Cloud KMS.", - "operationId": "ArgosDocuments_GetOrgPublicKey", + "operationId": "ExternalGroupRoleMappings_Get", "parameters": [ { - "description": "parent_id is the UIDP of the organization whose public key is requested.", "in": "path", - "name": "parentId", + "name": "uid", "required": true, "schema": { "pattern": ".+", @@ -7026,7 +8666,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.argos.ArgosOrgPublicKey" + "$ref": "#/components/schemas/chainguard.platform.iam.ExternalGroupRoleMapping" } } }, @@ -7043,23 +8683,134 @@ "description": "An unexpected error response." } }, - "summary": "Get Org Public Key", + "summary": "Get", "tags": [ - "ArgosDocuments" + "ExternalGroupRoleMappings" ] } }, - "/auth/v1/delete/{id}": { + "/iam/v1/group_invites": { + "get": { + "operationId": "GroupInvites_List", + "parameters": [ + { + "description": "group is used to identify the group this record is rooted under.", + "in": "query", + "name": "group", + "schema": { + "type": "string" + } + }, + { + "description": "id is the exact UID of the record.", + "in": "query", + "name": "id", + "schema": { + "type": "string" + } + }, + { + "description": "key_id is the identify the verification key for this code.", + "in": "query", + "name": "keyId", + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.GroupInviteList" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "List", + "tags": [ + "GroupInvites" + ] + } + }, + "/iam/v1/group_invites/{group}": { + "post": { + "operationId": "GroupInvites_Create", + "parameters": [ + { + "description": "group, The Group UIDP path under which the new group Invite targets.", + "in": "path", + "name": "group", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.GroupInvites.CreateBody" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.GroupInvite" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Create", + "tags": [ + "GroupInvites" + ] + } + }, + "/iam/v1/group_invites/{id}": { "delete": { - "operationId": "Auth_Delete", + "operationId": "GroupInvites_Delete", "parameters": [ { - "description": "id is the exact UID of the identity to be deleted from the platform.\nIt must be a root identity, and the UID must match the subject\nof the token.", + "description": "id is the exact UIDP of the record.", "in": "path", "name": "id", "required": true, "schema": { - "pattern": "[^/]+", + "pattern": ".+", "type": "string" } } @@ -7085,22 +8836,83 @@ }, "description": "An unexpected error response." } - }, - "summary": "Delete", - "tags": [ - "Auth" - ] - } - }, - "/auth/v1/ok": { - "get": { - "operationId": "Auth_Validate", + }, + "summary": "Delete", + "tags": [ + "GroupInvites" + ] + } + }, + "/iam/v1/groups": { + "get": { + "operationId": "Groups_List", + "parameters": [ + { + "description": "id is the exact UID of the record.", + "in": "query", + "name": "id", + "schema": { + "type": "string" + } + }, + { + "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", + "in": "query", + "name": "uidp.ancestorsOf", + "schema": { + "type": "string" + } + }, + { + "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", + "in": "query", + "name": "uidp.descendantsOf", + "schema": { + "type": "string" + } + }, + { + "description": "children_of are groups reachable by directly proceeding from parent to children.", + "in": "query", + "name": "uidp.childrenOf", + "schema": { + "type": "string" + } + }, + { + "description": "in_root resticts responses to root level resources (organizations, user identities)", + "in": "query", + "name": "uidp.inRoot", + "schema": { + "type": "boolean" + } + }, + { + "description": "ids are a list of exact UIDPs of records.", + "in": "query", + "name": "uidp.ids", + "schema": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + { + "description": "name is the exact name of the record.", + "in": "query", + "name": "name", + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.auth.WhoAmI" + "$ref": "#/components/schemas/chainguard.platform.iam.GroupList" } } }, @@ -7117,20 +8929,33 @@ "description": "An unexpected error response." } }, - "summary": "Validate", + "summary": "List", "tags": [ - "Auth" + "Groups" ] } }, - "/auth/v1/register": { + "/iam/v1/groups/{groupId}:requestGroupAccess": { "post": { - "operationId": "Auth_Register", + "description": "RequestGroupAccess sends an access request from the caller to the owners\nof the given verified root group. See the v2beta1 GroupsService.RequestGroupAccess\nfor full semantics.", + "operationId": "Groups_RequestGroupAccess", + "parameters": [ + { + "description": "group_id is the UIDP of the group to request access to. Must be the\ngroup whose name matches the email domain on the caller's token; the\nserver revalidates this on every call.", + "in": "path", + "name": "groupId", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], "requestBody": { "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.auth.RegistrationRequest" + "$ref": "#/components/schemas/chainguard.platform.iam.Groups.RequestGroupAccessBody" } } }, @@ -7142,7 +8967,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.auth.Session" + "$ref": "#/components/schemas/chainguard.platform.iam.RequestGroupAccessResponse" } } }, @@ -7159,66 +8984,25 @@ "description": "An unexpected error response." } }, - "summary": "Register", + "summary": "Request Group Access", "tags": [ - "Auth" + "Groups" ] } }, - "/events/v1/subscriptions": { - "get": { - "operationId": "Subscriptions_List", + "/iam/v1/groups/{id}": { + "delete": { + "operationId": "Groups_Delete", "parameters": [ { "description": "id is the exact UIDP of the record.", - "in": "query", + "in": "path", "name": "id", + "required": true, "schema": { + "pattern": ".+", "type": "string" } - }, - { - "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", - "in": "query", - "name": "uidp.ancestorsOf", - "schema": { - "type": "string" - } - }, - { - "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", - "in": "query", - "name": "uidp.descendantsOf", - "schema": { - "type": "string" - } - }, - { - "description": "children_of are groups reachable by directly proceeding from parent to children.", - "in": "query", - "name": "uidp.childrenOf", - "schema": { - "type": "string" - } - }, - { - "description": "in_root resticts responses to root level resources (organizations, user identities)", - "in": "query", - "name": "uidp.inRoot", - "schema": { - "type": "boolean" - } - }, - { - "description": "ids are a list of exact UIDPs of records.", - "in": "query", - "name": "uidp.ids", - "schema": { - "items": { - "type": "string" - }, - "type": "array" - } } ], "responses": { @@ -7226,7 +9010,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.events.SubscriptionList" + "type": "object" } } }, @@ -7243,18 +9027,16 @@ "description": "An unexpected error response." } }, - "summary": "List", + "summary": "Delete", "tags": [ - "Subscriptions" + "Groups" ] - } - }, - "/events/v1/subscriptions/{id}": { - "delete": { - "operationId": "Subscriptions_Delete", + }, + "put": { + "operationId": "Groups_Update", "parameters": [ { - "description": "id is the exact UIDP of the record.", + "description": "id, The group UIDP under which this group resides.", "in": "path", "name": "id", "required": true, @@ -7264,12 +9046,23 @@ } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.Groups.UpdateBody" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.iam.Group" } } }, @@ -7286,20 +9079,20 @@ "description": "An unexpected error response." } }, - "summary": "Delete", + "summary": "Update", "tags": [ - "Subscriptions" + "Groups" ] } }, - "/events/v1/subscriptions/{parentId}": { + "/iam/v1/groups/{parent}": { "post": { - "operationId": "Subscriptions_Create", + "operationId": "Groups_Create", "parameters": [ { - "description": "parent_id, The Group UIDP path under which the new subscription is associated.", + "description": "parent, The Group UIDP path under which the new Group resides.\nThis is effectively the iam_scope for Create requests, but because\nwe also allow users to create new \"root\" groups, we check the scoping\nmanually. Parent is allowed to be a prefix of a UIDP of a Group within\nscope, or the name of a Group in scope.", "in": "path", - "name": "parentId", + "name": "parent", "required": true, "schema": { "pattern": ".+", @@ -7311,20 +9104,20 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.events.Subscription" + "$ref": "#/components/schemas/chainguard.platform.iam.Group" } } }, - "description": "Subscription is the subscription to create;", + "description": "Group to create.", "required": true, - "x-originalParamName": "subscription" + "x-originalParamName": "group" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.events.Subscription" + "$ref": "#/components/schemas/chainguard.platform.iam.Group" } } }, @@ -7343,37 +9136,20 @@ }, "summary": "Create", "tags": [ - "Subscriptions" + "Groups" ] } }, - "/iam/v1/account_associations": { + "/iam/v1/groups:checkEligibility": { "get": { - "operationId": "GroupAccountAssociations_List", - "parameters": [ - { - "description": "group is the exact UIDP of the group whose associations we want to list.", - "in": "query", - "name": "group", - "schema": { - "type": "string" - } - }, - { - "description": "name is the exact name of the association.", - "in": "query", - "name": "name", - "schema": { - "type": "string" - } - } - ], + "description": "CheckEligibility reports whether the caller passes the same eligibility\ngates applied by LookupGroup and RequestGroupAccess. A response of\neligible=true does not guarantee those calls succeed for other reasons\n(no matching org, already requested, etc.).", + "operationId": "Groups_CheckEligibility", "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.AccountAssociationsList" + "$ref": "#/components/schemas/chainguard.platform.iam.CheckEligibilityResponse" } } }, @@ -7390,33 +9166,22 @@ "description": "An unexpected error response." } }, - "summary": "List", + "summary": "Check Eligibility", "tags": [ - "GroupAccountAssociations" + "Groups" ] } }, - "/iam/v1/account_associations/{group}": { - "delete": { - "operationId": "GroupAccountAssociations_Delete", - "parameters": [ - { - "description": "group is the exact UIDP of the group whose associations we want to delete.", - "in": "path", - "name": "group", - "required": true, - "schema": { - "pattern": ".+", - "type": "string" - } - } - ], + "/iam/v1/groups:lookupGroup": { + "get": { + "description": "LookupGroup returns the verified root group whose name matches the email\ndomain on the caller's token, when the token comes from a trusted upstream\nidentity provider that performs its own email verification.\nSee the v2beta1 GroupsService.LookupGroup for full semantics.", + "operationId": "Groups_LookupGroup", "responses": { "200": { "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.iam.LookupGroupResponse" } } }, @@ -7433,42 +9198,74 @@ "description": "An unexpected error response." } }, - "summary": "Delete", + "summary": "Lookup Group", "tags": [ - "GroupAccountAssociations" + "Groups" ] - }, - "post": { - "operationId": "GroupAccountAssociations_Create", + } + }, + "/iam/v1/identities": { + "get": { + "operationId": "Identities_List", "parameters": [ { - "description": "group is the group with which this account information is associated.", - "in": "path", - "name": "group", - "required": true, + "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", + "in": "query", + "name": "uidp.ancestorsOf", + "schema": { + "type": "string" + } + }, + { + "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", + "in": "query", + "name": "uidp.descendantsOf", + "schema": { + "type": "string" + } + }, + { + "description": "children_of are groups reachable by directly proceeding from parent to children.", + "in": "query", + "name": "uidp.childrenOf", + "schema": { + "type": "string" + } + }, + { + "description": "in_root resticts responses to root level resources (organizations, user identities)", + "in": "query", + "name": "uidp.inRoot", + "schema": { + "type": "boolean" + } + }, + { + "description": "ids are a list of exact UIDPs of records.", + "in": "query", + "name": "uidp.ids", + "schema": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + { + "description": "id is unique identifier to look up.", + "in": "query", + "name": "id", "schema": { - "pattern": ".+", "type": "string" } } ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.GroupAccountAssociations.CreateBody" - } - } - }, - "required": true, - "x-originalParamName": "body" - }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.AccountAssociations" + "$ref": "#/components/schemas/chainguard.platform.iam.IdentityList" } } }, @@ -7485,42 +9282,39 @@ "description": "An unexpected error response." } }, - "summary": "Create", + "summary": "List", "tags": [ - "GroupAccountAssociations" + "IAMIdentities" ] - }, - "put": { - "operationId": "GroupAccountAssociations_Update", + } + }, + "/iam/v1/identities/lookup": { + "get": { + "operationId": "Identities_Lookup", "parameters": [ { - "description": "group is the group with which this account information is associated.", - "in": "path", - "name": "group", - "required": true, + "description": "issuer is the oidc issuer to look up.", + "in": "query", + "name": "issuer", + "schema": { + "type": "string" + } + }, + { + "description": "subject is the subject to look up.", + "in": "query", + "name": "subject", "schema": { - "pattern": ".+", "type": "string" } } ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.GroupAccountAssociations.UpdateBody" - } - } - }, - "required": true, - "x-originalParamName": "body" - }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.AccountAssociations" + "$ref": "#/components/schemas/chainguard.platform.iam.Identity" } } }, @@ -7537,32 +9331,20 @@ "description": "An unexpected error response." } }, - "summary": "Update", + "summary": "Lookup", "tags": [ - "GroupAccountAssociations" + "IAMIdentities" ] } }, - "/iam/v1/account_associations/{group}:check": { - "post": { - "operationId": "GroupAccountAssociations_Check", - "parameters": [ - { - "description": "group is the exact UIDP of the group whose associations we want to check", - "in": "path", - "name": "group", - "required": true, - "schema": { - "pattern": ".+", - "type": "string" - } - } - ], + "/iam/v1/identities/metadata": { + "patch": { + "operationId": "Identities_UpdateMetadata", "requestBody": { "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.GroupAccountAssociations.CheckBody" + "$ref": "#/components/schemas/chainguard.platform.events.IdentityMetadata" } } }, @@ -7574,7 +9356,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.AccountAssociationsStatus" + "$ref": "#/components/schemas/chainguard.platform.events.IdentityMetadata" } } }, @@ -7591,37 +9373,23 @@ "description": "An unexpected error response." } }, - "summary": "Check", + "summary": "Update Metadata", "tags": [ - "GroupAccountAssociations" + "EventIdentities" ] } }, - "/iam/v1/group_invites": { - "get": { - "operationId": "GroupInvites_List", + "/iam/v1/identities/{id}": { + "delete": { + "operationId": "Identities_Delete", "parameters": [ { - "description": "group is used to identify the group this record is rooted under.", - "in": "query", - "name": "group", - "schema": { - "type": "string" - } - }, - { - "description": "id is the exact UID of the record.", - "in": "query", + "description": "ID, UIDP of the record.", + "in": "path", "name": "id", + "required": true, "schema": { - "type": "string" - } - }, - { - "description": "key_id is the identify the verification key for this code.", - "in": "query", - "name": "keyId", - "schema": { + "pattern": ".+", "type": "string" } } @@ -7631,7 +9399,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.GroupInviteList" + "type": "object" } } }, @@ -7648,20 +9416,18 @@ "description": "An unexpected error response." } }, - "summary": "List", + "summary": "Delete", "tags": [ - "GroupInvites" + "IAMIdentities" ] - } - }, - "/iam/v1/group_invites/{group}": { - "post": { - "operationId": "GroupInvites_Create", + }, + "put": { + "operationId": "Identities_Update", "parameters": [ { - "description": "group, The Group UIDP path under which the new group Invite targets.", + "description": "id is unique identifier of this specific identity.", "in": "path", - "name": "group", + "name": "id", "required": true, "schema": { "pattern": ".+", @@ -7673,7 +9439,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.GroupInvites.CreateBody" + "$ref": "#/components/schemas/chainguard.platform.iam.Identities.UpdateBody" } } }, @@ -7685,7 +9451,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.GroupInvite" + "$ref": "#/components/schemas/chainguard.platform.iam.Identity" } } }, @@ -7702,20 +9468,20 @@ "description": "An unexpected error response." } }, - "summary": "Create", + "summary": "Update", "tags": [ - "GroupInvites" + "IAMIdentities" ] } }, - "/iam/v1/group_invites/{id}": { - "delete": { - "operationId": "GroupInvites_Delete", + "/iam/v1/identities/{parentId}": { + "post": { + "operationId": "Identities_Create", "parameters": [ { - "description": "id is the exact UIDP of the record.", + "description": "parent_id, The Group UIDP path under which the new Identity resides.", "in": "path", - "name": "id", + "name": "parentId", "required": true, "schema": { "pattern": ".+", @@ -7723,12 +9489,24 @@ } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.Identity" + } + } + }, + "description": "Identity to create.", + "required": true, + "x-originalParamName": "identity" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.iam.Identity" } } }, @@ -7745,18 +9523,18 @@ "description": "An unexpected error response." } }, - "summary": "Delete", + "summary": "Create", "tags": [ - "GroupInvites" + "IAMIdentities" ] } }, - "/iam/v1/groups": { + "/iam/v1/identityProviders": { "get": { - "operationId": "Groups_List", + "operationId": "IdentityProviders_List", "parameters": [ { - "description": "id is the exact UID of the record.", + "description": "Exact match on identity provider UIDP", "in": "query", "name": "id", "schema": { @@ -7764,118 +9542,63 @@ } }, { - "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", - "in": "query", - "name": "uidp.ancestorsOf", - "schema": { - "type": "string" - } - }, - { - "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", - "in": "query", - "name": "uidp.descendantsOf", - "schema": { - "type": "string" - } - }, - { - "description": "children_of are groups reachable by directly proceeding from parent to children.", - "in": "query", - "name": "uidp.childrenOf", - "schema": { - "type": "string" - } - }, - { - "description": "in_root resticts responses to root level resources (organizations, user identities)", - "in": "query", - "name": "uidp.inRoot", - "schema": { - "type": "boolean" - } - }, - { - "description": "ids are a list of exact UIDPs of records.", - "in": "query", - "name": "uidp.ids", - "schema": { - "items": { - "type": "string" - }, - "type": "array" - } - }, - { - "description": "name is the exact name of the record.", + "description": "Exact match on identity provider name", "in": "query", "name": "name", "schema": { "type": "string" - } - } - ], - "responses": { - "200": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.GroupList" - } - } - }, - "description": "A successful response." - }, - "default": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/google.rpc.Status" - } - } - }, - "description": "An unexpected error response." - } - }, - "summary": "List", - "tags": [ - "Groups" - ] - } - }, - "/iam/v1/groups/{groupId}:requestGroupAccess": { - "post": { - "description": "RequestGroupAccess sends an access request from the caller to the owners\nof the given verified root group. See the v2beta1 GroupsService.RequestGroupAccess\nfor full semantics.", - "operationId": "Groups_RequestGroupAccess", - "parameters": [ + } + }, { - "description": "group_id is the UIDP of the group to request access to. Must be the\ngroup whose name matches the email domain on the caller's token; the\nserver revalidates this on every call.", - "in": "path", - "name": "groupId", - "required": true, + "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", + "in": "query", + "name": "uidp.ancestorsOf", "schema": { - "pattern": ".+", "type": "string" } - } - ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Groups.RequestGroupAccessBody" - } + }, + { + "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", + "in": "query", + "name": "uidp.descendantsOf", + "schema": { + "type": "string" } }, - "required": true, - "x-originalParamName": "body" - }, + { + "description": "children_of are groups reachable by directly proceeding from parent to children.", + "in": "query", + "name": "uidp.childrenOf", + "schema": { + "type": "string" + } + }, + { + "description": "in_root resticts responses to root level resources (organizations, user identities)", + "in": "query", + "name": "uidp.inRoot", + "schema": { + "type": "boolean" + } + }, + { + "description": "ids are a list of exact UIDPs of records.", + "in": "query", + "name": "uidp.ids", + "schema": { + "items": { + "type": "string" + }, + "type": "array" + } + } + ], "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RequestGroupAccessResponse" + "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProviderList" } } }, @@ -7892,18 +9615,18 @@ "description": "An unexpected error response." } }, - "summary": "Request Group Access", + "summary": "List", "tags": [ - "Groups" + "IdentityProviders" ] } }, - "/iam/v1/groups/{id}": { + "/iam/v1/identityProviders/{id}": { "delete": { - "operationId": "Groups_Delete", + "operationId": "IdentityProviders_Delete", "parameters": [ { - "description": "id is the exact UIDP of the record.", + "description": "id is the exact UIDP of the IdP", "in": "path", "name": "id", "required": true, @@ -7937,14 +9660,14 @@ }, "summary": "Delete", "tags": [ - "Groups" + "IdentityProviders" ] }, "put": { - "operationId": "Groups_Update", + "operationId": "IdentityProviders_Update", "parameters": [ { - "description": "id, The group UIDP under which this group resides.", + "description": "id is unique identifier of this specific identity provider", "in": "path", "name": "id", "required": true, @@ -7958,7 +9681,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Groups.UpdateBody" + "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProviders.UpdateBody" } } }, @@ -7970,7 +9693,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Group" + "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProvider" } } }, @@ -7989,18 +9712,18 @@ }, "summary": "Update", "tags": [ - "Groups" + "IdentityProviders" ] } }, - "/iam/v1/groups/{parent}": { + "/iam/v1/identityProviders/{parentId}": { "post": { - "operationId": "Groups_Create", + "operationId": "IdentityProviders_Create", "parameters": [ { - "description": "parent, The Group UIDP path under which the new Group resides.\nThis is effectively the iam_scope for Create requests, but because\nwe also allow users to create new \"root\" groups, we check the scoping\nmanually. Parent is allowed to be a prefix of a UIDP of a Group within\nscope, or the name of a Group in scope.", + "description": "parent_id is the exact UIDP of the IAM group to nest this identity provider under", "in": "path", - "name": "parent", + "name": "parentId", "required": true, "schema": { "pattern": ".+", @@ -8012,20 +9735,19 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Group" + "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProvider" } } }, - "description": "Group to create.", "required": true, - "x-originalParamName": "group" + "x-originalParamName": "identityProvider" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Group" + "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProvider" } } }, @@ -8044,78 +9766,22 @@ }, "summary": "Create", "tags": [ - "Groups" - ] - } - }, - "/iam/v1/groups:checkEligibility": { - "get": { - "description": "CheckEligibility reports whether the caller passes the same eligibility\ngates applied by LookupGroup and RequestGroupAccess. A response of\neligible=true does not guarantee those calls succeed for other reasons\n(no matching org, already requested, etc.).", - "operationId": "Groups_CheckEligibility", - "responses": { - "200": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.CheckEligibilityResponse" - } - } - }, - "description": "A successful response." - }, - "default": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/google.rpc.Status" - } - } - }, - "description": "An unexpected error response." - } - }, - "summary": "Check Eligibility", - "tags": [ - "Groups" - ] - } - }, - "/iam/v1/groups:lookupGroup": { - "get": { - "description": "LookupGroup returns the verified root group whose name matches the email\ndomain on the caller's token, when the token comes from a trusted upstream\nidentity provider that performs its own email verification.\nSee the v2beta1 GroupsService.LookupGroup for full semantics.", - "operationId": "Groups_LookupGroup", - "responses": { - "200": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.LookupGroupResponse" - } - } - }, - "description": "A successful response." - }, - "default": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/google.rpc.Status" - } - } - }, - "description": "An unexpected error response." - } - }, - "summary": "Lookup Group", - "tags": [ - "Groups" + "IdentityProviders" ] } }, - "/iam/v1/identities": { + "/iam/v1/rolebindings": { "get": { - "operationId": "Identities_List", + "operationId": "RoleBindings_List", "parameters": [ + { + "description": "id is the exact UID of the record.", + "in": "query", + "name": "id", + "schema": { + "type": "string" + } + }, { "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", "in": "query", @@ -8158,14 +9824,6 @@ }, "type": "array" } - }, - { - "description": "id is unique identifier to look up.", - "in": "query", - "name": "id", - "schema": { - "type": "string" - } } ], "responses": { @@ -8173,7 +9831,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.IdentityList" + "$ref": "#/components/schemas/chainguard.platform.iam.RoleBindingList" } } }, @@ -8192,79 +9850,46 @@ }, "summary": "List", "tags": [ - "IAMIdentities" + "RoleBindings" ] } }, - "/iam/v1/identities/lookup": { - "get": { - "operationId": "Identities_Lookup", + "/iam/v1/rolebindings/batch/{parent}": { + "post": { + "operationId": "RoleBindings_CreateBatch", "parameters": [ { - "description": "issuer is the oidc issuer to look up.", - "in": "query", - "name": "issuer", - "schema": { - "type": "string" - } - }, - { - "description": "subject is the subject to look up.", - "in": "query", - "name": "subject", + "description": "parent, The Group UIDP path under which the new RoleBinding resides.", + "in": "path", + "name": "parent", + "required": true, "schema": { + "pattern": ".+", "type": "string" } } ], - "responses": { - "200": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Identity" - } - } - }, - "description": "A successful response." - }, - "default": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/google.rpc.Status" - } - } - }, - "description": "An unexpected error response." - } - }, - "summary": "Lookup", - "tags": [ - "IAMIdentities" - ] - } - }, - "/iam/v1/identities/metadata": { - "patch": { - "operationId": "Identities_UpdateMetadata", "requestBody": { "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.events.IdentityMetadata" + "items": { + "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" + }, + "type": "array" } } }, + "description": "RoleBinding to create.", "required": true, - "x-originalParamName": "body" + "x-originalParamName": "roleBindings" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.events.IdentityMetadata" + "$ref": "#/components/schemas/chainguard.platform.iam.RoleBindingBatch" } } }, @@ -8281,18 +9906,18 @@ "description": "An unexpected error response." } }, - "summary": "Update Metadata", + "summary": "Create Batch", "tags": [ - "EventIdentities" + "RoleBindings" ] } }, - "/iam/v1/identities/{id}": { + "/iam/v1/rolebindings/{id}": { "delete": { - "operationId": "Identities_Delete", + "operationId": "RoleBindings_Delete", "parameters": [ { - "description": "ID, UIDP of the record.", + "description": "id is the exact UID of the record.", "in": "path", "name": "id", "required": true, @@ -8326,14 +9951,14 @@ }, "summary": "Delete", "tags": [ - "IAMIdentities" + "RoleBindings" ] }, "put": { - "operationId": "Identities_Update", + "operationId": "RoleBindings_Update", "parameters": [ { - "description": "id is unique identifier of this specific identity.", + "description": "id, the UID of this role binding.", "in": "path", "name": "id", "required": true, @@ -8347,7 +9972,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Identities.UpdateBody" + "$ref": "#/components/schemas/chainguard.platform.iam.RoleBindings.UpdateBody" } } }, @@ -8359,7 +9984,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Identity" + "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" } } }, @@ -8378,18 +10003,18 @@ }, "summary": "Update", "tags": [ - "IAMIdentities" + "RoleBindings" ] } }, - "/iam/v1/identities/{parentId}": { + "/iam/v1/rolebindings/{parent}": { "post": { - "operationId": "Identities_Create", + "operationId": "RoleBindings_Create", "parameters": [ { - "description": "parent_id, The Group UIDP path under which the new Identity resides.", + "description": "parent, The Group UIDP path under which the new RoleBinding resides.", "in": "path", - "name": "parentId", + "name": "parent", "required": true, "schema": { "pattern": ".+", @@ -8401,20 +10026,20 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Identity" + "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" } } }, - "description": "Identity to create.", + "description": "RoleBinding to create.", "required": true, - "x-originalParamName": "identity" + "x-originalParamName": "roleBinding" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Identity" + "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" } } }, @@ -8433,16 +10058,16 @@ }, "summary": "Create", "tags": [ - "IAMIdentities" + "RoleBindings" ] } }, - "/iam/v1/identityProviders": { + "/iam/v1/roles": { "get": { - "operationId": "IdentityProviders_List", + "operationId": "Roles_List", "parameters": [ { - "description": "Exact match on identity provider UIDP", + "description": "id is the exact UIDP of the record.", "in": "query", "name": "id", "schema": { @@ -8450,13 +10075,21 @@ } }, { - "description": "Exact match on identity provider name", + "description": "name is the exact name of the record", "in": "query", "name": "name", "schema": { "type": "string" } }, + { + "description": "parent is the exact UIDP of the parent, or / for root", + "in": "query", + "name": "parent", + "schema": { + "type": "string" + } + }, { "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", "in": "query", @@ -8506,7 +10139,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProviderList" + "$ref": "#/components/schemas/chainguard.platform.iam.RoleList" } } }, @@ -8525,16 +10158,16 @@ }, "summary": "List", "tags": [ - "IdentityProviders" + "Roles" ] } }, - "/iam/v1/identityProviders/{id}": { + "/iam/v1/roles/{id}": { "delete": { - "operationId": "IdentityProviders_Delete", + "operationId": "Roles_Delete", "parameters": [ { - "description": "id is the exact UIDP of the IdP", + "description": "id is the exact UIDP of the record.", "in": "path", "name": "id", "required": true, @@ -8568,14 +10201,14 @@ }, "summary": "Delete", "tags": [ - "IdentityProviders" + "Roles" ] }, "put": { - "operationId": "IdentityProviders_Update", + "operationId": "Roles_Update", "parameters": [ { - "description": "id is unique identifier of this specific identity provider", + "description": "id, The Group path under which this Role resides.", "in": "path", "name": "id", "required": true, @@ -8589,7 +10222,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProviders.UpdateBody" + "$ref": "#/components/schemas/chainguard.platform.iam.Roles.UpdateBody" } } }, @@ -8601,7 +10234,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProvider" + "$ref": "#/components/schemas/chainguard.platform.iam.Role" } } }, @@ -8620,16 +10253,16 @@ }, "summary": "Update", "tags": [ - "IdentityProviders" + "Roles" ] } }, - "/iam/v1/identityProviders/{parentId}": { + "/iam/v1/roles/{parentId}": { "post": { - "operationId": "IdentityProviders_Create", + "operationId": "Roles_Create", "parameters": [ { - "description": "parent_id is the exact UIDP of the IAM group to nest this identity provider under", + "description": "parent_id, The Group UIDP path under which the new Role resides.", "in": "path", "name": "parentId", "required": true, @@ -8643,19 +10276,20 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProvider" + "$ref": "#/components/schemas/chainguard.platform.iam.Role" } } }, + "description": "Role to create.", "required": true, - "x-originalParamName": "identityProvider" + "x-originalParamName": "role" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProvider" + "$ref": "#/components/schemas/chainguard.platform.iam.Role" } } }, @@ -8674,160 +10308,19 @@ }, "summary": "Create", "tags": [ - "IdentityProviders" + "Roles" ] } }, - "/iam/v1/rolebindings": { + "/iam/v1/terms/{group}": { "get": { - "operationId": "RoleBindings_List", - "parameters": [ - { - "description": "id is the exact UID of the record.", - "in": "query", - "name": "id", - "schema": { - "type": "string" - } - }, - { - "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", - "in": "query", - "name": "uidp.ancestorsOf", - "schema": { - "type": "string" - } - }, - { - "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", - "in": "query", - "name": "uidp.descendantsOf", - "schema": { - "type": "string" - } - }, - { - "description": "children_of are groups reachable by directly proceeding from parent to children.", - "in": "query", - "name": "uidp.childrenOf", - "schema": { - "type": "string" - } - }, - { - "description": "in_root resticts responses to root level resources (organizations, user identities)", - "in": "query", - "name": "uidp.inRoot", - "schema": { - "type": "boolean" - } - }, - { - "description": "ids are a list of exact UIDPs of records.", - "in": "query", - "name": "uidp.ids", - "schema": { - "items": { - "type": "string" - }, - "type": "array" - } - } - ], - "responses": { - "200": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleBindingList" - } - } - }, - "description": "A successful response." - }, - "default": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/google.rpc.Status" - } - } - }, - "description": "An unexpected error response." - } - }, - "summary": "List", - "tags": [ - "RoleBindings" - ] - } - }, - "/iam/v1/rolebindings/batch/{parent}": { - "post": { - "operationId": "RoleBindings_CreateBatch", - "parameters": [ - { - "description": "parent, The Group UIDP path under which the new RoleBinding resides.", - "in": "path", - "name": "parent", - "required": true, - "schema": { - "pattern": ".+", - "type": "string" - } - } - ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" - }, - "type": "array" - } - } - }, - "description": "RoleBinding to create.", - "required": true, - "x-originalParamName": "roleBindings" - }, - "responses": { - "200": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleBindingBatch" - } - } - }, - "description": "A successful response." - }, - "default": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/google.rpc.Status" - } - } - }, - "description": "An unexpected error response." - } - }, - "summary": "Create Batch", - "tags": [ - "RoleBindings" - ] - } - }, - "/iam/v1/rolebindings/{id}": { - "delete": { - "operationId": "RoleBindings_Delete", + "description": "ListAccepted returns the legal documents that the group has accepted.", + "operationId": "Terms_ListAccepted", "parameters": [ { - "description": "id is the exact UID of the record.", + "description": "group is the UIDP of the org to list documents for.", "in": "path", - "name": "id", + "name": "group", "required": true, "schema": { "pattern": ".+", @@ -8840,7 +10333,7 @@ "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.iam.TermsList" } } }, @@ -8857,18 +10350,19 @@ "description": "An unexpected error response." } }, - "summary": "Delete", + "summary": "List Accepted", "tags": [ - "RoleBindings" + "Terms" ] }, - "put": { - "operationId": "RoleBindings_Update", + "post": { + "description": "AcceptTerms records that the group has accepted one or more legal\ndocuments. Called by chainctl after the user completes the acceptance flow.", + "operationId": "Terms_AcceptTerms", "parameters": [ { - "description": "id, the UID of this role binding.", + "description": "group is the UIDP of the org on whose behalf legal docs are being accepted.", "in": "path", - "name": "id", + "name": "group", "required": true, "schema": { "pattern": ".+", @@ -8880,7 +10374,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleBindings.UpdateBody" + "$ref": "#/components/schemas/chainguard.platform.iam.Terms.AcceptTermsBody" } } }, @@ -8892,7 +10386,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" + "type": "object" } } }, @@ -8909,45 +10403,33 @@ "description": "An unexpected error response." } }, - "summary": "Update", + "summary": "Accept Terms", "tags": [ - "RoleBindings" + "Terms" ] } }, - "/iam/v1/rolebindings/{parent}": { + "/image-recommendation/v1/match": { "post": { - "operationId": "RoleBindings_Create", - "parameters": [ - { - "description": "parent, The Group UIDP path under which the new RoleBinding resides.", - "in": "path", - "name": "parent", - "required": true, - "schema": { - "pattern": ".+", - "type": "string" - } - } - ], + "description": "MatchImage takes a list of SBOM components and returns a list of Chainguard\nimages ranked by similarity to original SBOM components", + "operationId": "ImageMatcher_MatchImage", "requestBody": { "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" + "$ref": "#/components/schemas/chainguard.platform.matcher.MatchImageRequest" } } }, - "description": "RoleBinding to create.", "required": true, - "x-originalParamName": "roleBinding" + "x-originalParamName": "body" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" + "$ref": "#/components/schemas/chainguard.platform.matcher.MatchImageResponse" } } }, @@ -8964,78 +10446,128 @@ "description": "An unexpected error response." } }, - "summary": "Create", + "summary": "Match Image", "tags": [ - "RoleBindings" + "ImageMatcher" ] } }, - "/iam/v1/roles": { + "/libraries/v1/artifacts": { "get": { - "operationId": "Roles_List", + "operationId": "Artifacts_List", "parameters": [ { - "description": "id is the exact UIDP of the record.", + "description": "The language ecosystems to return artifacts for.", "in": "query", - "name": "id", + "name": "ecosystems", "schema": { - "type": "string" + "items": { + "enum": [ + "UNKNOWN", + "JAVA", + "PYTHON", + "JAVASCRIPT" + ], + "type": "string" + }, + "type": "array" } }, { - "description": "name is the exact name of the record", + "description": "A string to search artifacts by. If empty, all artifacts\nfrom the given ecosystem will be returned.", "in": "query", - "name": "name", + "name": "query", "schema": { "type": "string" } }, { - "description": "parent is the exact UIDP of the parent, or / for root", + "description": "Specify the cuda version of the packages to return from the python ecosystem", "in": "query", - "name": "parent", + "name": "cudaVersion", "schema": { "type": "string" } }, { - "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", + "description": "Flag to return only remediated packages for the ecosystems", "in": "query", - "name": "uidp.ancestorsOf", + "name": "remediated", "schema": { - "type": "string" + "type": "boolean" } }, { - "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", + "description": "The maximum number of artifacts to return per request.\nThe service may return fewer than this value.", "in": "query", - "name": "uidp.descendantsOf", + "name": "pageSize", "schema": { - "type": "string" + "format": "int32", + "type": "integer" } }, { - "description": "children_of are groups reachable by directly proceeding from parent to children.", + "description": "The token received from the previous call to List.\nProvide this to retrieve the subsequent page. If populated,\nall non-pagination parameters must match the call that provided this token.", "in": "query", - "name": "uidp.childrenOf", + "name": "pageToken", "schema": { "type": "string" } }, { - "description": "in_root resticts responses to root level resources (organizations, user identities)", + "description": "The number of artifacts to skip ahead in the list of returned artifacts,\nbased on the state of the provided page_token. If page_token is not provided,\nthe first result returned will be number skip+1. If page_token is provided,\nthe first result returned will be (next result based on page_token)+skip.", "in": "query", - "name": "uidp.inRoot", + "name": "skip", "schema": { - "type": "boolean" + "format": "int32", + "type": "integer" } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.libraries.ArtifactList" + } + } + }, + "description": "A successful response." }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "List", + "tags": [ + "Artifacts" + ] + } + }, + "/libraries/v1/artifacts/count": { + "get": { + "operationId": "Artifacts_GetArtifactCount", + "parameters": [ { - "description": "ids are a list of exact UIDPs of records.", + "description": "The language ecosystems to request the artifact counts for.", "in": "query", - "name": "uidp.ids", + "name": "ecosystems", "schema": { "items": { + "enum": [ + "UNKNOWN", + "JAVA", + "PYTHON", + "JAVASCRIPT" + ], "type": "string" }, "type": "array" @@ -9047,7 +10579,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleList" + "$ref": "#/components/schemas/chainguard.platform.libraries.GetArtifactCountResponse" } } }, @@ -9064,23 +10596,23 @@ "description": "An unexpected error response." } }, - "summary": "List", + "summary": "Get Artifact Count", "tags": [ - "Roles" + "Artifacts" ] } }, - "/iam/v1/roles/{id}": { - "delete": { - "operationId": "Roles_Delete", + "/libraries/v1/artifacts/{id}/versions": { + "get": { + "operationId": "Artifacts_ListVersions", "parameters": [ { - "description": "id is the exact UIDP of the record.", + "description": "The artifact's unique identifier, as returned by ListArtifacts", "in": "path", "name": "id", "required": true, "schema": { - "pattern": ".+", + "pattern": "[^/]+", "type": "string" } } @@ -9090,7 +10622,7 @@ "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.libraries.ArtifactVersionList" } } }, @@ -9107,42 +10639,92 @@ "description": "An unexpected error response." } }, - "summary": "Delete", + "summary": "List Versions", "tags": [ - "Roles" + "Artifacts" ] - }, - "put": { - "operationId": "Roles_Update", + } + }, + "/libraries/v1/blocked-packages": { + "get": { + "operationId": "LibraryPolicyBlockEvents_ListBlockEvents", "parameters": [ { - "description": "id, The Group path under which this Role resides.", - "in": "path", - "name": "id", - "required": true, + "description": "The org (parent) to scope events to. Required.", + "in": "query", + "name": "parentId", "schema": { - "pattern": ".+", "type": "string" } - } - ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Roles.UpdateBody" - } + }, + { + "description": "Only events for this ecosystem (UNKNOWN = all).", + "in": "query", + "name": "ecosystem", + "schema": { + "default": "UNKNOWN", + "enum": [ + "UNKNOWN", + "JAVA", + "PYTHON", + "JAVASCRIPT" + ], + "type": "string" } }, - "required": true, - "x-originalParamName": "body" - }, + { + "description": "Match against the PURL name component (exact, case-insensitive).", + "in": "query", + "name": "packageName", + "schema": { + "type": "string" + } + }, + { + "description": "Only events in this mode. Defaults to ENFORCED when unspecified.\n\n - LIBRARY_POLICY_BINDING_MODE_ENFORCED: Withhold packages that fail the policy.\n - LIBRARY_POLICY_BINDING_MODE_LOG: Evaluate and record violations without blocking.", + "in": "query", + "name": "mode", + "schema": { + "default": "LIBRARY_POLICY_BINDING_MODE_UNSPECIFIED", + "enum": [ + "LIBRARY_POLICY_BINDING_MODE_UNSPECIFIED", + "LIBRARY_POLICY_BINDING_MODE_ENFORCED", + "LIBRARY_POLICY_BINDING_MODE_LOG" + ], + "type": "string" + } + }, + { + "description": "Only events first blocked at or after this time. Defaults to 30 days ago.", + "in": "query", + "name": "since", + "schema": { + "format": "date-time", + "type": "string" + } + }, + { + "in": "query", + "name": "pageSize", + "schema": { + "format": "int32", + "type": "integer" + } + }, + { + "in": "query", + "name": "pageToken", + "schema": { + "type": "string" + } + } + ], "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Role" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBlockEventList" } } }, @@ -9159,45 +10741,48 @@ "description": "An unexpected error response." } }, - "summary": "Update", + "summary": "List Block Events", "tags": [ - "Roles" + "LibraryPolicyBlockEvents" ] } }, - "/iam/v1/roles/{parentId}": { - "post": { - "operationId": "Roles_Create", + "/libraries/v1/entitlements": { + "get": { + "operationId": "Entitlements_List", "parameters": [ { - "description": "parent_id, The Group UIDP path under which the new Role resides.", - "in": "path", + "description": "parent_id is the group to list entitlements for. Required.", + "in": "query", "name": "parentId", - "required": true, "schema": { - "pattern": ".+", "type": "string" } - } - ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Role" - } + }, + { + "description": "ecosystems are the language ecosystems to list entitlements for. If empty, all entitlements for the group will be listed.", + "in": "query", + "name": "ecosystems", + "schema": { + "items": { + "enum": [ + "UNKNOWN", + "JAVA", + "PYTHON", + "JAVASCRIPT" + ], + "type": "string" + }, + "type": "array" } - }, - "description": "Role to create.", - "required": true, - "x-originalParamName": "role" - }, + } + ], "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Role" + "$ref": "#/components/schemas/chainguard.platform.libraries.EntitlementList" } } }, @@ -9214,21 +10799,20 @@ "description": "An unexpected error response." } }, - "summary": "Create", + "summary": "List", "tags": [ - "Roles" + "LibrariesEntitlements" ] } }, - "/iam/v1/terms/{group}": { - "get": { - "description": "ListAccepted returns the legal documents that the group has accepted.", - "operationId": "Terms_ListAccepted", + "/libraries/v1/entitlements/{id}": { + "delete": { + "operationId": "Entitlements_Delete", "parameters": [ { - "description": "group is the UIDP of the org to list documents for.", + "description": "id is the exact uidp of the entitlement to delete.", "in": "path", - "name": "group", + "name": "id", "required": true, "schema": { "pattern": ".+", @@ -9241,7 +10825,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.TermsList" + "type": "object" } } }, @@ -9258,43 +10842,82 @@ "description": "An unexpected error response." } }, - "summary": "List Accepted", + "summary": "Delete", "tags": [ - "Terms" + "LibrariesEntitlements" ] - }, + } + }, + "/libraries/v1/entitlements/{parentId}": { "post": { - "description": "AcceptTerms records that the group has accepted one or more legal\ndocuments. Called by chainctl after the user completes the acceptance flow.", - "operationId": "Terms_AcceptTerms", + "operationId": "Entitlements_Create", "parameters": [ { - "description": "group is the UIDP of the org on whose behalf legal docs are being accepted.", + "description": "parent_id is the group to create the entitlement for.", "in": "path", - "name": "group", + "name": "parentId", "required": true, "schema": { "pattern": ".+", "type": "string" } + }, + { + "description": "policy is the libraries policy for this entitlement.\n\n - POLICY_UNKNOWN: defaults to CHAINGUARD behavior\n - POLICY_CHAINGUARD: internal packages only\n - POLICY_CHAINGUARD_AND_UPSTREAM: internal + upstream (with cooldown)", + "in": "query", + "name": "policy", + "schema": { + "default": "POLICY_UNKNOWN", + "enum": [ + "POLICY_UNKNOWN", + "POLICY_CHAINGUARD", + "POLICY_CHAINGUARD_AND_UPSTREAM" + ], + "type": "string" + } + }, + { + "description": "source indicates how this entitlement is being provisioned.\n\n - SOURCE_UNKNOWN: default; treat as SOURCE_TRIAL for backwards compatibility\n - SOURCE_TRIAL: self-service trial entitlement\n - SOURCE_SFDC: created or managed via Salesforce", + "in": "query", + "name": "source", + "schema": { + "default": "SOURCE_UNKNOWN", + "enum": [ + "SOURCE_UNKNOWN", + "SOURCE_TRIAL", + "SOURCE_SFDC" + ], + "type": "string" + } + }, + { + "description": "cooldown_days is the number of days an upstream package version must have\nbeen published before it is served. 0 means no cooldown is enforced; a\npositive value sets the cooldown to that many days. Negative values are\nrejected. Must be \u003c= 3650. The system default (when no entitlement\nspecifies a value) is 7 days.", + "in": "query", + "name": "cooldownDays", + "schema": { + "format": "int32", + "type": "integer" + } } ], "requestBody": { "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Terms.AcceptTermsBody" + "$ref": "#/components/schemas/chainguard.platform.libraries.Ecosystem" } } }, + "description": "ecosystem is the language ecosystem to entitle this group to.", "required": true, - "x-originalParamName": "body" + "x-originalParamName": "ecosystem" }, "responses": { "200": { "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.libraries.Entitlement" } } }, @@ -9311,33 +10934,65 @@ "description": "An unexpected error response." } }, - "summary": "Accept Terms", + "summary": "Create", "tags": [ - "Terms" + "LibrariesEntitlements" ] } }, - "/image-recommendation/v1/match": { - "post": { - "description": "MatchImage takes a list of SBOM components and returns a list of Chainguard\nimages ranked by similarity to original SBOM components", - "operationId": "ImageMatcher_MatchImage", - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.matcher.MatchImageRequest" - } + "/libraries/v1/npm/packages": { + "get": { + "operationId": "NpmPackages_List", + "parameters": [ + { + "description": "A string to search packages by. If empty, all packages\nwill be returned. When set, results are ranked by relevance.", + "in": "query", + "name": "query", + "schema": { + "type": "string" } }, - "required": true, - "x-originalParamName": "body" - }, + { + "description": "The maximum number of packages to return per request.\nThe service may return fewer than this value.", + "in": "query", + "name": "pageSize", + "schema": { + "format": "int64", + "type": "string" + } + }, + { + "description": "The token received from a previous call to List.\nProvide this to retrieve the subsequent page.", + "in": "query", + "name": "pageToken", + "schema": { + "type": "string" + } + }, + { + "description": "The source types to include. If empty, defaults to all.", + "in": "query", + "name": "sourceTypes", + "schema": { + "items": { + "enum": [ + "NPM_SOURCE_TYPE_UNKNOWN", + "NPM_SOURCE_TYPE_INTERNAL", + "NPM_SOURCE_TYPE_INTERNAL_REMEDIATED", + "NPM_SOURCE_TYPE_UPSTREAM_REGISTRY" + ], + "type": "string" + }, + "type": "array" + } + } + ], "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.matcher.MatchImageResponse" + "$ref": "#/components/schemas/chainguard.platform.libraries.NpmPackageList" } } }, @@ -9354,68 +11009,35 @@ "description": "An unexpected error response." } }, - "summary": "Match Image", + "summary": "List", "tags": [ - "ImageMatcher" + "NpmPackages" ] } }, - "/libraries/v1/artifacts": { + "/libraries/v1/npm/packages/versions": { "get": { - "operationId": "Artifacts_List", + "operationId": "NpmPackages_ListVersions", "parameters": [ { - "description": "The language ecosystems to return artifacts for.", - "in": "query", - "name": "ecosystems", - "schema": { - "items": { - "enum": [ - "UNKNOWN", - "JAVA", - "PYTHON", - "JAVASCRIPT" - ], - "type": "string" - }, - "type": "array" - } - }, - { - "description": "A string to search artifacts by. If empty, all artifacts\nfrom the given ecosystem will be returned.", - "in": "query", - "name": "query", - "schema": { - "type": "string" - } - }, - { - "description": "Specify the cuda version of the packages to return from the python ecosystem", + "description": "The npm package name to list versions for (required).", "in": "query", - "name": "cudaVersion", + "name": "packageName", "schema": { "type": "string" } }, { - "description": "Flag to return only remediated packages for the ecosystems", - "in": "query", - "name": "remediated", - "schema": { - "type": "boolean" - } - }, - { - "description": "The maximum number of artifacts to return per request.\nThe service may return fewer than this value.", + "description": "The maximum number of versions to return per request.\nThe service may return fewer than this value.", "in": "query", "name": "pageSize", "schema": { - "format": "int32", - "type": "integer" + "format": "int64", + "type": "string" } }, { - "description": "The token received from the previous call to List.\nProvide this to retrieve the subsequent page. If populated,\nall non-pagination parameters must match the call that provided this token.", + "description": "The token received from a previous call to ListVersions.\nProvide this to retrieve the subsequent page.", "in": "query", "name": "pageToken", "schema": { @@ -9423,12 +11045,20 @@ } }, { - "description": "The number of artifacts to skip ahead in the list of returned artifacts,\nbased on the state of the provided page_token. If page_token is not provided,\nthe first result returned will be number skip+1. If page_token is provided,\nthe first result returned will be (next result based on page_token)+skip.", + "description": "The source types to include. If empty, defaults to all.", "in": "query", - "name": "skip", + "name": "sourceTypes", "schema": { - "format": "int32", - "type": "integer" + "items": { + "enum": [ + "NPM_SOURCE_TYPE_UNKNOWN", + "NPM_SOURCE_TYPE_INTERNAL", + "NPM_SOURCE_TYPE_INTERNAL_REMEDIATED", + "NPM_SOURCE_TYPE_UPSTREAM_REGISTRY" + ], + "type": "string" + }, + "type": "array" } } ], @@ -9437,7 +11067,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.ArtifactList" + "$ref": "#/components/schemas/chainguard.platform.libraries.NpmPackageVersionList" } } }, @@ -9454,31 +11084,60 @@ "description": "An unexpected error response." } }, - "summary": "List", + "summary": "List Versions", "tags": [ - "Artifacts" + "NpmPackages" ] } }, - "/libraries/v1/artifacts/count": { + "/libraries/v1/policies": { "get": { - "operationId": "Artifacts_GetArtifactCount", + "description": "ListPolicies returns all policies available to the org: SYSTEM policies and\nthe org's CUSTOM policies.", + "operationId": "LibraryPolicies_ListPolicies", "parameters": [ { - "description": "The language ecosystems to request the artifact counts for.", + "description": "The org (parent) to scope policies to.", "in": "query", - "name": "ecosystems", + "name": "parentId", "schema": { - "items": { - "enum": [ - "UNKNOWN", - "JAVA", - "PYTHON", - "JAVASCRIPT" - ], - "type": "string" - }, - "type": "array" + "type": "string" + } + }, + { + "in": "query", + "name": "pageSize", + "schema": { + "format": "int32", + "type": "integer" + } + }, + { + "in": "query", + "name": "pageToken", + "schema": { + "type": "string" + } + }, + { + "description": "Exact name of the policy.", + "in": "query", + "name": "name", + "schema": { + "type": "string" + } + }, + { + "description": "Only return policies of this type (UNSPECIFIED = all).\n\n - LIBRARY_POLICY_TYPE_SYSTEM: Created and managed by Chainguard; readable but not modifiable.\n - LIBRARY_POLICY_TYPE_CUSTOM: Created and managed by your organization.", + "in": "query", + "name": "policyType", + "schema": { + "default": "LIBRARY_POLICY_TYPE_UNSPECIFIED", + "enum": [ + "LIBRARY_POLICY_TYPE_UNSPECIFIED", + "LIBRARY_POLICY_TYPE_SYSTEM", + "LIBRARY_POLICY_TYPE_CUSTOM" + ], + "type": "string" } } ], @@ -9487,7 +11146,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.GetArtifactCountResponse" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyList" } } }, @@ -9504,23 +11163,22 @@ "description": "An unexpected error response." } }, - "summary": "Get Artifact Count", + "summary": "List Policies", "tags": [ - "Artifacts" + "LibraryPolicies" ] } }, - "/libraries/v1/artifacts/{id}/versions": { - "get": { - "operationId": "Artifacts_ListVersions", + "/libraries/v1/policies/{id}": { + "delete": { + "operationId": "LibraryPolicies_DeletePolicy", "parameters": [ { - "description": "The artifact's unique identifier, as returned by ListArtifacts", "in": "path", "name": "id", "required": true, "schema": { - "pattern": "[^/]+", + "pattern": ".+", "type": "string" } } @@ -9530,7 +11188,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.ArtifactVersionList" + "type": "object" } } }, @@ -9547,48 +11205,42 @@ "description": "An unexpected error response." } }, - "summary": "List Versions", + "summary": "Delete Policy", "tags": [ - "Artifacts" + "LibraryPolicies" ] - } - }, - "/libraries/v1/entitlements": { - "get": { - "operationId": "Entitlements_List", + }, + "put": { + "description": "UpdatePolicy updates a custom policy. Returns PERMISSION_DENIED for SYSTEM\npolicies and applies the same validation as CreatePolicy.", + "operationId": "LibraryPolicies_UpdatePolicy", "parameters": [ { - "description": "parent_id is the group to list entitlements for. Required.", - "in": "query", - "name": "parentId", + "in": "path", + "name": "id", + "required": true, "schema": { + "pattern": ".+", "type": "string" } - }, - { - "description": "ecosystems are the language ecosystems to list entitlements for. If empty, all entitlements for the group will be listed.", - "in": "query", - "name": "ecosystems", - "schema": { - "items": { - "enum": [ - "UNKNOWN", - "JAVA", - "PYTHON", - "JAVASCRIPT" - ], - "type": "string" - }, - "type": "array" - } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicies.UpdatePolicyBody" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.EntitlementList" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicy" } } }, @@ -9605,20 +11257,21 @@ "description": "An unexpected error response." } }, - "summary": "List", + "summary": "Update Policy", "tags": [ - "LibrariesEntitlements" + "LibraryPolicies" ] } }, - "/libraries/v1/entitlements/{id}": { - "delete": { - "operationId": "Entitlements_Delete", + "/libraries/v1/policies/{parentId}": { + "post": { + "description": "CreatePolicy creates a custom policy under an org. expression is rejected\n(INVALID_ARGUMENT); cooldown_days above 30 is rejected; an allow-list entry\nwith bypass_malware=true requires a non-empty justification.", + "operationId": "LibraryPolicies_CreatePolicy", "parameters": [ { - "description": "id is the exact uidp of the entitlement to delete.", + "description": "The org Group UIDP under which the policy is created.", "in": "path", - "name": "id", + "name": "parentId", "required": true, "schema": { "pattern": ".+", @@ -9626,12 +11279,23 @@ } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicy" + } + } + }, + "required": true, + "x-originalParamName": "policy" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicy" } } }, @@ -9648,82 +11312,75 @@ "description": "An unexpected error response." } }, - "summary": "Delete", + "summary": "Create Policy", "tags": [ - "LibrariesEntitlements" + "LibraryPolicies" ] } }, - "/libraries/v1/entitlements/{parentId}": { - "post": { - "operationId": "Entitlements_Create", + "/libraries/v1/policy-bindings": { + "get": { + "operationId": "LibraryPolicyBindings_ListBindings", "parameters": [ { - "description": "parent_id is the group to create the entitlement for.", - "in": "path", + "description": "The org (parent) to scope bindings to.", + "in": "query", "name": "parentId", - "required": true, "schema": { - "pattern": ".+", "type": "string" } }, { - "description": "policy is the libraries policy for this entitlement.\n\n - POLICY_UNKNOWN: defaults to CHAINGUARD behavior\n - POLICY_CHAINGUARD: internal packages only\n - POLICY_CHAINGUARD_AND_UPSTREAM: internal + upstream (with cooldown)", + "description": "Only return bindings for this ecosystem (UNKNOWN = all).", "in": "query", - "name": "policy", + "name": "ecosystem", "schema": { - "default": "POLICY_UNKNOWN", + "default": "UNKNOWN", "enum": [ - "POLICY_UNKNOWN", - "POLICY_CHAINGUARD", - "POLICY_CHAINGUARD_AND_UPSTREAM" + "UNKNOWN", + "JAVA", + "PYTHON", + "JAVASCRIPT" ], "type": "string" } }, { - "description": "source indicates how this entitlement is being provisioned.\n\n - SOURCE_UNKNOWN: default; treat as SOURCE_TRIAL for backwards compatibility\n - SOURCE_TRIAL: self-service trial entitlement\n - SOURCE_SFDC: created or managed via Salesforce", + "description": "Only return bindings in this mode (UNSPECIFIED = all).\n\n - LIBRARY_POLICY_BINDING_MODE_ENFORCED: Withhold packages that fail the policy.\n - LIBRARY_POLICY_BINDING_MODE_LOG: Evaluate and record violations without blocking.", "in": "query", - "name": "source", + "name": "mode", "schema": { - "default": "SOURCE_UNKNOWN", + "default": "LIBRARY_POLICY_BINDING_MODE_UNSPECIFIED", "enum": [ - "SOURCE_UNKNOWN", - "SOURCE_TRIAL", - "SOURCE_SFDC" + "LIBRARY_POLICY_BINDING_MODE_UNSPECIFIED", + "LIBRARY_POLICY_BINDING_MODE_ENFORCED", + "LIBRARY_POLICY_BINDING_MODE_LOG" ], "type": "string" } }, { - "description": "cooldown_days is the number of days an upstream package version must have\nbeen published before it is served. 0 means no cooldown is enforced; a\npositive value sets the cooldown to that many days. Negative values are\nrejected. Must be \u003c= 3650. The system default (when no entitlement\nspecifies a value) is 7 days.", "in": "query", - "name": "cooldownDays", + "name": "pageSize", "schema": { "format": "int32", "type": "integer" } + }, + { + "in": "query", + "name": "pageToken", + "schema": { + "type": "string" + } } ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.Ecosystem" - } - } - }, - "description": "ecosystem is the language ecosystem to entitle this group to.", - "required": true, - "x-originalParamName": "ecosystem" - }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.Entitlement" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBindingList" } } }, @@ -9740,48 +11397,83 @@ "description": "An unexpected error response." } }, - "summary": "Create", + "summary": "List Bindings", "tags": [ - "LibrariesEntitlements" + "LibraryPolicyBindings" ] } }, - "/libraries/v1/npm/packages": { - "get": { - "operationId": "NpmPackages_List", + "/libraries/v1/policy-bindings/{id}": { + "delete": { + "operationId": "LibraryPolicyBindings_DeleteBinding", "parameters": [ { - "description": "A string to search packages by. If empty, all packages\nwill be returned. When set, results are ranked by relevance.", - "in": "query", - "name": "query", - "schema": { - "type": "string" - } - }, - { - "description": "The maximum number of packages to return per request.\nThe service may return fewer than this value.", - "in": "query", - "name": "pageSize", + "in": "path", + "name": "id", + "required": true, "schema": { - "format": "int64", + "pattern": ".+", "type": "string" } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "type": "object" + } + } + }, + "description": "A successful response." }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Delete Binding", + "tags": [ + "LibraryPolicyBindings" + ] + }, + "put": { + "operationId": "LibraryPolicyBindings_UpdateBinding", + "parameters": [ { - "description": "The token received from a previous call to List.\nProvide this to retrieve the subsequent page.", - "in": "query", - "name": "pageToken", + "in": "path", + "name": "id", + "required": true, "schema": { + "pattern": ".+", "type": "string" } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBindings.UpdateBindingBody" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.NpmPackageList" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBinding" } } }, @@ -9798,48 +11490,45 @@ "description": "An unexpected error response." } }, - "summary": "List", + "summary": "Update Binding", "tags": [ - "NpmPackages" + "LibraryPolicyBindings" ] } }, - "/libraries/v1/npm/packages/versions": { - "get": { - "operationId": "NpmPackages_ListVersions", + "/libraries/v1/policy-bindings/{parentId}": { + "post": { + "description": "CreateBinding activates a policy. Returns ALREADY_EXISTS if a binding for\nthe same (org, ecosystem, mode) already exists; use UpdateBinding instead.\nA JAVA ecosystem is rejected (INVALID_ARGUMENT) until enforcement exists.", + "operationId": "LibraryPolicyBindings_CreateBinding", "parameters": [ { - "description": "The npm package name to list versions for (required).", - "in": "query", - "name": "packageName", - "schema": { - "type": "string" - } - }, - { - "description": "The maximum number of versions to return per request.\nThe service may return fewer than this value.", - "in": "query", - "name": "pageSize", - "schema": { - "format": "int64", - "type": "string" - } - }, - { - "description": "The token received from a previous call to ListVersions.\nProvide this to retrieve the subsequent page.", - "in": "query", - "name": "pageToken", + "description": "The org Group UIDP under which the binding is created.", + "in": "path", + "name": "parentId", + "required": true, "schema": { + "pattern": ".+", "type": "string" } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBinding" + } + } + }, + "required": true, + "x-originalParamName": "binding" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.NpmPackageVersionList" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBinding" } } }, @@ -9856,9 +11545,9 @@ "description": "An unexpected error response." } }, - "summary": "List Versions", + "summary": "Create Binding", "tags": [ - "NpmPackages" + "LibraryPolicyBindings" ] } }, @@ -9934,7 +11623,7 @@ ] } }, - "/policygates/v1/bindings": { + "/policies/v1/bindings": { "get": { "operationId": "Bindings_ListBindings", "parameters": [ @@ -10021,7 +11710,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.BindingList" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.BindingList" } } }, @@ -10044,7 +11733,7 @@ ] } }, - "/policygates/v1/bindings/{id}": { + "/policies/v1/bindings/{id}": { "delete": { "operationId": "Bindings_DeleteBinding", "parameters": [ @@ -10103,7 +11792,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Bindings.UpdateBindingBody" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Bindings.UpdateBindingBody" } } }, @@ -10115,7 +11804,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Binding" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Binding" } } }, @@ -10138,7 +11827,7 @@ ] } }, - "/policygates/v1/bindings/{parentId}": { + "/policies/v1/bindings/{parentId}": { "post": { "operationId": "Bindings_CreateBinding", "parameters": [ @@ -10156,7 +11845,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Binding" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Binding" } } }, @@ -10168,7 +11857,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Binding" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Binding" } } }, @@ -10191,7 +11880,7 @@ ] } }, - "/policygates/v1/policies": { + "/policies/v1/policies": { "get": { "operationId": "Policies_ListPolicies", "parameters": [ @@ -10286,7 +11975,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.PolicyList" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.PolicyList" } } }, @@ -10309,7 +11998,7 @@ ] } }, - "/policygates/v1/policies/{id}": { + "/policies/v1/policies/{id}": { "delete": { "operationId": "Policies_DeletePolicy", "parameters": [ @@ -10368,7 +12057,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Policies.UpdatePolicyBody" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Policies.UpdatePolicyBody" } } }, @@ -10380,7 +12069,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Policy" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Policy" } } }, @@ -10403,7 +12092,7 @@ ] } }, - "/policygates/v1/policies/{parentId}": { + "/policies/v1/policies/{parentId}": { "post": { "operationId": "Policies_CreatePolicy", "parameters": [ @@ -10422,7 +12111,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Policy" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Policy" } } }, @@ -10435,7 +12124,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Policy" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Policy" } } }, @@ -14215,6 +15904,9 @@ { "name": "ArgosDocuments" }, + { + "name": "ArgosOSV" + }, { "name": "Auth" }, @@ -14228,6 +15920,9 @@ { "name": "GroupAccountAssociations" }, + { + "name": "ExternalGroupRoleMappings" + }, { "name": "Groups" }, @@ -14260,6 +15955,15 @@ { "name": "NpmPackages" }, + { + "name": "LibraryPolicies" + }, + { + "name": "LibraryPolicyBindings" + }, + { + "name": "LibraryPolicyBlockEvents" + }, { "name": "ImageMatcher" }, diff --git a/static/api-v2beta1.json b/static/api-v2beta1.json index d6ffa5d359..a85dbdf55d 100644 --- a/static/api-v2beta1.json +++ b/static/api-v2beta1.json @@ -3,7 +3,7 @@ "schemas": { "chainguard.capabilities.Capability": { "default": "UNKNOWN", - "description": "Capability is an enumeration of the Chainguard IAM capabilities.\n\n - CAP_TENANT_VULN_REPORTS_LIST: TODO(colin): deprecate this cap once the legacy endpoint is removed\n - CAP_REPO_BLOBS_GET: repo.blobs.get is a capability required to pull container images.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with images vs pulling the image itself.\n - CAP_APK_BLOBS_GET: apk.blobs.get is a capability required to pull APKs.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with APKs vs pulling the APK itself.\n - CAP_BUILD_REPORT_LIST: Custom Image Build\n - CAP_LIBRARIES_ENTITLEMENTS_CREATE: Global libraries capabilities\n - CAP_LIBRARIES_PYTHON_LIST: Ecosystems specific capabilities\n - CAP_LIBRARIES_CACHE_INVALIDATE: Cache invalidation capability for the libraries cache (covers all ecosystems).\nGranted to org owners and account admins; not to regular developer members.\n - CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE: Rebuilder API capabilities\n - CAP_REGISTRY_ENTITLEMENTS_LIST: Registry Entitlements\n - CAP_REGISTRY_SETTINGS_LIST: Registry Settings\n - CAP_REGISTRY_DEPLOYMENTS_CREATE: Registry Deployments\n - CAP_POLICY_GATES_POLICY_CREATE: Policy Gates\n - CAP_TERMS_ACCEPT: Terms\n - CAP_GULFSTREAM: This is orthogonal enough that we should leave\nit somewhat separate, so add new capabilities above.\nTODO(mattmoor): Think about whether we can encode specific\ncontroller capabilities into our access control here?\ne.g. could each logical controller/webhook be its own\ncapability?\n - CAP_GUARDENER_DFC_CONVERT: Guardener\n - CAP_MCP_TOOL_CALL: MCP tool calls\n - CAP_SKILLS_PUBLISH: Skills registry — publishing skill artifacts to skills.cgr.dev\n - CAP_SKILLS_ENTITLEMENTS_CREATE: Skills registry entitlements\n - CAP_ARGOS_DOCUMENTS_CREATE: Argos — client-side encrypted document records.", + "description": "Capability is an enumeration of the Chainguard IAM capabilities.\n\n - CAP_TENANT_VULN_REPORTS_LIST: TODO(colin): deprecate this cap once the legacy endpoint is removed\n - CAP_REPO_BLOBS_GET: repo.blobs.get is a capability required to pull container images.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with images vs pulling the image itself.\n - CAP_APK_BLOBS_GET: apk.blobs.get is a capability required to pull APKs.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with APKs vs pulling the APK itself.\n - CAP_BUILD_REPORT_LIST: Custom Image Build\n - CAP_LIBRARIES_ENTITLEMENTS_CREATE: Global libraries capabilities\n - CAP_LIBRARIES_PYTHON_LIST: Ecosystems specific capabilities\n - CAP_LIBRARIES_CACHE_INVALIDATE: Cache invalidation capability for the libraries cache (covers all ecosystems).\nGranted to org owners and account admins; not to regular developer members.\n - CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE: Rebuilder API capabilities\n - CAP_REGISTRY_ENTITLEMENTS_LIST: Registry Entitlements\n - CAP_REGISTRY_SETTINGS_LIST: Registry Settings\n - CAP_REGISTRY_DEPLOYMENTS_CREATE: Registry Deployments\n - CAP_POLICIES_POLICY_CREATE: Policies\n - CAP_TERMS_ACCEPT: Terms\n - CAP_GULFSTREAM: This is orthogonal enough that we should leave\nit somewhat separate, so add new capabilities above.\nTODO(mattmoor): Think about whether we can encode specific\ncontroller capabilities into our access control here?\ne.g. could each logical controller/webhook be its own\ncapability?\n - CAP_GUARDENER_DFC_CONVERT: Guardener\n - CAP_MCP_TOOL_CALL: MCP tool calls\n - CAP_SKILLS_PUBLISH: Skills registry — publishing skill artifacts to skills.cgr.dev\n - CAP_SKILLS_ENTITLEMENTS_CREATE: Skills registry entitlements\n - CAP_ARGOS_DOCUMENTS_CREATE: Argos — client-side encrypted document records.\n - CAP_ARGOS_OSV_READ: Argos — Private OSV API (customer-facing OSV query surface).\n - CAP_LIBRARIES_POLICY_CREATE: Libraries Policy Gates — customer-facing policies and bindings that\nconfigure the cooldown and malware gates applied to upstream package pulls,\nplus the block events recorded when a pull is withheld.", "enum": [ "UNKNOWN", "CAP_INTERNAL", @@ -125,14 +125,14 @@ "CAP_REGISTRY_DEPLOYMENTS_CREATE", "CAP_REGISTRY_DEPLOYMENTS_UPDATE", "CAP_REGISTRY_DEPLOYMENTS_LIST", - "CAP_POLICY_GATES_POLICY_CREATE", - "CAP_POLICY_GATES_POLICY_UPDATE", - "CAP_POLICY_GATES_POLICY_LIST", - "CAP_POLICY_GATES_POLICY_DELETE", - "CAP_POLICY_GATES_BINDING_CREATE", - "CAP_POLICY_GATES_BINDING_UPDATE", - "CAP_POLICY_GATES_BINDING_LIST", - "CAP_POLICY_GATES_BINDING_DELETE", + "CAP_POLICIES_POLICY_CREATE", + "CAP_POLICIES_POLICY_UPDATE", + "CAP_POLICIES_POLICY_LIST", + "CAP_POLICIES_POLICY_DELETE", + "CAP_POLICIES_BINDING_CREATE", + "CAP_POLICIES_BINDING_UPDATE", + "CAP_POLICIES_BINDING_LIST", + "CAP_POLICIES_BINDING_DELETE", "CAP_REPO_CHECK_POLICIES", "CAP_PACKAGES_ENTITLEMENTS_LIST", "CAP_TERMS_ACCEPT", @@ -146,7 +146,17 @@ "CAP_SKILLS_ENTITLEMENTS_DELETE", "CAP_ARGOS_DOCUMENTS_CREATE", "CAP_ARGOS_DOCUMENTS_LIST", - "CAP_ARGOS_DOCUMENTS_DELETE" + "CAP_ARGOS_DOCUMENTS_DELETE", + "CAP_ARGOS_OSV_READ", + "CAP_LIBRARIES_POLICY_CREATE", + "CAP_LIBRARIES_POLICY_UPDATE", + "CAP_LIBRARIES_POLICY_LIST", + "CAP_LIBRARIES_POLICY_DELETE", + "CAP_LIBRARIES_POLICY_BINDING_CREATE", + "CAP_LIBRARIES_POLICY_BINDING_UPDATE", + "CAP_LIBRARIES_POLICY_BINDING_LIST", + "CAP_LIBRARIES_POLICY_BINDING_DELETE", + "CAP_LIBRARIES_POLICY_BLOCK_EVENT_LIST" ], "type": "string" }, @@ -836,6 +846,10 @@ "readOnly": true, "type": "string" }, + "hubspotUtk": { + "description": "The HubSpot UTK value to pass to HubSpot during console login.\nThis value is ephemeral and not persisted to datastore.", + "type": "string" + }, "jobTitle": { "description": "The user's job title.", "type": "string" @@ -857,6 +871,10 @@ "description": "The product the user is interested in.", "type": "string" }, + "selfServe": { + "description": "Flag to indicate if the user is onboarding via a self-service flow.", + "type": "boolean" + }, "uid": { "description": "The caller's identity UID.", "readOnly": true, @@ -954,6 +972,10 @@ "description": "Client secret of the identity provider. This is a sensitive value\nand is not returned for list/get calls.", "type": "string" }, + "groupsClaim": { + "description": "Name of the OIDC token claim that carries the user's group memberships\n(e.g. \"groups\" for Entra, a custom claim name for Okta). Required for\nIdP group-based role mapping; when empty, group extraction is skipped.", + "type": "string" + }, "issuer": { "title": "Issuer URL (e.g https://accounts.google.com)", "type": "string" diff --git a/static/api.json b/static/api.json index 98ed917303..ef249370a5 100644 --- a/static/api.json +++ b/static/api.json @@ -3,7 +3,7 @@ "schemas": { "chainguard.capabilities.Capability": { "default": "UNKNOWN", - "description": "Capability is an enumeration of the Chainguard IAM capabilities.\n\n - CAP_TENANT_VULN_REPORTS_LIST: TODO(colin): deprecate this cap once the legacy endpoint is removed\n - CAP_REPO_BLOBS_GET: repo.blobs.get is a capability required to pull container images.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with images vs pulling the image itself.\n - CAP_APK_BLOBS_GET: apk.blobs.get is a capability required to pull APKs.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with APKs vs pulling the APK itself.\n - CAP_BUILD_REPORT_LIST: Custom Image Build\n - CAP_LIBRARIES_ENTITLEMENTS_CREATE: Global libraries capabilities\n - CAP_LIBRARIES_PYTHON_LIST: Ecosystems specific capabilities\n - CAP_LIBRARIES_CACHE_INVALIDATE: Cache invalidation capability for the libraries cache (covers all ecosystems).\nGranted to org owners and account admins; not to regular developer members.\n - CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE: Rebuilder API capabilities\n - CAP_REGISTRY_ENTITLEMENTS_LIST: Registry Entitlements\n - CAP_REGISTRY_SETTINGS_LIST: Registry Settings\n - CAP_REGISTRY_DEPLOYMENTS_CREATE: Registry Deployments\n - CAP_POLICY_GATES_POLICY_CREATE: Policy Gates\n - CAP_TERMS_ACCEPT: Terms\n - CAP_GULFSTREAM: This is orthogonal enough that we should leave\nit somewhat separate, so add new capabilities above.\nTODO(mattmoor): Think about whether we can encode specific\ncontroller capabilities into our access control here?\ne.g. could each logical controller/webhook be its own\ncapability?\n - CAP_GUARDENER_DFC_CONVERT: Guardener\n - CAP_MCP_TOOL_CALL: MCP tool calls\n - CAP_SKILLS_PUBLISH: Skills registry — publishing skill artifacts to skills.cgr.dev\n - CAP_SKILLS_ENTITLEMENTS_CREATE: Skills registry entitlements\n - CAP_ARGOS_DOCUMENTS_CREATE: Argos — client-side encrypted document records.", + "description": "Capability is an enumeration of the Chainguard IAM capabilities.\n\n - CAP_TENANT_VULN_REPORTS_LIST: TODO(colin): deprecate this cap once the legacy endpoint is removed\n - CAP_REPO_BLOBS_GET: repo.blobs.get is a capability required to pull container images.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with images vs pulling the image itself.\n - CAP_APK_BLOBS_GET: apk.blobs.get is a capability required to pull APKs.\nWe explicitly define this to distinguish roles that allow browsing/viewing\nmetadata associated with APKs vs pulling the APK itself.\n - CAP_BUILD_REPORT_LIST: Custom Image Build\n - CAP_LIBRARIES_ENTITLEMENTS_CREATE: Global libraries capabilities\n - CAP_LIBRARIES_PYTHON_LIST: Ecosystems specific capabilities\n - CAP_LIBRARIES_CACHE_INVALIDATE: Cache invalidation capability for the libraries cache (covers all ecosystems).\nGranted to org owners and account admins; not to regular developer members.\n - CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE: Rebuilder API capabilities\n - CAP_REGISTRY_ENTITLEMENTS_LIST: Registry Entitlements\n - CAP_REGISTRY_SETTINGS_LIST: Registry Settings\n - CAP_REGISTRY_DEPLOYMENTS_CREATE: Registry Deployments\n - CAP_POLICIES_POLICY_CREATE: Policies\n - CAP_TERMS_ACCEPT: Terms\n - CAP_GULFSTREAM: This is orthogonal enough that we should leave\nit somewhat separate, so add new capabilities above.\nTODO(mattmoor): Think about whether we can encode specific\ncontroller capabilities into our access control here?\ne.g. could each logical controller/webhook be its own\ncapability?\n - CAP_GUARDENER_DFC_CONVERT: Guardener\n - CAP_MCP_TOOL_CALL: MCP tool calls\n - CAP_SKILLS_PUBLISH: Skills registry — publishing skill artifacts to skills.cgr.dev\n - CAP_SKILLS_ENTITLEMENTS_CREATE: Skills registry entitlements\n - CAP_ARGOS_DOCUMENTS_CREATE: Argos — client-side encrypted document records.\n - CAP_ARGOS_OSV_READ: Argos — Private OSV API (customer-facing OSV query surface).\n - CAP_LIBRARIES_POLICY_CREATE: Libraries Policy Gates — customer-facing policies and bindings that\nconfigure the cooldown and malware gates applied to upstream package pulls,\nplus the block events recorded when a pull is withheld.", "enum": [ "UNKNOWN", "CAP_INTERNAL", @@ -125,14 +125,14 @@ "CAP_REGISTRY_DEPLOYMENTS_CREATE", "CAP_REGISTRY_DEPLOYMENTS_UPDATE", "CAP_REGISTRY_DEPLOYMENTS_LIST", - "CAP_POLICY_GATES_POLICY_CREATE", - "CAP_POLICY_GATES_POLICY_UPDATE", - "CAP_POLICY_GATES_POLICY_LIST", - "CAP_POLICY_GATES_POLICY_DELETE", - "CAP_POLICY_GATES_BINDING_CREATE", - "CAP_POLICY_GATES_BINDING_UPDATE", - "CAP_POLICY_GATES_BINDING_LIST", - "CAP_POLICY_GATES_BINDING_DELETE", + "CAP_POLICIES_POLICY_CREATE", + "CAP_POLICIES_POLICY_UPDATE", + "CAP_POLICIES_POLICY_LIST", + "CAP_POLICIES_POLICY_DELETE", + "CAP_POLICIES_BINDING_CREATE", + "CAP_POLICIES_BINDING_UPDATE", + "CAP_POLICIES_BINDING_LIST", + "CAP_POLICIES_BINDING_DELETE", "CAP_REPO_CHECK_POLICIES", "CAP_PACKAGES_ENTITLEMENTS_LIST", "CAP_TERMS_ACCEPT", @@ -146,7 +146,17 @@ "CAP_SKILLS_ENTITLEMENTS_DELETE", "CAP_ARGOS_DOCUMENTS_CREATE", "CAP_ARGOS_DOCUMENTS_LIST", - "CAP_ARGOS_DOCUMENTS_DELETE" + "CAP_ARGOS_DOCUMENTS_DELETE", + "CAP_ARGOS_OSV_READ", + "CAP_LIBRARIES_POLICY_CREATE", + "CAP_LIBRARIES_POLICY_UPDATE", + "CAP_LIBRARIES_POLICY_LIST", + "CAP_LIBRARIES_POLICY_DELETE", + "CAP_LIBRARIES_POLICY_BINDING_CREATE", + "CAP_LIBRARIES_POLICY_BINDING_UPDATE", + "CAP_LIBRARIES_POLICY_BINDING_LIST", + "CAP_LIBRARIES_POLICY_BINDING_DELETE", + "CAP_LIBRARIES_POLICY_BLOCK_EVENT_LIST" ], "type": "string" }, @@ -793,9 +803,45 @@ }, "type": "object" }, + "chainguard.platform.argos.Affected": { + "properties": { + "databaseSpecific": { + "format": "byte", + "type": "string" + }, + "ecosystemSpecific": { + "format": "byte", + "type": "string" + }, + "package": { + "$ref": "#/components/schemas/chainguard.platform.argos.Package" + }, + "ranges": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.Range" + }, + "type": "array" + }, + "versions": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, "chainguard.platform.argos.ArgosDocument": { "description": "ArgosDocument is an organization-scoped record describing a\nclient-side-encrypted document. The actual ciphertext (the upload\nenvelope: client-AES-encrypted plaintext + RSA-wrapped AES key) lives in\nGCS; ArgosDocument tracks only the metadata.", "properties": { + "cgpIds": { + "description": "cgp_ids are the Chainguard vulnerability identifiers (CGP-...) this\nsubmission resolved to, populated once processing completes.", + "items": { + "type": "string" + }, + "readOnly": true, + "type": "array" + }, "createdAt": { "description": "When the document record was created.", "format": "date-time", @@ -827,12 +873,13 @@ }, "chainguard.platform.argos.ArgosDocument.Status": { "default": "STATUS_UNSPECIFIED", - "description": " - STATUS_PENDING: Payload received; pending downstream processing.\n - STATUS_READY: Document is fully usable.\n - STATUS_FAILED: Document processing failed; the document is unusable.", + "description": " - STATUS_PENDING: Payload received; pending downstream processing.\n - STATUS_READY: Document is fully usable.\n - STATUS_FAILED: Document processing failed; the document is unusable.\n - STATUS_FALSE_POSITIVE: Processing determined the finding is not a true positive.", "enum": [ "STATUS_UNSPECIFIED", "STATUS_PENDING", "STATUS_READY", - "STATUS_FAILED" + "STATUS_FAILED", + "STATUS_FALSE_POSITIVE" ], "type": "string" }, @@ -892,6 +939,204 @@ }, "type": "object" }, + "chainguard.platform.argos.Event": { + "properties": { + "fixed": { + "type": "string" + }, + "introduced": { + "type": "string" + }, + "lastAffected": { + "type": "string" + }, + "limit": { + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.argos.MinimalOSVRecord": { + "description": "MinimalOSVRecord is the abbreviated vuln entry returned by QueryBatch,\nmatching the OSV spec's batch response (id + modified only); callers\nfollow up with GetVuln for full detail.", + "properties": { + "id": { + "type": "string" + }, + "modified": { + "format": "date-time", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.argos.OSVQueryBatchRequest": { + "properties": { + "queries": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.OSVQueryRequest" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.argos.OSVQueryBatchResponse": { + "properties": { + "results": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.OSVQueryBatchResult" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.argos.OSVQueryBatchResult": { + "properties": { + "nextPageToken": { + "description": "next_page_token paginates this query's results (OSV batch spec).", + "type": "string" + }, + "vulns": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.MinimalOSVRecord" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.argos.OSVQueryRequest": { + "properties": { + "package": { + "$ref": "#/components/schemas/chainguard.platform.argos.Package" + }, + "pageToken": { + "title": "page_token is the opaque cursor from a previous response's next_page_token.\nEmpty starts at the first page. (OSV spec: query supports page_token.)", + "type": "string" + }, + "version": { + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.argos.OSVQueryResponse": { + "properties": { + "nextPageToken": { + "description": "next_page_token is the cursor for the next page; empty when last page.", + "type": "string" + }, + "vulns": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.OSVRecord" + }, + "type": "array" + } + }, + "type": "object" + }, + "chainguard.platform.argos.OSVRecord": { + "properties": { + "affected": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.Affected" + }, + "type": "array" + }, + "aliases": { + "items": { + "type": "string" + }, + "type": "array" + }, + "details": { + "type": "string" + }, + "id": { + "type": "string" + }, + "modified": { + "format": "date-time", + "type": "string" + }, + "published": { + "format": "date-time", + "type": "string" + }, + "related": { + "items": { + "type": "string" + }, + "type": "array" + }, + "schemaVersion": { + "type": "string" + }, + "severity": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.Severity" + }, + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.argos.Package": { + "properties": { + "ecosystem": { + "type": "string" + }, + "name": { + "type": "string" + }, + "purl": { + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.argos.Range": { + "properties": { + "events": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.argos.Event" + }, + "type": "array" + }, + "repo": { + "type": "string" + }, + "type": { + "$ref": "#/components/schemas/chainguard.platform.argos.Range.RangeType" + } + }, + "type": "object" + }, + "chainguard.platform.argos.Range.RangeType": { + "default": "RANGE_TYPE_UNSPECIFIED", + "enum": [ + "RANGE_TYPE_UNSPECIFIED", + "RANGE_TYPE_SEMVER", + "RANGE_TYPE_ECOSYSTEM", + "RANGE_TYPE_GIT" + ], + "type": "string" + }, + "chainguard.platform.argos.Severity": { + "properties": { + "score": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "type": "object" + }, "chainguard.platform.auth.HeadlessSession": { "properties": { "ecdhPublicKey": { @@ -907,6 +1152,28 @@ }, "type": "object" }, + "chainguard.platform.auth.Profile": { + "description": "Profile carries upstream OIDC profile claims for a single identity.\nReturned on WhoAmI for the caller's own identity; not exposed via any\nother API surface.", + "properties": { + "familyName": { + "description": "family_name is the upstream `family_name` claim.", + "type": "string" + }, + "givenName": { + "description": "given_name is the upstream `given_name` claim.", + "type": "string" + }, + "name": { + "description": "name is the upstream `name` claim — typically the user's full display name.", + "type": "string" + }, + "picture": { + "description": "picture is the upstream `picture` claim — a URL to the user's avatar.", + "type": "string" + } + }, + "type": "object" + }, "chainguard.platform.auth.RegistrationRequest": { "properties": { "code": { @@ -967,6 +1234,14 @@ "description": "Issuer is the issuer of the token.", "type": "string" }, + "profile": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.auth.Profile" + } + ], + "description": "The upstream profile claims (name, picture, etc.) for the caller's\nidentity, sourced from the most recent authentication. Unset for\nidentities with no stored profile (e.g. assumable identities, or\nhuman identities that haven't authenticated since the feature shipped)." + }, "subject": { "description": "The subject of the token.", "type": "string" @@ -1024,6 +1299,9 @@ "companyName": { "type": "string" }, + "hubspotUtk": { + "type": "string" + }, "jobTitle": { "type": "string" }, @@ -1043,6 +1321,10 @@ }, "type": "array" }, + "selfServe": { + "description": "Product fields.", + "type": "boolean" + }, "utmCampaign": { "title": "UTM fields\nSee https://en.wikipedia.org/wiki/UTM_parameters", "type": "string" @@ -1320,6 +1602,47 @@ }, "type": "object" }, + "chainguard.platform.iam.ExternalGroupRoleMapping": { + "properties": { + "createdAt": { + "description": "When this mapping was created.", + "format": "date-time", + "type": "string" + }, + "externalGroupId": { + "description": "external_group_id is the IdP's identifier for the group.", + "type": "string" + }, + "id": { + "description": "id is the UIDP of this mapping. It is rooted under the owning\nIdentityProvider's UIDP ({org}/{idp}/{mapping}).", + "type": "string" + }, + "identityProviderUidp": { + "description": "identity_provider_uidp is the UIDP of the IdentityProvider this mapping belongs to.", + "type": "string" + }, + "roleUidp": { + "description": "role_uidp is the UIDP of the Chainguard Role to grant.", + "type": "string" + }, + "scope": { + "description": "scope is the UIDP of the Chainguard Group where the role applies.\nToday it must equal the organization root UIDP; it is modeled as a group\nUIDP (rather than an org_id) so role mappings can later be scoped to a\nsub-org or folder without a schema change.", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.iam.ExternalGroupRoleMappingList": { + "properties": { + "items": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.iam.ExternalGroupRoleMapping" + }, + "type": "array" + } + }, + "type": "object" + }, "chainguard.platform.iam.Group": { "properties": { "description": { @@ -1846,6 +2169,10 @@ "clientSecret": { "type": "string" }, + "groupsClaim": { + "description": "groups_claim is the name of the OIDC token claim containing group memberships.\nRequired for IdP group-based role mapping.", + "type": "string" + }, "issuer": { "title": "Issuer URL (e.g https://accounts.google.com)", "type": "string" @@ -2811,6 +3138,10 @@ "readOnly": true, "type": "string" }, + "hubspotUtk": { + "description": "The HubSpot UTK value to pass to HubSpot during console login.\nThis value is ephemeral and not persisted to datastore.", + "type": "string" + }, "jobTitle": { "description": "The user's job title.", "type": "string" @@ -2832,6 +3163,10 @@ "description": "The product the user is interested in.", "type": "string" }, + "selfServe": { + "description": "Flag to indicate if the user is onboarding via a self-service flow.", + "type": "boolean" + }, "uid": { "description": "The caller's identity UID.", "readOnly": true, @@ -2929,6 +3264,10 @@ "description": "Client secret of the identity provider. This is a sensitive value\nand is not returned for list/get calls.", "type": "string" }, + "groupsClaim": { + "description": "Name of the OIDC token claim that carries the user's group memberships\n(e.g. \"groups\" for Entra, a custom claim name for Okta). Required for\nIdP group-based role mapping; when empty, group extraction is skipped.", + "type": "string" + }, "issuer": { "title": "Issuer URL (e.g https://accounts.google.com)", "type": "string" @@ -3596,22 +3935,393 @@ }, "type": "object" }, - "chainguard.platform.libraries.NpmPackage": { - "description": "NpmPackage contains metadata about an npm package available in\nChainguard Libraries. The package name can be used to retrieve\nversion-level details via ListVersions.", + "chainguard.platform.libraries.LibraryAllowListEntry": { + "description": "AllowListEntry bypasses specific automatic gates for a trusted package (PURL).", "properties": { - "description": { - "description": "A short description of the package.", - "type": "string" + "bypassCooldown": { + "description": "Bypass the cooldown gate for matching versions.", + "type": "boolean" }, - "latestVersion": { - "description": "The most recent version of this package available.", - "type": "string" + "bypassMalware": { + "description": "Bypass the malware gate for matching versions. Requires justification.", + "type": "boolean" }, - "license": { - "description": "The SPDX license identifier for this package.", + "justification": { + "description": "Required when bypass_malware is true.", "type": "string" }, - "packageName": { + "purl": { + "description": "The PURL. Normalized on input. An empty component is a wildcard.", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.libraries.LibraryBlockListEntry": { + "description": "BlockListEntry explicitly withholds a package (PURL) regardless of any other\ngate. Block-list entries always take precedence over allow-list entries.", + "properties": { + "purl": { + "description": "The PURL. Normalized on input. An empty component is a wildcard.", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.libraries.LibraryPolicies.UpdatePolicyBody": { + "description": "LibraryPolicy configures Libraries gates via structured block/allow lists and\na cooldown window.", + "properties": { + "allowList": { + "description": "PURL-keyed entries that bypass specific automatic gates.", + "items": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryAllowListEntry" + }, + "type": "array" + }, + "blockList": { + "description": "PURL-keyed entries that withhold a package regardless of other gates.", + "items": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryBlockListEntry" + }, + "type": "array" + }, + "cooldownDays": { + "description": "The cooldown window in days. Unset = inherit default (7); 0 = disabled;\n1-30 = explicit. Values above 30 are rejected.", + "format": "int32", + "type": "integer" + }, + "createdAt": { + "format": "date-time", + "readOnly": true, + "type": "string" + }, + "description": { + "description": "Human-readable description. May be up to 1024 characters.", + "type": "string" + }, + "expression": { + "description": "Raw Rego. OUTPUT_ONLY: populated for SYSTEM policies, empty for CUSTOM.\nSetting it on create/update of a custom policy is rejected (INVALID_ARGUMENT) in v1.", + "readOnly": true, + "type": "string" + }, + "name": { + "description": "Human-readable name. May be up to 128 characters.", + "type": "string" + }, + "policyType": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyType" + } + ], + "description": "SYSTEM or CUSTOM. System policies may not be modified.", + "readOnly": true + }, + "updatedAt": { + "format": "date-time", + "readOnly": true, + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.libraries.LibraryPolicy": { + "description": "LibraryPolicy configures Libraries gates via structured block/allow lists and\na cooldown window.", + "properties": { + "allowList": { + "description": "PURL-keyed entries that bypass specific automatic gates.", + "items": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryAllowListEntry" + }, + "type": "array" + }, + "blockList": { + "description": "PURL-keyed entries that withhold a package regardless of other gates.", + "items": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryBlockListEntry" + }, + "type": "array" + }, + "cooldownDays": { + "description": "The cooldown window in days. Unset = inherit default (7); 0 = disabled;\n1-30 = explicit. Values above 30 are rejected.", + "format": "int32", + "type": "integer" + }, + "createdAt": { + "format": "date-time", + "readOnly": true, + "type": "string" + }, + "description": { + "description": "Human-readable description. May be up to 1024 characters.", + "type": "string" + }, + "expression": { + "description": "Raw Rego. OUTPUT_ONLY: populated for SYSTEM policies, empty for CUSTOM.\nSetting it on create/update of a custom policy is rejected (INVALID_ARGUMENT) in v1.", + "readOnly": true, + "type": "string" + }, + "id": { + "type": "string" + }, + "name": { + "description": "Human-readable name. May be up to 128 characters.", + "type": "string" + }, + "policyType": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyType" + } + ], + "description": "SYSTEM or CUSTOM. System policies may not be modified.", + "readOnly": true + }, + "updatedAt": { + "format": "date-time", + "readOnly": true, + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.libraries.LibraryPolicyBinding": { + "description": "LibraryPolicyBinding activates a policy for an (org, ecosystem) pair.", + "properties": { + "createdAt": { + "format": "date-time", + "readOnly": true, + "type": "string" + }, + "ecosystem": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.libraries.Ecosystem" + } + ], + "description": "The ecosystem this binding applies to (JAVASCRIPT or PYTHON; JAVA rejected)." + }, + "id": { + "type": "string" + }, + "mode": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBindingMode" + } + ], + "description": "ENFORCED or LOG." + }, + "policy": { + "description": "The UIDP of the policy to apply.", + "type": "string" + }, + "updatedAt": { + "format": "date-time", + "readOnly": true, + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.libraries.LibraryPolicyBindingList": { + "properties": { + "items": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBinding" + }, + "type": "array" + }, + "nextPageToken": { + "type": "string" + }, + "skipped": { + "format": "int32", + "type": "integer" + }, + "totalCount": { + "format": "int64", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.libraries.LibraryPolicyBindingMode": { + "default": "LIBRARY_POLICY_BINDING_MODE_UNSPECIFIED", + "description": "BindingMode controls whether a binding enforces (blocks pulls) or only logs\nshadow violations.\n\n - LIBRARY_POLICY_BINDING_MODE_ENFORCED: Withhold packages that fail the policy.\n - LIBRARY_POLICY_BINDING_MODE_LOG: Evaluate and record violations without blocking.", + "enum": [ + "LIBRARY_POLICY_BINDING_MODE_UNSPECIFIED", + "LIBRARY_POLICY_BINDING_MODE_ENFORCED", + "LIBRARY_POLICY_BINDING_MODE_LOG" + ], + "type": "string" + }, + "chainguard.platform.libraries.LibraryPolicyBindings.UpdateBindingBody": { + "description": "LibraryPolicyBinding activates a policy for an (org, ecosystem) pair.", + "properties": { + "createdAt": { + "format": "date-time", + "readOnly": true, + "type": "string" + }, + "ecosystem": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.libraries.Ecosystem" + } + ], + "description": "The ecosystem this binding applies to (JAVASCRIPT or PYTHON; JAVA rejected)." + }, + "mode": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBindingMode" + } + ], + "description": "ENFORCED or LOG." + }, + "policy": { + "description": "The UIDP of the policy to apply.", + "type": "string" + }, + "updatedAt": { + "format": "date-time", + "readOnly": true, + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.libraries.LibraryPolicyBlockEvent": { + "description": "LibraryPolicyBlockEvent records that a package version was withheld.", + "properties": { + "attemptCount": { + "format": "int32", + "type": "integer" + }, + "cooldownDays": { + "description": "Cooldown days snapshotted at first block.", + "format": "int32", + "type": "integer" + }, + "ecosystem": { + "description": "The ecosystem string (e.g. \"JAVASCRIPT\").", + "type": "string" + }, + "firstBlockedAt": { + "format": "date-time", + "type": "string" + }, + "id": { + "type": "string" + }, + "lastBlockedAt": { + "format": "date-time", + "type": "string" + }, + "mode": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBindingMode" + } + ], + "description": "ENFORCED or LOG." + }, + "policy": { + "description": "The policy UIDP active when the block occurred.", + "type": "string" + }, + "publishDate": { + "description": "Upstream publish date; set when reason = cooldown.", + "format": "date-time", + "type": "string" + }, + "purl": { + "description": "Full PURL of the attempted pull.", + "type": "string" + }, + "reason": { + "description": "cooldown, malware, or policy.", + "type": "string" + }, + "unblocksAt": { + "description": "publish_date + cooldown_days; nil when reason != cooldown.", + "format": "date-time", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.libraries.LibraryPolicyBlockEventList": { + "properties": { + "items": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBlockEvent" + }, + "type": "array" + }, + "nextPageToken": { + "type": "string" + }, + "skipped": { + "format": "int32", + "type": "integer" + }, + "totalCount": { + "format": "int64", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.libraries.LibraryPolicyList": { + "properties": { + "items": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicy" + }, + "type": "array" + }, + "nextPageToken": { + "description": "Token for retrieving the next page of results. Empty if no more results.", + "type": "string" + }, + "skipped": { + "format": "int32", + "type": "integer" + }, + "totalCount": { + "format": "int64", + "type": "string" + } + }, + "type": "object" + }, + "chainguard.platform.libraries.LibraryPolicyType": { + "default": "LIBRARY_POLICY_TYPE_UNSPECIFIED", + "description": "PolicyType distinguishes Chainguard-authored system policies from\ncustomer-managed custom policies.\n\n - LIBRARY_POLICY_TYPE_SYSTEM: Created and managed by Chainguard; readable but not modifiable.\n - LIBRARY_POLICY_TYPE_CUSTOM: Created and managed by your organization.", + "enum": [ + "LIBRARY_POLICY_TYPE_UNSPECIFIED", + "LIBRARY_POLICY_TYPE_SYSTEM", + "LIBRARY_POLICY_TYPE_CUSTOM" + ], + "type": "string" + }, + "chainguard.platform.libraries.NpmPackage": { + "description": "NpmPackage contains metadata about an npm package available in\nChainguard Libraries. The package name can be used to retrieve\nversion-level details via ListVersions.", + "properties": { + "description": { + "description": "A short description of the package.", + "type": "string" + }, + "latestVersion": { + "description": "The most recent version of this package available.", + "type": "string" + }, + "license": { + "description": "The SPDX license identifier for this package.", + "type": "string" + }, + "packageName": { "description": "The npm package name (e.g. \"react\" or \"@types/node\").", "type": "string" }, @@ -3649,26 +4359,62 @@ "description": "NpmPackageVersion contains metadata about a specific version of an\nnpm package available in Chainguard Libraries.", "properties": { "createdAt": { - "description": "When this version was first published.", + "description": "created_at is when the record was created in the database.", "format": "date-time", "type": "string" }, "fileCount": { - "description": "The number of files contained in the package.", + "description": "file_count is the number of files inside the tarball.", "format": "int64", "type": "string" }, "fileSize": { - "description": "The size of the package in bytes.", + "description": "file_size is the size of the tarball in bytes.", "format": "int64", "type": "string" }, + "integrity": { + "description": "integrity is the SRI string (optional).", + "type": "string" + }, "license": { - "description": "The SPDX license identifier for this version.", + "description": "license is the SPDX license identifier for this version (e.g., \"MIT\", \"Apache-2.0\").", + "type": "string" + }, + "malwareMalicious": { + "description": "malware_malicious indicates whether this version was flagged as malicious.", + "type": "boolean" + }, + "malwareScanned": { + "description": "malware_scanned indicates whether this version has been scanned for malware.", + "type": "boolean" + }, + "malwareScannedAt": { + "description": "malware_scanned_at is when the malware scan was performed.", + "format": "date-time", "type": "string" }, "packageName": { - "description": "The npm package name (e.g. \"react\" or \"@scope/lib\").", + "title": "package_name is the full package name including scope.\ne.g., \"@scope/lib\" or \"react\"", + "type": "string" + }, + "provenancePredicateType": { + "title": "provenance_predicate_type is the SLSA predicate type URI if provenance was\nprovided at publish time. Empty string if no provenance was provided.\ne.g., \"https://slsa.dev/provenance/v1\" or \"https://slsa.dev/provenance/v0.2\"", + "type": "string" + }, + "putumentRef": { + "description": "putument_ref is the R2 storage path to the raw putument JSON blob.", + "type": "string" + }, + "sbomFormats": { + "description": "sbom_formats are the supported sbom formats for this package.", + "items": { + "type": "string" + }, + "type": "array" + }, + "sha512": { + "description": "sha512 is the SHA-512 checksum of the tarball (required).", "type": "string" }, "sourceType": { @@ -3677,10 +4423,24 @@ "$ref": "#/components/schemas/chainguard.platform.libraries.NpmSourceType" } ], - "description": "The origin of this package version." + "description": "source_type indicates the origin of this version." + }, + "updatedAt": { + "description": "updated_at is when the record was last updated.", + "format": "date-time", + "type": "string" + }, + "upstreamPublishedDate": { + "description": "upstream_published_date is when the package was published upstream (optional).", + "format": "date-time", + "type": "string" }, "version": { - "description": "The version string of this package version.", + "title": "version is the semver string.\ne.g., \"18.2.0\"", + "type": "string" + }, + "versionMetadata": { + "description": "version_metadata is a JSON blob of the version object from the putument,\nused to serve rich packument responses without fetching from R2.", "type": "string" } }, @@ -4028,7 +4788,7 @@ }, "type": "object" }, - "chainguard.platform.policygates.v1.Binding": { + "chainguard.platform.policies.v1.Binding": { "description": "Binding associates a Policy with a resource in the hierarchy.\nThe binding is a child of the resource it applies to, and its policy\nis applied to all descendants of that resource.", "properties": { "createdAt": { @@ -4044,7 +4804,7 @@ "mode": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.PolicyMode" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.PolicyMode" } ], "description": "PolicyMode defines how the policy is enforced." @@ -4074,12 +4834,12 @@ }, "type": "object" }, - "chainguard.platform.policygates.v1.BindingList": { + "chainguard.platform.policies.v1.BindingList": { "properties": { "items": { "description": "The requested bindings.", "items": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Binding" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Binding" }, "type": "array" }, @@ -4100,7 +4860,7 @@ }, "type": "object" }, - "chainguard.platform.policygates.v1.Bindings.UpdateBindingBody": { + "chainguard.platform.policies.v1.Bindings.UpdateBindingBody": { "description": "Binding associates a Policy with a resource in the hierarchy.\nThe binding is a child of the resource it applies to, and its policy\nis applied to all descendants of that resource.", "properties": { "createdAt": { @@ -4112,7 +4872,7 @@ "mode": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.PolicyMode" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.PolicyMode" } ], "description": "PolicyMode defines how the policy is enforced." @@ -4142,7 +4902,7 @@ }, "type": "object" }, - "chainguard.platform.policygates.v1.ParameterSchema": { + "chainguard.platform.policies.v1.ParameterSchema": { "description": "ParameterSchema declares a single configurable parameter on a Policy.\nBindings supply values for these parameters at activation time.", "properties": { "allowedValues": { @@ -4178,7 +4938,7 @@ "type": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.ParameterType" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.ParameterType" } ], "description": "The data type of the parameter value." @@ -4186,18 +4946,19 @@ }, "type": "object" }, - "chainguard.platform.policygates.v1.ParameterType": { + "chainguard.platform.policies.v1.ParameterType": { "default": "PARAMETER_TYPE_UNSPECIFIED", - "description": "The data type of a configurable parameter on a Policy.\n\n - PARAMETER_TYPE_STRING: A UTF-8 string value.\n - PARAMETER_TYPE_INTEGER: A signed 64-bit integer value.\n - PARAMETER_TYPE_STRING_LIST: A list of UTF-8 string values.", + "description": "The data type of a configurable parameter on a Policy.\n\n - PARAMETER_TYPE_STRING: A UTF-8 string value.\n - PARAMETER_TYPE_INTEGER: A signed 64-bit integer value.\n - PARAMETER_TYPE_STRING_LIST: A list of UTF-8 string values.\n - PARAMETER_TYPE_BOOLEAN: A boolean value.", "enum": [ "PARAMETER_TYPE_UNSPECIFIED", "PARAMETER_TYPE_STRING", "PARAMETER_TYPE_INTEGER", - "PARAMETER_TYPE_STRING_LIST" + "PARAMETER_TYPE_STRING_LIST", + "PARAMETER_TYPE_BOOLEAN" ], "type": "string" }, - "chainguard.platform.policygates.v1.Policies.UpdatePolicyBody": { + "chainguard.platform.policies.v1.Policies.UpdatePolicyBody": { "description": "Policy defines a rule that can be evaluated on an image\nin a repository, giving an \"allowed\" or \"disallowed\" decision.", "properties": { "createdAt": { @@ -4221,7 +4982,7 @@ "parameterSchemas": { "description": "The configurable parameter schemas declared by this policy. System\npolicies declare these; customers configure values on the bindings that\nactivate the policy.", "items": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.ParameterSchema" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.ParameterSchema" }, "readOnly": true, "type": "array" @@ -4229,7 +4990,7 @@ "policyType": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.PolicyType" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.PolicyType" } ], "description": "The type of policy (system or custom).\nSystem policies are created automatically by the system and may not be modified.\nCustom policies may be created and modified by users with the relevant IAM permissions.", @@ -4251,7 +5012,7 @@ }, "type": "object" }, - "chainguard.platform.policygates.v1.Policy": { + "chainguard.platform.policies.v1.Policy": { "description": "Policy defines a rule that can be evaluated on an image\nin a repository, giving an \"allowed\" or \"disallowed\" decision.", "properties": { "createdAt": { @@ -4278,7 +5039,7 @@ "parameterSchemas": { "description": "The configurable parameter schemas declared by this policy. System\npolicies declare these; customers configure values on the bindings that\nactivate the policy.", "items": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.ParameterSchema" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.ParameterSchema" }, "readOnly": true, "type": "array" @@ -4286,7 +5047,7 @@ "policyType": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.PolicyType" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.PolicyType" } ], "description": "The type of policy (system or custom).\nSystem policies are created automatically by the system and may not be modified.\nCustom policies may be created and modified by users with the relevant IAM permissions.", @@ -4308,12 +5069,12 @@ }, "type": "object" }, - "chainguard.platform.policygates.v1.PolicyList": { + "chainguard.platform.policies.v1.PolicyList": { "properties": { "items": { "description": "The Policy items requested.", "items": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Policy" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Policy" }, "type": "array" }, @@ -4334,7 +5095,7 @@ }, "type": "object" }, - "chainguard.platform.policygates.v1.PolicyMode": { + "chainguard.platform.policies.v1.PolicyMode": { "default": "POLICY_MODE_UNSPECIFIED", "description": "The mode to use when evaluating the policy.\n\n - POLICY_MODE_ENFORCED: Disallow access to the artifact when it doesn't satisfy the applied policy.\n - POLICY_MODE_DRY_RUN: Allow access to the artifact when it doesn't satisfy the applied policy, but log the outcome.", "enum": [ @@ -4344,7 +5105,7 @@ ], "type": "string" }, - "chainguard.platform.policygates.v1.PolicyType": { + "chainguard.platform.policies.v1.PolicyType": { "default": "POLICY_TYPE_UNSPECIFIED", "description": "The type of policy.\n\n - POLICY_TYPE_SYSTEM: The policy was created and managed by the system.\n - POLICY_TYPE_CUSTOM: The policy was created and managed by your organization.", "enum": [ @@ -5615,6 +6376,11 @@ ], "description": "The mode the policy was operating in." }, + "parameters": { + "additionalProperties": {}, + "description": "The parameter values the binding supplied for this evaluation, keyed by\nparameter name. Surfaces what the allow/deny outcome was configured with.", + "type": "object" + }, "policyId": { "description": "The UIDP of the policy that was evaluated.", "type": "string" @@ -9063,7 +9829,7 @@ } }, { - "description": "Filter to documents in a specific lifecycle state.\nSTATUS_UNSPECIFIED (the default) returns documents in any state.\n\n - STATUS_PENDING: Payload received; pending downstream processing.\n - STATUS_READY: Document is fully usable.\n - STATUS_FAILED: Document processing failed; the document is unusable.", + "description": "Filter to documents in a specific lifecycle state.\nSTATUS_UNSPECIFIED (the default) returns documents in any state.\n\n - STATUS_PENDING: Payload received; pending downstream processing.\n - STATUS_READY: Document is fully usable.\n - STATUS_FAILED: Document processing failed; the document is unusable.\n - STATUS_FALSE_POSITIVE: Processing determined the finding is not a true positive.", "in": "query", "name": "status", "schema": { @@ -9072,7 +9838,8 @@ "STATUS_UNSPECIFIED", "STATUS_PENDING", "STATUS_READY", - "STATUS_FAILED" + "STATUS_FAILED", + "STATUS_FALSE_POSITIVE" ], "type": "string" } @@ -9179,14 +9946,154 @@ "pattern": ".+", "type": "string" } - } - ], + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "type": "object" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Delete", + "tags": [ + "ArgosDocuments" + ] + } + }, + "/argos/v1/documents/{parentId}": { + "post": { + "operationId": "ArgosDocuments_Create", + "parameters": [ + { + "description": "parent_id is the exact UIDP of the organization (root group) to nest this\ndocument under.", + "in": "path", + "name": "parentId", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.argos.ArgosDocuments.CreateBody" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.argos.ArgosDocument" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Create", + "tags": [ + "ArgosDocuments" + ] + } + }, + "/argos/v1/orgs/{parentId}/publicKey": { + "get": { + "description": "GetOrgPublicKey returns the PEM-encoded RSA-OAEP public key for the\ngiven organization. Clients fetch this once per upload destination and\nuse it to wrap a fresh per-document AES key client-side. The\ncorresponding private key never leaves Cloud KMS.", + "operationId": "ArgosDocuments_GetOrgPublicKey", + "parameters": [ + { + "description": "parent_id is the UIDP of the organization whose public key is requested.", + "in": "path", + "name": "parentId", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.argos.ArgosOrgPublicKey" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Get Org Public Key", + "tags": [ + "ArgosDocuments" + ] + } + }, + "/argos/v1/osv/query": { + "post": { + "operationId": "ArgosOSV_Query", + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.argos.OSVQueryRequest" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.argos.OSVQueryResponse" } } }, @@ -9203,32 +10110,20 @@ "description": "An unexpected error response." } }, - "summary": "Delete", + "summary": "Query", "tags": [ - "ArgosDocuments" + "ArgosOSV" ] } }, - "/argos/v1/documents/{parentId}": { + "/argos/v1/osv/querybatch": { "post": { - "operationId": "ArgosDocuments_Create", - "parameters": [ - { - "description": "parent_id is the exact UIDP of the organization (root group) to nest this\ndocument under.", - "in": "path", - "name": "parentId", - "required": true, - "schema": { - "pattern": ".+", - "type": "string" - } - } - ], + "operationId": "ArgosOSV_QueryBatch", "requestBody": { "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.argos.ArgosDocuments.CreateBody" + "$ref": "#/components/schemas/chainguard.platform.argos.OSVQueryBatchRequest" } } }, @@ -9240,7 +10135,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.argos.ArgosDocument" + "$ref": "#/components/schemas/chainguard.platform.argos.OSVQueryBatchResponse" } } }, @@ -9257,21 +10152,19 @@ "description": "An unexpected error response." } }, - "summary": "Create", + "summary": "Query Batch", "tags": [ - "ArgosDocuments" + "ArgosOSV" ] } }, - "/argos/v1/orgs/{parentId}/publicKey": { + "/argos/v1/osv/vulns/{id}": { "get": { - "description": "GetOrgPublicKey returns the PEM-encoded RSA-OAEP public key for the\ngiven organization. Clients fetch this once per upload destination and\nuse it to wrap a fresh per-document AES key client-side. The\ncorresponding private key never leaves Cloud KMS.", - "operationId": "ArgosDocuments_GetOrgPublicKey", + "operationId": "ArgosOSV_GetVuln", "parameters": [ { - "description": "parent_id is the UIDP of the organization whose public key is requested.", "in": "path", - "name": "parentId", + "name": "id", "required": true, "schema": { "pattern": ".+", @@ -9284,7 +10177,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.argos.ArgosOrgPublicKey" + "$ref": "#/components/schemas/chainguard.platform.argos.OSVRecord" } } }, @@ -9301,9 +10194,9 @@ "description": "An unexpected error response." } }, - "summary": "Get Org Public Key", + "summary": "Get Vuln", "tags": [ - "ArgosDocuments" + "ArgosOSV" ] } }, @@ -10069,23 +10962,244 @@ } } ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.GroupAccountAssociations.CheckBody" - } - } - }, - "required": true, - "x-originalParamName": "body" - }, + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.GroupAccountAssociations.CheckBody" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.AccountAssociationsStatus" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Check", + "tags": [ + "GroupAccountAssociations" + ] + } + }, + "/iam/v1/externalGroupRoleMappings": { + "get": { + "operationId": "ExternalGroupRoleMappings_List", + "parameters": [ + { + "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", + "in": "query", + "name": "uidp.ancestorsOf", + "schema": { + "type": "string" + } + }, + { + "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", + "in": "query", + "name": "uidp.descendantsOf", + "schema": { + "type": "string" + } + }, + { + "description": "children_of are groups reachable by directly proceeding from parent to children.", + "in": "query", + "name": "uidp.childrenOf", + "schema": { + "type": "string" + } + }, + { + "description": "in_root resticts responses to root level resources (organizations, user identities)", + "in": "query", + "name": "uidp.inRoot", + "schema": { + "type": "boolean" + } + }, + { + "description": "ids are a list of exact UIDPs of records.", + "in": "query", + "name": "uidp.ids", + "schema": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + { + "description": "identity_provider_uidp filters to a specific IdentityProvider.", + "in": "query", + "name": "identityProviderUidp", + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.ExternalGroupRoleMappingList" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "List", + "tags": [ + "ExternalGroupRoleMappings" + ] + } + }, + "/iam/v1/externalGroupRoleMappings/{id}": { + "delete": { + "operationId": "ExternalGroupRoleMappings_Delete", + "parameters": [ + { + "in": "path", + "name": "id", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "type": "object" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Delete", + "tags": [ + "ExternalGroupRoleMappings" + ] + } + }, + "/iam/v1/externalGroupRoleMappings/{parentId}": { + "post": { + "operationId": "ExternalGroupRoleMappings_Create", + "parameters": [ + { + "in": "path", + "name": "parentId", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.ExternalGroupRoleMapping" + } + } + }, + "required": true, + "x-originalParamName": "mapping" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.ExternalGroupRoleMapping" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Create", + "tags": [ + "ExternalGroupRoleMappings" + ] + } + }, + "/iam/v1/externalGroupRoleMappings/{uid}": { + "get": { + "operationId": "ExternalGroupRoleMappings_Get", + "parameters": [ + { + "in": "path", + "name": "uid", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.AccountAssociationsStatus" + "$ref": "#/components/schemas/chainguard.platform.iam.ExternalGroupRoleMapping" } } }, @@ -10102,9 +11216,9 @@ "description": "An unexpected error response." } }, - "summary": "Check", + "summary": "Get", "tags": [ - "GroupAccountAssociations" + "ExternalGroupRoleMappings" ] } }, @@ -10798,12 +11912,254 @@ ] } }, - "/iam/v1/identities/{id}": { + "/iam/v1/identities/{id}": { + "delete": { + "operationId": "Identities_Delete", + "parameters": [ + { + "description": "ID, UIDP of the record.", + "in": "path", + "name": "id", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "type": "object" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Delete", + "tags": [ + "IAMIdentities" + ] + }, + "put": { + "operationId": "Identities_Update", + "parameters": [ + { + "description": "id is unique identifier of this specific identity.", + "in": "path", + "name": "id", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.Identities.UpdateBody" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.Identity" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Update", + "tags": [ + "IAMIdentities" + ] + } + }, + "/iam/v1/identities/{parentId}": { + "post": { + "operationId": "Identities_Create", + "parameters": [ + { + "description": "parent_id, The Group UIDP path under which the new Identity resides.", + "in": "path", + "name": "parentId", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.Identity" + } + } + }, + "description": "Identity to create.", + "required": true, + "x-originalParamName": "identity" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.Identity" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Create", + "tags": [ + "IAMIdentities" + ] + } + }, + "/iam/v1/identityProviders": { + "get": { + "operationId": "IdentityProviders_List", + "parameters": [ + { + "description": "Exact match on identity provider UIDP", + "in": "query", + "name": "id", + "schema": { + "type": "string" + } + }, + { + "description": "Exact match on identity provider name", + "in": "query", + "name": "name", + "schema": { + "type": "string" + } + }, + { + "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", + "in": "query", + "name": "uidp.ancestorsOf", + "schema": { + "type": "string" + } + }, + { + "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", + "in": "query", + "name": "uidp.descendantsOf", + "schema": { + "type": "string" + } + }, + { + "description": "children_of are groups reachable by directly proceeding from parent to children.", + "in": "query", + "name": "uidp.childrenOf", + "schema": { + "type": "string" + } + }, + { + "description": "in_root resticts responses to root level resources (organizations, user identities)", + "in": "query", + "name": "uidp.inRoot", + "schema": { + "type": "boolean" + } + }, + { + "description": "ids are a list of exact UIDPs of records.", + "in": "query", + "name": "uidp.ids", + "schema": { + "items": { + "type": "string" + }, + "type": "array" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProviderList" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "List", + "tags": [ + "IdentityProviders" + ] + } + }, + "/iam/v1/identityProviders/{id}": { "delete": { - "operationId": "Identities_Delete", + "operationId": "IdentityProviders_Delete", "parameters": [ { - "description": "ID, UIDP of the record.", + "description": "id is the exact UIDP of the IdP", "in": "path", "name": "id", "required": true, @@ -10837,14 +12193,14 @@ }, "summary": "Delete", "tags": [ - "IAMIdentities" + "IdentityProviders" ] }, "put": { - "operationId": "Identities_Update", + "operationId": "IdentityProviders_Update", "parameters": [ { - "description": "id is unique identifier of this specific identity.", + "description": "id is unique identifier of this specific identity provider", "in": "path", "name": "id", "required": true, @@ -10858,7 +12214,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Identities.UpdateBody" + "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProviders.UpdateBody" } } }, @@ -10870,7 +12226,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Identity" + "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProvider" } } }, @@ -10889,16 +12245,16 @@ }, "summary": "Update", "tags": [ - "IAMIdentities" + "IdentityProviders" ] } }, - "/iam/v1/identities/{parentId}": { + "/iam/v1/identityProviders/{parentId}": { "post": { - "operationId": "Identities_Create", + "operationId": "IdentityProviders_Create", "parameters": [ { - "description": "parent_id, The Group UIDP path under which the new Identity resides.", + "description": "parent_id is the exact UIDP of the IAM group to nest this identity provider under", "in": "path", "name": "parentId", "required": true, @@ -10912,20 +12268,19 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Identity" + "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProvider" } } }, - "description": "Identity to create.", "required": true, - "x-originalParamName": "identity" + "x-originalParamName": "identityProvider" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Identity" + "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProvider" } } }, @@ -10944,30 +12299,22 @@ }, "summary": "Create", "tags": [ - "IAMIdentities" + "IdentityProviders" ] } }, - "/iam/v1/identityProviders": { + "/iam/v1/rolebindings": { "get": { - "operationId": "IdentityProviders_List", + "operationId": "RoleBindings_List", "parameters": [ { - "description": "Exact match on identity provider UIDP", + "description": "id is the exact UID of the record.", "in": "query", "name": "id", "schema": { "type": "string" } }, - { - "description": "Exact match on identity provider name", - "in": "query", - "name": "name", - "schema": { - "type": "string" - } - }, { "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", "in": "query", @@ -11017,7 +12364,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProviderList" + "$ref": "#/components/schemas/chainguard.platform.iam.RoleBindingList" } } }, @@ -11036,16 +12383,74 @@ }, "summary": "List", "tags": [ - "IdentityProviders" + "RoleBindings" ] } }, - "/iam/v1/identityProviders/{id}": { + "/iam/v1/rolebindings/batch/{parent}": { + "post": { + "operationId": "RoleBindings_CreateBatch", + "parameters": [ + { + "description": "parent, The Group UIDP path under which the new RoleBinding resides.", + "in": "path", + "name": "parent", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "items": { + "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" + }, + "type": "array" + } + } + }, + "description": "RoleBinding to create.", + "required": true, + "x-originalParamName": "roleBindings" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.RoleBindingBatch" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Create Batch", + "tags": [ + "RoleBindings" + ] + } + }, + "/iam/v1/rolebindings/{id}": { "delete": { - "operationId": "IdentityProviders_Delete", + "operationId": "RoleBindings_Delete", "parameters": [ { - "description": "id is the exact UIDP of the IdP", + "description": "id is the exact UID of the record.", "in": "path", "name": "id", "required": true, @@ -11079,14 +12484,14 @@ }, "summary": "Delete", "tags": [ - "IdentityProviders" + "RoleBindings" ] }, "put": { - "operationId": "IdentityProviders_Update", + "operationId": "RoleBindings_Update", "parameters": [ { - "description": "id is unique identifier of this specific identity provider", + "description": "id, the UID of this role binding.", "in": "path", "name": "id", "required": true, @@ -11100,7 +12505,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProviders.UpdateBody" + "$ref": "#/components/schemas/chainguard.platform.iam.RoleBindings.UpdateBody" } } }, @@ -11112,7 +12517,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProvider" + "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" } } }, @@ -11131,18 +12536,18 @@ }, "summary": "Update", "tags": [ - "IdentityProviders" + "RoleBindings" ] } }, - "/iam/v1/identityProviders/{parentId}": { + "/iam/v1/rolebindings/{parent}": { "post": { - "operationId": "IdentityProviders_Create", + "operationId": "RoleBindings_Create", "parameters": [ { - "description": "parent_id is the exact UIDP of the IAM group to nest this identity provider under", + "description": "parent, The Group UIDP path under which the new RoleBinding resides.", "in": "path", - "name": "parentId", + "name": "parent", "required": true, "schema": { "pattern": ".+", @@ -11154,19 +12559,20 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProvider" + "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" } } }, + "description": "RoleBinding to create.", "required": true, - "x-originalParamName": "identityProvider" + "x-originalParamName": "roleBinding" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.IdentityProvider" + "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" } } }, @@ -11185,22 +12591,38 @@ }, "summary": "Create", "tags": [ - "IdentityProviders" + "RoleBindings" ] } }, - "/iam/v1/rolebindings": { + "/iam/v1/roles": { "get": { - "operationId": "RoleBindings_List", + "operationId": "Roles_List", "parameters": [ { - "description": "id is the exact UID of the record.", + "description": "id is the exact UIDP of the record.", "in": "query", "name": "id", "schema": { "type": "string" } }, + { + "description": "name is the exact name of the record", + "in": "query", + "name": "name", + "schema": { + "type": "string" + } + }, + { + "description": "parent is the exact UIDP of the parent, or / for root", + "in": "query", + "name": "parent", + "schema": { + "type": "string" + } + }, { "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", "in": "query", @@ -11250,7 +12672,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleBindingList" + "$ref": "#/components/schemas/chainguard.platform.iam.RoleList" } } }, @@ -11269,18 +12691,59 @@ }, "summary": "List", "tags": [ - "RoleBindings" + "Roles" ] } }, - "/iam/v1/rolebindings/batch/{parent}": { - "post": { - "operationId": "RoleBindings_CreateBatch", + "/iam/v1/roles/{id}": { + "delete": { + "operationId": "Roles_Delete", "parameters": [ { - "description": "parent, The Group UIDP path under which the new RoleBinding resides.", + "description": "id is the exact UIDP of the record.", "in": "path", - "name": "parent", + "name": "id", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "type": "object" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Delete", + "tags": [ + "Roles" + ] + }, + "put": { + "operationId": "Roles_Update", + "parameters": [ + { + "description": "id, The Group path under which this Role resides.", + "in": "path", + "name": "id", "required": true, "schema": { "pattern": ".+", @@ -11292,23 +12755,19 @@ "content": { "*/*": { "schema": { - "items": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" - }, - "type": "array" + "$ref": "#/components/schemas/chainguard.platform.iam.Roles.UpdateBody" } } }, - "description": "RoleBinding to create.", "required": true, - "x-originalParamName": "roleBindings" + "x-originalParamName": "body" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleBindingBatch" + "$ref": "#/components/schemas/chainguard.platform.iam.Role" } } }, @@ -11325,20 +12784,20 @@ "description": "An unexpected error response." } }, - "summary": "Create Batch", + "summary": "Update", "tags": [ - "RoleBindings" + "Roles" ] } }, - "/iam/v1/rolebindings/{id}": { - "delete": { - "operationId": "RoleBindings_Delete", + "/iam/v1/roles/{parentId}": { + "post": { + "operationId": "Roles_Create", "parameters": [ { - "description": "id is the exact UID of the record.", + "description": "parent_id, The Group UIDP path under which the new Role resides.", "in": "path", - "name": "id", + "name": "parentId", "required": true, "schema": { "pattern": ".+", @@ -11346,12 +12805,24 @@ } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.Role" + } + } + }, + "description": "Role to create.", + "required": true, + "x-originalParamName": "role" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.iam.Role" } } }, @@ -11368,18 +12839,21 @@ "description": "An unexpected error response." } }, - "summary": "Delete", + "summary": "Create", "tags": [ - "RoleBindings" + "Roles" ] - }, - "put": { - "operationId": "RoleBindings_Update", + } + }, + "/iam/v1/terms/{group}": { + "get": { + "description": "ListAccepted returns the legal documents that the group has accepted.", + "operationId": "Terms_ListAccepted", "parameters": [ { - "description": "id, the UID of this role binding.", + "description": "group is the UIDP of the org to list documents for.", "in": "path", - "name": "id", + "name": "group", "required": true, "schema": { "pattern": ".+", @@ -11387,23 +12861,12 @@ } } ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleBindings.UpdateBody" - } - } - }, - "required": true, - "x-originalParamName": "body" - }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" + "$ref": "#/components/schemas/chainguard.platform.iam.TermsList" } } }, @@ -11420,20 +12883,19 @@ "description": "An unexpected error response." } }, - "summary": "Update", + "summary": "List Accepted", "tags": [ - "RoleBindings" + "Terms" ] - } - }, - "/iam/v1/rolebindings/{parent}": { + }, "post": { - "operationId": "RoleBindings_Create", + "description": "AcceptTerms records that the group has accepted one or more legal\ndocuments. Called by chainctl after the user completes the acceptance flow.", + "operationId": "Terms_AcceptTerms", "parameters": [ { - "description": "parent, The Group UIDP path under which the new RoleBinding resides.", + "description": "group is the UIDP of the org on whose behalf legal docs are being accepted.", "in": "path", - "name": "parent", + "name": "group", "required": true, "schema": { "pattern": ".+", @@ -11445,20 +12907,19 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" + "$ref": "#/components/schemas/chainguard.platform.iam.Terms.AcceptTermsBody" } } }, - "description": "RoleBinding to create.", "required": true, - "x-originalParamName": "roleBinding" + "x-originalParamName": "body" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleBinding" + "type": "object" } } }, @@ -11475,81 +12936,100 @@ "description": "An unexpected error response." } }, - "summary": "Create", + "summary": "Accept Terms", "tags": [ - "RoleBindings" + "Terms" ] } }, - "/iam/v1/roles": { + "/iam/v2beta1/accountAssociations": { "get": { - "operationId": "Roles_List", + "description": "ListAccountAssociations returns account associations with pagination support.", + "operationId": "AccountAssociationsService_ListAccountAssociations", "parameters": [ { - "description": "id is the exact UIDP of the record.", + "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", "in": "query", - "name": "id", + "name": "uidp.ancestorsOf", "schema": { "type": "string" } }, { - "description": "name is the exact name of the record", + "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", "in": "query", - "name": "name", + "name": "uidp.descendantsOf", "schema": { "type": "string" } }, { - "description": "parent is the exact UIDP of the parent, or / for root", + "description": "children_of are groups reachable by directly proceeding from parent to children.", "in": "query", - "name": "parent", + "name": "uidp.childrenOf", "schema": { "type": "string" } }, { - "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", + "description": "in_root resticts responses to root level resources (organizations, user identities)", "in": "query", - "name": "uidp.ancestorsOf", + "name": "uidp.inRoot", "schema": { - "type": "string" + "type": "boolean" } }, { - "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", + "description": "ids are a list of exact UIDPs of records.", "in": "query", - "name": "uidp.descendantsOf", + "name": "uidp.ids", + "schema": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + { + "description": "Optional exact name to filter by.", + "in": "query", + "name": "name", "schema": { "type": "string" } }, { - "description": "children_of are groups reachable by directly proceeding from parent to children.", + "description": "Maximum number of results to return per page.\nDefault: 50, Maximum: 200.", "in": "query", - "name": "uidp.childrenOf", + "name": "pageSize", + "schema": { + "format": "int32", + "type": "integer" + } + }, + { + "description": "Page token from a previous List response for pagination.\nOpaque token with 3-day expiration.", + "in": "query", + "name": "pageToken", "schema": { "type": "string" } }, { - "description": "in_root resticts responses to root level resources (organizations, user identities)", + "description": "Order results by field. Format: \"field [asc|desc]\"\nDefault: \"group asc\"\nNote: Changing order_by between pages invalidates the page token.", "in": "query", - "name": "uidp.inRoot", + "name": "orderBy", "schema": { - "type": "boolean" + "type": "string" } }, { - "description": "ids are a list of exact UIDPs of records.", + "description": "Number of results to skip before returning.\nUsed for random-access pagination (jumping to arbitrary pages).\nMust be non-negative.", "in": "query", - "name": "uidp.ids", + "name": "skip", "schema": { - "items": { - "type": "string" - }, - "type": "array" + "format": "int32", + "type": "integer" } } ], @@ -11558,7 +13038,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.RoleList" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ListAccountAssociationsResponse" } } }, @@ -11575,20 +13055,21 @@ "description": "An unexpected error response." } }, - "summary": "List", + "summary": "List Account Associations", "tags": [ - "Roles" + "AccountAssociationsService" ] } }, - "/iam/v1/roles/{id}": { - "delete": { - "operationId": "Roles_Delete", + "/iam/v2beta1/accountAssociations/{accountAssociation.uid}": { + "patch": { + "description": "UpdateAccountAssociation updates an account association's fields.", + "operationId": "AccountAssociationsService_UpdateAccountAssociation", "parameters": [ { - "description": "id is the exact UIDP of the record.", + "description": "Unique identifier (the group UIDP this association belongs to).", "in": "path", - "name": "id", + "name": "accountAssociation.uid", "required": true, "schema": { "pattern": ".+", @@ -11596,12 +13077,90 @@ } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "properties": { + "amazon": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation.Amazon" + } + ], + "description": "Amazon account association metadata." + }, + "azure": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation.Azure" + } + ], + "description": "Azure tenant and client association metadata." + }, + "chainguard": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation.Chainguard" + } + ], + "description": "Chainguard service principal bindings." + }, + "createTime": { + "description": "When the association was created.", + "format": "date-time", + "readOnly": true, + "type": "string" + }, + "description": { + "description": "Optional description of the association.", + "type": "string" + }, + "github": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation.GitHub" + } + ], + "description": "github holds GitHub App installation associations for this group." + }, + "google": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation.Google" + } + ], + "description": "Google Cloud project association metadata." + }, + "name": { + "description": "Human-readable name of the association.", + "type": "string" + }, + "updateTime": { + "description": "When the association was last updated.", + "format": "date-time", + "readOnly": true, + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "The account association to update.", + "type": "object" + } + } + }, + "description": "The account association to update.", + "required": true, + "x-originalParamName": "accountAssociation" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation" } } }, @@ -11618,18 +13177,21 @@ "description": "An unexpected error response." } }, - "summary": "Delete", + "summary": "Update Account Association", "tags": [ - "Roles" + "AccountAssociationsService" ] - }, - "put": { - "operationId": "Roles_Update", + } + }, + "/iam/v2beta1/accountAssociations/{parent}": { + "post": { + "description": "CreateAccountAssociation creates a new account association under a parent group.", + "operationId": "AccountAssociationsService_CreateAccountAssociation", "parameters": [ { - "description": "id, The Group path under which this Role resides.", + "description": "Parent group UIDP under which the account association will be created.", "in": "path", - "name": "id", + "name": "parent", "required": true, "schema": { "pattern": ".+", @@ -11641,19 +13203,20 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Roles.UpdateBody" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation" } } }, + "description": "The account association to create.", "required": true, - "x-originalParamName": "body" + "x-originalParamName": "accountAssociation" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Role" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation" } } }, @@ -11670,20 +13233,21 @@ "description": "An unexpected error response." } }, - "summary": "Update", + "summary": "Create Account Association", "tags": [ - "Roles" + "AccountAssociationsService" ] } - }, - "/iam/v1/roles/{parentId}": { - "post": { - "operationId": "Roles_Create", + }, + "/iam/v2beta1/accountAssociations/{uid}": { + "delete": { + "description": "DeleteAccountAssociation deletes an account association by UID.\nIdempotent: returns success if the account association does not exist (AIP-135).", + "operationId": "AccountAssociationsService_DeleteAccountAssociation", "parameters": [ { - "description": "parent_id, The Group UIDP path under which the new Role resides.", + "description": "UID (group UIDP) of the account association to delete.", "in": "path", - "name": "parentId", + "name": "uid", "required": true, "schema": { "pattern": ".+", @@ -11691,24 +13255,12 @@ } } ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Role" - } - } - }, - "description": "Role to create.", - "required": true, - "x-originalParamName": "role" - }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Role" + "type": "object" } } }, @@ -11725,21 +13277,19 @@ "description": "An unexpected error response." } }, - "summary": "Create", + "summary": "Delete Account Association", "tags": [ - "Roles" + "AccountAssociationsService" ] - } - }, - "/iam/v1/terms/{group}": { + }, "get": { - "description": "ListAccepted returns the legal documents that the group has accepted.", - "operationId": "Terms_ListAccepted", + "description": "GetAccountAssociation retrieves a single account association by group UID.", + "operationId": "AccountAssociationsService_GetAccountAssociation", "parameters": [ { - "description": "group is the UIDP of the org to list documents for.", + "description": "UID (group UIDP) of the account association to retrieve.", "in": "path", - "name": "group", + "name": "uid", "required": true, "schema": { "pattern": ".+", @@ -11752,7 +13302,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.TermsList" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation" } } }, @@ -11769,19 +13319,21 @@ "description": "An unexpected error response." } }, - "summary": "List Accepted", + "summary": "Get Account Association", "tags": [ - "Terms" + "AccountAssociationsService" ] - }, + } + }, + "/iam/v2beta1/accountAssociations/{uid}:checkAccountAssociation": { "post": { - "description": "AcceptTerms records that the group has accepted one or more legal\ndocuments. Called by chainctl after the user completes the acceptance flow.", - "operationId": "Terms_AcceptTerms", + "description": "CheckAccountAssociation validates whether a cloud provider account\nassociation is correctly configured by performing a live credential\nexchange against the provider's STS/token endpoint.", + "operationId": "AccountAssociationsService_CheckAccountAssociation", "parameters": [ { - "description": "group is the UIDP of the org on whose behalf legal docs are being accepted.", + "description": "UID (group UIDP) of the account association to check.", "in": "path", - "name": "group", + "name": "uid", "required": true, "schema": { "pattern": ".+", @@ -11793,7 +13345,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.Terms.AcceptTermsBody" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociationsService.CheckAccountAssociationBody" } } }, @@ -11805,7 +13357,7 @@ "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.CheckAccountAssociationResponse" } } }, @@ -11822,16 +13374,16 @@ "description": "An unexpected error response." } }, - "summary": "Accept Terms", + "summary": "Check Account Association", "tags": [ - "Terms" + "AccountAssociationsService" ] } }, - "/iam/v2beta1/accountAssociations": { + "/iam/v2beta1/groupInvites": { "get": { - "description": "ListAccountAssociations returns account associations with pagination support.", - "operationId": "AccountAssociationsService_ListAccountAssociations", + "description": "ListGroupInvites returns group invites based on filter criteria with pagination support.", + "operationId": "GroupInvitesService_ListGroupInvites", "parameters": [ { "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", @@ -11877,9 +13429,9 @@ } }, { - "description": "Optional exact name to filter by.", + "description": "Optional key_id to filter by.", "in": "query", - "name": "name", + "name": "keyId", "schema": { "type": "string" } @@ -11902,7 +13454,7 @@ } }, { - "description": "Order results by field. Format: \"field [asc|desc]\"\nDefault: \"group asc\"\nNote: Changing order_by between pages invalidates the page token.", + "description": "Order results by field. Format: \"field [asc|desc]\"\nDefault: \"created_at desc\"\nNote: Changing order_by between pages invalidates the page token.", "in": "query", "name": "orderBy", "schema": { @@ -11910,199 +13462,21 @@ } }, { - "description": "Number of results to skip before returning.\nUsed for random-access pagination (jumping to arbitrary pages).\nMust be non-negative.", + "description": "Number of results to skip before returning.\nUsed for random-access pagination (jumping to arbitrary pages).", "in": "query", "name": "skip", "schema": { - "format": "int32", - "type": "integer" - } - } - ], - "responses": { - "200": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ListAccountAssociationsResponse" - } - } - }, - "description": "A successful response." - }, - "default": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/google.rpc.Status" - } - } - }, - "description": "An unexpected error response." - } - }, - "summary": "List Account Associations", - "tags": [ - "AccountAssociationsService" - ] - } - }, - "/iam/v2beta1/accountAssociations/{accountAssociation.uid}": { - "patch": { - "description": "UpdateAccountAssociation updates an account association's fields.", - "operationId": "AccountAssociationsService_UpdateAccountAssociation", - "parameters": [ - { - "description": "Unique identifier (the group UIDP this association belongs to).", - "in": "path", - "name": "accountAssociation.uid", - "required": true, - "schema": { - "pattern": ".+", - "type": "string" - } - } - ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "properties": { - "amazon": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation.Amazon" - } - ], - "description": "Amazon account association metadata." - }, - "azure": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation.Azure" - } - ], - "description": "Azure tenant and client association metadata." - }, - "chainguard": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation.Chainguard" - } - ], - "description": "Chainguard service principal bindings." - }, - "createTime": { - "description": "When the association was created.", - "format": "date-time", - "readOnly": true, - "type": "string" - }, - "description": { - "description": "Optional description of the association.", - "type": "string" - }, - "github": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation.GitHub" - } - ], - "description": "github holds GitHub App installation associations for this group." - }, - "google": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation.Google" - } - ], - "description": "Google Cloud project association metadata." - }, - "name": { - "description": "Human-readable name of the association.", - "type": "string" - }, - "updateTime": { - "description": "When the association was last updated.", - "format": "date-time", - "readOnly": true, - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "The account association to update.", - "type": "object" - } - } - }, - "description": "The account association to update.", - "required": true, - "x-originalParamName": "accountAssociation" - }, - "responses": { - "200": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation" - } - } - }, - "description": "A successful response." - }, - "default": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/google.rpc.Status" - } - } - }, - "description": "An unexpected error response." - } - }, - "summary": "Update Account Association", - "tags": [ - "AccountAssociationsService" - ] - } - }, - "/iam/v2beta1/accountAssociations/{parent}": { - "post": { - "description": "CreateAccountAssociation creates a new account association under a parent group.", - "operationId": "AccountAssociationsService_CreateAccountAssociation", - "parameters": [ - { - "description": "Parent group UIDP under which the account association will be created.", - "in": "path", - "name": "parent", - "required": true, - "schema": { - "pattern": ".+", - "type": "string" - } - } - ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation" - } + "format": "int32", + "type": "integer" } - }, - "description": "The account association to create.", - "required": true, - "x-originalParamName": "accountAssociation" - }, + } + ], "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ListGroupInvitesResponse" } } }, @@ -12119,21 +13493,21 @@ "description": "An unexpected error response." } }, - "summary": "Create Account Association", + "summary": "List Group Invites", "tags": [ - "AccountAssociationsService" + "GroupInvitesService" ] } }, - "/iam/v2beta1/accountAssociations/{uid}": { - "delete": { - "description": "DeleteAccountAssociation deletes an account association by UID.\nIdempotent: returns success if the account association does not exist (AIP-135).", - "operationId": "AccountAssociationsService_DeleteAccountAssociation", + "/iam/v2beta1/groupInvites/{parent}": { + "post": { + "description": "CreateGroupInvite creates a new group invite under a parent group.", + "operationId": "GroupInvitesService_CreateGroupInvite", "parameters": [ { - "description": "UID (group UIDP) of the account association to delete.", + "description": "Parent group UIDP under which the invite will be created.", "in": "path", - "name": "uid", + "name": "parent", "required": true, "schema": { "pattern": ".+", @@ -12141,12 +13515,24 @@ } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.GroupInvite" + } + } + }, + "description": "The group invite to create.", + "required": true, + "x-originalParamName": "groupInvite" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.GroupInvite" } } }, @@ -12163,17 +13549,19 @@ "description": "An unexpected error response." } }, - "summary": "Delete Account Association", + "summary": "Create Group Invite", "tags": [ - "AccountAssociationsService" + "GroupInvitesService" ] - }, - "get": { - "description": "GetAccountAssociation retrieves a single account association by group UID.", - "operationId": "AccountAssociationsService_GetAccountAssociation", + } + }, + "/iam/v2beta1/groupInvites/{uid}": { + "delete": { + "description": "DeleteGroupInvite deletes a group invite by UID.", + "operationId": "GroupInvitesService_DeleteGroupInvite", "parameters": [ { - "description": "UID (group UIDP) of the account association to retrieve.", + "description": "UID of the group invite to delete.", "in": "path", "name": "uid", "required": true, @@ -12188,7 +13576,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociation" + "type": "object" } } }, @@ -12205,19 +13593,17 @@ "description": "An unexpected error response." } }, - "summary": "Get Account Association", + "summary": "Delete Group Invite", "tags": [ - "AccountAssociationsService" + "GroupInvitesService" ] - } - }, - "/iam/v2beta1/accountAssociations/{uid}:checkAccountAssociation": { - "post": { - "description": "CheckAccountAssociation validates whether a cloud provider account\nassociation is correctly configured by performing a live credential\nexchange against the provider's STS/token endpoint.", - "operationId": "AccountAssociationsService_CheckAccountAssociation", + }, + "get": { + "description": "GetGroupInvite retrieves a single group invite by UID.", + "operationId": "GroupInvitesService_GetGroupInvite", "parameters": [ { - "description": "UID (group UIDP) of the account association to check.", + "description": "UID of the group invite to retrieve.", "in": "path", "name": "uid", "required": true, @@ -12227,23 +13613,12 @@ } } ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.AccountAssociationsService.CheckAccountAssociationBody" - } - } - }, - "required": true, - "x-originalParamName": "body" - }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.CheckAccountAssociationResponse" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.GroupInvite" } } }, @@ -12260,16 +13635,16 @@ "description": "An unexpected error response." } }, - "summary": "Check Account Association", + "summary": "Get Group Invite", "tags": [ - "AccountAssociationsService" + "GroupInvitesService" ] } }, - "/iam/v2beta1/groupInvites": { + "/iam/v2beta1/groups": { "get": { - "description": "ListGroupInvites returns group invites based on filter criteria with pagination support.", - "operationId": "GroupInvitesService_ListGroupInvites", + "description": "ListGroups returns groups based on filter criteria with pagination support.", + "operationId": "GroupsService_ListGroups", "parameters": [ { "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", @@ -12315,9 +13690,9 @@ } }, { - "description": "Optional key_id to filter by.", + "description": "Optional exact name to filter by.", "in": "query", - "name": "keyId", + "name": "name", "schema": { "type": "string" } @@ -12340,29 +13715,196 @@ } }, { - "description": "Order results by field. Format: \"field [asc|desc]\"\nDefault: \"created_at desc\"\nNote: Changing order_by between pages invalidates the page token.", - "in": "query", - "name": "orderBy", + "description": "Order results by field. Format: \"field [asc|desc]\"\nDefault: \"uid asc\"\nNote: Changing order_by between pages invalidates the page token.", + "in": "query", + "name": "orderBy", + "schema": { + "type": "string" + } + }, + { + "description": "Number of results to skip before returning.\nUsed for random-access pagination (jumping to arbitrary pages).\nCan be combined with page_token to skip from cursor position.\nMust be non-negative.", + "in": "query", + "name": "skip", + "schema": { + "format": "int32", + "type": "integer" + } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ListGroupsResponse" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "List Groups", + "tags": [ + "GroupsService" + ] + } + }, + "/iam/v2beta1/groups/{group.uid}": { + "patch": { + "description": "UpdateGroup updates the given Group according to the provided field mask.\nThe fully populated Group is returned.", + "operationId": "GroupsService_UpdateGroup", + "parameters": [ + { + "description": "Unique identifier for the group (UIDP).\nGenerated by server.", + "in": "path", + "name": "group.uid", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "properties": { + "createTime": { + "description": "When the group was created.", + "format": "date-time", + "readOnly": true, + "type": "string" + }, + "description": { + "description": "Optional description of the group's purpose.", + "type": "string" + }, + "kind": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.OrgKind" + } + ], + "description": "The organization kind. Required when creating a verified root group.\nFor subgroups, kind is inherited from the root group and cannot be set." + }, + "name": { + "description": "Human-readable name of the group.\nMust be 3-63 characters.", + "type": "string" + }, + "resourceLimits": { + "additionalProperties": { + "format": "int32", + "type": "integer" + }, + "description": "Resource limits indicating the maximum number of resources allowed\nfor this group by type.", + "readOnly": true, + "type": "object" + }, + "status": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.OrgStatus" + } + ], + "description": "The provisioning status of the organization. Subgroups inherit the\nstatus from the root group they are a descendant of.", + "readOnly": true + }, + "updateTime": { + "description": "When the group was last updated.", + "format": "date-time", + "readOnly": true, + "type": "string" + }, + "verified": { + "description": "Whether this organization is verified by Chainguard.\nCan only be set by Chainguard staff.", + "type": "boolean" + } + }, + "required": [ + "name" + ], + "title": "The group to update.", + "type": "object" + } + } + }, + "description": "The group to update.", + "required": true, + "x-originalParamName": "group" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Group" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Update Group", + "tags": [ + "GroupsService" + ] + } + }, + "/iam/v2beta1/groups/{groupUid}:requestGroupAccess": { + "post": { + "description": "Returns NOT_FOUND when the supplied group_uid does not resolve to the\nverified root group matching the caller's email domain — either because\nno such group exists, the group_uid is wrong, or the caller is not on a\ntrusted upstream identity provider. Like LookupGroup, these cases are\nintentionally collapsed.\n\nReturns RESOURCE_EXHAUSTED (HTTP 429) when the same caller has recently\nrequested access to the same group; callers should surface a \"request\nalready sent\" message rather than retrying.\n\nReturns INVALID_ARGUMENT when group_uid is empty.", + "operationId": "GroupsService_RequestGroupAccess", + "parameters": [ + { + "description": "UID of the group to request access to. Must be the UID of a verified\nroot group whose name matches the email domain on the caller's token;\nthe server revalidates this on every call.", + "in": "path", + "name": "groupUid", + "required": true, "schema": { + "pattern": ".+", "type": "string" } - }, - { - "description": "Number of results to skip before returning.\nUsed for random-access pagination (jumping to arbitrary pages).", - "in": "query", - "name": "skip", - "schema": { - "format": "int32", - "type": "integer" - } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.GroupsService.RequestGroupAccessBody" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ListGroupInvitesResponse" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RequestGroupAccessResponse" } } }, @@ -12379,19 +13921,19 @@ "description": "An unexpected error response." } }, - "summary": "List Group Invites", + "summary": "Request Group Access", "tags": [ - "GroupInvitesService" + "GroupsService" ] } }, - "/iam/v2beta1/groupInvites/{parent}": { + "/iam/v2beta1/groups/{parent}": { "post": { - "description": "CreateGroupInvite creates a new group invite under a parent group.", - "operationId": "GroupInvitesService_CreateGroupInvite", + "description": "CreateGroup creates a new group (organization or folder).", + "operationId": "GroupsService_CreateGroup", "parameters": [ { - "description": "Parent group UIDP under which the invite will be created.", + "description": "Parent group UIDP. Empty for creating root organizations.\nCan be a UIDP, suffix, or name of a group in scope.", "in": "path", "name": "parent", "required": true, @@ -12405,20 +13947,20 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.GroupInvite" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Group" } } }, - "description": "The group invite to create.", + "description": "The group to create. Required fields: name.", "required": true, - "x-originalParamName": "groupInvite" + "x-originalParamName": "group" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.GroupInvite" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Group" } } }, @@ -12435,19 +13977,19 @@ "description": "An unexpected error response." } }, - "summary": "Create Group Invite", + "summary": "Create Group", "tags": [ - "GroupInvitesService" + "GroupsService" ] } }, - "/iam/v2beta1/groupInvites/{uid}": { + "/iam/v2beta1/groups/{uid}": { "delete": { - "description": "DeleteGroupInvite deletes a group invite by UID.", - "operationId": "GroupInvitesService_DeleteGroupInvite", + "description": "DeleteGroup deletes a group by UID.\nFails if the group has child repos, child groups, or other child IAM resources.", + "operationId": "GroupsService_DeleteGroup", "parameters": [ { - "description": "UID of the group invite to delete.", + "description": "UID of the group to delete.", "in": "path", "name": "uid", "required": true, @@ -12479,17 +14021,17 @@ "description": "An unexpected error response." } }, - "summary": "Delete Group Invite", + "summary": "Delete Group", "tags": [ - "GroupInvitesService" + "GroupsService" ] }, "get": { - "description": "GetGroupInvite retrieves a single group invite by UID.", - "operationId": "GroupInvitesService_GetGroupInvite", + "description": "GetGroup retrieves a single group by UID.", + "operationId": "GroupsService_GetGroup", "parameters": [ { - "description": "UID of the group invite to retrieve.", + "description": "UID of the group to retrieve.", "in": "path", "name": "uid", "required": true, @@ -12504,7 +14046,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.GroupInvite" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Group" } } }, @@ -12521,16 +14063,80 @@ "description": "An unexpected error response." } }, - "summary": "Get Group Invite", + "summary": "Get Group", "tags": [ - "GroupInvitesService" + "GroupsService" ] } }, - "/iam/v2beta1/groups": { + "/iam/v2beta1/groups:checkEligibility": { "get": { - "description": "ListGroups returns groups based on filter criteria with pagination support.", - "operationId": "GroupsService_ListGroups", + "description": "CheckEligibility reports whether the caller passes the same eligibility\ngates applied by LookupGroup and RequestGroupAccess. A response of\neligible=true does not guarantee those calls succeed for other reasons\n(no matching org, already requested, etc.).", + "operationId": "GroupsService_CheckEligibility", + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.CheckEligibilityResponse" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Check Eligibility", + "tags": [ + "GroupsService" + ] + } + }, + "/iam/v2beta1/groups:lookupGroup": { + "get": { + "description": "Returns NOT_FOUND when:\n * no verified root group matches the caller's email domain;\n * the caller's token is not from a trusted upstream identity provider; or\n * the caller's email domain is on the blocked-domains list (free email,\n known competitor, etc.).\n\nThese cases are intentionally collapsed into a single response so callers\ncannot distinguish \"no such org\" from \"you're not allowed to know.\"", + "operationId": "GroupsService_LookupGroup", + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.LookupGroupResponse" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Lookup Group", + "tags": [ + "GroupsService" + ] + } + }, + "/iam/v2beta1/identities": { + "get": { + "description": "ListIdentities returns identities based on filter criteria with pagination support.", + "operationId": "IdentitiesService_ListIdentities", "parameters": [ { "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", @@ -12583,6 +14189,22 @@ "type": "string" } }, + { + "description": "Optional relationship type to filter by.\n\n - RELATIONSHIP_TYPE_UNSPECIFIED: Unspecified relationship type (matches all).\n - RELATIONSHIP_TYPE_CLAIM_MATCH: OIDC claim matching.\n - RELATIONSHIP_TYPE_STATIC: Static OIDC keys (no online issuer).\n - RELATIONSHIP_TYPE_AWS_IDENTITY: AWS IAM identity.\n - RELATIONSHIP_TYPE_SERVICE_PRINCIPAL: Chainguard service principal.", + "in": "query", + "name": "relationshipType", + "schema": { + "default": "RELATIONSHIP_TYPE_UNSPECIFIED", + "enum": [ + "RELATIONSHIP_TYPE_UNSPECIFIED", + "RELATIONSHIP_TYPE_CLAIM_MATCH", + "RELATIONSHIP_TYPE_STATIC", + "RELATIONSHIP_TYPE_AWS_IDENTITY", + "RELATIONSHIP_TYPE_SERVICE_PRINCIPAL" + ], + "type": "string" + } + }, { "description": "Maximum number of results to return per page.\nDefault: 50, Maximum: 200.", "in": "query", @@ -12623,7 +14245,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ListGroupsResponse" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ListIdentitiesResponse" } } }, @@ -12640,21 +14262,21 @@ "description": "An unexpected error response." } }, - "summary": "List Groups", + "summary": "List Identities", "tags": [ - "GroupsService" + "IdentitiesService" ] } }, - "/iam/v2beta1/groups/{group.uid}": { + "/iam/v2beta1/identities/{identity.uid}": { "patch": { - "description": "UpdateGroup updates the given Group according to the provided field mask.\nThe fully populated Group is returned.", - "operationId": "GroupsService_UpdateGroup", + "description": "UpdateIdentity updates the given Identity according to the provided field mask.\nThe fully populated Identity is returned.", + "operationId": "IdentitiesService_UpdateIdentity", "parameters": [ { - "description": "Unique identifier for the group (UIDP).\nGenerated by server.", + "description": "Unique identifier for the identity (UIDP).\nGenerated by server.", "in": "path", - "name": "group.uid", + "name": "identity.uid", "required": true, "schema": { "pattern": ".+", @@ -12667,75 +14289,97 @@ "*/*": { "schema": { "properties": { + "awsIdentity": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Identity.AWSIdentity" + } + ], + "description": "AWS IAM identity configuration." + }, + "claimMatch": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Identity.ClaimMatch" + } + ], + "description": "OIDC claim matching configuration." + }, + "company": { + "description": "Optional company associated with the identity.", + "type": "string" + }, "createTime": { - "description": "When the group was created.", + "description": "When the identity was created.", "format": "date-time", "readOnly": true, "type": "string" }, "description": { - "description": "Optional description of the group's purpose.", + "description": "Optional description of the identity.", "type": "string" }, - "kind": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.OrgKind" - } - ], - "description": "The organization kind. Required when creating a verified root group.\nFor subgroups, kind is inherited from the root group and cannot be set." + "email": { + "description": "Verified email address from OIDC token (email_verified = true).", + "readOnly": true, + "type": "string" }, - "name": { - "description": "Human-readable name of the group.\nMust be 3-63 characters.", + "emailUnverified": { + "description": "Unverified email address from OIDC token (email_verified = false).", + "readOnly": true, "type": "string" }, - "resourceLimits": { - "additionalProperties": { - "format": "int32", - "type": "integer" - }, - "description": "Resource limits indicating the maximum number of resources allowed\nfor this group by type.", + "lastSeenTime": { + "description": "When the identity was last federated (last login).", + "format": "date-time", "readOnly": true, - "type": "object" + "type": "string" }, - "status": { + "name": { + "description": "Human-readable name of the identity.\nMust be 3-63 characters.", + "type": "string" + }, + "servicePrincipal": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.OrgStatus" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ServicePrincipal" + } + ], + "description": "Chainguard service principal." + }, + "staticKeys": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Identity.StaticKeys" } ], - "description": "The provisioning status of the organization. Subgroups inherit the\nstatus from the root group they are a descendant of.", - "readOnly": true + "description": "Static OIDC keys configuration." }, "updateTime": { - "description": "When the group was last updated.", + "description": "When the identity was last updated.", "format": "date-time", "readOnly": true, "type": "string" - }, - "verified": { - "description": "Whether this organization is verified by Chainguard.\nCan only be set by Chainguard staff.", - "type": "boolean" } }, "required": [ "name" ], - "title": "The group to update.", + "title": "The identity to update.", "type": "object" } } }, - "description": "The group to update.", + "description": "The identity to update.", "required": true, - "x-originalParamName": "group" + "x-originalParamName": "identity" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Group" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Identity" } } }, @@ -12752,21 +14396,21 @@ "description": "An unexpected error response." } }, - "summary": "Update Group", + "summary": "Update Identity", "tags": [ - "GroupsService" + "IdentitiesService" ] } }, - "/iam/v2beta1/groups/{groupUid}:requestGroupAccess": { + "/iam/v2beta1/identities/{parent}": { "post": { - "description": "Returns NOT_FOUND when the supplied group_uid does not resolve to the\nverified root group matching the caller's email domain — either because\nno such group exists, the group_uid is wrong, or the caller is not on a\ntrusted upstream identity provider. Like LookupGroup, these cases are\nintentionally collapsed.\n\nReturns RESOURCE_EXHAUSTED (HTTP 429) when the same caller has recently\nrequested access to the same group; callers should surface a \"request\nalready sent\" message rather than retrying.\n\nReturns INVALID_ARGUMENT when group_uid is empty.", - "operationId": "GroupsService_RequestGroupAccess", + "description": "CreateIdentity creates a new identity under a parent group.", + "operationId": "IdentitiesService_CreateIdentity", "parameters": [ { - "description": "UID of the group to request access to. Must be the UID of a verified\nroot group whose name matches the email domain on the caller's token;\nthe server revalidates this on every call.", + "description": "Parent group UIDP under which the identity will be created.", "in": "path", - "name": "groupUid", + "name": "parent", "required": true, "schema": { "pattern": ".+", @@ -12778,19 +14422,20 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.GroupsService.RequestGroupAccessBody" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Identity" } } }, + "description": "The identity to create.", "required": true, - "x-originalParamName": "body" + "x-originalParamName": "identity" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RequestGroupAccessResponse" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Identity" } } }, @@ -12807,21 +14452,21 @@ "description": "An unexpected error response." } }, - "summary": "Request Group Access", + "summary": "Create Identity", "tags": [ - "GroupsService" + "IdentitiesService" ] } }, - "/iam/v2beta1/groups/{parent}": { - "post": { - "description": "CreateGroup creates a new group (organization or folder).", - "operationId": "GroupsService_CreateGroup", + "/iam/v2beta1/identities/{uid}": { + "delete": { + "description": "DeleteIdentity deletes an identity by UID.", + "operationId": "IdentitiesService_DeleteIdentity", "parameters": [ { - "description": "Parent group UIDP. Empty for creating root organizations.\nCan be a UIDP, suffix, or name of a group in scope.", + "description": "UID of the identity to delete.", "in": "path", - "name": "parent", + "name": "uid", "required": true, "schema": { "pattern": ".+", @@ -12829,24 +14474,12 @@ } } ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Group" - } - } - }, - "description": "The group to create. Required fields: name.", - "required": true, - "x-originalParamName": "group" - }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Group" + "type": "object" } } }, @@ -12863,19 +14496,17 @@ "description": "An unexpected error response." } }, - "summary": "Create Group", + "summary": "Delete Identity", "tags": [ - "GroupsService" + "IdentitiesService" ] - } - }, - "/iam/v2beta1/groups/{uid}": { - "delete": { - "description": "DeleteGroup deletes a group by UID.\nFails if the group has child repos, child groups, or other child IAM resources.", - "operationId": "GroupsService_DeleteGroup", + }, + "get": { + "description": "GetIdentity retrieves a single identity by UID.", + "operationId": "IdentitiesService_GetIdentity", "parameters": [ { - "description": "UID of the group to delete.", + "description": "UID of the identity to retrieve.", "in": "path", "name": "uid", "required": true, @@ -12890,7 +14521,7 @@ "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Identity" } } }, @@ -12907,22 +14538,32 @@ "description": "An unexpected error response." } }, - "summary": "Delete Group", + "summary": "Get Identity", "tags": [ - "GroupsService" + "IdentitiesService" ] - }, + } + }, + "/iam/v2beta1/identities:lookupIdentity": { "get": { - "description": "GetGroup retrieves a single group by UID.", - "operationId": "GroupsService_GetGroup", + "description": "This is an unscoped endpoint: any authenticated caller may invoke it.", + "operationId": "IdentitiesService_LookupIdentity", "parameters": [ { - "description": "UID of the group to retrieve.", - "in": "path", - "name": "uid", + "description": "The OIDC issuer URL (e.g. \"https://accounts.google.com\").", + "in": "query", + "name": "issuer", + "required": true, + "schema": { + "type": "string" + } + }, + { + "description": "The OIDC subject identifier.", + "in": "query", + "name": "subject", "required": true, "schema": { - "pattern": ".+", "type": "string" } } @@ -12932,7 +14573,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Group" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.LookupIdentityResponse" } } }, @@ -12949,54 +14590,34 @@ "description": "An unexpected error response." } }, - "summary": "Get Group", + "summary": "Lookup Identity", "tags": [ - "GroupsService" + "IdentitiesService" ] } }, - "/iam/v2beta1/groups:checkEligibility": { - "get": { - "description": "CheckEligibility reports whether the caller passes the same eligibility\ngates applied by LookupGroup and RequestGroupAccess. A response of\neligible=true does not guarantee those calls succeed for other reasons\n(no matching org, already requested, etc.).", - "operationId": "GroupsService_CheckEligibility", - "responses": { - "200": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.CheckEligibilityResponse" - } + "/iam/v2beta1/identities:updateIdentityMetadata": { + "patch": { + "description": "This is an unscoped endpoint: any authenticated caller may invoke it.\nFollows AIP-134: supports field mask for partial updates.", + "operationId": "IdentitiesService_UpdateIdentityMetadata", + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.UpdateIdentityMetadataRequest" } - }, - "description": "A successful response." + } }, - "default": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/google.rpc.Status" - } - } - }, - "description": "An unexpected error response." - } + "description": "UpdateIdentityMetadataRequest is the request for UpdateIdentityMetadata.", + "required": true, + "x-originalParamName": "body" }, - "summary": "Check Eligibility", - "tags": [ - "GroupsService" - ] - } - }, - "/iam/v2beta1/groups:lookupGroup": { - "get": { - "description": "Returns NOT_FOUND when:\n * no verified root group matches the caller's email domain;\n * the caller's token is not from a trusted upstream identity provider; or\n * the caller's email domain is on the blocked-domains list (free email,\n known competitor, etc.).\n\nThese cases are intentionally collapsed into a single response so callers\ncannot distinguish \"no such org\" from \"you're not allowed to know.\"", - "operationId": "GroupsService_LookupGroup", "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.LookupGroupResponse" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.IdentityMetadata" } } }, @@ -13013,16 +14634,16 @@ "description": "An unexpected error response." } }, - "summary": "Lookup Group", + "summary": "Update Identity Metadata", "tags": [ - "GroupsService" + "IdentitiesService" ] } }, - "/iam/v2beta1/identities": { + "/iam/v2beta1/identityProviders": { "get": { - "description": "ListIdentities returns identities based on filter criteria with pagination support.", - "operationId": "IdentitiesService_ListIdentities", + "description": "ListIdentityProviders returns identity providers based on filter criteria with pagination support.", + "operationId": "IdentityProvidersService_ListIdentityProviders", "parameters": [ { "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", @@ -13068,29 +14689,13 @@ } }, { - "description": "Optional exact name to filter by.", + "description": "Exact match on identity provider name", "in": "query", "name": "name", "schema": { "type": "string" } }, - { - "description": "Optional relationship type to filter by.\n\n - RELATIONSHIP_TYPE_UNSPECIFIED: Unspecified relationship type (matches all).\n - RELATIONSHIP_TYPE_CLAIM_MATCH: OIDC claim matching.\n - RELATIONSHIP_TYPE_STATIC: Static OIDC keys (no online issuer).\n - RELATIONSHIP_TYPE_AWS_IDENTITY: AWS IAM identity.\n - RELATIONSHIP_TYPE_SERVICE_PRINCIPAL: Chainguard service principal.", - "in": "query", - "name": "relationshipType", - "schema": { - "default": "RELATIONSHIP_TYPE_UNSPECIFIED", - "enum": [ - "RELATIONSHIP_TYPE_UNSPECIFIED", - "RELATIONSHIP_TYPE_CLAIM_MATCH", - "RELATIONSHIP_TYPE_STATIC", - "RELATIONSHIP_TYPE_AWS_IDENTITY", - "RELATIONSHIP_TYPE_SERVICE_PRINCIPAL" - ], - "type": "string" - } - }, { "description": "Maximum number of results to return per page.\nDefault: 50, Maximum: 200.", "in": "query", @@ -13131,7 +14736,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ListIdentitiesResponse" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ListIdentityProvidersResponse" } } }, @@ -13148,21 +14753,21 @@ "description": "An unexpected error response." } }, - "summary": "List Identities", + "summary": "List Identity Providers", "tags": [ - "IdentitiesService" + "IdentityProvidersService" ] } }, - "/iam/v2beta1/identities/{identity.uid}": { + "/iam/v2beta1/identityProviders/{identityProvider.uid}": { "patch": { - "description": "UpdateIdentity updates the given Identity according to the provided field mask.\nThe fully populated Identity is returned.", - "operationId": "IdentitiesService_UpdateIdentity", + "description": "UpdateIdentityProvider updates an identity provider.", + "operationId": "IdentityProvidersService_UpdateIdentityProvider", "parameters": [ { - "description": "Unique identifier for the identity (UIDP).\nGenerated by server.", + "description": "Unique identifier for the identity provider (UIDP).\nGenerated by server.", "in": "path", - "name": "identity.uid", + "name": "identityProvider.uid", "required": true, "schema": { "pattern": ".+", @@ -13175,97 +14780,58 @@ "*/*": { "schema": { "properties": { - "awsIdentity": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Identity.AWSIdentity" - } - ], - "description": "AWS IAM identity configuration." - }, - "claimMatch": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Identity.ClaimMatch" - } - ], - "description": "OIDC claim matching configuration." - }, - "company": { - "description": "Optional company associated with the identity.", - "type": "string" - }, "createTime": { - "description": "When the identity was created.", + "description": "When the identity provider was created.", "format": "date-time", "readOnly": true, "type": "string" }, - "description": { - "description": "Optional description of the identity.", - "type": "string" - }, - "email": { - "description": "Verified email address from OIDC token (email_verified = true).", - "readOnly": true, - "type": "string" - }, - "emailUnverified": { - "description": "Unverified email address from OIDC token (email_verified = false).", - "readOnly": true, + "defaultRole": { + "description": "The UIDP of the default role to grant users of this identity provider\non initial authentication. Users who already have an identity on this platform\nare unaffected.", "type": "string" }, - "lastSeenTime": { - "description": "When the identity was last federated (last login).", - "format": "date-time", - "readOnly": true, + "description": { + "description": "Optional description of the identity provider.", "type": "string" }, "name": { - "description": "Human-readable name of the identity.\nMust be 3-63 characters.", + "description": "Human-readable name of the identity provider.\nMust be 3-63 characters.", "type": "string" }, - "servicePrincipal": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ServicePrincipal" - } - ], - "description": "Chainguard service principal." - }, - "staticKeys": { + "oidc": { "allOf": [ { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Identity.StaticKeys" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.IdentityProvider.OIDC" } ], - "description": "Static OIDC keys configuration." + "description": "Defines the parameters necessary for authenticating with the OIDC flow." }, "updateTime": { - "description": "When the identity was last updated.", + "description": "When the identity provider was last updated.", "format": "date-time", "readOnly": true, "type": "string" } }, "required": [ - "name" + "name", + "defaultRole" ], - "title": "The identity to update.", + "title": "The identity provider to update.", "type": "object" } } }, - "description": "The identity to update.", + "description": "The identity provider to update.", "required": true, - "x-originalParamName": "identity" + "x-originalParamName": "identityProvider" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Identity" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.IdentityProvider" } } }, @@ -13282,19 +14848,19 @@ "description": "An unexpected error response." } }, - "summary": "Update Identity", + "summary": "Update Identity Provider", "tags": [ - "IdentitiesService" + "IdentityProvidersService" ] } }, - "/iam/v2beta1/identities/{parent}": { + "/iam/v2beta1/identityProviders/{parent}": { "post": { - "description": "CreateIdentity creates a new identity under a parent group.", - "operationId": "IdentitiesService_CreateIdentity", + "description": "CreateIdentityProvider creates a new identity provider.", + "operationId": "IdentityProvidersService_CreateIdentityProvider", "parameters": [ { - "description": "Parent group UIDP under which the identity will be created.", + "description": "The exact UIDP of the IAM group to nest this identity provider under.", "in": "path", "name": "parent", "required": true, @@ -13308,20 +14874,20 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Identity" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.IdentityProvider" } } }, - "description": "The identity to create.", + "description": "The configuration for an upstream identity provider", "required": true, - "x-originalParamName": "identity" + "x-originalParamName": "identityProvider" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Identity" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.IdentityProvider" } } }, @@ -13338,19 +14904,19 @@ "description": "An unexpected error response." } }, - "summary": "Create Identity", + "summary": "Create Identity Provider", "tags": [ - "IdentitiesService" + "IdentityProvidersService" ] } }, - "/iam/v2beta1/identities/{uid}": { + "/iam/v2beta1/identityProviders/{uid}": { "delete": { - "description": "DeleteIdentity deletes an identity by UID.", - "operationId": "IdentitiesService_DeleteIdentity", + "description": "DeleteIdentityProvider deletes an identity provider by UID.", + "operationId": "IdentityProvidersService_DeleteIdentityProvider", "parameters": [ { - "description": "UID of the identity to delete.", + "description": "UID of the identity provider to delete.", "in": "path", "name": "uid", "required": true, @@ -13382,17 +14948,17 @@ "description": "An unexpected error response." } }, - "summary": "Delete Identity", + "summary": "Delete Identity Provider", "tags": [ - "IdentitiesService" + "IdentityProvidersService" ] }, "get": { - "description": "GetIdentity retrieves a single identity by UID.", - "operationId": "IdentitiesService_GetIdentity", + "description": "GetIdentityProvider retrieves a single identity provider by UID.", + "operationId": "IdentityProvidersService_GetIdentityProvider", "parameters": [ { - "description": "UID of the identity to retrieve.", + "description": "UID of the identity provider to retrieve.", "in": "path", "name": "uid", "required": true, @@ -13407,103 +14973,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Identity" - } - } - }, - "description": "A successful response." - }, - "default": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/google.rpc.Status" - } - } - }, - "description": "An unexpected error response." - } - }, - "summary": "Get Identity", - "tags": [ - "IdentitiesService" - ] - } - }, - "/iam/v2beta1/identities:lookupIdentity": { - "get": { - "description": "This is an unscoped endpoint: any authenticated caller may invoke it.", - "operationId": "IdentitiesService_LookupIdentity", - "parameters": [ - { - "description": "The OIDC issuer URL (e.g. \"https://accounts.google.com\").", - "in": "query", - "name": "issuer", - "required": true, - "schema": { - "type": "string" - } - }, - { - "description": "The OIDC subject identifier.", - "in": "query", - "name": "subject", - "required": true, - "schema": { - "type": "string" - } - } - ], - "responses": { - "200": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.LookupIdentityResponse" - } - } - }, - "description": "A successful response." - }, - "default": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/google.rpc.Status" - } - } - }, - "description": "An unexpected error response." - } - }, - "summary": "Lookup Identity", - "tags": [ - "IdentitiesService" - ] - } - }, - "/iam/v2beta1/identities:updateIdentityMetadata": { - "patch": { - "description": "This is an unscoped endpoint: any authenticated caller may invoke it.\nFollows AIP-134: supports field mask for partial updates.", - "operationId": "IdentitiesService_UpdateIdentityMetadata", - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.UpdateIdentityMetadataRequest" - } - } - }, - "description": "UpdateIdentityMetadataRequest is the request for UpdateIdentityMetadata.", - "required": true, - "x-originalParamName": "body" - }, - "responses": { - "200": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.IdentityMetadata" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.IdentityProvider" } } }, @@ -13520,16 +14990,16 @@ "description": "An unexpected error response." } }, - "summary": "Update Identity Metadata", + "summary": "Get Identity Provider", "tags": [ - "IdentitiesService" + "IdentityProvidersService" ] } }, - "/iam/v2beta1/identityProviders": { + "/iam/v2beta1/roleBindings": { "get": { - "description": "ListIdentityProviders returns identity providers based on filter criteria with pagination support.", - "operationId": "IdentityProvidersService_ListIdentityProviders", + "description": "ListRoleBindings returns role bindings based on filter criteria with pagination support.", + "operationId": "RoleBindingsService_ListRoleBindings", "parameters": [ { "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", @@ -13575,9 +15045,25 @@ } }, { - "description": "Exact match on identity provider name", + "description": "Optional identity UID to filter by.", "in": "query", - "name": "name", + "name": "identity", + "schema": { + "type": "string" + } + }, + { + "description": "Optional group UIDP to filter by.", + "in": "query", + "name": "group", + "schema": { + "type": "string" + } + }, + { + "description": "Optional role UIDP to filter by.", + "in": "query", + "name": "role", "schema": { "type": "string" } @@ -13622,7 +15108,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ListIdentityProvidersResponse" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ListRoleBindingsResponse" } } }, @@ -13639,21 +15125,21 @@ "description": "An unexpected error response." } }, - "summary": "List Identity Providers", + "summary": "List Role Bindings", "tags": [ - "IdentityProvidersService" + "RoleBindingsService" ] } }, - "/iam/v2beta1/identityProviders/{identityProvider.uid}": { - "patch": { - "description": "UpdateIdentityProvider updates an identity provider.", - "operationId": "IdentityProvidersService_UpdateIdentityProvider", + "/iam/v2beta1/roleBindings/{parent}": { + "post": { + "description": "CreateRoleBinding creates a new role binding.\nAssociates an identity with a role within a group scope.", + "operationId": "RoleBindingsService_CreateRoleBinding", "parameters": [ { - "description": "Unique identifier for the identity provider (UIDP).\nGenerated by server.", + "description": "Parent group UIDP where the role binding will be created.", "in": "path", - "name": "identityProvider.uid", + "name": "parent", "required": true, "schema": { "pattern": ".+", @@ -13665,59 +15151,20 @@ "content": { "*/*": { "schema": { - "properties": { - "createTime": { - "description": "When the identity provider was created.", - "format": "date-time", - "readOnly": true, - "type": "string" - }, - "defaultRole": { - "description": "The UIDP of the default role to grant users of this identity provider\non initial authentication. Users who already have an identity on this platform\nare unaffected.", - "type": "string" - }, - "description": { - "description": "Optional description of the identity provider.", - "type": "string" - }, - "name": { - "description": "Human-readable name of the identity provider.\nMust be 3-63 characters.", - "type": "string" - }, - "oidc": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.IdentityProvider.OIDC" - } - ], - "description": "Defines the parameters necessary for authenticating with the OIDC flow." - }, - "updateTime": { - "description": "When the identity provider was last updated.", - "format": "date-time", - "readOnly": true, - "type": "string" - } - }, - "required": [ - "name", - "defaultRole" - ], - "title": "The identity provider to update.", - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RoleBinding" } } }, - "description": "The identity provider to update.", + "description": "The role binding to create.\nSet identity_uid and role_uid; other fields are ignored.", "required": true, - "x-originalParamName": "identityProvider" + "x-originalParamName": "roleBinding" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.IdentityProvider" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RoleBinding" } } }, @@ -13734,21 +15181,21 @@ "description": "An unexpected error response." } }, - "summary": "Update Identity Provider", + "summary": "Create Role Binding", "tags": [ - "IdentityProvidersService" + "RoleBindingsService" ] } }, - "/iam/v2beta1/identityProviders/{parent}": { - "post": { - "description": "CreateIdentityProvider creates a new identity provider.", - "operationId": "IdentityProvidersService_CreateIdentityProvider", + "/iam/v2beta1/roleBindings/{roleBinding.uid}": { + "patch": { + "description": "UpdateRoleBinding updates the given role binding according to the provided field mask.\nThe fully populated RoleBinding is returned.", + "operationId": "RoleBindingsService_UpdateRoleBinding", "parameters": [ { - "description": "The exact UIDP of the IAM group to nest this identity provider under.", + "description": "Unique identifier for the role binding (UIDP).\nGenerated by server.", "in": "path", - "name": "parent", + "name": "roleBinding.uid", "required": true, "schema": { "pattern": ".+", @@ -13760,20 +15207,64 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.IdentityProvider" + "properties": { + "createTime": { + "description": "When the role binding was created.", + "format": "date-time", + "readOnly": true, + "type": "string" + }, + "group": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RoleBindingGroup" + } + ], + "description": "The group where this role binding applies.\nFully hydrated with group details.", + "readOnly": true + }, + "identity": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RoleBindingIdentity" + } + ], + "description": "The identity that is granted the role.\nFully hydrated with identity details.", + "readOnly": true + }, + "identityUid": { + "description": "The identity UID to bind to the role.\nSet this field when creating or updating a role binding.", + "type": "string" + }, + "role": { + "allOf": [ + { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RoleBindingRole" + } + ], + "description": "The role that is granted to the identity.\nFully hydrated with role details.", + "readOnly": true + }, + "roleUid": { + "description": "The role UID to bind to the identity.\nSet this field when creating or updating a role binding.", + "type": "string" + } + }, + "title": "The role binding to update. Must include uid.\nSet identity_uid and/or role_uid to update those fields.", + "type": "object" } } }, - "description": "The configuration for an upstream identity provider", + "description": "The role binding to update. Must include uid.\nSet identity_uid and/or role_uid to update those fields.", "required": true, - "x-originalParamName": "identityProvider" + "x-originalParamName": "roleBinding" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.IdentityProvider" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RoleBinding" } } }, @@ -13790,19 +15281,19 @@ "description": "An unexpected error response." } }, - "summary": "Create Identity Provider", + "summary": "Update Role Binding", "tags": [ - "IdentityProvidersService" + "RoleBindingsService" ] } }, - "/iam/v2beta1/identityProviders/{uid}": { + "/iam/v2beta1/roleBindings/{uid}": { "delete": { - "description": "DeleteIdentityProvider deletes an identity provider by UID.", - "operationId": "IdentityProvidersService_DeleteIdentityProvider", + "description": "DeleteRoleBinding deletes a role binding by UID.\nIdempotent: returns success if the role binding does not exist (AIP-135).", + "operationId": "RoleBindingsService_DeleteRoleBinding", "parameters": [ { - "description": "UID of the identity provider to delete.", + "description": "UID of the role binding to delete.", "in": "path", "name": "uid", "required": true, @@ -13834,17 +15325,17 @@ "description": "An unexpected error response." } }, - "summary": "Delete Identity Provider", + "summary": "Delete Role Binding", "tags": [ - "IdentityProvidersService" + "RoleBindingsService" ] }, "get": { - "description": "GetIdentityProvider retrieves a single identity provider by UID.", - "operationId": "IdentityProvidersService_GetIdentityProvider", + "description": "GetRoleBinding retrieves a single role binding by UID.", + "operationId": "RoleBindingsService_GetRoleBinding", "parameters": [ { - "description": "UID of the identity provider to retrieve.", + "description": "UID of the role binding to retrieve.", "in": "path", "name": "uid", "required": true, @@ -13859,7 +15350,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.IdentityProvider" + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RoleBinding" } } }, @@ -13876,16 +15367,16 @@ "description": "An unexpected error response." } }, - "summary": "Get Identity Provider", + "summary": "Get Role Binding", "tags": [ - "IdentityProvidersService" + "RoleBindingsService" ] } }, - "/iam/v2beta1/roleBindings": { + "/iam/v2beta1/roles": { "get": { - "description": "ListRoleBindings returns role bindings based on filter criteria with pagination support.", - "operationId": "RoleBindingsService_ListRoleBindings", + "description": "ListRoles returns roles based on filter criteria with pagination support.", + "operationId": "RolesService_ListRoles", "parameters": [ { "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", @@ -13931,62 +15422,235 @@ } }, { - "description": "Optional identity UID to filter by.", + "description": "Optional exact name to filter by.", "in": "query", - "name": "identity", + "name": "name", "schema": { "type": "string" } }, { - "description": "Optional group UIDP to filter by.", + "description": "Maximum number of results to return per page.\nDefault: 50, Maximum: 200.", "in": "query", - "name": "group", + "name": "pageSize", + "schema": { + "format": "int32", + "type": "integer" + } + }, + { + "description": "Page token from a previous List response for pagination.\nOpaque token with 3-day expiration.", + "in": "query", + "name": "pageToken", "schema": { "type": "string" } }, { - "description": "Optional role UIDP to filter by.", + "description": "Order results by field. Format: \"field [asc|desc]\"\nDefault: \"uid asc\"\nNote: Changing order_by between pages invalidates the page token.", "in": "query", - "name": "role", + "name": "orderBy", "schema": { "type": "string" } }, { - "description": "Maximum number of results to return per page.\nDefault: 50, Maximum: 200.", + "description": "Number of results to skip before returning.\nUsed for random-access pagination (jumping to arbitrary pages).\nCan be combined with page_token to skip from cursor position.\nMust be non-negative.", "in": "query", - "name": "pageSize", + "name": "skip", "schema": { "format": "int32", "type": "integer" } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ListRolesResponse" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "List Roles", + "tags": [ + "RolesService" + ] + } + }, + "/iam/v2beta1/roles/{parent}": { + "post": { + "description": "CreateRole creates a new custom role.", + "operationId": "RolesService_CreateRole", + "parameters": [ + { + "description": "Parent group UIDP under which the new role will be created.", + "in": "path", + "name": "parent", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Role" + } + } + }, + "description": "The role to create. Required fields: name, capabilities.", + "required": true, + "x-originalParamName": "role" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Role" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Create Role", + "tags": [ + "RolesService" + ] + } + }, + "/iam/v2beta1/roles/{role.uid}": { + "patch": { + "description": "UpdateRole updates the given Role according to the provided field mask.\nThe fully populated Role is returned.", + "operationId": "RolesService_UpdateRole", + "parameters": [ + { + "description": "Unique identifier for the role (UIDP).\nGenerated by server.", + "in": "path", + "name": "role.uid", + "required": true, + "schema": { + "pattern": ".+", + "type": "string" + } + } + ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "properties": { + "capabilities": { + "description": "Capabilities granted by this role.\nRequired on Create (at least one). Optional on Update (omit if not changing).", + "items": { + "$ref": "#/components/schemas/chainguard.capabilities.Capability" + }, + "type": "array" + }, + "createTime": { + "description": "When the role was created.", + "format": "date-time", + "readOnly": true, + "type": "string" + }, + "description": { + "description": "Optional description of the role's purpose.", + "type": "string" + }, + "name": { + "description": "Human-readable name of the role.", + "type": "string" + }, + "updateTime": { + "description": "When the role was last updated.", + "format": "date-time", + "readOnly": true, + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "The role to update.", + "type": "object" + } + } }, - { - "description": "Page token from a previous List response for pagination.\nOpaque token with 3-day expiration.", - "in": "query", - "name": "pageToken", - "schema": { - "type": "string" - } + "description": "The role to update.", + "required": true, + "x-originalParamName": "role" + }, + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Role" + } + } + }, + "description": "A successful response." }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Update Role", + "tags": [ + "RolesService" + ] + } + }, + "/iam/v2beta1/roles/{uid}": { + "delete": { + "description": "DeleteRole deletes a custom role by UID.\nFails if the role is bound to any identities.\nManaged (root-level) roles cannot be deleted.", + "operationId": "RolesService_DeleteRole", + "parameters": [ { - "description": "Order results by field. Format: \"field [asc|desc]\"\nDefault: \"uid asc\"\nNote: Changing order_by between pages invalidates the page token.", - "in": "query", - "name": "orderBy", + "description": "UID of the role to delete.", + "in": "path", + "name": "uid", + "required": true, "schema": { + "pattern": ".+", "type": "string" } - }, - { - "description": "Number of results to skip before returning.\nUsed for random-access pagination (jumping to arbitrary pages).\nCan be combined with page_token to skip from cursor position.\nMust be non-negative.", - "in": "query", - "name": "skip", - "schema": { - "format": "int32", - "type": "integer" - } } ], "responses": { @@ -13994,7 +15658,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ListRoleBindingsResponse" + "type": "object" } } }, @@ -14011,21 +15675,19 @@ "description": "An unexpected error response." } }, - "summary": "List Role Bindings", + "summary": "Delete Role", "tags": [ - "RoleBindingsService" + "RolesService" ] - } - }, - "/iam/v2beta1/roleBindings/{parent}": { - "post": { - "description": "CreateRoleBinding creates a new role binding.\nAssociates an identity with a role within a group scope.", - "operationId": "RoleBindingsService_CreateRoleBinding", + }, + "get": { + "description": "GetRole retrieves a single role by UID.", + "operationId": "RolesService_GetRole", "parameters": [ { - "description": "Parent group UIDP where the role binding will be created.", + "description": "UID of the role to retrieve.", "in": "path", - "name": "parent", + "name": "uid", "required": true, "schema": { "pattern": ".+", @@ -14033,24 +15695,55 @@ } } ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Role" + } + } + }, + "description": "A successful response." + }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Get Role", + "tags": [ + "RolesService" + ] + } + }, + "/image-recommendation/v1/match": { + "post": { + "description": "MatchImage takes a list of SBOM components and returns a list of Chainguard\nimages ranked by similarity to original SBOM components", + "operationId": "ImageMatcher_MatchImage", "requestBody": { "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RoleBinding" + "$ref": "#/components/schemas/chainguard.platform.matcher.MatchImageRequest" } } }, - "description": "The role binding to create.\nSet identity_uid and role_uid; other fields are ignored.", "required": true, - "x-originalParamName": "roleBinding" + "x-originalParamName": "body" }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RoleBinding" + "$ref": "#/components/schemas/chainguard.platform.matcher.MatchImageResponse" } } }, @@ -14067,90 +15760,90 @@ "description": "An unexpected error response." } }, - "summary": "Create Role Binding", + "summary": "Match Image", "tags": [ - "RoleBindingsService" + "ImageMatcher" ] } }, - "/iam/v2beta1/roleBindings/{roleBinding.uid}": { - "patch": { - "description": "UpdateRoleBinding updates the given role binding according to the provided field mask.\nThe fully populated RoleBinding is returned.", - "operationId": "RoleBindingsService_UpdateRoleBinding", + "/libraries/v1/artifacts": { + "get": { + "operationId": "Artifacts_List", "parameters": [ { - "description": "Unique identifier for the role binding (UIDP).\nGenerated by server.", - "in": "path", - "name": "roleBinding.uid", - "required": true, + "description": "The language ecosystems to return artifacts for.", + "in": "query", + "name": "ecosystems", + "schema": { + "items": { + "enum": [ + "UNKNOWN", + "JAVA", + "PYTHON", + "JAVASCRIPT" + ], + "type": "string" + }, + "type": "array" + } + }, + { + "description": "A string to search artifacts by. If empty, all artifacts\nfrom the given ecosystem will be returned.", + "in": "query", + "name": "query", "schema": { - "pattern": ".+", "type": "string" } - } - ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "properties": { - "createTime": { - "description": "When the role binding was created.", - "format": "date-time", - "readOnly": true, - "type": "string" - }, - "group": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RoleBindingGroup" - } - ], - "description": "The group where this role binding applies.\nFully hydrated with group details.", - "readOnly": true - }, - "identity": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RoleBindingIdentity" - } - ], - "description": "The identity that is granted the role.\nFully hydrated with identity details.", - "readOnly": true - }, - "identityUid": { - "description": "The identity UID to bind to the role.\nSet this field when creating or updating a role binding.", - "type": "string" - }, - "role": { - "allOf": [ - { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RoleBindingRole" - } - ], - "description": "The role that is granted to the identity.\nFully hydrated with role details.", - "readOnly": true - }, - "roleUid": { - "description": "The role UID to bind to the identity.\nSet this field when creating or updating a role binding.", - "type": "string" - } - }, - "title": "The role binding to update. Must include uid.\nSet identity_uid and/or role_uid to update those fields.", - "type": "object" - } + }, + { + "description": "Specify the cuda version of the packages to return from the python ecosystem", + "in": "query", + "name": "cudaVersion", + "schema": { + "type": "string" + } + }, + { + "description": "Flag to return only remediated packages for the ecosystems", + "in": "query", + "name": "remediated", + "schema": { + "type": "boolean" + } + }, + { + "description": "The maximum number of artifacts to return per request.\nThe service may return fewer than this value.", + "in": "query", + "name": "pageSize", + "schema": { + "format": "int32", + "type": "integer" + } + }, + { + "description": "The token received from the previous call to List.\nProvide this to retrieve the subsequent page. If populated,\nall non-pagination parameters must match the call that provided this token.", + "in": "query", + "name": "pageToken", + "schema": { + "type": "string" } }, - "description": "The role binding to update. Must include uid.\nSet identity_uid and/or role_uid to update those fields.", - "required": true, - "x-originalParamName": "roleBinding" - }, + { + "description": "The number of artifacts to skip ahead in the list of returned artifacts,\nbased on the state of the provided page_token. If page_token is not provided,\nthe first result returned will be number skip+1. If page_token is provided,\nthe first result returned will be (next result based on page_token)+skip.", + "in": "query", + "name": "skip", + "schema": { + "format": "int32", + "type": "integer" + } + } + ], "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RoleBinding" + "$ref": "#/components/schemas/chainguard.platform.libraries.ArtifactList" } } }, @@ -14167,25 +15860,31 @@ "description": "An unexpected error response." } }, - "summary": "Update Role Binding", + "summary": "List", "tags": [ - "RoleBindingsService" + "Artifacts" ] } }, - "/iam/v2beta1/roleBindings/{uid}": { - "delete": { - "description": "DeleteRoleBinding deletes a role binding by UID.\nIdempotent: returns success if the role binding does not exist (AIP-135).", - "operationId": "RoleBindingsService_DeleteRoleBinding", + "/libraries/v1/artifacts/count": { + "get": { + "operationId": "Artifacts_GetArtifactCount", "parameters": [ { - "description": "UID of the role binding to delete.", - "in": "path", - "name": "uid", - "required": true, + "description": "The language ecosystems to request the artifact counts for.", + "in": "query", + "name": "ecosystems", "schema": { - "pattern": ".+", - "type": "string" + "items": { + "enum": [ + "UNKNOWN", + "JAVA", + "PYTHON", + "JAVASCRIPT" + ], + "type": "string" + }, + "type": "array" } } ], @@ -14194,7 +15893,7 @@ "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.libraries.GetArtifactCountResponse" } } }, @@ -14211,22 +15910,23 @@ "description": "An unexpected error response." } }, - "summary": "Delete Role Binding", + "summary": "Get Artifact Count", "tags": [ - "RoleBindingsService" + "Artifacts" ] - }, + } + }, + "/libraries/v1/artifacts/{id}/versions": { "get": { - "description": "GetRoleBinding retrieves a single role binding by UID.", - "operationId": "RoleBindingsService_GetRoleBinding", + "operationId": "Artifacts_ListVersions", "parameters": [ { - "description": "UID of the role binding to retrieve.", + "description": "The artifact's unique identifier, as returned by ListArtifacts", "in": "path", - "name": "uid", + "name": "id", "required": true, "schema": { - "pattern": ".+", + "pattern": "[^/]+", "type": "string" } } @@ -14236,7 +15936,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.RoleBinding" + "$ref": "#/components/schemas/chainguard.platform.libraries.ArtifactVersionList" } } }, @@ -14253,70 +15953,71 @@ "description": "An unexpected error response." } }, - "summary": "Get Role Binding", + "summary": "List Versions", "tags": [ - "RoleBindingsService" + "Artifacts" ] } }, - "/iam/v2beta1/roles": { + "/libraries/v1/blocked-packages": { "get": { - "description": "ListRoles returns roles based on filter criteria with pagination support.", - "operationId": "RolesService_ListRoles", + "operationId": "LibraryPolicyBlockEvents_ListBlockEvents", "parameters": [ { - "description": "ancestors_of are groups reachable by repeated proceeding from child to parent.", + "description": "The org (parent) to scope events to. Required.", "in": "query", - "name": "uidp.ancestorsOf", + "name": "parentId", "schema": { "type": "string" } }, { - "description": "descendants_of are groups reachable by repeated proceeding from parent to child.", + "description": "Only events for this ecosystem (UNKNOWN = all).", "in": "query", - "name": "uidp.descendantsOf", + "name": "ecosystem", "schema": { + "default": "UNKNOWN", + "enum": [ + "UNKNOWN", + "JAVA", + "PYTHON", + "JAVASCRIPT" + ], "type": "string" } }, { - "description": "children_of are groups reachable by directly proceeding from parent to children.", + "description": "Match against the PURL name component (exact, case-insensitive).", "in": "query", - "name": "uidp.childrenOf", + "name": "packageName", "schema": { "type": "string" } }, { - "description": "in_root resticts responses to root level resources (organizations, user identities)", - "in": "query", - "name": "uidp.inRoot", - "schema": { - "type": "boolean" - } - }, - { - "description": "ids are a list of exact UIDPs of records.", + "description": "Only events in this mode. Defaults to ENFORCED when unspecified.\n\n - LIBRARY_POLICY_BINDING_MODE_ENFORCED: Withhold packages that fail the policy.\n - LIBRARY_POLICY_BINDING_MODE_LOG: Evaluate and record violations without blocking.", "in": "query", - "name": "uidp.ids", + "name": "mode", "schema": { - "items": { - "type": "string" - }, - "type": "array" + "default": "LIBRARY_POLICY_BINDING_MODE_UNSPECIFIED", + "enum": [ + "LIBRARY_POLICY_BINDING_MODE_UNSPECIFIED", + "LIBRARY_POLICY_BINDING_MODE_ENFORCED", + "LIBRARY_POLICY_BINDING_MODE_LOG" + ], + "type": "string" } }, { - "description": "Optional exact name to filter by.", + "description": "Only events first blocked at or after this time. Defaults to 30 days ago.", "in": "query", - "name": "name", + "name": "since", "schema": { + "format": "date-time", "type": "string" } }, { - "description": "Maximum number of results to return per page.\nDefault: 50, Maximum: 200.", "in": "query", "name": "pageSize", "schema": { @@ -14325,29 +16026,11 @@ } }, { - "description": "Page token from a previous List response for pagination.\nOpaque token with 3-day expiration.", "in": "query", "name": "pageToken", "schema": { "type": "string" } - }, - { - "description": "Order results by field. Format: \"field [asc|desc]\"\nDefault: \"uid asc\"\nNote: Changing order_by between pages invalidates the page token.", - "in": "query", - "name": "orderBy", - "schema": { - "type": "string" - } - }, - { - "description": "Number of results to skip before returning.\nUsed for random-access pagination (jumping to arbitrary pages).\nCan be combined with page_token to skip from cursor position.\nMust be non-negative.", - "in": "query", - "name": "skip", - "schema": { - "format": "int32", - "type": "integer" - } } ], "responses": { @@ -14355,7 +16038,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.ListRolesResponse" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBlockEventList" } } }, @@ -14372,135 +16055,48 @@ "description": "An unexpected error response." } }, - "summary": "List Roles", + "summary": "List Block Events", "tags": [ - "RolesService" + "LibraryPolicyBlockEvents" ] } }, - "/iam/v2beta1/roles/{parent}": { - "post": { - "description": "CreateRole creates a new custom role.", - "operationId": "RolesService_CreateRole", + "/libraries/v1/entitlements": { + "get": { + "operationId": "Entitlements_List", "parameters": [ { - "description": "Parent group UIDP under which the new role will be created.", - "in": "path", - "name": "parent", - "required": true, + "description": "parent_id is the group to list entitlements for. Required.", + "in": "query", + "name": "parentId", "schema": { - "pattern": ".+", "type": "string" } - } - ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Role" - } - } - }, - "description": "The role to create. Required fields: name, capabilities.", - "required": true, - "x-originalParamName": "role" - }, - "responses": { - "200": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Role" - } - } - }, - "description": "A successful response." }, - "default": { - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/google.rpc.Status" - } - } - }, - "description": "An unexpected error response." - } - }, - "summary": "Create Role", - "tags": [ - "RolesService" - ] - } - }, - "/iam/v2beta1/roles/{role.uid}": { - "patch": { - "description": "UpdateRole updates the given Role according to the provided field mask.\nThe fully populated Role is returned.", - "operationId": "RolesService_UpdateRole", - "parameters": [ { - "description": "Unique identifier for the role (UIDP).\nGenerated by server.", - "in": "path", - "name": "role.uid", - "required": true, + "description": "ecosystems are the language ecosystems to list entitlements for. If empty, all entitlements for the group will be listed.", + "in": "query", + "name": "ecosystems", "schema": { - "pattern": ".+", - "type": "string" - } - } - ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "properties": { - "capabilities": { - "description": "Capabilities granted by this role.\nRequired on Create (at least one). Optional on Update (omit if not changing).", - "items": { - "$ref": "#/components/schemas/chainguard.capabilities.Capability" - }, - "type": "array" - }, - "createTime": { - "description": "When the role was created.", - "format": "date-time", - "readOnly": true, - "type": "string" - }, - "description": { - "description": "Optional description of the role's purpose.", - "type": "string" - }, - "name": { - "description": "Human-readable name of the role.", - "type": "string" - }, - "updateTime": { - "description": "When the role was last updated.", - "format": "date-time", - "readOnly": true, - "type": "string" - } - }, - "required": [ - "name" + "items": { + "enum": [ + "UNKNOWN", + "JAVA", + "PYTHON", + "JAVASCRIPT" ], - "title": "The role to update.", - "type": "object" - } - } - }, - "description": "The role to update.", - "required": true, - "x-originalParamName": "role" - }, + "type": "string" + }, + "type": "array" + } + } + ], "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Role" + "$ref": "#/components/schemas/chainguard.platform.libraries.EntitlementList" } } }, @@ -14517,21 +16113,20 @@ "description": "An unexpected error response." } }, - "summary": "Update Role", + "summary": "List", "tags": [ - "RolesService" + "LibrariesEntitlements" ] } }, - "/iam/v2beta1/roles/{uid}": { + "/libraries/v1/entitlements/{id}": { "delete": { - "description": "DeleteRole deletes a custom role by UID.\nFails if the role is bound to any identities.\nManaged (root-level) roles cannot be deleted.", - "operationId": "RolesService_DeleteRole", + "operationId": "Entitlements_Delete", "parameters": [ { - "description": "UID of the role to delete.", + "description": "id is the exact uidp of the entitlement to delete.", "in": "path", - "name": "uid", + "name": "id", "required": true, "schema": { "pattern": ".+", @@ -14561,32 +16156,82 @@ "description": "An unexpected error response." } }, - "summary": "Delete Role", + "summary": "Delete", "tags": [ - "RolesService" + "LibrariesEntitlements" ] - }, - "get": { - "description": "GetRole retrieves a single role by UID.", - "operationId": "RolesService_GetRole", + } + }, + "/libraries/v1/entitlements/{parentId}": { + "post": { + "operationId": "Entitlements_Create", "parameters": [ { - "description": "UID of the role to retrieve.", + "description": "parent_id is the group to create the entitlement for.", "in": "path", - "name": "uid", + "name": "parentId", "required": true, "schema": { "pattern": ".+", "type": "string" } + }, + { + "description": "policy is the libraries policy for this entitlement.\n\n - POLICY_UNKNOWN: defaults to CHAINGUARD behavior\n - POLICY_CHAINGUARD: internal packages only\n - POLICY_CHAINGUARD_AND_UPSTREAM: internal + upstream (with cooldown)", + "in": "query", + "name": "policy", + "schema": { + "default": "POLICY_UNKNOWN", + "enum": [ + "POLICY_UNKNOWN", + "POLICY_CHAINGUARD", + "POLICY_CHAINGUARD_AND_UPSTREAM" + ], + "type": "string" + } + }, + { + "description": "source indicates how this entitlement is being provisioned.\n\n - SOURCE_UNKNOWN: default; treat as SOURCE_TRIAL for backwards compatibility\n - SOURCE_TRIAL: self-service trial entitlement\n - SOURCE_SFDC: created or managed via Salesforce", + "in": "query", + "name": "source", + "schema": { + "default": "SOURCE_UNKNOWN", + "enum": [ + "SOURCE_UNKNOWN", + "SOURCE_TRIAL", + "SOURCE_SFDC" + ], + "type": "string" + } + }, + { + "description": "cooldown_days is the number of days an upstream package version must have\nbeen published before it is served. 0 means no cooldown is enforced; a\npositive value sets the cooldown to that many days. Negative values are\nrejected. Must be \u003c= 3650. The system default (when no entitlement\nspecifies a value) is 7 days.", + "in": "query", + "name": "cooldownDays", + "schema": { + "format": "int32", + "type": "integer" + } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.libraries.Ecosystem" + } + } + }, + "description": "ecosystem is the language ecosystem to entitle this group to.", + "required": true, + "x-originalParamName": "ecosystem" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.iam.v2beta1.Role" + "$ref": "#/components/schemas/chainguard.platform.libraries.Entitlement" } } }, @@ -14603,33 +16248,65 @@ "description": "An unexpected error response." } }, - "summary": "Get Role", + "summary": "Create", "tags": [ - "RolesService" + "LibrariesEntitlements" ] } }, - "/image-recommendation/v1/match": { - "post": { - "description": "MatchImage takes a list of SBOM components and returns a list of Chainguard\nimages ranked by similarity to original SBOM components", - "operationId": "ImageMatcher_MatchImage", - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.matcher.MatchImageRequest" - } + "/libraries/v1/npm/packages": { + "get": { + "operationId": "NpmPackages_List", + "parameters": [ + { + "description": "A string to search packages by. If empty, all packages\nwill be returned. When set, results are ranked by relevance.", + "in": "query", + "name": "query", + "schema": { + "type": "string" } }, - "required": true, - "x-originalParamName": "body" - }, + { + "description": "The maximum number of packages to return per request.\nThe service may return fewer than this value.", + "in": "query", + "name": "pageSize", + "schema": { + "format": "int64", + "type": "string" + } + }, + { + "description": "The token received from a previous call to List.\nProvide this to retrieve the subsequent page.", + "in": "query", + "name": "pageToken", + "schema": { + "type": "string" + } + }, + { + "description": "The source types to include. If empty, defaults to all.", + "in": "query", + "name": "sourceTypes", + "schema": { + "items": { + "enum": [ + "NPM_SOURCE_TYPE_UNKNOWN", + "NPM_SOURCE_TYPE_INTERNAL", + "NPM_SOURCE_TYPE_INTERNAL_REMEDIATED", + "NPM_SOURCE_TYPE_UPSTREAM_REGISTRY" + ], + "type": "string" + }, + "type": "array" + } + } + ], "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.matcher.MatchImageResponse" + "$ref": "#/components/schemas/chainguard.platform.libraries.NpmPackageList" } } }, @@ -14646,68 +16323,35 @@ "description": "An unexpected error response." } }, - "summary": "Match Image", + "summary": "List", "tags": [ - "ImageMatcher" + "NpmPackages" ] } }, - "/libraries/v1/artifacts": { + "/libraries/v1/npm/packages/versions": { "get": { - "operationId": "Artifacts_List", + "operationId": "NpmPackages_ListVersions", "parameters": [ { - "description": "The language ecosystems to return artifacts for.", - "in": "query", - "name": "ecosystems", - "schema": { - "items": { - "enum": [ - "UNKNOWN", - "JAVA", - "PYTHON", - "JAVASCRIPT" - ], - "type": "string" - }, - "type": "array" - } - }, - { - "description": "A string to search artifacts by. If empty, all artifacts\nfrom the given ecosystem will be returned.", - "in": "query", - "name": "query", - "schema": { - "type": "string" - } - }, - { - "description": "Specify the cuda version of the packages to return from the python ecosystem", + "description": "The npm package name to list versions for (required).", "in": "query", - "name": "cudaVersion", + "name": "packageName", "schema": { "type": "string" } }, { - "description": "Flag to return only remediated packages for the ecosystems", - "in": "query", - "name": "remediated", - "schema": { - "type": "boolean" - } - }, - { - "description": "The maximum number of artifacts to return per request.\nThe service may return fewer than this value.", + "description": "The maximum number of versions to return per request.\nThe service may return fewer than this value.", "in": "query", "name": "pageSize", "schema": { - "format": "int32", - "type": "integer" + "format": "int64", + "type": "string" } }, { - "description": "The token received from the previous call to List.\nProvide this to retrieve the subsequent page. If populated,\nall non-pagination parameters must match the call that provided this token.", + "description": "The token received from a previous call to ListVersions.\nProvide this to retrieve the subsequent page.", "in": "query", "name": "pageToken", "schema": { @@ -14715,12 +16359,20 @@ } }, { - "description": "The number of artifacts to skip ahead in the list of returned artifacts,\nbased on the state of the provided page_token. If page_token is not provided,\nthe first result returned will be number skip+1. If page_token is provided,\nthe first result returned will be (next result based on page_token)+skip.", + "description": "The source types to include. If empty, defaults to all.", "in": "query", - "name": "skip", + "name": "sourceTypes", "schema": { - "format": "int32", - "type": "integer" + "items": { + "enum": [ + "NPM_SOURCE_TYPE_UNKNOWN", + "NPM_SOURCE_TYPE_INTERNAL", + "NPM_SOURCE_TYPE_INTERNAL_REMEDIATED", + "NPM_SOURCE_TYPE_UPSTREAM_REGISTRY" + ], + "type": "string" + }, + "type": "array" } } ], @@ -14729,7 +16381,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.ArtifactList" + "$ref": "#/components/schemas/chainguard.platform.libraries.NpmPackageVersionList" } } }, @@ -14746,31 +16398,60 @@ "description": "An unexpected error response." } }, - "summary": "List", + "summary": "List Versions", "tags": [ - "Artifacts" + "NpmPackages" ] } }, - "/libraries/v1/artifacts/count": { + "/libraries/v1/policies": { "get": { - "operationId": "Artifacts_GetArtifactCount", + "description": "ListPolicies returns all policies available to the org: SYSTEM policies and\nthe org's CUSTOM policies.", + "operationId": "LibraryPolicies_ListPolicies", "parameters": [ { - "description": "The language ecosystems to request the artifact counts for.", + "description": "The org (parent) to scope policies to.", "in": "query", - "name": "ecosystems", + "name": "parentId", "schema": { - "items": { - "enum": [ - "UNKNOWN", - "JAVA", - "PYTHON", - "JAVASCRIPT" - ], - "type": "string" - }, - "type": "array" + "type": "string" + } + }, + { + "in": "query", + "name": "pageSize", + "schema": { + "format": "int32", + "type": "integer" + } + }, + { + "in": "query", + "name": "pageToken", + "schema": { + "type": "string" + } + }, + { + "description": "Exact name of the policy.", + "in": "query", + "name": "name", + "schema": { + "type": "string" + } + }, + { + "description": "Only return policies of this type (UNSPECIFIED = all).\n\n - LIBRARY_POLICY_TYPE_SYSTEM: Created and managed by Chainguard; readable but not modifiable.\n - LIBRARY_POLICY_TYPE_CUSTOM: Created and managed by your organization.", + "in": "query", + "name": "policyType", + "schema": { + "default": "LIBRARY_POLICY_TYPE_UNSPECIFIED", + "enum": [ + "LIBRARY_POLICY_TYPE_UNSPECIFIED", + "LIBRARY_POLICY_TYPE_SYSTEM", + "LIBRARY_POLICY_TYPE_CUSTOM" + ], + "type": "string" } } ], @@ -14779,7 +16460,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.GetArtifactCountResponse" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyList" } } }, @@ -14796,23 +16477,22 @@ "description": "An unexpected error response." } }, - "summary": "Get Artifact Count", + "summary": "List Policies", "tags": [ - "Artifacts" + "LibraryPolicies" ] } }, - "/libraries/v1/artifacts/{id}/versions": { - "get": { - "operationId": "Artifacts_ListVersions", + "/libraries/v1/policies/{id}": { + "delete": { + "operationId": "LibraryPolicies_DeletePolicy", "parameters": [ { - "description": "The artifact's unique identifier, as returned by ListArtifacts", "in": "path", "name": "id", "required": true, "schema": { - "pattern": "[^/]+", + "pattern": ".+", "type": "string" } } @@ -14822,7 +16502,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.ArtifactVersionList" + "type": "object" } } }, @@ -14839,48 +16519,42 @@ "description": "An unexpected error response." } }, - "summary": "List Versions", + "summary": "Delete Policy", "tags": [ - "Artifacts" + "LibraryPolicies" ] - } - }, - "/libraries/v1/entitlements": { - "get": { - "operationId": "Entitlements_List", + }, + "put": { + "description": "UpdatePolicy updates a custom policy. Returns PERMISSION_DENIED for SYSTEM\npolicies and applies the same validation as CreatePolicy.", + "operationId": "LibraryPolicies_UpdatePolicy", "parameters": [ { - "description": "parent_id is the group to list entitlements for. Required.", - "in": "query", - "name": "parentId", + "in": "path", + "name": "id", + "required": true, "schema": { + "pattern": ".+", "type": "string" } - }, - { - "description": "ecosystems are the language ecosystems to list entitlements for. If empty, all entitlements for the group will be listed.", - "in": "query", - "name": "ecosystems", - "schema": { - "items": { - "enum": [ - "UNKNOWN", - "JAVA", - "PYTHON", - "JAVASCRIPT" - ], - "type": "string" - }, - "type": "array" - } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicies.UpdatePolicyBody" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.EntitlementList" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicy" } } }, @@ -14897,20 +16571,21 @@ "description": "An unexpected error response." } }, - "summary": "List", + "summary": "Update Policy", "tags": [ - "LibrariesEntitlements" + "LibraryPolicies" ] } }, - "/libraries/v1/entitlements/{id}": { - "delete": { - "operationId": "Entitlements_Delete", + "/libraries/v1/policies/{parentId}": { + "post": { + "description": "CreatePolicy creates a custom policy under an org. expression is rejected\n(INVALID_ARGUMENT); cooldown_days above 30 is rejected; an allow-list entry\nwith bypass_malware=true requires a non-empty justification.", + "operationId": "LibraryPolicies_CreatePolicy", "parameters": [ { - "description": "id is the exact uidp of the entitlement to delete.", + "description": "The org Group UIDP under which the policy is created.", "in": "path", - "name": "id", + "name": "parentId", "required": true, "schema": { "pattern": ".+", @@ -14918,12 +16593,23 @@ } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicy" + } + } + }, + "required": true, + "x-originalParamName": "policy" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "type": "object" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicy" } } }, @@ -14940,82 +16626,75 @@ "description": "An unexpected error response." } }, - "summary": "Delete", + "summary": "Create Policy", "tags": [ - "LibrariesEntitlements" + "LibraryPolicies" ] } }, - "/libraries/v1/entitlements/{parentId}": { - "post": { - "operationId": "Entitlements_Create", + "/libraries/v1/policy-bindings": { + "get": { + "operationId": "LibraryPolicyBindings_ListBindings", "parameters": [ { - "description": "parent_id is the group to create the entitlement for.", - "in": "path", + "description": "The org (parent) to scope bindings to.", + "in": "query", "name": "parentId", - "required": true, "schema": { - "pattern": ".+", "type": "string" } }, { - "description": "policy is the libraries policy for this entitlement.\n\n - POLICY_UNKNOWN: defaults to CHAINGUARD behavior\n - POLICY_CHAINGUARD: internal packages only\n - POLICY_CHAINGUARD_AND_UPSTREAM: internal + upstream (with cooldown)", + "description": "Only return bindings for this ecosystem (UNKNOWN = all).", "in": "query", - "name": "policy", + "name": "ecosystem", "schema": { - "default": "POLICY_UNKNOWN", + "default": "UNKNOWN", "enum": [ - "POLICY_UNKNOWN", - "POLICY_CHAINGUARD", - "POLICY_CHAINGUARD_AND_UPSTREAM" + "UNKNOWN", + "JAVA", + "PYTHON", + "JAVASCRIPT" ], "type": "string" } }, { - "description": "source indicates how this entitlement is being provisioned.\n\n - SOURCE_UNKNOWN: default; treat as SOURCE_TRIAL for backwards compatibility\n - SOURCE_TRIAL: self-service trial entitlement\n - SOURCE_SFDC: created or managed via Salesforce", + "description": "Only return bindings in this mode (UNSPECIFIED = all).\n\n - LIBRARY_POLICY_BINDING_MODE_ENFORCED: Withhold packages that fail the policy.\n - LIBRARY_POLICY_BINDING_MODE_LOG: Evaluate and record violations without blocking.", "in": "query", - "name": "source", + "name": "mode", "schema": { - "default": "SOURCE_UNKNOWN", + "default": "LIBRARY_POLICY_BINDING_MODE_UNSPECIFIED", "enum": [ - "SOURCE_UNKNOWN", - "SOURCE_TRIAL", - "SOURCE_SFDC" + "LIBRARY_POLICY_BINDING_MODE_UNSPECIFIED", + "LIBRARY_POLICY_BINDING_MODE_ENFORCED", + "LIBRARY_POLICY_BINDING_MODE_LOG" ], "type": "string" } }, { - "description": "cooldown_days is the number of days an upstream package version must have\nbeen published before it is served. 0 means no cooldown is enforced; a\npositive value sets the cooldown to that many days. Negative values are\nrejected. Must be \u003c= 3650. The system default (when no entitlement\nspecifies a value) is 7 days.", "in": "query", - "name": "cooldownDays", + "name": "pageSize", "schema": { "format": "int32", "type": "integer" } + }, + { + "in": "query", + "name": "pageToken", + "schema": { + "type": "string" + } } ], - "requestBody": { - "content": { - "*/*": { - "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.Ecosystem" - } - } - }, - "description": "ecosystem is the language ecosystem to entitle this group to.", - "required": true, - "x-originalParamName": "ecosystem" - }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.Entitlement" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBindingList" } } }, @@ -15032,48 +16711,83 @@ "description": "An unexpected error response." } }, - "summary": "Create", + "summary": "List Bindings", "tags": [ - "LibrariesEntitlements" + "LibraryPolicyBindings" ] } }, - "/libraries/v1/npm/packages": { - "get": { - "operationId": "NpmPackages_List", + "/libraries/v1/policy-bindings/{id}": { + "delete": { + "operationId": "LibraryPolicyBindings_DeleteBinding", "parameters": [ { - "description": "A string to search packages by. If empty, all packages\nwill be returned. When set, results are ranked by relevance.", - "in": "query", - "name": "query", - "schema": { - "type": "string" - } - }, - { - "description": "The maximum number of packages to return per request.\nThe service may return fewer than this value.", - "in": "query", - "name": "pageSize", + "in": "path", + "name": "id", + "required": true, "schema": { - "format": "int64", + "pattern": ".+", "type": "string" } + } + ], + "responses": { + "200": { + "content": { + "application/json": { + "schema": { + "type": "object" + } + } + }, + "description": "A successful response." }, + "default": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/google.rpc.Status" + } + } + }, + "description": "An unexpected error response." + } + }, + "summary": "Delete Binding", + "tags": [ + "LibraryPolicyBindings" + ] + }, + "put": { + "operationId": "LibraryPolicyBindings_UpdateBinding", + "parameters": [ { - "description": "The token received from a previous call to List.\nProvide this to retrieve the subsequent page.", - "in": "query", - "name": "pageToken", + "in": "path", + "name": "id", + "required": true, "schema": { + "pattern": ".+", "type": "string" } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBindings.UpdateBindingBody" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.NpmPackageList" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBinding" } } }, @@ -15090,48 +16804,45 @@ "description": "An unexpected error response." } }, - "summary": "List", + "summary": "Update Binding", "tags": [ - "NpmPackages" + "LibraryPolicyBindings" ] } }, - "/libraries/v1/npm/packages/versions": { - "get": { - "operationId": "NpmPackages_ListVersions", + "/libraries/v1/policy-bindings/{parentId}": { + "post": { + "description": "CreateBinding activates a policy. Returns ALREADY_EXISTS if a binding for\nthe same (org, ecosystem, mode) already exists; use UpdateBinding instead.\nA JAVA ecosystem is rejected (INVALID_ARGUMENT) until enforcement exists.", + "operationId": "LibraryPolicyBindings_CreateBinding", "parameters": [ { - "description": "The npm package name to list versions for (required).", - "in": "query", - "name": "packageName", - "schema": { - "type": "string" - } - }, - { - "description": "The maximum number of versions to return per request.\nThe service may return fewer than this value.", - "in": "query", - "name": "pageSize", - "schema": { - "format": "int64", - "type": "string" - } - }, - { - "description": "The token received from a previous call to ListVersions.\nProvide this to retrieve the subsequent page.", - "in": "query", - "name": "pageToken", + "description": "The org Group UIDP under which the binding is created.", + "in": "path", + "name": "parentId", + "required": true, "schema": { + "pattern": ".+", "type": "string" } } ], + "requestBody": { + "content": { + "*/*": { + "schema": { + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBinding" + } + } + }, + "required": true, + "x-originalParamName": "binding" + }, "responses": { "200": { "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.libraries.NpmPackageVersionList" + "$ref": "#/components/schemas/chainguard.platform.libraries.LibraryPolicyBinding" } } }, @@ -15148,9 +16859,9 @@ "description": "An unexpected error response." } }, - "summary": "List Versions", + "summary": "Create Binding", "tags": [ - "NpmPackages" + "LibraryPolicyBindings" ] } }, @@ -15258,7 +16969,7 @@ ] } }, - "/policygates/v1/bindings": { + "/policies/v1/bindings": { "get": { "operationId": "Bindings_ListBindings", "parameters": [ @@ -15345,7 +17056,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.BindingList" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.BindingList" } } }, @@ -15368,7 +17079,7 @@ ] } }, - "/policygates/v1/bindings/{id}": { + "/policies/v1/bindings/{id}": { "delete": { "operationId": "Bindings_DeleteBinding", "parameters": [ @@ -15427,7 +17138,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Bindings.UpdateBindingBody" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Bindings.UpdateBindingBody" } } }, @@ -15439,7 +17150,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Binding" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Binding" } } }, @@ -15462,7 +17173,7 @@ ] } }, - "/policygates/v1/bindings/{parentId}": { + "/policies/v1/bindings/{parentId}": { "post": { "operationId": "Bindings_CreateBinding", "parameters": [ @@ -15480,7 +17191,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Binding" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Binding" } } }, @@ -15492,7 +17203,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Binding" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Binding" } } }, @@ -15515,7 +17226,7 @@ ] } }, - "/policygates/v1/policies": { + "/policies/v1/policies": { "get": { "operationId": "Policies_ListPolicies", "parameters": [ @@ -15610,7 +17321,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.PolicyList" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.PolicyList" } } }, @@ -15633,7 +17344,7 @@ ] } }, - "/policygates/v1/policies/{id}": { + "/policies/v1/policies/{id}": { "delete": { "operationId": "Policies_DeletePolicy", "parameters": [ @@ -15692,7 +17403,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Policies.UpdatePolicyBody" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Policies.UpdatePolicyBody" } } }, @@ -15704,7 +17415,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Policy" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Policy" } } }, @@ -15727,7 +17438,7 @@ ] } }, - "/policygates/v1/policies/{parentId}": { + "/policies/v1/policies/{parentId}": { "post": { "operationId": "Policies_CreatePolicy", "parameters": [ @@ -15746,7 +17457,7 @@ "content": { "*/*": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Policy" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Policy" } } }, @@ -15759,7 +17470,7 @@ "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/chainguard.platform.policygates.v1.Policy" + "$ref": "#/components/schemas/chainguard.platform.policies.v1.Policy" } } }, @@ -20310,6 +22021,9 @@ { "name": "ArgosDocuments" }, + { + "name": "ArgosOSV" + }, { "name": "Auth" }, @@ -20323,6 +22037,9 @@ { "name": "GroupAccountAssociations" }, + { + "name": "ExternalGroupRoleMappings" + }, { "name": "Groups" }, @@ -20355,6 +22072,15 @@ { "name": "NpmPackages" }, + { + "name": "LibraryPolicies" + }, + { + "name": "LibraryPolicyBindings" + }, + { + "name": "LibraryPolicyBlockEvents" + }, { "name": "ImageMatcher" },