Skip to content

Commit c880f76

Browse files
ashanthamaraashanthamara
authored
Merge pull request #5763 from AnuradhaSK/update-operational-scopes
Update required scopes of application and role mgt APIs
2 parents 1625a36 + 35b7b44 commit c880f76

4 files changed

Lines changed: 556 additions & 327 deletions

File tree

‎en/asgardeo/docs/apis/organization-apis/restapis/org-application-mgt.yaml‎

Lines changed: 58 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -464,8 +464,19 @@ paths:
464464
Authorized an API to the application.
465465
operationId: addAuthorizedAPI
466466
description: |
467-
This API provides the capability to authorized an API to the application. <br>
468-
<b>Scope(Permission) required:</b> `internal_org_application_mgt_update`
467+
This API provides the capability to authorized an API to the application.
468+
469+
<b>Scope(Permission) required:</b>
470+
- `internal_org_application_mgt_update`
471+
472+
<b>➕ Additional Scopes</b>
473+
474+
To authorize organization APIs and business APIs, you also need the following additional scopes:
475+
476+
| Action | Scope |
477+
|---------|--------|
478+
| Authorize organization API | `internal_org_application_internal_api_update` |
479+
| Authorize business APIs | `internal_org_application_business_api_update` |
469480
parameters:
470481
- name: applicationId
471482
in: path
@@ -522,7 +533,18 @@ paths:
522533
operationId: patchAuthorizedAPI
523534
description: |
524535
This API provides the capability to update an authorized API of the application. <br>
525-
<b>Scope(Permission) required:</b> `internal_org_application_mgt_update`
536+
537+
<b>Scope(Permission) required:</b>
538+
- `internal_org_application_mgt_update`
539+
540+
<b>➕ Additional Scopes</b>
541+
542+
To update authorized organization APIs and business APIs, you also need the following additional scopes:
543+
544+
| Action | Scope |
545+
|---------|--------|
546+
| Update authorized organization API | `internal_org_application_internal_api_update` |
547+
| Update authorized business APIs | `internal_org_application_business_api_update` |
526548
parameters:
527549
- name: applicationId
528550
in: path
@@ -585,7 +607,18 @@ paths:
585607
operationId: deleteAuthorizedAPI
586608
description: |
587609
This API provides the capability to delete an authorized API of the application. <br>
588-
<b>Scope(Permission) required:</b> `internal_org_application_mgt_update`
610+
611+
<b>Scope(Permission) required:</b>
612+
- `internal_org_application_mgt_update`
613+
614+
<b>➕ Additional Scopes</b>
615+
616+
To remove authorized organization APIs and business APIs, you also need the following additional scopes:
617+
618+
| Action | Scope |
619+
|---------|--------|
620+
| Remove authorized organization API | `internal_org_application_internal_api_update` |
621+
| Remove authorized business APIs | `internal_org_application_business_api_update` |
589622
parameters:
590623
- name: applicationId
591624
in: path
@@ -676,9 +709,19 @@ paths:
676709
- Inbound Protocols - OAuth / OIDC
677710
summary: |
678711
Retrieve OIDC authentication protocol parameters.
679-
description: >
712+
description: |
680713
This API provides the capability to retrieve OIDC authentication protocol parameters of an application. <br>
681-
<b>Scope(Permission) required:</b> `internal_org_application_mgt_view`
714+
715+
<b>Scope(Permission) required:</b>
716+
- `internal_org_application_mgt_view`
717+
718+
<b>➕ Additional Scopes</b>
719+
720+
To view the client secret, you also need the following additional scope:
721+
722+
| Action | Scope |
723+
|---------|--------|
724+
| View client secret | `internal_org_application_mgt_client_secret_view` |
682725
operationId: getInboundOAuthConfiguration
683726
parameters:
684727
- name: applicationId
@@ -887,7 +930,8 @@ paths:
887930
Regenerate the OAuth2/OIDC client secret.
888931
description: |
889932
This API regenerates the OAuth2/OIDC client secret. <br>
890-
<b>Scope(Permission) required:</b> `internal_org_application_mgt_create`
933+
934+
<b>Scope(Permission) required:</b> `internal_org_application_mgt_client_secret_create`
891935
operationId: regenerateOAuthClientSecret
892936
parameters:
893937
- name: applicationId
@@ -1911,18 +1955,15 @@ components:
19111955
example: 3600
19121956
bindingType:
19131957
type: string
1914-
description: "OAuth2 access token and refresh token can be bound to an external attribute during the token
1915-
generation so that it can be optionally validated during the API invocation."
1958+
description: "OAuth2 access token and refresh token can be bound to an external attribute during the token generation so that it can be optionally validated during the API invocation."
19161959
default: "None"
19171960
example: cookie
19181961
revokeTokensWhenIDPSessionTerminated:
19191962
type: boolean
1920-
description: "If enabled, when the IDP session is terminated, all the access tokens bound to the session
1921-
will get revoked."
1963+
description: "If enabled, when the IDP session is terminated, all the access tokens bound to the session will get revoked."
19221964
validateTokenBinding:
19231965
type: boolean
1924-
description: "If enabled, both access token and the token binding needs to be present for a successful API
1925-
invocation."
1966+
description: "If enabled, both access token and the token binding needs to be present for a successful API invocation."
19261967
accessTokenAttributes:
19271968
type: array
19281969
items:
@@ -2045,8 +2086,10 @@ components:
20452086
type:
20462087
type: string
20472088
description: "
2048-
- DEFAULT type indicates that the application will use the default authentication sequence specified at the tenant level. When the DEFAULT type is used, the information given in the other fields of the AuthenticationSequence will be ignored and overriden with values defined at the tenant level.
2049-
- USER_DEFINED type indicates that the application will use a user-defined authentication sequence."
2089+
<ul>
2090+
<li> <b>DEFAULT</b> type indicates that the application will use the default authentication sequence specified at the organization level. When the DEFAULT type is used, the information given in the other fields of the `AuthenticationSequence` will be ignored and overriden with values defined at the organization level.</li>
2091+
<li> <b>USER_DEFINED</b> type indicates that the application will use a user-defined authentication sequence.</li>
2092+
</ul>"
20502093
enum:
20512094
- DEFAULT
20522095
- USER_DEFINED

‎en/asgardeo/docs/apis/organization-apis/restapis/role-management.yaml‎

Lines changed: 50 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1-
openapi: 3.0.1
1+
openapi: 3.0.0
22
info:
33
title: Asgardeo - SCIM 2.0 Roles V2 API
4+
version: v2
45
description: |
56
This is the RESTful API for SCIM 2.0 Roles API in Asgardeo organizations.
67
This API allows listing roles and updating users and groups of the roles.
@@ -91,12 +92,24 @@ paths:
9192
tags:
9293
- Roles Endpoint
9394
summary: Create Role
94-
description: >
95+
description: |
9596
This API creates a role and returns the details of the created role
9697
including its unique ID. These roles can only be associated with the
9798
applications which are created in the organization level. You cannot
9899
use these roles with the shared applications from the root organization.
99-
<b>Scope(Permission) required:</b> `internal_org_role_mgt_create`
100+
101+
<b>Scope(Permission) required:</b>
102+
- `internal_org_role_mgt_create`
103+
104+
<b>➕ Additional Scopes</b>
105+
106+
To assign permissions, users, or groups to the role you create, you also need the following additional scopes:
107+
108+
| Action | Scope |
109+
|---------|--------|
110+
| Assign permissions | `internal_org_role_mgt_permissions_update` |
111+
| Assign users | `internal_org_role_mgt_users_update` |
112+
| Assign groups | `internal_org_role_mgt_groups_update` |
100113
operationId: createRoleV2
101114
requestBody:
102115
content:
@@ -283,10 +296,23 @@ paths:
283296
tags:
284297
- Roles Endpoint
285298
summary: Update Role - PUT
286-
description: "This API updates the **assigned users and groups** of the role.\
287-
\ \n**Role name, role audience, role permissions and associated applications**\
288-
\ cannot be updated through this API.\n\n<b>Scope(Permission) required:</b>\
289-
\ `internal_org_role_mgt_update`\n"
299+
description: |
300+
This API updates the **assigned users and groups** of a shared and non-shared roles.<br>
301+
Also, you can update role name, permissions of non-shared roles.<br>
302+
**Role audience and associated applications** can't be updated through this API.
303+
304+
<b>Scope(Permission) required:</b>
305+
- `internal_org_role_mgt_update`
306+
307+
<b>➕ Additional Scopes</b>
308+
309+
To update permissions, users, or groups assignments of the role, you also need the following additional scopes:
310+
311+
| Action | Scope |
312+
|---------|--------|
313+
| Update permissions | `internal_org_role_mgt_permissions_update` |
314+
| Update users | `internal_org_role_mgt_users_update` |
315+
| Update groups | `internal_org_role_mgt_groups_update` |
290316
operationId: updateRoleV2
291317
parameters:
292318
- name: id
@@ -432,10 +458,23 @@ paths:
432458
tags:
433459
- Roles Endpoint
434460
summary: Update Role - PATCH
435-
description: "This API updates the **assigned users and groups** of the role.\
436-
\ \n**Role name, role audience, role permissions and associated applications**\
437-
\ cannot be updated through this API.\n\n<b>Scope(Permission) required:</b>\
438-
\ `internal_org_role_mgt_update`\n"
461+
description: |
462+
This API updates the **assigned users and groups** of shared and non shared roles.<br>
463+
You can also update the role name and the permissions of non shared roles.<br>
464+
**Role audience and associated applications** cannot be updated through this API.
465+
466+
<b>Scope(Permission) required:</b>
467+
- `internal_org_role_mgt_update`
468+
469+
<b>➕ Additional Scopes</b>
470+
471+
To update permissions, users, or groups assignments of the role, you also need the following additional scopes:
472+
473+
| Action | Scope |
474+
|---------|--------|
475+
| Update permissions | `internal_org_role_mgt_permissions_update` |
476+
| Update users | `internal_org_role_mgt_users_update` |
477+
| Update groups | `internal_org_role_mgt_groups_update` |
439478
operationId: patchRole
440479
parameters:
441480
- name: id

0 commit comments

Comments
 (0)